# changelog

author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-315.196.5.el8uek]
changelog:
  - uek-rpm: add "bpf" to CONFIG_LSM (Alan Maguire) [Orabug: 35653191]
  - Revert "cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry" (Samasth Norway Ananda) [Orabug: 38613264]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-315.196.5.1.el8uek]
changelog:
  - netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)  [Orabug: 38744086]  {CVE-2025-38678} 
  - Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha)  [Orabug: 38744084]  
  - rtc: expose RTC_FEATURE_UPDATE_INTERRUPT (Alexandre Belloni)  [Orabug: 38744082]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-315.196.5.1.el8uek]
changelog:
  - netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)  [Orabug: 38744086]  {CVE-2025-38678}
  - Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha)  [Orabug: 38744084]
  - rtc: expose RTC_FEATURE_UPDATE_INTERRUPT (Alexandre Belloni)  [Orabug: 38744082]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-315.196.5.2.el8uek]
changelog:
  - tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima)  [Orabug: 38786195]  {CVE-2025-40280} 
  - fs/proc: fix uaf in proc_readdir_de() (Wei Yang)  [Orabug: 38786194]  {CVE-2025-40271} 
  - vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj)  [Orabug: 38786193]  {CVE-2025-40248}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-315.196.3.el8uek]
changelog:
  - KVM: VMX: Intercept reads to invalid and write-only x2APIC registers (Sean Christopherson) [Orabug: 38535186]
  - KVM: VMX: Always intercept accesses to unsupported "extended" x2APIC regs (Sean Christopherson) [Orabug: 38535186]
  - KVM: x86: Split out logic to generate "readable" APIC regs mask to helper (Sean Christopherson) [Orabug: 38535186]
  - KVM: x86: Mark x2APIC DFR reg as non-existent for x2APIC (Sean Christopherson) [Orabug: 38535186]
  - uek-rpm/ol9/config-mips64-emb: Enable NF_TABLES for MIPS64 (Vijay Kumar) [Orabug: 38578981]
  - LTS version: v5.15.196 (Vijayendra Suman)
  - PCI: rcar: Demote WARN() to dev_warn_ratelimited() in rcar_pcie_wakeup() (Marek Vasut) [Orabug: 38641258] {CVE-2024-43876}
  - net: rtnetlink: fix module reference count leak issue in rtnetlink_rcv_msg (Zhengchao Shao)
  - usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai) [Orabug: 38601854] {CVE-2025-40094}
  - usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai) [Orabug: 38601837] {CVE-2025-40092}
  - usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
  - usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
  - arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (Kaushlendra Kumar)
  - xfs: always warn about deprecated mount options (Darrick J. Wong)
  - devcoredump: Fix circular locking dependency with devcd->mutex. (Maarten Lankhorst)
  - PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
  - PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
  - PCI: rcar: Finish transition to L1 state in rcar_pcie_config_access() (Marek Vasut)
  - PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
  - f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
  - NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601818] {CVE-2025-40087}
  - vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601923] {CVE-2025-40105}
  - drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
  - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
  - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
  - PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
  - PCI: j721e: Enable ACSPCIE Refclk if "ti,syscon-acspcie-proxy-ctrl" exists (Siddharth Vadapalli)
  - fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong) [Orabug: 38730516] {CVE-2025-40220}
  - fuse: allocate ff->release_args only if release is needed (Amir Goldstein)
  - padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
  - iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
  - PM: runtime: Add new devm functions (Csókás Bence)
  - iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
  - iio: imu: inv_icm42600: use = { } instead of memset() (David Lechner)
  - NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
  - NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
  - NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
  - xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
  - xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
  - s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
  - arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
  - serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 (Florian Eckert)
  - most: usb: hdm_probe: Fix calling put_device() before device initialization (Victoria Votokina)
  - most: usb: Fix use-after-free in hdm_disconnect (Victoria Votokina)
  - mei: me: add wildcat lake P DID (Alexander Usyskin)
  - comedi: fix divide-by-zero in comedi_buf_munge() (Deepanshu Kartikey)
  - binder: remove "invalid inc weak" check (Alice Ryhl)
  - xhci: dbc: enable back DbC in resume if it was enabled before suspend (Mathias Nyman)
  - usb: raw-gadget: do not limit transfer length (Andrey Konovalov)
  - usb/core/quirks: Add Huawei ME906S to wakeup quirk (Tim Guttzeit)
  - USB: serial: option: add Telit FN920C04 ECM compositions (Li Qingwu)
  - USB: serial: option: add Quectel RG255C (Reinhard Speyerer)
  - USB: serial: option: add UNISOC UIS7720 (Renjun Wang)
  - net: ravb: Ensure memory write completes before ringing TX doorbell (Lad Prabhakar)
  - net: usb: rtl8150: Fix frame padding (Michał Pecio)
  - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [Orabug: 38730748] {CVE-2025-40231}
  - ocfs2: clear extent cache after moving/defragmenting extents (Deepanshu Kartikey) [Orabug: 38730546] {CVE-2025-40233}
  - MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering (Maciej W. Rozycki)
  - Revert "cpuidle: menu: Avoid discarding useful information" (Rafael J. Wysocki)
  - net: bonding: fix possible peer notify event loss or dup issue (Tonghao Zhang)
  - sctp: avoid NULL dereference when chunk data buffer is missing (Alexey Simakov) [Orabug: 38730566] {CVE-2025-40240}
  - arm64, mm: avoid always making PTE dirty in pte_mkwrite() (Huang, Ying)
  - dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path (Ioana Ciornei)
  - net: enetc: correct the value of ENETC_RXB_TRUESIZE (Wei Fang)
  - rtnetlink: Allow deleting FDB entries in user namespace (Johannes Wiesboeck)
  - net: rtnetlink: add NLM_F_BULK support to rtnl_fdb_del (Nikolay Aleksandrov)
  - net: rtnetlink: add bulk delete support flag (Nikolay Aleksandrov)
  - net: netlink: add NLM_F_BULK delete request modifier (Nikolay Aleksandrov)
  - net: rtnetlink: use BIT for flag values (Nikolay Aleksandrov)
  - net: rtnetlink: add helper to extract msg type's kind (Nikolay Aleksandrov)
  - m68k: bitops: Fix find_*_bit() signatures (Geert Uytterhoeven)
  - hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() (Yangtao Li)
  - hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() (Viacheslav Dubeyko)
  - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring)
  - hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (Viacheslav Dubeyko)
  - hfs: validate record offset in hfsplus_bmap_alloc (Yang Chenzhi)
  - hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() (Viacheslav Dubeyko)
  - hfs: make proper initalization of struct hfs_find_data (Viacheslav Dubeyko)
  - hfs: clear offset and space out of valid records in b-tree node (Viacheslav Dubeyko)
  - nios2: ensure that memblock.current_limit is set when setting pfn limits (Simon Schuster)
  - exec: Fix incorrect type for ret (Xichao Zhao)
  - PCI/sysfs: Ensure devices are powered for config reads (part 2) (Brian Norris)
  - hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
  - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597093] {CVE-2025-40085}
  - ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
  - sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
  - sched/balancing: Rename newidle_balance() => sched_balance_newidle() (Ingo Molnar)
  - drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
  - net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset (I Viswanath)
  - net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
  - net: usb: use eth_hw_addr_set() instead of ether_addr_copy() (Jakub Kicinski)
  - tls: don't rely on tx_work during send() (Sabrina Dubroca)
  - tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
  - tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
  - net: tls: wait for async completion on last message (Sascha Hauer)
  - tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
  - tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
  - amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
  - net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov) [Orabug: 38649259] {CVE-2025-40173}
  - r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
  - doc: fix seg6_flowlabel path (Nicolas Dichtel)
  - net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
  - can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
  - dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
  - HID: multitouch: fix sticky fingers (Benjamin Tissoires)
  - cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
  - crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
  - drm/exynos: exynos7_drm_decon: remove ctx->suspended (Kaustabh Chakraborty)
  - drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
  - drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
  - blk-crypto: fix missing blktrace bio split events (Yu Kuai)
  - media: lirc: Fix error handling in lirc_register() (Ma Ke)
  - media: rc: Directly use ida_free() (Keliu)
  - media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
  - btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
  - ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey) [Orabug: 38649222] {CVE-2025-40167}
  - jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
  - r8152: add error handling in rtl8152_driver_init (Yi Cong)
  - LTS version: v5.15.195 (Vijayendra Suman)
  - selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
  - mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
  - media: pci: ivtv: Add check for DMA map result (Mikhail Kobuk) [Orabug: 38641260] {CVE-2024-43877}
  - xen/events: Update virq_to_irq on migration (Jason Andryuk)
  - media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
  - media: pci/ivtv: switch from 'pci_' to 'dma_' API (Christophe Jaillet)
  - arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
  - media: cx18: Add missing check after DMA map (Thomas Fourier)
  - media: switch from 'pci_' to 'dma_' API (Christophe Jaillet)
  - writeback: Avoid excessively long inode switching times (Jan Kara)
  - writeback: Avoid softlockup when switching many inodes (Jan Kara)
  - cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
  - fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
  - pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17) [Orabug: 38649275] {CVE-2025-40178}
  - minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
  - minmax.h: remove some #defines that are only expanded once (David Laight)
  - minmax.h: simplify the variants of clamp() (David Laight)
  - minmax.h: move all the clamp() definitions after the min/max() ones (David Laight)
  - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() (David Laight)
  - minmax.h: reduce the #define expansion of min(), max() and clamp() (David Laight)
  - minmax.h: update some comments (David Laight)
  - minmax.h: add whitespace around operators and after commas (David Laight)
  - minmax: fix up min3() and max3() too (Linus Torvalds)
  - minmax: improve macro expansion and type checking (Linus Torvalds)
  - minmax: simplify min()/max()/clamp() implementation (Linus Torvalds)
  - minmax: don't use max() in situations that want a C constant expression (Linus Torvalds)
  - minmax: make generic MIN() and MAX() macros available everywhere (Linus Torvalds)
  - minmax: simplify and clarify min_t()/max_t() implementation (Linus Torvalds)
  - minmax: add a few more MIN_T/MAX_T users (Linus Torvalds)
  - minmax: avoid overly complicated constant expressions in VM code (Linus Torvalds)
  - minmax: fix indentation of __cmp_once() and __clamp_once() (David Laight)
  - minmax: deduplicate __unconst_integer_typeof() (Andy Shevchenko)
  - minmax: Introduce {min,max}_array() (Herve Codina)
  - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
  - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
  - fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
  - dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing) [Orabug: 38649056] {CVE-2025-40134}
  - tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592032] {CVE-2025-40042}
  - ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
  - net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel) [Orabug: 38649002] {CVE-2025-40120}
  - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
  - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
  - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
  - media: mc: Clear minor number before put device (Edward Adam Davis) [Orabug: 38649397] {CVE-2025-40197}
  - Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher) [Orabug: 38649424] {CVE-2025-40200}
  - Squashfs: add additional inode sanity checking (Phillip Lougher)
  - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
  - ASoC: codecs: wcd934x: Simplify with dev_err_probe (Krzysztof Kozlowski)
  - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591958] {CVE-2025-40026}
  - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
  - ext4: free orphan info with kvfree (Jan Kara)
  - ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag) [Orabug: 38649329] {CVE-2025-40190}
  - ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
  - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
  - ext4: verify orphan file size is not too big (Jan Kara) [Orabug: 38649284] {CVE-2025-40179}
  - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
  - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
  - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
  - x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
  - x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
  - spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
  - spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
  - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
  - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
  - PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
  - PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
  - PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
  - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle) [Orabug: 38730511] {CVE-2025-40219}
  - PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
  - rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
  - rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
  - rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
  - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
  - mmc: core: SPI mode remove cmd7 (Rex Chen)
  - mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
  - sparc: fix error handling in scan_one_device() (Ma Ke)
  - sparc64: fix hugetlb for sun4u (Anthony Yznaga)
  - sctp: Fix MAC comparison to be constant-time (Eric Biggers) [Orabug: 38649450] {CVE-2025-40204}
  - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
  - pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
  - powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
  - powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
  - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
  - parisc: don't reference obsolete termio struct for TC* constants (Sam James)
  - openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
  - lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
  - KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
  - iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
  - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
  - init: handle bootloader identifier in kernel parameters (Huacai Chen)
  - iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
  - iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
  - iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
  - fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
  - crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
  - cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki) [Orabug: 38649365] {CVE-2025-40194}
  - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) (Simon Schuster)
  - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
  - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento) [Orabug: 38649461] {CVE-2025-40205}
  - drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
  - media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
  - firmware: meson_sm: fix device leak at probe (Johan Hovold)
  - xen/manage: Fix suspend error path (Lukas Wunner)
  - xen/events: Cleanup find_virq() return codes (Jason Andryuk)
  - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
  - arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
  - ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
  - ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
  - bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
  - gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
  - gpio: wcd934x: Remove duplicate assignment of of_gpio_n_cells (Andy Shevchenko)
  - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
  - crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581454,38705933] {CVE-2025-40019}
  - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
  - drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
  - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
  - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
  - drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
  - bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann) [Orabug: 38649299] {CVE-2025-40183}
  - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
  - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
  - tools build: Align warning options with perf (Leo Yan)
  - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
  - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima) [Orabug: 38649578] {CVE-2025-40186}
  - net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov) [Orabug: 38649311] {CVE-2025-40187}
  - drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes) [Orabug: 38643545] {CVE-2025-40111}
  - drm/vmwgfx: Copy DRM hash-table code into driver (Thomas Zimmermann)
  - s390/cio: unregister the subchannel while purging (Vineeth Vijayan)
  - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
  - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557653] {CVE-2025-40001}
  - scsi: mvsas: Use sas_task_find_rq() for tagging (John Garry)
  - scsi: mvsas: Delete mvs_tag_init() (John Garry)
  - scsi: libsas: Add sas_task_find_rq() (John Garry)
  - cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
  - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
  - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
  - perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
  - rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
  - perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
  - clk: at91: peripheral: fix return value (Brian Masney)
  - libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
  - perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
  - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
  - clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
  - fs: always return zero on success from replace_fd() (Thomas Weißschuh)
  - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
  - bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
  - pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591980] {CVE-2025-40030}
  - Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38592000] {CVE-2025-40035}
  - Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
  - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
  - mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi) [Orabug: 38649149] {CVE-2025-40153}
  - ext4: fix checks for orphan inodes (Jan Kara)
  - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
  - net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
  - fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592047] {CVE-2025-40044}
  - uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592066] {CVE-2025-40048}
  - Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592076] {CVE-2025-40049}
  - net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592097] {CVE-2025-40053}
  - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
  - nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
  - drivers/base/node: fix double free in register_one_node() (Donet Tom)
  - ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592109] {CVE-2025-40055}
  - hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
  - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
  - net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath) [Orabug: 38649095] {CVE-2025-40140}
  - RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
  - usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
  - scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar) [Orabug: 38648980] {CVE-2025-40115}
  - ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581444] {CVE-2025-40018}
  - NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
  - coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
  - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
  - sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
  - sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
  - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
  - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
  - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
  - wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
  - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
  - IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
  - RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
  - Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
  - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
  - scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
  - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
  - wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
  - RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
  - drivers/base/node: handle error properly in register_one_node() (Donet Tom)
  - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
  - netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
  - iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
  - fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
  - ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai) [Orabug: 38649006] {CVE-2025-40121}
  - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai) [Orabug: 38649156] {CVE-2025-40154}
  - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
  - pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592169] {CVE-2025-40070}
  - misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
  - usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
  - usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
  - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
  - tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
  - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation (Alok Tiwari)
  - wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
  - drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
  - ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
  - media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
  - scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
  - scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel) [Orabug: 38649566] {CVE-2025-40118}
  - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
  - drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
  - i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
  - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
  - thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
  - thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
  - tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
  - smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
  - bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592204] {CVE-2025-40078}
  - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
  - i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
  - nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner) [Orabug: 38649248] {CVE-2025-40171}
  - pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
  - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
  - firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
  - pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
  - PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
  - block: use int to store blk_stack_limits() return value (Rong Qianfeng)
  - regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
  - ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
  - blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan) [Orabug: 38649025] {CVE-2025-40125}
  - pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
  - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
  - ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
  - cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
  - libbpf: Fix reuse of DEVMAP (Yureka Lilian)
  - regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
  - x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
  - perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592220] {CVE-2025-40081}
  - coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
  - selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
  - filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
  - net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591964] {CVE-2025-40027}
  - minmax: add in_range() macro (Matthew Wilcox)
  - crypto: rng - Ensure set_ent is always present (Herbert Xu) [Orabug: 38643530] {CVE-2025-40109}
  - platform/x86: int3472: Check for adev == NULL (Hans de Goede)
  - driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
  - staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
  - staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
  - serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
  - hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
  - perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
  - dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
  - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
  - USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
  - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
  - media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou) [Orabug: 38548036] {CVE-2025-39994}
  - media: tunner: xc5000: Refactor firmware load (Ricardo Ribalda)
  - udp: Fix memory accounting leak. (Kuniyuki Iwashima) [Orabug: 37844324] {CVE-2025-22058}
  - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence (Will Deacon) [Orabug: 38513233]
  - media: rc: fix races with imon_disconnect() (Larshin Sergey) [Orabug: 38548026] {CVE-2025-39993}
  - media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou) [Orabug: 38548050] {CVE-2025-39996}
  - scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran) [Orabug: 38548058] {CVE-2025-39998}
  - LTS version: v5.15.194 (Vijayendra Suman)
  - drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)
  - i40e: add validation for ring_len param (Lukasz Czapnik) [Orabug: 38547951,38603025,38607608] {CVE-2025-39973}
  - i40e: increase max descriptors for XL710 (Justin Bronder)
  - i40e: fix idx validation in config queues msg (Lukasz Czapnik) [Orabug: 38547937] {CVE-2025-39971}
  - i40e: fix validation of VF state in get resources (Lukasz Czapnik) [Orabug: 38547928] {CVE-2025-39969}
  - mm/hugetlb: fix folio is still mapped when deleted (Tu Jinjiang) [Orabug: 38560480] {CVE-2025-40006}
  - mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize() (David Hildenbrand)
  - fbcon: Fix OOB access in font allocation (Thomas Zimmermann)
  - fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda) [Orabug: 38547912] {CVE-2025-39967}
  - tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu) [Orabug: 38581470] {CVE-2025-40021}
  - i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)
  - i40e: add max boundary check for VF filters (Lukasz Czapnik) [Orabug: 38547922] {CVE-2025-39968}
  - i40e: fix input validation logic for action_meta (Lukasz Czapnik) [Orabug: 38547932] {CVE-2025-39970}
  - i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik) [Orabug: 38547945] {CVE-2025-39972}
  - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers) [Orabug: 38641289] {CVE-2025-40022}
  - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu) [Orabug: 38537468,38575792,38575804] {CVE-2025-39964}
  - drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita) [Orabug: 38560495] {CVE-2025-40011}
  - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir Oltean)
  - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)
  - net: dsa: lantiq_gswip: do also enable or disable cpu port (Martin Schiller)
  - selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)
  - nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel) [Orabug: 38547971] {CVE-2025-39980}
  - bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)
  - ethernet: rvu-af: Remove slash from the driver name (Petr Malat)
  - can: peak_usb: fix shift-out-of-bounds issue (Stephane Grosjean) [Orabug: 38581461] {CVE-2025-40020}
  - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
  - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
  - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
  - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
  - can: etas_es58x: sort the includes by alphabetic order (Vincent Mailhol)
  - can: etas_es58x: advertise timestamping capabilities and add ioctl support (Vincent Mailhol)
  - can: dev: add generic function can_eth_ioctl_hwts() (Vincent Mailhol)
  - can: dev: add generic function can_ethtool_op_get_ts_info_hwts() (Vincent Mailhol)
  - can: bittiming: replace CAN units with the generic ones from linux/units.h (Vincent Mailhol)
  - can: bittiming: allow TDC{V,O} to be zero and add can_tdc_const::tdc{v,o,f}_min (Vincent Mailhol)
  - bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)
  - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)
  - arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)
  - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)
  - usb: core: Add 0x prefix to quirks debug output (Jiayi Li)
  - ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)
  - ALSA: usb-audio: Convert comma to semicolon (Chen Ni)
  - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)
  - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)
  - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)
  - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)
  - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)
  - ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)
  - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer (Hans de Goede)
  - net: rfkill: gpio: add DT support (Philipp Zabel)
  - mptcp: propagate shutdown to subflows when possible (Matthieu Baerts)
  - ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer (Namjae Jeon)
  - mptcp: set remote_deny_join_id0 on SYN recv (Matthieu Baerts)
  - phy: ti: omap-usb2: fix device leak at unbind (Johan Hovold)
  - phy: Use device_get_match_data() (Rob Herring)
  - phy: broadcom: ns-usb3: fix Wvoid-pointer-to-enum-cast warning (Krzysztof Kozlowski)
  - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels (Alan Stern)
  - usb: gadget: dummy_hcd: remove usage of list iterator past the loop body (Jakob Koschel)
  - xhci: dbc: Fix full DbC transfer ring after several reconnects (Mathias Nyman)
  - xhci: dbc: decouple endpoint allocation from initialization (Mathias Nyman)
  - serial: sc16is7xx: fix bug in flow control levels init (Hugo Villeneuve)
  - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path (Qi Xi)
  - drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ (Loic Poulain)
  - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message (Colin Ian King)
  - ASoC: wm8974: Correct PLL rate rounding (Charles Keepax)
  - ASoC: wm8940: Correct typo in control name (Charles Keepax)
  - mmc: mvsdio: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - btrfs: tree-checker: fix the incorrect inode ref size check (Qu Wenruo)
  - power: supply: bq27xxx: restrict no-battery detection to bq27000 (H. Nikolaus Schaller)
  - power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery (H. Nikolaus Schaller)
  - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* (Nathan Chancellor)
  - cnic: Fix use-after-free bugs in cnic_delete_task (Duoming Zhou) [Orabug: 38503848] {CVE-2025-39945}
  - net: liquidio: fix overflow in octeon_init_instr_queue() (Alexey Nepomnyashih)
  - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Kuniyuki Iwashima) [Orabug: 38526387] {CVE-2025-39955}
  - i40e: remove redundant memory barrier when cleaning Tx descs (Maciej Fijalkowski)
  - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure (Moon Yeounsu)
  - qed: Don't collect too many protection override GRC elements (Jamie Bainbridge) [Orabug: 38503869] {CVE-2025-39949}
  - dpaa2-switch: fix buffer pool seeding for control traffic (Ioana Ciornei)
  - um: virtio_uml: Fix use-after-free after put_device in probe (Miaoqian Lin)
  - cgroup: split cgroup_destroy_wq into 3 workqueues (Chen Ridong) [Orabug: 38503891] {CVE-2025-39953}
  - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch (Geert Uytterhoeven)
  - wifi: mac80211: fix incorrect type for ret (Liao Yuanhong)
  - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported (Takashi Sakamoto)
  - net: hsr: hsr_slave: Fix the promiscuous mode in offload mode (Ravi Gunasekaran)
  - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Miaohe Lin) [Orabug: 38461847] {CVE-2025-39883}
  - drm/i915/power: fix size for for_each_set_bit() in abox iteration (Jani Nikula)
  - phy: ti-pipe3: fix device leak at unbind (Johan Hovold)
  - phy: tegra: xusb: fix device and OF node leak at probe (Johan Hovold)
  - dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees (Stephan Gerhold) [Orabug: 38494821] {CVE-2025-39923}
  - regulator: sy7636a: fix lifecycle of power good gpio (Andreas Kemnade)
  - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (Anders Roxell)
  - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr (Hangbin Liu)
  - hsr: use rtnl lock when iterating over ports (Hangbin Liu)
  - net: hsr: Add VLAN CTAG filter support (Murali Karicheri)
  - net: hsr: Add support for MC filtering at the slave device (Murali Karicheri)
  - net: hsr: Disable promiscuous mode in offload mode (Ravi Gunasekaran)
  - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB (Anssi Hannula)
  - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails (Tetsuo Handa)
  - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed (Tetsuo Handa)
  - i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (Michal Schmidt) [Orabug: 38494786] {CVE-2025-39911}
  - i40e: Use irq_update_affinity_hint() (Nitesh Narayan Lal)
  - igb: fix link test skipping when interface is admin down (Kohei Enju)
  - tunnels: reset the GSO metadata before reusing the skb (Antoine Tenart)
  - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (Stefan Wahren)
  - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
  - USB: serial: option: add Telit Cinterion FN990A w/audio compositions (Fabio Porcedda)
  - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks (Krzysztof Kozlowski)
  - tty: hvc_console: Call hvc_kick in hvc_write unconditionally (Fabian Vogt)
  - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
  - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer (Christophe Kerello)
  - mtd: rawnand: stm32_fmc2: Fix dma_map_sg error check (Jack Wang)
  - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing (Alexander Sverdlin)
  - mtd: nand: raw: atmel: Fix comment in timings preparation (Alexander Dahl)
  - mm/khugepaged: fix the address passed to notifier on testing young (Wei Yang)
  - libceph: fix invalid accesses to ceph_connection_v1_info (Ilya Dryomov) [Orabug: 38461836] {CVE-2025-39880}
  - fuse: prevent overflow in copy_file_range return value (Miklos Szeredi)
  - fuse: check if copy_file_range() returns larger than requested size (Miklos Szeredi)
  - mtd: rawnand: stm32_fmc2: fix ECC overwrite (Christophe Kerello)
  - ocfs2: fix recursive semaphore deadlock in fiemap call (Mark Tinguely) [Orabug: 38461858] {CVE-2025-39885}
  - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN (Krister Johansen)
  - compiler-clang.h: define __SANITIZE_*__ macros only when undefined (Nathan Chancellor)
  - EDAC/altera: Delete an inappropriate dma_free_coherent() call (Salah Triki)
  - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. (Kuniyuki Iwashima) [Orabug: 38494796] {CVE-2025-39913}
  - NFSv4/flexfiles: Fix layout merge mirror check. (Jonathan Curley)
  - tracing: Fix tracing_marker may trigger page fault during preempt_disable (Luo Gengkun)
  - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server (Trond Myklebust)
  - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set (Trond Myklebust)
  - mm/rmap: reject hugetlb folios in folio_make_device_exclusive() (David Hildenbrand)
  - net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod. (Kuniyuki Iwashima) [Orabug: 37901603] {CVE-2025-23143}
  - media: i2c: imx214: Fix link frequency validation (André Apitzsch)
  - media: mtk-vcodec: venc: avoid -Wenum-compare-conditional warning (Arnd Bergmann)
  - mm: introduce and use {pgd,p4d}_populate_kernel() (Harry Yoo)
  - kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
  - xfs: short circuit xfs_growfs_data_private() if delta is zero (Eric Sandeen)
  - Revert "fbdev: Disable sysfb device registration when removing conflicting FBs" (Brett A C Sheffield)


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-316.196.1.el8uek]
changelog:
  - uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu) [Orabug: 38609547]
  - bnxt_en: Fix memory corruption when FW resources change during ifdown (Sreekanth Reddy) [Orabug: 38440240] {CVE-2025-39810}
  - selftests/proc: add PROCMAP_QUERY ioctl tests (Andrii Nakryiko) [Orabug: 38410775]
  - tools: sync uapi/linux/fs.h header into tools subdir (Andrii Nakryiko) [Orabug: 38410775]
  - docs/procfs: call out ioctl()-based PROCMAP_QUERY command existence (Andrii Nakryiko) [Orabug: 38410775]
  - fs/procfs: add build ID fetching to PROCMAP_QUERY API (Andrii Nakryiko) [Orabug: 38410775]
  - fs/procfs: implement efficient VMA querying API for /proc/<pid>/maps (Andrii Nakryiko) [Orabug: 38410775]
  - fs/procfs: extract logic for getting VMA name constituents (Andrii Nakryiko) [Orabug: 38410775]
  - fs: create helper file_user_path() for user displayed mapped file path (Amir Goldstein) [Orabug: 38410775]
  - mm: factor out VMA stack and heap checks (Kefeng Wang) [Orabug: 38410775]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-316.196.2.el8uek]
changelog:
  - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Pradyumn Rahar) [Orabug: 37961220,38730620] {CVE-2025-40250}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-316.196.3.el8uek]
changelog:
  - rds: Add smp_rmb before reading c_destroy_in_prog (Håkon Bugge) [Orabug: 38352484]
  - Revert "block: don't add or resize partition on the disk with GENHD_FL_NO_PART" (Gulam Mohamed) [Orabug: 38652797]
  - Revert "block: Move checking GENHD_FL_NO_PART to bdev_add_partition()" (Gulam Mohamed) [Orabug: 38652797]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-316.196.4.el8uek]
changelog:
  - vhost_scsi: Sync up cmd completion locking with upstream (Mike Christie)  [Orabug: 38545946]
  - vhost_scsi: add support for worker ioctls (Mike Christie)  [Orabug: 38545946]
  - vhost: Limit access to vhost worker ioctls (Mike Christie)  [Orabug: 38545946]
  - vhost: allow userspace to create workers (Mike Christie)  [Orabug: 38545946]
  - vhost: replace single worker pointer with xarray (Mike Christie)  [Orabug: 38545946]
  - vhost: add helper to parse userspace vring state/file (Mike Christie)  [Orabug: 38545946]
  - vhost: remove vhost_work_queue (Mike Christie)  [Orabug: 38545946]
  - vhost_scsi: flush IO vqs then send TMF rsp (Mike Christie)  [Orabug: 38545946]
  - vhost_scsi: convert to vhost_vq_work_queue (Mike Christie)  [Orabug: 38545946]
  - vhost_scsi: make SCSI cmd completion per vq (Mike Christie)  [Orabug: 38545946]
  - vhost_sock: convert to vhost_vq_work_queue (Mike Christie)  [Orabug: 38545946]
  - vhost: convert poll work to be vq based (Mike Christie)  [Orabug: 38545946]
  - vhost: take worker or vq for flushing (Mike Christie)  [Orabug: 38545946]
  - vhost: take worker or vq instead of dev for queueing (Mike Christie)  [Orabug: 38545946]
  - vhost, vhost_net: add helper to check if vq has work (Mike Christie)  [Orabug: 38545946]
  - vhost: add vhost_worker pointer to vhost_virtqueue (Mike Christie)  [Orabug: 38545946]
  - vhost: dynamically allocate vhost_worker (Mike Christie)  [Orabug: 38545946]
  - vhost: create worker at end of vhost_dev_set_owner (Mike Christie)  [Orabug: 38545946]
  - vhost-scsi: Fix crash during LUN unmapping (Mike Christie)  [Orabug: 38545946]
  - vhost: move worker thread fields to new struct (Mike Christie)  [Orabug: 38545946]
  - vhost: Fix livepatch timeouts in vhost_worker() (Josh Poimboeuf)  [Orabug: 38545946]
  - vhost: rename vhost_work_dev_flush (Mike Christie)  [Orabug: 38545946]
  - vhost-test: drop flush after vhost_dev_cleanup (Mike Christie)  [Orabug: 38545946]
  - vhost/test: fix memory leak of vhost virtqueues (Xianting Tian)  [Orabug: 38545946]
  - vhost-scsi: drop flush after vhost_dev_cleanup (Mike Christie)  [Orabug: 38545946]
  - vhost_vsock: simplify vhost_vsock_flush() (Andrey Ryabinin)  [Orabug: 38545946]
  - vhost_test: remove vhost_test_flush_vq() (Andrey Ryabinin)  [Orabug: 38545946]
  - vhost_net: get rid of vhost_net_flush_vq() and extra flush calls (Andrey Ryabinin)  [Orabug: 38545946]
  - vhost: flush dev once during vhost_dev_stop (Mike Christie)  [Orabug: 38545946]
  - vhost: get rid of vhost_poll_flush() wrapper (Andrey Ryabinin)  [Orabug: 38545946]
  - net/mlx5e: Add a miss level for ipsec crypto offload (Lama Kayal)  [Orabug: 38600056]
  - net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)  [Orabug: 38600056]
  - mm/hugetlb: add option to allows disabling CVE-2025-38085 mitigation (Joe Jin)  [Orabug: 38728358]
  - uek-rpm: Replace check-kabi tool with kabi (Yifei Liu)  [Orabug: 38673381]
  - uek-rpm: Introduce check function for uek-rpm/tools/kabi (Yifei Liu)  [Orabug: 38673381]
  - rtc: expose RTC_FEATURE_UPDATE_INTERRUPT (Alexandre Belloni)  [Orabug: 38708842]
  - Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha)  [Orabug: 38710346]
  - netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)  [Orabug: 38389767]  {CVE-2025-38678}
  - HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 (Zhang Heng)
  - mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR (Matthieu Baerts (NGI0))
  - USB: storage: Remove subclass and protocol overrides from Novatek quirk (Alan Stern)
  - most: usb: fix double free on late probe failure (Johan Hovold)
  - uio_hv_generic: Set event for all channels on the device (Long Li)
  - regmap: slimbus: fix bus_context pointer in regmap init calls (Alexey Klimov)
  - usb: typec: ucsi: psy: Set max current to zero when disconnected (Jameson Thies)
  - ata: libata-scsi: Fix system suspend for a security locked drive (Niklas Cassel)
  - MIPS: mm: Prevent a TLB shutdown on initial uniquification (Maciej W. Rozycki)


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-316.196.4.1.el8uek]
changelog:
  - tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima)  [Orabug: 38788585]  {CVE-2025-40280} 
  - fs/proc: fix uaf in proc_readdir_de() (Wei Yang)  [Orabug: 38788587]  {CVE-2025-40271} 
  - vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj)  [Orabug: 38788594]  {CVE-2025-40248}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-316.196.4.1.el8uek]
changelog:
  - tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima)  [Orabug: 38788585]  {CVE-2025-40280}
  - fs/proc: fix uaf in proc_readdir_de() (Wei Yang)  [Orabug: 38788587]  {CVE-2025-40271}
  - vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj)  [Orabug: 38788594]  {CVE-2025-40248}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-316.196.4.2.el8uek]
changelog:
  - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added (Sabrina Dubroca)   
  - usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE (Gopi Krishna Menon)   
  - ext4: clear i_state_flags when alloc inode (Haibo Chen)   
  - ext4: align max orphan file size with e2fsprogs limit (Baokun Li)   
  - PM: runtime: Do not clear needs_force_resume with enabled runtime PM (Rafael J. Wysocki)   
  - net: enetc: fix build warning when PAGE_SIZE is greater than 128K (Wei Fang)   
  - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Xiang Mei)   
  - block: fix comment for op_is_zone_mgmt() to include RESET_ALL (shechenglong)   
  - fuse: fix readahead reclaim deadlock (Joanne Koong)   
  - i40e: validate ring_len parameter against hardware-specific values (Gregory Herrero)   
  - fs/ntfs3: fix mount failure for sparse runs in run_unpack() (Konstantin Komarov)   
  - xfrm: delete x->tunnel as we delete x (Sabrina Dubroca)  [Orabug: 38933003]  {CVE-2025-40215} 
  - mptcp: fix race condition in mptcp_schedule_work() (Eric Dumazet)  [Orabug: 38932997]  {CVE-2025-40258} 
  - mlx5: Fix default values in create CQ (Akiva Goldberger)  [Orabug: 38932992]  
  - sunrpc: fix handling of server side tls alerts (Olga Kornievskaia)  [Orabug: 38932991]  {CVE-2025-38566} 
  - sunrpc: fix client side handling of tls alerts (Olga Kornievskaia)  [Orabug: 38932988]  {CVE-2025-38571}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-316.196.4.el8uek]
changelog:
  - vhost_scsi: Sync up cmd completion locking with upstream (Mike Christie) [Orabug: 38545946]
  - vhost_scsi: add support for worker ioctls (Mike Christie) [Orabug: 38545946]
  - vhost: Limit access to vhost worker ioctls (Mike Christie) [Orabug: 38545946]
  - vhost: allow userspace to create workers (Mike Christie) [Orabug: 38545946]
  - vhost: replace single worker pointer with xarray (Mike Christie) [Orabug: 38545946]
  - vhost: add helper to parse userspace vring state/file (Mike Christie) [Orabug: 38545946]
  - vhost: remove vhost_work_queue (Mike Christie) [Orabug: 38545946]
  - vhost_scsi: flush IO vqs then send TMF rsp (Mike Christie) [Orabug: 38545946]
  - vhost_scsi: convert to vhost_vq_work_queue (Mike Christie) [Orabug: 38545946]
  - vhost_scsi: make SCSI cmd completion per vq (Mike Christie) [Orabug: 38545946]
  - vhost_sock: convert to vhost_vq_work_queue (Mike Christie) [Orabug: 38545946]
  - vhost: convert poll work to be vq based (Mike Christie) [Orabug: 38545946]
  - vhost: take worker or vq for flushing (Mike Christie) [Orabug: 38545946]
  - vhost: take worker or vq instead of dev for queueing (Mike Christie) [Orabug: 38545946]
  - vhost, vhost_net: add helper to check if vq has work (Mike Christie) [Orabug: 38545946]
  - vhost: add vhost_worker pointer to vhost_virtqueue (Mike Christie) [Orabug: 38545946]
  - vhost: dynamically allocate vhost_worker (Mike Christie) [Orabug: 38545946]
  - vhost: create worker at end of vhost_dev_set_owner (Mike Christie) [Orabug: 38545946]
  - vhost-scsi: Fix crash during LUN unmapping (Mike Christie) [Orabug: 38545946]
  - vhost: move worker thread fields to new struct (Mike Christie) [Orabug: 38545946]
  - vhost: Fix livepatch timeouts in vhost_worker() (Josh Poimboeuf) [Orabug: 38545946]
  - vhost: rename vhost_work_dev_flush (Mike Christie) [Orabug: 38545946]
  - vhost-test: drop flush after vhost_dev_cleanup (Mike Christie) [Orabug: 38545946]
  - vhost/test: fix memory leak of vhost virtqueues (Xianting Tian) [Orabug: 38545946]
  - vhost-scsi: drop flush after vhost_dev_cleanup (Mike Christie) [Orabug: 38545946]
  - vhost_vsock: simplify vhost_vsock_flush() (Andrey Ryabinin) [Orabug: 38545946]
  - vhost_test: remove vhost_test_flush_vq() (Andrey Ryabinin) [Orabug: 38545946]
  - vhost_net: get rid of vhost_net_flush_vq() and extra flush calls (Andrey Ryabinin) [Orabug: 38545946]
  - vhost: flush dev once during vhost_dev_stop (Mike Christie) [Orabug: 38545946]
  - vhost: get rid of vhost_poll_flush() wrapper (Andrey Ryabinin) [Orabug: 38545946]
  - net/mlx5e: Add a miss level for ipsec crypto offload (Lama Kayal) [Orabug: 38600056]
  - net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu) [Orabug: 38600056]
  - mm/hugetlb: add option to allows disabling CVE-2025-38085 mitigation (Joe Jin) [Orabug: 38728358] {CVE-2025-38085}
  - uek-rpm: Replace check-kabi tool with kabi (Yifei Liu) [Orabug: 38673381]
  - uek-rpm: Introduce check function for uek-rpm/tools/kabi (Yifei Liu) [Orabug: 38673381]
  - rtc: expose RTC_FEATURE_UPDATE_INTERRUPT (Alexandre Belloni) [Orabug: 38708842]
  - Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38710346]
  - netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso) [Orabug: 38389767,38744086] {CVE-2025-38678}
  - HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 (Zhang Heng)
  - mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR (Matthieu Baerts)
  - USB: storage: Remove subclass and protocol overrides from Novatek quirk (Alan Stern)
  - most: usb: fix double free on late probe failure (Johan Hovold)
  - uio_hv_generic: Set event for all channels on the device (Long Li)
  - regmap: slimbus: fix bus_context pointer in regmap init calls (Alexey Klimov)
  - usb: typec: ucsi: psy: Set max current to zero when disconnected (Jameson Thies)
  - ata: libata-scsi: Fix system suspend for a security locked drive (Niklas Cassel)
  - MIPS: mm: Prevent a TLB shutdown on initial uniquification (Maciej W. Rozycki)


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-317.197.1.el8uek]
changelog:
  - LTS version: v5.15.197 (Vijayendra Suman)
  - libbpf: Fix invalid return address register in s390 (Daniel T. Lee)
  - libbpf, riscv: Use a0 for RC register (Yixun Lan)
  - libbpf: Fix riscv register names (Ilya Leoshkevich)
  - selftests/bpf: Don't rely on preserving volatile in PT_REGS macros in loop3 (Andrii Nakryiko)
  - scsi: pm80xx: Set phy->enable_completion only when we (Igor Pylypiv) [Orabug: 37159744] {CVE-2024-47666}
  - Bluetooth: Add more enc key size check (Alex Lu)
  - usb: renesas_usbhs: Fix synchronous external abort on unbind (Claudiu Beznea) [Orabug: 38792571] {CVE-2025-68327}
  - usb: renesas_usbhs: Convert to platform remove callback returning void (Uwe Kleine-König)
  - smb: client: fix memory leak in cifs_construct_tcon() (Paulo Alcantara) [Orabug: 38773704] {CVE-2025-68295}
  - mptcp: Fix proto fallback detection with BPF (Jiayuan Chen) [Orabug: 38773435] {CVE-2025-68227}
  - mptcp: avoid unneeded subflow-level drops (Paolo Abeni)
  - selftests: mptcp: join: rm: set backup flag (Matthieu Baerts)
  - staging: rtl8712: Remove driver using deprecated API wext (Philipp Hortmann)
  - libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (Ziming Zhang) [Orabug: 38773649] {CVE-2025-68284}
  - libceph: fix potential use-after-free in have_mon_and_osd_map() (Ilya Dryomov) [Orabug: 38773655] {CVE-2025-68285}
  - drm/amd/display: Check NULL before accessing (Alex Hung) [Orabug: 38773664] {CVE-2025-68286}
  - drm: sti: fix device leaks at component probe (Johan Hovold)
  - USB: serial: option: add support for Rolling RW101R-GL (Vanillan Wang)
  - USB: serial: ftdi_sio: add support for u-blox EVK-M101 (Oleksandr Suvorov)
  - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host (Mathias Nyman)
  - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths (Manish Nagar) [Orabug: 38773671] {CVE-2025-68287}
  - usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer (Owen Gu) [Orabug: 38792593] {CVE-2025-68331}
  - usb: storage: sddr55: Reject out-of-bound new_pba (Tianchu Chen) [Orabug: 38762730] {CVE-2025-40345}
  - usb: storage: Fix memory leak in USB bulk transport (Desnes Nunes) [Orabug: 38773677] {CVE-2018-1000204,CVE-2025-68288}
  - usb: gadget: f_eem: Fix memory leak in eem_unwrap (Kuen-Han Tsai) [Orabug: 38773687] {CVE-2025-68289}
  - usb: cdns3: Fix double resource release in cdns3_pci_probe (Miaoqian Lin)
  - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking (Miaoqian Lin)
  - firmware: stratix10-svc: fix bug in saving controller data (Khairul Anuar Romli)
  - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves (Miaoqian Lin)
  - thunderbolt: Add support for Intel Wildcat Lake (Alan Borzeszkowski)
  - drivers/usb/dwc3: fix PCI parent check (Jamie Iles)
  - dm-verity: fix unreliable memory allocation (Mikulas Patocka)
  - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling (Marc Kleine-Budde)
  - can: sja1000: fix max irq loop handling (Thomas Mühlbacher)
  - atm/fore200e: Fix possible data race in fore200e_open() (Gui-Dong Han)
  - iio: accel: bmc150: Fix irq assumption regression (Linus Walleij) [Orabug: 38792587] {CVE-2025-68330}
  - iio:common:ssp_sensors: Fix an error handling path ssp_probe() (Christophe Jaillet)
  - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields (Francesco Lavra)
  - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" (Jiri Olsa)
  - spi: bcm63xx: fix premature CS deassertion on RX-only transactions (Hang Zhou)
  - mailbox: mailbox-test: Fix debugfs_create_dir error checking (Xu Wang)
  - net: atlantic: fix fragment overflow handling in RX path (Jiefeng Zhang) [Orabug: 38773729] {CVE-2025-68301}
  - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic (Vladimir Oltean)
  - net: dsa: sja1105: simplify static configuration reload (Russell King)
  - net: dsa: sja1105: Convert to mdiobus_c45_read (Andrew Lunn)
  - net: sxgbe: fix potential NULL dereference in sxgbe_rx() (Alexey Kodanev)
  - net/mlx5e: Fix validation logic in rate limiting (Danielle Costantino)
  - net: aquantia: Add missing descriptor cache invalidation on ATL2 (Kai-Heng Feng)
  - platform/x86: intel: punit_ipc: fix memory corruption (Dan Carpenter)
  - Bluetooth: SMP: Fix not generating mackey and ltk when repairing (Luiz Augusto von Dentz)
  - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers (Seungjin Bae) [Orabug: 38773760] {CVE-2025-68308}
  - Revert "block: don't add or resize partition on the disk with GENHD_FL_NO_PART" (Gulam Mohamed) [Orabug: 38652797]
  - Revert "block: Move checking GENHD_FL_NO_PART to bdev_add_partition()" (Gulam Mohamed) [Orabug: 38652797]
  - mptcp: do not fallback when OoO is present (Paolo Abeni)
  - mptcp: fix a race in mptcp_pm_del_add_timer() (Eric Dumazet) [Orabug: 38730656] {CVE-2025-40257}
  - mptcp: fix premature close in case of fallback (Paolo Abeni)
  - mptcp: fix ack generation for fallback msk (Paolo Abeni)
  - dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups (Krzysztof Kozlowski)
  - Input: pegasus-notetaker - fix potential out-of-bounds access (Seungjin Bae)
  - Input: remove third argument of usb_maxpacket() (Vincent Mailhol)
  - usb: deprecate the third argument of usb_maxpacket() (Vincent Mailhol)
  - mptcp: Disallow MPTCP subflows from sockmap (Jiayuan Chen)
  - selftests: mptcp: connect: fix fallback note due to OoO (Matthieu Baerts)
  - pmdomain: samsung: plug potential memleak during probe (André Draszik)
  - pmdomain: arm: scmi: Fix genpd leak on provider registration failure (Sudeep Holla)
  - pmdomain: imx: Fix reference count leak in imx_gpc_remove (Miaoqian Lin)
  - net: netpoll: fix incorrect refcount handling causing incorrect cleanup (Breno Leitao) [Orabug: 38773509] {CVE-2025-68245}
  - mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 (Shawn Lin)
  - net: qede: Initialize qede_ll_ops with designated initializer (Nathan Chancellor)
  - btrfs: fix crash on racing fsync and size-extending write into prealloc (Omar Sandoval) [Orabug: 36774582] {CVE-2024-37354}
  - btrfs: add helper to truncate inode items when logging inode (Filipe Manana)
  - Makefile.compiler: replace cc-ifversion with compiler-specific macros (Nick Desaulniers)
  - tracing/tools: Fix incorrcet short option in usage text for --threads (Zhang Chujun)
  - net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error (Nishanth Menon)
  - ALSA: usb-audio: fix uac2 clock source at terminal parser (René Rebe)
  - mm/secretmem: fix use-after-free race in fault handler (Lance Yang) [Orabug: 38737039] {CVE-2025-40272}
  - mm/mm_init: fix hash table order logging in alloc_large_system_hash() (Isaac J. Manjarres)
  - kconfig/nconf: Initialize the default locale at startup (Jakub Horký)
  - kconfig/mconf: Initialize the default locale at startup (Jakub Horký)
  - net: tls: Cancel RX async resync request on rcd_delta overflow (Shahar Shitrit)
  - selftests: net: use BASH for bareudp testing (Po-Hsu Lin)
  - scsi: core: Fix a regression triggered by scsi_host_busy() (Bart Van Assche) [Orabug: 38773426]
  - vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj) [Orabug: 38730611,38786193,38788594] {CVE-2025-40248}
  - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Pavel Zhigulin) [Orabug: 38730629] {CVE-2025-40252}
  - kernel.h: Move ARRAY_SIZE() to a separate header (Alejandro Colomar)
  - platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos (Xu Wang)
  - s390/ctcm: Fix double-kfree (Aleksei Nikiforov)
  - net: openvswitch: remove never-working support for setting nsh fields (Ilya Maximets) [Orabug: 38730648] {CVE-2025-40254}
  - net: dsa: hellcreek: fix missing error handling in LED registration (Pavel Zhigulin)
  - mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() (Zilin Guan)
  - drm/tegra: dc: Fix reference leak in tegra_dc_couple() (Ma Ke)
  - mptcp: fix race condition in mptcp_schedule_work() (Eric Dumazet) [Orabug: 38730659] {CVE-2025-40258}
  - MIPS: Malta: Fix !EVA SOC-it PCI MMIO (Maciej W. Rozycki)
  - scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() (Hamza Mahfooz) [Orabug: 38773440] {CVE-2025-68229}
  - scsi: sg: Do not sleep in atomic context (Bart Van Assche) [Orabug: 38730663] {CVE-2025-40259}
  - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [Orabug: 38730673] {CVE-2025-40261}
  - Input: imx_sc_key - fix memory corruption on unload (Dan Carpenter)
  - Input: cros_ec_keyb - fix an invalid memory access (Tzung-Bi Shih) [Orabug: 38730680] {CVE-2025-40263}
  - be2net: pass wrb_params in case of OS2BMC (Andrey Vatoropin) [Orabug: 38730689] {CVE-2025-40264}
  - exfat: check return value of sb_min_blocksize in exfat_read_boot_sector (Yongpeng Yang)
  - mtd: rawnand: cadence: fix DMA device NULL pointer dereference (Niravkumar L Rabara)
  - net/sched: act_connmark: handle errno on tcf_idr_check_alloc (Pedro Tammela)
  - isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (Abdun Nihaal) [Orabug: 38798907] {CVE-2025-68734}
  - EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection (Niravkumar L Rabara)
  - EDAC/altera: Handle OCRAM ECC enable after warm reset (Niravkumar L Rabara)
  - spi: Try to get ACPI GPIO IRQ earlier (Hans de Goede)
  - ALSA: usb-audio: Fix missing unlock at error path of maxpacksize check (Takashi Iwai)
  - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (Takashi Iwai) [Orabug: 38737023] {CVE-2025-40269}
  - fs/proc: fix uaf in proc_readdir_de() (Wei Yang) [Orabug: 38737033,38786194,38788587] {CVE-2025-40271}
  - ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (Chuang Wang) [Orabug: 38773495] {CVE-2025-68241}
  - strparser: Fix signed/unsigned mismatch bug (Nate Karstens)
  - gcov: add support for GCC 15 (Peter Oberparleiter)
  - NFSD: free copynotify stateid in nfs4_free_ol_stateid() (Olga Kornievskaia) [Orabug: 38737042] {CVE-2025-40273}
  - HID: hid-ntrig: Prevent memory leak in ntrig_report_version() (Masami Ichikawa)
  - mtd: onenand: Pass correct pointer to IRQ handler (Dan Carpenter)
  - lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN (Eric Biggers)
  - mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592026] {CVE-2025-40040}
  - bpf: Add bpf_prog_run_data_pointers() (Eric Dumazet) [Orabug: 38773327] {CVE-2025-68200}
  - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (Haein Lee) [Orabug: 38737051] {CVE-2025-40275}
  - NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() (Trond Myklebust)
  - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (Ian Forbes) [Orabug: 38737060] {CVE-2025-40277}
  - ASoC: cs4271: Fix regulator leak on probe failure (Xu Wang)
  - regulator: fixed: fix GPIO descriptor leak on register failure (Xu Wang)
  - acpi,srat: Fix incorrect device handle check for Generic Initiator (Shuai Xue)
  - Bluetooth: L2CAP: export l2cap_chan_hold for modules (Pauli Virtanen)
  - hsr: Fix supervision frame sending on HSRv0 (Felix Maurer)
  - net_sched: limit try_bulk_dequeue_skb() batches (Eric Dumazet)
  - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Gal Pressman)
  - net/mlx5e: Fix maxrate wraparound in threshold between units (Gal Pressman)
  - net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (Ranganath V N)
  - net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (Ranganath V N) [Orabug: 38737072] {CVE-2025-40279}
  - net_sched: act_connmark: use RCU in tcf_connmark_dump() (Eric Dumazet)
  - net/sched: act_connmark: transition to percpu stats and rcu (Pedro Tammela)
  - net: sched: act_connmark: get rid of tcf_connmark_walker and tcf_connmark_search (Zhengchao Shao)
  - net: sched: act: move global static variable net_id to tc_action_ops (Zhengchao Shao)
  - wifi: mac80211: skip rate verification for not captured PSDUs (Benjamin Berg)
  - net: mdio: fix resource leak in mdiobus_register_device() (Csaba Buday)
  - tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima) [Orabug: 38737082,38786195,38788585] {CVE-2025-40280}
  - net/smc: fix mismatch between CLC header and proposal (D. Wythe)
  - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto (Eric Dumazet) [Orabug: 38737090] {CVE-2025-40281}
  - Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions (Pauli Virtanen)
  - Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion (Pauli Virtanen)
  - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (Pauli Virtanen)
  - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (Raphael Pinsonneault-Thibeault) [Orabug: 38737103] {CVE-2025-40283}
  - net: fec: correct rx_bytes statistic for the case SHIFT16 is set (Wei Fang)
  - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (Sharique Mohammad)
  - NFS: check if suid/sgid was cleared after a write as needed (Scott Mayhew)
  - HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (Tristan Lobb)
  - NFS4: Fix state renewals missing after boot (Joshua Watt)
  - RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors (Danil Skrebenkov)
  - compiler_types: Move unused static inline functions warning to W=2 (Peter Zijlstra)
  - drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (Janusz Krzysztofik) [Orabug: 38773506] {CVE-2025-68244}
  - selftests: netdevsim: set test timeout to 10 minutes (Jakub Kicinski)
  - extcon: adc-jack: Cleanup wakeup source only if it was enabled (Krzysztof Kozlowski)
  - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC (Nathan Chancellor)
  - rtc: rx8025: fix incorrect register reference (Yuta Hayama)
  - tracing: Fix memory leaks in create_field_var() (Zilin Guan)
  - bnxt_en: Fix a possible memory leak in bnxt_ptp_init (Kalesh Ap)
  - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (Qendrim Maxhuni) [Orabug: 38773282] {CVE-2025-68192}
  - sctp: Hold sock lock while iterating over address list (Stefan Wiehler)
  - sctp: Prevent TOCTOU out-of-bounds write (Stefan Wiehler) [Orabug: 38747446] {CVE-2025-40331}
  - sctp: Hold RCU read lock while iterating over address list (Stefan Wiehler)
  - net: dsa: b53: stop reading ARL entries if search is done (Jonas Gorski)
  - net: dsa: b53: fix enabling ip multicast (Jonas Gorski)
  - net: dsa: b53: fix resetting speed and pause on forced link (Jonas Gorski)
  - net: vlan: sync VLAN features with lower device (Hangbin Liu)
  - selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh (Wang Liang)
  - netdevsim: add Makefile for selftests (David Wei)
  - selftests/net: use destination options instead of hop-by-hop (Anubhav Singh)
  - selftests/net: fix GRO coalesce test and add ext header coalesce tests (Richard Gobert)
  - selftests/net: fix out-of-order delivery of FIN in gro:tcp test (Anubhav Singh)
  - net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx (Jonas Gorski)
  - riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro (Josephine Pfeiffer)
  - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" (Baochen Qiang)
  - ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again (Kailang Yang)
  - ceph: add checking of wait_for_completion_killable() return value (Viacheslav Dubeyko)
  - ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (Valerio Setti)
  - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (Albin Babu Varghese) [Orabug: 38737181] {CVE-2025-40304}
  - ACPI: property: Return present device nodes only on fwnode interface (Sakari Ailus)
  - 9p: sysfs_init: don't hardcode error to ENOMEM (Randall P. Embry)
  - cpufreq: tegra186: Initialize all cores to max frequencies (Aaron Kling)
  - 9p: fix /sys/fs/9p/caches overwriting itself (Randall P. Embry)
  - clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled (Matthias Schiffer)
  - clk: at91: clk-master: Add check for divide by 3 (Ryan Wanner)
  - ARM: at91: pm: save and restore ACR during PLL disable/enable (Nicolas Ferre)
  - rtc: pcf2127: clear minute/second interrupt (Josua Mayer)
  - um: Fix help message for ssl-non-raw (Tiwei Bie)
  - fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink (Yikang Yue)
  - btrfs: mark dirty extent range for out of bound prealloc extents (Austinchang)
  - RDMA/hns: Fix wrong WQE data when QP wraps around (Junxian Huang)
  - RDMA/irdma: Set irdma_cq cq_num field during CQ create (Jacob Moroni)
  - RDMA/irdma: Remove unused struct irdma_cq fields (Jacob Moroni)
  - RDMA/irdma: Fix SD index calculation (Jacob Moroni)
  - ACPICA: Update dsmethod.c to get rid of unused variable warning (Saket Dumbre)
  - orangefs: fix xattr related buffer overflow... (Mike Marshall)
  - page_pool: Clamp pool size to max 16K pages (Dragos Tatulea)
  - exfat: limit log print for IO error (Chi Zhiling)
  - ALSA: usb-audio: add mono main switch to Presonus S1824c (Roy Vegard Ovesen)
  - Bluetooth: bcsp: receive data only if registered (Ivan Pravdin) [Orabug: 38737212] {CVE-2025-40308}
  - Bluetooth: SCO: Fix UAF on sco_conn_free (Luiz Augusto von Dentz) [Orabug: 38737223] {CVE-2025-40309}
  - net: macb: avoid dealing with endianness in macb_set_hwaddr() (Théo Lebrun)
  - fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock (Chuguangqing) [Orabug: 38773127] {CVE-2025-40361}
  - scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() (Alok Tiwari)
  - nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing (Al Viro) [Orabug: 38773244] {CVE-2025-68185}
  - NFSv4.1: fix mount hang after CREATE_SESSION failure (Anthony Iliopoulos)
  - NFSv4: handle ERR_GRACE on delegation recalls (Olga Kornievskaia)
  - remoteproc: qcom: q6v5: Avoid handling handover twice (Stephan Gerhold)
  - sparc/module: Add R_SPARC_UA64 relocation handling (Koakuma)
  - PCI: cadence: Check for the existence of cdns_pcie::ops before using it (Chen Wang)
  - r8169: set EEE speed down ratio to 1 (Chunhao Lin)
  - net: intel: fm10k: Fix parameter idx set but not used (Brahmajit Das)
  - wifi: ath10k: Fix connection after GTK rekeying (Loic Poulain)
  - iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() (Seyediman Seyedarab)
  - net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X (Robert Marko)
  - jfs: fix uninitialized waitqueue in transaction manager (Shaurya Rane)
  - jfs: Verify inode mode when loading from disk (Tetsuo Handa)
  - ipv6: np->rxpmtu race annotation (Eric Dumazet)
  - usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (Krishna Kurapati)
  - usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (Forest Crossman)
  - allow finish_no_open(file, ERR_PTR(-E...)) (Al Viro)
  - scsi: lpfc: Define size of debugfs entry for xri rebalancing (Justin Tee)
  - scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup (Justin Tee)
  - scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET (Justin Tee)
  - selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency (Nai-Chen Cheng)
  - page_pool: always add GFP_NOWARN for ATOMIC allocations (Jakub Kicinski) [Orabug: 38773835] {CVE-2025-68321}
  - drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl (Tvrtko Ursulin)
  - net/cls_cgroup: Fix task_get_classid() during qdisc run (Yafang Shao)
  - udp_tunnel: use netdev_warn() instead of netdev_WARN() (Alok Tiwari) [Orabug: 38773275] {CVE-2025-68191}
  - selftests: Replace sleep with slowwait (David Ahern)
  - eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP (Daniel Palmer)
  - selftests: Disable dad for ipv6 in fcnal-test.sh (David Ahern)
  - x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT (Li Rongqing)
  - netfilter: nf_reject: don't reply to icmp error messages (Florian Westphal)
  - selftests: traceroute: Use require_command() (Ido Schimmel)
  - media: redrat3: use int type to store negative error codes (Rong Qianfeng)
  - net: sh_eth: Disable WoL if system can not suspend (Niklas Söderlund)
  - phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 (Michael Riesch)
  - phy: cadence: cdns-dphy: Enable lower resolutions in dphy (Harikrishna Shenoy)
  - ntfs3: pretend $Extend records as regular files (Tetsuo Handa)
  - net: phy: marvell: Fix 88e1510 downshift counter errata (Rohan G Thomas)
  - drm/msm: make sure to not queue up recovery more than once (Antonino Maniscalco)
  - usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (Chen Yufeng)
  - usb: gadget: f_hid: Fix zero length packet transfer (William Wu)
  - iommu/amd: Skip enabling command/event buffers for kdump (Ashish Kalra)
  - net: call cond_resched() less often in __release_sock() (Eric Dumazet)
  - net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms (Juraj Šarinay)
  - ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled (Yue Haibing)
  - drm/msm/dsi/phy_7nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
  - drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL (Krzysztof Kozlowski)
  - dmaengine: dw-edma: Set status for callback_result (Devendra K Verma)
  - dmaengine: mv_xor: match alloc_wc and free_wc (Rosen Penev)
  - dmaengine: sh: setup_xref error handling (Thomas Andreatta)
  - ptp: Limit time setting of PTP clocks (Miroslav Lichvar)
  - scsi: pm8001: Use int instead of u32 to store error codes (Rong Qianfeng)
  - mips: lantiq: xway: sysctrl: rename stp clock (Aleksander Jan Bajkowski)
  - mips: lantiq: danube: add missing device_type in pci node (Aleksander Jan Bajkowski)
  - mips: lantiq: danube: add missing properties to cpu node (Aleksander Jan Bajkowski)
  - media: fix uninitialized symbol warnings (Chelsy Ratnawat)
  - drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (Amber Lin)
  - extcon: adc-jack: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
  - scsi: pm80xx: Fix race condition caused by static variables (Francisco Gutierrez)
  - scsi: mpi3mr: Fix controller init failure on fault during queue creation (Chandrakanth Patil)
  - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (Takashi Iwai)
  - PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (Sungho Kim)
  - net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. (Kuniyuki Iwashima)
  - net: When removing nexthops, don't call synchronize_net if it is not necessary (Christoph Paasch)
  - char: misc: Does not request module for miscdevice with dynamic minor (Zijun Hu)
  - usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (Raub Camaioni)
  - iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (Rodrigo Gobbi)
  - drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts (Dmitry Baryshkov)
  - media: imon: make send_packet() more robust (Tetsuo Handa) [Orabug: 38773297] {CVE-2025-68194}
  - net: ipv6: fix field-spanning memcpy warning in AH output (Charalampos Mitrodimas) [Orabug: 38773140] {CVE-2025-40363}
  - bridge: Redirect to backup port when port is administratively down (Ido Schimmel)
  - powerpc/eeh: Use result of error_detected() in uevent (Niklas Schnelle)
  - thunderbolt: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
  - net: stmmac: Check stmmac_hw_setup() in stmmac_resume() (Tiezhu Yang)
  - x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall (Kirill A. Shutemov)
  - drm/tidss: Set crtc modesetting parameters with adjusted mode (Jayesh Choudhary)
  - drm/tidss: Use the crtc_* timings when programming the HW (Tomi Valkeinen)
  - media: pci: ivtv: Don't create fake v4l2_fh (Laurent Pinchart)
  - drm/amdkfd: return -ENOTTY for unsupported IOCTLs (Geoffrey Mcrae)
  - selftests/net: Ensure assert() triggers in psock_tpacket.c (Wake Liu)
  - selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 (Wake Liu)
  - PCI: Disable MSI on RDC PCI to PCIe bridges (Marcos Del Sol Vives)
  - drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (Seyediman Seyedarab)
  - drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff (Sathishkumar S)
  - drm/amd/pm: Use cached metrics data on arcturus (Lijo Lazar)
  - drm/amd/pm: Use cached metrics data on aldebaran (Lijo Lazar)
  - mfd: da9063: Split chip variant reading in two bus transactions (Jens Kehne)
  - mfd: madera: Work around false-positive -Wininitialized warning (Arnd Bergmann)
  - mfd: stmpe-i2c: Add missing MODULE_LICENSE (Alexander Stein)
  - mfd: stmpe: Remove IRQ domain upon removal (Alexander Stein)
  - tools/power x86_energy_perf_policy: Prefer driver HWP limits (Len Brown)
  - tools/power x86_energy_perf_policy: Enhance HWP enable (Len Brown)
  - tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage (Kaushlendra Kumar)
  - tools/cpupower: Fix incorrect size in cpuidle_state_disable() (Kaushlendra Kumar)
  - hwmon: (dell-smm) Add support for Dell OptiPlex 7040 (Armin Wolf)
  - uprobe: Do not emulate/sstep original instruction when ip is changed (Jiri Olsa)
  - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Daniel Lezcano)
  - cpuidle: Fail cpuidle device registration if there is one already (Rafael J. Wysocki)
  - tools/cpupower: fix error return value in cpupower_write_sysfs() (Kaushlendra Kumar)
  - video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (Svyatoslav Ryhel)
  - nvme-fc: use lock accessing port_state and rport state (Daniel Wagner) [Orabug: 38747531] {CVE-2025-40342}
  - nvmet-fc: avoid scheduling association deletion twice (Daniel Wagner) [Orabug: 38747538] {CVE-2025-40343}
  - tee: allow a driver to allocate a tee_device without a pool (Amirreza Zarrabi)
  - ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (Hans de Goede)
  - mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (Sarthak Garg)
  - power: supply: sbs-charger: Support multiple devices (Fabien Proriol)
  - hwmon: (sbtsi_temp) AMD CPU extended temperature range support (Chuande Chen)
  - ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] (Hans de Goede)
  - ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (Shang Song)
  - irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment (Christian Bruel)
  - arc: Fix __fls() const-foldability via __builtin_clzl() (Kees Cook)
  - cpufreq/longhaul: handle NULL policy in longhaul_exit (Dennis Beier)
  - selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 (Ricardo B. Marlière)
  - ACPI: video: force native for Lenovo 82K8 (Mario Limonciello)
  - memstick: Add timeout to prevent indefinite waiting (Jiayi Li)
  - mmc: host: renesas_sdhi: Fix the actual clock (Biju Das)
  - pinctrl: single: fix bias pull up/down handling in pin_config_set (Chi Zhang)
  - bpf: Don't use %pK through printk (Thomas Weißschuh)
  - soc: ti: pruss: don't use %pK through printk (Thomas Weißschuh)
  - spi: loopback-test: Don't use %pK through printk (Thomas Weißschuh)
  - soc: qcom: smem: Fix endian-unaware access of num_entries (Jens Reidel)
  - soc: aspeed: socinfo: Add AST27xx silicon IDs (Ryan Chen)
  - block: make REQ_OP_ZONE_OPEN a write operation (Damien Le Moal)
  - drm/sysfb: Do not dereference NULL pointer in plane reset (Thomas Zimmermann) [Orabug: 38773123] {CVE-2025-40360}
  - drm/sched: Fix race in drm_sched_entity_select_rq() (Philipp Stanner)
  - usb: gadget: f_fs: Fix epfile null pointer access after ep enable. (Owen Gu)
  - Revert "docs/process/howto: Replace C89 with C11" (Matthieu Baerts)
  - arch: back to -std=gnu89 in < v5.18 (Matthieu Baerts)
  - x86/boot: Compile boot code with -std=gnu11 too (Alexey Dobriyan)
  - xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event (Mathias Nyman)
  - xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive. (Mathias Nyman)
  - xhci: dbc: Improve performance by removing delay in transfer event polling. (Mathias Nyman)
  - xhci: dbc: Allow users to modify DbC poll interval via sysfs (Uday M Bhat)
  - xhci: dbc: poll at different rate depending on data transfer activity (Mathias Nyman)
  - xhci: dbc: Provide sysfs option to configure dbc descriptors (Mathias Nyman)
  - x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
  - net: phy: dp83867: Disable EEE support as not implemented (Emanuele Ghidoli)
  - can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
  - net: ravb: Enforce descriptor type ordering (Lad Prabhakar)
  - ravb: Exclude gPTP feature support for RZ/G2L (Biju Das)
  - dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp (Xu Yang)
  - serial: 8250_dw: handle reset control deassert error (Artem Shimko)
  - serial: 8250_dw: Use devm_add_action_or_reset() (Andy Shevchenko)
  - block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL (Damien Le Moal)
  - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland (John Smith)
  - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji (John Smith)
  - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (Yang Wang)
  - net: hns3: return error code when function fails (Jijie Shao)
  - drm/etnaviv: fix flush sequence logic (Tomeu Vizoso)
  - usbnet: Prevents free active kevent (Lizhi Xu) [Orabug: 38773783] {CVE-2025-68312}
  - libbpf: Fix powerpc's stack register definition in bpf_tracing.h (Andrii Nakryiko)
  - libbpf: Normalize PT_REGS_xxx() macro definitions (Andrii Nakryiko)
  - riscv, libbpf: Add RISC-V (RV64) support to bpf_tracing.h (Björn Töpel)
  - bpf: Do not audit capability check in do_jit() (Ondrej Mosnacek)
  - bpf: Sync pending IRQ work before freeing ring buffer (Noorain Eqbal) [Orabug: 38737284] {CVE-2025-40319}
  - ALSA: usb-audio: fix control pipe direction (Roy Vegard Ovesen)
  - drm/msm/a6xx: Fix GMU firmware parser (Akhil P Oommen)
  - wifi: ath10k: Fix memory leak on unsupported WMI command (Loic Poulain)
  - ASoC: qdsp6: q6asm: do not sleep while atomic (Srinivas Kandagatla)
  - mptcp: restore window probe (Paolo Abeni)
  - fbdev: valkyriefb: Fix reference count leak in valkyriefb_init (Miaoqian Lin)
  - fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (Florian Fuchs)
  - wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode (Gokul Sivakumar) [Orabug: 38737291] {CVE-2025-40321}
  - fbdev: bitblit: bound-check glyph index in bit_putcs* (Junjie Cao) [Orabug: 38737300] {CVE-2025-40322}
  - ACPI: video: Fix use-after-free in acpi_video_switch_brightness() (Yuhao Jiang) [Orabug: 38687004] {CVE-2025-40211}
  - fbdev: atyfb: Check if pll_ops->init_pll failed (Daniel Palmer)
  - net: usb: asix_devices: Check return value of usbnet_get_endpoints (Miaoqian Lin)
  - NFSD: Fix crash in nfsd4_read_release() (Chuck Lever) [Orabug: 38737315] {CVE-2025-40324}
  - btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (Filipe Manana)
  - btrfs: always drop log root tree reference in btrfs_replay_log() (Filipe Manana)
  - btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() (Thorsten Blum)
  - x86/bugs: Fix reporting of LFENCE retpoline (David Kaplan)
  - net/sched: sch_qfq: Fix null-deref in agg_dequeue (Xiang Mei) [Orabug: 38597084] {CVE-2025-40083}


author: Samasth Norway Ananda <samasth.norway.ananda@oracle.com> [5.15.0-317.197.2.el8uek]
changelog:
  - x86/its: Build fails with CONFIG_MITIGATION_ITS=n (Alexandre Chartre) [Orabug: 38756952]
  - net/sched: adjust device watchdog timer to detect stopped queue at right time (Praveen Kumar Kannoju) [Orabug: 38341919]
  - KVM: arm64: Add minimal handling for the ARMv8.7 PMU (Marc Zyngier) [Orabug: 38784458]
  - scsi: megaraid_sas: Fix invalid node index (Chen Yu) [Orabug: 38175026] {CVE-2025-38239}
  - Revert "iommu/amd: Skip enabling command/event buffers for kdump" (Dongli Zhang) [Orabug: 38790823]
  - mm: list_lru: avoid using NULL list_lru_one. (Imran Khan) [Orabug: 38619860]
  - mm: list_lru: fix UAF for memory cgroup (Muchun Song) [Orabug: 38619860]
  - net/rds: improve conn destroy printk message (Sharath Srinivasan) [Orabug: 38728740]
  - net/rds: expand kref coverage to rds_notifier->n_conn (Sharath Srinivasan) [Orabug: 38728740]
  - net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn (Sharath Srinivasan) [Orabug: 38728740]
  - net/rds: rds_sendmsg must use rs_conn only when not being destroyed (Sharath Srinivasan) [Orabug: 38728743]
  - net/mlx5e: Set default burst period for TX and RX reporters (Shahar Shitrit) [Orabug: 38512377]
  - devlink: Make health reporter burst period configurable (Shahar Shitrit) [Orabug: 38512377]
  - devlink: Introduce burst period for health reporter (Shahar Shitrit) [Orabug: 38512377]
  - devlink: Move health reporter recovery abort logic to a separate function (Shahar Shitrit) [Orabug: 38512377]
  - devlink: Move graceful period parameter to reporter ops (Shahar Shitrit) [Orabug: 38512377]
  - devlink: introduce devlink_nl_put_u64() (Przemek Kitszel) [Orabug: 38512377]
  - net/mlx5: remove fw reporter dump option for non PF (Moshe Shemesh) [Orabug: 38512377]
  - net/mlx5: remove fw_fatal reporter dump option for non PF (Moshe Shemesh) [Orabug: 38512377]
  - devlink: Hold devlink lock on health reporter dump get (Moshe Shemesh) [Orabug: 38512377]
  - Revert "net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery" (Qing Huang) [Orabug: 38512377]
  - NVIDIA: SAUCE: iommu/arm-smmu-v3: Allow default substream bypass with a pasid support (Nicolin Chen) [Orabug: 38463999]
  - RDMA/mlx5: Fix a WARN during dereg_mr for DM type (Yishai Hadas) [Orabug: 37766291,38463999] {CVE-2025-21888}
  - uek-rpm: replace CONFIG_IOMMU_SVA_LIB with CONFIG_IOMMU_SVA (Junxiao Bi) [Orabug: 38463999]
  - iommu/sva: Rename CONFIG_IOMMU_SVA_LIB to CONFIG_IOMMU_SVA (Fenghua Yu) [Orabug: 38463999]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-317.197.3.el8uek]
changelog:
  - kpcimgr: Enable loading firmware via kernel infrastructure (Joseph Dobosenski) [Orabug: 38546110]
  - Move hnic crashkernel to cnic-image-builder (Henry Willard) [Orabug: 38546110]
  - Bump supported capmem range count from 64 to 256 (Jan Setje-Eilers) [Orabug: 38546110]
  - irqchip/pensando: Fix partial of_iomap() leak on error (#505) (Brad Larson) [Orabug: 38546110]
  - pensando: Allow sparse allowed ranges in cap_mem (Maciej S. Szmigiero) [Orabug: 38546110]
  - soc/pensando/cap-pcie: Handle zero-ed out MS_CFG_WDT_IDX/WDT_IDX (Joao Martins) [Orabug: 38546110]
  - pensando: Enable penfw driver for smartnic (Jan Setje-Eilers) [Orabug: 38546110]
  - irqchip/gic-v3-its: remove WARN_ON gic_reserve_range (Tom Saeger) [Orabug: 38546110]
  - hnic: Disable CONFIG_OVERLAY_FS_INDEX (Patrick Colp) [Orabug: 38546110]
  - pensando: missing diffs from AMD (Jan Setje-Eilers) [Orabug: 38546110]
  - hnic: config: Build FUSE into the kernel (not as a module) (Patrick Colp) [Orabug: 38546110]
  - hnic: config: Add DM_VERITY support (Patrick Colp) [Orabug: 38546110]
  - hnic config: Add LOCKDOWN_LSM support (Patrick Colp) [Orabug: 38546110]
  - Subject: uek-rpm: Build hostnic kernel for Pensando (Dave Kleikamp) [Orabug: 38546110]
  - pensando: kpcimgr: support pcie port bifurcation (Darshan Prajapati) [Orabug: 38546110]
  - Add changes for penfw and sbus.c for secureboot (Rahshekh) [Orabug: 38546110]
  - arm64: GIC ITS MSI encapsulator address configured from device tree (Brad Larson) [Orabug: 38546110]
  - perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver (Brad Larson) [Orabug: 38546110]
  - reset: salinasr: Add AMD Pensando Salina SoC reset (Brad Larson) [Orabug: 38546110]
  - spi: dw-mmio: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38546110]
  - EDAC/elba: Support AMD Pensando Giglio SoC (Brad Larson) [Orabug: 38546110]
  - arm64: defconfig: Add AMD Pensando Salina SoC defconfig (Brad Larson) [Orabug: 38546110]
  - soc/pensando: Support AMD Pensando Salina SoC (Brad Larson) [Orabug: 38546110]
  - arm64: dts: Add AMD Pensando Salina SoC support (Brad Larson) [Orabug: 38546110]
  - mmc: sdhci-cadence: Support AMD Salina SoC (Brad Larson) [Orabug: 38546110]
  - PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() (Breno Leitao) [Orabug: 38597010] {CVE-2025-40034}
  - mm/hugetlb: disable huge_pmd_unshare TLB sync by default on Exadata (Joe Jin) [Orabug: 38829889]
  - vhost: Account for worker thread under owner's nproc (Mike Christie) [Orabug: 38770748]
  - vhost: revert CAP_SYS restrictions on worker ioctls (Mike Christie) [Orabug: 38770748]
  - RDMA/cm: Base cm_id destruction timeout on CMA values (Håkon Bugge) [Orabug: 38753654]
  - mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38420735,38773370] {CVE-2025-68209}
  - uek-rpm: Allow disabling kabichk at command line (Yifei Liu) [Orabug: 38744825]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-317.197.4.el8uek]
changelog:
  - gpio: mlxbf3: use platform_get_irq_optional() (David Thompson) [Orabug: 38755419]
  - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari) [Orabug: 38755419]
  - pinctrl: mlxbf3: Fix return value check for devm_platform_ioremap_resource (Chen Ni) [Orabug: 38755419]
  - net/mlx5e: Query FW for buffer ownership (Alexei Lazar) [Orabug: 38755419]
  - net/mlx5: Add IFC bits and enums for buf_ownership (Oren Sidi) [Orabug: 38755419]
  - net/mlx5: Update mlx5_ifc to support FEC for 200G per lane link modes (Jianbo Liu) [Orabug: 38755419]
  - net/mlx5e: Support FEC settings for 100G/lane modes (Cosmin Ratiu) [Orabug: 38755419]
  - net/mlx5e: Extract checking of FEC support for a link mode (Cosmin Ratiu) [Orabug: 38755419]
  - tcp: Set pingpong threshold via sysctl (Haiyang Zhang) [Orabug: 38853979]
  - arm64: hnic: config: Add NBD driver (Patrick Colp) [Orabug: 38858773]
  - arm64: pensando: Fix spec file for HNIC (Rob Gardner) [Orabug: 38858773]
  - Enable additional drivers needed to support MIPS64 SmartNic (Vijay Kumar) [Orabug: 38846771]
  - MIPS: Fix build error for mips ARCH_ATOMIC (Vijay Kumar) [Orabug: 38846771]
  - Added atomic addition,subtraction functions. (Anagha K J) [Orabug: 38846771]
  - Allocate the required IV size referenced by the cypher handle in init_state (Anagha K J) [Orabug: 38846771]
  - Setting up numa system and memory initializations (Anagha K J) [Orabug: 38846771]
  - Implemented clocksource provider driven by node-0 FPA_CLK_COUNT (Anagha K J) [Orabug: 38846771]
  - Processor cache information made available to userspace (Anagha K J) [Orabug: 38846771]
  - MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow (Thomas Bogendoerfer) [Orabug: 38851582]
  - usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE (Gopi Krishna Menon)
  - ext4: clear i_state_flags when alloc inode (Haibo Chen)
  - ext4: align max orphan file size with e2fsprogs limit (Baokun Li)
  - PM: runtime: Do not clear needs_force_resume with enabled runtime PM (Rafael J. Wysocki)
  - net: enetc: fix build warning when PAGE_SIZE is greater than 128K (Wei Fang)
  - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Xiang Mei) [Orabug: 38783137] {CVE-2025-68325}
  - block: fix comment for op_is_zone_mgmt() to include RESET_ALL (Shechenglong)
  - fuse: fix readahead reclaim deadlock (Joanne Koong) [Orabug: 38847946] {CVE-2025-68821}
  - i40e: validate ring_len parameter against hardware-specific values (Gregory Herrero)
  - fs/ntfs3: fix mount failure for sparse runs in run_unpack() (Konstantin Komarov)
  - ntfs3: init run lock for extend inode (Edward Adam Davis)


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-317.197.5.el8uek]
changelog:
  - KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang)  [Orabug: 38801641]
  - Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang)  [Orabug: 38801641]
  - uek-rpm: pensando: Move crashkernel to cnic-image-builder (Henry Willard)  [Orabug: 38851137]
  - ext4: drop dio overwrite only flag and associated warning (Brian Foster)  [Orabug: 38381010]
  - ext4: fix racy may inline data check in dio write (Brian Foster)  [Orabug: 38381010]
  - ext4: allow concurrent unaligned dio overwrites (Brian Foster)  [Orabug: 38381010]
  - ext4: dio take shared inode lock when overwriting preallocated blocks (Zhang Yi)  [Orabug: 38381010]
  - net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang)  [Orabug: 38172423]
  - uek-rpm: hnic: add unique hnic signing certs (Tom Saeger)  [Orabug: 38894488]
  - drivers/soc/pensando/sbus: Secure mode support. (Hiren Mehta)  [Orabug: 38894106]
  - drivers/soc/pensando/pen_secure: Report register address on access errors (Maciej S. Szmigiero)  [Orabug: 38894106]
  - drivers/edac/elba_edac: Secure mode support (Hiren Mehta)  [Orabug: 38894106]
  - drivers/soc/pensando/bsm: Add secure-mode support. (Hiren Mehta)  [Orabug: 38894106]
  - drivers/soc/pensando/rstcause: Add secure mode support. (Hiren Mehta)  [Orabug: 38894106]
  - drivers/soc/pensando/penfw: New SMC support for secure-mode. (Hiren Mehta)  [Orabug: 38894106]
  - drivers/soc/pensando/sbus: Secure mode support (Hiren Mehta)  [Orabug: 38894106]
  - sunrpc: fix client side handling of tls alerts (Olga Kornievskaia)  [Orabug: 38334981]  {CVE-2025-38571}
  - sunrpc: fix handling of server side tls alerts (Olga Kornievskaia)  [Orabug: 38334968]  {CVE-2025-38566}
  - xfrm: delete x->tunnel as we delete x (Sabrina Dubroca)  [Orabug: 38730492]  {CVE-2025-40215}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-317.197.5.1.el8uek]
changelog:
  - Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Vijayendra Suman)  [Orabug: 38961010]  
  - Revert "net/rds: expand kref coverage to rds_notifier->n_conn" (Sharath Srinivasan)  [Orabug: 38961010]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-317.197.5.1.el8uek]
changelog:
  - Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Vijayendra Suman)  [Orabug: 38961010]
  - Revert "net/rds: expand kref coverage to rds_notifier->n_conn" (Sharath Srinivasan)  [Orabug: 38961010]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-317.197.5.2.el8uek]
changelog:
  - xfrm: flush all states in xfrm_state_fini (Sabrina Dubroca)  [Orabug: 39016261]  
  - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added (Sabrina Dubroca)  [Orabug: 39016261]  
  - Revert "xfrm: destroy xfrm_state synchronously on net exit path" (Sabrina Dubroca)  [Orabug: 39016261]  
  - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima)  [Orabug: 39016219]  {CVE-2025-40149} 
  - net: Add locking to protect skb->dev access in ip_output (Sharath Chandra Vurukala)  [Orabug: 39016219]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-317.197.5.el8uek]
changelog:
  - KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38801641]
  - Partial backport of "KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()" (Dongli Zhang) [Orabug: 38801641]
  - uek-rpm: pensando: Move crashkernel to cnic-image-builder (Henry Willard) [Orabug: 38851137]
  - ext4: drop dio overwrite only flag and associated warning (Brian Foster) [Orabug: 38381010]
  - ext4: fix racy may inline data check in dio write (Brian Foster) [Orabug: 38381010]
  - ext4: allow concurrent unaligned dio overwrites (Brian Foster) [Orabug: 38381010]
  - ext4: dio take shared inode lock when overwriting preallocated blocks (Zhang Yi) [Orabug: 38381010]
  - net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang) [Orabug: 38172423]
  - uek-rpm: hnic: add unique hnic signing certs (Tom Saeger) [Orabug: 38894488]
  - drivers/soc/pensando/sbus: Secure mode support. (Hiren Mehta) [Orabug: 38894106]
  - drivers/soc/pensando/pen_secure: Report register address on access errors (Maciej S. Szmigiero) [Orabug: 38894106]
  - drivers/edac/elba_edac: Secure mode support (Hiren Mehta) [Orabug: 38894106]
  - drivers/soc/pensando/bsm: Add secure-mode support. (Hiren Mehta) [Orabug: 38894106]
  - drivers/soc/pensando/rstcause: Add secure mode support. (Hiren Mehta) [Orabug: 38894106]
  - drivers/soc/pensando/penfw: New SMC support for secure-mode. (Hiren Mehta) [Orabug: 38894106]
  - drivers/soc/pensando/sbus: Secure mode support (Hiren Mehta) [Orabug: 38894106]
  - sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [Orabug: 38334981,38932988] {CVE-2025-38571}
  - sunrpc: fix handling of server side tls alerts (Olga Kornievskaia) [Orabug: 38334968,38932991] {CVE-2025-38566}
  - xfrm: delete x->tunnel as we delete x (Sabrina Dubroca) [Orabug: 38730492,38933003] {CVE-2025-40215}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-318.199.1.el8uek]
changelog:
  - LTS version: v5.15.199 (Vijayendra Suman)
  - wifi: cfg80211: init wiphy_work before allocating rfkill fails (Edward Adam Davis) [Orabug: 39004275] {CVE-2025-22119}
  - wifi: cfg80211: fully move wiphy work to unbound workqueue (Johannes Berg)
  - wifi: cfg80211: cancel wiphy_work before freeing wiphy (Miri Korenblit) [Orabug: 39004414] {CVE-2025-21979}
  - wifi: cfg80211: fix wiphy delayed work queueing (Johannes Berg)
  - wifi: cfg80211: use system_unbound_wq for wiphy work (Johannes Berg)
  - team: Move team device type change at the end of team_port_add (Nikola Z. Ivanov)
  - pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
  - mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
  - writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
  - drm/imx/tve: fix probe device leak (Johan Hovold)
  - pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
  - net/sched: act_ife: convert comma to semicolon (Chen Ni)
  - btrfs: prevent use-after-free on page private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
  - drm/amdkfd: fix a memory leak in device_queue_manager_init() (Haoxiang Li)
  - can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
  - genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek)
  - HID: uclogic: Add NULL check in uclogic_input_configured() (Henry Martin) [Orabug: 39004242] {CVE-2025-38007}
  - HID: uclogic: Correct devm device reference for hidinput input_dev name (Rahul Rameshbabu)
  - wifi: mac80211: move TDLS work to wiphy work (Johannes Berg)
  - wifi: mac80211: use wiphy work for sdata->work (Johannes Berg)
  - wifi: cfg80211: add a work abstraction with special semantics (Johannes Berg)
  - Bluetooth: Fix hci_suspend_sync crash (Ying Hsu)
  - net: stmmac: make sure that ptp_rate is not 0 before configuring EST (Alexis Lothoré)
  - usbnet: Fix using smp_processor_id() in preemptible code warnings (Zqiang) [Orabug: 38649206] {CVE-2025-40164}
  - NFSD: fix race between nfsd registration and exports_proc (Maninder Singh) [Orabug: 38158712] {CVE-2025-38232}
  - ext4: fix memory leaks in ext4_fname_{setup_filename,prepare_lookup} (Luis Henriques)
  - espintcp: fix skb leaks (Sabrina Dubroca) [Orabug: 38094997] {CVE-2025-38057}
  - fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
  - ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency (Namjae Jeon)
  - drm/ttm: fix undefined behavior in bit shift for TTM_TT_FLAG_PRIV_POPULATED (Gaosheng Cui)
  - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Pedro Demarchi Gomes) [Orabug: 38773375] {CVE-2025-68211}
  - mm/pagewalk: add walk_page_range_vma() (David Hildenbrand)
  - ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
  - mei: trace: treat reg parameter as string (Alexander Usyskin)
  - ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda)
  - nvme: fix PCIe subsystem reset controller state transition (Nilay Shroff)
  - nvme-pci: do not directly handle subsys reset fallout (Keith Busch)
  - nvme-fc: rename free_ctrl callback to match name pattern (Daniel Wagner)
  - xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster)
  - dmaengine: stm32: dmamux: fix device leak on route allocation (Johan Hovold)
  - dmaengine: stm32: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
  - w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930799] {CVE-2025-71197}
  - w1: w1_therm: use swap() to make code cleaner (Yang Guang)
  - arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
  - scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931015] {CVE-2026-23087}
  - iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
  - of: platform: Use default match table for /firmware (Rob Herring)
  - comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
  - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima) [Orabug: 38649138] {CVE-2025-40149}
  - net: Add locking to protect skb->dev access in ip_output (Sharath Chandra Vurukala)
  - mptcp: only reset subflow errors when propagated (Matthieu Baerts)
  - scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
  - scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
  - ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
  - dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
  - gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
  - scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
  - net: bridge: fix static key check (Martin Kaiser)
  - nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
  - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Gal Pressman)
  - net/mlx5e: Report rx_discards_phy via rx_dropped (Yafang Shao)
  - ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
  - nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
  - rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970353] {CVE-2026-23164}
  - ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
  - net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
  - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
  - Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970605] {CVE-2026-23146}
  - bpf: Reject narrower access to pointer ctx fields (Paul Chaignon) [Orabug: 38335081] {CVE-2025-38591}
  - bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798882] {CVE-2025-68725}
  - migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931067] {CVE-2026-23097}
  - can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931121] {CVE-2026-23108}
  - can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
  - can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930883] {CVE-2026-23061}
  - can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930860] {CVE-2026-23058}
  - irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931002] {CVE-2026-23085}
  - perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
  - netrom: fix double-free in nr_route_frame() (Jeongjun Park)
  - uacce: ensure safe queue release with state management (Chenghai Huang)
  - uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
  - uacce: fix cdev handling in the cleanup path (Wenkai Lin)
  - intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931041] {CVE-2026-23091}
  - slimbus: core: fix device reference leak on report present (Johan Hovold)
  - slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
  - octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
  - arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang)
  - wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930941] {CVE-2026-23073}
  - wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
  - wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970255] {CVE-2026-23133}
  - mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
  - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931030] {CVE-2026-23089}
  - ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930967] {CVE-2026-23076}
  - iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kübrich)
  - iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
  - iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
  - of: fix reference count leak in of_alias_scan() (Weigang He)
  - leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931092] {CVE-2026-23101}
  - x86: make page fault handling disable interrupts properly (Cedric Xing)
  - net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
  - octeontx2-af: Fix error handling (Ratheesh Kannoth)
  - bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970200] {CVE-2026-23119}
  - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930993] {CVE-2026-23084}
  - drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristóf)
  - drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristóf)
  - usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
  - ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970223] {CVE-2026-23124}
  - mISDN: annotate data-race around dev->work (Eric Dumazet) [Orabug: 38970211] {CVE-2026-23121}
  - net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
  - net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
  - ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
  - regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930931] {CVE-2026-23071}
  - iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
  - staging:iio:adc:ad7280a: Register define cleanup. (Jonathan Cameron)
  - x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
  - scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
  - Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
  - Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
  - Revert "nfc/nci: Add the inconsistency check between the input data length and count" (Thadeu Lima de Souza Cascardo)
  - w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
  - comedi: dmm32at: serialize use of paged registers (Ian Abbott)
  - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930875] {CVE-2026-23060}
  - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931111] {CVE-2026-23105}
  - net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930949] {CVE-2026-23074}
  - ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931103] {CVE-2026-23103}
  - l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970203] {CVE-2026-23120}
  - fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
  - net: fou: use policy and operation tables generated from the spec (Jakub Kicinski)
  - net: fou: rename the source for linking (Jakub Kicinski)
  - netlink: add a proto specification for FOU (Jakub Kicinski)
  - gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima)
  - amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
  - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970226] {CVE-2026-23125}
  - bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931080] {CVE-2026-23099}
  - net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
  - testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
  - selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
  - ptp: add testptp mask test (Xabier Marquiegui)
  - selftests/ptp: Add -X option for testing PTP_SYS_OFFSET_PRECISE (Alex Maftei)
  - selftests/ptp: Add -x option for testing PTP_SYS_OFFSET_EXTENDED (Alex Maftei)
  - testptp: Add support for testing ptp_clock_info .adjphase callback (Rahul Rameshbabu)
  - testptp: add option to shift clock by nanoseconds (Maciek Machnikowski)
  - ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
  - posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)
  - Fix memory leak in posix_clock_open() (Linus Torvalds) [Orabug: 39004188] {CVE-2024-26655}
  - posix-clock: introduce posix_clock_context concept (Xabier Marquiegui)
  - btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (Robbie Ko) [Orabug: 38930779] {CVE-2025-71194}
  - dmaengine: ti: k3-udma: fix device leak on udma lookup (Johan Hovold)
  - dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation (Johan Hovold)
  - dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation (Johan Hovold)
  - dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() (Biju Das)
  - dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() (Miaoqian Lin)
  - dmaengine: lpc18xx-dmamux: fix device leak on route allocation (Johan Hovold)
  - dmaengine: idxd: fix device leaks on compat bind and unbind (Johan Hovold)
  - dmaengine: bcm-sba-raid: fix device leak on probe (Johan Hovold) [Orabug: 38914728] {CVE-2025-71190}
  - dmaengine: at_hdmac: fix device leak on of_dma_xlate() (Johan Hovold)
  - drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() (Haoxiang Li)
  - drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel (Marek Vasut) [Orabug: 38930830] {CVE-2026-23049}
  - drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare (Lyude Paul)
  - mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free (Aboorva Devarajan)
  - x86/resctrl: Fix memory bandwidth counter width for Hygon (Xiaochen Shen)
  - x86/resctrl: Add missing resctrl initialization for Hygon (Xiaochen Shen)
  - EDAC/i3200: Fix a resource leak in i3200_probe1() (Haoxiang Li)
  - EDAC/x38: Fix a resource leak in x38_probe1() (Haoxiang Li)
  - hrtimer: Fix softirq base check in update_needs_ipi() (Thomas Weißschuh)
  - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (Yangerkun) [Orabug: 38970601] {CVE-2026-23145}
  - nvme-pci: disable secondary temp for Wodposit WPBSNM8 (Ilikara Zheng)
  - USB: serial: ftdi_sio: add support for PICAXE AXE027 cable (Ethan Nelson-Moore)
  - USB: serial: option: add Telit LE910 MBIM composition (Ulrich Mohr)
  - USB: OHCI/UHCI: Add soft dependencies on ehci_platform (Huacai Chen)
  - usb: dwc3: Check for USB4 IP_NAME (Thinh Nguyen)
  - phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 (Wayne Chang)
  - phy: rockchip: inno-usb2: fix communication disruption in gadget mode (Luca Ceresoli)
  - phy: rockchip: inno-usb2: fix disconnection in gadget mode (Louis Chauvet)
  - x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers (Dan Williams)
  - net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts (Tetsuo Handa) [Orabug: 38887710] {CVE-2026-22997}
  - ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer (Jaroslav Kysela)
  - HID: usbhid: paper over wrong bNumDescriptor field (Benjamin Tissoires)
  - dmaengine: omap-dma: fix dma_pool resource leak in error paths (Xu Wang)
  - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) (Krzysztof Kozlowski)
  - phy: stm32-usphyc: Fix off by one in probe() (Dan Carpenter)
  - dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing (Suraj Gupta)
  - dmaengine: tegra-adma: Fix use-after-free (Sheetal)
  - mm, kfence: describe @slab parameter in __kfence_obj_info() (Bagas Sanjaya)
  - textsearch: describe @list member in ts_ops search (Bagas Sanjaya)
  - ASoC: tlv320adcx140: fix word length (Emil Svendsen)
  - net/sched: sch_qfq: do not free existing class in qfq_change_class() (Eric Dumazet) [Orabug: 38887718] {CVE-2026-22999}
  - selftests: drv-net: fix RPS mask handling for high CPU numbers (Gal Pressman)
  - net/mlx5e: Restore destroying state bit after profile cleanup (Saeed Mahameed)
  - vsock/test: add a final full barrier after run all tests (Stefano Garzarella)
  - ipv4: ip_gre: make ipgre_header() robust (Eric Dumazet) [Orabug: 38887758] {CVE-2026-23011}
  - macvlan: fix possible UAF in macvlan_forward_source() (Eric Dumazet) [Orabug: 38887730] {CVE-2026-23001}
  - net: update netdev_lock_{type,name} (Eric Dumazet)
  - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (Eric Dumazet) [Orabug: 38887738] {CVE-2026-23003}
  - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (Shivam Kumar) [Orabug: 38887714] {CVE-2026-22998}
  - nvmet-tcp: remove boilerplate code (Maurizio Lombardi)
  - can: etas_es58x: allow partial RX URB allocation to succeed (Szymon Wilczek)
  - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (Zilin Guan) [Orabug: 38914816] {CVE-2026-23038}
  - LTS version: v5.15.198 (Vijayendra Suman)
  - NFS: add barriers when testing for NFS_FSDATA_BLOCKED (Neil Brown)
  - NFS: unlink/rmdir shouldn't call d_delete() twice on ENOENT (Neil Brown)
  - efi/cper: Fix cper_bits_to_str buffer handling and return value (Dandan Zhang)
  - firmware: imx: scu-irq: Set mu_resource_id before get handle (Peng Fan)
  - scsi: sg: Fix occasional bogus elapsed time that exceeds timeout (Michal Rábek)
  - ASoC: fsl_sai: Add missing registers to cache default (Alexander Stein)
  - can: j1939: make j1939_session_activate() fail if device is no longer registered (Tetsuo Handa) [Orabug: 38914675] {CVE-2025-71182}
  - powercap: fix sscanf() error return value handling (Sumeet Pawnikar)
  - powercap: fix race condition in register_control_type() (Sumeet Pawnikar)
  - blk-throttle: Set BIO_THROTTLED when bio has been throttled (Laibin Qiu)
  - pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping (Bartosz Golaszewski)
  - pinctrl: qcom: lpass-lpi: Remove duplicate assignment of of_gpio_n_cells (Andy Shevchenko)
  - counter: interrupt-cnt: Drop IRQF_NO_THREAD flag (Alexander Sverdlin)
  - nfsd: provide locking for v4_end_grace (Neil Brown) [Orabug: 38887659] {CVE-2026-22980}
  - NFSD: Remove NFSERR_EAGAIN (Chuck Lever)
  - nfs_common: factor out nfs_errtbl and nfs_stat_to_errno (Mike Snitzer)
  - NFS: trace: show TIMEDOUT instead of 0x6e (Chen Hanxiao)
  - arp: do not assume dev_hard_header() does not change skb->head (Eric Dumazet) [Orabug: 39004363] {CVE-2026-22988}
  - net: usb: pegasus: fix memory leak in update_eth_regs_async() (Petko Manolov) [Orabug: 38914761] {CVE-2026-23021}
  - net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (Xiang Mei) [Orabug: 38872325] {CVE-2026-22976}
  - HID: quirks: work around VID/PID conflict for appledisplay (René Rebe)
  - bnxt_en: Fix potential data corruption with HW GRO/LRO (Srijit Bose)
  - net/mlx5e: Don't print error message due to invalid module (Gal Pressman)
  - netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates (Di Zhu)
  - net: sock: fix hardened usercopy panic in sock_recv_errqueue (Weiming Shi) [Orabug: 38877947] {CVE-2026-22977}
  - inet: ping: Fix icmp out counting (Yuan Gao)
  - net: mscc: ocelot: Fix crash when adding interface under a lag (Jerry Wu)
  - bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress (Alexandre Knecht)
  - net: marvell: prestera: fix NULL dereference on devlink_alloc() failure (Alok Tiwari)
  - netfilter: nf_conncount: update last_gc only when GC has been performed (Fernando Fernandez Mancera) [Orabug: 38970278] {CVE-2026-23139}
  - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Zilin Guan)
  - netfilter: nft_synproxy: avoid possible data-race on update operation (Fernando Fernandez Mancera)
  - ARM: dts: imx6q-ba16: fix RTC interrupt level (Ian Ray)
  - arm64: dts: add off-on-delay-us for usdhc2 regulator (Haibo Chen)
  - scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" (Xingui Yang)
  - scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset (Wen Xiong)
  - NFS: Fix up the automount fs_context to use the correct cred (Trond Myklebust)
  - NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew)
  - alpha: don't reference obsolete termio struct for TC* constants (Sam James)
  - ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels (Sebastian Andrzej Siewior)
  - csky: fix csky_cmpxchg_fixup not working (Yang Li)
  - ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (Ye Bin) [Orabug: 37844521] {CVE-2025-22121}
  - ext4: introduce ITAIL helper (Ye Bin)
  - libceph: make calc_target() set t->paused, not just clear it (Ilya Dryomov) [Orabug: 38930821] {CVE-2026-23047}
  - libceph: return the handler error from mon_handle_auth_done() (Ilya Dryomov) [Orabug: 38887697] {CVE-2026-22992}
  - libceph: make free_choose_arg_map() resilient to partial allocation (Tuo Li) [Orabug: 38887691] {CVE-2026-22991}
  - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (Ilya Dryomov) [Orabug: 38887685] {CVE-2026-22990}
  - libceph: prevent potential out-of-bounds reads in handle_auth_done() (Ziming Zhang) [Orabug: 38887673] {CVE-2026-22984}
  - wifi: avoid kernel-infoleak from struct iw_point (Eric Dumazet) [Orabug: 38887650] {CVE-2026-22978}
  - drm/pl111: Fix error handling in pl111_amba_probe (Miaoqian Lin)
  - lib/crypto: aes: Fix missing MMU protection for AES S-box (Eric Biggers)
  - mei: me: add nova lake point S DID (Alexander Usyskin)
  - net: 3com: 3c59x: fix possible null dereference in vortex_probe1() (Thomas Fourier) [Orabug: 38914755] {CVE-2026-23020}
  - atm: Fix dma_free_coherent() size (Thomas Fourier)
  - usb: gadget: lpc32xx_udc: fix clock imbalance in error path (Johan Hovold)
  - net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool() (Su Hui) [Orabug: 39004163] {CVE-2024-40928}
  - firmware: arm_scmi: Fix unused notifier-block in unregister (Amitai Gottlieb)
  - ext4: fix error message when rejecting the default hash (Gabriel Krisman Bertazi)
  - ext4: factor out ext4_hash_info_init() (Jason Yan)
  - ext4: filesystems without casefold feature cannot be mounted with siphash (Lizhi Xu) [Orabug: 37206152] {CVE-2024-49968}
  - pwm: stm32: Always program polarity (Sean Nyekjaer)
  - x86: remove __range_not_ok() (Arnd Bergmann)
  - selftests: net: test_vxlan_under_vrf: fix HV connectivity test (Andrea Righi)
  - ipv4: Fix uninit-value access in __ip_make_skb() (Shigeru Yoshida) [Orabug: 36683410] {CVE-2024-36927}
  - ipv6: Fix potential uninit-value access in __ip6_make_skb() (Shigeru Yoshida) [Orabug: 36683284] {CVE-2024-36903}
  - KVM: arm64: sys_regs: disable -Wuninitialized-const-pointer warning (Justin Stitt)
  - HID: core: Harden s32ton() against conversion to 0 bits (Alan Stern) [Orabug: 38334903] {CVE-2025-38556}
  - KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS (Sean Christopherson) [Orabug: 37116451] {CVE-2024-46830}
  - page_pool: Fix use-after-free in page_pool_recycle_in_ring (Dong Chenchen) [Orabug: 38152994] {CVE-2025-38129}
  - drm/i915/selftests: fix subtraction overflow bug (Andrzej Hajda)
  - mmc: core: use sysfs_emit() instead of sprintf() (Sergey Shtylyov)
  - net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. (Thadeu Lima de Souza Cascardo) [Orabug: 37844500] {CVE-2025-22111}
  - drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg() (Thomas Zimmermann)
  - wifi: mac80211: Discard Beacon frames to non-broadcast address (Jouni Malinen) [Orabug: 38852361] {CVE-2025-71127}
  - ASoC: stm32: sai: fix OF node leak on probe (Johan Hovold)
  - lockd: fix vfs_test_lock() calls (Neil Brown)
  - powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages (David Hildenbrand)
  - mm/balloon_compaction: convert balloon_page_delete() to balloon_page_finalize() (David Hildenbrand)
  - mm/balloon_compaction: we cannot have isolated pages in the balloon list (David Hildenbrand)
  - mm/balloon_compaction: make balloon page compaction callbacks static (Miaohe Lin)
  - ASoC: stm32: sai: fix clk prepare imbalance on probe failure (Johan Hovold)
  - ASoC: stm32: sai: Use the devm_clk_get_optional() helper (Christophe Jaillet)
  - ASoC: stm: Use dev_err_probe() helper (Kuninori Morimoto)
  - r8169: fix RTL8117 Wake-on-Lan in DASH mode (René Rebe)
  - iommu/qcom: fix device leak on of_xlate() (Johan Hovold)
  - powerpc/64s/slb: Fix SLB multihit issue during SLB preload (Donet Tom)
  - PCI: brcmstb: Fix disabling L0s capability (Jim Quinlan)
  - powerpc/pseries/cmm: call balloon_devinfo_init() also without CONFIG_BALLOON_COMPACTION (David Hildenbrand)
  - media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled (Miaoqian Lin)
  - media: samsung: exynos4-is: fix potential ABBA deadlock on init (Marek Szyprowski)
  - NFSD: NFSv4 file creation neglects setting ACL (Chuck Lever) [Orabug: 38847872] {CVE-2025-68803}
  - media: verisilicon: Protect G2 HEVC decoder against invalid DPB index (Nicolas Dufresne)
  - media: vpif_capture: fix section mismatch (Johan Hovold)
  - media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init() (Haoxiang Li)
  - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (Joshua Rogers) [Orabug: 38852341] {CVE-2025-71120}
  - KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (Jim Mattson)
  - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Shivani Agarwal) [Orabug: 38852312] {CVE-2025-71113}
  - svcrdma: bound check rq_pages index in inline path (Joshua Rogers) [Orabug: 38847976] {CVE-2025-71068}
  - ARM: dts: microchip: sama7g5: fix uart fifo size to 32 (Nicolas Ferre)
  - usb: ohci-nxp: fix device leak on probe failure (Johan Hovold)
  - usb: ohci-nxp: Use helper function devm_clk_get_enabled() (Zhang Zekun)
  - mptcp: pm: ignore unknown endpoint flags (Matthieu Baerts)
  - usb: dwc3: keep susphy enabled during exit to avoid controller faults (Udipto Goswami)
  - f2fs: fix to avoid updating zero-sized extent in extent cache (Chao Yu)
  - f2fs: fix to propagate error from f2fs_enable_checkpoint() (Chao Yu)
  - f2fs: use global inline_xattr_slab instead of per-sb slab cache (Chao Yu)
  - f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes() (Chao Yu)
  - xfs: fix a memory leak in xfs_buf_item_init() (Haoxiang Li)
  - KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit (Dongli Zhang)
  - NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap (Chuck Lever)
  - ALSA: wavefront: Fix integer overflow in sample size validation (Junrui Luo)
  - ALSA: wavefront: Use standard print API (Takashi Iwai)
  - ALSA: wavefront: Clear substream pointers on close (Junrui Luo)
  - wifi: mt76: Fix DTS power-limits on little endian systems (Sven Eckelmann)
  - btrfs: don't rewrite ret from inode_permission (Josef Bacik)
  - tpm: Cap the number of PCR banks (Jarkko Sakkinen) [Orabug: 38848017] {CVE-2025-71077}
  - jbd2: fix the inconsistency between checksum and data in memory for journal sb (Ye Bin)
  - xhci: dbgtty: fix device unregister (Łukasz Bartosik)
  - xhci: dbgtty: use IDR to support several dbc instances. (Mathias Nyman)
  - usb: gadget: udc: fix use-after-free in usb_gadget_state_work (Jimmy Hu) [Orabug: 38773636] {CVE-2025-68282}
  - usb: xhci: Apply the link chain quirk on NEC isoc endpoints (Michał Pecio) [Orabug: 37844150] {CVE-2025-22022}
  - usb: xhci: move link chain bit quirk checks into one helper function. (Niklas Neronin)
  - drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin) [Orabug: 38643537] {CVE-2025-40110}
  - virtio_console: fix order of fields cols and rows (Maximilian Immanuel Brandtner)
  - kbuild: Use CRC32 and a 1MiB dictionary for XZ compressed modules (Martin Nybo Andersen)
  - mm/damon/tests/core-kunit: handle memory alloc failure from damon_test_aggregate() (Seongjae Park)
  - mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_regions_of() (Seongjae Park)
  - mm/damon/tests/core-kunit: handle memory failure from damon_test_target() (Seongjae Park)
  - mm/damon/tests/core-kunit: handle alloc failures on damon_test_merge_two() (Seongjae Park)
  - mm/damon/tests/core-kunit: handle alloc failures on dasmon_test_merge_regions_of() (Seongjae Park)
  - mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_at() (Seongjae Park)
  - mm/damon/tests/core-kunit: handle allocation failures in damon_test_regions() (Seongjae Park)
  - mm/damon/tests/vaddr-kunit: handle alloc failures on damon_test_split_evenly_succ() (Seongjae Park)
  - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (Zhu Yanjun) [Orabug: 38094814] {CVE-2025-38022}
  - mm/damon/tests/vaddr-kunit: handle alloc failures on damon_do_test_apply_three_regions() (Seongjae Park)
  - mm/damon/tests/vaddr-kunit: handle alloc failures in damon_test_split_evenly_fail() (Seongjae Park)
  - drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb (Lyude Paul)
  - drm/ttm: Avoid NULL pointer deref for evicted BOs (Simon Richter) [Orabug: 38848052] {CVE-2025-71083}
  - drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers (Akhil P Oommen)
  - net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write (Deepanshu Kartikey)
  - net: usb: sr9700: fix incorrect command used to write single register (Ethan Nelson-Moore)
  - nfsd: Drop the client reference in client_states_open() (Haoxiang Li)
  - fjes: Add missing iounmap in fjes_hw_init() (Haoxiang Li)
  - e1000: fix OOB in e1000_tbi_should_accept() (Guangshuo Li) [Orabug: 38848099] {CVE-2025-71093}
  - RDMA/cm: Fix leaking the multicast GID table reference (Jason Gunthorpe) [Orabug: 38848058] {CVE-2025-71084}
  - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly (Jason Gunthorpe) [Orabug: 38848117] {CVE-2025-71096}
  - idr: fix idr_alloc() returning an ID out of range (Matthew Wilcox)
  - media: i2c: adv7842: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
  - media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
  - media: TDA1997x: Remove redundant cancel_delayed_work in probe (Duoming Zhou)
  - media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread() (Ivan Abramov)
  - media: cec: Fix debugfs leak on bus_register() failure (Xu Wang)
  - fbdev: tcx.c fix mem_map to correct smem_start offset (René Rebe)
  - fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing (Thorsten Blum)
  - fbdev: gbefb: fix to use physical address instead of dma address (René Rebe)
  - dm-ebs: Mark full buffer dirty even on partial write (Uladzislau Rezki)
  - media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() (Ivan Abramov)
  - parisc: entry: set W bit for !compat tasks in syscall_restore_rfi() (Sven Schnelle)
  - parisc: entry.S: fix space adjustment on interruption for 64-bit userspace (Sven Schnelle)
  - media: rc: st_rc: Fix reset control resource leak (Xu Wang)
  - mfd: max77620: Fix potential IRQ chip conflict when probing two devices (Krzysztof Kozlowski)
  - mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup (Johan Hovold)
  - leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs (Christian Hitz)
  - leds: leds-lp50xx: Allow LED 0 to be added to module bank (Christian Hitz)
  - PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths (Lukas Wunner)
  - HID: logitech-dj: Remove duplicate error logging (Hans de Goede)
  - iommu/tegra: fix device leak on probe_device() (Johan Hovold)
  - iommu/sun50i: fix device leak on of_xlate() (Johan Hovold)
  - iommu/omap: fix device leaks on probe_device() (Johan Hovold)
  - iommu/mediatek: fix device leak on of_xlate() (Johan Hovold)
  - iommu/mediatek-v1: fix device leak on probe_device() (Johan Hovold)
  - iommu/ipmmu-vmsa: fix device leak on of_xlate() (Johan Hovold)
  - iommu/exynos: fix device leak on of_xlate() (Johan Hovold)
  - iommu/apple-dart: fix device leak on of_xlate() (Johan Hovold)
  - ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment. (Srinivas Kandagatla)
  - ASoC: qcom: q6adm: the the copp device only during last instance (Srinivas Kandagatla)
  - ASoC: qcom: q6asm-dai: perform correct state check before closing (Srinivas Kandagatla)
  - ASoC: stm32: sai: fix device leak on probe (Johan Hovold)
  - selftests/ftrace: traceonoff_triggers: strip off names (Yipeng Zou)
  - RDMA/bnxt_re: fix dma_free_coherent() pointer (Thomas Fourier)
  - RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation (Lihonggang)
  - RDMA/bnxt_re: Fix to use correct page size for PDE table (Kalesh Ap)
  - RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send (Alok Tiwari)
  - RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db() (Alok Tiwari)
  - RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr() (Jang Ingyu)
  - RDMA/efa: Remove possible negative shift (Michael Margolin)
  - RDMA/irdma: avoid invalid read in irdma_net_event (Michal Schmidt) [Orabug: 38852379] {CVE-2025-71133}
  - net: rose: fix invalid array index in rose_kill_by_device() (Pwnverse)
  - ipv4: Fix reference count leak when using error routes with nexthop objects (Ido Schimmel) [Orabug: 38848125] {CVE-2025-71097}
  - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (Will Rosenberg) [Orabug: 38848061] {CVE-2025-71085}
  - octeontx2-pf: fix "UBSAN: shift-out-of-bounds error" (Anshumali Gaur)
  - net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct (Bagas Sanjaya)
  - net: usb: asix: validate PHY address before use (Deepanshu Kartikey) [Orabug: 38848107] {CVE-2025-71094}
  - net: dsa: b53: skip multicast entries for fdb_dump() (Jonas Gorski)
  - firewire: nosy: Fix dma_free_coherent() size (Thomas Fourier)
  - genalloc.h: fix htmldocs warning (Andrew Morton)
  - smc91x: fix broken irq-context in PREEMPT_RT (Levi Yun) [Orabug: 38852376] {CVE-2025-71132}
  - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure (Deepakkumar Karn) [Orabug: 38887620] {CVE-2025-71154}
  - team: fix check for port enabled in team_queue_override_port_prio_changed() (Jiri Pirko) [Orabug: 38848088] {CVE-2025-71091}
  - platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic (Junrui Luo)
  - platform/x86: msi-laptop: add missing sysfs_remove_group() (Thomas Fourier)
  - ip6_gre: make ip6gre_header() robust (Eric Dumazet) [Orabug: 38848131] {CVE-2025-71098}
  - net: openvswitch: Avoid needlessly taking the RTNL on vport destroy (Toke Høiland-Jørgensen)
  - net: mdio: aspeed: add dummy read to avoid read-after-write issue (Jacky Chou)
  - net: mdio: aspeed: move reg accessing part into separate functions (Potin Lai)
  - Bluetooth: btusb: revert use of devm_kzalloc in btusb (Raphael Pinsonneault-Thibeault) [Orabug: 38848044] {CVE-2025-71082}
  - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt (Herbert Xu) [Orabug: 38852370] {CVE-2025-71131}
  - iavf: fix off-by-one issues in iavf_config_rss_reg() (Kohei Enju) [Orabug: 38848073] {CVE-2025-71087}
  - i40e: Refactor argument of i40e_detect_recover_hung() (Ivan Vecera)
  - i40e: Refactor argument of several client notification functions (Ivan Vecera)
  - i40e: fix scheduling in set_rx_mode (Przemyslaw Korba)
  - hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU (Gui-Dong Han)
  - hwmon: (w83791d) Convert macros to functions to avoid TOCTOU (Gui-Dong Han) [Orabug: 38852300] {CVE-2025-71111}
  - hwmon: (max16065) Use local variable to avoid TOCTOU (Gui-Dong Han)
  - i2c: amd-mp2: fix reference leak in MP2 PCI device (Ma Ke)
  - rpmsg: glink: fix rpmsg device leak (Srinivas Kandagatla)
  - soc: amlogic: canvas: fix device leak on lookup (Johan Hovold)
  - soc: qcom: ocmem: fix device leak on lookup (Johan Hovold)
  - amba: tegra-ahb: Fix device leak on SMMU enable (Johan Hovold)
  - drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state() (Alex Deucher)
  - io_uring: fix filename leak in __io_openat_prep() (Prithvi Tambewagh)
  - svcrdma: return 0 on success from svc_rdma_copy_inline_range (Joshua Rogers)
  - nfsd: Mark variable __maybe_unused to avoid W=1 build break (Andy Shevchenko)
  - fsnotify: do not generate ACCESS/MODIFY events on child for special files (Amir Goldstein) [Orabug: 38847800] {CVE-2025-68788}
  - tracing: Do not register unsupported perf events (Steven Rostedt) [Orabug: 38852355] {CVE-2025-71125}
  - KVM: nSVM: Clear exit_code_hi in VMCB when synthesizing nested VM-Exits (Sean Christopherson)
  - KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN) (Sean Christopherson)
  - KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation (Yosry Ahmed)
  - KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (Fuqiang Wang) [Orabug: 38852273] {CVE-2025-71104}
  - KVM: x86: Explicitly set new periodic hrtimer expiration in apic_timer_fn() (Fuqiang Wang)
  - KVM: x86: WARN if hrtimer callback for periodic APIC timer fires with period=0 (Sean Christopherson)
  - libceph: make decode_pool() more resilient against corrupted osdmaps (Ilya Dryomov) [Orabug: 38852325] {CVE-2025-71116}
  - parisc: Do not reprogram affinitiy on ASP chip (Helge Deller)
  - scs: fix a wrong parameter in __scs_magic (Zhichi Lin)
  - platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver (Tzung-Bi Shih)
  - ocfs2: fix kernel BUG in ocfs2_find_victim_chain (Prithvi Tambewagh) [Orabug: 38847688] {CVE-2025-68771}
  - media: vidtv: initialize local pointers upon transfer of memory ownership (Jeongjun Park)
  - tools/testing/nvdimm: Use per-DIMM device handle (Alison Schofield)
  - f2fs: fix return value of f2fs_recover_fsync_data() (Chao Yu)
  - f2fs: invalidate dentry cache on failed whiteout creation (Deepanshu Kartikey)
  - scsi: target: Reset t_task_cdb pointer in error case (Andrey Vatoropin) [Orabug: 38847770] {CVE-2025-68782}
  - NFSD: use correct reservation type in nfsd4_scsi_fence_client (Dai Ngo)
  - scsi: aic94xx: fix use-after-free in device removal path (Junrui Luo) [Orabug: 38848009] {CVE-2025-71075}
  - scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (Tony Battersby) [Orabug: 38847931] {CVE-2025-68818}
  - cpufreq: nforce2: fix reference count leak in nforce2 (Miaoqian Lin)
  - intel_th: Fix error handling in intel_th_output_open (Ma Ke)
  - char: applicom: fix NULL pointer dereference in ac_ioctl (Tianchu Chen)
  - usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc() (Haoxiang Li)
  - usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe (Miaoqian Lin)
  - usb: phy: isp1301: fix non-OF device reference imbalance (Johan Hovold)
  - USB: lpc32xx_udc: Fix error handling in probe (Ma Ke)
  - phy: broadcom: bcm63xx-usbh: fix section mismatches (Johan Hovold)
  - media: pvrusb2: Fix incorrect variable used in trace message (Colin Ian King)
  - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() (Jeongjun Park) [Orabug: 38847937] {CVE-2025-68819}
  - usb: usb-storage: Maintain minimal modifications to the bcdDevice range. (Chenchangcheng)
  - media: v4l2-mem2mem: Fix outdated documentation (Laurent Pinchart)
  - jbd2: use a weaker annotation in journal handling (Byungchul Park)
  - ext4: fix incorrect group number assertion in mb_check_buddy (Yongjian Sun)
  - ext4: xattr: fix null pointer deref in ext4_raw_inode() (Karina Yankevich) [Orabug: 38848276] {CVE-2025-68820}
  - ktest.pl: Fix uninitialized var in config-bisect.pl (Steven Rostedt)
  - floppy: fix for PAGE_SIZE != 4KB (René Rebe)
  - block: rate-limit capacity change info log (Li Chen)
  - lib/crypto: x86/blake2s: Fix 32-bit arg treated as 64-bit (Eric Biggers)
  - mmc: sdhci-msm: Avoid early clock doubling during HS400 transition (Sarthak Garg)
  - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Jarkko Sakkinen) [Orabug: 38887597] {CVE-2025-71147}
  - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella)
  - platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks (Chia-Lin Kao)
  - nvme-fc: don't hold rport lock when putting ctrl (Daniel Wagner)
  - serial: sprd: Return -EPROBE_DEFER when uart clock is not ready (Wenhua Lin)
  - usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive. (Chenchangcheng)
  - usb: xhci: limit run_graceperiod for only usb 3.0 devices (Hongyu Xie)
  - usb: typec: ucsi: Handle incorrect num_connectors capability (Mark Pearson) [Orabug: 38852285] {CVE-2025-71108}
  - usbip: Fix locking bug in RT-enabled kernels (Lizhi Xu)
  - exfat: fix remount failure in different process environments (Yuezhang Mo)
  - via_wdt: fix critical boot hang due to unnamed resource allocation (Li Qiang) [Orabug: 38852318] {CVE-2025-71114}
  - scsi: qla2xxx: Use reinit_completion on mbx_intr_comp (Tony Battersby)
  - scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive (Tony Battersby)
  - scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled (Tony Battersby)
  - powerpc/addnote: Fix overflow on 32-bit builds (Ben Collins)
  - clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 & pcie_x4 (Josua Mayer)
  - ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx (Matthias Schiffer)
  - firmware: imx: scu-irq: Init workqueue before request mbox channel (Peng Fan)
  - ipmi: Fix __scan_channels() failing to rescan channels (Jinhui Guo)
  - ipmi: Fix the race between __scan_channels() and deliver_response() (Jinhui Guo)
  - ALSA: usb-mixer: us16x08: validate meter packet indices (Shipei Qu) [Orabug: 38847775] {CVE-2025-68783}
  - ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path (Xu Wang)
  - ALSA: vxpocket: Fix resource leak in vxpocket_probe error path (Xu Wang)
  - net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (Shaurya Rane) [Orabug: 38847724] {CVE-2025-68776}
  - mmc: sdhci-esdhc-imx: add alternate ARCH_S32 dependency to Kconfig (Jared Kangas)
  - spi: fsl-cpm: Check length parity before switching to 16 bit mode (Christophe Leroy)
  - ACPI: CPPC: Fix missing PCC check for guaranteed_perf (Pengjie Zhang)
  - Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
  - Input: ti_am335x_tsc - fix off-by-one error in wire_order validation (Junjie Cao)
  - HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen (Ping Cheng)
  - net: hns3: add VLAN id validation before using (Jian Shen)
  - net: hns3: using the num_tqps to check whether tqp_index is out of range when vf get ring info from mbx (Jian Shen)
  - net: hns3: Align type of some variables with their print type (Hao Chen)
  - net: hns3: using the num_tqps in the vf driver to apply for resources (Jian Shen)
  - net/mlx5: fw_tracer, Handle escaped percent properly (Shay Drory)
  - net/mlx5: fw_tracer, Validate format string parameters (Shay Drory) [Orabug: 38847914] {CVE-2025-68816}
  - ethtool: Avoid overflowing userspace buffer on stats query (Gal Pressman) [Orabug: 38847826] {CVE-2025-68795}
  - net/ethtool/ioctl: split ethtool_get_phy_stats into multiple helpers (Daniil Tatianin)
  - net/ethtool/ioctl: remove if n_stats checks from ethtool_get_phy_stats (Daniil Tatianin)
  - ethtool: use phydev variable (Tom Rix)
  - nfc: pn533: Fix error code in pn533_acr122_poweron_rdr() (Dan Carpenter)
  - net/sched: ets: Remove drr class from the active list if it changes to strict (Victor Nogueira) [Orabug: 38847910] {CVE-2025-68815}
  - caif: fix integer underflow in cffrml_receive() (Junrui Luo)
  - ipvs: fix ipv4 null-ptr-deref in route error path (Slavin Liu) [Orabug: 38847900] {CVE-2025-68813}
  - netfilter: nf_conncount: fix leaked ct in error paths (Fernando Fernandez Mancera) [Orabug: 38974757] {CVE-2025-71146}
  - broadcom: b44: prevent uninitialized value usage (Alexey Simakov)
  - net: openvswitch: fix middle attribute validation in push_nsh() action (Ilya Maximets) [Orabug: 38847784] {CVE-2025-68785}
  - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (Ido Schimmel)
  - mlxsw: spectrum_router: Fix neighbour use-after-free (Ido Schimmel)
  - ipvlan: Ignore PACKET_LOOPBACK in handle_mode_l2() (Dmitry Skorodumov)
  - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (Jamal Hadi Salim) [Orabug: 38847965] {CVE-2025-71066}
  - netrom: Fix memory leak in nr_sendmsg() (Wang Liang)
  - Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE (Gongwei Li)
  - btrfs: scrub: always update btrfs_scrub_progress::last_physical (Qu Wenruo)
  - hfsplus: fix volume corruption issue for generic/073 (Viacheslav Dubeyko)
  - hfsplus: Verify inode mode when loading from disk (Tetsuo Handa)
  - hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create (Yang Chenzhi)
  - hfsplus: fix volume corruption issue for generic/070 (Viacheslav Dubeyko)
  - fs/ntfs3: Support timestamps prior to epoch (Konstantin Komarov)
  - livepatch: Match old_sympos 0 and 1 in klp_find_func() (Song Liu)
  - cpufreq: s5pv210: fix refcount leak (Shuhao Fu)
  - ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only (Sakari Ailus)
  - ACPICA: Avoid walking the Namespace if start_node is NULL (Cryolitia Pukngae) [Orabug: 38852333] {CVE-2025-71118}
  - x86/ptrace: Always inline trivial accessors (Peter Zijlstra)
  - sched/deadline: only set free_cpus for online runqueues (Doug Berger) [Orabug: 38847753] {CVE-2025-68780}
  - btrfs: fix memory leak of fs_devices in degraded seed device path (Deepanshu Kartikey)
  - bpf, arm64: Do not audit capability check in do_jit() (Ondrej Mosnacek)
  - spi: tegra210-quad: Fix X1_X2_X4 encoding and support x4 transfers (Vishwaroop A)
  - coresight: etm4x: Correct polling IDLE bit (Leo Yan)
  - netfilter: nf_conncount: garbage collection is not skipped when jiffies wrap around (Nicklas Bo Jensen)
  - NFS: Fix missing unlock in nfs_unlink() (Sun Ke)
  - ASoC: fsl_xcvr: get channel status data when PHY is not exists (Shengjiu Wang)
  - ALSA: dice: fix buffer overflow in detect_stream_formats() (Junrui Luo) [Orabug: 38798767] {CVE-2025-68346}
  - usb: phy: Initialize struct usb_phy list_head (Diogo Ivo)
  - usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt (Haotien Hsu)
  - ocfs2: fix memory leak in ocfs2_merge_rec_left() (Dmitry Antipov)
  - efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs (Mauro Carvalho Chehab)
  - efi/cper: Adjust infopfx size to accept an extra space (Mauro Carvalho Chehab)
  - efi/cper: Add a new helper function to print bitmasks (Mauro Carvalho Chehab)
  - dm log-writes: Add missing set_freezable() for freezable kthread (Xu Wang)
  - dm-raid: fix possible NULL dereference with undefined raid type (Alexey Simakov)
  - ARM: 9464/1: fix input-only operand modification in load_unaligned_zeropad() (Pangliyuan)
  - ALSA: uapi: Fix typo in asound.h comment (Andres J Rosa)
  - dma/pool: eliminate alloc_pages warning in atomic_pool_expand (Dave Kleikamp)
  - blk-mq: Abort suspend when wakeup events are pending (Cong Zhang)
  - ASoC: ak5558: Disable regulator when error happens (Shengjiu Wang)
  - ASoC: ak4458: Disable regulator when error happens (Shengjiu Wang)
  - ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure() (Xu Wang)
  - platform/x86: asus-wmi: use brightness_set_blocking() for kbd led (Anton Khirnov)
  - fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8() (Armin Wolf)
  - NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (Trond Myklebust) [Orabug: 38818237] {CVE-2025-68764}
  - fs_context: drop the unused lsm_flags member (Ondrej Mosnacek)
  - Revert "nfs: ignore SB_RDONLY when mounting nfs" (Trond Myklebust)
  - Revert "nfs: clear SB_RDONLY before getting superblock" (Trond Myklebust)
  - Revert "nfs: ignore SB_RDONLY when remounting nfs" (Trond Myklebust)
  - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (Jonathan Curley) [Orabug: 38798775] {CVE-2025-68349}
  - NFS: Initialise verifiers for visible dentries in nfs_atomic_open() (Trond Myklebust)
  - NFS: Fix the verifier for case sensitive filesystem in nfs_atomic_open() (Trond Myklebust)
  - NFSv4: Add some support for case insensitive filesystems (Trond Myklebust)
  - fs/nls: Fix utf16 to utf8 conversion (Armin Wolf)
  - NFS: Avoid changing nlink when file removes and attribute updates race (Trond Myklebust)
  - NFS: don't unhash dentry during unlink/rename (Neil Brown)
  - NFS: Label the dentry with a verifier in nfs_rmdir() and nfs_unlink() (Trond Myklebust)
  - fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe() (Abdun Nihaal)
  - pinctrl: single: Fix incorrect type for error return variable (Xu Wang)
  - pinctrl: single: Fix PIN_CONFIG_BIAS_DISABLE handling (Matthijs Kooijman)
  - perf tools: Fix split kallsyms DSO counting (Namhyung Kim)
  - remoteproc: qcom_q6v5_wcss: fix parsing of qcom,halt-regs (Alexandru Gagniuc)
  - mtd: lpddr_cmds: fix signed shifts in lpddr_cmds (Ivan Stepchenko)
  - net: stmmac: fix rx limit check in stmmac_rx_zc() (Alexey Kodanev)
  - netfilter: nft_connlimit: update the count if add was skipped (Fernando Fernandez Mancera)
  - netfilter: nf_conncount: rework API to use sk_buff directly (Fernando Fernandez Mancera)
  - netfilter: nf_conncount: reduce unnecessary GC (William Tu)
  - netfilter: flowtable: check for maximum number of encapsulations in bridge vlan (Pablo Neira Ayuso)
  - regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex (Sparkhuang) [Orabug: 38798787] {CVE-2025-68354}
  - ASoC: Intel: catpt: Fix error path in hw_params() (Cezary Rojewski)
  - virtio: fix virtqueue_set_affinity() docs (Michael S. Tsirkin)
  - virtio_vdpa: fix misleading return in void function (Alok Tiwari)
  - ext4: improve integrity checking in __mb_check_buddy by enhancing order-0 validation (Yongjian Sun)
  - ext4: remove unused return value of __mb_check_buddy (Kemeng Shi)
  - ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4 (René Rebe)
  - drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1() (Dan Carpenter)
  - ASoC: fsl_xcvr: clear the channel status control memory (Shengjiu Wang)
  - ASoC: fsl_xcvr: Add support for i.MX93 platform (Chancel Liu)
  - ASoC: fsl_xcvr: Add Counter registers (Shengjiu Wang)
  - RDMA/irdma: Fix data race in irdma_free_pble (Krzysztof Czurylo)
  - RDMA/irdma: Fix data race in irdma_sc_ccq_arm (Krzysztof Czurylo)
  - iommu/arm-smmu-qcom: Enable use of all SMR groups when running bare-metal (Stephan Gerhold)
  - backlight: lp855x: Fix lp855x.h kernel-doc warnings (Randy Dunlap)
  - backlight: led-bl: Add devlink to supplier LEDs (Luca Ceresoli)
  - backlight: led_bl: Take led_access lock when required (Mans Rullgard)
  - wifi: ieee80211: correct FILS status codes (Ria Thomas)
  - PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition (Shawn Lin)
  - staging: fbtft: core: fix potential memory leak in fbtft_probe_common() (Jianglei Nie)
  - mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() (Zilin Guan)
  - crypto: ccree - Correctly handle return of sg_nents_for_len (Xu Wang)
  - selftests/bpf: Improve reliability of test_perf_branches_no_hw() (Matt Bobrowski)
  - selftests/bpf: skip test_perf_branches_hw() on unsupported platforms (Matt Bobrowski)
  - usb: dwc2: fix hang during suspend if set as peripheral (Jisheng Zhang)
  - usb: dwc2: fix hang during shutdown if set as peripheral (Jisheng Zhang)
  - usb: dwc2: disable platform lowlevel hw resources during shutdown (Jisheng Zhang)
  - usb: chaoskey: fix locking for O_NONBLOCK (Oliver Neukum)
  - ima: Handle error code returned by ima_filter_rule_match() (Zhao Yipeng) [Orabug: 38798922] {CVE-2025-68740}
  - wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb() (Seungjin Bae) [Orabug: 38798815] {CVE-2025-68362}
  - mfd: mt6358-irq: Fix missing irq_domain_remove() in error path (Xu Wang)
  - mfd: mt6397-irq: Fix missing irq_domain_remove() in error path (Xu Wang)
  - pwm: bcm2835: Make sure the channel is enabled after pwm_request() (Uwe Kleine-König)
  - drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue (Jay Liu)
  - fs/ntfs3: Prevent memory leaks in add sub record (Edward Adam Davis)
  - fs/ntfs3: out1 also needs to put mi (Edward Adam Davis)
  - fs/ntfs3: Make ni_ins_new_attr return error (Konstantin Komarov)
  - fs/ntfs3: Add new argument is_mft to ntfs_mark_rec_free (Konstantin Komarov)
  - fs/ntfs3: Remove unused mi_mark_free (Konstantin Komarov)
  - powerpc/64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE format (Ritesh Harjani)
  - wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() (Abdun Nihaal) [Orabug: 38818222] {CVE-2025-68759}
  - NFSD/blocklayout: Fix minlength check in proc_layoutget (Sergey Bashirov)
  - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Xu Wang)
  - watchdog: wdat_wdt: Stop watchdog when uninstalling module (Liu Xinpeng)
  - selftests/bpf: Fix failure paths in send_signal test (Alexei Starovoitov)
  - ps3disk: use memcpy_{from,to}_bvec index (René Rebe)
  - PCI: keystone: Exit ks_pcie_probe() for invalid mode (Siddharth Vadapalli)
  - leds: netxbig: Fix GPIO descriptor leak in error paths (Xu Wang)
  - scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls (Xu Wang)
  - ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint() (Xu Wang)
  - ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent() (Dmitry Antipov) [Orabug: 38798824] {CVE-2025-68364}
  - lib/vsprintf: Check pointer before dereferencing in time_and_date() (Andy Shevchenko)
  - clk: renesas: r9a06g032: Fix memory leak in error path (Xu Wang)
  - coresight: etm4x: Add context synchronization before enabling trace (Leo Yan)
  - coresight: etm4x: Extract the trace unit controlling (Leo Yan)
  - coresight-etm4x: add isb() before reading the TRCSTATR (Yuanfang Zhang)
  - coresight: etm4x: Use Trace Filtering controls dynamically (Suzuki K Poulose)
  - coresight: etm4x: Save restore TRFCR_EL1 (Suzuki K Poulose)
  - nbd: defer config unlock in nbd_genl_connect (Zheng Qixing) [Orabug: 38798833] {CVE-2025-68366}
  - wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper() (Abdun Nihaal)
  - macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (Long Li) [Orabug: 38798838] {CVE-2025-68367}
  - powerpc/32: Fix unpaired stwcx. on interrupt exit (Christophe Leroy)
  - RDMA/rtrs: server: Fix error handling in get_or_create_srv (Ma Ke)
  - dt-bindings: PCI: amlogic: Fix the register name of the DBI region (Manivannan Sadhasivam)
  - dt-bindings: PCI: convert amlogic,meson-pcie.txt to dt-schema (Neil Armstrong)
  - scsi: stex: Fix reboot_notifier leak in probe error path (Xu Wang)
  - nbd: defer config put in recv_work (Zheng Qixing) [Orabug: 38798851] {CVE-2025-68372}
  - nbd: partition nbd_read_stat() into nbd_read_reply() and nbd_handle_reply() (Yu Kuai)
  - nbd: clean up return value checking of sock_xmit() (Yu Kuai)
  - regulator: core: disable supply if enabling main regulator fails (Gabor Juhos)
  - perf/x86/intel: Correct large PEBS flag check (Dapeng Mi)
  - ext4: correct the checking of quota files before moving extents (Zhang Yi)
  - ext4: minor defrag code improvements (Eric Whitney)
  - mfd: da9055: Fix missing regmap_del_irq_chip() in error path (Xu Wang)
  - spi: tegra210-quad: Fix timeout handling (Vishwaroop A) [Orabug: 38798944] {CVE-2025-68746}
  - spi: tegra210-quad: modify chip select (CS) deactivation (Vishwaroop A)
  - scsi: target: Do not write NUL characters into ASCII configfs output (Bart Van Assche)
  - power: supply: apm_power: only unset own apm_get_power_status (Ahelenia Ziemiańska)
  - power: supply: wm831x: Check wm831x_set_bits() return value (Ivan Abramov)
  - i3c: master: svc: Prevent incomplete IBI transaction (Stanley Chu)
  - i3c: fix refcount inconsistency in i3c_master_register (Frank Li)
  - pinctrl: stm32: fix hwspinlock resource leak in probe function (Xu Wang)
  - x86/dumpstack: Prevent KASAN false positive warnings in __show_regs() (Tengda Wu)
  - x86: kmsan: don't instrument stack walking functions (Alexander Potapenko)
  - kmsan: introduce __no_sanitize_memory and __no_kmsan_checks (Alexander Potapenko)
  - compiler-gcc.h: Define __SANITIZE_ADDRESS__ under hwaddress sanitizer (Kees Cook)
  - sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock(). (Kuniyuki Iwashima)
  - phy: mscc: Fix PTP for VSC8574 and VSC8572 (Horatiu Vultur)
  - firmware: imx: scu-irq: fix OF node leak in (Peng Fan)
  - s390/ap: Don't leak debug feature files if AP instructions are not available (Heiko Carstens)
  - s390/smp: Fix fallback CPU detection (Heiko Carstens)
  - crypto: hisilicon/qm - restore original qos values (Nieweiqiang)
  - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (Thorsten Blum) [Orabug: 38798875] {CVE-2025-68724}
  - uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe (Li Qiang)
  - arm64: dts: imx8mm-venice-gw72xx: remove unused sdhc1 pinctrl (Tim Harvey)
  - iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member (Francesco Lavra)
  - iio: imu: st_lsm6dsx: discard samples during filters settling time (Lorenzo Bianconi)
  - iio: imu: st_lsm6dsx: introduce st_lsm6dsx_device_set_enable routine (Lorenzo Bianconi)
  - inet: Avoid ehash lookup race in inet_ehash_insert() (Luoxuanqiang)
  - rculist: Add hlist_nulls_replace_rcu() and hlist_nulls_replace_init_rcu() (Luoxuanqiang)
  - ntfs3: Fix uninit buffer allocated by __getname() (Sidharth Seela)
  - ntfs3: fix uninit memory after failed mi_read in mi_format_new (Raphael Pinsonneault-Thibeault)
  - irqchip/qcom-irq-combiner: Fix section mismatch (Johan Hovold)
  - USB: Fix descriptor count when handling invalid MBIM extended descriptor (Seungjin Bae)
  - drm/vgem-fence: Fix potential deadlock on release (Janusz Krzysztofik) [Orabug: 38818212] {CVE-2025-68757}
  - drm/panel: visionox-rm69299: Don't clear all mode flags (Guido Günther)
  - gpu: host1x: Fix race in syncpt alloc/free (Mainak Sen) [Orabug: 38798899] {CVE-2025-68732}
  - smack: fix bug: unprivileged task can create labels (Konstantin Andreev)
  - staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing (Navaneeth K) [Orabug: 38773544] {CVE-2025-68254}
  - staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing (Navaneeth K) [Orabug: 38773554] {CVE-2025-68255}
  - comedi: check device's attached status in compat ioctls (Nikita Zhandarovich)
  - comedi: multiq3: sanitize config options in multiq3_attach() (Nikita Zhandarovich)
  - comedi: c6xdigio: Fix invalid PNP driver unregistration (Ian Abbott)
  - HID: elecom: Add support for ELECOM M-XT3URBK (018F) (Naoki Ueki)
  - platform/x86: huawei-wmi: add keys for HONOR models (Ston Jia)
  - platform/x86: acer-wmi: Ignore backlight event (Armin Wolf)
  - pinctrl: qcom: msm: Fix deadlock in pinmux configuration (Praveen Talari)
  - bfs: Reconstruct file type when loading from disk (Tetsuo Handa)
  - spi: imx: keep dma request disabled before dma transfer setup (Robin Gong)
  - spi: xilinx: increase number of retries before declaring stall (Alvaro Gamez Machado)
  - USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC (Johan Hovold)
  - USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC (Johan Hovold)
  - serial: add support of CPCI cards (Magne Bruno)
  - USB: serial: ftdi_sio: match on interface number for jtag (Johan Hovold)
  - USB: serial: option: move Telit 0x10c7 composition in the right place (Fabio Porcedda)
  - USB: serial: option: add Telit Cinterion FE910C04 new compositions (Fabio Porcedda)
  - USB: serial: option: add Foxconn T99W760 (Slark Xiao)
  - comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel() (Nikita Zhandarovich)
  - ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (Alexey Nepomnyashih) [Orabug: 38773587] {CVE-2025-68261}
  - locking/spinlock/debug: Fix data-race in do_raw_write_lock (Alexander Sverdlin)
  - ext4: refresh inline data size before write operations (Deepanshu Kartikey) [Orabug: 38773603] {CVE-2025-68264}
  - jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (Ye Bin) [Orabug: 38792633] {CVE-2025-68337}
  - Documentation: process: Also mention Sasha Levin as stable tree maintainer (Bagas Sanjaya)
  - leds: spi-byte: Use devm_led_classdev_register_ext() (Stefan Kalscheuer)
  - leds: Replace all non-returning strlcpy with strscpy (Azeem Shaikh)
  - drm/i915/selftests: Fix inconsistent IS_ERR and PTR_ERR (Kai Song)
  - dpaa2-mac: bail if the dpmacs fwnode is not found (Robert-Ionut Alexa)
  - xfrm: flush all states in xfrm_state_fini (Sabrina Dubroca)
  - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added (Sabrina Dubroca) [Orabug: 39004269] {CVE-2025-40256}
  - Revert "xfrm: destroy xfrm_state synchronously on net exit path" (Sabrina Dubroca)


author: Samasth Norway Ananda <samasth.norway.ananda@oracle.com> [5.15.0-318.199.2.el8uek]
changelog:
  - drivers/soc/pensando/penfw: Add support for pcie serdes fw download. (Hiren Mehta) [Orabug: 38953591]
  - arm64: pensando: Add support for kpcimgr dynamic event queue (Rob Gardner) [Orabug: 38928823]
  - procfs: move dropping pde and pid from ->evict_inode() to ->free_inode() (Al Viro) [Orabug: 38945002]
  - ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38188749]
  - jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38188749]
  - Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923519]
  - Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923519]
  - Revert "IB/core: Fix off-by-one attr index in setup_hw_port_stats" (Sharath Srinivasan) [Orabug: 38923519]
  - drivers/soc/pensando/bsm: Fix various issues with secure-mode. (Hiren Mehta) [Orabug: 38944299]
  - net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928274]
  - net/rds: rds_send_xmit should INIT_LIST_HEAD(&to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928272]
  - net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928270]
  - net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923496]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-318.199.3.el8uek]
changelog:
  - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
  - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970594] {CVE-2026-23202}
  - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
  - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
  - x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
  - KVM: x86: Don't snapshot "max" TSC if host TSC is constant (Sean Christopherson) [Orabug: 38966500]
  - KVM: x86: Accept KVM_[GS]ET_TSC_KHZ as a VM ioctl. (David Woodhouse) [Orabug: 38966500]
  - sfc: fix NULL dereferences in ef100_process_design_param() (Edward Cree) [Orabug: 37855346] {CVE-2025-37860}
  - Revert "net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn" (Sharath Srinivasan) [Orabug: 38937481]
  - Revert "net/rds: expand kref coverage to rds_notifier->n_conn" (Sharath Srinivasan) [Orabug: 38937481]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-318.199.3.1.el8uek]
changelog:
  - nvme-pci: fix stuck reset on concurrent DPC and HP (Keith Busch)  [Orabug: 39026355]
  - nvme: cancel pending I/O if nvme controller is in terminal state (Nilay Shroff)  [Orabug: 39026355]
  - nvme-pci: fix queue unquiesce check on slot_reset (Keith Busch)  [Orabug: 39026355]
  - nvme: ensure disabling pairs with unquiesce (Keith Busch)  [Orabug: 39026355]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-318.199.3.2.el8uek]
changelog:
  - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet)  [Orabug: 39057366]
  - macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet)  [Orabug: 39057366]  {CVE-2026-23209}
  - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano)  [Orabug: 39057346]  {CVE-2026-23111}
  - net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong)  [Orabug: 39055945]


author: Jack Vogel <jack.vogel@oracle.com> [5.15.0-318.199.3.2.1.el8uek]
changelog:
  - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39071316]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-317.197.1.el8uek]
changelog:
  - LTS version: v5.15.197 (Vijayendra Suman)
  - libbpf: Fix invalid return address register in s390 (Daniel T. Lee)
  - libbpf, riscv: Use a0 for RC register (Yixun Lan)
  - libbpf: Fix riscv register names (Ilya Leoshkevich)
  - selftests/bpf: Don't rely on preserving volatile in PT_REGS macros in loop3 (Andrii Nakryiko)
  - scsi: pm80xx: Set phy->enable_completion only when we (Igor Pylypiv) [Orabug: 37159744] {CVE-2024-47666}
  - Bluetooth: Add more enc key size check (Alex Lu)
  - usb: renesas_usbhs: Fix synchronous external abort on unbind (Claudiu Beznea) [Orabug: 38792571] {CVE-2025-68327}
  - usb: renesas_usbhs: Convert to platform remove callback returning void (Uwe Kleine-König)
  - smb: client: fix memory leak in cifs_construct_tcon() (Paulo Alcantara) [Orabug: 38773704] {CVE-2025-68295}
  - mptcp: Fix proto fallback detection with BPF (Jiayuan Chen) [Orabug: 38773435] {CVE-2025-68227}
  - mptcp: avoid unneeded subflow-level drops (Paolo Abeni)
  - selftests: mptcp: join: rm: set backup flag (Matthieu Baerts)
  - staging: rtl8712: Remove driver using deprecated API wext (Philipp Hortmann)
  - libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (Ziming Zhang) [Orabug: 38773649] {CVE-2025-68284}
  - libceph: fix potential use-after-free in have_mon_and_osd_map() (Ilya Dryomov) [Orabug: 38773655] {CVE-2025-68285}
  - drm/amd/display: Check NULL before accessing (Alex Hung) [Orabug: 38773664] {CVE-2025-68286}
  - drm: sti: fix device leaks at component probe (Johan Hovold)
  - USB: serial: option: add support for Rolling RW101R-GL (Vanillan Wang)
  - USB: serial: ftdi_sio: add support for u-blox EVK-M101 (Oleksandr Suvorov)
  - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host (Mathias Nyman)
  - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths (Manish Nagar) [Orabug: 38773671] {CVE-2025-68287}
  - usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer (Owen Gu) [Orabug: 38792593] {CVE-2025-68331}
  - usb: storage: sddr55: Reject out-of-bound new_pba (Tianchu Chen) [Orabug: 38762730] {CVE-2025-40345}
  - usb: storage: Fix memory leak in USB bulk transport (Desnes Nunes) [Orabug: 38773677] {CVE-2018-1000204,CVE-2025-68288}
  - usb: gadget: f_eem: Fix memory leak in eem_unwrap (Kuen-Han Tsai) [Orabug: 38773687] {CVE-2025-68289}
  - usb: cdns3: Fix double resource release in cdns3_pci_probe (Miaoqian Lin)
  - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking (Miaoqian Lin)
  - firmware: stratix10-svc: fix bug in saving controller data (Khairul Anuar Romli)
  - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves (Miaoqian Lin)
  - thunderbolt: Add support for Intel Wildcat Lake (Alan Borzeszkowski)
  - drivers/usb/dwc3: fix PCI parent check (Jamie Iles)
  - dm-verity: fix unreliable memory allocation (Mikulas Patocka)
  - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling (Marc Kleine-Budde)
  - can: sja1000: fix max irq loop handling (Thomas Mühlbacher)
  - atm/fore200e: Fix possible data race in fore200e_open() (Gui-Dong Han)
  - iio: accel: bmc150: Fix irq assumption regression (Linus Walleij) [Orabug: 38792587] {CVE-2025-68330}
  - iio:common:ssp_sensors: Fix an error handling path ssp_probe() (Christophe Jaillet)
  - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields (Francesco Lavra)
  - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" (Jiri Olsa) [Orabug: 38893604]
  - spi: bcm63xx: fix premature CS deassertion on RX-only transactions (Hang Zhou)
  - mailbox: mailbox-test: Fix debugfs_create_dir error checking (Xu Wang)
  - net: atlantic: fix fragment overflow handling in RX path (Jiefeng Zhang) [Orabug: 38773729] {CVE-2025-68301}
  - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic (Vladimir Oltean)
  - net: dsa: sja1105: simplify static configuration reload (Russell King)
  - net: dsa: sja1105: Convert to mdiobus_c45_read (Andrew Lunn)
  - net: sxgbe: fix potential NULL dereference in sxgbe_rx() (Alexey Kodanev)
  - net/mlx5e: Fix validation logic in rate limiting (Danielle Costantino)
  - net: aquantia: Add missing descriptor cache invalidation on ATL2 (Kai-Heng Feng)
  - platform/x86: intel: punit_ipc: fix memory corruption (Dan Carpenter)
  - Bluetooth: SMP: Fix not generating mackey and ltk when repairing (Luiz Augusto von Dentz)
  - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers (Seungjin Bae) [Orabug: 38773760] {CVE-2025-68308}
  - Revert "block: don't add or resize partition on the disk with GENHD_FL_NO_PART" (Gulam Mohamed) [Orabug: 38652797]
  - Revert "block: Move checking GENHD_FL_NO_PART to bdev_add_partition()" (Gulam Mohamed) [Orabug: 38652797]
  - mptcp: do not fallback when OoO is present (Paolo Abeni)
  - mptcp: fix a race in mptcp_pm_del_add_timer() (Eric Dumazet) [Orabug: 38730656] {CVE-2025-40257}
  - mptcp: fix premature close in case of fallback (Paolo Abeni)
  - mptcp: fix ack generation for fallback msk (Paolo Abeni)
  - dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups (Krzysztof Kozlowski)
  - Input: pegasus-notetaker - fix potential out-of-bounds access (Seungjin Bae)
  - Input: remove third argument of usb_maxpacket() (Vincent Mailhol)
  - usb: deprecate the third argument of usb_maxpacket() (Vincent Mailhol)
  - mptcp: Disallow MPTCP subflows from sockmap (Jiayuan Chen)
  - selftests: mptcp: connect: fix fallback note due to OoO (Matthieu Baerts)
  - pmdomain: samsung: plug potential memleak during probe (André Draszik)
  - pmdomain: arm: scmi: Fix genpd leak on provider registration failure (Sudeep Holla)
  - pmdomain: imx: Fix reference count leak in imx_gpc_remove (Miaoqian Lin)
  - net: netpoll: fix incorrect refcount handling causing incorrect cleanup (Breno Leitao) [Orabug: 38773509] {CVE-2025-68245}
  - mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 (Shawn Lin)
  - net: qede: Initialize qede_ll_ops with designated initializer (Nathan Chancellor)
  - btrfs: fix crash on racing fsync and size-extending write into prealloc (Omar Sandoval) [Orabug: 36774582] {CVE-2024-37354}
  - btrfs: add helper to truncate inode items when logging inode (Filipe Manana)
  - Makefile.compiler: replace cc-ifversion with compiler-specific macros (Nick Desaulniers)
  - tracing/tools: Fix incorrcet short option in usage text for --threads (Zhang Chujun)
  - net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error (Nishanth Menon)
  - ALSA: usb-audio: fix uac2 clock source at terminal parser (René Rebe)
  - mm/secretmem: fix use-after-free race in fault handler (Lance Yang) [Orabug: 38737039] {CVE-2025-40272}
  - mm/mm_init: fix hash table order logging in alloc_large_system_hash() (Isaac J. Manjarres)
  - kconfig/nconf: Initialize the default locale at startup (Jakub Horký)
  - kconfig/mconf: Initialize the default locale at startup (Jakub Horký)
  - net: tls: Cancel RX async resync request on rcd_delta overflow (Shahar Shitrit)
  - selftests: net: use BASH for bareudp testing (Po-Hsu Lin)
  - scsi: core: Fix a regression triggered by scsi_host_busy() (Bart Van Assche) [Orabug: 38773426]
  - vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj) [Orabug: 38730611,38786193,38788594] {CVE-2025-40248}
  - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Pavel Zhigulin) [Orabug: 38730629] {CVE-2025-40252}
  - kernel.h: Move ARRAY_SIZE() to a separate header (Alejandro Colomar)
  - platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos (Xu Wang)
  - s390/ctcm: Fix double-kfree (Aleksei Nikiforov)
  - net: openvswitch: remove never-working support for setting nsh fields (Ilya Maximets) [Orabug: 38730648] {CVE-2025-40254}
  - net: dsa: hellcreek: fix missing error handling in LED registration (Pavel Zhigulin)
  - mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() (Zilin Guan)
  - drm/tegra: dc: Fix reference leak in tegra_dc_couple() (Ma Ke)
  - mptcp: fix race condition in mptcp_schedule_work() (Eric Dumazet) [Orabug: 38730659,38932997] {CVE-2025-40258}
  - MIPS: Malta: Fix !EVA SOC-it PCI MMIO (Maciej W. Rozycki)
  - scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() (Hamza Mahfooz) [Orabug: 38773440] {CVE-2025-68229}
  - scsi: sg: Do not sleep in atomic context (Bart Van Assche) [Orabug: 38730663] {CVE-2025-40259}
  - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [Orabug: 38730673] {CVE-2025-40261}
  - Input: imx_sc_key - fix memory corruption on unload (Dan Carpenter)
  - Input: cros_ec_keyb - fix an invalid memory access (Tzung-Bi Shih) [Orabug: 38730680] {CVE-2025-40263}
  - be2net: pass wrb_params in case of OS2BMC (Andrey Vatoropin) [Orabug: 38730689] {CVE-2025-40264}
  - exfat: check return value of sb_min_blocksize in exfat_read_boot_sector (Yongpeng Yang)
  - mtd: rawnand: cadence: fix DMA device NULL pointer dereference (Niravkumar L Rabara)
  - net/sched: act_connmark: handle errno on tcf_idr_check_alloc (Pedro Tammela)
  - isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (Abdun Nihaal) [Orabug: 38798907] {CVE-2025-68734}
  - EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection (Niravkumar L Rabara)
  - EDAC/altera: Handle OCRAM ECC enable after warm reset (Niravkumar L Rabara)
  - spi: Try to get ACPI GPIO IRQ earlier (Hans de Goede)
  - ALSA: usb-audio: Fix missing unlock at error path of maxpacksize check (Takashi Iwai)
  - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (Takashi Iwai) [Orabug: 38737023] {CVE-2025-40269}
  - fs/proc: fix uaf in proc_readdir_de() (Wei Yang) [Orabug: 38737033,38786194,38788587] {CVE-2025-40271}
  - ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (Chuang Wang) [Orabug: 38773495] {CVE-2025-68241}
  - strparser: Fix signed/unsigned mismatch bug (Nate Karstens)
  - gcov: add support for GCC 15 (Peter Oberparleiter)
  - NFSD: free copynotify stateid in nfs4_free_ol_stateid() (Olga Kornievskaia) [Orabug: 38737042] {CVE-2025-40273}
  - HID: hid-ntrig: Prevent memory leak in ntrig_report_version() (Masami Ichikawa)
  - mtd: onenand: Pass correct pointer to IRQ handler (Dan Carpenter)
  - lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN (Eric Biggers)
  - mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592026] {CVE-2025-40040}
  - bpf: Add bpf_prog_run_data_pointers() (Eric Dumazet) [Orabug: 38773327] {CVE-2025-68200}
  - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (Haein Lee) [Orabug: 38737051] {CVE-2025-40275}
  - NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() (Trond Myklebust)
  - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (Ian Forbes) [Orabug: 38737060] {CVE-2025-40277}
  - ASoC: cs4271: Fix regulator leak on probe failure (Xu Wang)
  - regulator: fixed: fix GPIO descriptor leak on register failure (Xu Wang)
  - acpi,srat: Fix incorrect device handle check for Generic Initiator (Shuai Xue)
  - Bluetooth: L2CAP: export l2cap_chan_hold for modules (Pauli Virtanen)
  - hsr: Fix supervision frame sending on HSRv0 (Felix Maurer)
  - net_sched: limit try_bulk_dequeue_skb() batches (Eric Dumazet)
  - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Gal Pressman)
  - net/mlx5e: Fix maxrate wraparound in threshold between units (Gal Pressman)
  - net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (Ranganath V N)
  - net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (Ranganath V N) [Orabug: 38737072] {CVE-2025-40279}
  - net_sched: act_connmark: use RCU in tcf_connmark_dump() (Eric Dumazet)
  - net/sched: act_connmark: transition to percpu stats and rcu (Pedro Tammela)
  - net: sched: act_connmark: get rid of tcf_connmark_walker and tcf_connmark_search (Zhengchao Shao)
  - net: sched: act: move global static variable net_id to tc_action_ops (Zhengchao Shao)
  - wifi: mac80211: skip rate verification for not captured PSDUs (Benjamin Berg)
  - net: mdio: fix resource leak in mdiobus_register_device() (Csaba Buday)
  - tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima) [Orabug: 38737082,38786195,38788585] {CVE-2025-40280}
  - net/smc: fix mismatch between CLC header and proposal (D. Wythe)
  - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto (Eric Dumazet) [Orabug: 38737090] {CVE-2025-40281}
  - Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions (Pauli Virtanen)
  - Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion (Pauli Virtanen)
  - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (Pauli Virtanen)
  - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (Raphael Pinsonneault-Thibeault) [Orabug: 38737103] {CVE-2025-40283}
  - net: fec: correct rx_bytes statistic for the case SHIFT16 is set (Wei Fang)
  - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (Sharique Mohammad)
  - NFS: check if suid/sgid was cleared after a write as needed (Scott Mayhew)
  - HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (Tristan Lobb)
  - NFS4: Fix state renewals missing after boot (Joshua Watt)
  - RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors (Danil Skrebenkov)
  - compiler_types: Move unused static inline functions warning to W=2 (Peter Zijlstra)
  - drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (Janusz Krzysztofik) [Orabug: 38773506] {CVE-2025-68244}
  - selftests: netdevsim: set test timeout to 10 minutes (Jakub Kicinski)
  - extcon: adc-jack: Cleanup wakeup source only if it was enabled (Krzysztof Kozlowski)
  - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC (Nathan Chancellor)
  - rtc: rx8025: fix incorrect register reference (Yuta Hayama)
  - tracing: Fix memory leaks in create_field_var() (Zilin Guan)
  - bnxt_en: Fix a possible memory leak in bnxt_ptp_init (Kalesh Ap)
  - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (Qendrim Maxhuni) [Orabug: 38773282] {CVE-2025-68192}
  - sctp: Hold sock lock while iterating over address list (Stefan Wiehler)
  - sctp: Prevent TOCTOU out-of-bounds write (Stefan Wiehler) [Orabug: 38747446] {CVE-2025-40331}
  - sctp: Hold RCU read lock while iterating over address list (Stefan Wiehler)
  - net: dsa: b53: stop reading ARL entries if search is done (Jonas Gorski)
  - net: dsa: b53: fix enabling ip multicast (Jonas Gorski)
  - net: dsa: b53: fix resetting speed and pause on forced link (Jonas Gorski)
  - net: vlan: sync VLAN features with lower device (Hangbin Liu)
  - selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh (Wang Liang)
  - netdevsim: add Makefile for selftests (David Wei)
  - selftests/net: use destination options instead of hop-by-hop (Anubhav Singh)
  - selftests/net: fix GRO coalesce test and add ext header coalesce tests (Richard Gobert)
  - selftests/net: fix out-of-order delivery of FIN in gro:tcp test (Anubhav Singh)
  - net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx (Jonas Gorski)
  - riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro (Josephine Pfeiffer)
  - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" (Baochen Qiang)
  - ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again (Kailang Yang)
  - ceph: add checking of wait_for_completion_killable() return value (Viacheslav Dubeyko)
  - ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (Valerio Setti)
  - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (Albin Babu Varghese) [Orabug: 38737181] {CVE-2025-40304}
  - ACPI: property: Return present device nodes only on fwnode interface (Sakari Ailus)
  - 9p: sysfs_init: don't hardcode error to ENOMEM (Randall P. Embry)
  - cpufreq: tegra186: Initialize all cores to max frequencies (Aaron Kling)
  - 9p: fix /sys/fs/9p/caches overwriting itself (Randall P. Embry)
  - clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled (Matthias Schiffer)
  - clk: at91: clk-master: Add check for divide by 3 (Ryan Wanner)
  - ARM: at91: pm: save and restore ACR during PLL disable/enable (Nicolas Ferre)
  - rtc: pcf2127: clear minute/second interrupt (Josua Mayer)
  - um: Fix help message for ssl-non-raw (Tiwei Bie)
  - fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink (Yikang Yue)
  - btrfs: mark dirty extent range for out of bound prealloc extents (Austinchang)
  - RDMA/hns: Fix wrong WQE data when QP wraps around (Junxian Huang)
  - RDMA/irdma: Set irdma_cq cq_num field during CQ create (Jacob Moroni)
  - RDMA/irdma: Remove unused struct irdma_cq fields (Jacob Moroni)
  - RDMA/irdma: Fix SD index calculation (Jacob Moroni)
  - ACPICA: Update dsmethod.c to get rid of unused variable warning (Saket Dumbre)
  - orangefs: fix xattr related buffer overflow... (Mike Marshall)
  - page_pool: Clamp pool size to max 16K pages (Dragos Tatulea)
  - exfat: limit log print for IO error (Chi Zhiling)
  - ALSA: usb-audio: add mono main switch to Presonus S1824c (Roy Vegard Ovesen)
  - Bluetooth: bcsp: receive data only if registered (Ivan Pravdin) [Orabug: 38737212] {CVE-2025-40308}
  - Bluetooth: SCO: Fix UAF on sco_conn_free (Luiz Augusto von Dentz) [Orabug: 38737223] {CVE-2025-40309}
  - net: macb: avoid dealing with endianness in macb_set_hwaddr() (Théo Lebrun)
  - fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock (Chuguangqing)
  - scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() (Alok Tiwari)
  - nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing (Al Viro) [Orabug: 38773244] {CVE-2025-68185}
  - NFSv4.1: fix mount hang after CREATE_SESSION failure (Anthony Iliopoulos)
  - NFSv4: handle ERR_GRACE on delegation recalls (Olga Kornievskaia)
  - remoteproc: qcom: q6v5: Avoid handling handover twice (Stephan Gerhold)
  - sparc/module: Add R_SPARC_UA64 relocation handling (Koakuma)
  - PCI: cadence: Check for the existence of cdns_pcie::ops before using it (Chen Wang)
  - r8169: set EEE speed down ratio to 1 (Chunhao Lin)
  - net: intel: fm10k: Fix parameter idx set but not used (Brahmajit Das)
  - wifi: ath10k: Fix connection after GTK rekeying (Loic Poulain)
  - iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() (Seyediman Seyedarab)
  - net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X (Robert Marko)
  - jfs: fix uninitialized waitqueue in transaction manager (Shaurya Rane)
  - jfs: Verify inode mode when loading from disk (Tetsuo Handa)
  - ipv6: np->rxpmtu race annotation (Eric Dumazet)
  - usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (Krishna Kurapati)
  - usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (Forest Crossman)
  - allow finish_no_open(file, ERR_PTR(-E...)) (Al Viro)
  - scsi: lpfc: Define size of debugfs entry for xri rebalancing (Justin Tee)
  - scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup (Justin Tee)
  - scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET (Justin Tee)
  - selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency (Nai-Chen Cheng)
  - page_pool: always add GFP_NOWARN for ATOMIC allocations (Jakub Kicinski) [Orabug: 38773835] {CVE-2025-68321}
  - drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl (Tvrtko Ursulin)
  - net/cls_cgroup: Fix task_get_classid() during qdisc run (Yafang Shao)
  - udp_tunnel: use netdev_warn() instead of netdev_WARN() (Alok Tiwari) [Orabug: 38773275] {CVE-2025-68191}
  - selftests: Replace sleep with slowwait (David Ahern)
  - eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP (Daniel Palmer)
  - selftests: Disable dad for ipv6 in fcnal-test.sh (David Ahern)
  - x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT (Li Rongqing)
  - netfilter: nf_reject: don't reply to icmp error messages (Florian Westphal)
  - selftests: traceroute: Use require_command() (Ido Schimmel)
  - media: redrat3: use int type to store negative error codes (Rong Qianfeng)
  - net: sh_eth: Disable WoL if system can not suspend (Niklas Söderlund)
  - phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 (Michael Riesch)
  - phy: cadence: cdns-dphy: Enable lower resolutions in dphy (Harikrishna Shenoy)
  - ntfs3: pretend $Extend records as regular files (Tetsuo Handa)
  - net: phy: marvell: Fix 88e1510 downshift counter errata (Rohan G Thomas)
  - drm/msm: make sure to not queue up recovery more than once (Antonino Maniscalco)
  - usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (Chen Yufeng)
  - usb: gadget: f_hid: Fix zero length packet transfer (William Wu)
  - iommu/amd: Skip enabling command/event buffers for kdump (Ashish Kalra)
  - net: call cond_resched() less often in __release_sock() (Eric Dumazet)
  - net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms (Juraj Šarinay)
  - ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled (Yue Haibing)
  - drm/msm/dsi/phy_7nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
  - drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL (Krzysztof Kozlowski)
  - dmaengine: dw-edma: Set status for callback_result (Devendra K Verma)
  - dmaengine: mv_xor: match alloc_wc and free_wc (Rosen Penev)
  - dmaengine: sh: setup_xref error handling (Thomas Andreatta)
  - ptp: Limit time setting of PTP clocks (Miroslav Lichvar)
  - scsi: pm8001: Use int instead of u32 to store error codes (Rong Qianfeng)
  - mips: lantiq: xway: sysctrl: rename stp clock (Aleksander Jan Bajkowski)
  - mips: lantiq: danube: add missing device_type in pci node (Aleksander Jan Bajkowski)
  - mips: lantiq: danube: add missing properties to cpu node (Aleksander Jan Bajkowski)
  - media: fix uninitialized symbol warnings (Chelsy Ratnawat)
  - drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (Amber Lin)
  - extcon: adc-jack: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
  - scsi: pm80xx: Fix race condition caused by static variables (Francisco Gutierrez)
  - scsi: mpi3mr: Fix controller init failure on fault during queue creation (Chandrakanth Patil)
  - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (Takashi Iwai)
  - PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (Sungho Kim)
  - net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. (Kuniyuki Iwashima)
  - net: When removing nexthops, don't call synchronize_net if it is not necessary (Christoph Paasch)
  - char: misc: Does not request module for miscdevice with dynamic minor (Zijun Hu)
  - usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (Raub Camaioni)
  - iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (Rodrigo Gobbi)
  - drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts (Dmitry Baryshkov)
  - media: imon: make send_packet() more robust (Tetsuo Handa) [Orabug: 38773297] {CVE-2025-68194}
  - net: ipv6: fix field-spanning memcpy warning in AH output (Charalampos Mitrodimas) [Orabug: 38773140] {CVE-2025-40363}
  - bridge: Redirect to backup port when port is administratively down (Ido Schimmel)
  - powerpc/eeh: Use result of error_detected() in uevent (Niklas Schnelle)
  - thunderbolt: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
  - net: stmmac: Check stmmac_hw_setup() in stmmac_resume() (Tiezhu Yang)
  - x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall (Kirill A. Shutemov)
  - drm/tidss: Set crtc modesetting parameters with adjusted mode (Jayesh Choudhary)
  - drm/tidss: Use the crtc_* timings when programming the HW (Tomi Valkeinen)
  - media: pci: ivtv: Don't create fake v4l2_fh (Laurent Pinchart)
  - drm/amdkfd: return -ENOTTY for unsupported IOCTLs (Geoffrey Mcrae)
  - selftests/net: Ensure assert() triggers in psock_tpacket.c (Wake Liu)
  - selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 (Wake Liu)
  - PCI: Disable MSI on RDC PCI to PCIe bridges (Marcos Del Sol Vives)
  - drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (Seyediman Seyedarab)
  - drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff (Sathishkumar S)
  - drm/amd/pm: Use cached metrics data on arcturus (Lijo Lazar)
  - drm/amd/pm: Use cached metrics data on aldebaran (Lijo Lazar)
  - mfd: da9063: Split chip variant reading in two bus transactions (Jens Kehne)
  - mfd: madera: Work around false-positive -Wininitialized warning (Arnd Bergmann)
  - mfd: stmpe-i2c: Add missing MODULE_LICENSE (Alexander Stein)
  - mfd: stmpe: Remove IRQ domain upon removal (Alexander Stein)
  - tools/power x86_energy_perf_policy: Prefer driver HWP limits (Len Brown)
  - tools/power x86_energy_perf_policy: Enhance HWP enable (Len Brown)
  - tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage (Kaushlendra Kumar)
  - tools/cpupower: Fix incorrect size in cpuidle_state_disable() (Kaushlendra Kumar)
  - hwmon: (dell-smm) Add support for Dell OptiPlex 7040 (Armin Wolf)
  - uprobe: Do not emulate/sstep original instruction when ip is changed (Jiri Olsa)
  - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Daniel Lezcano)
  - cpuidle: Fail cpuidle device registration if there is one already (Rafael J. Wysocki)
  - tools/cpupower: fix error return value in cpupower_write_sysfs() (Kaushlendra Kumar)
  - video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (Svyatoslav Ryhel)
  - nvme-fc: use lock accessing port_state and rport state (Daniel Wagner) [Orabug: 38747531] {CVE-2025-40342}
  - nvmet-fc: avoid scheduling association deletion twice (Daniel Wagner) [Orabug: 38747538] {CVE-2025-40343}
  - tee: allow a driver to allocate a tee_device without a pool (Amirreza Zarrabi)
  - ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (Hans de Goede)
  - mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (Sarthak Garg)
  - power: supply: sbs-charger: Support multiple devices (Fabien Proriol)
  - hwmon: (sbtsi_temp) AMD CPU extended temperature range support (Chuande Chen)
  - ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] (Hans de Goede)
  - ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (Shang Song)
  - irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment (Christian Bruel)
  - arc: Fix __fls() const-foldability via __builtin_clzl() (Kees Cook)
  - cpufreq/longhaul: handle NULL policy in longhaul_exit (Dennis Beier)
  - selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 (Ricardo B. Marlière)
  - ACPI: video: force native for Lenovo 82K8 (Mario Limonciello)
  - memstick: Add timeout to prevent indefinite waiting (Jiayi Li)
  - mmc: host: renesas_sdhi: Fix the actual clock (Biju Das)
  - pinctrl: single: fix bias pull up/down handling in pin_config_set (Chi Zhang)
  - bpf: Don't use %pK through printk (Thomas Weißschuh)
  - soc: ti: pruss: don't use %pK through printk (Thomas Weißschuh)
  - spi: loopback-test: Don't use %pK through printk (Thomas Weißschuh)
  - soc: qcom: smem: Fix endian-unaware access of num_entries (Jens Reidel)
  - soc: aspeed: socinfo: Add AST27xx silicon IDs (Ryan Chen)
  - block: make REQ_OP_ZONE_OPEN a write operation (Damien Le Moal)
  - drm/sysfb: Do not dereference NULL pointer in plane reset (Thomas Zimmermann) [Orabug: 38773123] {CVE-2025-40360}
  - drm/sched: Fix race in drm_sched_entity_select_rq() (Philipp Stanner)
  - usb: gadget: f_fs: Fix epfile null pointer access after ep enable. (Owen Gu)
  - Revert "docs/process/howto: Replace C89 with C11" (Matthieu Baerts)
  - arch: back to -std=gnu89 in < v5.18 (Matthieu Baerts)
  - x86/boot: Compile boot code with -std=gnu11 too (Alexey Dobriyan)
  - xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event (Mathias Nyman)
  - xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive. (Mathias Nyman)
  - xhci: dbc: Improve performance by removing delay in transfer event polling. (Mathias Nyman)
  - xhci: dbc: Allow users to modify DbC poll interval via sysfs (Uday M Bhat)
  - xhci: dbc: poll at different rate depending on data transfer activity (Mathias Nyman)
  - xhci: dbc: Provide sysfs option to configure dbc descriptors (Mathias Nyman)
  - x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
  - net: phy: dp83867: Disable EEE support as not implemented (Emanuele Ghidoli)
  - can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
  - net: ravb: Enforce descriptor type ordering (Lad Prabhakar)
  - ravb: Exclude gPTP feature support for RZ/G2L (Biju Das)
  - dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp (Xu Yang)
  - serial: 8250_dw: handle reset control deassert error (Artem Shimko)
  - serial: 8250_dw: Use devm_add_action_or_reset() (Andy Shevchenko)
  - block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL (Damien Le Moal)
  - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland (John Smith)
  - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji (John Smith)
  - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (Yang Wang)
  - net: hns3: return error code when function fails (Jijie Shao)
  - drm/etnaviv: fix flush sequence logic (Tomeu Vizoso)
  - usbnet: Prevents free active kevent (Lizhi Xu) [Orabug: 38773783] {CVE-2025-68312}
  - libbpf: Fix powerpc's stack register definition in bpf_tracing.h (Andrii Nakryiko)
  - libbpf: Normalize PT_REGS_xxx() macro definitions (Andrii Nakryiko)
  - riscv, libbpf: Add RISC-V (RV64) support to bpf_tracing.h (Björn Töpel)
  - bpf: Do not audit capability check in do_jit() (Ondrej Mosnacek)
  - bpf: Sync pending IRQ work before freeing ring buffer (Noorain Eqbal) [Orabug: 38737284] {CVE-2025-40319}
  - ALSA: usb-audio: fix control pipe direction (Roy Vegard Ovesen)
  - drm/msm/a6xx: Fix GMU firmware parser (Akhil P Oommen)
  - wifi: ath10k: Fix memory leak on unsupported WMI command (Loic Poulain)
  - ASoC: qdsp6: q6asm: do not sleep while atomic (Srinivas Kandagatla)
  - mptcp: restore window probe (Paolo Abeni)
  - fbdev: valkyriefb: Fix reference count leak in valkyriefb_init (Miaoqian Lin)
  - fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (Florian Fuchs)
  - wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode (Gokul Sivakumar) [Orabug: 38737291] {CVE-2025-40321}
  - fbdev: bitblit: bound-check glyph index in bit_putcs* (Junjie Cao) [Orabug: 38737300] {CVE-2025-40322}
  - ACPI: video: Fix use-after-free in acpi_video_switch_brightness() (Yuhao Jiang) [Orabug: 38687004] {CVE-2025-40211}
  - fbdev: atyfb: Check if pll_ops->init_pll failed (Daniel Palmer)
  - net: usb: asix_devices: Check return value of usbnet_get_endpoints (Miaoqian Lin)
  - NFSD: Fix crash in nfsd4_read_release() (Chuck Lever) [Orabug: 38737315] {CVE-2025-40324}
  - btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (Filipe Manana)
  - btrfs: always drop log root tree reference in btrfs_replay_log() (Filipe Manana)
  - btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() (Thorsten Blum)
  - x86/bugs: Fix reporting of LFENCE retpoline (David Kaplan)
  - net/sched: sch_qfq: Fix null-deref in agg_dequeue (Xiang Mei) [Orabug: 38597084] {CVE-2025-40083}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-318.199.3.2.el8uek]
changelog:
  - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet)  [Orabug: 39057366]  
  - macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet)  [Orabug: 39057366]  {CVE-2026-23209} 
  - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano)  [Orabug: 39057346]  {CVE-2026-23111} 
  - net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong)  [Orabug: 39055945]


author: Samasth Norway Ananda <samasth.norway.ananda@oracle.com> [5.15.0-318.199.3.3.el8uek]
changelog:
  - vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas)  [Orabug: 39110129]
  - vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas)  [Orabug: 39110129]
  - net/mlx5: Add IFC bits for migration state (Yishai Hadas)  [Orabug: 39110129]
  - vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas)  [Orabug: 39110129]
  - vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas)  [Orabug: 39110129]
  - vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas)  [Orabug: 39110129]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-318.199.3.4.el8uek]
changelog:
  - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39150890]
  - vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero)  [Orabug: 39150887]


author: Samasth Norway Ananda <samasth.norway.ananda@oracle.com> [5.15.0-318.199.3.5.el8uek]
changelog:
  - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu)  [Orabug: 39312618]
  - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39312618]
  - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39312618]
  - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39312618]
  - crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39312618]
  - crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39312618]
  - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39312618]  {CVE-2026-31431}
  - crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39312618]
  - crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39312618]
  - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi)  [Orabug: 39312608]  {CVE-2026-23216}
  - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi)  [Orabug: 39312602]  {CVE-2026-23193}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-318.199.3.6.el8uek]
changelog:
  - xfrm: esp: ipv4: fix up flags setting (Greg Kroah-Hartman)  [Orabug: 39368252]  {CVE-2026-43284} 
  - xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39368252]  {CVE-2026-43284} 
  - x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39368491]  {CVE-2025-54518}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-318.199.3.6.el8uek]
changelog:
  - xfrm: esp: ipv4: fix up flags setting (Greg Kroah-Hartman)  [Orabug: 39368252]  {CVE-2026-43284}
  - xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39368252]  {CVE-2026-43284}
  - x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39368491]  {CVE-2025-54518}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-319.199.1.el8uek]
changelog:
  - genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan)  [Orabug: 39001910]
  - nvme-pci: fix stuck reset on concurrent DPC and HP (Keith Busch)  [Orabug: 38928033]
  - nvme: cancel pending I/O if nvme controller is in terminal state (Nilay Shroff)  [Orabug: 38928033]
  - nvme-pci: fix queue unquiesce check on slot_reset (Keith Busch)  [Orabug: 38928033]
  - nvme: ensure disabling pairs with unquiesce (Keith Busch)  [Orabug: 38928033]
  - ionic: Rate limit unknown xcvr type messages (Eric Joyner)  [Orabug: 38977644]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-319.201.2.el8uek]
changelog:
  - LTS version: v5.15.201 (Vijayendra Suman)
  - USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
  - f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
  - f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
  - fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
  - fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
  - PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
  - PCI: endpoint: Remove unused field in struct pci_epf_group (Christophe JAILLET)
  - PCI: endpoint: Automatically create a function specific attributes group (Damien Le Moal)
  - scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy)
  - scsi: qla2xxx: Use named initializers for port_[d]state_str (Gleb Chesnokov)
  - scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy)
  - bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
  - bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
  - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
  - crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
  - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
  - selftests: mptcp: pm: ensure unknown flags are ignored (Matthieu Baerts (NGI0))
  - net: dsa: free routing table on probe failure (Vladimir Oltean)
  - smb: client: set correct id, uid and cruid for multiuser automounts (Paulo Alcantara)
  - btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov)
  - Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
  - gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
  - ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
  - platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
  - platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki)
  - drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
  - romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
  - gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
  - ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
  - gpio: omap: do not register driver in probe() (Danilo Krummrich)
  - scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
  - scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy)
  - scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy)
  - nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
  - crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao)
  - crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
  - crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
  - LTS version: v5.15.200 (Vijayendra Suman)
  - riscv: Replace function-like macro by static inline function (Björn Töpel)
  - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Varun Prakash)
  - spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
  - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
  - spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
  - iommu: disable SVA when CONFIG_X86 is set (Lu Baolu)
  - Bluetooth: hci_event: call disconnect callback before deleting conn (Pauli Virtanen)
  - gve: Correct ethtool rx_dropped calculation (Max Yuan)
  - gve: Fix stats report corruption on queue count change (Debarghya Kundu)
  - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andreas Gruenbacher)
  - riscv: uprobes: Add missing fence.i after building the XOL buffer (Björn Töpel)
  - ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge)
  - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (YunJe Shin)
  - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano)
  - hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
  - tipc: use kfree_sensitive() for session key material (Daniel Hodges)
  - macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet)
  - dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
  - net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
  - net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
  - net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
  - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
  - platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
  - platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
  - wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
  - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi)
  - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi)
  - wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
  - ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
  - ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
  - wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
  - ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Wupeng Ma)
  - HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe da Conceição Alves)
  - HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
  - netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
  - ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
  - HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
  - HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
  - HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (DaytonCL)
  - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (ZhangGuoDong)
  - block,bfq: fix aux stat accumulation destination (shechenglong)
  - net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
  - wifi: wlcore: ensure skb headroom before skb_push (Peter Åstrand)
  - wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee)
  - binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
  - Bluetooth: hci_qca: Fix the teardown problem for real (Thomas Gleixner)
  - clocksource/drivers/arm_arch_timer: Do not use timer namespace for timer_shutdown() function (Steven Rostedt (Google))
  - ARM: spear: Do not use timer namespace for timer_shutdown() function (Steven Rostedt (Google))
  - Documentation: Remove bogus claim about del_timer_sync() (Thomas Gleixner)
  - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Pablo Neira Ayuso)
  - mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
  - KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
  - ARM: 9468/1: fix memset64() on big-endian (Thomas Weissschuh)
  - rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
  - platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)


author: Samasth Norway Ananda <samasth.norway.ananda@oracle.com> [5.15.0-319.201.3.el8uek]
changelog:
  - arm64: pensando: Add non-caching option to capmem/mmap (Rob Gardner)  [Orabug: 39017011]
  - PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson)  [Orabug: 39021252]
  - PCI: Batch BAR sizing operations (Alex Williamson)  [Orabug: 39021252]
  - net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong)  [Orabug: 39053373]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-319.201.4.el8uek]
changelog:
  - bnxt_en: Fix GSO type for HW GRO packets on 5750X chips (Michael Chan)  [Orabug: 39086190]
  - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (Fernando Fernandez Mancera)  [Orabug: 39080807]
  - hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta)  [Orabug: 39065407]
  - net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta)  [Orabug: 39065407]
  - IPv6/GRO: generic helper to remove temporary HBH/jumbo header in driver (Coco Li)  [Orabug: 39065407]
  - rds: Drop rds conn in connect worker if not in down state. (Rohit Nair)  [Orabug: 39045034]
  - exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan)  [Orabug: 38567667]
  - tools: perf: add comm_ignore_digit column (Stephen Brennan)  [Orabug: 38567667]
  - mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka)  [Orabug: 39071712]
  - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka)  [Orabug: 39071712]
  - rds: Add state field to RDS trace logs. (Rohit Nair)  [Orabug: 38870357]
  - i3c: Move device name assignment after i3c_bus_init (Billy Tsai)
  - ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
  - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet)
  - netfilter: nf_conncount: fix tracking of connections from localhost (Fernando Fernandez Mancera)
  - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (Niklas Schnelle)
  - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (Niklas Schnelle)
  - rtc: interface: Alarm race handling should not discard preceding error (Anthony Pighin (Nokia))


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-319.201.4.1.el8uek]
changelog:
  - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39153095]
  - vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero)  [Orabug: 39153092]
  - vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas)  [Orabug: 39153077]
  - vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas)  [Orabug: 39153077]
  - net/mlx5: Add IFC bits for migration state (Yishai Hadas)  [Orabug: 39153077]
  - vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas)  [Orabug: 39153077]
  - vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas)  [Orabug: 39153077]
  - vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas)  [Orabug: 39153077]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-319.201.4.2.el8uek]
changelog:
  - Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39200414]


author: Samasth Norway Ananda <samasth.norway.ananda@oracle.com> [5.15.0-319.201.4.3.el8uek]
changelog:
  - uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39263158]  
  - iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu)  [Orabug: 39263158]  
  - iommu/vt-d: Set variable intel_dirty_ops to static (Kunwu Chan)  [Orabug: 39263158]  
  - iommu/vt-d: Access/Dirty bit support for SS domains (Joao Martins)  [Orabug: 39263158]  
  - iommu/amd: reduce GA Log overflow printk noise (Alejandro Jimenez)  [Orabug: 39261287]  
  - iommu/amd: add reschedule points to GA Log draining (Alejandro Jimenez)  [Orabug: 39261287]  
  - iommu/amd: Rework GAInt handling in overflow case (Joao Martins)  [Orabug: 39261287]  
  - iommu/amd: Disable GAInt while GA Log is processed (Joao Martins)  [Orabug: 39261287]  
  - iommu/amd: Move helpers to update IOMMU features to amd_iommu.h (Alejandro Jimenez)  [Orabug: 39261287]  
  - iommu/amd: Increase GA Log buffer size to 8192 entries (Joao Martins)  [Orabug: 39261287]  
  - x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39261281]


author: Samasth Norway Ananda <samasth.norway.ananda@oracle.com> [5.15.0-319.201.4.3.el8uek]
changelog:
  - uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp)  [Orabug: 39263158]
  - iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu)  [Orabug: 39263158]
  - iommu/vt-d: Set variable intel_dirty_ops to static (Kunwu Chan)  [Orabug: 39263158]
  - iommu/vt-d: Access/Dirty bit support for SS domains (Joao Martins)  [Orabug: 39263158]
  - iommu/amd: reduce GA Log overflow printk noise (Alejandro Jimenez)  [Orabug: 39261287]
  - iommu/amd: add reschedule points to GA Log draining (Alejandro Jimenez)  [Orabug: 39261287]
  - iommu/amd: Rework GAInt handling in overflow case (Joao Martins)  [Orabug: 39261287]
  - iommu/amd: Disable GAInt while GA Log is processed (Joao Martins)  [Orabug: 39261287]
  - iommu/amd: Move helpers to update IOMMU features to amd_iommu.h (Alejandro Jimenez)  [Orabug: 39261287]
  - iommu/amd: Increase GA Log buffer size to 8192 entries (Joao Martins)  [Orabug: 39261287]
  - x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD))  [Orabug: 39261281]


author: Samasth Norway Ananda <samasth.norway.ananda@oracle.com> [5.15.0-319.201.4.4.el8uek]
changelog:
  - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu)  [Orabug: 39291961]  
  - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39291961]  
  - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39291961]  
  - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39291961]  
  - crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291961]  
  - crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39291961]  
  - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39291961]  {CVE-2026-31431} 
  - crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291961]  
  - crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39291961]  
  - uek-rpm: Enable FWCTL for aarch64 (Dave Kleikamp)  [Orabug: 39291938]


author: Samasth Norway Ananda <samasth.norway.ananda@oracle.com> [5.15.0-319.201.4.4.el8uek]
changelog:
  - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu)  [Orabug: 39291961]
  - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39291961]
  - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39291961]
  - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39291961]
  - crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291961]
  - crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39291961]
  - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39291961]  {CVE-2026-31431}
  - crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39291961]
  - crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39291961]
  - uek-rpm: Enable FWCTL for aarch64 (Dave Kleikamp)  [Orabug: 39291938]


author: Samasth Norway Ananda <samasth.norway.ananda@oracle.com> [5.15.0-319.201.4.5.el8uek]
changelog:
  - iommu/arm-smmu-v3: Handle zeroed A4-2C HTTU override settings (Joao Martins)  [Orabug: 39312049]
  - iommu: Move IOMMU_DIRTY_NO_CLEAR define (Shameer Kolothum)  [Orabug: 39312049]
  - iommu/arm-smmu-v3: Enable HTTU for stage1 with io-pgtable mapping (Kunkun Jiang)  [Orabug: 39312049]
  - iommu/arm-smmu-v3: Add support for dirty tracking in domain alloc (Joao Martins)  [Orabug: 39312049]
  - iommu/io-pgtable-arm: Add read_and_clear_dirty() support (Shameer Kolothum)  [Orabug: 39312049]
  - iommu/arm-smmu-v3: Add feature detection for HTTU (Jean-Philippe Brucker)  [Orabug: 39312049]


author: Samasth Norway Ananda <samasth.norway.ananda@oracle.com> [5.15.0-319.201.4.6.el8uek]
changelog:
  - xfrm: esp: ipv4: fix up flags setting (Greg Kroah-Hartman)  [Orabug: 39342679]  {CVE-2026-43284} 
  - xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39342679]  {CVE-2026-43284}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-320.202.1.el8uek]
changelog:
  - LTS version: v5.15.202 (Vijayendra Suman)
  - NTB: ntb_transport: Fix too small buffer for debugfs_name (Koichiro Den)
  - net: nfc: nci: Fix parameter validation for packet data (Michael Thalmeier)
  - drm/amdgpu: keep vga memory on MacBooks with switchable graphics (Alex Deucher)
  - net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (Thomas Fourier)
  - fbdev: ffb: fix corrupted video output on Sun FFB1 (René Rebe)
  - fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (Weigang He)
  - fbdev: vt8500lcdfb: fix missing dma_free_coherent() (Thomas Fourier)
  - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (Junxi Qian)
  - atm: fore200e: fix use-after-free in tasklets during device removal (Duoming Zhou)
  - net: intel: fix PCI device ID conflict between i40e and ipw2200 (Ethan Nelson-Moore)
  - tracing: Fix to set write permission to per-cpu buffer_size_kb (Masami Hiramatsu)
  - net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() (Thomas Fourier)
  - net: ethernet: marvell: skge: remove incorrect conflicting PCI ID (Ethan Nelson-Moore)
  - ceph: supply snapshot context in ceph_zero_partial_object() (Ethanwu)
  - MIPS: rb532: Fix MMIO UART resource registration (Jiaxun Yang)
  - staging: rtl8723bs: fix null dereference in find_network (Ethan Tidmore)
  - parisc: kernel: replace kfree() with put_device() in create_tree_node() (Haoxiang Li)
  - PCI: Fix pci_slot_trylock() error handling (Jinhui Guo)
  - net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path (Kevin Hao)
  - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (Sunday Clement)
  - tipc: fix RCU dereference race in tipc_aead_users_dec() (Daniel Hodges)
  - mtd: rawnand: pl353: Fix software ECC support (Andrea Scian)
  - usb: dwc2: fix resume failure if dr_mode is host (Jisheng Zhang)
  - scsi: ufs: core: Flush exception handling work when RPM level is zero (Thomas Yen)
  - remoteproc: imx_rproc: Fix invalid loaded resource table detection (Peng Fan)
  - btrfs: continue trimming remaining devices on failure (Jinbaohong)
  - arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y (Marco Elver)
  - kexec: derive purgatory entry from symbol (Li Chen)
  - ocfs2: fix reflink preserve cleanup issue (Heming Zhao)
  - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (Haoxiang Li)
  - iio: gyro: itg3200: Fix unchecked return value in read_raw (Antoniu Miclaus)
  - powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() (Guangshuo Li)
  - dm mpath: make pg_init_delay_msecs settable (Benjamin Marzinski)
  - bus: fsl-mc: fix an error handling in fsl_mc_device_add() (Haoxiang Li)
  - usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Haotien Hsu)
  - nfsd: fix return error code for nfsd_map_name_to_[ug]id (Anthony Iliopoulos)
  - md/bitmap: fix GPF in write_page caused by resize race (Jack Wang)
  - PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (Manikanta Maddireddy)
  - xfs: fix remote xattr valuelblk check (Darrick J. Wong)
  - xfs: fix freemap adjustments when adding xattrs to leaf blocks (Darrick J. Wong)
  - xfs: delete attr leaf freemap entries when empty (Darrick J. Wong)
  - iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (Jinhui Guo)
  - xfs: mark data structures corrupt on EIO and ENODATA (Darrick J. Wong)
  - selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs (Li Wang)
  - drm: of: drm_of_panel_bridge_remove(): fix device_node leak (Luca Ceresoli)
  - media: venus: vdec: fix error state assignment for zero bytesused (Renjiang Han)
  - arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro (Yan Jun)
  - dm-unstripe: fix mapping bug when there are multiple targets in a table (Matt Whitlock)
  - s390/pci: Handle futile config accesses of disabled devices directly (Niklas Schnelle)
  - clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() (Haoxiang Li)
  - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (Yosry Ahmed)
  - soc: ti: pruss: Fix double free in pruss_clk_mux_setup() (Xu Wang)
  - soc: ti: k3-socinfo: Fix regmap leak on probe failure (Johan Hovold)
  - dm: clear cloned request bio pointer when last clone bio completes (Michael Liang)
  - dm-integrity: fix a typo in the code for write/discard race (Mikulas Patocka)
  - media: i2c: ov5647: use our own mutex for the ctrl lock (Xiaolei Wang)
  - media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode (Jai Luthra)
  - media: i2c: ov5647: Sensor should report RAW color space (David Plowman)
  - media: i2c: ov5647: Correct minimum VBLANK value (David Plowman)
  - media: i2c: ov5647: Correct pixel array offset (David Plowman)
  - media: i2c: ov5647: Initialize subdev before controls (Jai Luthra)
  - media: ccs: Avoid possible division by zero (Sakari Ailus)
  - media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (Abdun Nihaal)
  - media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (Abdun Nihaal)
  - media: cx25821: Add missing unmap in snd_cx25821_hw_params() (Haoxiang Li)
  - media: cx23885: Add missing unmap in snd_cx23885_hw_params() (Haoxiang Li)
  - media: cx88: Add missing unmap in snd_cx88_hw_params() (Haoxiang Li)
  - media: radio-keene: fix memory leak in error path (Shaurya Rane)
  - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (Günther Noack)
  - HID: prodikeys: Check presence of pm->input_ep82 (Günther Noack)
  - HID: magicmouse: Do not crash on missing msc->input (Günther Noack)
  - HID: hid-pl: handle probe errors (Oliver Neukum)
  - arm64: Disable branch profiling for all arm64 code (Breno Leitao)
  - KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (Sean Christopherson)
  - media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (Haoxiang Li)
  - media: mtk-mdp: Fix error handling in probe function (Haoxiang Li)
  - dm-verity: correctly handle dm_bufio_client_create() failure (Eric Biggers)
  - fpga: dfl: use subsys_initcall to allow built-in drivers to be added (Thadeu Lima de Souza Cascardo)
  - rpmsg: core: fix race in driver_override_show() and use core helper (Gui-Dong Han)
  - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Vahagn Vardanian)
  - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (Junrui Luo)
  - net: consume xmit errors of GSO frames (Jakub Kicinski)
  - net: usb: pegasus: enable basic endpoint checking (Ziyi Guo)
  - RDMA/efa: Fix typo in efa_alloc_mr() (Jason Gunthorpe)
  - net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (Duoming Zhou)
  - RDMA/core: Fix stale RoCE GIDs during netdev events at registration (Jiri Pirko)
  - tipc: fix duplicate publication key in tipc_service_insert_publ() (Tung Nguyen)
  - Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (Luiz Augusto von Dentz)
  - Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
  - Bluetooth: hci_qca: Cleanup on all setup failures (Jinwang Li)
  - Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ (Luiz Augusto von Dentz)
  - wifi: cfg80211: wext: fix IGTK key ID off-by-one (Johannes Berg)
  - net: ethernet: xscale: Check for PTP support properly (Linus Walleij)
  - net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() (Vladimir Oltean)
  - net: usb: lan78xx: scan all MDIO addresses on LAN7801 (Martin Pålsson)
  - net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (Ziyi Guo)
  - xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (Jiayuan Chen)
  - ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut (Maciej Grochowski)
  - ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (Maciej Grochowski)
  - btrfs: replace BUG() with error handling in __btrfs_balance() (Adarsh Das)
  - ALSA: usb-audio: Add sanity check for OOB writes at silencing (Takashi Iwai)
  - drm/radeon: Add HAINAN clock adjustment (Decce6)
  - drm/amdgpu: Add HAINAN clock adjustment (Decce6)
  - ALSA: usb-audio: Update the number of packets properly at receiving (Takashi Iwai)
  - drm/amdgpu: Adjust usleep_range in fence wait (Ce Sun)
  - drm/amd/display: Avoid updating surface with the same surface under MPO (Wayne Lin)
  - ARM: 9467/1: mm: Don't use %pK through printk (Thomas Weißschuh)
  - include: uapi: netfilter_bridge.h: Cover for musl libc (Phil Sutter)
  - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov)
  - fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() (Konstantin Komarov)
  - fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST (Jaehun Gou)
  - fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata (Jaehun Gou)
  - fs: ntfs3: check return value of indx_find to avoid infinite loop (Jaehun Gou)
  - MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry)
  - iio: magnetometer: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
  - iio: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior)
  - Revert "mfd: da9052-spi: Change read-mask to write-mask" (Marcus Folkesson)
  - phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Xu Yang)
  - phy: mvebu-cp110-utmi: fix dr_mode property read from dts (Aleksandar Gerasimovski)
  - binder: don't use %pK through printk (Thomas Weißschuh)
  - fix it87_wdt early reboot by reporting running timer (René Rebe)
  - serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done (Moteen Shah)
  - staging: rtl8723bs: fix memory leak on failure path (Diksha Kumari)
  - misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 (Markus Koch)
  - serial: 8250_dw: handle clock enable errors in runtime_resume (Artem Shimko)
  - staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (Liang Jie)
  - m68k: nommu: fix memmove() with differently aligned src and dest for 68000 (Daniel Palmer)
  - clk: microchip: core: correct return value on *_get_parent() (Brian Masney)
  - mailbox: sprd: clear delivery flag before handling TX done (Otto Pflüger)
  - remoteproc: mediatek: Break lock dependency to `prepare_lock` (Tzung-Bi Shih)
  - mailbox: sprd: mask interrupts that are not handled (Otto Pflüger)
  - tracing: Fix false sharing in hwlat get_sample() (Colin Lord)
  - scsi: buslogic: Reduce stack usage (Arnd Bergmann)
  - RDMA/rtrs-clt: For conn rejection use actual err number (Md Haris Iqbal)
  - nfc: nxp-nci: remove interrupt trigger type (Carl Lee)
  - myri10ge: avoid uninitialized variable use (Arnd Bergmann)
  - PCI: Mark Nvidia GB10 to avoid bus reset (Johnny-Cc Chang)
  - PCI: Add ACS quirk for Qualcomm Hamoa & Glymur (Krishna Chaitanya Chundru)
  - PCI: Enable ACS after configuring IOMMU for OF platforms (Manivannan Sadhasivam)
  - PCI: Fix pci_slot_lock () device locking (Keith Busch)
  - PCI/AER: Clear stale errors on reporting agents upon probe (Lukas Wunner)
  - PCI: Mark ASM1164 SATA controller to avoid bus reset (Alex Williamson)
  - vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 (Arnd Bergmann)
  - net: usb: sr9700: remove code to drive nonexistent multicast filter (Ethan Nelson-Moore)
  - wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() (Ziyi Guo)
  - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (Geetha Sowjanya)
  - Bluetooth: btusb: Add device ID for Realtek RTL8761BU (Jacopo Scannella)
  - Bluetooth: hci_conn: use mod_delayed_work for active mode timeout (Stefan Sørensen)
  - ipv4: fib: Annotate access to struct fib_alias.fa_state. (Kuniyuki Iwashima)
  - wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() (Ziyi Guo)
  - wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() (Ziyi Guo)
  - net: hns3: extend HCLGE_FD_AD_QID to 11 bits (Jijie Shao)
  - net: usb: r8152: fix transmit queue timeout (Mingj Ye)
  - openrisc: define arch-specific version of nop() (Brian Masney)
  - netfilter: xt_tcpmss: check remaining length before reading optlen (Florian Westphal)
  - netfilter: nf_conntrack: Add allow_clash to generic protocol handler (Yuto Hamaguchi)
  - ext4: mark group extend fast-commit ineligible (Li Chen)
  - ext4: mark group add fast-commit ineligible (Li Chen)
  - ipv6: exthdrs: annotate data-race over multiple sysctl (Eric Dumazet)
  - ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() (Eric Dumazet)
  - wifi: libertas: fix WARNING in usb_tx_block (Szymon Wilczek)
  - iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency (Alexander Grest)
  - dm: remove fake timeout to avoid leak request (Ding Hui)
  - jfs: nlink overflow in jfs_rename (Jori Koolstra)
  - jfs: Add missing set_freezable() for freezable kthread (Xu Wang)
  - ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio (Lianqin Hu)
  - modpost: Amend ppc64 save/restfpr symnames for -Os build (René Rebe)
  - ASoC: es8328: Add error unwind in resume (Hsieh Hung-En)
  - spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end (Chin-Ting Kuo)
  - gpio: aspeed-sgpio: Change the macro to support deferred probe (Billy Tsai)
  - HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK (David Phillips)
  - HID: multitouch: add eGalaxTouch EXC3188 support (Thorsten Schmelzer)
  - drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (Ludovic Desroches)
  - drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts (Ludovic Desroches)
  - drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (Ludovic Desroches)
  - virt: vbox: uapi: Mark inner unions in packed structs as packed (Thomas Weißschuh)
  - hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed (Thomas Weißschuh)
  - drm: Account property blob allocations to memcg (Xiao Kan)
  - drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() (Donet Tom)
  - media: cx25821: Fix a resource leak in cx25821_dev_setup() (Haoxiang Li)
  - media: solo6x10: Check for out of bounds chip_id (Kees Cook)
  - media: pvrusb2: fix URB leak in pvr2_send_request_ex (Szymon Wilczek)
  - media: adv7180: fix frame interval in progressive mode (Thorsten Schmelzer)
  - ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug (Sebastian Krzyszkowiak)
  - ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask (Sebastian Krzyszkowiak)
  - media: omap3isp: set initial format (Hans Verkuil)
  - media: omap3isp: isppreview: always clamp in preview_try_format() (Hans Verkuil)
  - media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes (Hans Verkuil)
  - drm/v3d: Set DMA segment size to avoid debug warnings (Xiaolei Wang)
  - spi: stm32: fix Overrun issue at < 8bpw (Deepak Kumar)
  - media: dvb-core: dmxdevfilter must always flush bufs (Hans Verkuil)
  - parisc: Prevent interrupts during reboot (Helge Deller)
  - arm64: tegra: smaug: Add usb-role-switch support (Diogo Ivo)
  - pstore: ram_core: fix incorrect success return when vmap() fails (Ruipeng Qi)
  - char: tpm: cr50: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
  - mailbox: bcm-ferxrm-mailbox: Use default primary handler (Sebastian Andrzej Siewior)
  - clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF (Bartosz Golaszewski)
  - clocksource/drivers/sh_tmu: Always leave device running after probe (Niklas Söderlund)
  - bpf: verifier improvement in 32bit shift sign extension pattern (Cupertino Miranda)
  - sparc: don't reference obsolete termio struct for TC* constants (Sam James)
  - sparc: Synchronize user stack on fork and clone (Andreas Larsson)
  - blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() (Yu Kuai)
  - xenbus: Use .freeze/.thaw to handle xenbus devices (Jason Andryuk)
  - s390/perf: Disable register readout on sampling events (Thomas Richter)
  - ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (Armin Wolf)
  - ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (Tuo Li)
  - EFI/CPER: don't go past the ARM processor CPER record buffer (Mauro Carvalho Chehab)
  - APEI/GHES: ensure that won't go past CPER allocated record (Mauro Carvalho Chehab)
  - EFI/CPER: don't dump the entire memory region (Mauro Carvalho Chehab)
  - x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set (Hou Wenlong)
  - rnbd-srv: Zero the rsp buffer before using it (Md Haris Iqbal)
  - arm64: Add support for TSV110 Spectre-BHB mitigation (Jinqian Yang)
  - s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS (Heiko Carstens)
  - tools/power cpupower: Reset errno before strtoull() (Kaushlendra Kumar)
  - gfs2: fiemap page fault fix (Andreas Gruenbacher)
  - minix: Add required sanity checking to minix_check_superblock() (Jori Koolstra)
  - i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() (Frank Li)
  - hfsplus: pretend special inodes as regular files (Tetsuo Handa)
  - audit: add missing syscalls to read class (Jeffrey Bencteux)
  - hfsplus: fix volume corruption issue for generic/498 (Viacheslav Dubeyko)
  - audit: add fchmodat2() to change attributes class (Jeffrey Bencteux)
  - libperf build: Always place libperf includes first (Ian Rogers)
  - libperf: Don't remove -g when EXTRA_CFLAGS are used (James Clark)
  - perf callchain: Fix srcline printing with inlines (Ian Rogers)
  - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (Daniel Hodges)
  - SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (Chuck Lever)
  - ata: pata_ftide010: Fix some DMA timings (Linus Walleij)
  - ext4: use optimized mballoc scanning regardless of inode format (Jan Kara)
  - ext4: fix memory leak in ext4_ext_shift_extents() (Zilin Guan)
  - ext4: don't cache extent during splitting extent (Zhang Yi)
  - MIPS: Work around LLVM bug when gp is used as global register variable (Yao Zi)
  - btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (Filipe Manana)
  - drm/i915/acpi: free _DSM package when no connectors (Kaushlendra Kumar)
  - apparmor: fix invalid deref of rawdata when export_binary is unset (Georgia Garcia)
  - apparmor: fix rlimit for posix cpu timers (John Johansen)
  - apparmor: fix NULL sock in aa_sock_file_perm (John Johansen)
  - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (Hangbin Liu)
  - bpftool: Fix truncated netlink dumps (Jakub Kicinski)
  - ipv6: fix a race in ip6_sock_set_v6only() (Eric Dumazet)
  - net: remove WARN_ON_ONCE when accessing forward path array (Pablo Neira Ayuso)
  - netfilter: nf_conntrack_h323: don't pass uninitialised l3num value (Florian Westphal)
  - selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled (Aleksei Oladko)
  - xen-netback: reject zero-queue configuration from guest (Ziyi Guo)
  - selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 (Ido Schimmel)
  - cpuidle: Skip governor when only one idle state is available (Aboorva Devarajan)
  - ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs (Sean V Kelley)
  - fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot (Jiasheng Jiang)
  - fs/ntfs3: prevent infinite loops caused by the next valid being the same (Edward Adam Davis)
  - backlight: qcom-wled: Support ovp values for PMI8994 (Barnabás Czémán)
  - pinctrl: single: fix refcount leak in pcs_add_gpio_func() (Wei Li)
  - pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition (Luca Weiss)
  - pinctrl: qcom: Extract chip specific LPASS LPI code (Srinivasa Rao Mandadapu)
  - pinctrl: qcom: Update lpi pin group custiom functions with framework generic functions (Srinivasa Rao Mandadapu)
  - pinctrl: qcom: Update macro name to LPI specific (Srinivasa Rao Mandadapu)
  - iio: sca3000: Fix a resource leak in sca3000_probe() (Harshit Mogalapalli)
  - ovl: Fix uninit-value in ovl_fill_real (Qing Wang)
  - pinctrl: equilibrium: Fix device node reference leak in pinbank_init() (Felix Gu)
  - usb: bdc: fix sleep during atomic (Justin Chen)
  - drivers: iio: mpu3050: use dev_err_probe for regulator request (Svyatoslav Ryhel)
  - mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure (Xu Wang)
  - Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" (Greg Kroah-Hartman)
  - coresight: etm3x: Fix cpulocked warning on cpuhp (Antonio Borneo)
  - mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms (Matthew Schwartz)
  - serial: SH_SCI: improve "DMA support" prompt (Randy Dunlap)
  - serial: imx: change SERIAL_IMX_CONSOLE to bool (Randy Dunlap)
  - staging: greybus: lights: avoid NULL deref (Chaitanya Mishra)
  - dma: dma-axi-dmac: fix SW cyclic transfers (Nuno Sa)
  - dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX (AngeloGioacchino Del Regno)
  - clk: qcom: dispcc-sdm845: Enable parents for pixel clocks (Petr Hodina)
  - clk: Move clk_{save,restore}_context() to COMMON_CLK section (Geert Uytterhoeven)
  - clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán)
  - clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs (Martin Blumenstingl)
  - clk: qcom: rcg2: compute 2d using duty fraction directly (Taniya Das)
  - fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() (Felix Gu)
  - tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros (Steven Rostedt)
  - nvdimm: virtio_pmem: serialize flush requests (Li Chen)
  - scsi: csiostor: Fix dereference of null pointer rn (Colin Ian King)
  - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia)
  - RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc (Liuyi)
  - mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() (Weigang He)
  - RDMA/core: add rdma_rw_max_sge() helper for SQ sizing (Chuck Lever)
  - svcrdma: Reduce the number of rdma_rw contexts per-QP (Chuck Lever)
  - svcrdma: Increase the per-transport rw_ctx count (Chuck Lever)
  - svcrdma: Clean up comment in svc_rdma_accept() (Chuck Lever)
  - svcrdma: Remove queue-shortening warnings (Chuck Lever)
  - RDMA/core: Fix a couple of obvious typos in comments (Chuck Lever)
  - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (Liuyi)
  - crypto: ccp - Add an S4 restore flow (Mario Limonciello)
  - mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper (Alok Tiwari)
  - RDMA/rxe: Fix double free in rxe_srq_from_init (Jiasheng Jiang)
  - RDMA/rtrs-srv: fix SG mapping (Roman Pen)
  - RDMA/rtrs-srv: Correct the checking of ib_map_mr_sg (Guoqing Jiang)
  - RDMA/rtrs-srv: Refactor the handling of failure case in map_cont_bufs (Guoqing Jiang)
  - power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() (Waqar Hameed)
  - power: supply: bq27xxx: fix wrong errno when bus ops are unsupported (Xu Wang)
  - power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write (Alexander Koskovich)
  - power: supply: sbs-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
  - power: supply: rt9455: Fix use-after-free in power_supply_changed() (Waqar Hameed)
  - power: supply: goldfish: Fix use-after-free in power_supply_changed() (Waqar Hameed)
  - power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed)
  - power: supply: bq25980: Fix use-after-free in power_supply_changed() (Waqar Hameed)
  - power: supply: bq256xx: Fix use-after-free in power_supply_changed() (Waqar Hameed)
  - power: supply: act8945a: Fix use-after-free in power_supply_changed() (Waqar Hameed)
  - power: supply: ab8500: Fix use-after-free in power_supply_changed() (Waqar Hameed)
  - power: supply: ab8500: Use core battery parser (Linus Walleij)
  - power: supply: ab8500_bmdata: Use standard phandle (Linus Walleij)
  - RDMA/hns: Notify ULP of remaining soft-WCs during reset (Chengchang Tang)
  - IB/cache: update gid cache on client reregister event (Etienne Aujames)
  - RDMA/rtrs: server: remove dead code (Lihonggang)
  - octeontx2-pf: Unregister devlink on probe failure (Hariprasad Kelam)
  - serial: caif: fix use-after-free in caif_serial ldisc_close() (Jiayuan Chen)
  - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (Jiayuan Chen) [Orabug: 39188477] {CVE-2026-31411}
  - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (Jinliang Zheng)
  - net: hns3: fix double free issue for tx spare buffer (Jian Shen)
  - net: hns3: add max order judgement for tx spare buffer (Hao Chen)
  - net: hns3: fix ethtool tx copybreak buf size indicating not aligned issue (Hao Chen)
  - net: hns3: remove the way to set tx spare buf via module parameter (Hao Chen)
  - net: hns3: add support to set/get tx copybreak buf size via ethtool for hns3 driver (Hao Chen)
  - ethtool: add support to set/get tx copybreak buf size via ethtool (Hao Chen)
  - netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (Pablo Neira Ayuso)
  - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal)
  - nfc: hci: shdlc: Stop timers and work before freeing context (Victoria Votokina)
  - timers: Replace in_irq() with in_hardirq() (Ye Xingchen)
  - bonding: only set speed/duplex to unknown, if getting speed failed (Thomas Bogendoerfer)
  - octeontx2-af: Fix PF driver crash with kexec kernel booting (Anshumali Gaur)
  - ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() (Ondrej Mosnacek)
  - PCI: Initialize RCB from pci_configure_device() (Håkon Bugge)
  - wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() (Ziyi Guo)
  - tcp: tcp_tx_timestamp() must look at the rtx queue (Eric Dumazet)
  - fat: avoid parent link count underflow in rmdir (Zhiyu Zhang)
  - nfsd: never defer requests during idmap lookup (Anthony Iliopoulos)
  - iommu/vt-d: Flush cache for PASID table before using it (Dmytro Maluka)
  - PCI: Mark 3ware-9650SA Root Port Extended Tags as broken (Jörg Wedekind)
  - netfilter: nf_conncount: increase the connection clean up limit to 64 (Fernando Fernandez Mancera)
  - netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH (Fernando Fernandez Mancera)
  - wifi: cfg80211: stop NAN and P2P in cfg80211_leave (Miri Korenblit)
  - PCI/portdrv: Fix potential resource leak (Uwe Kleine-König)
  - PCI: Do not attempt to set ExtTag for VFs (Håkon Bugge)
  - PCI: mediatek: Fix IRQ domain leak when MSI allocation fails (Xu Wang)
  - spi: tools: Add include folder to .gitignore (Francesco Lavra)
  - platform/chrome: cros_ec_lightbar: Fix response size initialization (Tzung-Bi Shih)
  - media: uvcvideo: Fix allocation for small frame sizes (Ricardo Ribalda)
  - media: ccs: Accommodate C-PHY into the calculation (David Heidelberger)
  - HID: playstation: Add missing check for input_ff_create_memless (Xu Wang)
  - regulator: core: move supply check earlier in set_machine_constraints() (André Draszik)
  - drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init (Srinivasan Shanmugam)
  - smack: /smack/doi: accept previously used values (Konstantin Andreev)
  - smack: /smack/doi must be > 0 (Konstantin Andreev)
  - arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 (Dmitry Baryshkov)
  - arm64: dts: amlogic: g12: assign the MMC A signal clock (Jerome Brunet)
  - arm64: dts: amlogic: g12: assign the MMC B and C signal clocks (Jerome Brunet)
  - arm64: dts: amlogic: gx: assign the MMC signal clocks (Jerome Brunet)
  - arm64: dts: amlogic: axg: assign the MMC signal clocks (Jerome Brunet)
  - arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node (Vladimir Zapolskiy)
  - ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells (Vladimir Zapolskiy)
  - powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (Narayana Murty N)
  - soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe (Xu Wang)
  - powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() (Christophe Leroy)
  - ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property (Chen-Yu Tsai)
  - arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on (Casey Connolly)
  - arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on (Casey Connolly)
  - arm64: dts: qcom: sdm630: fix gpu_speed_bin size (Dmitry Baryshkov)
  - arm64: dts: qcom: sdm630: correct QFPROM byte offsets (Krzysztof Kozlowski)
  - clk: qcom: Return correct error code in qcom_cc_probe_by_index() (Xu Wang)
  - EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() (Dan Carpenter)
  - EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() (Dan Carpenter)
  - pstore/ram: fix buffer overflow in persistent_ram_save_old() (Pwnverse)
  - sched/rt: Skip currently executing CPU in rto_next_cpu() (Chen Jinghuang)
  - mfd: wm8350-core: Use IRQF_ONESHOT (Sebastian Andrzej Siewior)
  - EDAC/altera: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior)
  - scsi: efct: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior)
  - crypto: hisilicon/trng - support tfms sharing the device (Weili Qian)
  - crypto: hisilicon/trng - modifying the order of header files (Chenghai Huang)
  - hrtimer: Fix trace oddity (Thomas Gleixner)
  - crypto: octeontx - fix dma_free_coherent() size (Thomas Fourier)
  - crypto: cavium - fix dma_free_coherent() size (Thomas Fourier)
  - ARM: VDSO: Patch out __vdso_clock_getres() if unavailable (Thomas Weißschuh)
  - libbpf: Fix OOB read in btf_dump_get_bitfield_value (Varun R Mallya)
  - libbpf: Fix dumping big-endian bitfields (Ilya Leoshkevich)
  - s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (Salah Triki)
  - PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races (Gui-Dong Han)
  - PM: wakeup: Handle empty list in wakeup_sources_walk_start() (Sam Wu)
  - iomap: fix submission side handling of completion side errors (Christoph Hellwig)
  - md/raid10: fix any_working flag handling in raid10_sync_request (Li Nan)
  - btrfs: qgroup: return correct error when deleting qgroup relation item (Filipe Manana)
  - tpm: st33zp24: Fix missing cleanup on get_burstcount() error (Alper Ak)
  - tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (Alper Ak)
  - gfs2: Fix use-after-free in iomap inline data write path (Deepanshu Kartikey)
  - gfs2: Add metapath_dibh helper (Andreas Gruenbacher)
  - fs: add <linux/init_task.h> for 'init_fs' (Ben Dooks)
  - i3c: remove i2c board info from i2c_dev_desc (Jamie Iles)
  - hfsplus: return error when node already exists in hfs_bnode_create (Shardul Bankar)
  - auxdisplay: arm-charlcd: fix release_mem_region() size (Thomas Fourier)
  - RDMA/umad: Reject negative data_len in ib_umad_write (Yunje Shin) [Orabug: 39103109] {CVE-2026-23243}
  - RDMA/siw: Fix potential NULL pointer dereference in header processing (Yunje Shin)


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-320.202.2.el8uek]
changelog:
  - vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero) [Orabug: 39121645]
  - vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas) [Orabug: 39065603]
  - vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas) [Orabug: 39065603]
  - net/mlx5: Add IFC bits for migration state (Yishai Hadas) [Orabug: 39065603]
  - vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas) [Orabug: 39065603]
  - vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas) [Orabug: 39065603]
  - vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas) [Orabug: 39065603]
  - scsi: target: core: Add emulation for REPORT IDENTIFYING INFORMATION (Gulam Mohamed) [Orabug: 39098783]
  - scsi: core: Fix error handling for scsi_alloc_sdev() (Junxiao Bi) [Orabug: 38976650]
  - scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi) [Orabug: 38976650,39130775] {CVE-2026-23296}
  - scsi: core: Move two statements (Bart Van Assche) [Orabug: 38976650]
  - mm, percpu: do not consider sleepable allocations atomic (Michal Hocko) [Orabug: 39100354]
  - uek: kabi: Only do size allignment check on kabi_use when in 64 bit environment. (Yifei Liu) [Orabug: 39089315]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-320.202.3.el8uek]
changelog:
  - net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju) [Orabug: 38915250]
  - ipv4: icmp: convert to dev_net_rcu() (Eric Dumazet) [Orabug: 38807392]
  - ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Eric Dumazet) [Orabug: 38807392]
  - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson) [Orabug: 39151165,39159089] {CVE-2026-23401}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-320.202.4.el8uek]
changelog:
  - xsk: fix an integer overflow in xp_create_and_assign_umem() (Gavrilov Ilia) [Orabug: 37828202] {CVE-2025-21997}
  - RDMA/mlx5: Fix the recovery flow of the UMR QP (Yishai Hadas) [Orabug: 37766306] {CVE-2025-21892}
  - misc: misc_minor_alloc to use ida for all dynamic/misc dynamic minors (Vimal Agrawal) [Orabug: 37678552] {CVE-2024-58078}
  - net/sched: cls_api: fix error handling causing NULL dereference (Pierre Riteau) [Orabug: 37702083] {CVE-2025-21857}
  - bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() (Shigeru Yoshida) [Orabug: 37766220] {CVE-2025-21867}
  - net: xdp: Disallow attaching device-bound programs in generic mode (Toke Høiland-Jørgensen) [Orabug: 37650238] {CVE-2025-21808}
  - iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index() (Qasim Ijaz) [Orabug: 37649891] {CVE-2025-21724}
  - xfrm: delete intermediate secpath entry in packet offload mode (Alexandre Cassen) [Orabug: 37649866] {CVE-2025-21720}
  - gpiolib: Fix crash on error in gpiochip_get_ngpios() (Andy Shevchenko) [Orabug: 37650154] {CVE-2025-21783}
  - scsi: mpi3mr: Fix possible crash when setting up bsg fails (Guixin Liu) [Orabug: 37649886] {CVE-2025-21723}
  - uek-rpm: Enable CONFIG_NET_VRF in container kernel (Boris Ostrovsky) [Orabug: 38932706]
  - Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768951]
  - selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768951]
  - mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768951]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-320.202.5.el8uek]
changelog:
  - Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" (Manivannan Sadhasivam) [Orabug: 39187371]
  - net/handshake: duplicate handshake cancellations leak socket (Scott Mayhew) [Orabug: 38847720] {CVE-2025-68775}
  - ext4: show 'shutdown' hint when ext4 is forced to shutdown (Baokun Li) [Orabug: 39002346]
  - ext4: show 'emergency_ro' when EXT4_FLAGS_EMERGENCY_RO is set (Baokun Li) [Orabug: 39002346]
  - ext4: correct behavior under errors=remount-ro mode (Baokun Li) [Orabug: 39002346]
  - ext4: add more ext4_emergency_state() checks around sb_rdonly() (Baokun Li) [Orabug: 39002346]
  - ext4: add ext4_emergency_state() helper function (Baokun Li) [Orabug: 39002346]
  - ext4: add EXT4_FLAGS_EMERGENCY_RO bit (Baokun Li) [Orabug: 39002346]
  - ext4: convert EXT4_FLAGS_* defines to enum (Baokun Li) [Orabug: 39002346]
  - ext4: make ext4_forced_shutdown() take struct super_block (Jan Kara) [Orabug: 39002346]
  - ipv6: use RCU in ip6_xmit() (Eric Dumazet) [Orabug: 38649062] {CVE-2025-40135}
  - memfd: move MFD_MF_KEEP_UE_MAPPED flag to higher bit (William Roche) [Orabug: 39109773]
  - scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930868] {CVE-2026-23059}
  - bpf: Fix reference count leak in bpf_prog_test_run_xdp() (Tetsuo Handa) [Orabug: 38887702] {CVE-2026-22994}
  - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [Orabug: 38887682] {CVE-2026-22989}
  - net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970398] {CVE-2026-23173}
  - net/handshake: restore destructor on submit failure (Caoping) [Orabug: 38887601] {CVE-2025-71148}
  - scsi: qla2xxx: Fix improper freeing of purex item (Zilin Guan) [Orabug: 38798929] {CVE-2025-68741}
  - bnxt_en: Fix XDP_TX path (Michael Chan) [Orabug: 38847684] {CVE-2025-68770}
  - perf/x86/amd: Check event before enable to avoid GPF (George Kennedy) [Orabug: 38847849] {CVE-2025-68798}
  - scsi: smartpqi: Fix device resources accessed after device removal (Mike Mcgowen) [Orabug: 38798848] {CVE-2025-68371}
  - KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced (Omar Sandoval) [Orabug: 38773579] {CVE-2025-68259}
  - x86/fpu: Ensure XFD state on signal delivery (Chang S. Bae) [Orabug: 38773165] {CVE-2025-68171}
  - virtio-net: fix received length check in big packets (Bui Quang Minh) [Orabug: 38737152] {CVE-2025-40292}
  - ACPI: CPPC: Fix NULL pointer dereference when nosmp is used (Yunhui Cui) [Orabug: 38641284] {CVE-2025-38113}
  - EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo) [Orabug: 38649173] {CVE-2025-40157}
  - sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu) [Orabug: 38649042] {CVE-2025-40129}
  - cpufreq: CPPC: Fix possible null-ptr-deref for cppc_get_cpu_cost() (Jinjie Ruan) [Orabug: 38641275] {CVE-2024-53230}
  - cpufreq: CPPC: Fix possible null-ptr-deref for cpufreq_cpu_get_raw() (Jinjie Ruan) [Orabug: 38641272] {CVE-2024-53231}
  - vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592117] {CVE-2025-40056}
  - crypto: qat - flush misc workqueue during device shutdown (Giovanni Cabiddu) [Orabug: 38401717] {CVE-2025-39721}
  - vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592085] {CVE-2025-40051}
  - virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324330] {CVE-2025-38551}
  - gve: prevent ethtool ops after shutdown (Jordan Rhee) [Orabug: 38401492] {CVE-2025-38735}
  - KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254140] {CVE-2025-38455}
  - net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253871] {CVE-2025-38385}
  - net/mlx5e: Disable MACsec offload for uplink representor profile (Carolina Jubran) [Orabug: 38094809] {CVE-2025-38020}
  - dmaengine: idxd: fix memory leak in error handling path of idxd_alloc (Shuai Xue) [Orabug: 38094794] {CVE-2025-38015}
  - net/mlx5: Fix ECVF vports unload on shutdown flow (Amir Tzin) [Orabug: 38152903] {CVE-2025-38109}
  - bnxt: properly flush XDP redirect lists (Yan Zhai) [Orabug: 38175054] {CVE-2025-38246}
  - eth: bnxt: fix missing ring index trim on error path (Jakub Kicinski) [Orabug: 37937451] {CVE-2025-37873}
  - net/mlx5: Fix null-ptr-deref in mlx5_create_{inner_,}ttc_table() (Henry Martin) [Orabug: 37938078] {CVE-2025-37888}
  - nfsd: fix possible badness in FREE_STATEID (Olga Kornievskaia) [Orabug: 37989102] {CVE-2024-50043}
  - devlink: fix xa_alloc_cyclic() error handling (Michal Swiatkowski) [Orabug: 37828271] {CVE-2025-22017}


author: Samasth Norway Ananda <samasth.norway.ananda@oracle.com> [5.15.0-320.202.6.el8uek]
changelog:
  - Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman) [Orabug: 39277795]
  - uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp) [Orabug: 39109819]
  - iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu) [Orabug: 39109819]
  - iommu/vt-d: Set variable intel_dirty_ops to static (Kunwu Chan) [Orabug: 39109819]
  - iommu/vt-d: Access/Dirty bit support for SS domains (Joao Martins) [Orabug: 39109819]
  - iommu/amd: reduce GA Log overflow printk noise (Alejandro Jimenez) [Orabug: 39209012]
  - iommu/amd: add reschedule points to GA Log draining (Alejandro Jimenez) [Orabug: 39209012]
  - iommu/amd: Rework GAInt handling in overflow case (Joao Martins) [Orabug: 39209012]
  - iommu/amd: Disable GAInt while GA Log is processed (Joao Martins) [Orabug: 39209012]
  - iommu/amd: Move helpers to update IOMMU features to amd_iommu.h (Alejandro Jimenez) [Orabug: 39209012]
  - iommu/amd: Increase GA Log buffer size to 8192 entries (Joao Martins) [Orabug: 39209012]
  - x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov) [Orabug: 39241228,39273722] {CVE-2026-31628}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-320.202.7.el8uek]
changelog:
  - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu)  [Orabug: 39250686]
  - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39250686]
  - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39250686]
  - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39250686]
  - crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39250686]
  - crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39250686]
  - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39250686]  {CVE-2026-31431}
  - crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39250686]
  - crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39250686]
  - uek-rpm: Enable FWCTL for aarch64 (Dave Kleikamp)  [Orabug: 39252913]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-320.202.8.el8uek]
changelog:
  - iommu/arm-smmu-v3: Handle zeroed A4-2C HTTU override settings (Joao Martins)  [Orabug: 39186453]
  - iommu: Move IOMMU_DIRTY_NO_CLEAR define (Shameer Kolothum)  [Orabug: 39186453]
  - iommu/arm-smmu-v3: Enable HTTU for stage1 with io-pgtable mapping (Kunkun Jiang)  [Orabug: 39186453]
  - iommu/arm-smmu-v3: Add support for dirty tracking in domain alloc (Joao Martins)  [Orabug: 39186453]
  - iommu/io-pgtable-arm: Add read_and_clear_dirty() support (Shameer Kolothum)  [Orabug: 39186453]
  - iommu/arm-smmu-v3: Add feature detection for HTTU (Jean-Philippe Brucker)  [Orabug: 39186453]


author: Samasth Norway Ananda <samasth.norway.ananda@oracle.com> [5.15.0-320.202.8.2.el8uek]
changelog:
  - xfrm: esp: ipv4: fix up flags setting (Greg Kroah-Hartman)  [Orabug: 39344515]  {CVE-2026-43284} 
  - xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39344515]  {CVE-2026-43284}


author: Samasth Norway Ananda <samasth.norway.ananda@oracle.com> [5.15.0-320.202.8.2.el8uek]
changelog:
  - xfrm: esp: ipv4: fix up flags setting (Greg Kroah-Hartman)  [Orabug: 39344515]  {CVE-2026-43284}
  - xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39344515]  {CVE-2026-43284}


author: Samasth Norway Ananda <samasth.norway.ananda@oracle.com> [5.15.0-320.202.8.3.el8uek]
changelog:
  - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Jeff Layton)  [Orabug: 39362036]  {CVE-2026-31402} 
  - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (Victor Nogueira)  [Orabug: 39362005]  {CVE-2026-23270} 
  - KVM: x86: disable preemption around the call to kvm_arch_vcpu_{un|}blocking (Maxim Levitsky)  [Orabug: 39362018]  
  - KVM: Don't block+unblock when halt-polling is successful (Sean Christopherson)  [Orabug: 39362018]


author: Samasth Norway Ananda <samasth.norway.ananda@oracle.com> [5.15.0-320.202.8.3.el8uek]
changelog:
  - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Jeff Layton)  [Orabug: 39362036]  {CVE-2026-31402}
  - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (Victor Nogueira)  [Orabug: 39362005]  {CVE-2026-23270}
  - KVM: x86: disable preemption around the call to kvm_arch_vcpu_{un|}blocking (Maxim Levitsky)  [Orabug: 39362018]
  - KVM: Don't block+unblock when halt-polling is successful (Sean Christopherson)  [Orabug: 39362018]


author: Samasth Norway Ananda <samasth.norway.ananda@oracle.com> [5.15.0-320.202.8.4.el8uek]
changelog:
  - ptrace: slightly saner 'get_dumpable()' logic (Linus Torvalds)  [Orabug: 39391447]  {CVE-2026-46333}


author: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> [5.15.0-320.202.8.5.el8uek]
changelog:
  - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim)  [Orabug: 39420565]  {CVE-2026-46300} 
  - net: skbuff: preserve shared-frag marker during coalescing (William Bowling)  [Orabug: 39420565]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-320.202.7.el8uek]
changelog:
  - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [Orabug: 39250686,39331104] {CVE-2026-43077}
  - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [Orabug: 39250686,39331109] {CVE-2026-43078}
  - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [Orabug: 39250686]
  - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [Orabug: 39250686,39300910] {CVE-2026-43033}
  - crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers) [Orabug: 39250686]
  - crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le) [Orabug: 39250686]
  - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [Orabug: 39250686,39283867,39291961] {CVE-2026-31431}
  - crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers) [Orabug: 39250686] {CVE-2026-31431}
  - crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers) [Orabug: 39250686]
  - uek-rpm: Enable FWCTL for aarch64 (Dave Kleikamp) [Orabug: 39252913]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-320.202.8.el8uek]
changelog:
  - iommu/arm-smmu-v3: Handle zeroed A4-2C HTTU override settings (Joao Martins) [Orabug: 39186453]
  - iommu: Move IOMMU_DIRTY_NO_CLEAR define (Shameer Kolothum) [Orabug: 39186453]
  - iommu/arm-smmu-v3: Enable HTTU for stage1 with io-pgtable mapping (Kunkun Jiang) [Orabug: 39186453]
  - iommu/arm-smmu-v3: Add support for dirty tracking in domain alloc (Joao Martins) [Orabug: 39186453]
  - iommu/io-pgtable-arm: Add read_and_clear_dirty() support (Shameer Kolothum) [Orabug: 39186453]
  - iommu/arm-smmu-v3: Add feature detection for HTTU (Jean-Philippe Brucker) [Orabug: 39186453]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-321.202.1.el8uek]
changelog:
  - virtio-net: add cond_resched() to the command waiting loop (Jason Wang) [Orabug: 39291988]
  - virtio-net: convert rx mode setting to use workqueue (Jason Wang) [Orabug: 39291988]
  - x86: KVM: Add common feature flag for AMD's PSFD (Sean Christopherson) [Orabug: 35586248]
  - KVM: x86: Insert "AMD" in KVM_X86_FEATURE_PSFD (Jim Mattson) [Orabug: 35586248]
  - KVM: x86: Expose Predictive Store Forwarding Disable (Babu Moger) [Orabug: 35586248]
  - i2c: designware: fix __i2c_dw_disable() in case master is holding SCL low (Yann Sionneau) [Orabug: 39174661]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-321.202.2.el8uek]
changelog:
  - dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler (Guenter Roeck)
  - Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" (Sasha Levin)
  - ip6_tunnel: Fix usage of skb_vlan_inet_prepare() (Ben Hutchings)
  - hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler optimization induced race (Gui-Dong Han)
  - wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (Guenter Roeck)
  - sched: idle: Make skipping governor callbacks more consistent (Rafael J. Wysocki)
  - nvmet-tcp: fix use-before-check of sg in bounds validation (Cengiz Can)
  - remoteproc: mediatek: Unprepare SCP clock during system suspend (Tzung-Bi Shih)
  - net: openvswitch: Avoid releasing netdev before teardown completes (Toke Høiland-Jørgensen)
  - ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (Rafael J. Wysocki)
  - net: hsr: fix VLAN add unwind on slave errors (Luka Gejak)
  - x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39327141]  {CVE-2025-54518}
  - xfrm: esp: ipv4: fix up flags setting (Greg Kroah-Hartman)  [Orabug: 39342679]  {CVE-2026-43284}
  - xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39342679]  {CVE-2026-43284}
  - KVM: x86: disable preemption around the call to kvm_arch_vcpu_{un|}blocking (Maxim Levitsky)  [Orabug: 39334996]
  - KVM: Don't block+unblock when halt-polling is successful (Sean Christopherson)  [Orabug: 39334996]
  - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Jeff Layton)  [Orabug: 39167616]  {CVE-2026-31402}
  - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (Victor Nogueira)  [Orabug: 39103230]  {CVE-2026-23270}
  - exadata: tools: perf: update column to comm_nodigit (Stephen Brennan)  [Orabug: 39327019]
  - perf report: Add comm_nodigit sort key (Stephen Brennan)  [Orabug: 39327019]
  - Revert "tools: perf: add comm_ignore_digit column" (Stephen Brennan)  [Orabug: 39327019]


author: Samasth Norway Ananda <samasth.norway.ananda@oracle.com> [5.15.0-321.202.3.el8uek]
changelog:
  - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim)  [Orabug: 39368827]  {CVE-2026-46300}
  - net: skbuff: preserve shared-frag marker during coalescing (William Bowling)  [Orabug: 39368827]
  - ptrace: slightly saner 'get_dumpable()' logic (Linus Torvalds)  [Orabug: 39384274]  {CVE-2026-46333}
  - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand (Red Hat))  [Orabug: 38474901]
  - Revert "mm/hugetlb: add option to allows disabling CVE-2025-38085 mitigation" (Samasth Norway Ananda)  [Orabug: 38474901]
  - mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand (Red Hat))  [Orabug: 38474901]
  - mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand (Red Hat))  [Orabug: 38474901]
  - mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand (Red Hat))  [Orabug: 38474901]


author: Samasth Norway Ananda <samasth.norway.ananda@oracle.com> [5.15.0-321.202.4.el8uek]
changelog:
  - tun: free page on build_skb failure in tun_xdp_one() (Weiming Shi)  [Orabug: 39429143]
  - tap: free page on error paths in tap_get_user_xdp() (Weiming Shi)  [Orabug: 39429143]
  - tun: free page on short-frame rejection in tun_xdp_one() (Weiming Shi)  [Orabug: 39429143]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-321.202.5.el8uek]
changelog:
  - Revert "ip6_tunnel: Fix usage of skb_vlan_inet_prepare()" (Harshit Mogalapalli)  [Orabug: 39476647]
  - smb: client: reject userspace cifs.spnego descriptions (Asim Viladi Oglu Manizada)  [Orabug: 39463672]


author: Samasth Norway Ananda <samasth.norway.ananda@oracle.com> [5.15.0-321.202.5.1.el8uek]
changelog:
  - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Rutland)  [Orabug: 39017590]  {CVE-2025-10263} 
  - arm64: tlb: Add ARM64_WORKAROUND_REPEAT_TLBI_SYNC (Mark Rutland)  [Orabug: 39017590]  
  - ARM: uek: Disable CONFIG_NVIDIA_CARMEL_CNP_ERRATUM (Boris Ostrovsky)  [Orabug: 39017590]  
  - arm64: tlb: allow XZR argument to TLBI ops (Mark Rutland)  [Orabug: 39017590]  
  - arm64: cputype: Add C1-Premium definitions (Mark Rutland)  [Orabug: 39017590]  
  - arm64: cputype: Add C1-Ultra definitions (Mark Rutland)  [Orabug: 39017590]


author: Samasth Norway Ananda <samasth.norway.ananda@oracle.com> [5.15.0-321.202.5.1.el8uek]
changelog:
  - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Rutland)  [Orabug: 39017590]  {CVE-2025-10263}
  - arm64: tlb: Add ARM64_WORKAROUND_REPEAT_TLBI_SYNC (Mark Rutland)  [Orabug: 39017590]
  - ARM: uek: Disable CONFIG_NVIDIA_CARMEL_CNP_ERRATUM (Boris Ostrovsky)  [Orabug: 39017590]
  - arm64: tlb: allow XZR argument to TLBI ops (Mark Rutland)  [Orabug: 39017590]
  - arm64: cputype: Add C1-Premium definitions (Mark Rutland)  [Orabug: 39017590]
  - arm64: cputype: Add C1-Ultra definitions (Mark Rutland)  [Orabug: 39017590]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-321.202.5.2.el8uek]
changelog:
  - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Muhammad Alifa Ramdhan)  [Orabug: 39543209]  {CVE-2026-31533} 
  - net: fix fanout UAF in packet_release() via NETDEV_UP race (Yochai Eisenrich)  [Orabug: 39543208]  {CVE-2026-31504} 
  - net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null (Cezar Bulinaru)  [Orabug: 39543201]  {CVE-2022-50073} 
  - mptcp: fix slab-use-after-free in __inet_lookup_established (Jiayuan Chen)  [Orabug: 39543200]  {CVE-2026-31669} 
  - batman-adv: hold claim backbone gateways by reference (Haoze Xie)  [Orabug: 39543197]  {CVE-2026-31657} 
  - arm64: dts: pensando: drop elba penfw firmware node (Tom Saeger)  [Orabug: 39543196]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-321.202.5.2.el8uek]
changelog:
  - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Muhammad Alifa Ramdhan)  [Orabug: 39543209]  {CVE-2026-31533}
  - net: fix fanout UAF in packet_release() via NETDEV_UP race (Yochai Eisenrich)  [Orabug: 39543208]  {CVE-2026-31504}
  - net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null (Cezar Bulinaru)  [Orabug: 39543201]  {CVE-2022-50073}
  - mptcp: fix slab-use-after-free in __inet_lookup_established (Jiayuan Chen)  [Orabug: 39543200]  {CVE-2026-31669}
  - batman-adv: hold claim backbone gateways by reference (Haoze Xie)  [Orabug: 39543197]  {CVE-2026-31657}
  - arm64: dts: pensando: drop elba penfw firmware node (Tom Saeger)  [Orabug: 39543196]


author: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> [5.15.0-321.202.5.3.el8uek]
changelog:
  - net: skbuff: fix missing zerocopy reference in pskb_carve helpers (Minh Nguyen)  [Orabug: 39639981]  {CVE-2026-52943}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-321.202.5.el8uek]
changelog:
  - Revert "ip6_tunnel: Fix usage of skb_vlan_inet_prepare()" (Harshit Mogalapalli)  [Orabug: 39476647]  
  - smb: client: reject userspace cifs.spnego descriptions (Asim Viladi Oglu Manizada)  [Orabug: 39463672]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-322.202.1.el8uek]
changelog:
  - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (Michael Bommarito)  [Orabug: 39446044]
  - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (Michael Bommarito)  [Orabug: 39446044]
  - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Michael Bommarito)  [Orabug: 39446044]
  - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Michael Bommarito)  [Orabug: 39446044]
  - ima: process_measurement() needlessly takes inode_lock() on MAY_READ (Frederick Lawler)  [Orabug: 39390378]
  - net: sched: act_api: implement generic walker and search for tc action (Zhengchao Shao)  [Orabug: 39342047]
  - btrfs: reserve extra space for the free space tree (Josef Bacik)  [Orabug: 39281379]
  - btrfs: include the free space tree in the global rsv minimum calculation (Josef Bacik)  [Orabug: 39281379]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-322.203.2.el8uek]
changelog:
  - LTS version: v5.15.203 (Vijayendra Suman)
  - io_uring/poll: correctly handle io_poll_add() return value on update (Jens Axboe)
  - ksmbd: Fix dangling pointer in krb_authenticate (Sean Heelan)
  - ksmbd: Fix refcount leak when invalid session is found on session lookup (Namjae Jeon)
  - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz)
  - i2c: cp2615: fix serial string NULL-deref at probe (Johan Hovold)
  - i2c: cp2615: replace deprecated strncpy with strscpy (Justin Stitt)
  - ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() (Namjae Jeon)
  - ksmbd: fix potencial OOB in get_file_all_info() for compound requests (Namjae Jeon)
  - tracing: Fix potential deadlock in cpu hotplug with osnoise (Luo Haiyang)
  - x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling() (Nikunj A Dadhania)
  - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (Jinjiang Tu)
  - scsi: target: tcm_loop: Drain commands in target_reset handler (Josef Bacik)
  - net: macb: Move devm_{free,request}_irq() out of spin lock area (Kevin Hao)
  - dmaengine: sh: rz-dmac: Protect the driver specific lists (Claudiu Beznea)
  - dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock (Claudiu Beznea)
  - xfs: save ailp before dropping the AIL lock in push callbacks (Yuto Ohnuki)
  - ext4: fix use-after-free in update_super_work when racing with umount (Jiayuan Chen)
  - ext4: fix the might_sleep() warnings in kvfree() (Zqiang)
  - ext4: publish jinode after initialization (Li Chen)
  - usb: gadget: uvc: fix NULL pointer dereference during unbind race (Jimmy Hu)
  - usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop (Kuen-Han Tsai)
  - usb: gadget: f_hid: move list and spinlock inits from bind to alloc (Michael Zimmermann)
  - net: rfkill: prevent unlimited numbers of rfkill events from being created (Greg Kroah-Hartman)
  - seg6: separate dst_cache for input and output paths in seg6 lwtunnel (Andrea Mayer)
  - Revert "mptcp: add needs_id for netlink appending addr" (Matthieu Baerts (NGI0))
  - xen/privcmd: unregister xenstore notifier on module exit (GuoHan Zhao)
  - netlink: add nla be16/32 types to minlen array (Florian Westphal)
  - rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) (David Howells)
  - rxrpc: fix reference count leak in rxrpc_server_keyring() (Luxiao Xu)
  - net: stmmac: fix integer underflow in chain mode (Tyllis Xu)
  - net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure (Pengpeng Hou)
  - mmc: vub300: fix NULL-deref on disconnect (Johan Hovold)
  - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (Sebastian Brzezinka)
  - net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() (David Carlier)
  - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Muhammad Alifa Ramdhan)
  - batman-adv: reject oversized global TT response buffers (Ruide Cao)
  - nfc: pn533: allocate rx skb before consuming bytes (Pengpeng Hou)
  - arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges (Shawn Guo)
  - arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity (Shawn Guo)
  - wifi: brcmsmac: Fix dma_free_coherent() size (Thomas Fourier)
  - tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (Oleh Konko)
  - netfilter: nft_ct: fix use-after-free in timeout object destroy (Tuan Do)
  - apparmor: fix race between freeing data and fs accessing it (John Johansen)
  - apparmor: fix race on rawdata dereference (John Johansen)
  - apparmor: fix differential encoding verification (John Johansen)
  - apparmor: fix unprivileged local user can do privileged policy management (John Johansen)
  - apparmor: Fix double free of ns_name in aa_replace_profiles() (John Johansen)
  - apparmor: fix missing bounds check on DEFAULT table in verify_dfa() (Massimiliano Pellizzer)
  - apparmor: fix side-effect bug in match_char() macro usage (Massimiliano Pellizzer)
  - apparmor: fix: limit the number of levels of policy namespaces (John Johansen)
  - apparmor: replace recursive profile removal with iterative approach (Massimiliano Pellizzer)
  - apparmor: fix memory leak in verify_header (Massimiliano Pellizzer)
  - apparmor: validate DFA start states are in bounds in unpack_pdb (Massimiliano Pellizzer)
  - iio: adc: ad7923: Fix buffer overflow for tx_buf and ring_xfer (Nuno Sa)
  - gpiolib: cdev: fix uninitialised kfifo (Kent Gibson)
  - media: uvcvideo: Use heuristic to find stream entity (Ricardo Ribalda)
  - media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Thadeu Lima de Souza Cascardo)
  - Input: uinput - take event lock when submitting FF request "event" (Dmitry Torokhov)
  - Input: uinput - fix circular locking dependency with ff-core (Mikhail Gavrilov)
  - mptcp: fix slab-use-after-free in __inet_lookup_established (Jiayuan Chen)
  - xfrm_user: fix info leak in build_report() (Greg Kroah-Hartman)
  - wifi: rt2x00usb: fix devres lifetime (Johan Hovold)
  - lib/crypto: chacha: Zeroize permuted_state before it leaves scope (Eric Biggers)
  - wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free (Alexander Popov)
  - io_uring/tctx: work around xa_store() allocation error issue (Jens Axboe)
  - usb: gadget: f_uac1_legacy: validate control request size (Taegu Ha)
  - usb: gadget: f_rndis: Protect RNDIS options with mutex (Kuen-Han Tsai)
  - usb: gadget: f_subset: Fix unbalanced refcnt in geth_free (Kuen-Han Tsai)
  - staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser (Navaneeth K)
  - smb: client: Fix refcount leak for cifs_sb_tlink (Shuhao Fu)
  - net: mctp: Don't access ifa_index when missing (Matt Johnston)
  - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Quanmin Yan)
  - can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
  - can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde)
  - can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
  - usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer (Sebastian Urban)
  - USB: dummy-hcd: Fix interrupt synchronization error (Alan Stern)
  - USB: dummy-hcd: Fix locking/synchronization error (Alan Stern)
  - thunderbolt: Fix property read in nhi_wake_supported() (Konrad Dybcio)
  - net: ftgmac100: fix ring allocation unwind on open failure (Yufan Chen)
  - vxlan: validate ND option lengths in vxlan_na_create (Yang Yang)
  - netfilter: ipset: drop logically empty buckets in mtype_del (Yifan Wu)
  - comedi: me4000: Fix potential overrun of firmware buffer (Ian Abbott)
  - comedi: me_daq: Fix potential overrun of firmware buffer (Ian Abbott)
  - comedi: ni_atmio16d: Fix invalid clean-up after failed attach (Ian Abbott)
  - comedi: Reinit dev->spinlock between attachments to low-level drivers (Ian Abbott)
  - comedi: dt2815: add hardware detection to prevent crash (Deepanshu Kartikey)
  - cdc-acm: new quirk for EPSON HMD (Oliver Neukum)
  - bridge: br_nd_send: validate ND option lengths (Yang Yang)
  - phy: renesas: rcar-gen3-usb2: Assert PLL reset on PHY power off (Claudiu Beznea)
  - phy: renesas: rcar-gen3-usb2: Lock around hardware registers and driver data (Claudiu Beznea)
  - phy: renesas: rcar-gen3-usb2: Move IRQ request in probe (Claudiu Beznea)
  - phy: renesas: rcar-gen3-usb2: Fix role detection on unbind/bind (Claudiu Beznea)
  - usb: cdns3: gadget: fix state inconsistency on gadget init failure (Yongchao Wu)
  - usb: cdns3: gadget: fix NULL pointer dereference in ep_queue (Yongchao Wu)
  - usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() (Juno Choi)
  - usb: ehci-brcm: fix sleep during atomic (Justin Chen)
  - usb: usbtmc: Flush anchored URBs in usbtmc_release (Heitor Alves de Siqueira)
  - usb: ulpi: fix double free in ulpi_register_interface() error path (Guangshuo Li)
  - usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive (Miao Li)
  - iio: gyro: mpu3050: Fix out-of-sequence free_irq() (Ethan Tidmore)
  - iio: gyro: mpu3050: Move iio_device_register() to correct location (Ethan Tidmore)
  - iio: gyro: mpu3050: Fix irq resource leak (Ethan Tidmore)
  - iio: gyro: mpu3050: Fix incorrect free_irq() variable (Ethan Tidmore)
  - iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only (Francesco Lavra)
  - iio: light: vcnl4035: fix scan buffer on big-endian (David Lechner)
  - iio: dac: ad5770r: fix error return in ad5770r_read_raw() (Antoniu Miclaus)
  - Input: xpad - add support for Razer Wolverine V3 Pro (Zoltan Illes)
  - Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
  - Input: synaptics-rmi4 - fix a locking bug in an error path (Bart Van Assche)
  - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam (JP Hein)
  - USB: serial: option: add support for Rolling Wireless RW135R-GL (Wanquan Zhong)
  - USB: serial: io_edgeport: add support for Blackbox IC135A (Frej Drejhammar)
  - drm/ast: dp501: Fix initialization of SCU2C (Thomas Zimmermann)
  - hwmon: (occ) Fix division by zero in occ_show_power_1() (Sanman Pradhan)
  - MIPS: Fix the GCC version check for `__multi3' workaround (Maciej W. Rozycki)
  - Bluetooth: SMP: force responder MITM requirements before building the pairing response (Oleh Konko)
  - Bluetooth: SMP: derive legacy responder STK authentication from MITM state (Oleh Konko)
  - ALSA: ctxfi: Fix missing SPDIFI1 index handling (Takashi Iwai)
  - ALSA: caiaq: fix stack out-of-bounds read in init_card (Berk Cem Goksel)
  - USB: serial: option: add MeiG Smart SRM825WN (Ernestas Kulik)
  - wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation (Yasuaki Torimaru)
  - drm/ioc32: stop speculation on the drm_compat_ioctl path (Greg Kroah-Hartman)
  - riscv: kgdb: fix several debug register assignment bugs (Paul Walmsley)
  - hwmon: (occ) Fix missing newline in occ_show_extended() (Sanman Pradhan)
  - hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify() (Sanman Pradhan)
  - hwmon: (pxe1610) Check return value of page-select write in probe (Sanman Pradhan)
  - bpf: reject direct access to nullable PTR_TO_BUF pointers (Qi Tang)
  - ipv6: avoid overflows in ip6_datagram_send_ctl() (Eric Dumazet)
  - net/sched: cls_flow: fix NULL pointer dereference on shared blocks (Xiang Mei)
  - net/sched: cls_fw: fix NULL pointer dereference on shared blocks (Xiang Mei)
  - net/x25: Fix overflow when accumulating packets (Martin Schiller)
  - net/x25: Fix potential double free of skb (Martin Schiller)
  - net/mlx5: Avoid "No data available" when FW version queries fail (Saeed Mahameed)
  - net: macb: properly unregister fixed rate clocks (Fedor Pchelkin)
  - net: macb: fix clk handling on PCI glue driver removal (Fedor Pchelkin)
  - Bluetooth: MGMT: validate LTK enc_size on load (Keenan Dong)
  - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Pablo Neira Ayuso)
  - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Pablo Neira Ayuso)
  - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Qi Tang)
  - netfilter: nf_conntrack_helper: pass helper to expect cleanup (Qi Tang)
  - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal)
  - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal)
  - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal)
  - netfilter: flowtable: strictly check for maximum number of actions (Pablo Neira Ayuso)
  - net: ipv6: flowlabel: defer exclusive option free until RCU teardown (Zhengchuan Liang)
  - bpf: Fix regsafe() for pointers to packet (Alexei Starovoitov)
  - net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec (Suraj Gupta)
  - NFC: pn533: bound the UART receive buffer (Pengpeng Hou)
  - net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak (Yochai Eisenrich)
  - ipv6: prevent possible UaF in addrconf_permanent_addr() (Paolo Abeni)
  - net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() (Xiang Mei)
  - bridge: br_nd_send: linearize skb before parsing ND options (Yang Yang)
  - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Eric Dumazet)
  - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Eric Dumazet)
  - tg3: Fix race for querying speed/duplex (Thomas Bogendoerfer)
  - net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak (Yochai Eisenrich)
  - net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak (Jiayuan Chen)
  - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Norbert Szetei)
  - dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning (Frank Li)
  - btrfs: reject root items with drop_progress and zero drop_level (ZhengYuan Huang)
  - HID: multitouch: Check to ensure report responses match the request (Lee Jones)
  - objtool: Fix Clang jump table detection (Josh Poimboeuf)
  - btrfs: don't take device_list_mutex when querying zone info (Johannes Thumshirn)
  - atm: lec: fix use-after-free in sock_def_readable() (Deepanshu Kartikey)
  - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (Benoît Sevens)
  - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Davidlohr Bueso)
  - dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA (Tomi Valkeinen)
  - dmaengine: xilinx_dma: Program interrupt delay timeout (Radhey Shyam Pandey)
  - dmaengine: idxd: Fix freeing the allocated ida too late (Vinicius Costa Gomes)
  - btrfs: fix lost error when running device stats on multiple devices fs (Filipe Manana)
  - btrfs: fix super block offset in error message in btrfs_validate_super() (Mark Harmstone)
  - dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction (Marek Vasut)
  - dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA (Marek Vasut)
  - dmaengine: xilinx: xilinx_dma: Fix dma_device directions (Marek Vasut)
  - phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types() (Felix Gu)
  - ext4: always drain queued discard work in ext4_mb_release() (Theodore Ts'o)
  - ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (Baokun Li)
  - ext4: reject mount if bigalloc with s_first_data_block != 0 (Helen Koike)
  - ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (Ye Bin)
  - ext4: make recently_deleted() properly work with lazy itable initialization (Jan Kara)
  - ext4: convert inline data to extents when truncate exceeds inline size (Deepanshu Kartikey)
  - xfs: stop reclaim before pushing AIL during unmount (Yuto Ohnuki)
  - jbd2: gracefully abort on checkpointing state corruptions (Milos Nikic)
  - scsi: ses: Handle positive SCSI error from ses_recv_diag() (Greg Kroah-Hartman)
  - scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (Tyllis Xu)
  - alarmtimer: Fix argument order in alarm_timer_forward() (Zhan Xusheng)
  - erofs: add GFP_NOIO in the bio completion if needed (Jiucheng Xu)
  - virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (xietangxin)
  - media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (Yuchan Nam)
  - cpufreq: conservative: Reset requested_freq on limits change (Viresh Kumar)
  - can: gw: fix OOB heap access in cgw_csum_crc8_rel() (Ali Norouzi)
  - s390/barrier: Make array_index_mask_nospec() __always_inline (Vasily Gorbik)
  - s390/syscalls: Add spectre boundary for syscall dispatch table (Greg Kroah-Hartman)
  - spi: spi-fsl-lpspi: fix teardown order issue (UAF) (Marc Kleine-Budde)
  - ASoC: adau1372: Fix clock leak on PLL lock failure (Jihed Chaibi)
  - ASoC: adau1372: Fix unchecked clk_prepare_enable() return value (Jihed Chaibi)
  - sysctl: fix uninitialized variable in proc_do_large_bitmap (Marc Buerg)
  - hwmon: (adm1177) fix sysfs ABI violation and current unit conversion (Sanman Pradhan)
  - ACPI: EC: Fix ECDT probe ordering issues (Hans de Goede)
  - ACPI: EC: Fix EC address space handler unregistration (Hans de Goede)
  - ACPICA: Allow address_space_handler Install and _REG execution as 2 separate steps (Hans de Goede)
  - ACPICA: include/acpi/acpixf.h: Fix indentation (Hans de Goede)
  - ASoC: Intel: catpt: Fix the device initialization (Cezary Rojewski)
  - drm/i915/gmbus: fix spurious timeout on 512-byte burst reads (Samasth Norway Ananda)
  - x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size (Mike Rapoport (Microsoft))
  - scsi: scsi_transport_sas: Fix the maximum channel scanning issue (Yihang Li)
  - RDMA/irdma: Return EINVAL for invalid arp index error (Tatyana Nikolova)
  - RDMA/irdma: Fix deadlock during netdev reset with active connections (Anil Samal)
  - RDMA/irdma: Remove reset check from irdma_modify_qp_to_err() (Tatyana Nikolova)
  - RDMA/irdma: Clean up unnecessary dereference of event->cm_node (Ivan Barrera)
  - RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce() (Tatyana Nikolova)
  - RDMA/irdma: Update ibqp state to error if QP is already in error state (Tatyana Nikolova)
  - RDMA/rw: Fall back to direct SGE on MR pool exhaustion (Chuck Lever)
  - regmap: Synchronize cache for the page selector (Andy Shevchenko)
  - net: macb: use the current queue number for stats (Paolo Valerio)
  - netfilter: ctnetlink: use netlink policy range checks (David Carlier)
  - netlink: allow be16 and be32 types in all uint policy checks (Florian Westphal)
  - netlink: introduce bigendian integer types (Florian Westphal)
  - netfilter: nft_payload: reject out-of-range attributes via policy (Florian Westphal)
  - netlink: introduce NLA_POLICY_MAX_BE (Florian Westphal)
  - netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp (Weiming Shi)
  - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Ren Wei)
  - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Weiming Shi)
  - Bluetooth: btusb: clamp SCO altsetting table indices (Pengpeng Hou)
  - Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop (Hyunwoo Kim)
  - dma-mapping: add missing `inline` for `dma_free_attrs` (Miguel Ojeda)
  - net: enetc: fix the output issue of 'ethtool --show-ring' (Wei Fang)
  - net: fix fanout UAF in packet_release() via NETDEV_UP race (Yochai Eisenrich)
  - platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen (Alok Tiwari)
  - rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size (Sabrina Dubroca)
  - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer (Qi Tang)
  - openvswitch: validate MPLS set/set_masked payload length (Yang Yang)
  - nfc: nci: fix circular locking dependency in nci_close_device (Jakub Kicinski)
  - ionic: fix persistent MAC address override on PF (Mohammad Heib)
  - pinctrl: mediatek: common: Fix probe failure for devices without EINT (Luca Leonardo Scorcia)
  - Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb (Helen Koike)
  - Bluetooth: hci_ll: Fix firmware leak on error path (Anas Iqbal)
  - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (Hyunwoo Kim)
  - Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() (Hyunwoo Kim)
  - can: statistics: add missing atomic access in hot path (Oliver Hartkopp)
  - af_key: validate families in pfkey_send_migrate() (Eric Dumazet)
  - esp: fix skb leak with espintcp and async crypto (Sabrina Dubroca)
  - xfrm: Fix the usage of skb->sk (Steffen Klassert)
  - xfrm: call xdo_dev_state_delete during state update (Sabrina Dubroca)
  - ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390 (Uzair Mughal)
  - dma-buf: Include ioctl.h in UAPI header (Isaac J. Manjarres)
  - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits() (Mark Brown)
  - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg() (Mark Brown)
  - module: Fix kernel panic when a symbol st_shndx is out of bounds (Ihor Solodrai)
  - HID: mcp2221: cancel last I2C command on read error (Romain Sioen)
  - net: usb: r8152: add TRENDnet TUC-ET2G (Valentin Spreckels)
  - HID: magicmouse: avoid memory leak in magicmouse_report_fixup() (Günther Noack)
  - HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2 (Julius Lehmann)
  - nvme-pci: ensure we're polling a polled queue (Keith Busch)
  - platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10 (Hans de Goede)
  - platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1 (Leif Skunberg)
  - nvme-pci: cap queue creation to used queues (Keith Busch)
  - platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list (Peter Metz)
  - HID: asus: avoid memory leak in asus_report_fixup() (Günther Noack)
  - bpf: Release module BTF IDR before module unload (Kumar Kartikeya Dwivedi)
  - sh: platform_early: remove pdev->driver_override check (Danilo Krummrich)
  - xen/privcmd: add boot control for restricted usage in domU (Juergen Gross)
  - xen/privcmd: restrict usage in unprivileged domU (Juergen Gross)
  - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal)
  - netfilter: nf_tables: de-constify set commit ops function argument (Florian Westphal)
  - tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure (Josh Law)
  - lib/bootconfig: check xbc_init_node() return in override path (Josh Law)
  - drm/i915/gt: Check set_default_submission() before deferencing (Rahul Bukte)
  - ksmbd: fix use-after-free of share_conf in compound request (Hyunwoo Kim)
  - mtd: rawnand: brcmnand: skip DMA during panic write (Kamal Dasu)
  - mtd: rawnand: serialize lock/unlock against other NAND operations (Kamal Dasu)
  - i2c: fsi: Fix a potential leak in fsi_i2c_probe() (Christophe JAILLET)
  - hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit() (Sanman Pradhan)
  - icmp: fix NULL pointer dereference in icmp_tag_validation() (Weiming Shi)
  - net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths (Anas Iqbal)
  - net: mvpp2: guard flow control update with global_tx_fc in buffer switching (Muhammad Hammad Ijaz)
  - nfnetlink_osf: validate individual option lengths in fingerprints (Weiming Shi)
  - net: bonding: fix NULL deref in bond_debug_rlb_hash_show (Xiang Mei)
  - udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n (Xiang Mei)
  - net: macb: fix uninitialized rx_fs_lock (Fedor Pchelkin)
  - wifi: mac80211: fix NULL deref in mesh_matches_local() (Xiang Mei)
  - igc: fix missing update of skb->tail in igc_xmit_frame() (Kohei Enju)
  - net: usb: aqc111: Do not perform PM inside suspend callback (Nikola Z. Ivanov)
  - net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (Jiayuan Chen)
  - net/smc: Fix slab-out-of-bounds issue in fallback (Wen Gu)
  - net/smc: Only save the original clcsock callback functions (Wen Gu)
  - PM: runtime: Fix a race condition related to device removal (Bart Van Assche)
  - sched: idle: Consolidate the handling of two special cases (Rafael J. Wysocki)
  - net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown (Dipayaan Roy)
  - net: bcmgenet: increase WoL poll timeout (Justin Chen)
  - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (Jenny Guanni Qu)
  - netfilter: xt_time: use unsigned int for monthday bit shift (Jenny Guanni Qu)
  - netfilter: xt_CT: drop pending enqueued packets on template removal (Pablo Neira Ayuso)
  - netfilter: nft_ct: drop pending enqueued packets on removal (Pablo Neira Ayuso)
  - netfilter: nft_ct: add seqadj extension for natted connections (Andrii Melnychenko)
  - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Jenny Guanni Qu)
  - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Lukas Johannes Möller)
  - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Hyunwoo Kim)
  - netfilter: ctnetlink: remove refcounting in expectation dumpers (Florian Westphal)
  - net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect (Jiayuan Chen)
  - Bluetooth: qca: fix ROM version reading on WCN3998 chips (Dmitry Baryshkov)
  - Bluetooth: HIDP: Fix possible UAF (Luiz Augusto von Dentz)
  - Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy (Christian Eggers)
  - Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU (Christian Eggers)
  - Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU (Christian Eggers)
  - firmware: arm_scpi: Fix device_node reference leak in probe path (Felix Gu)
  - of: Add cleanup.h based auto release via __free(device_node) markings (Jonathan Cameron)
  - wifi: mac80211: Fix static_branch_dec() underflow for aql_disable. (Kuniyuki Iwashima)
  - soc: fsl: qbman: fix race condition in qman_destroy_fq (Richard Genoud)
  - btrfs: tree-checker: fix misleading root drop_level error message (ZhengYuan Huang)
  - batman-adv: avoid OGM aggregation when skb tailroom is insufficient (Yang Yang)
  - pmdomain: bcm: bcm2835-power: Increase ASB control timeout (Maíra Canal)
  - mptcp: pm: avoid sending RM_ADDR over same subflow (Matthieu Baerts (NGI0))
  - drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink (Natalie Vock)
  - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (Andrew Lunn)
  - smb: client: Don't log plaintext credentials in cifs_set_cifscreds (Thorsten Blum)
  - RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() (Jason Gunthorpe)
  - wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() (Daniil Dulov)
  - wifi: cfg80211: move scan done work to wiphy work (Johannes Berg)
  - wifi: libertas: fix use-after-free in lbs_free_adapter() (Daniel Hodges)
  - ext4: always allocate blocks only from groups inode can use (Jan Kara)
  - ksmbd: fix null pointer dereference error in generate_encryptionkey (Namjae Jeon)
  - ext4: fix dirtyclusters double decrement on fs shutdown (Brian Foster)
  - ext4: drop extent cache when splitting extent fails (Zhang Yi)
  - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O (Zhang Yi)
  - ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths (Fedor Pchelkin)
  - drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free (Jeongjun Park)
  - drm/exynos: vidi: fix to avoid directly dereferencing user pointer (Jeongjun Park)
  - drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() (Jeongjun Park)
  - net: Handle napi_schedule() calls from non-interrupt (Frederic Weisbecker)
  - net: stmmac: dwmac-loongson: Set clk_csr_i to 100-150MHz (Huacai Chen)
  - drm/radeon: apply state adjust rules to some additional HAINAN vairants (Alex Deucher)
  - serial: uartlite: fix PM runtime usage count underflow on probe (Maciej Andrzejewski ICEYE)
  - serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY (Ilpo Järvinen)
  - serial: 8250: Fix TX deadlock when using DMA (Raul E Rangel)
  - serial: 8250_pci: add support for the AX99100 (Martin Roukala (né Peres))
  - iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry (Guanghui Feng)
  - mtd: Avoid boot crash in RedBoot partition table parser (Finn Thain)
  - mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init() (Chen Ni)
  - mtd: rawnand: pl353: make sure optimal timings are applied (Olivier Sobrie)
  - mmc: sdhci: fix timing selection for 1-bit bus width (Luke Wang)
  - mmc: sdhci-pci-gli: fix GL9750 DMA write corruption (Matthew Schwartz)
  - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access (Lukas Johannes Möller)
  - Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() (Lukas Johannes Möller)
  - net: macb: fix use-after-free access to PTP clock (Fedor Pchelkin)
  - NFC: nxp-nci: allow GPIOs to sleep (Ian Ray)
  - nvdimm/bus: Fix potential use after free in asynchronous initialization (Ira Weiny)
  - sunrpc: fix cache_request leak in cache_release (Jeff Layton)
  - driver: iio: add missing checks on iio_info's callback access (Julien Stephan)
  - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe)
  - l2tp: do not use sock_hold() in pppol2tp_session_get_sock() (Eric Dumazet)
  - bpf: Forget ranges when refining tnum after JSET (Paul Chaignon)
  - i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor (Adrian Hunter)
  - i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort (Adrian Hunter)
  - i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors (Adrian Hunter)
  - iio: imu: inv_icm42600: fix odr switch to the same value (Jean-Baptiste Maneyrol)
  - iio: gyro: mpu3050-i2c: fix pm_runtime error handling (Antoniu Miclaus)
  - iio: gyro: mpu3050-core: fix pm_runtime error handling (Antoniu Miclaus)
  - iio: chemical: bme680: Fix measurement wait duration calculation (Chris Spencer)
  - iio: potentiometer: mcp4131: fix double application of wiper shift (Lukas Schmid)
  - iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas() (Antoniu Miclaus)
  - iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas() (Antoniu Miclaus)
  - iio: dac: ds4424: reject -128 RAW value (Oleksij Rempel)
  - btrfs: abort transaction on failure to update root in the received subvol ioctl (Filipe Manana)
  - lib/bootconfig: check bounds before writing in __xbc_open_brace() (Josh Law)
  - lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after() (Josh Law)
  - x86/apic: Disable x2apic on resume if the kernel expects so (Shashank Balaji)
  - lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error (Josh Law)
  - xfs: fix undersized l_iclog_roundoff values (Darrick J. Wong)
  - tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G (Calvin Owens)
  - drm/amdgpu: Fix use-after-free race in VM acquire (Alysa Liu)
  - net: ethernet: arc: emac: quiesce interrupts before requesting IRQ (Fan Wu)
  - net: ncsi: fix skb leak in error paths (Jian Zhang)
  - parisc: Fix initial page table creation for boot (Helge Deller)
  - hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read (Sanman Pradhan)
  - nouveau/dpcd: return EBUSY for aux xfer if the device is asleep (Dave Airlie)
  - parisc: Increase initial mapping to 64 MB with KALLSYMS (Helge Deller)
  - batman-adv: Avoid double-rtnl_lock ELP metric worker (Sven Eckelmann)
  - ice: fix retry for AQ command 0x06EE (Jakub Staniszewski)
  - net: mana: Ring doorbell at 4 CQ wraparounds (Long Li)
  - media: dvb-net: fix OOB access in ULE extension header tables (Ariel Silver)
  - staging: rtl8723bs: properly validate the data in rtw_get_ie_ex() (Greg Kroah-Hartman)
  - staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie (Luka Gejak)
  - irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports (Marc Zyngier)
  - device property: Allow secondary lookup in fwnode_get_next_child_node() (Andy Shevchenko)
  - time/jiffies: Mark jiffies_64_to_clock_t() notrace (Steven Rostedt)
  - time: add kernel-doc in time.c (Randy Dunlap)
  - ceph: fix i_nlink underrun during async unlink (Max Kellermann)
  - libceph: admit message frames only in CEPH_CON_S_OPEN state (Ilya Dryomov)
  - libceph: Use u32 for non-negative values in ceph_monmap_decode() (Raphael Zimmer)
  - libceph: prevent potential out-of-bounds reads in process_message_header() (Ilya Dryomov)
  - libceph: reject preamble if control segment is empty (Ilya Dryomov)
  - libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() (Raphael Zimmer)
  - tipc: fix divide-by-zero in tipc_sk_filter_connect() (Mehul Rao)
  - mmc: core: Avoid bitfield RMW for claim/retune flags (Penghe Geng)
  - mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index() (Felix Gu)
  - mm/tracing: rss_stat: ensure curr is false from kthread context (Kalesh Singh)
  - usb: image: mdc800: kill download URB on timeout (Ziyi Guo)
  - usb: mdc800: handle signal and read racing (Oliver Neukum)
  - usb: renesas_usbhs: fix use-after-free in ISR during device removal (Fan Wu)
  - usb: class: cdc-wdm: fix reordering issue in read code path (Oliver Neukum)
  - USB: core: Limit the length of unkillable synchronous timeouts (Alan Stern)
  - USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts (Alan Stern)
  - USB: usbcore: Introduce usb_bulk_msg_killable() (Alan Stern)
  - usb: cdc-acm: Restore CAP_BRK functionnality to CH343 (Marc Zyngier)
  - usb: core: don't power off roothub PHYs if phy_set_mode() fails (Gabor Juhos)
  - usb: misc: uss720: properly clean up reference in uss720_probe() (Greg Kroah-Hartman)
  - usb: yurex: fix race in probe (Oliver Neukum)
  - usb: xhci: Fix memory leak in xhci_disable_slot() (Zilin Guan)
  - usb/core/quirks: Add Huawei ME906S-device to wakeup quirk (Christoffer Sandberg)
  - net: usb: lan78xx: skip LTM configuration for LAN7850 (Oleksij Rempel)
  - net: usb: lan78xx: fix silent drop of packets with checksum errors (Oleksij Rempel)
  - cgroup: fix race between task migration and iteration (Qingye Zhao)
  - octeontx2-af: devlink: fix NIX RAS reporter recovery condition (Alok Tiwari)
  - ASoC: detect empty DMI strings (Casey Connolly)
  - ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition (Chen Ni)
  - ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address() (Ben Dooks)
  - e1000/e1000e: Fix leak in DMA error cleanup (Matt Vollrath)
  - i40e: fix src IP mask checks and memcpy argument names in cloud filter (Alok Tiwari)
  - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set (Sungwoo Kim)
  - regulator: pca9450: Correct interrupt type (Peng Fan)
  - regulator: pca9450: Make IRQ optional (Frieder Schrempf)
  - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels (Yuan Tan)
  - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (Hyunwoo Kim)
  - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Hyunwoo Kim)
  - netfilter: x_tables: guard option walkers against 1-byte tail reads (David Dull)
  - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Jenny Guanni Qu)
  - can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value (Wenyuan Li)
  - serial: caif: hold tty->link reference in ldisc_open and ser_release (Shuangpeng Bai)
  - ASoC: soc-core: flush delayed work before removing DAIs and widgets (matteo.cotifava)
  - ASoC: core: Do not call link_exit() on uninitialized rtd objects (Amadeusz Sławiński)
  - ASoC: core: Exit all links before removing their components (Cezary Rojewski)
  - ASoC: soc-core: accept zero format at snd_soc_runtime_set_dai_fmt() (Kuninori Morimoto)
  - ASoC: soc-core: drop delayed_work_pending() check before flush (matteo.cotifava)
  - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit (Weiming Shi)
  - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Gal Pressman)
  - bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states (Hangbin Liu)
  - xprtrdma: Decrement re_receiving on the early exit paths (Eric Badger)
  - powerpc: 83xx: km83xx: Fix keymile vendor prefix (J. Neuschäfer)
  - remoteproc: sysmon: Correct subsys_name_len type in QMI request (Bjorn Andersson)
  - powerpc/uaccess: Fix inline assembly for clang build on PPC32 (Christophe Leroy (CS GROUP))
  - ALSA: usb-audio: Check max frame size for implicit feedback mode, too (Takashi Iwai)
  - ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0 (Takashi Iwai)
  - scsi: ses: Fix devices attaching to different hosts (Tomas Henzl)
  - ACPI: OSI: Add DMI quirk for Acer Aspire One D255 (Sofia Schneider)
  - unshare: fix unshare_fs() handling (Al Viro)
  - scsi: mpi3mr: Add NULL checks when resetting request and reply queues (Ranjan Kumar)
  - ACPI: PM: Save NVS memory on Lenovo G70-35 (Piotr Mazek)
  - scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT (Jan Kiszka)
  - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (Victor Nogueira)
  - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (Jiayuan Chen)
  - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled (Fernando Fernandez Mancera)
  - net: stmmac: Fix error handling in VLAN add and delete paths (Ovidiu Panait)
  - nfc: rawsock: cancel tx_work before socket teardown (Jakub Kicinski)
  - nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback (Jakub Kicinski)
  - nfc: nci: free skb on nci_transceive early error paths (Jakub Kicinski)
  - net: nfc: nci: Fix zero-length proprietary notifications (Ian Ray)
  - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (Koichiro Den)
  - amd-xgbe: fix sleep while atomic on suspend/resume (Raju Rangoju)
  - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() (Jakub Kicinski)
  - xen/acpi-processor: fix _CST detection using undersized evaluation buffer (David Thomson)
  - indirect_call_wrapper: do not reevaluate function pointer (Eric Dumazet)
  - wifi: wlcore: Fix a locking bug (Bart Van Assche)
  - can: mcp251x: fix deadlock in error path of mcp251x_open (Alban Bedel)
  - can: bcm: fix locking for bcm_op runtime updates (Oliver Hartkopp)
  - atm: lec: fix null-ptr-deref in lec_arp_clear_vccs (Jiayuan Chen)
  - dpaa2-switch: do not clear any interrupts automatically (Ioana Ciornei)
  - net: dpaa2-switch: serialize changes to priv->mac with a mutex (Vladimir Oltean)
  - net: dpaa2-switch replace direct MAC access with dpaa2_switch_port_has_mac() (Vladimir Oltean)
  - net: dpaa2-switch: assign port_priv->mac after dpaa2_mac_connect() call (Vladimir Oltean)
  - net: dpaa2: replace dpaa2_mac_is_type_fixed() with dpaa2_mac_is_type_phy() (Vladimir Oltean)
  - net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling in ALE table (Chintan Vankar)
  - platform/x86: thinkpad_acpi: Fix errors reading battery thresholds (Jonathan Teh)
  - selftests: mptcp: more stable simult_flows tests (Paolo Abeni)
  - drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() (Lars Ellenberg)
  - Squashfs: check metadata block offset is within range (Phillip Lougher)
  - net/sched: ets: fix divide by zero in the offload path (Davide Caratti)
  - IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq() (Jason Gunthorpe)
  - wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() (Vahagn Vardanian)
  - wifi: radiotap: reject radiotap with unknown bits (Johannes Berg)
  - ALSA: usb-audio: Use correct version for UAC3 header validation (Jun Seo)
  - platform/x86: dell-wmi: Add audio/mic mute key codes (Kurt Borja)
  - platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data (Thorsten Blum)
  - x86/efi: defer freeing of boot services memory (Mike Rapoport (Microsoft))
  - HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them (Greg Kroah-Hartman)
  - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback (Greg Kroah-Hartman)
  - can: ucan: Fix infinite loop from zero-length messages (Greg Kroah-Hartman)
  - can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message (Greg Kroah-Hartman)
  - net: usb: pegasus: validate USB endpoints (Greg Kroah-Hartman)
  - net: usb: kalmia: validate USB endpoints (Greg Kroah-Hartman)
  - net: usb: kaweth: validate USB endpoints (Greg Kroah-Hartman)
  - nfc: pn533: properly drop the usb interface reference on disconnect (Greg Kroah-Hartman)
  - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen (Jens Axboe)
  - eventpoll: Fix integer overflow in ep_loop_check_proc() (Jann Horn)
  - net: arcnet: com20020-pci: fix support for 2.5Mbit cards (Ethan Nelson-Moore)
  - ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314 (Takashi Iwai)
  - fbcon: check return value of con2fb_acquire_newinfo() (Andrey Vatoropin)
  - fbcon: move more common code into fb_open() (Daniel Vetter)
  - fbcon: Extract fbcon_open/release helpers (Daniel Vetter)
  - fbcon: Use delayed work for cursor (Daniel Vetter)
  - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
  - ALSA: hda/conexant: Add quirk for HP ZBook Studio G4 (Takashi Iwai)
  - usb: cdns3: fix role switching during resume (Thomas Richard (TI))
  - usb: cdns3: call cdns_power_is_lost() only once in cdns_resume() (Théo Lebrun)
  - usb: cdns3: remove redundant if branch (Hongyu Xie)
  - clk: tegra: tegra124-emc: fix device leak on set_rate() (Johan Hovold)
  - mfd: omap-usb-host: Fix OF populate on driver rebind (Johan Hovold)
  - mfd: omap-usb-host: Convert to platform remove callback returning void (Uwe Kleine-König)
  - mfd: qcom-pm8xxx: Fix OF populate on driver rebind (Johan Hovold)
  - mfd: qcom-pm8xxx: Convert to platform remove callback returning void (Uwe Kleine-König)
  - mfd: qcom-pm8xxx: switch away from using chained IRQ handlers (Dmitry Baryshkov)
  - drm/tegra: dsi: fix device leak on probe (Johan Hovold)
  - ata: libata-scsi: refactor ata_scsi_translate() (Damien Le Moal)
  - ata: libata: remove pointless VPRINTK() calls (Hannes Reinecke)
  - ata: libata-scsi: drop DPRINTK calls for cdb translation (Hannes Reinecke)
  - scsi: ata: Call scsi_done() directly (Bart Van Assche)
  - ARM: omap2: Fix reference count leaks in omap_control_init() (Wentao Liang)
  - ARM: OMAP2+: add missing of_node_put before break and return (Wang Qing)
  - memory: mtk-smi: fix device leak on larb probe (Johan Hovold)
  - memory: mtk-smi: Convert to platform remove callback returning void (Uwe Kleine-König)
  - bpf: Fix stack-out-of-bounds write in devmap (Kohei Enju)
  - btrfs: fix incorrect key offset in error message in check_dev_extent_item() (Mark Harmstone)
  - ALSA: usb-audio: Use inclusive terms (Takashi Iwai)
  - ALSA: usb-audio: Cap the packet size pre-calculations (Takashi Iwai)
  - scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume (Peter Wang)
  - scsi: ufs: core: Always initialize the UIC done completion (Bart Van Assche)
  - scsi: lpfc: Properly set WC for DPP mapping (Mathias Krause)
  - ARM: clean up the memset64() C wrapper (Thomas Weißschuh)


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-322.203.3.el8uek]
changelog:
  - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Rutland)  [Orabug: 39548689]  {CVE-2025-10263}
  - arm64: tlb: Add ARM64_WORKAROUND_REPEAT_TLBI_SYNC (Mark Rutland)  [Orabug: 39548689]
  - ARM: uek: Disable CONFIG_NVIDIA_CARMEL_CNP_ERRATUM (Boris Ostrovsky)  [Orabug: 39548689]
  - arm64: tlb: allow XZR argument to TLBI ops (Mark Rutland)  [Orabug: 39548689]
  - arm64: cputype: Add C1-Premium definitions (Mark Rutland)  [Orabug: 39548689]
  - arm64: cputype: Add C1-Ultra definitions (Mark Rutland)  [Orabug: 39548689]
  - net/rds: Make "rds_send_xmit" fairer (Gerd Rausch)  [Orabug: 39532945]
  - net/rds: Schedule rds_send_worker if there's more work to do (Gerd Rausch)  [Orabug: 39532945]
  - Revert "rds: Change return code from rds_send_xmit() when lock is taken" (Gerd Rausch)  [Orabug: 39532945]
  - Revert "Reapply "rds: ib: Make sure receives are posted before connection is up"" (Gerd Rausch)  [Orabug: 39532945]
  - Revert "rds: ib: Make sure a QP in INIT state is transitioned to ERR" (Gerd Rausch)  [Orabug: 39532945]
  - net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null (Cezar Bulinaru)  [Orabug: 39526881]  {CVE-2022-50073}
  - mmc: dwcmshc_bf3_hw_reset: Log eMMC reset calls (Satyansh Shukla)  [Orabug: 39333650]
  - arm64: dts: pensando: drop elba penfw firmware node (Tom Saeger)  [Orabug: 39522954]
  - batman-adv: hold claim backbone gateways by reference (Haoze Xie)  [Orabug: 39262374]  {CVE-2026-31657}
  - rds: Drop rds conn in connect worker if not in down state. (Rohit Nair)  [Orabug: 39179363]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-322.203.3.1.el8uek]
changelog:
  - net: skbuff: fix missing zerocopy reference in pskb_carve helpers (Minh Nguyen)  [Orabug: 39648952]  {CVE-2026-52943}


author: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> [5.15.0-322.203.3.2.el8uek]
changelog:
  - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Sean Christopherson)  [Orabug: 39673886]  
  - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini)  [Orabug: 39673886]  
  - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Sean Christopherson)  [Orabug: 39673886]  
  - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini)  [Orabug: 39673886]  
  - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Paolo Bonzini)  [Orabug: 39673886]  
  - KVM: x86/mmu: Derive shadow MMU page role from parent (Paolo Bonzini)  [Orabug: 39673886]  
  - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (David Matlack)  [Orabug: 39673886]  
  - KVM: x86/mmu: Use a bool for direct (David Matlack)  [Orabug: 39673886]  
  - net/sched: act_pedit: free pedit keys on bail from offset check (Pedro Tammela)  [Orabug: 39668793]  
  - net/sched: fix pedit partial COW leading to page cache corruption (Rajat Gupta)  [Orabug: 39668793]  {CVE-2026-46331} 
  - net/sched: act_pedit: rate limit datapath messages (Pedro Tammela)  [Orabug: 39668793]  
  - net/sched: act_pedit: check static offsets a priori (Pedro Tammela)  [Orabug: 39668793]


author: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> [5.15.0-322.203.3.2.el8uek]
changelog:
  - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Sean Christopherson)  [Orabug: 39673886]
  - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini)  [Orabug: 39673886]
  - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Sean Christopherson)  [Orabug: 39673886]
  - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini)  [Orabug: 39673886]
  - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Paolo Bonzini)  [Orabug: 39673886]
  - KVM: x86/mmu: Derive shadow MMU page role from parent (Paolo Bonzini)  [Orabug: 39673886]
  - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (David Matlack)  [Orabug: 39673886]
  - KVM: x86/mmu: Use a bool for direct (David Matlack)  [Orabug: 39673886]
  - net/sched: act_pedit: free pedit keys on bail from offset check (Pedro Tammela)  [Orabug: 39668793]
  - net/sched: fix pedit partial COW leading to page cache corruption (Rajat Gupta)  [Orabug: 39668793]  {CVE-2026-46331}
  - net/sched: act_pedit: rate limit datapath messages (Pedro Tammela)  [Orabug: 39668793]
  - net/sched: act_pedit: check static offsets a priori (Pedro Tammela)  [Orabug: 39668793]


author: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> [5.15.0-322.203.3.3.el8uek]
changelog:
  - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Davidlohr Bueso)  [Orabug: 39706512]  
  - rtmutex: Use waiter::task instead of current in remove_waiter() (Keenan Dong)  [Orabug: 39706512]  {CVE-2026-43499}


author: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> [5.15.0-322.203.3.3.el8uek]
changelog:
  - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Davidlohr Bueso)  [Orabug: 39706512]
  - rtmutex: Use waiter::task instead of current in remove_waiter() (Keenan Dong)  [Orabug: 39706512]  {CVE-2026-43499}


author: Sherry Yang <sherry.yang@oracle.com> [5.15.0-322.203.3.4.1.el8uek]
changelog:
  - net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() (Dongli Zhang)  [Orabug: 39558744]


author: Samasth Norway Ananda <samasth.norway.ananda@oracle.com> [5.15.0-322.203.3.4.5.el8uek]
changelog:
  - KVM: x86/mmu: Stop needlessly making MMU pages available for TDP MMU faults (David Matlack)  [Orabug: 39832946]
  - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Sean Christopherson)  [Orabug: 39832946]  {CVE-2026-64561}
  - KVM: x86/mmu: Rename __direct_map() to direct_map() (David Matlack)  [Orabug: 39832946]
  - KVM: x86/mmu: Split out TDP MMU page fault handling (David Matlack)  [Orabug: 39832946]
  - KVM: Rename mmu_notifier_* to mmu_invalidate_* (Chao Peng)  [Orabug: 39832946]
  - KVM: x86/mmu: Document the "rules" for using host_pfn_mapping_level() (Sean Christopherson)  [Orabug: 39832946]
  - KVM: x86/mmu: Rename pte_list_{destroy,remove}() to show they zap SPTEs (Sean Christopherson)  [Orabug: 39832946]
  - KVM: x86/mmu: Directly "destroy" PTE list when recycling rmaps (Sean Christopherson)  [Orabug: 39832946]
  - x86/bugs: Make Safe-RET robust against interrupt injection (Borislav Petkov (AMD))  [Orabug: 39784615]  {CVE-2026-68480}
  - x86/alternatives: Disable interrupts and sync when optimizing NOPs in place (Thomas Gleixner)  [Orabug: 39784615]
  - x86/alternative: Support relocations in alternatives (Peter Zijlstra)  [Orabug: 39784615]
  - x86/alternative: Make debug-alternative selective (Peter Zijlstra)  [Orabug: 39784615]
  - x86/alternatives: Add alt_instr.flags (Borislav Petkov (AMD))  [Orabug: 39784615]
  - x86/asm: Provide ALTERNATIVE_3 (Peter Zijlstra)  [Orabug: 39784615]
  - net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() (Dongli Zhang)  [Orabug: 39819205]
  - net: openvswitch: reject oversized nested action attrs (Asim Viladi Oglu Manizada)  [Orabug: 39819143]  {CVE-2026-64531}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-321.202.5.el8uek]
changelog:
  - Revert "ip6_tunnel: Fix usage of skb_vlan_inet_prepare()" (Harshit Mogalapalli) [Orabug: 39476647]
  - smb: client: reject userspace cifs.spnego descriptions (Asim Viladi Oglu Manizada) [Orabug: 39463672,39476933] {CVE-2026-46243}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-322.202.1.el8uek]
changelog:
  - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (Michael Bommarito) [Orabug: 39446044,39754206] {CVE-2026-63890}
  - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (Michael Bommarito) [Orabug: 39446044,39754203] {CVE-2026-63889}
  - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Michael Bommarito) [Orabug: 39446044,39754199] {CVE-2026-63888}
  - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Michael Bommarito) [Orabug: 39446044,39754193] {CVE-2026-63887}
  - ima: process_measurement() needlessly takes inode_lock() on MAY_READ (Frederick Lawler) [Orabug: 39390378]
  - net: sched: act_api: implement generic walker and search for tc action (Zhengchao Shao) [Orabug: 39342047]
  - btrfs: reserve extra space for the free space tree (Josef Bacik) [Orabug: 39281379]
  - btrfs: include the free space tree in the global rsv minimum calculation (Josef Bacik) [Orabug: 39281379]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-322.203.2.el8uek]
changelog:
  - LTS version: v5.15.203 (Vijayendra Suman)
  - io_uring/poll: correctly handle io_poll_add() return value on update (Jens Axboe)
  - ksmbd: Fix dangling pointer in krb_authenticate (Sean Heelan)
  - ksmbd: Fix refcount leak when invalid session is found on session lookup (Namjae Jeon)
  - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz) [Orabug: 39131105] {CVE-2026-23395}
  - i2c: cp2615: fix serial string NULL-deref at probe (Johan Hovold)
  - i2c: cp2615: replace deprecated strncpy with strscpy (Justin Stitt)
  - ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() (Namjae Jeon)
  - ksmbd: fix potencial OOB in get_file_all_info() for compound requests (Namjae Jeon)
  - tracing: Fix potential deadlock in cpu hotplug with osnoise (Luo Haiyang) [Orabug: 39250863] {CVE-2026-31480}
  - x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling() (Nikunj A Dadhania)
  - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (Tu Jinjiang) [Orabug: 39250813] {CVE-2026-31466}
  - scsi: target: tcm_loop: Drain commands in target_reset handler (Josef Bacik) [Orabug: 39300990] {CVE-2026-43054}
  - net: macb: Move devm_{free,request}_irq() out of spin lock area (Kevin Hao)
  - dmaengine: sh: rz-dmac: Protect the driver specific lists (Claudiu Beznea)
  - dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock (Claudiu Beznea)
  - xfs: save ailp before dropping the AIL lock in push callbacks (Yuto Ohnuki) [Orabug: 39250775] {CVE-2026-31454}
  - ext4: fix use-after-free in update_super_work when racing with umount (Jiayuan Chen) [Orabug: 39250727] {CVE-2026-31446}
  - ext4: fix the might_sleep() warnings in kvfree() (Zqiang)
  - ext4: publish jinode after initialization (Li Chen) [Orabug: 39250749] {CVE-2026-31450}
  - usb: gadget: uvc: fix NULL pointer dereference during unbind race (Jimmy Hu)
  - usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop (Kuen-Han Tsai) [Orabug: 39300667] {CVE-2026-31728}
  - usb: gadget: f_hid: move list and spinlock inits from bind to alloc (Michael Zimmermann) [Orabug: 39300642] {CVE-2026-31721}
  - net: rfkill: prevent unlimited numbers of rfkill events from being created (Greg Kroah-Hartman) [Orabug: 39262425] {CVE-2026-31670}
  - seg6: separate dst_cache for input and output paths in seg6 lwtunnel (Andrea Mayer) [Orabug: 39262417] {CVE-2026-31668}
  - Revert "mptcp: add needs_id for netlink appending addr" (Matthieu Baerts)
  - xen/privcmd: unregister xenstore notifier on module exit (Guohan Zhao)
  - netlink: add nla be16/32 types to minlen array (Florian Westphal) [Orabug: 39654776] {CVE-2024-26849}
  - rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) (David Howells)
  - rxrpc: fix reference count leak in rxrpc_server_keyring() (Luxiao Xu)
  - net: stmmac: fix integer underflow in chain mode (Tyllis Xu) [Orabug: 39262353] {CVE-2026-31649}
  - net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure (Pengpeng Hou)
  - mmc: vub300: fix NULL-deref on disconnect (Johan Hovold) [Orabug: 39262359] {CVE-2026-31651}
  - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (Sebastian Brzezinka) [Orabug: 39262371] {CVE-2026-31656}
  - net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() (David Carlier) [Orabug: 39262378] {CVE-2026-31658}
  - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (M A Ramdhan) [Orabug: 39257891,39543209] {CVE-2026-31533}
  - batman-adv: reject oversized global TT response buffers (Ruide Cao) [Orabug: 39262382] {CVE-2026-31659}
  - nfc: pn533: allocate rx skb before consuming bytes (Pengpeng Hou)
  - arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges (Shawn Guo)
  - arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity (Shawn Guo)
  - wifi: brcmsmac: Fix dma_free_coherent() size (Thomas Fourier) [Orabug: 39262390] {CVE-2026-31661}
  - tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (Oleh Konko) [Orabug: 39262394] {CVE-2026-31662}
  - netfilter: nft_ct: fix use-after-free in timeout object destroy (Tuan Do) [Orabug: 39262407] {CVE-2026-31665}
  - apparmor: fix race between freeing data and fs accessing it (John Johansen)
  - apparmor: fix race on rawdata dereference (John Johansen)
  - apparmor: fix differential encoding verification (John Johansen)
  - apparmor: fix unprivileged local user can do privileged policy management (John Johansen)
  - apparmor: Fix double free of ns_name in aa_replace_profiles() (John Johansen)
  - apparmor: fix missing bounds check on DEFAULT table in verify_dfa() (Massimiliano Pellizzer)
  - apparmor: fix side-effect bug in match_char() macro usage (Massimiliano Pellizzer)
  - apparmor: fix: limit the number of levels of policy namespaces (John Johansen)
  - apparmor: replace recursive profile removal with iterative approach (Massimiliano Pellizzer)
  - apparmor: fix memory leak in verify_header (Massimiliano Pellizzer)
  - apparmor: validate DFA start states are in bounds in unpack_pdb (Massimiliano Pellizzer)
  - iio: adc: ad7923: Fix buffer overflow for tx_buf and ring_xfer (Nuno Sa)
  - gpiolib: cdev: fix uninitialised kfifo (Kent Gibson) [Orabug: 36683267] {CVE-2024-36898}
  - media: uvcvideo: Use heuristic to find stream entity (Ricardo Ribalda)
  - media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Thadeu Lima de Souza Cascardo) [Orabug: 38560508] {CVE-2025-40016}
  - Input: uinput - take event lock when submitting FF request "event" (Dmitry Torokhov)
  - Input: uinput - fix circular locking dependency with ff-core (Mikhail Gavrilov) [Orabug: 39262413] {CVE-2026-31667}
  - mptcp: fix slab-use-after-free in __inet_lookup_established (Jiayuan Chen) [Orabug: 39262422] {CVE-2026-31669}
  - xfrm_user: fix info leak in build_report() (Greg Kroah-Hartman) [Orabug: 39262429] {CVE-2026-31671}
  - wifi: rt2x00usb: fix devres lifetime (Johan Hovold) [Orabug: 39262433] {CVE-2026-31672}
  - lib/crypto: chacha: Zeroize permuted_state before it leaves scope (Eric Biggers) [Orabug: 39343667] {CVE-2026-43336}
  - wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free (Alexander Popov)
  - io_uring/tctx: work around xa_store() allocation error issue (Jens Axboe)
  - usb: gadget: f_uac1_legacy: validate control request size (Taegu Ha)
  - usb: gadget: f_rndis: Protect RNDIS options with mutex (Kuen-Han Tsai)
  - usb: gadget: f_subset: Fix unbalanced refcnt in geth_free (Kuen-Han Tsai) [Orabug: 39343693] {CVE-2026-43343}
  - staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser (Navaneeth K) [Orabug: 38773561] {CVE-2025-68256}
  - smb: client: Fix refcount leak for cifs_sb_tlink (Shuhao Fu)
  - net: mctp: Don't access ifa_index when missing (Matt Johnston)
  - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Quanmin Yan) [Orabug: 38737307] {CVE-2025-40323}
  - can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde) [Orabug: 39654809] {CVE-2026-23155}
  - can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 39654800] {CVE-2026-23082}
  - can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38914786] {CVE-2026-23031}
  - usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer (Sebastian Urban)
  - USB: dummy-hcd: Fix interrupt synchronization error (Alan Stern)
  - USB: dummy-hcd: Fix locking/synchronization error (Alan Stern)
  - thunderbolt: Fix property read in nhi_wake_supported() (Konrad Dybcio)
  - net: ftgmac100: fix ring allocation unwind on open failure (Yufan Chen)
  - vxlan: validate ND option lengths in vxlan_na_create (Ao Zhou) [Orabug: 39300690] {CVE-2026-31738}
  - netfilter: ipset: drop logically empty buckets in mtype_del (Yifan Wu) [Orabug: 39205985] {CVE-2026-31418}
  - comedi: me4000: Fix potential overrun of firmware buffer (Ian Abbott)
  - comedi: me_daq: Fix potential overrun of firmware buffer (Ian Abbott)
  - comedi: ni_atmio16d: Fix invalid clean-up after failed attach (Ian Abbott)
  - comedi: Reinit dev->spinlock between attachments to low-level drivers (Ian Abbott)
  - comedi: dt2815: add hardware detection to prevent crash (Deepanshu Kartikey)
  - cdc-acm: new quirk for EPSON HMD (Oliver Neukum)
  - bridge: br_nd_send: validate ND option lengths (Ao Zhou) [Orabug: 39300724] {CVE-2026-31752}
  - phy: renesas: rcar-gen3-usb2: Assert PLL reset on PHY power off (Claudiu Beznea)
  - phy: renesas: rcar-gen3-usb2: Lock around hardware registers and driver data (Claudiu Beznea)
  - phy: renesas: rcar-gen3-usb2: Move IRQ request in probe (Claudiu Beznea)
  - phy: renesas: rcar-gen3-usb2: Fix role detection on unbind/bind (Claudiu Beznea)
  - usb: cdns3: gadget: fix state inconsistency on gadget init failure (Yongchao Wu)
  - usb: cdns3: gadget: fix NULL pointer dereference in ep_queue (Yongchao Wu)
  - usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() (Juneho Choi) [Orabug: 39300737] {CVE-2026-31756}
  - usb: ehci-brcm: fix sleep during atomic (Justin Chen)
  - usb: usbtmc: Flush anchored URBs in usbtmc_release (Heitor Alves de Siqueira) [Orabug: 39300742] {CVE-2026-31758}
  - usb: ulpi: fix double free in ulpi_register_interface() error path (Guangshuo Li) [Orabug: 39300746] {CVE-2026-31759}
  - usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive (Miao Li)
  - iio: gyro: mpu3050: Fix out-of-sequence free_irq() (Ethan Tidmore)
  - iio: gyro: mpu3050: Move iio_device_register() to correct location (Ethan Tidmore) [Orabug: 39300751] {CVE-2026-31761}
  - iio: gyro: mpu3050: Fix irq resource leak (Ethan Tidmore) [Orabug: 39300756] {CVE-2026-31762}
  - iio: gyro: mpu3050: Fix incorrect free_irq() variable (Ethan Tidmore) [Orabug: 39300761] {CVE-2026-31763}
  - iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only (Francesco Lavra)
  - iio: light: vcnl4035: fix scan buffer on big-endian (David Lechner)
  - iio: dac: ad5770r: fix error return in ad5770r_read_raw() (Antoniu Miclaus)
  - Input: xpad - add support for Razer Wolverine V3 Pro (Zoltan Illes)
  - Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
  - Input: synaptics-rmi4 - fix a locking bug in an error path (Bart Van Assche)
  - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam (Jp Hein)
  - USB: serial: option: add support for Rolling Wireless RW135R-GL (Wanquan Zhong)
  - USB: serial: io_edgeport: add support for Blackbox IC135A (Frej Drejhammar)
  - drm/ast: dp501: Fix initialization of SCU2C (Thomas Zimmermann)
  - hwmon: (occ) Fix division by zero in occ_show_power_1() (Sanman Pradhan)
  - MIPS: Fix the GCC version check for `__multi3' workaround (Maciej W. Rozycki)
  - Bluetooth: SMP: force responder MITM requirements before building the pairing response (Oleh Konko) [Orabug: 39343662] {CVE-2026-43334}
  - Bluetooth: SMP: derive legacy responder STK authentication from MITM state (Oleh Konko) [Orabug: 39300793] {CVE-2026-31773}
  - ALSA: ctxfi: Fix missing SPDIFI1 index handling (Takashi Iwai) [Orabug: 39300800] {CVE-2026-31776}
  - ALSA: caiaq: fix stack out-of-bounds read in init_card (Berk Cem Goksel) [Orabug: 39300808] {CVE-2026-31778}
  - USB: serial: option: add MeiG Smart SRM825WN (Ernestas Kulik)
  - wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation (Yasuaki Torimaru)
  - drm/ioc32: stop speculation on the drm_compat_ioctl path (Greg Kroah-Hartman) [Orabug: 39300820] {CVE-2026-31781}
  - riscv: kgdb: fix several debug register assignment bugs (Paul Walmsley)
  - hwmon: (occ) Fix missing newline in occ_show_extended() (Sanman Pradhan)
  - hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify() (Sanman Pradhan)
  - hwmon: (pxe1610) Check return value of page-select write in probe (Sanman Pradhan)
  - bpf: reject direct access to nullable PTR_TO_BUF pointers (Qi Tang) [Orabug: 39343659] {CVE-2026-43333}
  - ipv6: avoid overflows in ip6_datagram_send_ctl() (Eric Dumazet) [Orabug: 39205971] {CVE-2026-31415}
  - net/sched: cls_flow: fix NULL pointer dereference on shared blocks (Xiang Mei) [Orabug: 39206003] {CVE-2026-31422}
  - net/sched: cls_fw: fix NULL pointer dereference on shared blocks (Xiang Mei) [Orabug: 39205999] {CVE-2026-31421}
  - net/x25: Fix overflow when accumulating packets (Martin Schiller)
  - net/x25: Fix potential double free of skb (Martin Schiller)
  - net/mlx5: Avoid "No data available" when FW version queries fail (Saeed Mahameed)
  - net: macb: properly unregister fixed rate clocks (Fedor Pchelkin) [Orabug: 39300849] {CVE-2026-43014}
  - net: macb: fix clk handling on PCI glue driver removal (Fedor Pchelkin) [Orabug: 39300853] {CVE-2026-43015}
  - Bluetooth: MGMT: validate LTK enc_size on load (Keenan Dong) [Orabug: 39300866] {CVE-2026-43020}
  - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Pablo Neira Ayuso) [Orabug: 39300881] {CVE-2026-43024}
  - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Pablo Neira Ayuso) [Orabug: 39206017] {CVE-2026-31424}
  - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Qi Tang) [Orabug: 39300889] {CVE-2026-43026}
  - netfilter: nf_conntrack_helper: pass helper to expect cleanup (Qi Tang) [Orabug: 39300893] {CVE-2026-43027}
  - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal)
  - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [Orabug: 39300897] {CVE-2026-43028}
  - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [Orabug: 39205976] {CVE-2026-31416}
  - netfilter: flowtable: strictly check for maximum number of actions (Pablo Neira Ayuso) [Orabug: 39343649] {CVE-2026-43329}
  - net: ipv6: flowlabel: defer exclusive option free until RCU teardown (Zhengchuan Liang) [Orabug: 39263384] {CVE-2026-31680}
  - bpf: Fix regsafe() for pointers to packet (Alexei Starovoitov) [Orabug: 39300903] {CVE-2026-43030}
  - net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec (Suraj Gupta)
  - NFC: pn533: bound the UART receive buffer (Pengpeng Hou)
  - net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak (Yochai Eisenrich) [Orabug: 39300917] {CVE-2026-43035}
  - ipv6: prevent possible UaF in addrconf_permanent_addr() (Paolo Abeni) [Orabug: 39343677] {CVE-2026-43339}
  - net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() (Xiang Mei) [Orabug: 39206011] {CVE-2026-31423}
  - bridge: br_nd_send: linearize skb before parsing ND options (Ao Zhou) [Orabug: 39263393] {CVE-2026-31682}
  - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Eric Dumazet) [Orabug: 39300925] {CVE-2026-43037}
  - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Eric Dumazet) [Orabug: 39300929] {CVE-2026-43038}
  - tg3: Fix race for querying speed/duplex (Thomas Bogendoerfer)
  - net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak (Yochai Eisenrich) [Orabug: 39300934] {CVE-2026-43040}
  - net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak (Jiayuan Chen) [Orabug: 39300938] {CVE-2026-43041}
  - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Norbert Szetei) [Orabug: 39300946] {CVE-2026-43043}
  - dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning (Frank Li)
  - btrfs: reject root items with drop_progress and zero drop_level (Zhengyuan Huang) [Orabug: 39300958] {CVE-2026-43046}
  - HID: multitouch: Check to ensure report responses match the request (Lee Jones) [Orabug: 39300962] {CVE-2026-43047}
  - objtool: Fix Clang jump table detection (Josh Poimboeuf)
  - btrfs: don't take device_list_mutex when querying zone info (Johannes Thumshirn)
  - atm: lec: fix use-after-free in sock_def_readable() (Deepanshu Kartikey) [Orabug: 39300974] {CVE-2026-43050}
  - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (Benoît Sevens) [Orabug: 39300978] {CVE-2026-43051}
  - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Davidlohr Bueso) [Orabug: 39262274] {CVE-2026-31555}
  - dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA (Tomi Valkeinen)
  - dmaengine: xilinx_dma: Program interrupt delay timeout (Radhey Shyam Pandey)
  - dmaengine: idxd: Fix freeing the allocated ida too late (Vinicius Costa Gomes)
  - btrfs: fix lost error when running device stats on multiple devices fs (Filipe Manana)
  - btrfs: fix super block offset in error message in btrfs_validate_super() (Mark Harmstone)
  - dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction (Marek Vasut)
  - dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA (Marek Vasut)
  - dmaengine: xilinx: xilinx_dma: Fix dma_device directions (Marek Vasut)
  - phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types() (Felix Gu)
  - ext4: always drain queued discard work in ext4_mb_release() (Theodore Ts'O) [Orabug: 39323071] {CVE-2026-43065}
  - ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (Baokun Li) [Orabug: 39323078] {CVE-2026-43066}
  - ext4: reject mount if bigalloc with s_first_data_block != 0 (Helen Koike) [Orabug: 39250730] {CVE-2026-31447}
  - ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (Ye Bin) [Orabug: 39323091] {CVE-2026-43068}
  - ext4: make recently_deleted() properly work with lazy itable initialization (Jan Kara)
  - ext4: convert inline data to extents when truncate exceeds inline size (Deepanshu Kartikey) [Orabug: 39250762] {CVE-2026-31452}
  - xfs: stop reclaim before pushing AIL during unmount (Yuto Ohnuki) [Orabug: 39250778] {CVE-2026-31455}
  - jbd2: gracefully abort on checkpointing state corruptions (Milos Nikic)
  - scsi: ses: Handle positive SCSI error from ses_recv_diag() (Greg Kroah-Hartman)
  - scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (Tyllis Xu)
  - alarmtimer: Fix argument order in alarm_timer_forward() (Zhan Xusheng)
  - erofs: add GFP_NOIO in the bio completion if needed (Jiucheng Xu)
  - virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (Xietangxin) [Orabug: 39250825] {CVE-2026-31469}
  - media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (Yuchan Nam) [Orabug: 39250837] {CVE-2026-31473}
  - cpufreq: conservative: Reset requested_freq on limits change (Viresh Kumar)
  - can: gw: fix OOB heap access in cgw_csum_crc8_rel() (Ali Norouzi) [Orabug: 39262307] {CVE-2026-31570}
  - s390/barrier: Make array_index_mask_nospec() __always_inline (Vasily Gorbik)
  - s390/syscalls: Add spectre boundary for syscall dispatch table (Greg Kroah-Hartman)
  - spi: spi-fsl-lpspi: fix teardown order issue (UAF) (Marc Kleine-Budde)
  - ASoC: adau1372: Fix clock leak on PLL lock failure (Jihed Chaibi)
  - ASoC: adau1372: Fix unchecked clk_prepare_enable() return value (Jihed Chaibi)
  - sysctl: fix uninitialized variable in proc_do_large_bitmap (Marc Buerg)
  - hwmon: (adm1177) fix sysfs ABI violation and current unit conversion (Sanman Pradhan)
  - ACPI: EC: Fix ECDT probe ordering issues (Hans de Goede)
  - ACPI: EC: Fix EC address space handler unregistration (Hans de Goede)
  - ACPICA: Allow address_space_handler Install and _REG execution as 2 separate steps (Hans de Goede)
  - ACPICA: include/acpi/acpixf.h: Fix indentation (Hans de Goede)
  - ASoC: Intel: catpt: Fix the device initialization (Cezary Rojewski)
  - drm/i915/gmbus: fix spurious timeout on 512-byte burst reads (Samasth Norway Ananda)
  - x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size (Mike Rapoport)
  - scsi: scsi_transport_sas: Fix the maximum channel scanning issue (Yihang Li)
  - RDMA/irdma: Return EINVAL for invalid arp index error (Tatyana Nikolova)
  - RDMA/irdma: Fix deadlock during netdev reset with active connections (Anil Samal) [Orabug: 39262297] {CVE-2026-31565}
  - RDMA/irdma: Remove reset check from irdma_modify_qp_to_err() (Tatyana Nikolova)
  - RDMA/irdma: Clean up unnecessary dereference of event->cm_node (Ivan Barrera)
  - RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce() (Tatyana Nikolova)
  - RDMA/irdma: Update ibqp state to error if QP is already in error state (Tatyana Nikolova)
  - RDMA/rw: Fall back to direct SGE on MR pool exhaustion (Chuck Lever)
  - regmap: Synchronize cache for the page selector (Andy Shevchenko)
  - net: macb: use the current queue number for stats (Paolo Valerio) [Orabug: 39250906] {CVE-2026-31494}
  - netfilter: ctnetlink: use netlink policy range checks (David Carlier) [Orabug: 39250912] {CVE-2026-31495}
  - netlink: allow be16 and be32 types in all uint policy checks (Florian Westphal)
  - netlink: introduce bigendian integer types (Florian Westphal)
  - netfilter: nft_payload: reject out-of-range attributes via policy (Florian Westphal)
  - netlink: introduce NLA_POLICY_MAX_BE (Florian Westphal)
  - netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp (Weiming Shi) [Orabug: 39206030] {CVE-2026-31427}
  - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Ao Zhou) [Orabug: 39263360] {CVE-2026-31674}
  - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Weiming Shi) [Orabug: 39206034] {CVE-2026-31428}
  - Bluetooth: btusb: clamp SCO altsetting table indices (Pengpeng Hou) [Orabug: 39250922] {CVE-2026-31497}
  - Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop (Hyunwoo Kim) [Orabug: 39250926] {CVE-2026-31498}
  - dma-mapping: add missing `inline` for `dma_free_attrs` (Miguel Ojeda)
  - net: enetc: fix the output issue of 'ethtool --show-ring' (Wei Fang)
  - net: fix fanout UAF in packet_release() via NETDEV_UP race (Yochai Eisenrich) [Orabug: 39250952,39543208] {CVE-2026-31504}
  - platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen (Alok Tiwari)
  - rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size (Sabrina Dubroca)
  - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer (Qi Tang)
  - openvswitch: validate MPLS set/set_masked payload length (Ao Zhou) [Orabug: 39263381] {CVE-2026-31679}
  - nfc: nci: fix circular locking dependency in nci_close_device (Jakub Kicinski)
  - ionic: fix persistent MAC address override on PF (Mohammad Heib)
  - pinctrl: mediatek: common: Fix probe failure for devices without EINT (Luca Leonardo Scorcia)
  - Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb (Helen Koike) [Orabug: 39250973] {CVE-2026-31510}
  - Bluetooth: hci_ll: Fix firmware leak on error path (Anas Iqbal) [Orabug: 39323114] {CVE-2026-43069}
  - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (Hyunwoo Kim) [Orabug: 39171454] {CVE-2026-31408}
  - Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() (Hyunwoo Kim) [Orabug: 39250982] {CVE-2026-31512}
  - can: statistics: add missing atomic access in hot path (Oliver Hartkopp)
  - af_key: validate families in pfkey_send_migrate() (Eric Dumazet) [Orabug: 39250997] {CVE-2026-31515}
  - esp: fix skb leak with espintcp and async crypto (Sabrina Dubroca) [Orabug: 39251009] {CVE-2026-31518}
  - xfrm: Fix the usage of skb->sk (Steffen Klassert)
  - xfrm: call xdo_dev_state_delete during state update (Sabrina Dubroca)
  - ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390 (Uzair Mughal)
  - dma-buf: Include ioctl.h in UAPI header (Isaac J. Manjarres)
  - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits() (Mark Brown)
  - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg() (Mark Brown)
  - module: Fix kernel panic when a symbol st_shndx is out of bounds (Ihor Solodrai) [Orabug: 39251026] {CVE-2026-31521}
  - HID: mcp2221: cancel last I2C command on read error (Romain Sioen)
  - net: usb: r8152: add TRENDnet TUC-ET2G (Valentin Spreckels)
  - HID: magicmouse: avoid memory leak in magicmouse_report_fixup() (Günther Noack) [Orabug: 39251033] {CVE-2026-31522}
  - HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2 (Julius Lehmann)
  - nvme-pci: ensure we're polling a polled queue (Keith Busch) [Orabug: 39251039] {CVE-2026-31523}
  - platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10 (Hans de Goede)
  - platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1 (Leif Skunberg)
  - nvme-pci: cap queue creation to used queues (Keith Busch)
  - platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list (Peter Metz)
  - HID: asus: avoid memory leak in asus_report_fixup() (Günther Noack) [Orabug: 39251045] {CVE-2026-31524}
  - bpf: Release module BTF IDR before module unload (Kumar Kartikeya Dwivedi)
  - sh: platform_early: remove pdev->driver_override check (Danilo Krummrich)
  - xen/privcmd: add boot control for restricted usage in domU (Juergen Gross)
  - xen/privcmd: restrict usage in unprivileged domU (Juergen Gross) [Orabug: 39142872] {CVE-2026-31788}
  - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [Orabug: 39130949] {CVE-2026-23351}
  - netfilter: nf_tables: de-constify set commit ops function argument (Florian Westphal)
  - tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure (Josh Law)
  - lib/bootconfig: check xbc_init_node() return in override path (Josh Law)
  - drm/i915/gt: Check set_default_submission() before deferencing (Rahul Bukte) [Orabug: 39262235] {CVE-2026-31540}
  - ksmbd: fix use-after-free of share_conf in compound request (Hyunwoo Kim)
  - mtd: rawnand: brcmnand: skip DMA during panic write (Kamal Dasu)
  - mtd: rawnand: serialize lock/unlock against other NAND operations (Kamal Dasu) [Orabug: 39167446] {CVE-2026-23434}
  - i2c: fsi: Fix a potential leak in fsi_i2c_probe() (Christophe Jaillet)
  - hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit() (Sanman Pradhan)
  - icmp: fix NULL pointer dereference in icmp_tag_validation() (Weiming Shi) [Orabug: 39136287] {CVE-2026-23398}
  - net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths (Anas Iqbal)
  - net: mvpp2: guard flow control update with global_tx_fc in buffer switching (Muhammad Hammad Ijaz) [Orabug: 39167455] {CVE-2026-23438}
  - nfnetlink_osf: validate individual option lengths in fingerprints (Weiming Shi) [Orabug: 39136283] {CVE-2026-23397}
  - net: bonding: fix NULL deref in bond_debug_rlb_hash_show (Xiang Mei) [Orabug: 39262250] {CVE-2026-31546}
  - udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n (Xiang Mei) [Orabug: 39167458] {CVE-2026-23439}
  - net: macb: fix uninitialized rx_fs_lock (Fedor Pchelkin)
  - wifi: mac80211: fix NULL deref in mesh_matches_local() (Xiang Mei) [Orabug: 39136279] {CVE-2026-23396}
  - igc: fix missing update of skb->tail in igc_xmit_frame() (Kohei Enju)
  - net: usb: aqc111: Do not perform PM inside suspend callback (Nikola Z. Ivanov)
  - net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (Jiayuan Chen)
  - net/smc: Fix slab-out-of-bounds issue in fallback (Wen Gu)
  - net/smc: Only save the original clcsock callback functions (Wen Gu)
  - PM: runtime: Fix a race condition related to device removal (Bart Van Assche) [Orabug: 39167501] {CVE-2026-23452}
  - sched: idle: Consolidate the handling of two special cases (Rafael J. Wysocki)
  - net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown (Dipayaan Roy) [Orabug: 39167506] {CVE-2026-23454}
  - net: bcmgenet: increase WoL poll timeout (Justin Chen)
  - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (Jenny Guanni Qu) [Orabug: 39167510] {CVE-2026-23455}
  - netfilter: xt_time: use unsigned int for monthday bit shift (Jenny Guanni Qu)
  - netfilter: xt_CT: drop pending enqueued packets on template removal (Pablo Neira Ayuso) [Orabug: 39131089] {CVE-2026-23391}
  - netfilter: nft_ct: drop pending enqueued packets on removal (Pablo Neira Ayuso) [Orabug: 39322993] {CVE-2026-43060}
  - netfilter: nft_ct: add seqadj extension for natted connections (Andrii Melnychenko) [Orabug: 38773356] {CVE-2025-68206}
  - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Jenny Guanni Qu) [Orabug: 39167514] {CVE-2026-23456}
  - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Lukas Johannes Möller) [Orabug: 39167518] {CVE-2026-23457}
  - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Hyunwoo Kim) [Orabug: 39167522] {CVE-2026-23458}
  - netfilter: ctnetlink: remove refcounting in expectation dumpers (Florian Westphal) [Orabug: 38423446] {CVE-2025-39764}
  - net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect (Jiayuan Chen)
  - Bluetooth: qca: fix ROM version reading on WCN3998 chips (Dmitry Baryshkov)
  - Bluetooth: HIDP: Fix possible UAF (Luiz Augusto von Dentz) [Orabug: 39167534] {CVE-2026-23462}
  - Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy (Christian Eggers)
  - Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU (Christian Eggers)
  - Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU (Christian Eggers)
  - firmware: arm_scpi: Fix device_node reference leak in probe path (Felix Gu)
  - of: Add cleanup.h based auto release via __free(device_node) markings (Jonathan Cameron)
  - wifi: mac80211: Fix static_branch_dec() underflow for aql_disable. (Kuniyuki Iwashima) [Orabug: 39262267] {CVE-2026-31551}
  - soc: fsl: qbman: fix race condition in qman_destroy_fq (Richard Genoud)
  - btrfs: tree-checker: fix misleading root drop_level error message (Zhengyuan Huang)
  - batman-adv: avoid OGM aggregation when skb tailroom is insufficient (Ao Zhou) [Orabug: 39263397] {CVE-2026-31683}
  - pmdomain: bcm: bcm2835-power: Increase ASB control timeout (Maíra Canal) [Orabug: 39262263] {CVE-2026-31550}
  - mptcp: pm: avoid sending RM_ADDR over same subflow (Matthieu Baerts)
  - drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink (Natalie Vock)
  - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (Andrew Lunn) [Orabug: 39131009] {CVE-2026-23368}
  - smb: client: Don't log plaintext credentials in cifs_set_cifscreds (Thorsten Blum)
  - RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() (Jason Gunthorpe) [Orabug: 39130902] {CVE-2026-23335}
  - wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() (Daniil Dulov) [Orabug: 39130905] {CVE-2026-23336}
  - wifi: cfg80211: move scan done work to wiphy work (Johannes Berg)
  - wifi: libertas: fix use-after-free in lbs_free_adapter() (Daniel Hodges) [Orabug: 39130709] {CVE-2026-23281}
  - ext4: always allocate blocks only from groups inode can use (Jan Kara)
  - ksmbd: fix null pointer dereference error in generate_encryptionkey (Namjae Jeon)
  - ext4: fix dirtyclusters double decrement on fs shutdown (Brian Foster) [Orabug: 39451836] {CVE-2026-45920}
  - ext4: drop extent cache when splitting extent fails (Zhang Yi) [Orabug: 39451764] {CVE-2026-45899}
  - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O (Zhang Yi) [Orabug: 39452051] {CVE-2026-45985}
  - ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths (Fedor Pchelkin)
  - drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free (Jeongjun Park)
  - drm/exynos: vidi: fix to avoid directly dereferencing user pointer (Jeongjun Park)
  - drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() (Jeongjun Park) [Orabug: 39451950] {CVE-2026-45956}
  - net: Handle napi_schedule() calls from non-interrupt (Frederic Weisbecker)
  - net: stmmac: dwmac-loongson: Set clk_csr_i to 100-150MHz (Huacai Chen)
  - drm/radeon: apply state adjust rules to some additional HAINAN vairants (Alex Deucher)
  - serial: uartlite: fix PM runtime usage count underflow on probe (Maciej Andrzejewski Iceye)
  - serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY (Ilpo Järvinen)
  - serial: 8250: Fix TX deadlock when using DMA (Raul E Rangel) [Orabug: 39323001] {CVE-2026-43061}
  - serial: 8250_pci: add support for the AX99100 (Martin Roukala)
  - iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry (Guanghui Feng)
  - mtd: Avoid boot crash in RedBoot partition table parser (Finn Thain) [Orabug: 39167571] {CVE-2026-23474}
  - mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init() (Chen Ni)
  - mtd: rawnand: pl353: make sure optimal timings are applied (Olivier Sobrie)
  - mmc: sdhci: fix timing selection for 1-bit bus width (Luke Wang)
  - mmc: sdhci-pci-gli: fix GL9750 DMA write corruption (Matthew Schwartz)
  - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access (Lukas Johannes Möller) [Orabug: 39167591] {CVE-2026-31393}
  - Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() (Lukas Johannes Möller) [Orabug: 39323033] {CVE-2026-43062}
  - net: macb: fix use-after-free access to PTP clock (Fedor Pchelkin) [Orabug: 39167600] {CVE-2026-31396}
  - NFC: nxp-nci: allow GPIOs to sleep (Ian Ray)
  - nvdimm/bus: Fix potential use after free in asynchronous initialization (Ira Weiny) [Orabug: 39167606] {CVE-2026-31399}
  - sunrpc: fix cache_request leak in cache_release (Jeff Layton) [Orabug: 39167610] {CVE-2026-31400}
  - driver: iio: add missing checks on iio_info's callback access (Julien Stephan) [Orabug: 37073038] {CVE-2024-46715}
  - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970182] {CVE-2026-23113}
  - l2tp: do not use sock_hold() in pppol2tp_session_get_sock() (Eric Dumazet)
  - bpf: Forget ranges when refining tnum after JSET (Paul Chaignon) [Orabug: 38423331] {CVE-2025-39748}
  - i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor (Adrian Hunter)
  - i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort (Adrian Hunter)
  - i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors (Adrian Hunter)
  - iio: imu: inv_icm42600: fix odr switch to the same value (Jean-Baptiste Maneyrol)
  - iio: gyro: mpu3050-i2c: fix pm_runtime error handling (Antoniu Miclaus)
  - iio: gyro: mpu3050-core: fix pm_runtime error handling (Antoniu Miclaus) [Orabug: 39343732] {CVE-2026-43357}
  - iio: chemical: bme680: Fix measurement wait duration calculation (Chris Spencer)
  - iio: potentiometer: mcp4131: fix double application of wiper shift (Lukas Schmid)
  - iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas() (Antoniu Miclaus)
  - iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas() (Antoniu Miclaus)
  - iio: dac: ds4424: reject -128 RAW value (Oleksij Rempel)
  - btrfs: abort transaction on failure to update root in the received subvol ioctl (Filipe Manana)
  - lib/bootconfig: check bounds before writing in __xbc_open_brace() (Josh Law)
  - lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after() (Josh Law)
  - x86/apic: Disable x2apic on resume if the kernel expects so (Shashank Balaji) [Orabug: 39343756] {CVE-2026-43363}
  - lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error (Josh Law)
  - xfs: fix undersized l_iclog_roundoff values (Darrick J. Wong) [Orabug: 39343761] {CVE-2026-43365}
  - tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G (Calvin Owens)
  - drm/amdgpu: Fix use-after-free race in VM acquire (Alysa Liu) [Orabug: 39343770] {CVE-2026-43370}
  - net: ethernet: arc: emac: quiesce interrupts before requesting IRQ (Fan Wu)
  - net: ncsi: fix skb leak in error paths (Jian Zhang)
  - parisc: Fix initial page table creation for boot (Helge Deller)
  - hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read (Sanman Pradhan)
  - nouveau/dpcd: return EBUSY for aux xfer if the device is asleep (Dave Airlie) [Orabug: 39343797] {CVE-2026-43381}
  - parisc: Increase initial mapping to 64 MB with KALLSYMS (Helge Deller)
  - batman-adv: Avoid double-rtnl_lock ELP metric worker (Sven Eckelmann) [Orabug: 39343802] {CVE-2026-43382}
  - ice: fix retry for AQ command 0x06EE (Jakub Staniszewski)
  - net: mana: Ring doorbell at 4 CQ wraparounds (Long Li)
  - media: dvb-net: fix OOB access in ULE extension header tables (Ariel Silver) [Orabug: 39171442] {CVE-2026-31405}
  - staging: rtl8723bs: properly validate the data in rtw_get_ie_ex() (Greg Kroah-Hartman) [Orabug: 39343817] {CVE-2026-43387}
  - staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie (Luka Gejak) [Orabug: 39343813] {CVE-2026-43386}
  - irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports (Marc Zyngier)
  - device property: Allow secondary lookup in fwnode_get_next_child_node() (Andy Shevchenko)
  - time/jiffies: Mark jiffies_64_to_clock_t() notrace (Steven Rostedt)
  - time: add kernel-doc in time.c (Randy Dunlap)
  - ceph: fix i_nlink underrun during async unlink (Max Kellermann) [Orabug: 39343884] {CVE-2026-43420}
  - libceph: admit message frames only in CEPH_CON_S_OPEN state (Ilya Dryomov)
  - libceph: Use u32 for non-negative values in ceph_monmap_decode() (Raphael Zimmer) [Orabug: 39343844] {CVE-2026-43405}
  - libceph: prevent potential out-of-bounds reads in process_message_header() (Ilya Dryomov) [Orabug: 39343847] {CVE-2026-43406}
  - libceph: reject preamble if control segment is empty (Ilya Dryomov)
  - libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() (Raphael Zimmer) [Orabug: 39343850] {CVE-2026-43407}
  - tipc: fix divide-by-zero in tipc_sk_filter_connect() (Mehul Rao) [Orabug: 39343861] {CVE-2026-43411}
  - mmc: core: Avoid bitfield RMW for claim/retune flags (Penghe Geng) [Orabug: 39386859] {CVE-2026-43484}
  - mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index() (Felix Gu)
  - mm/tracing: rss_stat: ensure curr is false from kthread context (Kalesh Singh)
  - usb: image: mdc800: kill download URB on timeout (Ziyi Guo) [Orabug: 39343897] {CVE-2026-43425}
  - usb: mdc800: handle signal and read racing (Oliver Neukum)
  - usb: renesas_usbhs: fix use-after-free in ISR during device removal (Fan Wu) [Orabug: 39343902] {CVE-2026-43426}
  - usb: class: cdc-wdm: fix reordering issue in read code path (Oliver Neukum) [Orabug: 39343906] {CVE-2026-43427}
  - USB: core: Limit the length of unkillable synchronous timeouts (Alan Stern) [Orabug: 39343911] {CVE-2026-43428}
  - USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts (Alan Stern) [Orabug: 39343917] {CVE-2026-43429}
  - USB: usbcore: Introduce usb_bulk_msg_killable() (Alan Stern)
  - usb: cdc-acm: Restore CAP_BRK functionnality to CH343 (Marc Zyngier)
  - usb: core: don't power off roothub PHYs if phy_set_mode() fails (Gabor Juhos)
  - usb: misc: uss720: properly clean up reference in uss720_probe() (Greg Kroah-Hartman)
  - usb: yurex: fix race in probe (Oliver Neukum) [Orabug: 39343921] {CVE-2026-43430}
  - usb: xhci: Fix memory leak in xhci_disable_slot() (Zilin Guan) [Orabug: 39343930] {CVE-2026-43432}
  - usb/core/quirks: Add Huawei ME906S-device to wakeup quirk (Christoffer Sandberg)
  - net: usb: lan78xx: skip LTM configuration for LAN7850 (Oleksij Rempel)
  - net: usb: lan78xx: fix silent drop of packets with checksum errors (Oleksij Rempel)
  - cgroup: fix race between task migration and iteration (Qingye Zhao) [Orabug: 39343948] {CVE-2026-43439}
  - octeontx2-af: devlink: fix NIX RAS reporter recovery condition (Alok Tiwari)
  - ASoC: detect empty DMI strings (Casey Connolly)
  - ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition (Chen Ni)
  - ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address() (Ben Dooks)
  - e1000/e1000e: Fix leak in DMA error cleanup (Matt Vollrath) [Orabug: 39343961] {CVE-2026-43445}
  - i40e: fix src IP mask checks and memcpy argument names in cloud filter (Alok Tiwari)
  - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set (Sungwoo Kim) [Orabug: 39343972] {CVE-2026-43449}
  - regulator: pca9450: Correct interrupt type (Peng Fan)
  - regulator: pca9450: Make IRQ optional (Frieder Schrempf)
  - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels (Yuan Tan) [Orabug: 39110656] {CVE-2026-23274}
  - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (Hyunwoo Kim) [Orabug: 39343976] {CVE-2026-43450}
  - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Hyunwoo Kim) [Orabug: 39343980] {CVE-2026-43451}
  - netfilter: x_tables: guard option walkers against 1-byte tail reads (David Dull) [Orabug: 39343984] {CVE-2026-43452}
  - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Jenny Guanni Qu) [Orabug: 39343988] {CVE-2026-43453}
  - can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value (Wenyuan Li)
  - serial: caif: hold tty->link reference in ldisc_open and ser_release (Shuangpeng Bai)
  - ASoC: soc-core: flush delayed work before removing DAIs and widgets (Matteo Cotifava) [Orabug: 39344004] {CVE-2026-43459}
  - ASoC: core: Do not call link_exit() on uninitialized rtd objects (Amadeusz Sławiński)
  - ASoC: core: Exit all links before removing their components (Cezary Rojewski)
  - ASoC: soc-core: accept zero format at snd_soc_runtime_set_dai_fmt() (Kuninori Morimoto)
  - ASoC: soc-core: drop delayed_work_pending() check before flush (Matteo Cotifava)
  - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit (Weiming Shi) [Orabug: 39110666] {CVE-2026-23277}
  - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Gal Pressman) [Orabug: 39344017] {CVE-2026-43466}
  - bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states (Hangbin Liu)
  - xprtrdma: Decrement re_receiving on the early exit paths (Eric Badger) [Orabug: 39344026] {CVE-2026-43469}
  - powerpc: 83xx: km83xx: Fix keymile vendor prefix (Jonathan Neuschäfer)
  - remoteproc: sysmon: Correct subsys_name_len type in QMI request (Bjorn Andersson)
  - powerpc/uaccess: Fix inline assembly for clang build on PPC32 (Christophe Leroy)
  - ALSA: usb-audio: Check max frame size for implicit feedback mode, too (Takashi Iwai)
  - ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0 (Takashi Iwai)
  - scsi: ses: Fix devices attaching to different hosts (Tomas Henzl)
  - ACPI: OSI: Add DMI quirk for Acer Aspire One D255 (Sofia Schneider)
  - unshare: fix unshare_fs() handling (Al Viro) [Orabug: 39344034] {CVE-2026-43472}
  - scsi: mpi3mr: Add NULL checks when resetting request and reply queues (Ranjan Kumar) [Orabug: 39344038] {CVE-2026-43473}
  - ACPI: PM: Save NVS memory on Lenovo G70-35 (Piotr Mazek)
  - scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT (Jan Kiszka) [Orabug: 39344043] {CVE-2026-43475}
  - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (Victor Nogueira) [Orabug: 39103230,39362005] {CVE-2026-23270}
  - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (Jiayuan Chen) [Orabug: 39130790] {CVE-2026-23300}
  - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled (Fernando Fernandez Mancera) [Orabug: 39130767] {CVE-2026-23293}
  - net: stmmac: Fix error handling in VLAN add and delete paths (Ovidiu Panait)
  - nfc: rawsock: cancel tx_work before socket teardown (Jakub Kicinski)
  - nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback (Jakub Kicinski)
  - nfc: nci: free skb on nci_transceive early error paths (Jakub Kicinski)
  - net: nfc: nci: Fix zero-length proprietary notifications (Ian Ray)
  - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (Koichiro Den) [Orabug: 39130923] {CVE-2026-23340}
  - amd-xgbe: fix sleep while atomic on suspend/resume (Raju Rangoju)
  - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() (Jakub Kicinski) [Orabug: 39130807] {CVE-2026-23304}
  - xen/acpi-processor: fix _CST detection using undersized evaluation buffer (David Thomson)
  - indirect_call_wrapper: do not reevaluate function pointer (Eric Dumazet)
  - wifi: wlcore: Fix a locking bug (Bart Van Assche) [Orabug: 39167425] {CVE-2026-23420}
  - can: mcp251x: fix deadlock in error path of mcp251x_open (Alban Bedel) [Orabug: 39130971] {CVE-2026-23357}
  - can: bcm: fix locking for bcm_op runtime updates (Oliver Hartkopp) [Orabug: 39131187] {CVE-2026-23362}
  - atm: lec: fix null-ptr-deref in lec_arp_clear_vccs (Jiayuan Chen) [Orabug: 39130726] {CVE-2026-23286}
  - dpaa2-switch: do not clear any interrupts automatically (Ioana Ciornei)
  - net: dpaa2-switch: serialize changes to priv->mac with a mutex (Vladimir Oltean)
  - net: dpaa2-switch replace direct MAC access with dpaa2_switch_port_has_mac() (Vladimir Oltean)
  - net: dpaa2-switch: assign port_priv->mac after dpaa2_mac_connect() call (Vladimir Oltean)
  - net: dpaa2: replace dpaa2_mac_is_type_fixed() with dpaa2_mac_is_type_phy() (Vladimir Oltean)
  - net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling in ALE table (Chintan Vankar)
  - platform/x86: thinkpad_acpi: Fix errors reading battery thresholds (Jonathan Teh)
  - selftests: mptcp: more stable simult_flows tests (Paolo Abeni)
  - drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() (Lars Ellenberg) [Orabug: 39130965] {CVE-2026-23356}
  - Squashfs: check metadata block offset is within range (Phillip Lougher) [Orabug: 39131079] {CVE-2026-23388}
  - net/sched: ets: fix divide by zero in the offload path (Davide Caratti) [Orabug: 39131049] {CVE-2026-23379}
  - IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq() (Jason Gunthorpe) [Orabug: 39130742] {CVE-2026-23289}
  - wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() (Vahagn Vardanian) [Orabug: 39130701] {CVE-2026-23279}
  - wifi: radiotap: reject radiotap with unknown bits (Johannes Berg) [Orabug: 39131005] {CVE-2026-23367}
  - ALSA: usb-audio: Use correct version for UAC3 header validation (Jun Seo) [Orabug: 39130855] {CVE-2026-23318}
  - platform/x86: dell-wmi: Add audio/mic mute key codes (Kurt Borja)
  - platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data (Thorsten Blum) [Orabug: 39131016] {CVE-2026-23370}
  - x86/efi: defer freeing of boot services memory (Mike Rapoport) [Orabug: 39130953] {CVE-2026-23352}
  - HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them (Greg Kroah-Hartman) [Orabug: 39131061] {CVE-2026-23382}
  - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback (Greg Kroah-Hartman)
  - can: ucan: Fix infinite loop from zero-length messages (Greg Kroah-Hartman)
  - can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message (Greg Kroah-Hartman) [Orabug: 39130816] {CVE-2026-23307}
  - net: usb: pegasus: validate USB endpoints (Greg Kroah-Hartman) [Orabug: 39130750] {CVE-2026-23290}
  - net: usb: kalmia: validate USB endpoints (Greg Kroah-Hartman) [Orabug: 39130997] {CVE-2026-23365}
  - net: usb: kaweth: validate USB endpoints (Greg Kroah-Hartman) [Orabug: 39130832] {CVE-2026-23312}
  - nfc: pn533: properly drop the usb interface reference on disconnect (Greg Kroah-Hartman)
  - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen (Jens Axboe) [Orabug: 39103138] {CVE-2026-23253}
  - eventpoll: Fix integer overflow in ep_loop_check_proc() (Jann Horn)
  - net: arcnet: com20020-pci: fix support for 2.5Mbit cards (Ethan Nelson-Moore)
  - ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314 (Takashi Iwai)
  - fbcon: check return value of con2fb_acquire_newinfo() (Andrey Vatoropin) [Orabug: 39331304] {CVE-2026-43123}
  - fbcon: move more common code into fb_open() (Daniel Vetter)
  - fbcon: Extract fbcon_open/release helpers (Daniel Vetter)
  - fbcon: Use delayed work for cursor (Daniel Vetter)
  - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
  - ALSA: hda/conexant: Add quirk for HP ZBook Studio G4 (Takashi Iwai)
  - usb: cdns3: fix role switching during resume (Thomas Richard)
  - usb: cdns3: call cdns_power_is_lost() only once in cdns_resume() (Théo Lebrun)
  - usb: cdns3: remove redundant if branch (Hongyu Xie)
  - clk: tegra: tegra124-emc: fix device leak on set_rate() (Johan Hovold)
  - mfd: omap-usb-host: Fix OF populate on driver rebind (Johan Hovold)
  - mfd: omap-usb-host: Convert to platform remove callback returning void (Uwe Kleine-König)
  - mfd: qcom-pm8xxx: Fix OF populate on driver rebind (Johan Hovold)
  - mfd: qcom-pm8xxx: Convert to platform remove callback returning void (Uwe Kleine-König)
  - mfd: qcom-pm8xxx: switch away from using chained IRQ handlers (Dmitry Baryshkov)
  - drm/tegra: dsi: fix device leak on probe (Johan Hovold)
  - ata: libata-scsi: refactor ata_scsi_translate() (Damien Le Moal)
  - ata: libata: remove pointless VPRINTK() calls (Hannes Reinecke)
  - ata: libata-scsi: drop DPRINTK calls for cdb translation (Hannes Reinecke)
  - scsi: ata: Call scsi_done() directly (Bart Van Assche)
  - ARM: omap2: Fix reference count leaks in omap_control_init() (Xu Wang)
  - ARM: OMAP2+: add missing of_node_put before break and return (Qing Wang)
  - memory: mtk-smi: fix device leak on larb probe (Johan Hovold)
  - memory: mtk-smi: Convert to platform remove callback returning void (Uwe Kleine-König)
  - bpf: Fix stack-out-of-bounds write in devmap (Kohei Enju) [Orabug: 39130978] {CVE-2026-23359}
  - btrfs: fix incorrect key offset in error message in check_dev_extent_item() (Mark Harmstone)
  - ALSA: usb-audio: Use inclusive terms (Takashi Iwai)
  - ALSA: usb-audio: Cap the packet size pre-calculations (Takashi Iwai)
  - scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume (Peter Wang)
  - scsi: ufs: core: Always initialize the UIC done completion (Bart Van Assche)
  - scsi: lpfc: Properly set WC for DPP mapping (Mathias Krause)
  - ARM: clean up the memset64() C wrapper (Thomas Weißschuh)


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-322.203.3.el8uek]
changelog:
  - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Rutland) [Orabug: 39548689,39674327] {CVE-2025-10263,CVE-2026-53354}
  - arm64: tlb: Add ARM64_WORKAROUND_REPEAT_TLBI_SYNC (Mark Rutland) [Orabug: 39548689] {CVE-2025-10263}
  - ARM: uek: Disable CONFIG_NVIDIA_CARMEL_CNP_ERRATUM (Boris Ostrovsky) [Orabug: 39548689] {CVE-2025-10263}
  - arm64: tlb: allow XZR argument to TLBI ops (Mark Rutland) [Orabug: 39548689] {CVE-2025-10263}
  - arm64: cputype: Add C1-Premium definitions (Mark Rutland) [Orabug: 39548689] {CVE-2025-10263}
  - arm64: cputype: Add C1-Ultra definitions (Mark Rutland) [Orabug: 39548689] {CVE-2025-10263}
  - net/rds: Make "rds_send_xmit" fairer (Gerd Rausch) [Orabug: 39532945]
  - net/rds: Schedule rds_send_worker if there's more work to do (Gerd Rausch) [Orabug: 39532945]
  - Revert "rds: Change return code from rds_send_xmit() when lock is taken" (Gerd Rausch) [Orabug: 39532945]
  - Revert "Reapply "rds: ib: Make sure receives are posted before connection is up"" (Gerd Rausch) [Orabug: 39532945]
  - Revert "rds: ib: Make sure a QP in INIT state is transitioned to ERR" (Gerd Rausch) [Orabug: 39532945]
  - net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null (Cezar Bulinaru) [Orabug: 39526881] {CVE-2022-50073}
  - mmc: dwcmshc_bf3_hw_reset: Log eMMC reset calls (Satyansh Shukla) [Orabug: 39333650]
  - arm64: dts: pensando: drop elba penfw firmware node (Tom Saeger) [Orabug: 39522954]
  - batman-adv: hold claim backbone gateways by reference (Haoze Xie) [Orabug: 39262374,39543197] {CVE-2026-31657}
  - rds: Drop rds conn in connect worker if not in down state. (Rohit Nair) [Orabug: 39179363]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-323.203.1.el8uek]
changelog:
  - net/rds: Wait for rdma_cm_event background work to finish (Gerd Rausch) [Orabug: 38112000]
  - locking/mutex: Make contention tracepoints more consistent wrt adaptive spinning (Peter Zijlstra) [Orabug: 39598217]
  - locking: Apply contention tracepoints in the slow path (Namhyung Kim) [Orabug: 39598217]
  - locking: Add lock contention tracepoints (Namhyung Kim) [Orabug: 39598217]
  - net/mlx5: Fix EQ IRQ affinity notifier debug messages (Praveen Kumar Kannoju) [Orabug: 39594875]
  - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Michal Kosiorek) [Orabug: 39460234] {CVE-2026-46116}
  - Revert "rds: ib: Add cm_id generation scheme in order to detect new ones" (Sharath Srinivasan) [Orabug: 39226005]


author: Samasth Norway Ananda <samasth.norway.ananda@oracle.com> [5.15.0-323.203.2.el8uek]
changelog:
  - net/mlx5: Add vhca_id_type support to IPsec alias creation (Patrisious Haddad) [Orabug: 38732933]
  - net/mlx5: Add vhca_id_type bit to alias context (Patrisious Haddad) [Orabug: 38732933]
  - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Gal Pressman) [Orabug: 38290328]
  - net/mlx5e: Fix race condition during IPSec ESN update (Jianbo Liu) [Orabug: 38290328,39167462] {CVE-2026-23440}
  - net/mlx5e: Prevent concurrent access to IPSec ASO context (Jianbo Liu) [Orabug: 38290328,39167465] {CVE-2026-23441}
  - net/sched: act_pedit: free pedit keys on bail from offset check (Pedro Tammela) [Orabug: 39567286] {CVE-2026-46331}
  - net/sched: fix pedit partial COW leading to page cache corruption (Rajat Gupta) [Orabug: 39567286,39668793] {CVE-2026-46331}
  - net/sched: act_pedit: rate limit datapath messages (Pedro Tammela) [Orabug: 39567286] {CVE-2026-46331}
  - net/sched: act_pedit: check static offsets a priori (Pedro Tammela) [Orabug: 39567286] {CVE-2026-46331}
  - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Sean Christopherson) [Orabug: 39673870,39753976] {CVE-2026-63807}
  - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [Orabug: 39673870,39686460] {CVE-2026-53359}
  - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Sean Christopherson) [Orabug: 39460221,39673870] {CVE-2026-46113}
  - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [Orabug: 39673870]
  - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Paolo Bonzini) [Orabug: 39673870]
  - KVM: x86/mmu: Derive shadow MMU page role from parent (Paolo Bonzini) [Orabug: 39673870]
  - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (David Matlack) [Orabug: 39673870]
  - KVM: x86/mmu: Use a bool for direct (David Matlack) [Orabug: 39673870]
  - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Davidlohr Bueso) [Orabug: 39425999,39751167] {CVE-2026-43499,CVE-2026-53163}
  - rtmutex: Use waiter::task instead of current in remove_waiter() (Keenan Dong) [Orabug: 39425999,39706512] {CVE-2026-43499}
  - Revert "net/rds: poll eq during user-reset" (Praveen Kumar Kannoju) [Orabug: 39659419]
  - net: skbuff: fix missing zerocopy reference in pskb_carve helpers (Minh Nguyen) [Orabug: 39619388,39639981,39648952] {CVE-2026-52943}
  - fs/binfmt_elf: validate reserved VA ELF notes (Jianfeng Wang) [Orabug: 39681043]
  - mm: preserve page-table boundaries for reserved VA mappings (Jianfeng Wang) [Orabug: 39681043]
  - mm: enforce max_map_count for reserved VA mappings (Jianfeng Wang) [Orabug: 39681043]
  - fs/kernfs: raise sb->maxbytes to MAX_LFS_FILESIZE (Jane Chu) [Orabug: 39209740]
  - uek-rpm: cnic: Clean up the elba/SNIC config with make olddefconfig (Dave Kleikamp) [Orabug: 39661609]
  - uek-rpm: cnic: Trim the SNIC config for a faster boot (Dave Kleikamp) [Orabug: 39661609]
  - net/rds: expand kref coverage to rds_notifier->n_conn (Sharath Srinivasan) [Orabug: 38945572]
  - net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn (Sharath Srinivasan) [Orabug: 38945572]
  - tracing/events: Expand global buffer for in-kernel event enables (Manjunath Patil) [Orabug: 39480769]
  - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Hkbinbin) [Orabug: 39452260] {CVE-2026-46043}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-323.211.3.el8uek]
changelog:
  - LTS version: v5.15.211 (Vijayendra Suman)
  - dlm: prevent NPD when writing a positive value to event_done (Thadeu Lima de Souza Cascardo) [Orabug: 37844553] {CVE-2025-23131}
  - crypto: qat - remove unused character device and IOCTLs (Giovanni Cabiddu) [Orabug: 39786549] {CVE-2026-64529}
  - crypto: qat - Return pointer directly in adf_ctl_alloc_resources (Herbert Xu)
  - crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() (Thorsten Blum)
  - Documentation: ioctl-number: Extend "Include File" column width (Bagas Sanjaya)
  - ksmbd: reject non-VALID session in compound request branch (Gil Portnoy)
  - fuse: re-lock request before replacing page cache folio (Joanne Koong) [Orabug: 39753883] {CVE-2026-53388}
  - net: phonet: free phonet_device after RCU grace period (Santosh Kalluri) [Orabug: 39637380] {CVE-2026-53157}
  - phonet: Pass net and ifindex to phonet_address_notify(). (Kuniyuki Iwashima)
  - phonet: Pass ifindex to fill_addr(). (Kuniyuki Iwashima)
  - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs (Dexuan Cui)
  - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback (Mukesh Ojha)
  - misc: fastrpc: Add dma_mask to fastrpc_channel_ctx (Abel Vesa)
  - hv: utils: handle and propagate errors in kvp_register (Thorsten Blum)
  - mptcp: fix missing wakeups in edge scenarios (Paolo Abeni)
  - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (Michael Bommarito) [Orabug: 39753890] {CVE-2026-53391}
  - nfsd: check get_user() return when reading princhashlen (Dominik Woźniak)
  - nfsd: fix posix_acl leak on SETACL decode failure (Jeff Layton) [Orabug: 39753905] {CVE-2026-53397}
  - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Guannan Wang) [Orabug: 39753909] {CVE-2026-53398}
  - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode (Steffen Persvold)
  - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var (Ian Bridges) [Orabug: 39753928] {CVE-2026-53403}
  - power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() (Xu Wang)
  - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (Ashutosh Desai) [Orabug: 39753936] {CVE-2026-63794}
  - ocfs2: reject oversized group bitmap descriptors (Zhang Cen) [Orabug: 39753942] {CVE-2026-63796}
  - fpga: region: fix use-after-free in child_regions_with_firmware() (Xu Wang)
  - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove (Qingshuang Fu)
  - pNFS: Fix use-after-free in pnfs_update_layout() (Xu Wang) [Orabug: 39753953] {CVE-2026-63800}
  - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Doruk Tan Ozturk) [Orabug: 39753957] {CVE-2026-63801}
  - hdlc_ppp: sync per-proto timers before freeing hdlc state (Fan Wu) [Orabug: 39753963] {CVE-2026-63803}
  - exfat: fix potential use-after-free in exfat_find_dir_entry() (Michael Bommarito) [Orabug: 39753979] {CVE-2026-63808}
  - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS (Maciej W. Rozycki)
  - bpf: use kvfree() for replaced sysctl write buffer (Dawei Feng) [Orabug: 39753982] {CVE-2026-63809}
  - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() (Zhang Cen)
  - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor (Bitterblue Smith)
  - wifi: ath11k: fix warning when unbinding (Jose Ignacio Tornos Martinez) [Orabug: 39754021] {CVE-2026-63822}
  - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S (Zenm Chen)
  - keys: Pin request_key_auth payload in instantiate paths (Shaomin Chen) [Orabug: 39754024] {CVE-2026-63823}
  - KEYS: fix overflow in keyctl_pkey_params_get_2() (Jarkko Sakkinen) [Orabug: 39754028] {CVE-2026-63824}
  - mac802154: llsec: add skb_cow_data() before in-place crypto (Doruk Tan Ozturk) [Orabug: 39754053] {CVE-2026-63831}
  - crypto: af_alg - Set merge to zero early in af_alg_sendmsg (Herbert Xu) [Orabug: 38503789] {CVE-2025-39931}
  - ext4: add bounds check for inline data length in ext4_read_inline_page (Yuto Ohnuki)
  - ntfs3: reject direct userspace writes to reserved $LX* xattrs (Konstantin Komarov)
  - ring-buffer: Remove ring_buffer_read_prepare_sync() (Bjoern Doebel)
  - batman-adv: tvlv: avoid race of cifsnotfound handler state (Sven Eckelmann)
  - batman-adv: tvlv: enforce 2-byte alignment (Sven Eckelmann)
  - batman-adv: dat: prevent false sharing between VLANs (Sven Eckelmann)
  - batman-adv: tt: track roam count per VID (Sven Eckelmann)
  - batman-adv: tt: don't merge change entries with different VIDs (Sven Eckelmann)
  - batman-adv: tp_meter: handle overlapping packets (Sven Eckelmann)
  - batman-adv: tp_meter: prevent parallel modifications of last_recv (Sven Eckelmann)
  - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE (Sven Eckelmann)
  - batman-adv: tp_meter: restrict number of unacked list entries (Sven Eckelmann) [Orabug: 39754066] {CVE-2026-63834}
  - batman-adv: v: prevent OGM aggregation on disabled hardif (Sven Eckelmann) [Orabug: 39754070] {CVE-2026-63835}
  - batman-adv: frag: avoid underflow of TTL (Sven Eckelmann)
  - batman-adv: frag: ensure fragment is writable before modifying TTL (Sven Eckelmann)
  - batman-adv: fix (m|b)cast csum after decrementing TTL (Sven Eckelmann)
  - batman-adv: ensure bcast is writable before modifying TTL (Sven Eckelmann)
  - batman-adv: tp_meter: initialize last_recv_time during init (Sven Eckelmann)
  - batman-adv: prevent ELP transmission interval underflow (Sven Eckelmann)
  - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE (Sven Eckelmann)
  - batman-adv: tp_meter: add only finished tp_vars to lists (Sven Eckelmann)
  - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection (Sven Eckelmann)
  - batman-adv: tp_meter: fix fast recovery precondition (Sven Eckelmann)
  - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd (Sven Eckelmann) [Orabug: 39754076] {CVE-2026-63836}
  - batman-adv: tp_meter: avoid window underflow (Sven Eckelmann)
  - batman-adv: tp_meter: initialize dec_cwnd explicitly (Sven Eckelmann)
  - batman-adv: tp_meter: initialize dup_acks explicitly (Sven Eckelmann)
  - batman-adv: tp_meter: keep unacked list in ascending ordered (Sven Eckelmann)
  - kselftest/arm64: signal: Skip SVE signal test if not enough VLs supported (Yijia Wang)
  - Revert "ptp: add testptp mask test" (Petr Machata)
  - Revert "selftest/ptp: update ptp selftest to exercise the gettimex options" (Petr Machata)
  - virtiofs: fix UAF on submount umount (Miklos Szeredi) [Orabug: 39753856] {CVE-2026-53381}
  - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si (Ruslan Valiyev)
  - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write (Yi Yang) [Orabug: 39753871] {CVE-2026-53385}
  - regulator: core: fix locking in regulator_resolve_supply() error path (André Draszik) [Orabug: 39489558] {CVE-2026-46252}
  - af_unix: Reject SIOCATMARK on non-stream sockets (Jiexun Wang) [Orabug: 39619334] {CVE-2026-52928}
  - xhci: fix memory leak regression when freeing xhci vdev devices depth first (Mathias Nyman)
  - agp/amd64: Fix broken error propagation in agp_amd64_probe() (Mingyu Wang) [Orabug: 39662073] {CVE-2026-53325}
  - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() (Weiming Shi)
  - i2c: stub: Reject I2C block transfers with invalid length (Weiming Shi) [Orabug: 39760892] {CVE-2026-64191}
  - RDMA/bnxt_re: zero shared page before exposing to userspace (Lord Ulf Henrik Holmberg)
  - iio: light: bh1780: fix PM runtime leak on error path (Antoniu Miclaus)
  - batman-adv: tt: prevent TVLV entry number overflow (Sven Eckelmann)
  - batman-adv: tt: reject oversized local TVLV buffers (Sven Eckelmann)
  - drm/v3d: Skip CSD when it has zeroed workgroups (Maíra Canal)
  - drm/v3d: Store the active job inside the queue's state (Maíra Canal)
  - ip6_vti: set netns_immutable on the fallback device. (Eric Dumazet) [Orabug: 39589885] {CVE-2026-52909}
  - drm/amd/display: Bound VBIOS record-chain walk loops (Harry Wentland) [Orabug: 39637312] {CVE-2026-53138}
  - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios (Jann Horn) [Orabug: 39637410] {CVE-2026-53167}
  - LTS version: v5.15.210 (Vijayendra Suman)
  - netfilter: require Ethernet MAC header before using eth_hdr() (Zhengchuan Liang) [Orabug: 39637279] {CVE-2026-53131}
  - batman-adv: tp_meter: avoid role confusion in tp_list (Sven Eckelmann)
  - batman-adv: tp_meter: fix race condition in send error reporting (Sven Eckelmann)
  - ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops (Ali Ganiyev)
  - Bluetooth: MGMT: Fix backward compatibility with userspace (Luiz Augusto von Dentz)
  - media: rc: igorplugusb: fix control request setup packet (Henri A) [Orabug: 39785220] {CVE-2026-64240}
  - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown (Sven Eckelmann) [Orabug: 39784982] {CVE-2026-64092}
  - media: rc: ttusbir: fix inverted error logic (Oliver Neukum)
  - apparmor: validate default DFA states are in bounds (Ben Hutchings)
  - fbdev: vt8500lcdfb: Fix dma_free_coherent() cpu_addr parameter (Ben Hutchings)
  - mptcp: close TOCTOU race while computing rcv_wnd (Paolo Abeni) [Orabug: 39754146] {CVE-2026-63867}
  - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Will Deacon)
  - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Shanker Donthineni)
  - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Rutland) [Orabug: 39674327] {CVE-2026-53354}
  - arm64: cputype: Add NVIDIA Olympus definitions (Shanker Donthineni)
  - selinux: enable genfscon labeling for securityfs (Christian Göttsche)
  - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 (Aaron Erhardt)
  - ksmbd: Compare MACs in constant time (Eric Biggers)
  - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Pengpeng Hou) [Orabug: 39343685] {CVE-2026-43341}
  - batman-adv: tp_meter: fix tp_num leak on kmalloc failure (Sven Eckelmann)
  - batman-adv: stop tp_meter sessions during mesh teardown (Jiexun Wang) [Orabug: 39460622] {CVE-2026-46208}
  - blk-cgroup: Fix NULL deref caused by blkg_policy_data being installed before init (Tejun Heo)
  - ipvs: skip ipv6 extension headers for csum checks (Julian Anastasov) [Orabug: 39451541] {CVE-2026-45850}
  - mm/huge_memory: update file PMD counter before folio_put() (Yin Tirui) [Orabug: 39637477] {CVE-2026-53189}
  - RDMA/umem: Fix truncation for block sizes >= 4G (Jason Gunthorpe)
  - RDMA: Move DMA block iterator logic into dedicated files (Leon Romanovsky)
  - RDMA/umem: fix kernel-doc warnings (Randy Dunlap)
  - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf (Anton Leontev) [Orabug: 39637516] {CVE-2026-53199}
  - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Davide Ornaghi) [Orabug: 39637292] {CVE-2026-53134}
  - serial: qcom-geni: fix UART_RX_PAR_EN bit position (Prasanna S)
  - tty: serial: qcom-geni-serial: align #define values (Bartosz Golaszewski)
  - tty: serial: qcom-geni-serial: remove unused symbols (Bartosz Golaszewski)
  - serial: altera_jtaguart: handle uart_add_one_port() failures (Myeonghun Pak)
  - serial: altera_jtaguart: Use platform_get_irq_optional() to get the interrupt (Lad Prabhakar)
  - drm/hyperv: validate resolution_count and fix WIN8 fallback (Berkant Koc) [Orabug: 39786537] {CVE-2026-64524}
  - drm/hyperv: Remove support for Hyper-V 2008 and 2008R2/Win7 (Michael Kelley)
  - usb: typec: ucsi: Check if power role change actually happened before handling (Myrrh Periwinkle)
  - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() (Michael Bommarito) [Orabug: 39754211] {CVE-2026-63891}
  - usb: gadget: f_hid: fix device reference leak in hidg_alloc() (Guangshuo Li)
  - usb: gadget: f_hid: tidy error handling in hidg_alloc (John Keeping)
  - usb: dwc3: xilinx: fix error handling in zynqmp init error paths (Radhey Shyam Pandey)
  - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers (Tudor Ambarus) [Orabug: 39786545] {CVE-2026-64528}
  - tty: serial: samsung: use u32 for register interactions (Tudor Ambarus)
  - serial: samsung_tty: Use port lock wrappers (Thomas Gleixner)
  - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure (Peter Chen)
  - iio: dac: ad5686: fix ref bit initialization for single-channel parts (Rodrigo Alencar)
  - iio: chemical: scd30: fix division by zero in write_raw (Antoniu Miclaus)
  - iio: chemical: scd30: Use guard(mutex) to allow early returns (Jonathan Cameron)
  - iio: gyro: adis16260: fix division by zero in write_raw (Antoniu Miclaus)
  - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (Siwei Zhang) [Orabug: 39681273] {CVE-2026-53358}
  - phy: tegra: xusb: Fix per-pad high-speed termination calibration (Wayne Chang)
  - phy: tegra: xusb: Disable trk clk when not in use (Wayne Chang)
  - arm64: tlb: Flush walk cache when unsharing PMD tables (Zeng Heng) [Orabug: 39755010] {CVE-2026-63875}
  - spi: qup: fix error pointer deref after DMA setup failure (Johan Hovold) [Orabug: 39754942] {CVE-2026-64170}
  - spi: qup: switch to use modern name (Yang Yingliang)
  - octeontx2-pf: avoid double free of pool->stack on AQ init failure (Dawei Feng)
  - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index (Sam Daly)
  - mptcp: do not drop partial packets (Shardul Bankar)
  - selftests: mptcp: drop nanoseconds width specifier (Matthieu Baerts)
  - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient (Li Xiasong)
  - use less confusing names for iov_iter direction initializers (Al Viro)
  - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() (Justin Iurman) [Orabug: 39754825] {CVE-2026-64116}
  - ipv6/addrconf: annotate data-races around devconf fields (II) (Eric Dumazet)
  - ice: fix VF queue configuration with low MTU values (Jose Ignacio Tornos Martinez)
  - net: hsr: defer node table free until after RCU readers (Michael Bommarito) [Orabug: 39754840] {CVE-2026-64123}
  - Bluetooth: serialize accept_q access (Jiexun Wang) [Orabug: 39619283] {CVE-2026-52918}
  - Bluetooth: Init sk_peer_* on bt_sock_alloc (Luiz Augusto von Dentz)
  - Bluetooth: Consolidate code around sk_alloc into a helper function (Luiz Augusto von Dentz)
  - qed: fix double free in qed_cxt_tables_alloc() (Dawei Feng) [Orabug: 39754830] {CVE-2026-64118}
  - Bluetooth: MGMT: validate Add Extended Advertising Data length (Michael Bommarito) [Orabug: 39754849] {CVE-2026-64126}
  - Bluetooth: hci_sync: Make use of hci_cmd_sync_queue set 2 (Luiz Augusto von Dentz)
  - Bluetooth: hci_qca: Convert timeout from jiffies to ms (Shuai Zhang)
  - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (Safa Karakuş) [Orabug: 39681270] {CVE-2026-53357}
  - smb: client: require net admin for CIFS SWN netlink (Michael Bommarito)
  - genetlink: Use internal flags for multicast groups (Ido Schimmel)
  - spi: lantiq-ssc: fix controller deregistration (Johan Hovold)
  - spi: st-ssc4: fix controller deregistration (Johan Hovold)
  - f2fs: fix false alarm of lockdep on cp_global_sem lock (Chao Yu)
  - f2fs: fix incorrect file address mapping when inline inode is unwritten (Yongpeng Yang)
  - mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker (Matthieu Baerts)
  - mptcp: pm: ADD_ADDR rtx: fix potential data-race (Matthieu Baerts) [Orabug: 39460320] {CVE-2026-46137}
  - mptcp: pm: prio: skip closed subflows (Matthieu Baerts)
  - smb: client: Use FullSessionKey for AES-256 encryption key derivation (Piyush Sachdeva)
  - btrfs: fix missing last_unlink_trans update when removing a directory (Filipe Manana) [Orabug: 39460410] {CVE-2026-46160}
  - smb: client: validate dacloffset before building DACL pointers (Michael Bommarito)
  - pmdomain: core: Fix detach procedure for virtual devices in genpd (Ulf Hansson) [Orabug: 39524579] {CVE-2026-46292}
  - tracing/probes: Limit size of event probe to 3K (Steven Rostedt)
  - btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak (Yochai Eisenrich) [Orabug: 39460405] {CVE-2026-46159}
  - spi: topcliff-pch: fix controller deregistration (Johan Hovold)
  - spi: topcliff-pch: Convert to platform remove callback returning void (Uwe Kleine-König)
  - fbcon: Avoid OOB font access if console rotation fails (Thomas Zimmermann) [Orabug: 39460548] {CVE-2026-46191}
  - mm/hugetlb_cma: round up per_node before logging it (Sang-Heon Jeon)
  - spi: uniphier: fix controller deregistration (Johan Hovold)
  - spi: tegra20-sflash: fix controller deregistration (Johan Hovold)
  - spi: tegra114: fix controller deregistration (Johan Hovold)
  - spi: sun6i: fix controller deregistration (Johan Hovold)
  - spi: zynq-qspi: fix controller deregistration (Johan Hovold)
  - spi: ti-qspi: fix controller deregistration (Johan Hovold)
  - spi: spi-ti-qspi: Convert to platform remove callback returning void (Uwe Kleine-König)
  - spi: sun4i: fix controller deregistration (Johan Hovold)
  - spi: syncuacer: fix controller deregistration (Johan Hovold)
  - xfrm: ah: account for ESN high bits in async callbacks (Michael Bommarito) [Orabug: 39460554] {CVE-2026-46193}
  - net: ipv6: stop checking crypto_ahash_alignmask (Eric Biggers)
  - net: ipv4: stop checking crypto_ahash_alignmask (Eric Biggers)
  - usb: dwc3: Move GUID programming after PHY initialization (Selvarasu Ganesan)
  - wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task (Marek Szyprowski) [Orabug: 39460504] {CVE-2026-46180}
  - usb: typec: tcpm: reset internal port states on soft reset AMS (Amit Sunil Dhamne)
  - smb: client: validate the whole DACL before rewriting it in cifsacl (Michael Bommarito)
  - tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (David Carlier) [Orabug: 39460568] {CVE-2026-46196}
  - crypto: caam - guard HMAC key hex dumps in hash_digest_key (Thorsten Blum)
  - printk: add print_hex_dump_devel() (Thorsten Blum)
  - ALSA: aloop: Fix peer runtime UAF during format-change stop (Cássio Gabriel) [Orabug: 39452424] {CVE-2026-46090}
  - ceph: only d_add() negative dentries when they are unhashed (Max Kellermann) [Orabug: 39452292] {CVE-2026-46052}
  - erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() (Junrui Luo)
  - can: ucan: fix devres lifetime (Johan Hovold)
  - can: ucan: fix typos in comments (Julia Lawall)
  - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (Shuvam Pandey) [Orabug: 39452305] {CVE-2026-46056}
  - hfsplus: fix held lock freed on hfsplus_fill_super() (Zilin Guan)
  - hfsplus: fix uninit-value by validating catalog record size (Deepanshu Kartikey)
  - udf: fix partition descriptor append bookkeeping (Seohyeon Maeng) [Orabug: 39452078] {CVE-2026-45991}
  - mtd: spi-nor: sst: Fix write enable before AAI sequence (Sanjaikumar V S)
  - mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration (Shawn Lin)
  - randomize_kstack: Maintain kstack_offset per task (Ryan Roberts)
  - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info (Thomas Zimmermann) [Orabug: 39452332] {CVE-2026-46065}
  - net: bridge: use a stable FDB dst snapshot in RCU readers (Zhengchuan Liang) [Orabug: 39452412] {CVE-2026-46086}
  - net: qrtr: ns: Limit the total number of nodes (Manivannan Sadhasivam) [Orabug: 39452124] {CVE-2026-46003}
  - net: mctp: fix don't require received header reserved bits to be zero (Yuanzhaoming)
  - net: qrtr: ns: Free the node during ctrl_cmd_bye() (Manivannan Sadhasivam) [Orabug: 39452247] {CVE-2026-46038}
  - net: qrtr: ns: Change servers radix tree to xarray (Vignesh Viswanathan)
  - net: qrtr: ns: Limit the maximum number of lookups (Manivannan Sadhasivam) [Orabug: 39452208] {CVE-2026-46026}
  - ALSA: core: Fix potential data race at fasync handling (Takashi Iwai)
  - sched: Use u64 for bandwidth ratio calculations (Joseph Salisbury)
  - media: rc: igorplugusb: heed coherency rules (Oliver Neukum) [Orabug: 39452433] {CVE-2026-46091}
  - erofs: fix the out-of-bounds nameoff handling for trailing dirents (Gao Xiang)
  - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() (Thorsten Blum)
  - media: rc: ttusbir: respect DMA coherency rules (Oliver Neukum)
  - ALSA: aoa: i2sbus: clear stale prepared state (Cássio Gabriel)
  - ALSA: aoa: Use guard() for mutex locks (Takashi Iwai)
  - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() (Daniel Hodges) [Orabug: 39452344] {CVE-2026-46069}
  - thermal: core: Fix thermal zone governor cleanup issues (Rafael J. Wysocki) [Orabug: 39452187] {CVE-2026-46021}
  - wifi: rtw88: check for PCI upstream bridge existence (Fedor Pchelkin) [Orabug: 39452438] {CVE-2026-46092}
  - rtw88: 8821ce: Disable PCIe ASPM L1 for 8821CE using chip ID (Jimmy Hon)
  - arm64/mm: Enable batched TLB flush in unmap_hotplug_range() (Anshuman Khandual)
  - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (Bingquan Chen) [Orabug: 39300581] {CVE-2026-31700}
  - ksmbd: require minimum ACE size in smb_check_perm_dacl() (Michael Bommarito)
  - smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path (Michael Bommarito)
  - smb: client: require a full NFS mode SID before reading mode bits (Michael Bommarito)
  - smb: server: fix max_connections off-by-one in tcp accept path (Daemyung Kang)
  - smb: server: fix active_num_conn leak on transport allocation failure (Michael Bommarito)
  - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() (Yongpeng Yang)
  - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally (Chao Yu)
  - lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() (Lukas Wunner)
  - net/tcp-md5: Fix MAC comparison to be constant-time (Eric Biggers) [Orabug: 39343806] {CVE-2026-43383}
  - io_uring/poll: fix signed comparison in io_poll_get_ownership() (Longxuan Yu) [Orabug: 39619351] {CVE-2026-52933}
  - mm/damon/ops-common: call folio_test_lru() after folio_get() (Seongjae Park)
  - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (Mingyu Wang) [Orabug: 39655978] {CVE-2026-52946}
  - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (Harry Wentland) [Orabug: 39674253] {CVE-2026-53329}
  - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs (Harry Wentland) [Orabug: 39637296] {CVE-2026-53135}
  - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (Harry Wentland) [Orabug: 39637301] {CVE-2026-53136}
  - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size (Harry Wentland)
  - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock (Bjorn Andersson)
  - thunderbolt: Limit XDomain response copy to actual frame size (Michael Bommarito) [Orabug: 39637337] {CVE-2026-53146}
  - thunderbolt: Clamp XDomain response data copy to allocation size (Michael Bommarito) [Orabug: 39637346] {CVE-2026-53148}
  - thunderbolt: Bound root directory content to block size (Michael Bommarito) [Orabug: 39637351] {CVE-2026-53149}
  - thunderbolt: Reject zero-length property entries in validator (Michael Bommarito) [Orabug: 39637356] {CVE-2026-53150}
  - sctp: stream: fully roll back denied add-stream state (Wyatt Feng) [Orabug: 39619338] {CVE-2026-52929}
  - sctp: diag: reject stale associations in dump_one path (Zhao Zhang) [Orabug: 39619278] {CVE-2026-52917}
  - mmc: sdhci: add signal voltage switch in sdhci_resume_host (Jisheng Zhang)
  - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC (Lad Prabhakar)
  - mmc: core: Fix host controller programming for fixed driver type (Kamal Dasu)
  - net: mv643xx: fix OF node refcount (Bartosz Golaszewski)
  - net: bonding: fix NULL pointer dereference in bond_do_ioctl() (Zhaojinming) [Orabug: 39674284] {CVE-2026-53337}
  - misc: fastrpc: fix DMA address corruption due to find_vma misuse (Junrui Luo)
  - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context (Anandu Krishnan E)
  - ipc/shm: serialize orphan cleanup with shm_nattch updates (Yilin Zhu) [Orabug: 39619342] {CVE-2026-52930}
  - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard (Cryolitia Pukngae)
  - Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK) (Zeyu Wang)
  - i2c: tegra: Fix NOIRQ suspend/resume (Akhil R)
  - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter (Guillermo Rodríguez)
  - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() (Vladimir Zapolskiy)
  - fuse: reject fuse_notify() pagecache ops on directories (Jann Horn) [Orabug: 39637414] {CVE-2026-53168}
  - pidfd: refuse access to tasks that have started exiting harder (Christian Brauner)
  - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (Michael Bommarito) [Orabug: 39637428] {CVE-2026-53176}
  - bnxt_en: Fix NULL pointer dereference (Kyle Meyer) [Orabug: 39637432] {CVE-2026-53177}
  - vsock/vmci: fix sk_ack_backlog leak on failed handshake (Raf Dickson) [Orabug: 39637447] {CVE-2026-53181}
  - mptcp: sockopt: check timestamping ret value (Matthieu Baerts)
  - mptcp: fix retransmission loop when csum is enabled (Paolo Abeni)
  - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O (Karl Mehltretter)
  - ARM: socfpga: Fix OF node refcount leak in SMP setup (Yuho Choi)
  - RDMA/srp: bound SRP_RSP sense copy by the received length (Michael Bommarito) [Orabug: 39637467] {CVE-2026-53186}
  - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() (Harry Wentland)
  - ALSA: timer: Fix UAF at snd_timer_user_params() (Takashi Iwai) [Orabug: 39637489] {CVE-2026-53192}
  - USB: serial: kl5kusb105: fix bulk-out buffer overflow (Hyeongjun An) [Orabug: 39637496] {CVE-2026-53194}
  - USB: serial: option: add usb-id for Dell Wireless DW5826e-m (Jack Wu)
  - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Adrian Korwel) [Orabug: 39637502] {CVE-2026-53195}
  - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Adrian Korwel) [Orabug: 39637506] {CVE-2026-53196}
  - xfrm: espintcp: do not reuse an in-progress partial send (Wyatt Feng)
  - drm/i915/gem: Fix phys BO pread/pwrite with offset (Joonas Lahtinen) [Orabug: 39674335] {CVE-2026-53356}
  - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig (Michael Bommarito) [Orabug: 39637545] {CVE-2026-53208}
  - netfilter: nft_tunnel: fix use-after-free on object destroy (Tristan Madani) [Orabug: 39637555] {CVE-2026-53212}
  - drm/vc4: fix krealloc() memory leak (Alexander A. Klimov) [Orabug: 39637561] {CVE-2026-53213}
  - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS (Til Kaiser)
  - net: mvpp2: refill RX buffers before XDP or skb use (Til Kaiser) [Orabug: 39637568] {CVE-2026-53215}
  - net: mvpp2: Add metadata support for xdp mode (Lorenzo Bianconi)
  - net: mvpp2: limit XDP frame size to the RX buffer (Til Kaiser) [Orabug: 39637571] {CVE-2026-53216}
  - net: mvpp2: sync RX data at the hardware packet offset (Til Kaiser) [Orabug: 39637575] {CVE-2026-53217}
  - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [Orabug: 39637578] {CVE-2026-53218}
  - netfilter: nf_log: validate MAC header was set before dumping it (Xiang Mei) [Orabug: 39619384] {CVE-2026-52942}
  - netfilter: x_tables: avoid leaking percpu counter pointers (Kyle Zeng) [Orabug: 39637582] {CVE-2026-53219}
  - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() (Eric Dumazet) [Orabug: 39637592] {CVE-2026-53221}
  - net: guard timestamp cmsgs to real error queue skbs (Kyle Zeng) [Orabug: 39637599] {CVE-2026-53223}
  - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() (Michael Bommarito) [Orabug: 39637609] {CVE-2026-53225}
  - net: openvswitch: fix possible kfree_skb of ERR_PTR (Adrian Moreno) [Orabug: 39637618] {CVE-2026-53227}
  - ipv6: sit: reload inner IPv6 header after GSO offloads (Kyle Zeng) [Orabug: 39637622] {CVE-2026-53228}
  - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Mingyu Wang) [Orabug: 39621562] {CVE-2026-52947}
  - netlabel: validate unlabeled address and mask attribute lengths (Chenguang Zhao) [Orabug: 39637662] {CVE-2026-53238}
  - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sanghyun Park) [Orabug: 39637666] {CVE-2026-53239}
  - arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI (Mark Rutland)
  - KVM: arm64: Remove VPIPT I-cache handling (Marc Zyngier)
  - nfsd: don't ignore the return code of svc_proc_register() (Jeff Layton) [Orabug: 37844165] {CVE-2025-22026}
  - fs/ntfs3: Return error for inconsistent extended attributes (Edward Lo)
  - ext4: validate p_idx bounds in ext4_ext_correct_indexes (Tejas Bharambe) [Orabug: 39250744] {CVE-2026-31449}
  - time: Fix off-by-one in settimeofday() usec validation (Naveen Kumar Chaudhary)
  - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() (Aleksandr Nogikh) [Orabug: 39674319] {CVE-2026-53352}
  - sctp: purge outqueue on stale COOKIE-ECHO handling (Xin Long) [Orabug: 39619311] {CVE-2026-52924}
  - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr (Yizhou Zhao) [Orabug: 39637680] {CVE-2026-53245}
  - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() (Eric Dumazet) [Orabug: 39754155] {CVE-2026-63870}
  - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options (Eric Dumazet) [Orabug: 39637694] {CVE-2026-53249}
  - Bluetooth: fix memory leak in error path of hci_alloc_dev() (Bharath Reddy) [Orabug: 39785002] {CVE-2026-53252}
  - Bluetooth: bnep: reject short frames before parsing (Zhang Cen) [Orabug: 39637706] {CVE-2026-53253}
  - Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling (Dudu Lu)
  - Bluetooth: RFCOMM: validate skb length in MCC handlers (Seungju Cheon) [Orabug: 39637711] {CVE-2026-53254}
  - Bluetooth: MGMT: validate advertising TLV before type checks (Zhang Cen) [Orabug: 39637716] {CVE-2026-53255}
  - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (Zhang Cen) [Orabug: 39637720] {CVE-2026-53256}
  - net: lan743x: permit VLAN-tagged packets up to configured MTU (David Thompson)
  - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr (Yizhou Zhao) [Orabug: 39754149] {CVE-2026-63868}
  - pcnet32: stop holding device spin lock during napi_complete_done (Oscar Maes)
  - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c (Yicong Hui)
  - 6lowpan: fix off-by-one in multicast context address compression (Yizhou Zhao) [Orabug: 39637741] {CVE-2026-53263}
  - net/sched: act_api: use RCU with deferred freeing for action lifecycle (Jamal Hadi Salim) [Orabug: 39637748] {CVE-2026-53264}
  - dm cache policy smq: check allocation under invalidate lock (Guangshuo Li) [Orabug: 39784967] {CVE-2026-53265}
  - netfilter: bridge: make ebt_snat ARP rewrite writable (Yiming Qian) [Orabug: 39637753] {CVE-2026-53266}
  - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [Orabug: 39637763] {CVE-2026-53268}
  - netfilter: synproxy: add mutex to guard hook reference counting (Fernando Fernandez Mancera) [Orabug: 39637768] {CVE-2026-53269}
  - ipvs: clear the svc scheduler ptr early on edit (Julian Anastasov) [Orabug: 39637772] {CVE-2026-53270}
  - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id (Fernando Fernandez Mancera)
  - tee: optee: prevent use-after-free when the client exits before the supplicant (Amirreza Zarrabi) [Orabug: 39637782] {CVE-2026-53273}
  - ipv6: mcast: Fix use-after-free when processing MLD queries (Ido Schimmel) [Orabug: 39637790] {CVE-2026-53275}
  - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl (Mingyu Wang) [Orabug: 39621568] {CVE-2026-52948}
  - Disable -Wattribute-alias for clang-23 and newer (Nathan Chancellor)
  - compiler-clang.h: Add __diag infrastructure for clang (Nathan Chancellor)
  - USB: serial: mct_u232: fix memory corruption with small endpoint (Johan Hovold) [Orabug: 39754236] {CVE-2026-63898}
  - bpf: Free reuseport cBPF prog after RCU grace period. (Kuniyuki Iwashima) [Orabug: 39589889] {CVE-2026-52910}
  - usb: core: Fix SuperSpeed root hub wMaxPacketSize (Michał Pecio)
  - serial: dz: Fix bootconsole handover lockup (Maciej W. Rozycki)
  - xhci: tegra: Fix ghost USB device on dual-role port unplug (Wei-Cheng Chen)
  - USB: serial: digi_acceleport: fix memory corruption with small endpoints (Johan Hovold) [Orabug: 39754248] {CVE-2026-63901}
  - HID: core: Fix size_t specifier in hid_report_raw_event() (Nathan Chancellor)
  - HID: pass the buffer size to hid_report_raw_event (Benjamin Tissoires)
  - HID: core: Add printk_ratelimited variants to hid_warn() etc (Vicki Pfau)
  - USB: serial: cypress_m8: fix memory corruption with small endpoint (Johan Hovold) [Orabug: 39754408] {CVE-2026-63956}
  - serial: zs: Switch to using channel reset (Maciej W. Rozycki)
  - serial: zs: Fix bootconsole handover lockup (Maciej W. Rozycki)
  - serial: dz: Fix bootconsole message clobbering at chip reset (Maciej W. Rozycki)
  - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma (Shitalkumar Gandhi)
  - serial: zs: Fix swapped RI/DSR modem line transition counting (Maciej W. Rozycki)
  - serial: sh-sci: fix memory region release in error path (Hongling Zeng)
  - drm/hyperv: validate VMBus packet size in receive callback (Berkant Koc) [Orabug: 39786542] {CVE-2026-64527}
  - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow (Michael Bommarito) [Orabug: 39754216] {CVE-2026-63892}
  - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() (Michael Bommarito) [Orabug: 39754220] {CVE-2026-63893}
  - usb: gadget: f_fs: copy only received bytes on short ep0 read (Michael Bommarito)
  - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports (Seungjin Bae)
  - usb: gadget: net2280: Fix double free in probe error path (Guangshuo Li)
  - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check (Johan Hovold) [Orabug: 39754232] {CVE-2026-63897}
  - USB: serial: mxuport: fix memory corruption with small endpoint (Johan Hovold) [Orabug: 39754240] {CVE-2026-63899}
  - USB: serial: keyspan: fix missing indat transfer sanity check (Johan Hovold) [Orabug: 39754244] {CVE-2026-63900}
  - USB: serial: cypress_m8: validate interrupt packet headers (Zhang Cen) [Orabug: 39754252] {CVE-2026-63902}
  - USB: serial: belkin_sa: validate interrupt status length (Zhang Cen) [Orabug: 39754256] {CVE-2026-63903}
  - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL (Wanquan Zhong)
  - USB: serial: option: add MeiG SRM813Q (Jan Volckaert)
  - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize (Heitor Alves de Siqueira)
  - usb: usbtmc: check URB actual_length for interrupt-IN notifications (Heitor Alves de Siqueira) [Orabug: 39754260] {CVE-2026-63904}
  - usbip: vudc: Fix use after free bug in vudc_remove due to race condition (Michael Bommarito) [Orabug: 39754264] {CVE-2026-63905}
  - usb: storage: Add quirks for PNY Elite Portable SSD (Sam Burkels)
  - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers (Stephen J. Fuhry)
  - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval (Michał Pecio)
  - usb: chipidea: core: convert ci_role_switch to local variable (Xu Yang)
  - tty: serial: pch_uart: add check for dma_alloc_coherent() (Zhaoyang Yu)
  - comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() (Ian Abbott)
  - comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() (Ian Abbott)
  - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 (Nicolás Bazaes)
  - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem (Dmitry Torokhov) [Orabug: 39754271] {CVE-2026-63908}
  - xfrm: esp: restore combined single-frag length gate (Jingguo Tan) [Orabug: 39754278] {CVE-2026-63912}
  - ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks (Srinivas Kandagatla)
  - ASoC: qcom: q6asm-dai: close stream only when running (Srinivas Kandagatla)
  - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Hamza Mahfooz) [Orabug: 39754282] {CVE-2026-63913}
  - xfrm: ah: use skb_to_full_sk in async output callbacks (Michael Bommarito)
  - xfrm: route MIGRATE notifications to caller's netns (Maoyi Xie) [Orabug: 39754286] {CVE-2026-63914}
  - nfc: hci: fix out-of-bounds read in HCP header parsing (Ashutosh Desai)
  - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings (Arnd Bergmann)
  - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() (Lee Jones) [Orabug: 39754294] {CVE-2026-63916}
  - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Kuniyuki Iwashima) [Orabug: 39754298] {CVE-2026-63917}
  - xfrm: input: hold netns during deferred transport reinjection (Zhengchuan Liang) [Orabug: 39754304] {CVE-2026-63919}
  - ipv6: validate extension header length before copying to cmsg (Qi Tang) [Orabug: 39754307] {CVE-2026-63920}
  - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Maoyi Xie) [Orabug: 39754311] {CVE-2026-63921}
  - ipv6: exthdrs: refresh nh after handling HAO option (Zhengchuan Liang) [Orabug: 39754315] {CVE-2026-63922}
  - ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params (Srinivas Kandagatla)
  - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Justin Iurman) [Orabug: 39754322] {CVE-2026-63924}
  - macsec: fix replay protection at XPN lower-PN wrap (Junrui Luo) [Orabug: 39754326] {CVE-2026-63925}
  - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data (Yuqi Xu) [Orabug: 39754329] {CVE-2026-63926}
  - Input: elan_i2c - validate firmware size before use (Dmitry Torokhov) [Orabug: 39785158] {CVE-2026-64237}
  - usb: dwc2: Fix use after free in debug code (Dan Carpenter) [Orabug: 39754333] {CVE-2026-63927}
  - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles (Peter Chen)
  - usb: cdns3: gadget: fix request skipping after clearing halt (Yongchao Wu)
  - USB: serial: omninet: fix memory corruption with small endpoint (Johan Hovold) [Orabug: 39754337] {CVE-2026-63928}
  - iio: buffer: hw-consumer: fix use-after-free in error path (Felix Gu)
  - iio: light: cm3323: fix reg_conf not being initialized correctly (Aldo Conte)
  - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL (Advait Dhamorikar)
  - iio: temperature: tsys01: fix broken PROM checksum validation (Salah Triki)
  - iio: ssp_sensors: cancel delayed work_refresh on remove (Sanjay Chitroda)
  - iio: gyro: itg3200: fix i2c read into the wrong stack location (David Carlier)
  - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw (Salah Triki)
  - wireguard: send: append trailer after expanding head (Jason A. Donenfeld)
  - iio: dac: ad5686: fix input raw value check (Rodrigo Alencar)
  - iio: dac: max5821: fix return value check in powerdown sync (Salah Triki)
  - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux (Christofer Jonason)
  - parport: Fix race between port and client registration (Ben Hutchings) [Orabug: 39754375] {CVE-2026-63942}
  - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (Muhammad Bilal) [Orabug: 39754387] {CVE-2026-63947}
  - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn (Siwei Zhang) [Orabug: 39754391] {CVE-2026-63948}
  - ipc: limit next_id allocation to the valid ID range (Linpu Yu) [Orabug: 39619307] {CVE-2026-52923}
  - hpfs: fix a crash if hpfs_map_dnode_bitmap fails (Mikulas Patocka)
  - Bluetooth: btusb: Allow firmware re-download when version matches (Shuai Zhang)
  - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() (Thomas Fourier)
  - USB: serial: safe_serial: fix memory corruption with small endpoint (Johan Hovold) [Orabug: 39754412] {CVE-2026-63957}
  - usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() (Greg Kroah-Hartman)
  - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Greg Kroah-Hartman) [Orabug: 39754428] {CVE-2026-63961}
  - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Greg Kroah-Hartman)
  - usb: typec: ucsi: ccg: reject firmware images without a ':' record header (Greg Kroah-Hartman)
  - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer (Greg Kroah-Hartman)
  - smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path (Stefan Metzmacher)
  - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X (Horatiu Vultur)
  - phy: mscc: Use PHY_ID_MATCH_VENDOR to minimize PHY ID table (Harini Katakam)
  - RDMA/rxe: Fix double free in rxe_srq_from_init (Jiasheng Jiang) [Orabug: 39451551] {CVE-2026-45852}
  - Revert "RDMA/rxe: Fix double free in rxe_srq_from_init" (Ben Hutchings)
  - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used (Jouni Högander)
  - drm/dp: Add eDP 1.5 bit definition (Suraj Kandpal)
  - drm/i915/psr: Read Intel DPCD workaround register (Jouni Högander)
  - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register (Jouni Högander)
  - wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work (Duoming Zhou) [Orabug: 38456849] {CVE-2025-39863}
  - batman-adv: bla: avoid double decrement of bla.num_requests (Sven Eckelmann) [Orabug: 39754761] {CVE-2026-64095}
  - batman-adv: tt: avoid empty VLAN responses (Sven Eckelmann) [Orabug: 39754744] {CVE-2026-64090}
  - batman-adv: tt: fix TOCTOU race for reported vlans (Sven Eckelmann) [Orabug: 39754748] {CVE-2026-64091}
  - batman-adv: iv: recover OGM scheduling after forward packet error (Sven Eckelmann)
  - batman-adv: tvlv: reject oversized TVLV packets (Sven Eckelmann) [Orabug: 39619357] {CVE-2026-52934}
  - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface (Sven Eckelmann) [Orabug: 39754757] {CVE-2026-64094}
  - batman-adv: tvlv: abort OGM send on tvlv append failure (Sven Eckelmann)
  - batman-adv: v: stop OGMv2 on disabled interface (Sven Eckelmann)
  - sctp: fix race between sctp_wait_for_connect and peeloff (Zhenghang Xiao) [Orabug: 39754456] {CVE-2026-63971}
  - gpio: rockchip: convert bank->clk to devm_clk_get_enabled() (Marco Scardovi)
  - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (Luiz Augusto von Dentz) [Orabug: 39754468] {CVE-2026-63975}
  - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success (Zhenghang Xiao) [Orabug: 39754471] {CVE-2026-63976}
  - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Rahul Chandelkar) [Orabug: 39754489] {CVE-2026-63984}
  - ethtool: eeprom: add more safeties to EEPROM Netlink fallback (Jakub Kicinski) [Orabug: 39754492] {CVE-2026-63985}
  - bonding: refuse to enslave CAN devices (Oliver Hartkopp) [Orabug: 39754502] {CVE-2026-63990}
  - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() (Zhao Dongdong)
  - ASoC: codecs: simple-mux: Fix enum control bounds check (Cássio Gabriel)
  - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Eric Dumazet) [Orabug: 39754510] {CVE-2026-63992}
  - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Eric Dumazet) [Orabug: 39754513] {CVE-2026-63993}
  - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Eric Dumazet) [Orabug: 39754516] {CVE-2026-63994}
  - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors (Cássio Gabriel)
  - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Eric Dumazet) [Orabug: 39754536] {CVE-2026-64002}
  - net/iucv: fix locking in .getsockopt (Breno Leitao)
  - net/smc: Do not re-initialize smc hashtables (Alexandra Winter)
  - net: netlink: don't set nsid on local notifications (Ilya Maximets)
  - net: netlink: fix sending unassigned nsid after assigned one (Ilya Maximets)
  - netfilter: ebtables: fix OOB read in compat_mtw_from_user (Florian Westphal) [Orabug: 39619329] {CVE-2026-52927}
  - netfilter: xt_cpu: prefer raw_smp_processor_id (Florian Westphal)
  - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Chris Mason) [Orabug: 39754553] {CVE-2026-64007}
  - nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems (Carl Lee)
  - xfrm: Check for underflow in xfrm_state_mtu (David Ahern) [Orabug: 39754558] {CVE-2026-64009}
  - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (Lee Jones)
  - nfc: llcp: Fix use-after-free in llcp_sock_release() (Lee Jones)
  - net: cpsw_new: Fix potential unregister of netdev that has not been registered yet (Kevin Hao)
  - dmaengine: idxd: Fix not releasing workqueue on .release() (Vinicius Costa Gomes) [Orabug: 39323060] {CVE-2026-43064}
  - drm: Remove plane hsub/vsub alignment requirement for core helpers (Carlos Eduardo Gallo Filho)
  - net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked (Victor Nogueira) [Orabug: 39754570] {CVE-2026-64012}
  - net: mctp: ensure our nlmsg responses are initialised (Jeremy Kerr)
  - net/sched: cls_fw: fix NULL dereference of "old" filters before change() (Davide Caratti) [Orabug: 39622011] {CVE-2026-53080}
  - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size (Greg Kroah-Hartman) [Orabug: 39754575] {CVE-2026-64014}
  - LTS version: v5.15.209 (Samasth Norway Ananda)
  - net: mana: validate rx_req_idx to prevent out-of-bounds array access (Aditya Garg) [Orabug: 39754586] {CVE-2026-64018}
  - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed (Bartosz Golaszewski)
  - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) (Andy Shevchenko)
  - string: add mem_is_zero() helper to check if memory area is all zeros (Jani Nikula)
  - net: ag71xx: check error for platform_get_irq (Rosen Penev)
  - tracing: Avoid NULL return from hist_field_name() on truncation (David Carlier) [Orabug: 39784962] {CVE-2026-64028}
  - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Ido Schimmel) [Orabug: 39754613] {CVE-2026-64032}
  - net: bridge: Flush multicast groups when snooping is disabled (Petr Machata)
  - RDMA/rtrs: Fix use-after-free in path file creation cleanup (Guangshuo Li)
  - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL (Rafael J. Wysocki)
  - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL (Rafael J. Wysocki)
  - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL (Rafael J. Wysocki)
  - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL (Rafael J. Wysocki)
  - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Erni Sri Satya Vennela) [Orabug: 39754619] {CVE-2026-64034}
  - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames (Daniel Golle)
  - net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw (Arınç Ünal)
  - net: dsa: mt7530: fix FDB entries not aging out with short timeout (Daniel Golle)
  - net: dsa: mt7530: sync driver-specific behavior of MT7531 variants (Daniel Golle)
  - drm/msm/snapshot: fix dumping of the unaligned regions (Dmitry Baryshkov) [Orabug: 39754629] {CVE-2026-64039}
  - net: tls: prevent chain-after-chain in plain text SG (Jakub Kicinski) [Orabug: 39754638] {CVE-2026-64046}
  - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Jakub Kicinski) [Orabug: 39754642] {CVE-2026-64047}
  - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN (Mikko Perttunen) [Orabug: 39754904] {CVE-2026-64153}
  - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics (Chenguang Zhao)
  - HID: quirks: really enable the intended work around for appledisplay (Lukas Bulwahn)
  - wifi: ath11k: fix error path leaks in some WMI WOW calls (Nicolas Escande) [Orabug: 39754909] {CVE-2026-64155}
  - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference (Ethan Nelson-Moore)
  - net: ethernet: cortina: Carry over frag counter (Linus Walleij)
  - net: ethernet: cortina: Drop half-assembled SKB (Andreas Haarmann-Thiemann)
  - net: ethernet: cortina: Make RX SKB per-port (Linus Walleij)
  - irqchip/ath79-cpu: Remove unused function (Rosen Penev)
  - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access (Gabor Juhos)
  - ice: fix locking in ice_dcb_rebuild() (Bart Van Assche)
  - tcp: Fix imbalanced icsk_accept_queue count. (Kuniyuki Iwashima)
  - netfilter: x_tables: unregister the templates first (Florian Westphal)
  - ARM: integrator: Fix early initialization (Guenter Roeck)
  - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS (David Gow)
  - kunit: config: Enable KUNIT_DEBUGFS by default (David Gow)
  - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure (Sudeep Holla)
  - firmware: arm_ffa: Check for NULL FF-A ID table while driver registration (Sudeep Holla) [Orabug: 39754932] {CVE-2026-64166}
  - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors (Abdurrahman Hussain)
  - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() (Abdurrahman Hussain)
  - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() (Abdurrahman Hussain)
  - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple (Abdurrahman Hussain)
  - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR (Abdurrahman Hussain)
  - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer (Abdurrahman Hussain)
  - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer (Abdurrahman Hussain)
  - hwmon: (pmbus/adm1266) reject implausible blackbox record_count (Abdurrahman Hussain)
  - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock (Abdurrahman Hussain)
  - batman-adv: tt: fix negative tt_buff_len (Sven Eckelmann) [Orabug: 39754734] {CVE-2026-64088}
  - batman-adv: tt: fix negative last_changeset_len (Sven Eckelmann) [Orabug: 39754740] {CVE-2026-64089}
  - batman-adv: tp_meter: avoid use of uninit sender vars (Sven Eckelmann) [Orabug: 39619346] {CVE-2026-52931}
  - batman-adv: bla: fix report_work leak on backbone_gw purge (Sven Eckelmann) [Orabug: 39785109] {CVE-2026-64218}
  - batman-adv: frag: disallow unicast fragment in fragment (Sven Eckelmann) [Orabug: 39619274] {CVE-2026-52916}
  - batman-adv: fix tp_meter counter underflow during shutdown (Luxiao Xu) [Orabug: 39619287] {CVE-2026-52919}
  - batman-adv: fix fragment reassembly length accounting (Ruide Cao) [Orabug: 39619266] {CVE-2026-52914}
  - batman-adv: dat: handle forward allocation error (Sven Eckelmann)
  - batman-adv: clear current gateway during teardown (Ruijie Li) [Orabug: 39619323] {CVE-2026-52926}
  - batman-adv: mcast: fix use-after-free in orig_node RCU release (Sven Eckelmann) [Orabug: 39754765] {CVE-2026-64096}
  - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (Harry Wentland) [Orabug: 39785113] {CVE-2026-64219}
  - drm/amd/display: Fix integer overflow in bios_get_image() (Harry Wentland)
  - drm/bridge: megachips: remove bridge when irq request fails (Osama Abdelkader)
  - drm/bridge: it66121: acquire reset GPIO in probe (Julien Chauveau)
  - device property: set fwnode->secondary to NULL in fwnode_init() (Bartosz Golaszewski) [Orabug: 39785117] {CVE-2026-64220}
  - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (Michael Bommarito)
  - spi: ti-qspi: fix use-after-free after DMA setup failure (Johan Hovold)
  - spi: sprd: fix error pointer deref after DMA setup failure (Johan Hovold)
  - scsi: isci: Fix use-after-free in device removal path (Michael Bommarito) [Orabug: 39754786] {CVE-2026-64103}
  - tracing: Do not call map->ops->elt_free() if elt_alloc() fails (Masami Hiramatsu) [Orabug: 39754948] {CVE-2026-64173}
  - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (John Walker) [Orabug: 39754952] {CVE-2026-64174}
  - ixgbevf: fix use-after-free in VEPA multicast source pruning (Michael Bommarito) [Orabug: 39754812] {CVE-2026-64113}
  - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Michael Bommarito) [Orabug: 39754817] {CVE-2026-64114}
  - wifi: ath11k: clear shared SRNG pointer state on restart (Kyle Farnung)
  - vsock/vmci: fix UAF when peer resets connection during handshake (Minh Nguyen) [Orabug: 39754821] {CVE-2026-64115}
  - ring-buffer: Fix reporting of missed events in iterator (Steven Rostedt)
  - netfilter: ipset: stop hash:* range iteration at end (Nan Li) [Orabug: 39619299] {CVE-2026-52921}
  - netfilter: nf_queue: hold bridge skb->dev while queued (Haoze Xie) [Orabug: 39619255] {CVE-2026-52912}
  - netfilter: ip6t_hbh: reject oversized option lists (Zhengchuan Liang) [Orabug: 39619270] {CVE-2026-52915}
  - net: bcmgenet: keep RBUF EEE/PM disabled (Nicolai Buchwitz) [Orabug: 39754845] {CVE-2026-64125}
  - phonet/pep: disable BH around forwarded sk_receive_skb() (Zijing Yin) [Orabug: 39754963] {CVE-2026-64177}
  - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (Mingyu Wang) [Orabug: 39523054] {CVE-2026-46275}
  - Bluetooth: bnep: Fix UAF read of dev->name (Jann Horn) [Orabug: 39754967] {CVE-2026-64178}
  - net: wwan: iosm: fix potential memory leaks in ipc_imem_init() (Abdun Nihaal)
  - ALSA: asihpi: Fix potential OOB array access at reading cache (Takashi Iwai) [Orabug: 39754862] {CVE-2026-64133}
  - ALSA: ua101: Reject too-short USB descriptors (Cássio Gabriel)
  - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX (Abdurrahman Hussain)
  - sysfs: don't remove existing directory on update failure (Greg Kroah-Hartman) [Orabug: 39754983] {CVE-2026-64185}
  - Revert "s390/cio: Fix device lifecycle handling in css_alloc_subchannel()" (Sasha Levin)
  - KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses (Sean Christopherson) [Orabug: 37901590] {CVE-2025-23141}
  - wifi: mac80211: check tdls flag in ieee80211_tdls_oper (Deepanshu Kartikey) [Orabug: 39300982] {CVE-2026-43052}
  - net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() (Vladimir Oltean)
  - Revert "x86/vdso: Fix output operand size of RDPID" (Sasha Levin)
  - s390/debug: Reject zero-length input before trimming a newline (Pengpeng Hou)
  - io_uring: prevent opcode speculation (Pavel Begunkov) [Orabug: 37702113] {CVE-2025-21863}
  - io-wq: check that the predecessor is hashed in io_wq_remove_pending() (Nicholas Carlini) [Orabug: 39523050] {CVE-2026-46274}
  - drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup (Johan Hovold)
  - drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() (Gyeyoung Baek)
  - drm/i915: skip __i915_request_skip() for already signaled requests (Sebastian Brzezinka)
  - iommu/vt-d: Disable DMAR for Intel Q35 IGFX (Naval Alcalá)
  - libceph: handle rbtree insertion error in decode_choose_args() (Raphael Zimmer) [Orabug: 39621580] {CVE-2026-52954}
  - libceph: Fix potential out-of-bounds access in crush_decode() (Raphael Zimmer) [Orabug: 39621584] {CVE-2026-52955}
  - libceph: Fix potential null-ptr-deref in decode_choose_args() (Raphael Zimmer) [Orabug: 39621592] {CVE-2026-52957}
  - libceph: Fix potential out-of-bounds access in osdmap_decode() (Raphael Zimmer) [Orabug: 39621596] {CVE-2026-52958}
  - powerpc/warp: Fix error handling in pika_dtm_thread (Ma Ke)
  - ceph: fix a buffer leak in __ceph_setxattr() (Viacheslav Dubeyko) [Orabug: 39621609] {CVE-2026-52962}
  - ALSA: usb-audio: Bound MIDI endpoint descriptor scans (Cássio Gabriel) [Orabug: 39621613] {CVE-2026-52963}
  - drm/i915/dp: Fix VSC dynamic range signaling for RGB formats (Chaitanya Kumar Borah)
  - KVM: x86: Fix Xen hypercall tracepoint argument assignment (Maqiang)
  - KVM: Reject wrapped offset in kvm_reset_dirty_gfn() (Aaron Sacks) [Orabug: 39621628] {CVE-2026-52969}
  - audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV (Sergio Correia)
  - net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled (Zoran Ilievski)
  - netfilter: nft_ct: fix missing expect put in obj eval (Li Xiasong) [Orabug: 39621633] {CVE-2026-52970}
  - audit: fix incorrect inheritable capability in CAPSET records (Sergio Correia) [Orabug: 39653209] {CVE-2026-53287}
  - i40e: Cleanup PTP pins on probe failure (Matt Vollrath)
  - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Herbert Xu) [Orabug: 39655982] {CVE-2026-52972}
  - net/sched: sch_pie: annotate more data-races in pie_dump_stats() (Eric Dumazet)
  - flow_dissector: Do not count vlan tags inside tunnel payload (Qingqing Yang)
  - flow_dissector: do not dissect PPPoE PFC frames (Qingfang Deng) [Orabug: 39524619] {CVE-2026-46306}
  - btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() (Filipe Manana) [Orabug: 39784984] {CVE-2026-64164}
  - drm/amd/display: Read EDID from VBIOS embedded panel info (Timur Kristóf)
  - drm/amd/display: Allow DCE link encoder without AUX registers (Timur Kristóf)
  - ALSA: hda/conexant: Fix missing error check for jack detection (Wangdicheng) [Orabug: 39653220] {CVE-2026-53291}
  - ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 (Wangdicheng)
  - ALSA: hda/conexant: fix some typos (Oldherl Oh)
  - ALSA: hda/conexant: add a new hda codec SN6140 (Bo Liu)
  - net/sched: sch_cake: annotate data-races in cake_dump_stats() (V) (Eric Dumazet)
  - bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() (Weiming Shi) [Orabug: 39451517] {CVE-2026-45846}
  - ipv6: rename and move ip6_dst_lookup_tunnel() (Beniamino Galvani)
  - ipv4: add new arguments to udp_tunnel_dst_lookup() (Beniamino Galvani)
  - ipv4: remove "proto" argument from udp_tunnel_dst_lookup() (Beniamino Galvani)
  - ipv4: rename and move ip_route_output_tunnel() (Beniamino Galvani)
  - sctp: discard stale INIT after handshake completion (Xin Long)
  - netfilter: skip recording stale or retransmitted INIT (Xin Long)
  - ASoC: codecs: ab8500: Fix casting of private data (Christian A. Ehrhardt)
  - net: phy: dp83869: fix setting CLK_O_SEL field. (Heiko Schocher)
  - NFC: trf7970a: Ignore antenna noise when checking for RF field (Paul Geurts)
  - net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit (Dandan Zhang)
  - net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() (Jun Zhan) [Orabug: 39621670] {CVE-2026-52982}
  - vrf: Fix a potential NPD when removing a port from a VRF (Ido Schimmel) [Orabug: 39619318] {CVE-2026-52925}
  - net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats() (Eric Dumazet)
  - net/sched: sch_choke: annotate data-races in choke_dump_stats() (Eric Dumazet)
  - net: sched: choke: remove unused variables in struct choke_sched_data (Zhengchao Shao)
  - net/sched: netem: validate slot configuration (Stephen Hemminger)
  - net/sched: netem: fix queue limit check to include reordered packets (Stephen Hemminger) [Orabug: 39621677] {CVE-2026-52984}
  - net/sched: netem: fix probability gaps in 4-state loss model (Stephen Hemminger)
  - net: sched: sch_netem: Refactor code in 4-state loss generator (Harshit Mogalapalli)
  - netdevsim: zero initialize struct iphdr in dummy sk_buff (Nikola Z. Ivanov) [Orabug: 39621681] {CVE-2026-52985}
  - cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro() (Daan De Meyer)
  - scsi: sr: Add memory allocation failure handling for get_capabilities() (Enze Li)
  - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [Orabug: 39621685] {CVE-2026-52986}
  - netfilter: xt_policy: fix strict mode inbound policy matching (Jiexun Wang) [Orabug: 39619293] {CVE-2026-52920}
  - drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) (Timur Kristóf)
  - drm/amdgpu/uvd3.1: Don't validate the firmware when already validated (Timur Kristóf)
  - drm/amdgpu: fix spelling typos (Alexandre Demers)
  - netfilter: arp_tables: fix IEEE1394 ARP payload parsing (Pablo Neira Ayuso) [Orabug: 39451507] {CVE-2026-45844}
  - tracing: branch: Fix inverted check on stat tracer registration (Breno Leitao)
  - btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent() (Mark Harmstone)
  - mailbox: mailbox-test: make data_ready a per-instance variable (Wolfram Sang)
  - mailbox: mailbox-test: initialize struct earlier (Wolfram Sang)
  - mailbox: mailbox-test: don't free the reused channel (Wolfram Sang)
  - mailbox: add sanity check for channel array (Wolfram Sang) [Orabug: 39653234] {CVE-2026-53295}
  - cgroup/rdma: fix integer overflow in rdmacg_try_charge() (Tao Cui)
  - mailbox: mailbox-test: free channels on probe error (Wolfram Sang)
  - fbdev: offb: fix PCI device reference leak on probe failure (Yuho Choi)
  - rtc: abx80x: Disable alarm feature if no interrupt attached (Anthony Pighin)
  - fs/adfs: validate nzones in adfs_validate_bblk() (Bae Yeonju)
  - vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll() (Kohei Enju)
  - tipc: fix double-free in tipc_buf_append() (Lee Jones) [Orabug: 39621708] {CVE-2026-52993}
  - nfp: fix swapped arguments in nfp_encode_basic_qdr() calls (Alexey Kodanev)
  - net/sched: sch_sfb: annotate data-races in sfb_dump_stats() (Eric Dumazet)
  - net/sched: sch_red: annotate data-races in red_dump_stats() (Eric Dumazet)
  - net: sched: gred/red: remove unused variables in struct red_stats (Zhengchao Shao)
  - net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats() (Eric Dumazet)
  - net/sched: sch_pie: annotate data-races in pie_dump_stats() (Eric Dumazet)
  - net_sched: sch_hhf: annotate data-races in hhf_dump_stats() (Eric Dumazet)
  - ksmbd: scope conn->binding slowpath to bound sessions only (Hyunwoo Kim)
  - ksmbd: destroy tree_conn_ida in ksmbd_session_destroy() (Daemyung Kang)
  - arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number (Yan Jun)
  - slip: bound decode() reads against the compressed packet length (Weiming Shi) [Orabug: 39451500] {CVE-2026-45843}
  - slip: reject VJ receive packets on instances with no rstate array (Weiming Shi) [Orabug: 39451493] {CVE-2026-45842}
  - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Fernando Fernandez Mancera) [Orabug: 39621724] {CVE-2026-52998}
  - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Fernando Fernandez Mancera) [Orabug: 39621730] {CVE-2026-52999}
  - ipvs: fix MTU check for GSO packets in tunnel mode (Yingnan Zhang)
  - netfilter: xtables: restrict several matches to inet family (Pablo Neira Ayuso) [Orabug: 39621740] {CVE-2026-53001}
  - netfilter: conntrack: remove sprintf usage (Florian Westphal) [Orabug: 39621746] {CVE-2026-53002}
  - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Xiang Mei) [Orabug: 39451485] {CVE-2026-45841}
  - netfilter: nft_osf: restrict it to ipv4 (Pablo Neira Ayuso)
  - openvswitch: cap upcall PID array size and pre-size vport replies (Weiming Shi) [Orabug: 39451479] {CVE-2026-45840}
  - pppoe: drop PFC frames (Qingfang Deng) [Orabug: 39621751] {CVE-2026-53003}
  - flow_dissector: Add number of vlan tags dissector (Boris Sukholitko)
  - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks (Michael Bommarito) [Orabug: 39621757] {CVE-2026-53004}
  - ipv6: fix possible UAF in icmpv6_rcv() (Eric Dumazet) [Orabug: 39621765] {CVE-2026-53006}
  - e1000e: Unroll PTP in probe error handling (Matt Vollrath)
  - i40e: don't advertise IFF_SUPP_NOFCS (Kohei Enju)
  - tcp: annotate data-races around (tp->write_seq - tp->snd_nxt) (Eric Dumazet)
  - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (Vinicius Costa Gomes) [Orabug: 39621780] {CVE-2026-53011}
  - net/sched: taprio: rename close_time to end_time (Vladimir Oltean)
  - net/sched: taprio: refactor one skb dequeue from TXQ to separate function (Vladimir Oltean)
  - net/sched: taprio: continue with other TXQs if one dequeue() failed (Vladimir Oltean)
  - net/sched: taprio: replace safety precautions with comments (Vladimir Oltean)
  - net/sched: taprio: stop going through private ops for dequeue and peek (Vladimir Oltean)
  - nexthop: fix IPv6 route referencing IPv4 nexthop (Jiayuan Chen) [Orabug: 39621784] {CVE-2026-53012}
  - net/sched: sch_cake: fix NAT destination port not being updated in cake_update_flowkeys (Dudu Lu)
  - PCMCIA: Fix garbled log messages for KERN_CONT (René Rebe)
  - crypto: ccp - copy IV using skcipher ivsize (Paul Moses) [Orabug: 39621796] {CVE-2026-53016}
  - crypto: sa2ul - Fix AEAD fallback algorithm names (T Pratham)
  - lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() (Geert Uytterhoeven)
  - clk: qcom: dispcc-sc7180: Add missing MDSS resets (Konrad Dybcio)
  - dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets (Konrad Dybcio)
  - clk: xgene: Fix mapping leak in xgene_pllclk_init() (Geert Uytterhoeven)
  - clk: qoriq: avoid format string warning (Arnd Bergmann)
  - clk: imx8mq: Correct the CSI PHY sels (Sebastian Krzyszkowiak)
  - clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels() (Felix Gu)
  - clk: imx: imx6q: Fix device node reference leak in pll6_bypassed() (Felix Gu)
  - clk: qcom: dispcc-sm8250: Enable parents for pixel clocks (Val Packett)
  - clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk (Val Packett)
  - clk: qcom: gcc-sc8180x: Use retention for PCIe power domains (Val Packett)
  - clk: qcom: gcc-sc8180x: Use retention for USB power domains (Val Packett)
  - clk: qcom: gcc-sc8180x: Add missing GDSCs (Val Packett)
  - dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs (Val Packett)
  - scsi: target: core: Fix integer overflow in UNMAP bounds check (Junrui Luo) [Orabug: 39621811] {CVE-2026-53021}
  - scsi: sg: Resolve soft lockup issue when opening /dev/sgX (Yangerkun) [Orabug: 39653261] {CVE-2026-53304}
  - RDMA/core: Prefer NLA_NUL_STRING (Florian Westphal) [Orabug: 39754131] {CVE-2026-63860}
  - platform/x86: dell-wmi-sysman: bound enumeration string aggregation (Pengpeng Hou) [Orabug: 39621815] {CVE-2026-53022}
  - platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() (Fedor Pchelkin)
  - fs/ntfs3: terminate the cached volume label after UTF-8 conversion (Pengpeng Hou)
  - nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist() (Andy Shevchenko)
  - mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() (Abdun Nihaal)
  - platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup (Rafael J. Wysocki)
  - tty: hvc_iucv: fix off-by-one in number of supported devices (Randy Dunlap)
  - tty: hvc: remove HVC_IUCV_MAGIC (Ahelenia Ziemiańska)
  - leds: lgm-sso: Remove duplicate assignments for priv->mmap (Chen Ni)
  - platform/surface: surfacepro3_button: Drop wakeup source on remove (Rafael J. Wysocki)
  - backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() (Chen Ni)
  - dev_printk: add new dev_err_probe() helpers (Nuno Sa)
  - driver core: Move dev_err_probe() to where it belogs (Andy Shevchenko)
  - driver core: device.h: remove extern from function prototypes (Greg Kroah-Hartman)
  - i3c: mipi-i3c-hci: fix IBI payload length calculation for final status (Billy Tsai)
  - perf util: Kill die() prototype, dead for a long time (Arnaldo Carvalho de Melo)
  - perf expr: Return -EINVAL for syntax error in expr__find_ids() (Leo Yan)
  - pinctrl: abx500: Fix type of 'argument' variable (Yu-Chun Lin)
  - perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace (Mike Leach)
  - perf branch: Avoid incrementing NULL (Ian Rogers)
  - pinctrl: pinctrl-pic32: Fix resource leak (Ethan Tidmore)
  - HID: usbhid: fix deadlock in hid_post_reset() (Oliver Neukum) [Orabug: 39621857] {CVE-2026-53037}
  - mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob (Richard Genoud)
  - mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions (Cosmin Tanislav)
  - mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path (Cosmin Tanislav)
  - mtd: spi-nor: swp: check SR_TB flag when getting tb_mask (Shiji Yang)
  - mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations (Haibo Chen)
  - mtd: physmap_of_gemini: Fix disabled pinctrl state check (Chen Ni)
  - HID: asus: do not abort probe when not necessary (Denis Benato)
  - HID: asus: make asus_resume adhere to linux kernel coding standards (Denis Benato)
  - ima: check return value of crypto_shash_final() in boot aggregate (Daniel Hodges)
  - tracing: Rebuild full_name on each hist_field_name() call (Pengpeng Hou)
  - dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() (Frank Li)
  - dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function (Khairul Anuar Romli)
  - ocfs2: validate group add input before caching (Zhengyuan Huang) [Orabug: 39621864] {CVE-2026-53039}
  - ocfs2: validate bg_bits during freefrag scan (Zhengyuan Huang) [Orabug: 39621868] {CVE-2026-53040}
  - ocfs2: fix listxattr handling when the buffer is full (Zhengyuan Huang) [Orabug: 39621872] {CVE-2026-53041}
  - soc: qcom: aoss: compare against normalized cooling state (Alok Tiwari)
  - ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison (Junrui Luo) [Orabug: 39653274] {CVE-2026-53309}
  - ocfs2/dlm: validate qr_numregions in dlm_match_regions() (Junrui Luo) [Orabug: 39621878] {CVE-2026-53043}
  - unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure (Michal Grzedzicki)
  - arm64: dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered during boot (David Heidelberger)
  - soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available (Dmitry Baryshkov)
  - soc: qcom: ocmem: register reasons for probe deferrals (Dmitry Baryshkov)
  - soc: qcom: ocmem: use scoped device node handling to simplify error paths (Krzysztof Kozlowski)
  - memory: tegra30-emc: Fix dll_change check (Mikko Perttunen)
  - memory: tegra124-emc: Fix dll_change check (Mikko Perttunen)
  - ARM: dts: mediatek: mt7623: fix efuse fallback compatible (Rafał Miłecki)
  - ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine (Joshua Klinesmith)
  - efi/capsule-loader: fix incorrect sizeof in phys array reallocation (Thomas Huth) [Orabug: 39621893] {CVE-2026-53047}
  - gfs2: prevent NULL pointer dereference during unmount (Andreas Gruenbacher) [Orabug: 39621897] {CVE-2026-53048}
  - gfs2: add some missing log locking (Andreas Gruenbacher) [Orabug: 39621900] {CVE-2026-53049}
  - quota: Fix race of dquot_scan_active() with quota deactivation (Jan Kara) [Orabug: 39621904] {CVE-2026-53050}
  - ktest: Run POST_KTEST hooks on failure and cancellation (Ricardo B. Marlière)
  - ktest: Honor empty per-test option overrides (Ricardo B. Marlière)
  - ktest: Avoid undef warning when WARNINGS_FILE is unset (Ricardo B. Marlière)
  - ALSA: sc6000: Keep the programmed board state in card-private data (Cássio Gabriel)
  - ALSA: sc6000: Use standard print API (Takashi Iwai)
  - PCI: tegra194: Disable direct speed change for Endpoint mode (Vidya Sagar)
  - PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select" (Vidya Sagar)
  - PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down (Manikanta Maddireddy)
  - PCI: tegra194: Increase LTSSM poll time on surprise link down (Manikanta Maddireddy)
  - PCI: tegra194: Fix polling delay for L2 state (Vidya Sagar)
  - PCI: Add PCIE_PME_TO_L2_TIMEOUT_US L2 ready timeout value (Frank Li)
  - selftest: memcg: skip memcg_sock test if address family not supported (Waiman Long)
  - Documentation: fix a hugetlbfs reservation statement (Jane Chu)
  - PCI: Enable AtomicOps only if Root Port supports them (Gerd Bayer)
  - ASoC: fsl_easrc: Change the type for iec958 channel status controls (Shengjiu Wang)
  - ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() (Shengjiu Wang)
  - ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() (Shengjiu Wang)
  - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() (Shengjiu Wang)
  - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() (Shengjiu Wang)
  - pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe() (Felix Gu)
  - pmdomain: ti: omap_prm: Fix a reference leak on device node (Felix Gu)
  - drm/msm/a6xx: Use barriers while updating HFI Q headers (Akhil P Oommen)
  - drm/msm/a6xx: Fix HLSQ register dumping (Rob Clark)
  - ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') (Huanglei)
  - ALSA: hda/realtek: Whitespace fix (Luke D. Jones)
  - drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board (Timur Kristóf)
  - drm/amd/pm/ci: Fill DW8 fields from SMC (Timur Kristóf)
  - drm/amd/pm/ci: Clear EnabledForActivity field for memory levels (Timur Kristóf)
  - drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 (Timur Kristóf)
  - drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock (Timur Kristóf)
  - drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs (Timur Kristóf)
  - drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled (Timur Kristóf)
  - ALSA: core: Validate compress device numbers without dynamic minors (Cássio Gabriel)
  - drm/panel: simple: Correct G190EAN01 prepare timing (Sebastian Reichel)
  - drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 (Alexander Koskovich)
  - spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo (Pei Xiao)
  - fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break (Andy Shevchenko)
  - dm init: ensure device probing has finished in dm-mod.waitfor= (Guillaume Gonnet)
  - drm/sun4i: Fix resource leaks (Ethan Tidmore)
  - spi: fsl-qspi: Use reinit_completion() for repeated operations (Felix Gu)
  - dm log: fix out-of-bounds write due to region_count overflow (Junrui Luo) [Orabug: 39621924] {CVE-2026-53059}
  - dm cache metadata: fix memory leak on metadata abort retry (Ming-Hung Tsai) [Orabug: 39621929] {CVE-2026-53060}
  - dm cache: fix dirty mapping checking in passthrough mode switching (Ming-Hung Tsai) [Orabug: 39621933] {CVE-2026-53061}
  - dm cache: support shrinking the origin device (Ming-Hung Tsai)
  - dm cache: fix concurrent write failure in passthrough mode (Ming-Hung Tsai)
  - dm cache policy smq: fix missing locks in invalidating cache blocks (Ming-Hung Tsai) [Orabug: 39621937] {CVE-2026-53062}
  - dm cache: fix write path cache coherency in passthrough mode (Ming-Hung Tsai)
  - dm cache: fix null-deref with concurrent writes in passthrough mode (Ming-Hung Tsai) [Orabug: 39621946] {CVE-2026-53064}
  - ASoC: sti: use managed regmap_field allocations (Sander Vanheule)
  - ASoC: sti: Return errors from regmap_field_alloc() (Sander Vanheule)
  - drm/komeda: fix integer overflow in AFBC framebuffer size check (Alexander Konyukhov)
  - net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master (Jiayuan Chen) [Orabug: 39621966] {CVE-2026-53069}
  - sctp: fix missing encap_port propagation for GSO fragments (Xin Long)
  - net: phy: qcom: at803x: Use the correct bit to disable extended next page (Maxime Chevallier)
  - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (Dudu Lu) [Orabug: 39621973] {CVE-2026-53071}
  - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (Pauli Virtanen) [Orabug: 39621976] {CVE-2026-53072}
  - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (Jonathan Rissanen) [Orabug: 39621980] {CVE-2026-53073}
  - Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU (Luiz Augusto von Dentz)
  - bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb (Sun Jian) [Orabug: 39621984] {CVE-2026-53074}
  - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Taegu Ha) [Orabug: 39621987] {CVE-2026-53075}
  - net/sched: act_ct: Only release RCU read lock after ct_ft (Jamal Hadi Salim) [Orabug: 39531630] {CVE-2026-46319}
  - net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf (Mashiro Chen)
  - 6pack: propagage new tty types (Jiri Slaby)
  - netfilter: nft_fwd_netdev: check ttl/hl before forwarding (Florian Westphal)
  - netfilter: xt_socket: enable defrag after all other checks (Florian Westphal)
  - net: bcmgenet: fix off-by-one in bcmgenet_put_txcb (Justin Chen) [Orabug: 39622043] {CVE-2026-53088}
  - bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (Weiming Shi)
  - bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks (Jiayuan Chen) [Orabug: 39754142] {CVE-2026-63865}
  - bpf-lsm: Make bpf_lsm_userns_create() sleepable (Frederick Lawler)
  - wifi: brcmfmac: Fix error pointer dereference (Ethan Tidmore) [Orabug: 39622061] {CVE-2026-53093}
  - bpf: fix end-of-list detection in cgroup_storage_get_next_key() (Weiming Shi) [Orabug: 39451462] {CVE-2026-45838}
  - macvlan: annotate data-races around port->bc_queue_len_used (Eric Dumazet)
  - powerpc/crash: fix backup region offset update to elfcorehdr (Sourabh Jain)
  - r8152: fix incorrect register write to USB_UPHY_XTAL (Chih Kai Hsu)
  - bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path (David Carlier) [Orabug: 39622069] {CVE-2026-53096}
  - bpf, devmap: Remove unnecessary if check in for loop (Thorsten Blum)
  - module: Fix freeing of charp module parameters when CONFIG_SYSFS=n (Petr Pavlu)
  - params: Replace __modinit with __init_or_module (Petr Pavlu)
  - kernel: globalize lookup_or_create_module_kobject() (Shyam Saini)
  - kernel: param: rename locate_module_kobject (Shyam Saini)
  - dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n (Cai Xinchen)
  - dpaa2: add independent dependencies for FSL_DPAA2_SWITCH (Cai Xinchen)
  - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet (Duoming Zhou) [Orabug: 39622109] {CVE-2026-53112}
  - wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() (Zilin Guan)
  - firmware: dmi: Correct an indexing error in dmi.h (Mario Limonciello)
  - locking: Fix rwlock support in <linux/spinlock_up.h> (Bart Van Assche)
  - irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter (Brian Masney)
  - debugfs: check for NULL pointer in debugfs_create_str() (Gui-Dong Han)
  - thermal/drivers/spear: Fix error condition for reading st,thermal-flags (Gopi Krishna Menon)
  - devres: fix missing node debug info in devm_krealloc() (Danilo Krummrich)
  - pstore/ram: fix resource leak when ioremap() fails (Cole Leavitt)
  - nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty() (Deepanshu Kartikey)
  - drbd: Balance RCU calls in drbd_adm_dump_devices() (Bart Van Assche) [Orabug: 39622158] {CVE-2026-53128}
  - fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START (Hyungjung Joo)
  - bcache: fix uninitialized closure object (Mingzhe Zou)
  - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Benjamin Cheng)
  - vsock/virtio: fix accept queue count leak on transport mismatch (Dudu Lu) [Orabug: 39460646] {CVE-2026-46214}
  - vsock: fix buffer size clamping order (Norbert Szetei) [Orabug: 39460717] {CVE-2026-46234}
  - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (Siwei Zhang) [Orabug: 39445785] {CVE-2026-45836}
  - batman-adv: bla: put backbone reference on failed claim hash insert (Sven Eckelmann) [Orabug: 39460707] {CVE-2026-46231}
  - batman-adv: bla: only purge non-released claims (Sven Eckelmann) [Orabug: 39460713] {CVE-2026-46233}
  - batman-adv: bla: prevent use-after-free when deleting claims (Sven Eckelmann) [Orabug: 39460640] {CVE-2026-46212}
  - batman-adv: stop caching unowned originator pointers in BAT IV (Jiexun Wang) [Orabug: 39460733] {CVE-2026-46238}
  - batman-adv: reject new tp_meter sessions during teardown (Jiexun Wang) [Orabug: 39460614] {CVE-2026-46206}
  - batman-adv: fix integer overflow on buff_pos (Lyes Bourennani) [Orabug: 39460580] {CVE-2026-46198}
  - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (Ben Morris) [Orabug: 39460689] {CVE-2026-46227}
  - drm/amdgpu/pm: align Hawaii mclk workaround with radeon (Alex Deucher)
  - drm/amdgpu/pm: add missing revision check for CI (Alex Deucher)
  - drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission (John B. Moore) [Orabug: 39460668] {CVE-2026-46220}
  - drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ (John B. Moore)
  - drm/radeon: add missing revision check for CI (Alex Deucher)
  - drm/amdkfd: validate SVM ioctl nattr against buffer size (Alysa Liu) [Orabug: 39460573] {CVE-2026-46197}
  - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (Ashutosh Desai) [Orabug: 39460627] {CVE-2026-46209}
  - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Benjamin Cheng) [Orabug: 39460702] {CVE-2026-46230}
  - spi: mpc52xx: fix use-after-free on unbind (Johan Hovold)
  - spi: orion: fix clock imbalance on registration failure (Johan Hovold)
  - spi: imx: fix runtime pm leak on probe deferral (Johan Hovold)
  - spi: mtk-nor: fix controller deregistration (Johan Hovold)
  - media: i2c: imx412: Assert reset GPIO during probe (Wenmeng Liu)
  - media: dib8000: avoid division by 0 in dib8000_set_dds() (Sergey Shtylyov)
  - regulator: bd9571mwv: fix OF node reference imbalance (Johan Hovold)
  - regulator: act8945a: fix OF node reference imbalance (Johan Hovold)
  - media: rc: streamzap: Error handling in probe (Oliver Neukum)
  - media: rc: xbox_remote: heed DMA restrictions (Oliver Neukum)
  - regulator: max77650: fix OF node reference imbalance (Johan Hovold)
  - staging: media: atomisp: Disallow all private IOCTLs (Sakari Ailus)
  - media: i2c: ov8856: free control handler on error in ov8856_init_controls() (Alexander Koskovich)
  - media: uvcvideo: Enable VB2_DMABUF for metadata stream (Ricardo Ribalda)
  - platform/x86: hp-wmi: Ignore backlight and FnLock events (Krishna Chomal)
  - mptcp: fix scheduling with atomic in timestamp sockopt (Gang Yan) [Orabug: 39460450] {CVE-2026-46168}
  - mptcp: sockopt: set timestamp flags on subflow socket, not msk (Gang Yan)
  - mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure (Shardul Bankar)
  - mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure (Shardul Bankar)
  - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (Jason Gunthorpe) [Orabug: 39460540] {CVE-2026-46189}
  - RDMA/rxe: Reject unknown opcodes before ICRC processing (Michael Bommarito) [Orabug: 39460303] {CVE-2026-46133}
  - RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() (Jason Gunthorpe) [Orabug: 39460277] {CVE-2026-46127}
  - RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() (Jason Gunthorpe) [Orabug: 39460496] {CVE-2026-46178}
  - power: supply: max17042: avoid overflow when determining health (André Draszik)
  - PCI/AER: Stop ruling out unbound devices as error source (Lukas Wunner)
  - PCI/AER: Clear only error bits in PCIe Device Status (Shuai Xue)
  - s390/debug: Reject zero-length input in debug_input_flush_fn() (Vasily Gorbik)
  - RDMA/hns: Fix unlocked call to hns_roce_qp_remove() (Jason Gunthorpe)
  - nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (Chaitanya Kulkarni) [Orabug: 39524613] {CVE-2026-46304}
  - md/raid10: fix divide-by-zero in setup_geo() with zero far_copies (Junrui Luo) [Orabug: 39460415] {CVE-2026-46161}
  - libceph: Fix slab-out-of-bounds access in auth message processing (Raphael Zimmer) [Orabug: 39460244] {CVE-2026-46119}
  - isofs: validate block number from NFS file handle in isofs_export_iget (Michael Bommarito) [Orabug: 39460265] {CVE-2026-46124}
  - isofs: validate Rock Ridge CE continuation extent against volume size (Michael Bommarito) [Orabug: 39524609] {CVE-2026-46303}
  - dm-verity-fec: correctly reject too-small hash devices (Eric Biggers)
  - dm-verity-fec: correctly reject too-small FEC devices (Eric Biggers)
  - dm: fix a buffer overflow in ioctl processing (Mikulas Patocka) [Orabug: 39524585] {CVE-2026-46294}
  - dm: don't report warning when doing deferred remove (Mikulas Patocka)
  - dm-thin: fix metadata refcount underflow (Mikulas Patocka) [Orabug: 39460195] {CVE-2026-46107}
  - ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error (Cássio Gabriel)
  - ASoC: fsl_easrc: fix comment typo (Joseph Salisbury)
  - cpuidle: powerpc: avoid double clear when breaking snooze (Shrikanth Hegde)
  - spi: topcliff-pch: fix use-after-free on unbind (Johan Hovold)
  - thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp (Thorsten Blum)
  - thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata (Thorsten Blum)
  - udf: reject descriptors with oversized CRC length (Michael Bommarito) [Orabug: 39753576] {CVE-2026-53369}
  - ibmveth: Disable GSO for packets with small MSS (Mingming Cao)
  - hv_sock: fix ARM64 support (Hamza Mahfooz)
  - extcon: ptn5150: handle pending IRQ events during system resume (Xu Yang)
  - hwmon: (corsair-psu) Close HID device on probe errors (Myeonghun Pak)
  - hwmon: (ltc2992) Fix u32 overflow in power read path (Sanman Pradhan)
  - hwmon: (ltc2992) Clamp threshold writes to hardware range (Sanman Pradhan)
  - parisc: Fix IRQ leak in LASI driver (Hongling Zeng)
  - ip6_gre: Use cached t->net in ip6erspan_changelink(). (Maoyi Xie) [Orabug: 39460248] {CVE-2026-46120}
  - sound: ua101: fix division by zero at probe (Seungju Cheon) [Orabug: 39460519] {CVE-2026-46184}
  - net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo (Kai Aizen) [Orabug: 39460297] {CVE-2026-46132}
  - fanotify: fix false positive on permission events (Miklos Szeredi) [Orabug: 39460374] {CVE-2026-46150}
  - spi: zynqmp-gqspi: fix controller deregistration (Johan Hovold)
  - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() (Siwei Zhang) [Orabug: 39445772] {CVE-2026-45834}
  - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (Siwei Zhang) [Orabug: 39445781] {CVE-2026-45835}
  - Bluetooth: virtio_bt: validate rx pkt_type header length (Michael Bommarito)
  - Bluetooth: virtio_bt: clamp rx length before skb_put (Michael Bommarito)
  - ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() (Yilin Zhu) [Orabug: 39460469] {CVE-2026-46172}
  - xfrm: provide message size for XFRM_MSG_MAPPING (Ruijie Li)
  - ALSA: firewire-tascam: Do not drop unread control events (Cássio Gabriel)
  - usb: ulpi: fix memory leak on ulpi_register() error paths (Felix Gu) [Orabug: 39654820] {CVE-2026-46109}
  - USB: serial: option: add Telit Cinterion LE910Cx compositions (Fabio Porcedda)
  - USB: omap_udc: DMA: Don't enable burst 4 mode (Aaro Koskinen)
  - ALSA: usb-audio: Fix UAC3 cluster descriptor size check (Cássio Gabriel)
  - ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() (Takashi Iwai) [Orabug: 39460352] {CVE-2026-46146}
  - usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl (Greg Kroah-Hartman) [Orabug: 39460438] {CVE-2026-46167}
  - usb: usblp: fix heap leak in IEEE 1284 device ID via short response (Greg Kroah-Hartman) [Orabug: 39460379] {CVE-2026-46151}
  - wifi: b43: enforce bounds check on firmware key index in b43_rx() (Tristan Madani) [Orabug: 39460257] {CVE-2026-46122}
  - wifi: ath5k: do not access array OOB (Jiri Slaby) [Orabug: 39524622] {CVE-2026-46307}
  - wifi: rsi: fix kthread lifetime race between self-exit and external-stop (Jeongjun Park) [Orabug: 39460532] {CVE-2026-46187}
  - wifi: b43legacy: enforce bounds check on firmware key index in RX path (Tristan Madani) [Orabug: 39460424] {CVE-2026-46163}
  - ipmi:ssif: NULL thread on error (Corey Minyard)
  - ipmi:ssif: Remove unnecessary indention (Corey Minyard)
  - ipmi:ssif: Clean up kthread on errors (Corey Minyard) [Orabug: 39452264] {CVE-2026-46044}
  - ipmi:ssif: Fix a shutdown race (Corey Minyard)
  - net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (Jamal Hadi Salim) [Orabug: 39425987] {CVE-2026-43496}
  - octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_flows.c (Dipendra Khadka)
  - um: virt-pci: Fix build failure (Florian Fainelli)
  - spi: meson-spicc: Fix double-put in remove path (Felix Gu) [Orabug: 39250891] {CVE-2026-31489}
  - ksmbd: do not expire session on binding failure (Hyunwoo Kim)
  - spi: rockchip: fix controller deregistration (Johan Hovold)
  - ACPI: video: force native backlight on HP OMEN 16 (8A44) (Shivam Kalra)
  - ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug (Jinjie Ruan)
  - ACPI: scan: Use acpi_dev_put() in object add error paths (Guangshuo Li)
  - fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free (Rajat Gupta)
  - ipmi:si: Return state to normal if message allocation fails (Corey Minyard) [Orabug: 39460202] {CVE-2026-46108}
  - ipmi: Check event message buffer response for bad data (Corey Minyard) [Orabug: 39460284] {CVE-2026-46128}
  - ipmi: Add limits to event and receive message requests (Corey Minyard) [Orabug: 39460490] {CVE-2026-46177}
  - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (Greg Kroah-Hartman) [Orabug: 39460368] {CVE-2026-46149}
  - netfilter: reject zero shift in nft_bitwise (Kai Ma) [Orabug: 39452465] {CVE-2026-46101}
  - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Andrea Mayer) [Orabug: 39452458] {CVE-2026-46099}
  - ALSA: caiaq: fix usb_dev refcount leak on probe failure (Deepanshu Kartikey) [Orabug: 39784983] {CVE-2026-46048}
  - drm/amdgpu: fix zero-size GDS range init on RDNA4 (Arjan van de Ven) [Orabug: 39524543] {CVE-2026-46276}
  - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Greg Kroah-Hartman) [Orabug: 39426004] {CVE-2026-43501}
  - ALSA: caiaq: Don't abort when no input device is available (Takashi Iwai)
  - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path (Takashi Iwai)
  - driver core: Add kernel-doc for DEV_FLAG_COUNT enum value (Douglas Anderson)
  - crypto: authencesn - reject short ahash digests during instance creation (Yucheng Lu) [Orabug: 39452232] {CVE-2026-46033}
  - seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode (Andrea Mayer)
  - ntfs3: fix integer overflow in run_unpack() volume boundary check (Tobi Gaertner)
  - ntfs3: add buffer boundary checks to run_unpack() (Tobi Gaertner)
  - ktest: Fix the month in the name of the failure directory (Steven Rostedt)
  - IB/core: Fix zero dmac race in neighbor resolution (Chen Zhao)
  - dm mirror: fix integer overflow in create_dirty_log() (Junrui Luo) [Orabug: 39452197] {CVE-2026-46023}
  - crypto: atmel-tdes - fix DMA sync direction (Thorsten Blum)
  - crypto: ccree - fix a memory leak in cc_mac_digest() (Haoxiang Li)
  - crypto: hisilicon - Fix dma_unmap_single() direction (Thomas Fourier)
  - crypto: atmel-ecc - Release client on allocation failure (Thorsten Blum)
  - crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup (Thorsten Blum)
  - crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit (Eric Biggers)
  - taskstats: set version in TGID exit notifications (Yiyang Chen)
  - tcp: call sk_data_ready() after listener migration (Zhenzhong Wu) [Orabug: 39452160] {CVE-2026-46015}
  - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (Chia-Ming Chang) [Orabug: 39452251] {CVE-2026-46040}
  - md/raid5: validate payload size before accessing journal metadata (Junrui Luo) [Orabug: 39452350] {CVE-2026-46070}
  - md/raid5: fix soft lockup in retry_aligned_read() (Chia-Ming Chang) [Orabug: 39452288] {CVE-2026-46051}
  - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() (Sohei Koyama) [Orabug: 39452270] {CVE-2026-46046}
  - mtd: docg3: fix use-after-free in docg3_release() (James Kim)
  - mtd: docg3: Convert to platform remove callback returning void (Uwe Kleine-König)
  - io_uring/poll: fix backport of io_poll_add() changes (Jens Axboe)
  - io_uring/poll: fix EPOLL_URING_WAKE sometimes not being honored (Jens Axboe)
  - KVM: nSVM: Add missing consistency check for nCR3 validity (Yosry Ahmed)
  - KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) (Yosry Ahmed)
  - KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN (Yosry Ahmed)
  - KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode (Yosry Ahmed)
  - KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts (Sean Christopherson)
  - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 (Kevin Cheng) [Orabug: 39452395] {CVE-2026-46082}
  - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 (Yosry Ahmed) [Orabug: 39452062] {CVE-2026-45987}
  - KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state (Yosry Ahmed)
  - userfaultfd: allow registration of ranges below mmap_min_addr (Denis M. Karpov)
  - rtc: ntxec: fix OF node reference imbalance (Johan Hovold)
  - tpm: tpm_tis: add error logging for data transfer (Jacqueline Wong)
  - mmc: block: use single block write in retry (Bin Liu)
  - power: supply: axp288_charger: Do not cancel work before initializing it (Krzysztof Kozlowski)
  - tpm: avoid -Wunused-but-set-variable (Arnd Bergmann)
  - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (Raphael Zimmer) [Orabug: 39452202] {CVE-2026-46024}
  - ipv4: icmp: validate reply type before using icmp_pointers (Ruide Cao) [Orabug: 39452244] {CVE-2026-46037}
  - drm/arcpgu: fix device node leak (Luca Ceresoli)
  - net/smc: avoid early lgr access in smc_clc_wait_msg (Ruijie Li)
  - iio: adc: ad7768-1: fix one-shot mode data acquisition (Jonathan Santos)
  - ALSA: 6fire: Fix input volume change detection (Cássio Gabriel)
  - ALSA: caiaq: Handle probe errors properly (Takashi Iwai) [Orabug: 39452127] {CVE-2026-46004}
  - ALSA: caiaq: Fix control_put() result and cache rollback (Cássio Gabriel)
  - selftests/mqueue: Fix incorrectly named file (Simon Liebold)
  - parisc: _llseek syscall is only available for 32-bit userspace (Helge Deller)
  - nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 (Robert Beckett)
  - md/raid10: fix deadlock with check operation and nowait requests (Josh Hunt) [Orabug: 39452285] {CVE-2026-46050}
  - ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes (Cássio Gabriel)
  - ALSA: ctxfi: Add fallback to default RSR for S/PDIF (Harin Lee) [Orabug: 39452281] {CVE-2026-46049}
  - ALSA: aoa: i2sbus: fix OF node lifetime handling (Cássio Gabriel)
  - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() (Vasiliy Kovalev) [Orabug: 39452120] {CVE-2026-46002}
  - net: qrtr: ns: Fix use-after-free in driver remove() (Manivannan Sadhasivam) [Orabug: 39452275] {CVE-2026-46047}
  - media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() (Chen Ni)
  - lib/ts_kmp: fix integer overflow in pattern length calculation (Josh Law)
  - Revert "ALSA: usb: Increase volume range that triggers a warning" (Rongrong)
  - PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown (Koichiro Den)
  - net: strparser: fix skb_head leak in strp_abort_strp() (Luxiao Xu) [Orabug: 39452469] {CVE-2026-46102}
  - net: caif: clear client service pointer on teardown (Zhengchuan Liang)
  - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() (Ziqing Chen) [Orabug: 39452417] {CVE-2026-46088}
  - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Herbert Xu) [Orabug: 39410864] {CVE-2026-43493}
  - um: drivers: call kernel_strrchr() explicitly in cow_user.c (Michael Bommarito)
  - driver core: Don't let a device probe until it's ready (Douglas Anderson)
  - padata: Remove comment for reorder_work (Herbert Xu)
  - padata: Fix pd UAF once and for all (Herbert Xu) [Orabug: 38335056] {CVE-2025-38584}
  - ocfs2: split transactions in dio completion to avoid credit exhaustion (Heming Zhao) [Orabug: 39452389] {CVE-2026-46080}
  - device property: Make modifications of fwnode "flags" thread safe (Douglas Anderson)
  - scsi: ufs: core: Fix use-after free in init error and remove paths (André Draszik)
  - firmware: google: framebuffer: Do not mark framebuffer as busy (Thomas Zimmermann)
  - ibmasm: fix heap over-read in ibmasm_send_i2o_message() (Tyllis Xu)
  - ibmasm: fix OOB reads in command_file_write due to missing size checks (Tyllis Xu)
  - misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() (Tyllis Xu)
  - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check (Greg Kroah-Hartman) [Orabug: 39452134] {CVE-2026-46006}
  - ALSA: usb-audio: Evaluate packsize caps at the right place (Takashi Iwai)
  - usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() (Michał Pecio)
  - ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch (Cássio Gabriel)
  - ALSA: usb-audio: Avoid false E-MU sample-rate notifications (Cássio Gabriel)
  - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES (Cássio Gabriel) [Orabug: 39452171] {CVE-2026-46018}
  - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jeongjun Park)
  - tty: n_gsm: fix flow control handling in tx path (Daniel Starke)
  - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing (Anderson Nascimento)
  - crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (Sean Christopherson) [Orabug: 39300568] {CVE-2026-31697}
  - crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (Sean Christopherson) [Orabug: 39300572] {CVE-2026-31698}
  - crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (Sean Christopherson) [Orabug: 39300576] {CVE-2026-31699}
  - ALSA: caiaq: take a reference on the USB device in create_card() (Berk Cem Goksel) [Orabug: 39300587] {CVE-2026-31701}
  - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu (Cryolitia Pukngae)
  - fuse: quiet down complaints in fuse_conn_limit_write (Darrick J. Wong)
  - fuse: reject oversized dirents in page cache (Samuel Page) [Orabug: 39300557] {CVE-2026-31694}
  - fs/ntfs3: validate rec->used in journal-replay file record check (Greg Kroah-Hartman)
  - iommu: fix a reference count leak in iommu_sva_bind_device() (Vasant Karasulli)
  - rxrpc: Fix anonymous key handling (David Howells)
  - rxrpc: only handle RESPONSE during service challenge (Jie Wang) [Orabug: 39342679,39368252]
  - ksmbd: unset conn->binding on failed binding request (Namjae Jeon)
  - scripts/dtc: Remove unused dts_version in dtc-lexer.l (Nathan Chancellor)
  - Revert "wifi: cfg80211: stop NAN and P2P in cfg80211_leave" (Guocai He)
  - drivers: base: Free devm resources when unregistering a device (David Gow)
  - cpufreq: Avoid a bad reference count on CPU node (Miquel Sabaté Solà) [Orabug: 37206351] {CVE-2024-50012}
  - net: clear the dst when changing skb protocol (Jakub Kicinski) [Orabug: 38158471] {CVE-2025-38192}
  - fbdev: efifb: Register sysfs groups through driver core (Thomas Weißschuh) [Orabug: 37205941] {CVE-2024-49925}
  - md/md-bitmap: Synchronize bitmap_get_stats() with bitmap lifetime (Yu Kuai) [Orabug: 37649831] {CVE-2025-21712}
  - cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path (Guangshuo Li) [Orabug: 39343645] {CVE-2026-43328}
  - cpufreq: governor: Free dbs_data directly when gov->init() fails (Liao Chang)
  - rxrpc: Fix recvmsg() unconditional requeue (David Howells)
  - fs/ntfs3: Add more attributes checks in mi_enum_attr() (Konstantin Komarov) {CVE-2023-45896}
  - btrfs: lock the inode in shared mode before starting fiemap (Filipe Manana)
  - f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode (Chao Yu)
  - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs (Marc Kleine-Budde) [Orabug: 38773752] {CVE-2025-68307}
  - Bluetooth: af_bluetooth: Fix deadlock (Luiz Augusto von Dentz) [Orabug: 36544919] {CVE-2024-26886}
  - iio: imu: inv_icm42600: fix odr switch when turning buffer off (Jean-Baptiste Maneyrol)
  - pstore: inode: Only d_invalidate() is needed (Kees Cook) [Orabug: 36598300] {CVE-2024-27389}
  - f2fs: fix to wait on block writeback for post_read case (Chao Yu)
  - net: stmmac: fix TSO DMA API usage causing oops (Russell King) [Orabug: 37434619] {CVE-2024-56719}
  - drm/amdgpu: unmap and remove csa_va properly (Lang Yu)
  - binfmt_misc: restore write access before closing files opened by open_exec() (Zilin Guan) [Orabug: 38773485] {CVE-2025-68239}
  - gfs2: No more self recovery (Andreas Gruenbacher) [Orabug: 38351909] {CVE-2025-38659}
  - bpf: Do mark_chain_precision for ARG_CONST_ALLOC_SIZE_OR_ZERO (Kumar Kartikeya Dwivedi)
  - dlm: fix possible lkb_resource null dereference (Alexander Aring) [Orabug: 37472202] {CVE-2024-47809}
  - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (Kuniyuki Iwashima) [Orabug: 38175068] {CVE-2025-38250}
  - mailbox: Prevent out-of-bounds access in of_mbox_index_xlate() (Joonwon Kang)
  - btrfs: do not strictly require dirty metadata threshold for metadata writepages (Qu Wenruo) [Orabug: 38970329] {CVE-2026-23157}
  - btrfs: send: check for inline extents in range_is_hole_in_parent() (Qu Wenruo) [Orabug: 38970284] {CVE-2026-23141}
  - x86/uprobes: Fix XOL allocation failure for 32-bit tasks (Oleg Nesterov)
  - spi: cadence-quadspi: Implement refcount to handle unbind during busy (Khairul Anuar Romli)
  - fs: dlm: fix use after free in midcomms commit (Alexander Aring)
  - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() (Guodong Xu)
  - net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970488] {CVE-2026-23204}
  - net: add skb_header_pointer_careful() helper (Eric Dumazet)
  - dm-verity: disable recursive forward error correction (Mikulas Patocka) [Orabug: 38887637] {CVE-2025-71161}
  - blk-mq: use quiesced elevator switch when reinitializing queues (Keith Busch)
  - wifi: iwlwifi: read txq->read_ptr under lock (Johannes Berg) [Orabug: 36683388] {CVE-2024-36922}
  - f2fs: fix null-ptr-deref in f2fs_submit_page_bio() (Ye Bin)
  - s390/xor: Fix xor_xc_2() inline assembly constraints (Heiko Carstens)
  - ALSA: control: Avoid WARN() for symlink errors (Takashi Iwai) [Orabug: 37434224] {CVE-2024-56657}
  - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Jaskaran Singh) [Orabug: 38730673] {CVE-2025-40261}
  - Revert "nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()" (Jaskaran Singh)
  - tty: n_gsm: fix deadlock and link starvation in outgoing data path (Daniel Starke)
  - MPTCP: fix lock class name family in pm_nl_create_listen_socket (Li Xiasong)
  - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (Breno Leitao) [Orabug: 39273511] {CVE-2026-31586}
  - ocfs2: fix possible deadlock between unlink and dio_end_io_write (Joseph Qi) [Orabug: 39273588] {CVE-2026-31598}
  - fs/ocfs2: fix comments mentioning i_mutex (Hongnan Li)
  - rxrpc: reject undecryptable rxkad response tickets (Yuqi Xu)
  - rxrpc: Fix call removal to use RCU safe deletion (David Howells)
  - rxrpc: Fix key quota calculation for multitoken keys (David Howells)
  - xfrm: clear trailing padding in build_polexpire() (Yasuaki Torimaru) [Orabug: 39262402] {CVE-2026-31664}
  - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline (Joseph Qi) [Orabug: 39331093] {CVE-2026-43075}
  - ocfs2: validate inline data i_size during inode read (Deepanshu Kartikey) [Orabug: 39331098] {CVE-2026-43076}
  - ocfs2: add inline inode consistency check to ocfs2_validate_inode_block() (Dmitry Antipov)
  - arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V (Sebastian Krzyszkowiak)
  - Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower" (Sebastian Krzyszkowiak)
  - arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage to 0.81V (Sebastian Krzyszkowiak)
  - arm64: dts: imx8mq-librem5: Set the DVS voltages lower (Sebastian Krzyszkowiak)
  - powerpc64/bpf: do not increment tailcall count when prog is NULL (Hari Bathini)
  - netfilter: nft_set_pipapo: do not rely on ZERO_SIZE_PTR (Florian Westphal)
  - PCI/ACPI: Restrict program_hpx_type2() to AER bits (Håkon Bugge)
  - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (Felix Fietkau) [Orabug: 39167473] {CVE-2026-23444}
  - gfs2: Validate i_depth for exhash directories (Andrew Price) [Orabug: 38395007] {CVE-2025-38710}
  - gfs2: Improve gfs2_consist_inode() usage (Andrew Price)
  - ipv6: add NULL checks for idev in SRv6 paths (Heminhong) [Orabug: 39167468] {CVE-2026-23442}
  - Revert "net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set()" (Sasha Levin)
  - Revert "net: ethernet: xscale: Check for PTP support properly" (Sasha Levin)
  - PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown (Koichiro Den)
  - media: hackrf: fix to not free memory after the device is registered in hackrf_probe() (Jeongjun Park)
  - media: vidtv: fix pass-by-value structs causing MSAN warnings (Abd-Alrhman Masalkhi)
  - nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map (Deepanshu Kartikey)
  - media: as102: fix to not free memory after the device is registered in as102_usb_probe() (Jeongjun Park) [Orabug: 39273468] {CVE-2026-31578}
  - bcache: fix cached_dev.sb_bio use-after-free and crash (Mingzhe Zou) [Orabug: 39273482] {CVE-2026-31580}
  - ALSA: 6fire: fix use-after-free on disconnect (Berk Cem Goksel) [Orabug: 39273487] {CVE-2026-31581}
  - media: em28xx: fix use-after-free in em28xx_v4l2_open() (Abhishek Kumar) [Orabug: 39273494] {CVE-2026-31583}
  - media: vidtv: fix nfeeds state corruption on start_streaming failure (Ruslan Valiyev)
  - mm/kasan: fix double free for kasan pXds (Ritesh Harjani)
  - KVM: x86: Use scratch field in MMIO fragment to hold small write values (Sean Christopherson) [Orabug: 39273523] {CVE-2026-31588}
  - checkpatch: add support for Assisted-by tag (Sasha Levin)
  - rxrpc: proc: size address buffers for %pISpc output (Pengpeng Hou)
  - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Pablo Neira Ayuso) [Orabug: 39139840] {CVE-2026-23399}
  - smb: client: fix potential UAF in smb2_is_valid_oplock_break() (Paulo Alcantara)
  - fsl-mc: Use driver_set_override() instead of open-coding (Krzysztof Kozlowski)
  - KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (Sean Christopherson) [Orabug: 39273531] {CVE-2026-31590}
  - ocfs2: handle invalid dinode in ocfs2_group_extend (Zhengyuan Huang) [Orabug: 39273570] {CVE-2026-31596}
  - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY (Tejas Bharambe) [Orabug: 39273579] {CVE-2026-31597}
  - media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections (Ruslan Valiyev)
  - ALSA: ctxfi: Limit PTP to a single page (Harin Lee) [Orabug: 39273609] {CVE-2026-31602}
  - USB: serial: option: add Telit Cinterion FN990A MBIM composition (Fabio Porcedda)
  - staging: sm750fb: fix division by zero in ps_to_hz() (Junrui Luo)
  - fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO (Greg Kroah-Hartman)
  - usb: storage: Expand range of matched versions for VL817 quirks entry (Daniel Brát)
  - usbip: validate number_of_packets in usbip_pack_ret_submit() (Nathan Rebello) [Orabug: 39273632] {CVE-2026-31607}
  - usb: gadget: renesas_usb3: validate endpoint index in standard request handlers (Greg Kroah-Hartman)
  - usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() (Greg Kroah-Hartman)
  - usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() (Greg Kroah-Hartman) [Orabug: 39273669] {CVE-2026-31617}
  - fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO (Greg Kroah-Hartman)
  - ALSA: fireworks: bound device-supplied status before string array lookup (Greg Kroah-Hartman) [Orabug: 39273681] {CVE-2026-31619}
  - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler (Greg Kroah-Hartman)
  - net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() (Greg Kroah-Hartman) [Orabug: 39273693] {CVE-2026-31623}
  - HID: core: clamp report_size in s32ton() to avoid undefined shift (Greg Kroah-Hartman) [Orabug: 39273697] {CVE-2026-31624}
  - HID: alps: fix NULL pointer dereference in alps_raw_event() (Greg Kroah-Hartman) [Orabug: 39273705] {CVE-2026-31625}
  - staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() (Lin Yu Chen) [Orabug: 39273709] {CVE-2026-31626}
  - i2c: s3c24xx: check the size of the SMBUS message before using it (Greg Kroah-Hartman)
  - can: raw: fix ro->uniq use-after-free in raw_rcv() (Samuel Page) [Orabug: 39273447] {CVE-2026-31532}
  - nfc: llcp: add missing return after LLCP_CLOSED checks (Junxi Qian)
  - ALSA: usb-audio: Update for native DSD support quirks (Jussi Laako)
  - MIPS: mm: Rewrite TLB uniquification for the hidden bit feature (Maciej W. Rozycki)
  - MIPS: mm: Suppress TLB uniquification on EHINV hardware (Maciej W. Rozycki)
  - MIPS: Always record SEGBITS in cpu_data.vmbits (Maciej W. Rozycki)
  - mips: mm: Allocate tlb_vpn array atomically (Stefan Wiehler)
  - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [Orabug: 39171450] {CVE-2026-31407}
  - i3c: fix uninitialized variable use in i2c setup (Jamie Iles)
  - perf/x86/intel/uncore: Skip discovery table for offline dies (Zide Chen) [Orabug: 39331116] {CVE-2026-43079}
  - gpio: tegra: fix irq_release_resources calling enable instead of disable (Samasth Norway Ananda)
  - l2tp: Drop large packets with UDP encap (Alice Mikityanska) [Orabug: 39331125] {CVE-2026-43080}
  - af_unix: read UNIX_DIAG_VFS data under unix_state_lock (Jiexun Wang) [Orabug: 39263356] {CVE-2026-31673}
  - netfilter: ip6t_eui64: reject invalid MAC header for all packets (Zhengchuan Liang) [Orabug: 39263406] {CVE-2026-31685}
  - netfilter: xt_multiport: validate range encoding in checkentry (Ao Zhou) [Orabug: 39263388] {CVE-2026-31681}
  - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Xiang Mei) [Orabug: 39331145] {CVE-2026-43085}
  - xfrm_user: fix info leak in build_mapping() (Greg Kroah-Hartman) [Orabug: 39331163] {CVE-2026-43089}
  - xsk: tighten UMEM headroom validation to account for tailroom and min frame (Maciej Fijalkowski) [Orabug: 39331181] {CVE-2026-43093}
  - e1000: check return value of e1000_read_eeprom (Agalakov Daniil)
  - tracing/probe: reject non-closed empty immediate strings (Pengpeng Hou)
  - nfc: s3fwrn5: allocate rx skb before consuming bytes (Pengpeng Hou)
  - ipv4: icmp: fix null-ptr-deref in icmp_build_probe() (Yiqi Sun) [Orabug: 39331198] {CVE-2026-43099}
  - net: lapbether: handle NETDEV_PRE_TYPE_CHANGE (Eric Dumazet)
  - net: sched: act_csum: validate nested VLAN headers (Ruide Cao) [Orabug: 39263401] {CVE-2026-31684}
  - eventpoll: defer struct eventpoll free to RCU grace period (Nicholas Carlini) [Orabug: 39784990] {CVE-2026-43074}
  - epoll: use refcount to reduce ep_mutex contention (Paolo Abeni)
  - drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock (Maíra Canal)
  - drm/vc4: Fix a memory leak in hang state error path (Maíra Canal) [Orabug: 39331212] {CVE-2026-43104}
  - drm/vc4: Fix memory leak of BO array in hang state (Maíra Canal) [Orabug: 39331216] {CVE-2026-43105}
  - PCI: hv: Set default NUMA node to 0 for devices without affinity info (Long Li)
  - arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency (Sebastian Krzyszkowiak)
  - soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching (Potin Lai)
  - ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J (Tomasz Merta)
  - wifi: brcmfmac: validate bsscfg indices in IF events (Pengpeng Hou) [Orabug: 39331238] {CVE-2026-43110}
  - ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 (Arthur Husband)
  - HID: roccat: fix use-after-free in roccat_report_event (Benoît Sevens) [Orabug: 39331244] {CVE-2026-43111}
  - HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 (Leo Vriska)
  - pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) (Andy Shevchenko)
  - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (Fredric Cover)
  - ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex (Phil Willoughby)
  - ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list (Kuninori Morimoto)
  - wifi: wl1251: validate packet IDs before indexing tx_frames (Pengpeng Hou) [Orabug: 39331254] {CVE-2026-43113}
  - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [Orabug: 39331263] {CVE-2026-43114}
  - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx (César Montoya)
  - btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() (Goldwyn Rodrigues) [Orabug: 39331280] {CVE-2026-43117}
  - can: mcp251x: add error handling for power enable in open and resume (Wenyuan Li)
  - ALSA: asihpi: avoid write overflow check warning (Arnd Bergmann)
  - LTS version: v5.15.208 (Samasth Norway Ananda)
  - LTS version: v5.15.207 (Samasth Norway Ananda)
  - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Prathyushi Nangia) [Orabug: 39460476] {CVE-2026-46174}
  - x86/CPU/AMD: Add X86_FEATURE_ZEN1 (Borislav Petkov)
  - LTS version: v5.15.206 (Samasth Norway Ananda)
  - LTS version: v5.15.205 (Samasth Norway Ananda)
  - LTS version: v5.15.204 (Samasth Norway Ananda)
  - xen/privcmd: fix double free via VMA splitting (Juergen Gross) [Orabug: 39305911] {CVE-2026-31787}
  - Buffer overflow in drivers/xen/sys-hypervisor.c (Juergen Gross) [Orabug: 39305899] {CVE-2026-31786}


