# changelog

author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.346.3.el8uek]
changelog:
  - x86/bpf: Classic BPF program can fail when BHB barrier is used (Alexandre Chartre) [Orabug: 38151403]
  - Add Zen34 clients (Borislav Petkov) [Orabug: 38172250] {CVE-2024-36350,CVE-2024-36357}
  - x86/process: Move the buffer clearing before MONITOR (Kim Phillips) [Orabug: 38172250] {CVE-2024-36350,CVE-2024-36357}
  - KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov) [Orabug: 38172250] {CVE-2024-36350,CVE-2024-36357}
  - x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38172250] {CVE-2024-36350,CVE-2024-36357}
  - KVM: x86: add support for CPUID leaf 0x80000021 (Paolo Bonzini) [Orabug: 38172250] {CVE-2024-36350,CVE-2024-36357}
  - x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38172250] {CVE-2024-36350,CVE-2024-36357}
  - x86/CPU/AMD: Add ZenX generations flags (Borislav Petkov) [Orabug: 38172250] {CVE-2024-36350,CVE-2024-36357}
  - x86/bugs: Free X86_BUG_AMD_APIC_C1E and X86_BUG_AMD_E400 bits (Boris Ostrovsky) [Orabug: 38172250] {CVE-2024-36350,CVE-2024-36357}


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.346.4.el8uek]
changelog:
  - pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
  - Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
  - net/sched: Always pass notifications when child class becomes empty (Lion Ackermann)


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.346.5.el8uek]
changelog:
  - perf: Fix perf_event_validate_size() lockdep splat (Mark Rutland)  [Orabug: 36261486]  {CVE-2023-6931}
  - perf: Fix perf_event_validate_size() (Peter Zijlstra)  [Orabug: 36261486]  {CVE-2023-6931}
  - net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju)  [Orabug: 38182891]


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.346.6.el8uek]
changelog:
  - net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju)  [Orabug: 38109070]  
  - net/rds: poll eq during user-reset (Praveen Kumar Kannoju)  [Orabug: 38189315]


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.346.4.el8uek]
changelog:
  - pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
  - Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
  - net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217340] {CVE-2025-38350}


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.346.5.el8uek]
changelog:
  - perf: Fix perf_event_validate_size() lockdep splat (Mark Rutland) [Orabug: 36261486] {CVE-2023-6931}
  - perf: Fix perf_event_validate_size() (Peter Zijlstra) [Orabug: 36261486] {CVE-2023-6931}
  - net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju) [Orabug: 38182891]


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.346.6.el8uek]
changelog:
  - net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38109070]
  - net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189315]


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.347.1.el8uek]
changelog:
  - LTS tag: v5.4.295 (Alok Tiwari)
  - scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops (Kees Cook)
  - arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (Tengda Wu) [Orabug: 38180596] {CVE-2025-38320}
  - perf: Fix sample vs do_exit() (Peter Zijlstra) [Orabug: 38254030] {CVE-2025-38424}
  - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Heiko Carstens)
  - rtc: test: Fix invalid format specifier. (David Gow)
  - jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (Jeongjun Park) [Orabug: 38180707] {CVE-2025-38337}
  - mm/huge_memory: fix dereferencing invalid pmd migration entry (Gavin Guo) [Orabug: 37976985] {CVE-2025-37958}
  - rtc: Make rtc_time64_to_tm() support dates before 1970 (Alexandre Mergnat)
  - rtc: Improve performance of rtc_time64_to_tm(). Add tests. (Cassio Neri)
  - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (Dan Aloni) [Orabug: 37101886] {CVE-2022-48773}
  - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [Orabug: 38223087] {CVE-2025-38352}
  - ARM: dts: am335x-bone-common: Increase MDIO reset deassert delay to 50ms (Geert Uytterhoeven)
  - ARM: dts: am335x-bone-common: Increase MDIO reset deassert time (Colin Foster)
  - ARM: dts: am335x-bone-common: Add GPIO PHY reset on revision C3 board (Shengyu Qu)
  - net: atm: fix /proc/net/atm/lec handling (Eric Dumazet) [Orabug: 38158407] {CVE-2025-38180}
  - net: atm: add lec_mutex (Eric Dumazet) [Orabug: 38180612] {CVE-2025-38323}
  - calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). (Kuniyuki Iwashima) [Orabug: 38158413] {CVE-2025-38181}
  - tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (Haixia Qu) [Orabug: 38158425] {CVE-2025-38184}
  - tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior (Neal Cardwell)
  - atm: atmtcp: Free invalid length skb in atmtcp_c_send(). (Kuniyuki Iwashima) [Orabug: 38158434] {CVE-2025-38185}
  - mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (Kuniyuki Iwashima) [Orabug: 38180618] {CVE-2025-38324}
  - wifi: carl9170: do not ping device which has failed to load firmware (Dmitry Antipov) [Orabug: 38254011] {CVE-2025-38420}
  - aoe: clean device rq_list in aoedev_downdev() (Justin Sanders) [Orabug: 38180629] {CVE-2025-38326}
  - hwmon: (occ) fix unaligned accesses (Arnd Bergmann)
  - drm/nouveau/bl: increase buffer size to avoid truncate warning (Jacob Keller)
  - erofs: remove unused trace event erofs_destroy_inode (Gao Xiang)
  - ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged (Jonathan Lane)
  - ALSA: hda/intel: Add Thinkpad E15 to PM deny list (Takashi Iwai)
  - Input: sparcspkr - avoid unannotated fall-through (Yuli Wang)
  - HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (Terry Junge) [Orabug: 38152878] {CVE-2025-38103}
  - atm: Revert atm_account_tx() if copy_from_iter_full() fails. (Kuniyuki Iwashima) [Orabug: 38158458] {CVE-2025-38190}
  - selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len (Stephen Smalley)
  - scsi: s390: zfcp: Ensure synchronous unit_add (Peter Oberparleiter)
  - scsi: storvsc: Increase the timeouts to storvsc_timeout (Dexuan Cui)
  - jffs2: check jffs2_prealloc_raw_node_refs() result in few other places (Fedor Pchelkin) [Orabug: 38180636] {CVE-2025-38328}
  - jffs2: check that raw node were preallocated before writing summary (Artem Sadovnikov) [Orabug: 38158484] {CVE-2025-38194}
  - drivers/rapidio/rio_cm.c: prevent possible heap overwrite (Andrew Morton) [Orabug: 38137454] {CVE-2025-38090}
  - powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery (Narayana Murty N)
  - platform/x86: dell_rbu: Stop overwriting data buffer (Stuart Hayes)
  - platform: Add Surface platform directory (Maximilian Luz)
  - Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first" (Alexander Sverdlin)
  - tee: Prevent size calculation wraparound on 32-bit kernels (Jann Horn)
  - ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY (Sukrut Bellary)
  - bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value (Laurentiu Tudor)
  - watchdog: da9052_wdt: respect TWDMIN (Marcus Folkesson)
  - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Kyungwook Boo) [Orabug: 38158518] {CVE-2025-38200}
  - sock: Correct error checking condition for (assign|release)_proto_idx() (Zijun Hu)
  - scsi: lpfc: Use memcpy() for BIOS version (Daniel Wagner) [Orabug: 38180668] {CVE-2025-38332}
  - vxlan: Do not treat dst cache initialization errors as fatal (Ido Schimmel)
  - clk: rockchip: rk3036: mark ddrphy as critical (Heiko Stuebner)
  - wifi: mac80211: do not offer a mesh path if forwarding is disabled (Benjamin Berg)
  - net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info (Jason Xing)
  - pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() (Gabor Juhos)
  - pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction() (Gabor Juhos)
  - pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction() (Gabor Juhos)
  - pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name() (Gabor Juhos)
  - ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT (Sebastian Andrzej Siewior)
  - tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows (Eric Dumazet)
  - tcp: always seek for minimal rtt in tcp_rcv_rtt_update() (Eric Dumazet)
  - net: dlink: add synchronization for stats update (Moon Yeounsu)
  - sctp: Do not wake readers in __sctp_write_space() (Petr Malat)
  - emulex/benet: correct command version selection in be_cmd_get_stats() (Alok Tiwari)
  - i2c: designware: Invoke runtime suspend on quick slave re-registration (Tan En De)
  - net: macb: Check return value of dma_set_mask_and_coherent() (Sergio Perez Gonzalez)
  - cpufreq: Force sync policy boost with global boost on sysfs update (Viresh Kumar)
  - nios2: force update_mmu_cache on spurious tlb-permission--related pagefaults (Simon Schuster)
  - media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() (Xu Wang) [Orabug: 38175014] {CVE-2025-38237}
  - media: tc358743: ignore video while HPD is low (Hans Verkuil)
  - drm/amdkfd: Set SDMA_RLCx_IB_CNTL/SWITCH_INSIDE_IB (Amber Lin)
  - jfs: Fix null-ptr-deref in jfs_ioc_trim (Dylan Wolff) [Orabug: 38158546] {CVE-2025-38203}
  - drm/amdgpu/gfx9: fix CSIB handling (Alex Deucher)
  - drm/amdgpu/gfx8: fix CSIB handling (Alex Deucher)
  - jfs: fix array-index-out-of-bounds read in add_missing_indices (Aditya Dutt) [Orabug: 38158553] {CVE-2025-38204}
  - drm/amdgpu/gfx7: fix CSIB handling (Alex Deucher)
  - drm/amdgpu/gfx10: fix CSIB handling (Alex Deucher)
  - drm/msm/a6xx: Increase HFI response timeout (Akhil P Oommen)
  - drm/amd/display: Add NULL pointer checks in dm_force_atomic_commit() (Srinivasan Shanmugam)
  - media: uapi: v4l: Fix V4L2_TYPE_IS_OUTPUT condition (Nas Chung)
  - drm/msm/hdmi: add runtime PM calls to DDC transfer function (Dmitry Baryshkov)
  - drm/bridge: analogix_dp: Add irq flag IRQF_NO_AUTOEN instead of calling disable_irq() (Damon Ding)
  - sunrpc: update nextcheck time when adding new cache entries (Long Li)
  - drm/amdgpu/gfx6: fix CSIB handling (Alex Deucher)
  - ACPI: battery: negate current when discharging (Peter Marheine)
  - PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() (Charan Teja Kalla)
  - power: supply: bq27xxx: Retrieve again when busy (Jerry Lv)
  - ACPICA: fix acpi parse and parseext cache leaks (Seunghun Han) [Orabug: 38180748] {CVE-2025-38344}
  - ACPICA: Avoid sequence overread in call to strncmp() (Ahmed Salem)
  - ACPICA: fix acpi operand cache leak in dswstate.c (Seunghun Han) [Orabug: 38180756] {CVE-2025-38345}
  - iio: adc: ad7606_spi: fix reg write value mask (David Lechner)
  - PCI: Fix lock symmetry in pci_slot_unlock() (Ilpo Järvinen)
  - PCI: Add ACS quirk for Loongson PCIe (Huacai Chen)
  - uio_hv_generic: Use correct size for interrupt and monitor pages (Long Li)
  - regulator: max14577: Add error check for max14577_read_reg() (Xu Wang)
  - mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS (Khem Raj)
  - staging: iio: ad5933: Correct settling cycles encoding per datasheet (Gabriel)
  - net: ch9200: fix uninitialised access during mii_nway_restart (Qasim Ijaz) [Orabug: 38132189] {CVE-2025-38086}
  - ftrace: Fix UAF when lookup kallsym after ftrace disabled (Ye Bin) [Orabug: 38180768] {CVE-2025-38346}
  - dm-mirror: fix a tiny race condition (Mikulas Patocka)
  - mtd: nand: sunxi: Add randomizer configuration before randomizer enable (Xu Wang)
  - mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk (Xu Wang)
  - mm: fix ratelimit_pages update error in dirty_ratio_handler() (Jinliang Zheng)
  - ipc: fix to protect IPCS lookups using RCU (Jeongjun Park) [Orabug: 38158598] {CVE-2025-38212}
  - parisc: fix building with gcc-15 (Arnd Bergmann)
  - vgacon: Add check for vc_origin address range in vgacon_scroll() (Gong, Ruiqi)
  - fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [Orabug: 38158615] {CVE-2025-38214}
  - EDAC/altera: Use correct write width with the INTTEST register (Niravkumar L Rabara)
  - NFC: nci: uart: Set tty->disc_data only in success path (Krzysztof Kozlowski) [Orabug: 38253992] {CVE-2025-38416}
  - f2fs: prevent kernel warning due to negative i_nlink from corrupted image (Jaegeuk Kim) [Orabug: 38158649] {CVE-2025-38219}
  - Input: ims-pcu - check record size in ims_pcu_flash_firmware() (Dan Carpenter) [Orabug: 38254054] {CVE-2025-38428}
  - ext4: fix calculation of credits for extent tree modification (Jan Kara)
  - ext4: inline: fix len overflow in ext4_prepare_inline_data (Thadeu Lima de Souza Cascardo) [Orabug: 38158662] {CVE-2025-38222}
  - bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device (Ioana Ciornei)
  - ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 (Tasos Sahanidis) [Orabug: 38180697] {CVE-2025-38336}
  - ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap() (Ross Stutterheim)
  - media: v4l2-dev: fix error handling in __video_register_device() (Ma Ke)
  - media: gspca: Add error handling for stv06xx_read_sensor() (Xu Wang)
  - wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723 (Mingcong Bai)
  - nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request (Neil Brown) [Orabug: 38254062] {CVE-2025-38430}
  - wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() (Christian Lamparter) [Orabug: 38180783] {CVE-2025-38348}
  - gfs2: move msleep to sleepable context (Alexander Aring)
  - configfs: Do not override creating attribute file failure in populate_attrs() (Zijun Hu)
  - net: usb: aqc111: debug info before sanitation (Oliver Neukum)
  - calipso: unlock rcu before returning -EAFNOSUPPORT (Eric Dumazet)
  - xen/arm: call uaccess_ttbr0_enable for dm_op hypercall (Stefano Stabellini)
  - usb: Flush altsetting 0 endpoints before reinitializating them after reset. (Mathias Nyman)
  - fs/filesystems: Fix potential unsigned integer underflow in fs_name() (Zijun Hu)
  - net/mdiobus: Fix potential out-of-bounds read/write access (Jakub Raczynski)
  - drm/amd/display: Do not add '-mhard-float' to dcn2{1,0}_resource.o for clang (Nathan Chancellor)
  - drm/amd/display: Do not add '-mhard-float' to dml_ccflags for clang (Nathan Chancellor)
  - MIPS: Move '-Wa,-msoft-float' check from as-option to cc-option (Nathan Chancellor)
  - x86/boot/compressed: prefer cc-option for CFLAGS additions (Nick Desaulniers)
  - net: mdio: C22 is now optional, EOPNOTSUPP if not provided (Andrew Lunn)
  - net_sched: tbf: fix a race in tbf_change() (Eric Dumazet)
  - net_sched: red: fix a race in __red_change() (Eric Dumazet) [Orabug: 38152899] {CVE-2025-38108}
  - net_sched: prio: fix a race in prio_tune() (Eric Dumazet) [Orabug: 38105335] {CVE-2025-38083}
  - net/mlx5: Fix return value when searching for existing flow group (Patrisious Haddad)
  - net/mlx5: Wait for inactive autogroups (Paul Blakey)
  - i40e: retry VFLR handling if there is ongoing VF reset (Robert Malz)
  - i40e: return false from i40e_reset_vf if reset is in progress (Robert Malz)
  - net_sched: sch_sfq: fix a potential crash on gso_skb handling (Eric Dumazet) [Orabug: 38152923] {CVE-2025-38115}
  - scsi: iscsi: Fix incorrect error path labels for flashnode operations (Alok Tiwari)
  - NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes (Chuck Lever) [Orabug: 36954169] {CVE-2022-48829}
  - NFSD: Fix ia_size underflow (Chuck Lever) [Orabug: 36954164] {CVE-2022-48828}
  - Input: synaptics-rmi - fix crash with unsupported versions of F34 (Dmitry Torokhov)
  - Input: synaptics-rmi4 - convert to use sysfs_emit() APIs (Zhang Songyi)
  - pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id() (Dan Carpenter)
  - do_change_type(): refuse to operate on unmounted/not ours mounts (Al Viro) [Orabug: 38256450] {CVE-2025-38498}
  - ice: create new Tx scheduler nodes for new queues only (Michal Kubiak)
  - Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION (Luiz Augusto von Dentz)
  - net/mlx4_en: Prevent potential integer overflow calculating Hz (Dan Carpenter)
  - vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl() (Nicolas Pitre)
  - serial: Fix potential null-ptr-deref in mlb_usio_probe() (Henry Martin) [Orabug: 38153012] {CVE-2025-38135}
  - usb: renesas_usbhs: Reorder clock handling and power management in probe (Lad Prabhakar) [Orabug: 38153017] {CVE-2025-38136}
  - rtc: Fix offset calculation for .start_secs < 0 (Alexandre Mergnat)
  - rtc: sh: assign correct interrupts with DT (Wolfram Sang)
  - perf record: Fix incorrect --user-regs comments (Dapeng Mi)
  - perf tests switch-tracking: Fix timestamp comparison (Leo Yan)
  - mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE (Alexey Gladkov)
  - mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove() (Christophe Jaillet)
  - rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() (Dan Carpenter)
  - perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3 (Adrian Hunter)
  - perf ui browser hists: Set actions->thread before calling do_zoom_thread() (Arnaldo Carvalho de Melo)
  - fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (Sergey Shtylyov) [Orabug: 38180566] {CVE-2025-38312}
  - soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() (Henry Martin) [Orabug: 38153060] {CVE-2025-38145}
  - soc: aspeed: lpc: Fix impossible judgment condition (Su Hui)
  - arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou (Quentin Schulz)
  - ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device (Dmitry Baryshkov)
  - bus: fsl-mc: fix double-free on mc_dev (Ioana Ciornei) [Orabug: 38180573] {CVE-2025-38313}
  - nilfs2: do not propagate ENOENT error from nilfs_btree_propagate() (Ryusuke Konishi)
  - nilfs2: add pointer check for nilfs_direct_propagate() (Xu Wang)
  - Squashfs: check return result of sb_min_blocksize (Phillip Lougher) [Orabug: 38253985] {CVE-2025-38415}
  - ARM: dts: at91: at91sam9263: fix NAND chip selects (Wolfram Sang)
  - ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select (Wolfram Sang)
  - f2fs: fix to correct check conditions in f2fs_cross_rename (Zhiguo Niu)
  - f2fs: use d_inode(dentry) cleanup dentry->d_inode (Zhiguo Niu)
  - calipso: Don't call calipso functions for AF_INET sk. (Kuniyuki Iwashima) [Orabug: 38153070] {CVE-2025-38147}
  - net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy (Thangaraj Samynathan)
  - net: usb: aqc111: fix error handling of usbnet read calls (Nikita Zhandarovich) [Orabug: 38153090] {CVE-2025-38153}
  - netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy (Florian Westphal)
  - wifi: ath9k_htc: Abort software beacon handling if disabled (Toke Høiland-Jørgensen) [Orabug: 38153110] {CVE-2025-38157}
  - bpf: Fix WARN() in get_bpf_raw_tp_regs (Tao Chen) [Orabug: 38180489] {CVE-2025-38285}
  - pinctrl: at91: Fix possible out-of-boundary access (Andy Shevchenko) [Orabug: 38180495] {CVE-2025-38286}
  - ktls, sockmap: Fix missing uncharge operation (Jiayuan Chen)
  - netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it (Huajian Yang)
  - f2fs: clean up w/ fscrypt_is_bounce_page() (Chao Yu)
  - RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h (Junxian Huang)
  - wifi: rtw88: do not ignore hardware read error during DPK (Dmitry Antipov)
  - net: ncsi: Fix GCPS 64-bit member variables (Hari Kalavakunta)
  - f2fs: fix to do sanity check on sbi->total_valid_block_count (Chao Yu) [Orabug: 38153150] {CVE-2025-38163}
  - drm/tegra: rgb: Fix the unbound reference count (Biju Das)
  - drm/vkms: Adjust vkms_state->active_planes allocation type (Kees Cook)
  - drm: rcar-du: Fix memory leak in rcar_du_vsps_init() (Biju Das)
  - selftests/seccomp: fix syscall_restart test for arm compat (Neill Kapron)
  - firmware: psci: Fix refcount leak in psci_dt_init (Miaoqian Lin)
  - m68k: mac: Fix macintosh_config for Mac II (Finn Thain)
  - drm/vmwgfx: Add seqno waiter for sync_files (Ian Forbes)
  - spi: sh-msiof: Fix maximum DMA transfer size (Geert Uytterhoeven)
  - ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions" (Armin Wolf)
  - x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (Jiaqing Zhao)
  - PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks() (Zijun Hu)
  - EDAC/skx_common: Fix general protection fault (Qiuxu Zhuo) [Orabug: 38180525] {CVE-2025-38298}
  - crypto: marvell/cesa - Avoid empty transfer descriptor (Herbert Xu)
  - crypto: marvell/cesa - Handle zero-length skcipher requests (Herbert Xu) [Orabug: 38153190] {CVE-2025-38173}
  - x86/cpu: Sanitize CPUID(0x80000000) output (Ahmed S. Darwish)
  - perf/core: Fix broken throttling when max_samples_per_tick=1 (Qing Wang)
  - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher)
  - netfilter: nft_socket: fix sk refcount leaks (Florian Westphal) [Orabug: 37116555] {CVE-2024-46855}
  - thunderbolt: Do not double dequeue a configuration request (Sergey Senozhatsky) [Orabug: 38158384] {CVE-2025-38174}
  - usb: usbtmc: Fix timeout value in get_stb (Dave Penkler)
  - usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device (Hongyu Xie)
  - usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE (Jiayi Li)
  - pinctrl: armada-37xx: set GPIO output value before setting direction (Gabor Juhos)
  - pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs > 31 (Gabor Juhos)


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.347.2.el8uek]
changelog:
  - rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38236847]
  - kexec: Improve & fix crash_exclude_mem_range() to handle overlapping ranges (Lianbo Jiang) [Orabug: 38134902]
  - module: correctly exit module_kallsyms_on_each_symbol when fn() != 0 (Jon Mediero) [Orabug: 37820709]
  - module: potential uninitialized return in module_kallsyms_on_each_symbol() (Dan Carpenter) [Orabug: 37820709]
  - module: use RCU to synchronize find_module (Christoph Hellwig) [Orabug: 37820709]
  - kallsyms: refactor {,module_}kallsyms_on_each_symbol (Christoph Hellwig) [Orabug: 37820709]


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.347.3.el8uek]
changelog:
  - mm: make page_mapped_in_vma() hugetlb walk aware (Jane Chu) [Orabug: 38146326]
  - mm/rmap: Fix handling of hugetlbfs pages in page_vma_mapped_walk (Zhenwei Pi) [Orabug: 38146326]


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.347.4.el8uek]
changelog:
  - KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38319938]
  - KVM: APIC: add helper func to remove duplicate code in kvm_pv_send_ipi (Miaohe Lin) [Orabug: 38319938]
  - rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169303]


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.347.5.el8uek]
changelog:
  - squashfs: fix memory leak in squashfs_fill_super (Phillip Lougher)
  - netfilter: nf_tables: adjust lockdep assertions handling (Fedor Pchelkin)
  - Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" (Helge Deller)
  - ASoC: ops: dynamically allocate struct snd_ctl_elem_value (Arnd Bergmann)


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.347.6.el8uek]
changelog:
  - net_sched: sch_sfq: move the limit validation (Octavian Purdila) [Orabug: 38377926] {CVE-2025-37752}
  - net_sched: sch_sfq: use a temporary work area for validating configuration (Octavian Purdila) [Orabug: 38377926]
  - net_sched: sch_sfq: don't allow 1 packet limit (Octavian Purdila) [Orabug: 38377926] {CVE-2024-57996}
  - net_sched: sch_sfq: handle bigger packets (Eric Dumazet) [Orabug: 38377926]
  - net_sched: sch_sfq: annotate data-races around q->perturb_period (Eric Dumazet) [Orabug: 38377926]


author: Jack Vogel <jack.vogel@oracle.com> [5.4.17-2136.347.6.1.el8uek]
changelog:
  - x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta)  [Orabug: 38343661]  
  - x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta)  [Orabug: 38343661]  
  - x86/vmscape: Enable the mitigation (Pawan Gupta)  [Orabug: 38343661]  
  - x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta)  [Orabug: 38343661]  
  - x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta)  [Orabug: 38343661]  
  - x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta)  [Orabug: 38343661]  
  - Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta)  [Orabug: 38343661]


author: Jack Vogel <jack.vogel@oracle.com> [5.4.17-2136.347.6.1.el8uek]
changelog:
  - x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta)  [Orabug: 38343661]
  - x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta)  [Orabug: 38343661]
  - x86/vmscape: Enable the mitigation (Pawan Gupta)  [Orabug: 38343661]
  - x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta)  [Orabug: 38343661]
  - x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta)  [Orabug: 38343661]
  - x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta)  [Orabug: 38343661]
  - Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta)  [Orabug: 38343661]


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.347.6.2.el8uek]
changelog:
  - clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro)  [Orabug: 38453918]  {CVE-2025-38499} 
  - vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic)  [Orabug: 38453914]  
  - HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires)  [Orabug: 38453908]  
  - HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires)  [Orabug: 38453904]


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.347.6.2.el8uek]
changelog:
  - clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38453918] {CVE-2025-38499}
  - vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38453914] {CVE-2025-38618}
  - HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38453908] {CVE-2025-38495}
  - HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38453904] {CVE-2025-38494}


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.347.6.4.el8uek]
changelog:
  - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton)  [Orabug: 38501612]  {CVE-2025-38724}


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.347.6.el8uek]
changelog:
  - net_sched: sch_sfq: move the limit validation (Octavian Purdila)  [Orabug: 38377926]  {CVE-2025-37752} 
  - net_sched: sch_sfq: use a temporary work area for validating configuration (Octavian Purdila)  [Orabug: 38377926]  
  - net_sched: sch_sfq: don't allow 1 packet limit (Octavian Purdila)  [Orabug: 38377926]  {CVE-2024-57996} 
  - net_sched: sch_sfq: handle bigger packets (Eric Dumazet)  [Orabug: 38377926]  
  - net_sched: sch_sfq: annotate data-races around q->perturb_period (Eric Dumazet)  [Orabug: 38377926]


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.347.4.el8uek]
changelog:
  - KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38319938,38440302] {CVE-2025-39823}
  - KVM: APIC: add helper func to remove duplicate code in kvm_pv_send_ipi (Miaohe Lin) [Orabug: 38319938]
  - rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169303]


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.347.5.el8uek]
changelog:
  - squashfs: fix memory leak in squashfs_fill_super (Phillip Lougher) [Orabug: 38343661]
  - netfilter: nf_tables: adjust lockdep assertions handling (Fedor Pchelkin)
  - Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" (Helge Deller) [Orabug: 38343661]
  - ASoC: ops: dynamically allocate struct snd_ctl_elem_value (Arnd Bergmann)


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.347.6.el8uek]
changelog:
  - net_sched: sch_sfq: move the limit validation (Octavian Purdila) [Orabug: 38377926,38394593] {CVE-2025-37752}
  - net_sched: sch_sfq: use a temporary work area for validating configuration (Octavian Purdila) [Orabug: 38377926]
  - net_sched: sch_sfq: don't allow 1 packet limit (Octavian Purdila) [Orabug: 38377926] {CVE-2024-57996}
  - net_sched: sch_sfq: handle bigger packets (Eric Dumazet) [Orabug: 38377926]
  - net_sched: sch_sfq: annotate data-races around q->perturb_period (Eric Dumazet) [Orabug: 38377926]


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.348.1.el8uek]
changelog:
  - LTS tag: v5.4.298 (Sherry Yang)
  - Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" (Imre Deak)
  - net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
  - Revert "drm/amdgpu: fix incorrect vm flags to map bo" (Alex Deucher) [Orabug: 38343661]
  - HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [Orabug: 38440228] {CVE-2025-39808}
  - HID: wacom: Add a new Art Pen 2 (Ping Cheng)
  - HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [Orabug: 38440310] {CVE-2025-39824}
  - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [Orabug: 38440277] {CVE-2025-39817}
  - sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [Orabug: 38440251] {CVE-2025-39812}
  - net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts (Rohan G Thomas)
  - net/mlx5e: Set local Xoff after FW update (Alexei Lazar)
  - net/mlx5e: Update and set Xon/Xoff upon port speed set (Alexei Lazar)
  - net/mlx5e: Update and set Xon/Xoff upon MTU set (Alexei Lazar)
  - net: dlink: fix multicast stats being counted incorrectly (Moon Yeounsu)
  - atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [Orabug: 38440347] {CVE-2025-39828}
  - net/atm: remove the atmdev_ops {get, set}sockopt methods (Christoph Hellwig)
  - Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced (Luiz Augusto von Dentz)
  - powerpc/kvm: Fix ifdef to remove build warning (Madhavan Srinivasan)
  - net: ipv4: fix regression in local-broadcast routes (Oscar Maes) [Orabug: 38343661]
  - vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() (Nikolay Kuratov)
  - scsi: core: sysfs: Correct sysfs attributes access rights (Damien Le Moal)
  - ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [Orabug: 38440259] {CVE-2025-39813}
  - pinctrl: STMFX: add missing HAS_IOMEM dependency (Randy Dunlap)
  - LTS tag: v5.4.297 (Sherry Yang)
  - alloc_fdtable(): change calling conventions. (Al Viro)
  - s390/hypfs: Enable limited access during lockdown (Peter Oberparleiter)
  - s390/hypfs: Avoid unnecessary ioctl registration in debugfs (Peter Oberparleiter)
  - ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation (Takashi Iwai)
  - net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate (William Liu)
  - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (William Liu) [Orabug: 38423457] {CVE-2025-39766}
  - ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc (Jason Xing)
  - ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add (Heminhong)
  - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [Orabug: 38343661]
  - scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [Orabug: 38401514] {CVE-2025-39676}
  - usb: xhci: Fix slot_id resource race conflict (Weitao Wang)
  - nfs: fix UAF in direct writes (Josef Bacik) [Orabug: 36596831] {CVE-2024-26958}
  - NFS: Fix up commit deadlocks (Trond Myklebust)
  - cifs: Fix UAF in cifs_demultiplex_thread() (Zhang Xiaoxu) [Orabug: 36983927] {CVE-2023-52572}
  - Bluetooth: fix use-after-free in device_for_each_child() (Dmitry Antipov) [Orabug: 37433654] {CVE-2024-53237}
  - act_mirred: use the backlog for nested calls to mirred ingress (Davide Caratti)
  - net/sched: act_mirred: better wording on protection against excessive stack growth (Davide Caratti)
  - net/sched: act_mirred: refactor the handle of xmit (Wenxu)
  - selftests: forwarding: tc_actions.sh: add matchall mirror test (Jiri Pirko)
  - net: sched: don't expose action qstats to skb_tc_reinsert() (Vlad Buslov)
  - net: sched: extract qstats update code into functions (Vlad Buslov)
  - net: sched: extract bstats update code into function (Vlad Buslov)
  - net: sched: extract common action counters update code into function (Vlad Buslov)
  - mm: perform the mapping_map_writable() check after call_mmap() (Lorenzo Stoakes)
  - mm: update memfd seal write check to include F_SEAL_WRITE (Lorenzo Stoakes)
  - mm: drop the assumption that VM_SHARED always implies writable (Lorenzo Stoakes)
  - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Cong Wang) [Orabug: 37908492] {CVE-2025-37798}
  - sch_qfq: make qfq_qlen_notify() idempotent (Cong Wang)
  - sch_hfsc: make hfsc_qlen_notify() idempotent (Cong Wang) [Orabug: 38158396] {CVE-2025-38177}
  - sch_drr: make drr_qlen_notify() idempotent (Cong Wang)
  - btrfs: populate otime when logging an inode item (Qu Wenruo)
  - media: venus: hfi: explicitly release IRQ during teardown (Jorge Ramirez-Ortiz)
  - f2fs: fix to avoid out-of-boundary access in dnode page (Chao Yu) [Orabug: 38375870] {CVE-2025-38677}
  - media: venus: protect against spurious interrupts during probe (Jorge Ramirez-Ortiz) [Orabug: 38401659] {CVE-2025-39709}
  - media: qcom: camss: cleanup media device allocated resource on error path (Vladimir Zapolskiy)
  - media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. (Ricardo Ribalda)
  - drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS (Imre Deak)
  - pwm: mediatek: Fix duty and period setting (Uwe Kleine-König)
  - pwm: mediatek: Handle hardware enable and clock enable separately (Uwe Kleine-König)
  - pwm: mediatek: Implement .apply() callback (Uwe Kleine-König)
  - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [Orabug: 38401677] {CVE-2025-39713}
  - media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() (Sakari Ailus)
  - media: v4l2-ctrls: always copy the controls on completion (Hans Verkuil)
  - ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig (Damien Le Moal)
  - soc: qcom: mdt_loader: Ensure we don't read past the ELF header (Bjorn Andersson) [Orabug: 38423524] {CVE-2025-39787}
  - rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 (Meagan Lloyd)
  - usb: musb: omap2430: fix device leak at unbind (Johan Hovold)
  - NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug: 38429211] {CVE-2025-39798}
  - NFS: Fix up handling of outstanding layoutcommit in nfs_update_inode() (Trond Myklebust)
  - NFSv4: Fix nfs4_bitmap_copy_adjust() (Trond Myklebust)
  - usb: typec: fusb302: cache PD RX state (Sebastian Reichel)
  - cdc-acm: fix race between initial clearing halt and open (Oliver Neukum)
  - USB: cdc-acm: do not log successful probe on later errors (Johan Hovold)
  - mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock (Breno Leitao) [Orabug: 38423261] {CVE-2025-39736}
  - mm/kmemleak: turn kmemleak_lock and object->lock to raw_spinlock_t (He Zhe)
  - ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (Geoffrey D. Bennett)
  - x86/fpu: Delay instruction pointer fixup until after warning (Dave Hansen)
  - mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery (Andy Shevchenko)
  - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395081] {CVE-2025-38724}
  - pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
  - tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324271] {CVE-2025-38539}
  - usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
  - usb: hub: avoid warm port reset during USB3 disconnect (Mathias Nyman)
  - x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
  - iio: hid-sensor-prox: Fix incorrect OFFSET calculation (Zhang Lixu)
  - f2fs: fix to do sanity check on ino and xnid (Chao Yu) [Orabug: 38180774] {CVE-2025-38347}
  - mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n (Harry Yoo)
  - mm/zsmalloc.c: convert to use kmem_cache_zalloc in cache_alloc_zspage() (Miaohe Lin)
  - drm/sched: Remove optimization that causes hang when killing dependent jobs (Lin Cao)
  - ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351930] {CVE-2025-38664}
  - net: usbnet: Fix the wrong netif_carrier_on() call (Ammar Faizi)
  - net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (John Ernberg)
  - PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (Lukas Wunner)
  - ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value (Li Zhong)
  - comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott) [Orabug: 38254285] {CVE-2025-38481}
  - comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott) [Orabug: 38254272] {CVE-2025-38478}
  - kbuild: Add KBUILD_CPPFLAGS to as-option invocation (Nathan Chancellor)
  - kbuild: add $(CLANG_FLAGS) to KBUILD_CPPFLAGS (Masahiro Yamada)
  - kbuild: Add CLANG_FLAGS to as-instr (Nathan Chancellor)
  - mips: Include KBUILD_CPPFLAGS in CHECKFLAGS invocation (Nathan Chancellor)
  - kbuild: Update assembler calls to use proper flags and language target (Nick Desaulniers)
  - ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS (Nathan Chancellor)
  - usb: dwc3: Ignore late xferNotReady event to prevent halt timeout (Kuen-Han Tsai)
  - USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles (Zenm Chen)
  - usb: storage: realtek_cr: Use correct byte order for bcs->Residue (Thorsten Blum)
  - USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera (Mael Guerin)
  - usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive (Miao Li)
  - iio: proximity: isl29501: fix buffered read on big-endian systems (David Lechner)
  - ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [Orabug: 38401581] {CVE-2025-39689}
  - fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() (Xu Yilun)
  - use uniform permission checks for all mount propagation changes (Al Viro)
  - move_mount: allow to add a mount into an existing group (Pavel Tikhomirov)
  - fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [Orabug: 38401587] {CVE-2025-39691}
  - drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs (Timur Kristóf)
  - drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 (Timur Kristóf)
  - memstick: Fix deadlock by moving removing flag earlier (Jiayi Li)
  - media: venus: Add a check for packet size after reading from shared memory (Vedang Nagar) [Orabug: 38401666] {CVE-2025-39710}
  - media: ov2659: Fix memory leaks in ov2659_probe() (Zhang Shurong)
  - media: usbtv: Lock resolution while streaming (Ludwig Disterhof) [Orabug: 38401684] {CVE-2025-39714}
  - media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (Haoxiang Li)
  - media: gspca: Add bounds checking to firmware parser (Dan Carpenter)
  - soc/tegra: pmc: Ensure power-domains are in a known state (Jonathan Hunter)
  - jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [Orabug: 38423509] {CVE-2025-39782}
  - PCI: endpoint: Fix configfs group removal on driver teardown (Damien Le Moal)
  - PCI: endpoint: Fix configfs group list head handling (Damien Le Moal) [Orabug: 38423515] {CVE-2025-39783}
  - mtd: rawnand: fsmc: Add missing check after DMA map (Thomas Fourier)
  - pwm: imx-tpm: Reset counter if CMOD is 0 (Laurentiu Mihalcea)
  - wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (Nathan Chancellor)
  - zynq_fpga: use sgtable-based scatterlist wrappers (Marek Szyprowski)
  - ata: libata-scsi: Fix ata_to_sense_error() status handling (Damien Le Moal)
  - ext4: fix reserved gdt blocks handling in fsmap (Ojaswin Mujoo)
  - ext4: fix fsmap end of range reporting with bigalloc (Ojaswin Mujoo)
  - ext4: check fast symlink for ea_inode correctly (Andreas Dilger)
  - vt: defkeymap: Map keycodes above 127 to K_HOLE (Myrrh Periwinkle)
  - vt: keyboard: Don't process Unicode characters in K_OFF mode (Myrrh Periwinkle)
  - usb: dwc3: meson-g12a: fix device leaks at unbind (Johan Hovold)
  - usb: gadget: udc: renesas_usb3: fix device leak at unbind (Johan Hovold)
  - usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (Nathan Chancellor)
  - m68k: Fix lost column on framebuffer debug console (Finn Thain)
  - cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (Dan Carpenter)
  - serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [Orabug: 38401729] {CVE-2025-39724}
  - media: uvcvideo: Do not mark valid metadata as invalid (Ricardo Ribalda)
  - media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394816] {CVE-2025-38680}
  - mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() (Waiman Long) [Orabug: 38423265] {CVE-2025-39737}
  - parisc: Makefile: fix a typo in palo.conf (Randy Dunlap)
  - btrfs: fix log tree replay failure due to file with 0 links and extents (Filipe Manana)
  - thunderbolt: Fix copy+paste error in match_service_id() (Eric Biggers)
  - comedi: fix race between polling and detaching (Ian Abbott) [Orabug: 38394854] {CVE-2025-38687}
  - misc: rtsx: usb: Ensure mmc child device is active when card is present (Ricky Wu)
  - drm/amdgpu: fix incorrect vm flags to map bo (Jack Xiao)
  - scsi: lpfc: Remove redundant assignment to avoid memory leak (Jiasheng Jiang)
  - rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe (Meagan Lloyd)
  - pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394867] {CVE-2025-38691}
  - pNFS: Handle RPC size limit for layoutcommits (Sergey Bashirov)
  - pNFS: Fix disk addr range check in block/scsi layout (Sergey Bashirov)
  - pNFS: Fix stripe mapping in block/scsi layout (Sergey Bashirov)
  - net: phy: smsc: add proper reset flags for LAN8710A (Csaba Buday)
  - ipmi: Fix strcpy source and destination the same (Corey Minyard)
  - kconfig: lxdialog: fix 'space' to (de)select options (Yann E. MORIN)
  - kconfig: gconf: fix potential memory leak in renderer_edited() (Masahiro Yamada)
  - kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() (Masahiro Yamada)
  - ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Breno Leitao)
  - scsi: aacraid: Stop using PCI_IRQ_AFFINITY (John Garry)
  - scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (Ranjan Kumar)
  - kconfig: nconf: Ensure null termination where strncpy is used (Shankari Anand)
  - kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c (Suchit Karunakaran)
  - i3c: don't fail if GETHDRCAP is unsupported (Wolfram Sang)
  - PCI: pnv_php: Work around switches with broken presence detection (Timothy Pearson)
  - i3c: add missing include to internal header (Wolfram Sang)
  - media: uvcvideo: Fix bandwidth issue for Alcor camera (Chenchangcheng)
  - media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394880] {CVE-2025-38693}
  - media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394887] {CVE-2025-38694}
  - media: usb: hdpvr: disable zero-length read messages (Wolfram Sang)
  - media: tc358743: Increase FIFO trigger level to 374 (Dave Stevenson)
  - media: tc358743: Return an appropriate colorspace from tc358743_set_fmt (Dave Stevenson)
  - media: tc358743: Check I2C succeeded during probe (Dave Stevenson)
  - pinctrl: stm32: Manage irq affinity settings (Cheick Traore)
  - scsi: mpt3sas: Correctly handle ATA device errors (Damien Le Moal)
  - scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug: 38394894] {CVE-2025-38695}
  - RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423286] {CVE-2025-39742}
  - MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh)
  - jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte) [Orabug: 38394912] {CVE-2025-38697}
  - jfs: Regular file corruption check (Edward Adam Davis) [Orabug: 38394918] {CVE-2025-38698}
  - jfs: truncate good inode pages when hard link is 0 (Lizhi Xu) [Orabug: 38423294] {CVE-2025-39743}
  - scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394925] {CVE-2025-38699}
  - MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} (Shiji Yang)
  - watchdog: dw_wdt: Fix default timeout (Sebastian Reichel)
  - fs/orangefs: use snprintf() instead of sprintf() (Amir Mohammad Jahangirzad)
  - scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated (Showrya M N) [Orabug: 38394931] {CVE-2025-38700}
  - ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394937] {CVE-2025-38701}
  - cifs: Fix calling CIFSFindFirst() for root path without msearch (Pali Rohár)
  - vhost: fail early when __vhost_add_used() fails (Jason Wang)
  - net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 (Álvaro Fernández Rojas)
  - uapi: in6: restore visibility of most IPv6 socket options (Jakub Kicinski)
  - net: ncsi: Fix buffer overflow in fetching version id (Hari Kalavakunta)
  - net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 (Álvaro Fernández Rojas)
  - net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 (Álvaro Fernández Rojas)
  - net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs (Gal Pressman)
  - wifi: iwlegacy: Check rate_idx range after addition (Stanislaw Gruszka)
  - netmem: fix skb_frag_address_safe with unreadable skbs (Mina Almasry)
  - wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. (Thomas Fourier)
  - wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect (Anjaneyulu)
  - wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() (Rand Deeb)
  - net: fec: allow disable coalescing (Jonas Rebmann)
  - (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer (Thomas Fourier)
  - s390/stp: Remove udelay from stp_sync_clock() (Sven Schnelle)
  - wifi: iwlwifi: mvm: fix scan request validation (Avraham Stern)
  - net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() (Alok Tiwari)
  - net: ipv4: fix incorrect MTU in broadcast routes (Oscar Maes)
  - wifi: cfg80211: Fix interface type validation (Ilan Peer)
  - rcu: Protect ->defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423341] {CVE-2025-39749}
  - net: ag71xx: Add missing check after DMA map (Thomas Fourier)
  - et131x: Add missing check after DMA map (Thomas Fourier)
  - be2net: Use correct byte order and format string for TCP seq and ack_seq (Alok Tiwari)
  - s390/time: Use monotonic clock in get_cycles() (Sven Schnelle)
  - wifi: cfg80211: reject HTC bit for management frames (Johannes Berg)
  - ktest.pl: Prevent recursion of default variable options (Steven Rostedt)
  - ASoC: codecs: rt5640: Retry DEVICE_ID verification (Xinxin Wan)
  - ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros (Cristian Ciocaltea)
  - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun) [Orabug: 38423359] {CVE-2025-39751}
  - platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches (Kees Cook)
  - pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() (Gautham R. Shenoy)
  - usb: core: usb_submit_urb: downgrade type check (Oliver Neukum)
  - ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 (Alok Tiwari)
  - ASoC: hdac_hdmi: Rate limit logging on connection and disconnection (Mark Brown)
  - mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() (Ulf Hansson)
  - ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (Breno Leitao)
  - ACPI: processor: fix acpi_object initialization (Sebastian Ott)
  - PM: sleep: console: Fix the black screen issue (Tuhaowen)
  - thermal: sysfs: Return ENODATA instead of EAGAIN for reads (Hsin-Te Yuan)
  - PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() (Rafael J. Wysocki)
  - selftests: tracing: Use mutex_unlock for testing glob filter (Masami Hiramatsu)
  - ARM: tegra: Use I/O memcpy to write to IRAM (Aaron Kling) [Orabug: 38429180] {CVE-2025-39794}
  - gpio: tps65912: check the return value of regmap_update_bits() (Bartosz Golaszewski)
  - ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed (Kuninori Morimoto)
  - ARM: rockchip: fix kernel hang during smp initialization (Alexander Kochetkov) [Orabug: 38423372] {CVE-2025-39752}
  - cpufreq: Exit governor when failed to start old governor (Lifeng Zheng)
  - usb: xhci: Avoid showing errors during surprise removal (Mario Limonciello)
  - usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command (Jay Chen)
  - usb: xhci: Avoid showing warnings for dying controller (Mario Limonciello)
  - selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t (Cynthia Huang)
  - usb: xhci: print xhci->xhc_state when queue_command failed (Su Hui)
  - securityfs: don't pin dentries twice, once is enough... (Al Viro)
  - hfs: fix not erasing deleted b-tree node issue (Viacheslav Dubeyko)
  - drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394995] {CVE-2025-38708}
  - udf: Verify partition map count (Jan Kara)
  - arm64: Handle KCOV __init vs inline mismatches (Kees Cook)
  - hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa)
  - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko) [Orabug: 38395027] {CVE-2025-38713}
  - hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko) [Orabug: 38395033] {CVE-2025-38714}
  - hfs: fix slab-out-of-bounds in hfs_bnode_read() (Viacheslav Dubeyko) [Orabug: 38395039] {CVE-2025-38715}
  - sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395059] {CVE-2025-38718}
  - netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395068] {CVE-2025-38721}
  - udp: also consider secpath when evaluating ipsec use for checksumming (Sabrina Dubroca)
  - ACPI: processor: perflib: Move problematic pr->performance check (Rafael J. Wysocki)
  - ACPI: processor: perflib: Fix initial _PPC limit application (Jiayi Li)
  - Documentation: ACPI: Fix parent device references (Andy Shevchenko)
  - fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423397] {CVE-2025-39756}
  - sunvdc: Balance device refcount in vdc_port_mpgroup_check (Ma Ke)
  - NFSD: detect mismatch of file handle and delegation stateid in OPEN op (Dai Ngo)
  - net: dpaa: fix device leak when querying time stamp info (Johan Hovold)
  - net: gianfar: fix device leak when querying time stamp info (Johan Hovold)
  - netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38401319] {CVE-2025-38727}
  - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423407] {CVE-2025-39757}
  - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395101] {CVE-2025-38729}
  - io_uring: don't use int for ABI (Pavel Begunkov)
  - usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue) [Orabug: 38334898] {CVE-2025-38555}
  - MIPS: mm: tlb-r4k: Uniquify TLB entries on init (Jiaxun Yang)
  - USB: serial: option: add Foxconn T99W709 (Slark Xiao)
  - vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351771,38453914] {CVE-2025-38618}
  - net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351764] {CVE-2025-38617}
  - perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334948] {CVE-2025-38563}
  - perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334959] {CVE-2025-38565}
  - perf/core: Don't leak AUX buffer refcount on allocation failure (Thomas Gleixner)
  - pptp: fix pptp_xmit() error path (Eric Dumazet)
  - smb: client: let recv_done() cleanup before notifying the callers. (Stefan Metzmacher)
  - benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334976] {CVE-2025-38569}
  - net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351786] {CVE-2025-38622}
  - ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334988] {CVE-2025-38572}
  - pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335004] {CVE-2025-38574}
  - netpoll: prevent hanging NAPI when netcons gets enabled (Jakub Kicinski)
  - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401745] {CVE-2025-39730}
  - pci/hotplug/pnv-php: Wrap warnings in macro (Frederic Barrat)
  - pci/hotplug/pnv-php: Improve error msg on power state change failure (Frederic Barrat)
  - usb: chipidea: udc: fix sleeping function called from invalid context (Peter Chen)
  - f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu) [Orabug: 38351895] {CVE-2025-38652}
  - f2fs: fix to avoid panic in f2fs_evict_inode (Chao Yu) [Orabug: 38335025] {CVE-2025-38577}
  - f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu) [Orabug: 38335033] {CVE-2025-38578}
  - rtc: pcf8563: fix incorrect maximum clock rate handling (Brian Masney)
  - rtc: hym8563: fix incorrect maximum clock rate handling (Brian Masney)
  - rtc: ds1307: fix incorrect maximum clock rate handling (Brian Masney)
  - module: Restore the moduleparam prefix length check (Petr Pavlu)
  - bpf: Check flow_dissector ctx accesses are aligned (Paul Chaignon)
  - mtd: rawnand: atmel: set pmecc data setup time (Balamanikandan Gunasundar)
  - mtd: rawnand: atmel: Fix dma_mapping_error() address (Thomas Fourier)
  - jfs: fix metapage reference count leak in dbAllocCtl (Zheng Yu)
  - fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (Chenyuan Yang) [Orabug: 38351831] {CVE-2025-38630}
  - crypto: qat - fix seq_file position update in adf_ring_next() (Giovanni Cabiddu)
  - dmaengine: nbpfaxi: Add missing check after DMA map (Thomas Fourier)
  - dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (Thomas Fourier)
  - fs/orangefs: Allow 2 more characters in do_c_string() (Dan Carpenter)
  - soundwire: stream: restore params when prepare ports fail (Bard Liao)
  - crypto: img-hash - Fix dma_unmap_sg() nents value (Thomas Fourier)
  - hwrng: mtk - handle devm_pm_runtime_enable errors (Ovidiu Panait)
  - watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (Dan Carpenter)
  - scsi: isci: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - scsi: mvsas: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - clk: sunxi-ng: v3s: Fix de clock definition (Paul Kocialkowski)
  - perf tests bp_account: Fix leaked file descriptor (Leo Yan)
  - crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong) [Orabug: 38335042] {CVE-2025-38581}
  - pinctrl: sunxi: Fix memory leak on krealloc failure (Yuan Chen)
  - power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (Charles Han)
  - clk: davinci: Add NULL check in davinci_lpsc_clk_register() (Henry Martin) [Orabug: 38351846] {CVE-2025-38635}
  - mtd: fix possible integer overflow in erase_xfer() (Ivan Stepchenko)
  - crypto: marvell/cesa - Fix engine load inaccuracy (Herbert Xu)
  - PCI: rockchip-host: Fix "Unexpected Completion" log message (Hans Zhang)
  - vrf: Drop existing dst reference in vrf_ip6_input_dst (Stanislav Fomichev)
  - selftests: rtnetlink.sh: remove esp4_offload after test (Xiumei Mu)
  - netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351854] {CVE-2025-38639}
  - can: kvaser_usb: Assign netdev.dev_port based on device channel index (Jimmy Assarsson)
  - can: kvaser_pciefd: Store device channel index (Jimmy Assarsson)
  - wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (Gokul Sivakumar)
  - Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Remi Pommarel)
  - mwl8k: Add missing check after DMA map (Thomas Fourier)
  - wifi: rtl8xxxu: Fix RX skb size for aggregation disabled (Martin Kaistra)
  - net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug: 38331466] {CVE-2025-38553}
  - arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX (Johan Korsnes)
  - drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (Fedor Pchelkin)
  - m68k: Don't unregister boot console needlessly (Finn Thain)
  - tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range (Xin Guo)
  - iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335110] {CVE-2025-38602}
  - wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (Xiu Jianfeng)
  - wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335120] {CVE-2025-38604}
  - caif: reduce stack size, again (Arnd Bergmann)
  - bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure (Yuan Chen)
  - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335131] {CVE-2025-38608}
  - staging: nvec: Fix incorrect null termination of battery manufacturer (Alok Tiwari)
  - samples: mei: Fix building on musl libc (Brahmajit Das)
  - cpufreq: Init policy->rwsem before it may be possibly used (Lifeng Zheng)
  - ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface (Annette Kobou)
  - usb: early: xhci-dbc: Fix early_ioremap leak (Lucas De Marchi)
  - Revert "vmci: Prevent the dispatching of uninitialized payloads" (Greg Kroah-Hartman)
  - pps: fix poll support (Denis Osterland-Heim)
  - vmci: Prevent the dispatching of uninitialized payloads (Lizhi Xu)
  - staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal) [Orabug: 38335153] {CVE-2025-38612}
  - ARM: dts: vfxxx: Correctly use two tuples for timer address (Krzysztof Kozlowski)
  - hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li) [Orabug: 38351890] {CVE-2025-38650}
  - ASoC: Intel: fix SND_SOC_SOF dependencies (Arnd Bergmann)
  - ethernet: intel: fix building with large NR_CPUS (Arnd Bergmann)
  - usb: phy: mxs: disconnect line when USB charger is attached (Xu Yang)
  - usb: chipidea: add USB PHY event (Xu Yang)
  - usb: chipidea: introduce CI_HDRC_CONTROLLER_VBUS_EVENT glue layer use (Peter Chen)
  - usb: chipidea: udc: protect usb interrupt enable (Li Jun)
  - usb: chipidea: udc: add new API ci_hdrc_gadget_connect (Peter Chen)
  - ALSA: hda: Add missing NVIDIA HDA codec IDs (Daniel Dadap)
  - comedi: comedi_test: Fix possible deletion of uninitialized timers (Ian Abbott)
  - nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi) [Orabug: 38351921] {CVE-2025-38663}
  - i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351994] {CVE-2025-38671}
  - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei)
  - net: appletalk: Fix use-after-free in AARP proxy probe (Kito Xu) [Orabug: 38351969] {CVE-2025-38666}
  - net: appletalk: fix kerneldoc warnings (Andrew Lunn)
  - RDMA/core: Rate limit GID cache warning messages (Maor Gottlieb)
  - regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati) [Orabug: 38351978] {CVE-2025-38668}
  - usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
  - usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
  - net_sched: sch_sfq: reject invalid perturb period (Eric Dumazet) [Orabug: 38158477] {CVE-2025-38193}
  - power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition (Zheng Wang)
  - power: supply: bq24190_charger: using pm_runtime_resume_and_get instead of pm_runtime_get_sync (Minghao Chi)
  - power: supply: bq24190_charger: Fix runtime PM imbalance on error (Dinghao Liu)
  - xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
  - virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253834] {CVE-2025-38375}
  - ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
  - usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
  - usb: musb: fix gadget state on disconnect (Drew Hamilton)
  - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254214] {CVE-2025-38468}
  - net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254225] {CVE-2025-38470}
  - Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
  - Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
  - Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
  - Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254241] {CVE-2025-38473}
  - usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254249] {CVE-2025-38474}
  - net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254266] {CVE-2025-38477}
  - net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
  - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott) [Orabug: 38254278] {CVE-2025-38480}
  - comedi: Fix some signed shift left operations (Ian Abbott)
  - comedi: das6402: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254294] {CVE-2025-38482}
  - comedi: das16m1: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254301] {CVE-2025-38483}
  - comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324231] {CVE-2025-38529}
  - comedi: pcl812: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324238] {CVE-2025-38530}
  - iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
  - iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
  - iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
  - soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
  - soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
  - mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
  - mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
  - mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
  - isofs: Verify inode mode when loading from disk (Jan Kara)
  - dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter) [Orabug: 38324264] {CVE-2025-38538}
  - af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
  - af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
  - phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
  - HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254340,38453904] {CVE-2025-38494}
  - HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
  - HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254348,38453908] {CVE-2025-38495}
  - pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
  - Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
  - i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
  - usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254358] {CVE-2025-38497}
  - USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
  - USB: serial: option: add Foxconn T99W640 (Slark Xiao)
  - USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
  - LTS tag: v5.4.296 (Sherry Yang)
  - x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
  - Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID (Hans de Goede)
  - HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324280] {CVE-2025-38540}
  - HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
  - vt: add missing notification when switching back to text mode (Nicolas Pitre)
  - net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
  - atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
  - bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254090] {CVE-2025-38439}
  - bnxt_en: Fix DCB ETS validation (Shravya Kn)
  - can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
  - net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
  - net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu) [Orabug: 38324290] {CVE-2025-38542}
  - md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254109] {CVE-2025-38445}
  - wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324161] {CVE-2025-38513}
  - dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
  - Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
  - Input: xpad - add VID for Turtle Beach controllers (Vicki Pfau)
  - Input: xpad - add support for Amazon Game Controller (Matt Reynolds)
  - NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
  - flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Tigran Mkrtchyan)
  - RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad)
  - netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
  - netlink: make sure we allow at least one dump skb (Jakub Kicinski)
  - Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
  - usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254118] {CVE-2025-38448}
  - drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324180] {CVE-2025-38515}
  - pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324186] {CVE-2025-38516}
  - x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
  - x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
  - x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
  - rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells) [Orabug: 38324172] {CVE-2025-38514}
  - net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254147] {CVE-2025-38457}
  - atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254153] {CVE-2025-38458}
  - atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254161] {CVE-2025-38459}
  - atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324309] {CVE-2025-38546}
  - atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254167] {CVE-2025-38460}
  - tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254181] {CVE-2025-38464}
  - netlink: Fix wraparounds of sk->sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254188] {CVE-2025-38465}
  - fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
  - proc: Clear the pieces of proc_inode that proc_evict_inode cares about (Eric W. Biederman)
  - drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254203] {CVE-2025-38467}
  - staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() (Nathan Chancellor)
  - media: uvcvideo: Rollback non processed entities on error (Ricardo Ribalda)
  - media: uvcvideo: Send control events for partial succeeds (Ricardo Ribalda)
  - media: uvcvideo: Return the number of processed controls (Ricardo Ribalda)
  - ACPI: PAD: fix crash in exit_round_robin() (Seiji Nishikawa) [Orabug: 37206006] {CVE-2024-49935}
  - usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38401436] {CVE-2025-38404}
  - Logitech C-270 even more broken (Oliver Neukum)
  - rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253842] {CVE-2025-38377}
  - net: rose: Fix fall-through warnings for Clang (Gustavo A R Silva)
  - drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253887] {CVE-2025-38389}
  - drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
  - spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
  - spi: spi-fsl-dspi: Fix interrupt-less DMA mode taking an XSPI code path (Vladimir Oltean)
  - spi: spi-fsl-dspi: Rename fifo_{read,write} and {tx,cmd}_fifo_write (Vladimir Oltean)
  - dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
  - ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
  - btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
  - btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
  - RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad)
  - RDMA/core: Create and destroy counters in the ib_core (Leon Romanovsky)
  - scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
  - drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal) [Orabug: 38253821] {CVE-2025-38371}
  - mtk-sd: reset host->mrq on prepare_data() error (Sergey Senozhatsky)
  - mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253928] {CVE-2025-38401}
  - mmc: mediatek: use data instead of mrq parameter from msdc_{un}prepare_data() (Yue Hu)
  - regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253907] {CVE-2025-38395}
  - regulator: gpio: Add input_supply support in gpio_regulator_config (Jerome Neanne)
  - ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253875] {CVE-2025-38386}
  - wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253946] {CVE-2025-38406}
  - wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
  - powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
  - ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
  - ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
  - nui: Fix dma_mapping_error() check (Thomas Fourier)
  - enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
  - amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
  - lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
  - drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
  - btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
  - scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
  - nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253923] {CVE-2025-38400}
  - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253881] {CVE-2025-38387}
  - platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
  - mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
  - usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253894] {CVE-2025-38391}
  - mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
  - vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253937] {CVE-2025-38403}
  - btrfs: don't abort filesystem when attempting to snapshot deleted subvolume (Omar Sandoval) [Orabug: 36530119] {CVE-2024-26644}
  - arm64: Restrict pagetable teardown to avoid false warning (Dev Jain)
  - s390: Add '-std=gnu11' to decompressor and purgatory CFLAGS (Nathan Chancellor)
  - drm/bridge: cdns-dsi: Check return value when getting default PHY config (Aradhya Bhatia)
  - drm/bridge: cdns-dsi: Fix connecting to next bridge (Aradhya Bhatia)
  - drm/bridge: cdns-dsi: Fix the clock variable for mode_valid() (Aradhya Bhatia)
  - drm/tegra: Assign plane type before registration (Thierry Reding)
  - HID: wacom: fix kobject reference count leak (Qasim Ijaz)
  - HID: wacom: fix memory leak on sysfs attribute creation failure (Qasim Ijaz)
  - HID: wacom: fix memory leak on kobject creation failure (Qasim Ijaz)
  - dm-raid: fix variable in journal device check (Heinz Mauelshagen)
  - Bluetooth: L2CAP: Fix L2CAP MTU negotiation (Frédéric Danis)
  - atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). (Kuniyuki Iwashima) [Orabug: 38175045] {CVE-2025-38245}
  - net: enetc: Correct endianness handling in _enetc_rd_reg64 (Simon Horman)
  - um: ubd: Add missing error check in start_io_thread() (Tiwei Bie)
  - vsock/uapi: fix linux/vm_sockets.h userspace compilation errors (Stefano Garzarella)
  - wifi: mac80211: fix beacon interval calculation overflow (Lachlan Hodges)
  - attach_recursive_mnt(): do not lock the covering tree when sliding something under it (Al Viro)
  - ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() (Youngjun Lee) [Orabug: 38175065] {CVE-2025-38249}
  - i2c: robotfuzz-osif: disable zero-length read messages (Wolfram Sang)
  - i2c: tiny-usb: disable zero-length read messages (Wolfram Sang)
  - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Shin'Ichiro Kawasaki) [Orabug: 38158592] {CVE-2025-38211}
  - RDMA/core: Use refcount_t instead of atomic_t on refcount of iwcm_id_private (Weihang Li)
  - media: vivid: Change the siize of the composing (Denis Arefev) [Orabug: 38158681] {CVE-2025-38226}
  - media: omap3isp: use sgtable-based scatterlist wrappers (Marek Szyprowski)
  - media: cxusb: no longer judge rbuf when the write fails (Edward Adam Davis) [Orabug: 38158692] {CVE-2025-38229}
  - media: cxusb: use dev_dbg() rather than hand-rolled debug (Sean Young)
  - jfs: validate AG parameters in dbMount() to prevent crashes (Vasiliy Kovalev) [Orabug: 38158701] {CVE-2025-38230}
  - fs/jfs: consolidate sanity checking in dbMount (Dave Kleikamp)
  - ASoC: meson: meson-card-utils: use of_property_present() for DT parsing (Martin Blumenstingl)
  - of: Add of_property_present() helper (Rob Herring)
  - of: property: define of_property_read_u{8,16,32,64}_array() unconditionally (Michael Walle)
  - kbuild: hdrcheck: fix cross build with clang (Arnd Bergmann)
  - kbuild: add --target to correctly cross-compile UAPI headers with Clang (Masahiro Yamada)
  - bpfilter: match bit size of bpfilter_umh to that of the kernel (Masahiro Yamada)
  - kbuild: use -MMD instead of -MD to exclude system headers from dependency (Masahiro Yamada)
  - VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify (Ma Wupeng) [Orabug: 38152869] {CVE-2025-38102}
  - VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF (George Kennedy)
  - ovl: Check for NULL d_inode() in ovl_dentry_upper() (Kees Cook)
  - ceph: fix possible integer overflow in ceph_zero_objects() (Dmitry Kandybka)
  - ALSA: hda: Ignore unsol events for cards being shut down (Cezary Rojewski)
  - usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode (Jos Wang)
  - usb: cdc-wdm: avoid setting WDM_READ for ZLP-s (Robert Hodaszi)
  - usb: Add checks for snprintf() calls in usb_alloc_dev() (Andy Shevchenko)
  - tty: serial: uartlite: register uart driver in init (Jakub Lewalski) [Orabug: 38175114] {CVE-2025-38262}
  - usb: potential integer overflow in usbg_make_tpg() (Chen Yufeng)
  - iio: pressure: zpa2326: Use aligned_s64 for the timestamp (Jonathan Cameron)
  - md/md-bitmap: fix dm-raid max_write_behind setting (Yu Kuai)
  - dmaengine: xilinx_dma: Set dma_device directions (Thomas Gessler)
  - mfd: max14577: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
  - mailbox: Not protect module_put with spin_lock_irqsave (Peng Fan)
  - cifs: Fix cifs_query_path_info() for Windows NT servers (Pali Rohár)


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.348.2.el8uek]
changelog:
  - uek-rpm: Move ifb module to nano modules (Harshit Mogalapalli) [Orabug: 38443798]
  - clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310007,38453918] {CVE-2025-38499}
  - x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta) [Orabug: 38424094]
  - x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta) [Orabug: 38424094]
  - x86/vmscape: Enable the mitigation (Pawan Gupta) [Orabug: 38424094]
  - x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta) [Orabug: 38424094]
  - x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta) [Orabug: 38424094]
  - x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta) [Orabug: 38424094]
  - Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta) [Orabug: 38424094]


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.348.3.el8uek]
changelog:
  - hugetlbfs: take read_lock on i_mmap for PMD sharing (Waiman Long) [Orabug: 38459576]
  - kallsyms: add module_kallsyms_on_each_symbol_locked (Julian Pidancet) [Orabug: 38418686]
  - kallsyms: export module_kallsyms_on_each_symbol (Julian Pidancet) [Orabug: 38418686]


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.348.3.1.el8uek]
changelog:
  - i40e: add validation for ring_len param (Lukasz Czapnik)  [Orabug: 38604168]  {CVE-2025-39973} 
  - i40e: increase max descriptors for XL710 (Justin Bronder)  [Orabug: 38604168]  {CVE-2025-39973}


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.347.1.el8uek]
changelog:
  - LTS tag: v5.4.295 (Alok Tiwari)
  - scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops (Kees Cook)
  - arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (Tengda Wu) [Orabug: 38180596] {CVE-2025-38320}
  - perf: Fix sample vs do_exit() (Peter Zijlstra) [Orabug: 38254030] {CVE-2025-38424}
  - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Heiko Carstens)
  - rtc: test: Fix invalid format specifier. (David Gow)
  - jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (Jeongjun Park) [Orabug: 38180707] {CVE-2025-38337}
  - mm/huge_memory: fix dereferencing invalid pmd migration entry (Gavin Guo) [Orabug: 37976985] {CVE-2025-37958}
  - rtc: Make rtc_time64_to_tm() support dates before 1970 (Alexandre Mergnat)
  - rtc: Improve performance of rtc_time64_to_tm(). Add tests. (Cassio Neri)
  - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (Dan Aloni) [Orabug: 37101886] {CVE-2022-48773}
  - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [Orabug: 38223087] {CVE-2025-38352}
  - ARM: dts: am335x-bone-common: Increase MDIO reset deassert delay to 50ms (Geert Uytterhoeven)
  - ARM: dts: am335x-bone-common: Increase MDIO reset deassert time (Colin Foster)
  - ARM: dts: am335x-bone-common: Add GPIO PHY reset on revision C3 board (Shengyu Qu)
  - net: atm: fix /proc/net/atm/lec handling (Eric Dumazet) [Orabug: 38158407] {CVE-2025-38180}
  - net: atm: add lec_mutex (Eric Dumazet) [Orabug: 38180612] {CVE-2025-38323}
  - calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). (Kuniyuki Iwashima) [Orabug: 38158413] {CVE-2025-38181}
  - tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (Haixia Qu) [Orabug: 38158425] {CVE-2025-38184}
  - tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior (Neal Cardwell)
  - atm: atmtcp: Free invalid length skb in atmtcp_c_send(). (Kuniyuki Iwashima) [Orabug: 38158434] {CVE-2025-38185}
  - mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (Kuniyuki Iwashima) [Orabug: 38180618] {CVE-2025-38324}
  - wifi: carl9170: do not ping device which has failed to load firmware (Dmitry Antipov) [Orabug: 38254011] {CVE-2025-38420}
  - aoe: clean device rq_list in aoedev_downdev() (Justin Sanders) [Orabug: 38180629] {CVE-2025-38326}
  - hwmon: (occ) fix unaligned accesses (Arnd Bergmann)
  - drm/nouveau/bl: increase buffer size to avoid truncate warning (Jacob Keller)
  - erofs: remove unused trace event erofs_destroy_inode (Gao Xiang)
  - ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged (Jonathan Lane)
  - ALSA: hda/intel: Add Thinkpad E15 to PM deny list (Takashi Iwai)
  - Input: sparcspkr - avoid unannotated fall-through (Yuli Wang)
  - HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (Terry Junge) [Orabug: 38152878] {CVE-2025-38103}
  - atm: Revert atm_account_tx() if copy_from_iter_full() fails. (Kuniyuki Iwashima) [Orabug: 38158458] {CVE-2025-38190}
  - selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len (Stephen Smalley)
  - scsi: s390: zfcp: Ensure synchronous unit_add (Peter Oberparleiter)
  - scsi: storvsc: Increase the timeouts to storvsc_timeout (Dexuan Cui)
  - jffs2: check jffs2_prealloc_raw_node_refs() result in few other places (Fedor Pchelkin) [Orabug: 38180636] {CVE-2025-38328}
  - jffs2: check that raw node were preallocated before writing summary (Artem Sadovnikov) [Orabug: 38158484] {CVE-2025-38194}
  - drivers/rapidio/rio_cm.c: prevent possible heap overwrite (Andrew Morton)
  - powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery (Narayana Murty N)
  - platform/x86: dell_rbu: Stop overwriting data buffer (Stuart Hayes)
  - platform: Add Surface platform directory (Maximilian Luz)
  - Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first" (Alexander Sverdlin)
  - tee: Prevent size calculation wraparound on 32-bit kernels (Jann Horn)
  - ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY (Sukrut Bellary)
  - bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value (Laurentiu Tudor)
  - watchdog: da9052_wdt: respect TWDMIN (Marcus Folkesson)
  - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Kyungwook Boo) [Orabug: 38158518] {CVE-2025-38200}
  - sock: Correct error checking condition for (assign|release)_proto_idx() (Zijun Hu)
  - scsi: lpfc: Use memcpy() for BIOS version (Daniel Wagner) [Orabug: 38180668] {CVE-2025-38332}
  - vxlan: Do not treat dst cache initialization errors as fatal (Ido Schimmel)
  - clk: rockchip: rk3036: mark ddrphy as critical (Heiko Stuebner)
  - wifi: mac80211: do not offer a mesh path if forwarding is disabled (Benjamin Berg)
  - net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info (Jason Xing)
  - pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() (Gabor Juhos)
  - pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction() (Gabor Juhos)
  - pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction() (Gabor Juhos)
  - pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name() (Gabor Juhos)
  - ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT (Sebastian Andrzej Siewior)
  - tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows (Eric Dumazet)
  - tcp: always seek for minimal rtt in tcp_rcv_rtt_update() (Eric Dumazet)
  - net: dlink: add synchronization for stats update (Moon Yeounsu)
  - sctp: Do not wake readers in __sctp_write_space() (Petr Malat)
  - emulex/benet: correct command version selection in be_cmd_get_stats() (Alok Tiwari)
  - i2c: designware: Invoke runtime suspend on quick slave re-registration (Tan En De)
  - net: macb: Check return value of dma_set_mask_and_coherent() (Sergio Perez Gonzalez)
  - cpufreq: Force sync policy boost with global boost on sysfs update (Viresh Kumar)
  - nios2: force update_mmu_cache on spurious tlb-permission--related pagefaults (Simon Schuster)
  - media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() (Xu Wang)
  - media: tc358743: ignore video while HPD is low (Hans Verkuil)
  - drm/amdkfd: Set SDMA_RLCx_IB_CNTL/SWITCH_INSIDE_IB (Amber Lin)
  - jfs: Fix null-ptr-deref in jfs_ioc_trim (Dylan Wolff)
  - drm/amdgpu/gfx9: fix CSIB handling (Alex Deucher)
  - drm/amdgpu/gfx8: fix CSIB handling (Alex Deucher)
  - jfs: fix array-index-out-of-bounds read in add_missing_indices (Aditya Dutt)
  - drm/amdgpu/gfx7: fix CSIB handling (Alex Deucher)
  - drm/amdgpu/gfx10: fix CSIB handling (Alex Deucher)
  - drm/msm/a6xx: Increase HFI response timeout (Akhil P Oommen)
  - drm/amd/display: Add NULL pointer checks in dm_force_atomic_commit() (Srinivasan Shanmugam)
  - media: uapi: v4l: Fix V4L2_TYPE_IS_OUTPUT condition (Nas Chung)
  - drm/msm/hdmi: add runtime PM calls to DDC transfer function (Dmitry Baryshkov)
  - drm/bridge: analogix_dp: Add irq flag IRQF_NO_AUTOEN instead of calling disable_irq() (Damon Ding)
  - sunrpc: update nextcheck time when adding new cache entries (Long Li)
  - drm/amdgpu/gfx6: fix CSIB handling (Alex Deucher)
  - ACPI: battery: negate current when discharging (Peter Marheine)
  - PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() (Charan Teja Kalla)
  - power: supply: bq27xxx: Retrieve again when busy (Jerry Lv)
  - ACPICA: fix acpi parse and parseext cache leaks (Seunghun Han) [Orabug: 38180748] {CVE-2025-38344}
  - ACPICA: Avoid sequence overread in call to strncmp() (Ahmed Salem)
  - ACPICA: fix acpi operand cache leak in dswstate.c (Seunghun Han) [Orabug: 38180756] {CVE-2025-38345}
  - iio: adc: ad7606_spi: fix reg write value mask (David Lechner)
  - PCI: Fix lock symmetry in pci_slot_unlock() (Ilpo Järvinen)
  - PCI: Add ACS quirk for Loongson PCIe (Huacai Chen)
  - uio_hv_generic: Use correct size for interrupt and monitor pages (Long Li)
  - regulator: max14577: Add error check for max14577_read_reg() (Xu Wang)
  - mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS (Khem Raj)
  - staging: iio: ad5933: Correct settling cycles encoding per datasheet (Gabriel)
  - net: ch9200: fix uninitialised access during mii_nway_restart (Qasim Ijaz) [Orabug: 38132189] {CVE-2025-38086}
  - ftrace: Fix UAF when lookup kallsym after ftrace disabled (Ye Bin) [Orabug: 38180768] {CVE-2025-38346}
  - dm-mirror: fix a tiny race condition (Mikulas Patocka)
  - mtd: nand: sunxi: Add randomizer configuration before randomizer enable (Xu Wang)
  - mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk (Xu Wang)
  - mm: fix ratelimit_pages update error in dirty_ratio_handler() (Jinliang Zheng)
  - ipc: fix to protect IPCS lookups using RCU (Jeongjun Park) [Orabug: 38158598] {CVE-2025-38212}
  - parisc: fix building with gcc-15 (Arnd Bergmann)
  - vgacon: Add check for vc_origin address range in vgacon_scroll() (Gong, Ruiqi)
  - fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [Orabug: 38158615] {CVE-2025-38214}
  - EDAC/altera: Use correct write width with the INTTEST register (Niravkumar L Rabara)
  - NFC: nci: uart: Set tty->disc_data only in success path (Krzysztof Kozlowski)
  - f2fs: prevent kernel warning due to negative i_nlink from corrupted image (Jaegeuk Kim)
  - Input: ims-pcu - check record size in ims_pcu_flash_firmware() (Dan Carpenter)
  - ext4: fix calculation of credits for extent tree modification (Jan Kara)
  - ext4: inline: fix len overflow in ext4_prepare_inline_data (Thadeu Lima de Souza Cascardo) [Orabug: 38158662] {CVE-2025-38222}
  - bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device (Ioana Ciornei)
  - ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 (Tasos Sahanidis) [Orabug: 38180697] {CVE-2025-38336}
  - ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap() (Ross Stutterheim)
  - media: v4l2-dev: fix error handling in __video_register_device() (Ma Ke)
  - media: gspca: Add error handling for stv06xx_read_sensor() (Xu Wang)
  - wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723 (Mingcong Bai)
  - nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request (Neil Brown) [Orabug: 38254062] {CVE-2025-38430}
  - wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() (Christian Lamparter) [Orabug: 38180783] {CVE-2025-38348}
  - gfs2: move msleep to sleepable context (Alexander Aring)
  - configfs: Do not override creating attribute file failure in populate_attrs() (Zijun Hu)
  - net: usb: aqc111: debug info before sanitation (Oliver Neukum)
  - calipso: unlock rcu before returning -EAFNOSUPPORT (Eric Dumazet)
  - xen/arm: call uaccess_ttbr0_enable for dm_op hypercall (Stefano Stabellini)
  - usb: Flush altsetting 0 endpoints before reinitializating them after reset. (Mathias Nyman)
  - fs/filesystems: Fix potential unsigned integer underflow in fs_name() (Zijun Hu)
  - net/mdiobus: Fix potential out-of-bounds read/write access (Jakub Raczynski)
  - drm/amd/display: Do not add '-mhard-float' to dcn2{1,0}_resource.o for clang (Nathan Chancellor)
  - drm/amd/display: Do not add '-mhard-float' to dml_ccflags for clang (Nathan Chancellor)
  - MIPS: Move '-Wa,-msoft-float' check from as-option to cc-option (Nathan Chancellor)
  - x86/boot/compressed: prefer cc-option for CFLAGS additions (Nick Desaulniers)
  - net: mdio: C22 is now optional, EOPNOTSUPP if not provided (Andrew Lunn)
  - net_sched: tbf: fix a race in tbf_change() (Eric Dumazet)
  - net_sched: red: fix a race in __red_change() (Eric Dumazet) [Orabug: 38152899] {CVE-2025-38108}
  - net_sched: prio: fix a race in prio_tune() (Eric Dumazet) [Orabug: 38105335] {CVE-2025-38083}
  - net/mlx5: Fix return value when searching for existing flow group (Patrisious Haddad)
  - net/mlx5: Wait for inactive autogroups (Paul Blakey)
  - i40e: retry VFLR handling if there is ongoing VF reset (Robert Malz)
  - i40e: return false from i40e_reset_vf if reset is in progress (Robert Malz)
  - net_sched: sch_sfq: fix a potential crash on gso_skb handling (Eric Dumazet) [Orabug: 38152923] {CVE-2025-38115}
  - scsi: iscsi: Fix incorrect error path labels for flashnode operations (Alok Tiwari)
  - NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes (Chuck Lever) [Orabug: 36954169] {CVE-2022-48829}
  - NFSD: Fix ia_size underflow (Chuck Lever) [Orabug: 36954164] {CVE-2022-48828}
  - Input: synaptics-rmi - fix crash with unsupported versions of F34 (Dmitry Torokhov)
  - Input: synaptics-rmi4 - convert to use sysfs_emit() APIs (Zhang Songyi)
  - pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id() (Dan Carpenter)
  - do_change_type(): refuse to operate on unmounted/not ours mounts (Al Viro) [Orabug: 38256450] {CVE-2025-38498}
  - ice: create new Tx scheduler nodes for new queues only (Michal Kubiak)
  - Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION (Luiz Augusto von Dentz)
  - net/mlx4_en: Prevent potential integer overflow calculating Hz (Dan Carpenter)
  - vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl() (Nicolas Pitre)
  - serial: Fix potential null-ptr-deref in mlb_usio_probe() (Henry Martin)
  - usb: renesas_usbhs: Reorder clock handling and power management in probe (Lad Prabhakar) [Orabug: 38153017] {CVE-2025-38136}
  - rtc: Fix offset calculation for .start_secs < 0 (Alexandre Mergnat)
  - rtc: sh: assign correct interrupts with DT (Wolfram Sang)
  - perf record: Fix incorrect --user-regs comments (Dapeng Mi)
  - perf tests switch-tracking: Fix timestamp comparison (Leo Yan)
  - mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE (Alexey Gladkov)
  - mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove() (Christophe Jaillet)
  - rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() (Dan Carpenter)
  - perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3 (Adrian Hunter)
  - perf ui browser hists: Set actions->thread before calling do_zoom_thread() (Arnaldo Carvalho de Melo)
  - fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (Sergey Shtylyov) [Orabug: 38180566] {CVE-2025-38312}
  - soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() (Henry Martin)
  - soc: aspeed: lpc: Fix impossible judgment condition (Su Hui)
  - arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou (Quentin Schulz)
  - ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device (Dmitry Baryshkov)
  - bus: fsl-mc: fix double-free on mc_dev (Ioana Ciornei)
  - nilfs2: do not propagate ENOENT error from nilfs_btree_propagate() (Ryusuke Konishi)
  - nilfs2: add pointer check for nilfs_direct_propagate() (Xu Wang)
  - Squashfs: check return result of sb_min_blocksize (Phillip Lougher) [Orabug: 38253985] {CVE-2025-38415}
  - ARM: dts: at91: at91sam9263: fix NAND chip selects (Wolfram Sang)
  - ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select (Wolfram Sang)
  - f2fs: fix to correct check conditions in f2fs_cross_rename (Zhiguo Niu)
  - f2fs: use d_inode(dentry) cleanup dentry->d_inode (Zhiguo Niu)
  - calipso: Don't call calipso functions for AF_INET sk. (Kuniyuki Iwashima) [Orabug: 38153070] {CVE-2025-38147}
  - net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy (Thangaraj Samynathan)
  - net: usb: aqc111: fix error handling of usbnet read calls (Nikita Zhandarovich)
  - netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy (Florian Westphal)
  - wifi: ath9k_htc: Abort software beacon handling if disabled (Toke Høiland-Jørgensen) [Orabug: 38153110] {CVE-2025-38157}
  - bpf: Fix WARN() in get_bpf_raw_tp_regs (Tao Chen) [Orabug: 38180489] {CVE-2025-38285}
  - pinctrl: at91: Fix possible out-of-boundary access (Andy Shevchenko)
  - ktls, sockmap: Fix missing uncharge operation (Jiayuan Chen)
  - netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it (Huajian Yang)
  - f2fs: clean up w/ fscrypt_is_bounce_page() (Chao Yu)
  - RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h (Junxian Huang)
  - wifi: rtw88: do not ignore hardware read error during DPK (Dmitry Antipov)
  - net: ncsi: Fix GCPS 64-bit member variables (Hari Kalavakunta)
  - f2fs: fix to do sanity check on sbi->total_valid_block_count (Chao Yu)
  - drm/tegra: rgb: Fix the unbound reference count (Biju Das)
  - drm/vkms: Adjust vkms_state->active_planes allocation type (Kees Cook)
  - drm: rcar-du: Fix memory leak in rcar_du_vsps_init() (Biju Das)
  - selftests/seccomp: fix syscall_restart test for arm compat (Neill Kapron)
  - firmware: psci: Fix refcount leak in psci_dt_init (Miaoqian Lin)
  - m68k: mac: Fix macintosh_config for Mac II (Finn Thain)
  - drm/vmwgfx: Add seqno waiter for sync_files (Ian Forbes)
  - spi: sh-msiof: Fix maximum DMA transfer size (Geert Uytterhoeven)
  - ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions" (Armin Wolf)
  - x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (Jiaqing Zhao)
  - PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks() (Zijun Hu)
  - EDAC/skx_common: Fix general protection fault (Qiuxu Zhuo) [Orabug: 38180525] {CVE-2025-38298}
  - crypto: marvell/cesa - Avoid empty transfer descriptor (Herbert Xu)
  - crypto: marvell/cesa - Handle zero-length skcipher requests (Herbert Xu)
  - x86/cpu: Sanitize CPUID(0x80000000) output (Ahmed S. Darwish)
  - perf/core: Fix broken throttling when max_samples_per_tick=1 (Qing Wang)
  - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher)
  - netfilter: nft_socket: fix sk refcount leaks (Florian Westphal)
  - thunderbolt: Do not double dequeue a configuration request (Sergey Senozhatsky) [Orabug: 38158384] {CVE-2025-38174}
  - usb: usbtmc: Fix timeout value in get_stb (Dave Penkler)
  - usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device (Hongyu Xie)
  - usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE (Jiayi Li)
  - pinctrl: armada-37xx: set GPIO output value before setting direction (Gabor Juhos)
  - pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs > 31 (Gabor Juhos)


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.348.1.el8uek]
changelog:
  - LTS tag: v5.4.298 (Sherry Yang)
  - Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" (Imre Deak)
  - net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
  - Revert "drm/amdgpu: fix incorrect vm flags to map bo" (Alex Deucher) [Orabug: 38343661]
  - HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [Orabug: 38440228] {CVE-2025-39808}
  - HID: wacom: Add a new Art Pen 2 (Ping Cheng)
  - HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [Orabug: 38440310] {CVE-2025-39824}
  - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [Orabug: 38440277] {CVE-2025-39817}
  - sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [Orabug: 38440251] {CVE-2025-39812}
  - net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts (Rohan G Thomas)
  - net/mlx5e: Set local Xoff after FW update (Alexei Lazar)
  - net/mlx5e: Update and set Xon/Xoff upon port speed set (Alexei Lazar)
  - net/mlx5e: Update and set Xon/Xoff upon MTU set (Alexei Lazar)
  - net: dlink: fix multicast stats being counted incorrectly (Moon Yeounsu)
  - atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [Orabug: 38440347] {CVE-2025-39828}
  - net/atm: remove the atmdev_ops {get, set}sockopt methods (Christoph Hellwig)
  - Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced (Luiz Augusto von Dentz)
  - powerpc/kvm: Fix ifdef to remove build warning (Madhavan Srinivasan)
  - net: ipv4: fix regression in local-broadcast routes (Oscar Maes) [Orabug: 38343661]
  - vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() (Nikolay Kuratov)
  - scsi: core: sysfs: Correct sysfs attributes access rights (Damien Le Moal)
  - ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [Orabug: 38440259] {CVE-2025-39813}
  - pinctrl: STMFX: add missing HAS_IOMEM dependency (Randy Dunlap)
  - LTS tag: v5.4.297 (Sherry Yang)
  - alloc_fdtable(): change calling conventions. (Al Viro)
  - s390/hypfs: Enable limited access during lockdown (Peter Oberparleiter)
  - s390/hypfs: Avoid unnecessary ioctl registration in debugfs (Peter Oberparleiter)
  - ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation (Takashi Iwai)
  - net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate (William Liu)
  - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (William Liu)
  - ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc (Jason Xing)
  - ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add (Heminhong)
  - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [Orabug: 38343661]
  - scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [Orabug: 38401514] {CVE-2025-39676}
  - usb: xhci: Fix slot_id resource race conflict (Weitao Wang)
  - nfs: fix UAF in direct writes (Josef Bacik) [Orabug: 36596831] {CVE-2024-26958}
  - NFS: Fix up commit deadlocks (Trond Myklebust)
  - cifs: Fix UAF in cifs_demultiplex_thread() (Zhang Xiaoxu) [Orabug: 36154626] {CVE-2023-1192}
  - Bluetooth: fix use-after-free in device_for_each_child() (Dmitry Antipov) [Orabug: 37433654] {CVE-2024-53237}
  - act_mirred: use the backlog for nested calls to mirred ingress (Davide Caratti)
  - net/sched: act_mirred: better wording on protection against excessive stack growth (Davide Caratti)
  - net/sched: act_mirred: refactor the handle of xmit (Wenxu)
  - selftests: forwarding: tc_actions.sh: add matchall mirror test (Jiri Pirko)
  - net: sched: don't expose action qstats to skb_tc_reinsert() (Vlad Buslov)
  - net: sched: extract qstats update code into functions (Vlad Buslov)
  - net: sched: extract bstats update code into function (Vlad Buslov)
  - net: sched: extract common action counters update code into function (Vlad Buslov)
  - mm: perform the mapping_map_writable() check after call_mmap() (Lorenzo Stoakes)
  - mm: update memfd seal write check to include F_SEAL_WRITE (Lorenzo Stoakes)
  - mm: drop the assumption that VM_SHARED always implies writable (Lorenzo Stoakes)
  - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Cong Wang) [Orabug: 37908492] {CVE-2025-37798}
  - sch_qfq: make qfq_qlen_notify() idempotent (Cong Wang)
  - sch_hfsc: make hfsc_qlen_notify() idempotent (Cong Wang) [Orabug: 38158396] {CVE-2025-38177}
  - sch_drr: make drr_qlen_notify() idempotent (Cong Wang)
  - btrfs: populate otime when logging an inode item (Qu Wenruo)
  - media: venus: hfi: explicitly release IRQ during teardown (Jorge Ramirez-Ortiz)
  - f2fs: fix to avoid out-of-boundary access in dnode page (Chao Yu)
  - media: venus: protect against spurious interrupts during probe (Jorge Ramirez-Ortiz)
  - media: qcom: camss: cleanup media device allocated resource on error path (Vladimir Zapolskiy)
  - media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. (Ricardo Ribalda)
  - drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS (Imre Deak)
  - pwm: mediatek: Fix duty and period setting (Uwe Kleine-König)
  - pwm: mediatek: Handle hardware enable and clock enable separately (Uwe Kleine-König)
  - pwm: mediatek: Implement .apply() callback (Uwe Kleine-König)
  - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [Orabug: 38401677] {CVE-2025-39713}
  - media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() (Sakari Ailus)
  - media: v4l2-ctrls: always copy the controls on completion (Hans Verkuil)
  - ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig (Damien Le Moal)
  - soc: qcom: mdt_loader: Ensure we don't read past the ELF header (Bjorn Andersson)
  - rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 (Meagan Lloyd)
  - usb: musb: omap2430: fix device leak at unbind (Johan Hovold)
  - NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug: 38429211] {CVE-2025-39798}
  - NFS: Fix up handling of outstanding layoutcommit in nfs_update_inode() (Trond Myklebust)
  - NFSv4: Fix nfs4_bitmap_copy_adjust() (Trond Myklebust)
  - usb: typec: fusb302: cache PD RX state (Sebastian Reichel)
  - cdc-acm: fix race between initial clearing halt and open (Oliver Neukum)
  - USB: cdc-acm: do not log successful probe on later errors (Johan Hovold)
  - mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock (Breno Leitao)
  - mm/kmemleak: turn kmemleak_lock and object->lock to raw_spinlock_t (He Zhe)
  - ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (Geoffrey D. Bennett)
  - x86/fpu: Delay instruction pointer fixup until after warning (Dave Hansen)
  - mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery (Andy Shevchenko)
  - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395081] {CVE-2025-38724}
  - pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
  - tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324271] {CVE-2025-38539}
  - usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
  - usb: hub: avoid warm port reset during USB3 disconnect (Mathias Nyman)
  - x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
  - iio: hid-sensor-prox: Fix incorrect OFFSET calculation (Zhang Lixu)
  - f2fs: fix to do sanity check on ino and xnid (Chao Yu)
  - mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n (Harry Yoo)
  - mm/zsmalloc.c: convert to use kmem_cache_zalloc in cache_alloc_zspage() (Miaohe Lin)
  - drm/sched: Remove optimization that causes hang when killing dependent jobs (Lin Cao)
  - ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351930] {CVE-2025-38664}
  - net: usbnet: Fix the wrong netif_carrier_on() call (Ammar Faizi)
  - net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (John Ernberg)
  - PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (Lukas Wunner)
  - ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value (Li Zhong)
  - comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott)
  - comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott)
  - kbuild: Add KBUILD_CPPFLAGS to as-option invocation (Nathan Chancellor)
  - kbuild: add $(CLANG_FLAGS) to KBUILD_CPPFLAGS (Masahiro Yamada)
  - kbuild: Add CLANG_FLAGS to as-instr (Nathan Chancellor)
  - mips: Include KBUILD_CPPFLAGS in CHECKFLAGS invocation (Nathan Chancellor)
  - kbuild: Update assembler calls to use proper flags and language target (Nick Desaulniers)
  - ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS (Nathan Chancellor)
  - usb: dwc3: Ignore late xferNotReady event to prevent halt timeout (Kuen-Han Tsai)
  - USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles (Zenm Chen)
  - usb: storage: realtek_cr: Use correct byte order for bcs->Residue (Thorsten Blum)
  - USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera (Mael Guerin)
  - usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive (Miao Li)
  - iio: proximity: isl29501: fix buffered read on big-endian systems (David Lechner)
  - ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [Orabug: 38401581] {CVE-2025-39689}
  - fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() (Xu Yilun)
  - use uniform permission checks for all mount propagation changes (Al Viro)
  - move_mount: allow to add a mount into an existing group (Pavel Tikhomirov)
  - fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [Orabug: 38401587] {CVE-2025-39691}
  - drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs (Timur Kristóf)
  - drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 (Timur Kristóf)
  - memstick: Fix deadlock by moving removing flag earlier (Jiayi Li)
  - media: venus: Add a check for packet size after reading from shared memory (Vedang Nagar)
  - media: ov2659: Fix memory leaks in ov2659_probe() (Zhang Shurong)
  - media: usbtv: Lock resolution while streaming (Ludwig Disterhof) [Orabug: 38401684] {CVE-2025-39714}
  - media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (Haoxiang Li)
  - media: gspca: Add bounds checking to firmware parser (Dan Carpenter)
  - soc/tegra: pmc: Ensure power-domains are in a known state (Jonathan Hunter)
  - jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [Orabug: 38423509] {CVE-2025-39782}
  - PCI: endpoint: Fix configfs group removal on driver teardown (Damien Le Moal)
  - PCI: endpoint: Fix configfs group list head handling (Damien Le Moal)
  - mtd: rawnand: fsmc: Add missing check after DMA map (Thomas Fourier)
  - pwm: imx-tpm: Reset counter if CMOD is 0 (Laurentiu Mihalcea)
  - wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (Nathan Chancellor)
  - zynq_fpga: use sgtable-based scatterlist wrappers (Marek Szyprowski)
  - ata: libata-scsi: Fix ata_to_sense_error() status handling (Damien Le Moal)
  - ext4: fix reserved gdt blocks handling in fsmap (Ojaswin Mujoo)
  - ext4: fix fsmap end of range reporting with bigalloc (Ojaswin Mujoo)
  - ext4: check fast symlink for ea_inode correctly (Andreas Dilger)
  - vt: defkeymap: Map keycodes above 127 to K_HOLE (Myrrh Periwinkle)
  - vt: keyboard: Don't process Unicode characters in K_OFF mode (Myrrh Periwinkle)
  - usb: dwc3: meson-g12a: fix device leaks at unbind (Johan Hovold)
  - usb: gadget: udc: renesas_usb3: fix device leak at unbind (Johan Hovold)
  - usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (Nathan Chancellor)
  - m68k: Fix lost column on framebuffer debug console (Finn Thain)
  - cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (Dan Carpenter)
  - serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [Orabug: 38401729] {CVE-2025-39724}
  - media: uvcvideo: Do not mark valid metadata as invalid (Ricardo Ribalda)
  - media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394816] {CVE-2025-38680}
  - mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() (Waiman Long)
  - parisc: Makefile: fix a typo in palo.conf (Randy Dunlap)
  - btrfs: fix log tree replay failure due to file with 0 links and extents (Filipe Manana)
  - thunderbolt: Fix copy+paste error in match_service_id() (Eric Biggers)
  - comedi: fix race between polling and detaching (Ian Abbott)
  - misc: rtsx: usb: Ensure mmc child device is active when card is present (Ricky Wu)
  - drm/amdgpu: fix incorrect vm flags to map bo (Jack Xiao)
  - scsi: lpfc: Remove redundant assignment to avoid memory leak (Jiasheng Jiang)
  - rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe (Meagan Lloyd)
  - pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394867] {CVE-2025-38691}
  - pNFS: Handle RPC size limit for layoutcommits (Sergey Bashirov)
  - pNFS: Fix disk addr range check in block/scsi layout (Sergey Bashirov)
  - pNFS: Fix stripe mapping in block/scsi layout (Sergey Bashirov)
  - net: phy: smsc: add proper reset flags for LAN8710A (Csaba Buday)
  - ipmi: Fix strcpy source and destination the same (Corey Minyard)
  - kconfig: lxdialog: fix 'space' to (de)select options (Yann E. MORIN)
  - kconfig: gconf: fix potential memory leak in renderer_edited() (Masahiro Yamada)
  - kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() (Masahiro Yamada)
  - ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Breno Leitao)
  - scsi: aacraid: Stop using PCI_IRQ_AFFINITY (John Garry)
  - scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (Ranjan Kumar)
  - kconfig: nconf: Ensure null termination where strncpy is used (Shankari Anand)
  - kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c (Suchit Karunakaran)
  - i3c: don't fail if GETHDRCAP is unsupported (Wolfram Sang)
  - PCI: pnv_php: Work around switches with broken presence detection (Timothy Pearson)
  - i3c: add missing include to internal header (Wolfram Sang)
  - media: uvcvideo: Fix bandwidth issue for Alcor camera (Chenchangcheng)
  - media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394880] {CVE-2025-38693}
  - media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394887] {CVE-2025-38694}
  - media: usb: hdpvr: disable zero-length read messages (Wolfram Sang)
  - media: tc358743: Increase FIFO trigger level to 374 (Dave Stevenson)
  - media: tc358743: Return an appropriate colorspace from tc358743_set_fmt (Dave Stevenson)
  - media: tc358743: Check I2C succeeded during probe (Dave Stevenson)
  - pinctrl: stm32: Manage irq affinity settings (Cheick Traore)
  - scsi: mpt3sas: Correctly handle ATA device errors (Damien Le Moal)
  - scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug: 38394894] {CVE-2025-38695}
  - RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423286] {CVE-2025-39742}
  - MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh)
  - jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte)
  - jfs: Regular file corruption check (Edward Adam Davis)
  - jfs: truncate good inode pages when hard link is 0 (Lizhi Xu)
  - scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394925] {CVE-2025-38699}
  - MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} (Shiji Yang)
  - watchdog: dw_wdt: Fix default timeout (Sebastian Reichel)
  - fs/orangefs: use snprintf() instead of sprintf() (Amir Mohammad Jahangirzad)
  - scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated (Showrya M N) [Orabug: 38394931] {CVE-2025-38700}
  - ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394937] {CVE-2025-38701}
  - cifs: Fix calling CIFSFindFirst() for root path without msearch (Pali Rohár)
  - vhost: fail early when __vhost_add_used() fails (Jason Wang)
  - net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 (Álvaro Fernández Rojas)
  - uapi: in6: restore visibility of most IPv6 socket options (Jakub Kicinski)
  - net: ncsi: Fix buffer overflow in fetching version id (Hari Kalavakunta)
  - net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 (Álvaro Fernández Rojas)
  - net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 (Álvaro Fernández Rojas)
  - net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs (Gal Pressman)
  - wifi: iwlegacy: Check rate_idx range after addition (Stanislaw Gruszka)
  - netmem: fix skb_frag_address_safe with unreadable skbs (Mina Almasry)
  - wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. (Thomas Fourier)
  - wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect (Anjaneyulu)
  - wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() (Rand Deeb)
  - net: fec: allow disable coalescing (Jonas Rebmann)
  - (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer (Thomas Fourier)
  - s390/stp: Remove udelay from stp_sync_clock() (Sven Schnelle)
  - wifi: iwlwifi: mvm: fix scan request validation (Avraham Stern)
  - net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() (Alok Tiwari)
  - net: ipv4: fix incorrect MTU in broadcast routes (Oscar Maes)
  - wifi: cfg80211: Fix interface type validation (Ilan Peer)
  - rcu: Protect ->defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423341] {CVE-2025-39749}
  - net: ag71xx: Add missing check after DMA map (Thomas Fourier)
  - et131x: Add missing check after DMA map (Thomas Fourier)
  - be2net: Use correct byte order and format string for TCP seq and ack_seq (Alok Tiwari)
  - s390/time: Use monotonic clock in get_cycles() (Sven Schnelle)
  - wifi: cfg80211: reject HTC bit for management frames (Johannes Berg)
  - ktest.pl: Prevent recursion of default variable options (Steven Rostedt)
  - ASoC: codecs: rt5640: Retry DEVICE_ID verification (Xinxin Wan)
  - ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros (Cristian Ciocaltea)
  - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun) [Orabug: 38423359] {CVE-2025-39751}
  - platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches (Kees Cook)
  - pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() (Gautham R. Shenoy)
  - usb: core: usb_submit_urb: downgrade type check (Oliver Neukum)
  - ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 (Alok Tiwari)
  - ASoC: hdac_hdmi: Rate limit logging on connection and disconnection (Mark Brown)
  - mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() (Ulf Hansson)
  - ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (Breno Leitao)
  - ACPI: processor: fix acpi_object initialization (Sebastian Ott)
  - PM: sleep: console: Fix the black screen issue (Tuhaowen)
  - thermal: sysfs: Return ENODATA instead of EAGAIN for reads (Hsin-Te Yuan)
  - PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() (Rafael J. Wysocki)
  - selftests: tracing: Use mutex_unlock for testing glob filter (Masami Hiramatsu)
  - ARM: tegra: Use I/O memcpy to write to IRAM (Aaron Kling)
  - gpio: tps65912: check the return value of regmap_update_bits() (Bartosz Golaszewski)
  - ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed (Kuninori Morimoto)
  - ARM: rockchip: fix kernel hang during smp initialization (Alexander Kochetkov)
  - cpufreq: Exit governor when failed to start old governor (Lifeng Zheng)
  - usb: xhci: Avoid showing errors during surprise removal (Mario Limonciello)
  - usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command (Jay Chen)
  - usb: xhci: Avoid showing warnings for dying controller (Mario Limonciello)
  - selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t (Cynthia Huang)
  - usb: xhci: print xhci->xhc_state when queue_command failed (Su Hui)
  - securityfs: don't pin dentries twice, once is enough... (Al Viro)
  - hfs: fix not erasing deleted b-tree node issue (Viacheslav Dubeyko)
  - drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394995] {CVE-2025-38708}
  - udf: Verify partition map count (Jan Kara)
  - arm64: Handle KCOV __init vs inline mismatches (Kees Cook)
  - hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa)
  - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko)
  - hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko)
  - hfs: fix slab-out-of-bounds in hfs_bnode_read() (Viacheslav Dubeyko)
  - sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395059] {CVE-2025-38718}
  - netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395068] {CVE-2025-38721}
  - udp: also consider secpath when evaluating ipsec use for checksumming (Sabrina Dubroca)
  - ACPI: processor: perflib: Move problematic pr->performance check (Rafael J. Wysocki) [Orabug: 38429229] {CVE-2025-39799}
  - ACPI: processor: perflib: Fix initial _PPC limit application (Jiayi Li)
  - Documentation: ACPI: Fix parent device references (Andy Shevchenko)
  - fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423397] {CVE-2025-39756}
  - sunvdc: Balance device refcount in vdc_port_mpgroup_check (Ma Ke)
  - NFSD: detect mismatch of file handle and delegation stateid in OPEN op (Dai Ngo)
  - net: dpaa: fix device leak when querying time stamp info (Johan Hovold)
  - net: gianfar: fix device leak when querying time stamp info (Johan Hovold)
  - netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38401319] {CVE-2025-38727}
  - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423407] {CVE-2025-39757}
  - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395101] {CVE-2025-38729}
  - io_uring: don't use int for ABI (Pavel Begunkov)
  - usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue) [Orabug: 38334898] {CVE-2025-38555}
  - MIPS: mm: tlb-r4k: Uniquify TLB entries on init (Jiaxun Yang)
  - USB: serial: option: add Foxconn T99W709 (Slark Xiao)
  - vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351771] {CVE-2025-38618}
  - net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351764] {CVE-2025-38617}
  - perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334948] {CVE-2025-38563}
  - perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334959] {CVE-2025-38565}
  - perf/core: Don't leak AUX buffer refcount on allocation failure (Thomas Gleixner)
  - pptp: fix pptp_xmit() error path (Eric Dumazet)
  - smb: client: let recv_done() cleanup before notifying the callers. (Stefan Metzmacher)
  - benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334976] {CVE-2025-38569}
  - net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351786] {CVE-2025-38622}
  - ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334988] {CVE-2025-38572}
  - pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335004] {CVE-2025-38574}
  - netpoll: prevent hanging NAPI when netcons gets enabled (Jakub Kicinski)
  - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401745] {CVE-2025-39730}
  - pci/hotplug/pnv-php: Wrap warnings in macro (Frederic Barrat)
  - pci/hotplug/pnv-php: Improve error msg on power state change failure (Frederic Barrat)
  - usb: chipidea: udc: fix sleeping function called from invalid context (Peter Chen)
  - f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu)
  - f2fs: fix to avoid panic in f2fs_evict_inode (Chao Yu)
  - f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu)
  - rtc: pcf8563: fix incorrect maximum clock rate handling (Brian Masney)
  - rtc: hym8563: fix incorrect maximum clock rate handling (Brian Masney)
  - rtc: ds1307: fix incorrect maximum clock rate handling (Brian Masney)
  - module: Restore the moduleparam prefix length check (Petr Pavlu)
  - bpf: Check flow_dissector ctx accesses are aligned (Paul Chaignon)
  - mtd: rawnand: atmel: set pmecc data setup time (Balamanikandan Gunasundar)
  - mtd: rawnand: atmel: Fix dma_mapping_error() address (Thomas Fourier)
  - jfs: fix metapage reference count leak in dbAllocCtl (Zheng Yu)
  - fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (Chenyuan Yang)
  - crypto: qat - fix seq_file position update in adf_ring_next() (Giovanni Cabiddu)
  - dmaengine: nbpfaxi: Add missing check after DMA map (Thomas Fourier)
  - dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (Thomas Fourier)
  - fs/orangefs: Allow 2 more characters in do_c_string() (Dan Carpenter)
  - soundwire: stream: restore params when prepare ports fail (Bard Liao)
  - crypto: img-hash - Fix dma_unmap_sg() nents value (Thomas Fourier)
  - hwrng: mtk - handle devm_pm_runtime_enable errors (Ovidiu Panait)
  - watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (Dan Carpenter)
  - scsi: isci: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - scsi: mvsas: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - clk: sunxi-ng: v3s: Fix de clock definition (Paul Kocialkowski)
  - perf tests bp_account: Fix leaked file descriptor (Leo Yan)
  - crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong)
  - pinctrl: sunxi: Fix memory leak on krealloc failure (Yuan Chen)
  - power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (Charles Han)
  - clk: davinci: Add NULL check in davinci_lpsc_clk_register() (Henry Martin)
  - mtd: fix possible integer overflow in erase_xfer() (Ivan Stepchenko)
  - crypto: marvell/cesa - Fix engine load inaccuracy (Herbert Xu)
  - PCI: rockchip-host: Fix "Unexpected Completion" log message (Hans Zhang)
  - vrf: Drop existing dst reference in vrf_ip6_input_dst (Stanislav Fomichev)
  - selftests: rtnetlink.sh: remove esp4_offload after test (Xiumei Mu)
  - netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351854] {CVE-2025-38639}
  - can: kvaser_usb: Assign netdev.dev_port based on device channel index (Jimmy Assarsson)
  - can: kvaser_pciefd: Store device channel index (Jimmy Assarsson)
  - wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (Gokul Sivakumar)
  - Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Remi Pommarel)
  - mwl8k: Add missing check after DMA map (Thomas Fourier)
  - wifi: rtl8xxxu: Fix RX skb size for aggregation disabled (Martin Kaistra)
  - net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug: 38331466] {CVE-2025-38553}
  - arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX (Johan Korsnes)
  - drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (Fedor Pchelkin)
  - m68k: Don't unregister boot console needlessly (Finn Thain)
  - tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range (Xin Guo)
  - iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335110] {CVE-2025-38602}
  - wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (Xiu Jianfeng)
  - wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335120] {CVE-2025-38604}
  - caif: reduce stack size, again (Arnd Bergmann)
  - bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure (Yuan Chen)
  - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335131] {CVE-2025-38608}
  - staging: nvec: Fix incorrect null termination of battery manufacturer (Alok Tiwari)
  - samples: mei: Fix building on musl libc (Brahmajit Das)
  - cpufreq: Init policy->rwsem before it may be possibly used (Lifeng Zheng)
  - ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface (Annette Kobou)
  - usb: early: xhci-dbc: Fix early_ioremap leak (Lucas De Marchi)
  - Revert "vmci: Prevent the dispatching of uninitialized payloads" (Greg Kroah-Hartman)
  - pps: fix poll support (Denis Osterland-Heim)
  - vmci: Prevent the dispatching of uninitialized payloads (Lizhi Xu)
  - staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal) [Orabug: 38335153] {CVE-2025-38612}
  - ARM: dts: vfxxx: Correctly use two tuples for timer address (Krzysztof Kozlowski)
  - hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li)
  - ASoC: Intel: fix SND_SOC_SOF dependencies (Arnd Bergmann)
  - ethernet: intel: fix building with large NR_CPUS (Arnd Bergmann)
  - usb: phy: mxs: disconnect line when USB charger is attached (Xu Yang)
  - usb: chipidea: add USB PHY event (Xu Yang)
  - usb: chipidea: introduce CI_HDRC_CONTROLLER_VBUS_EVENT glue layer use (Peter Chen)
  - usb: chipidea: udc: protect usb interrupt enable (Li Jun)
  - usb: chipidea: udc: add new API ci_hdrc_gadget_connect (Peter Chen)
  - ALSA: hda: Add missing NVIDIA HDA codec IDs (Daniel Dadap)
  - comedi: comedi_test: Fix possible deletion of uninitialized timers (Ian Abbott)
  - nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi)
  - i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351994] {CVE-2025-38671}
  - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei)
  - net: appletalk: Fix use-after-free in AARP proxy probe (Kito Xu)
  - net: appletalk: fix kerneldoc warnings (Andrew Lunn)
  - RDMA/core: Rate limit GID cache warning messages (Maor Gottlieb)
  - regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati) [Orabug: 38351978] {CVE-2025-38668}
  - usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
  - usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
  - net_sched: sch_sfq: reject invalid perturb period (Eric Dumazet) [Orabug: 38158477] {CVE-2025-38193}
  - power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition (Zheng Wang)
  - power: supply: bq24190_charger: using pm_runtime_resume_and_get instead of pm_runtime_get_sync (Minghao Chi)
  - power: supply: bq24190_charger: Fix runtime PM imbalance on error (Dinghao Liu)
  - xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
  - virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253834] {CVE-2025-38375}
  - ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
  - usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
  - usb: musb: fix gadget state on disconnect (Drew Hamilton)
  - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254214] {CVE-2025-38468}
  - net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254225] {CVE-2025-38470}
  - Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
  - Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
  - Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
  - Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254241] {CVE-2025-38473}
  - usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254249] {CVE-2025-38474}
  - net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254266] {CVE-2025-38477}
  - net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
  - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott)
  - comedi: Fix some signed shift left operations (Ian Abbott)
  - comedi: das6402: Fix bit shift out of bounds (Ian Abbott)
  - comedi: das16m1: Fix bit shift out of bounds (Ian Abbott)
  - comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott)
  - comedi: pcl812: Fix bit shift out of bounds (Ian Abbott)
  - iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
  - iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
  - iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
  - soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
  - soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
  - mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
  - mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
  - mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
  - isofs: Verify inode mode when loading from disk (Jan Kara)
  - dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter)
  - af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
  - af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
  - phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
  - HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254340] {CVE-2025-38494}
  - HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
  - HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254348] {CVE-2025-38495}
  - pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
  - Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
  - i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
  - usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254358] {CVE-2025-38497}
  - USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
  - USB: serial: option: add Foxconn T99W640 (Slark Xiao)
  - USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
  - LTS tag: v5.4.296 (Sherry Yang)
  - x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
  - Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID (Hans de Goede)
  - HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324280] {CVE-2025-38540}
  - HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
  - vt: add missing notification when switching back to text mode (Nicolas Pitre)
  - net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
  - atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
  - bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254090] {CVE-2025-38439}
  - bnxt_en: Fix DCB ETS validation (Shravya Kn)
  - can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
  - net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
  - net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu)
  - md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254109] {CVE-2025-38445}
  - wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324161] {CVE-2025-38513}
  - dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
  - Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
  - Input: xpad - add VID for Turtle Beach controllers (Vicki Pfau)
  - Input: xpad - add support for Amazon Game Controller (Matt Reynolds)
  - NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
  - flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Tigran Mkrtchyan)
  - RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad)
  - netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
  - netlink: make sure we allow at least one dump skb (Jakub Kicinski)
  - Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
  - usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254118] {CVE-2025-38448}
  - drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324180] {CVE-2025-38515}
  - pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324186] {CVE-2025-38516}
  - x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
  - x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
  - x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
  - rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells)
  - net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254147] {CVE-2025-38457}
  - atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254153] {CVE-2025-38458}
  - atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254161] {CVE-2025-38459}
  - atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324309] {CVE-2025-38546}
  - atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254167] {CVE-2025-38460}
  - tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254181] {CVE-2025-38464}
  - netlink: Fix wraparounds of sk->sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254188] {CVE-2025-38465}
  - fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
  - proc: Clear the pieces of proc_inode that proc_evict_inode cares about (Eric W. Biederman)
  - drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254203] {CVE-2025-38467}
  - staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() (Nathan Chancellor)
  - media: uvcvideo: Rollback non processed entities on error (Ricardo Ribalda)
  - media: uvcvideo: Send control events for partial succeeds (Ricardo Ribalda)
  - media: uvcvideo: Return the number of processed controls (Ricardo Ribalda)
  - ACPI: PAD: fix crash in exit_round_robin() (Seiji Nishikawa) [Orabug: 37206006] {CVE-2024-49935}
  - usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38401436] {CVE-2025-38404}
  - Logitech C-270 even more broken (Oliver Neukum)
  - rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju)
  - net: rose: Fix fall-through warnings for Clang (Gustavo A R Silva)
  - drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253887] {CVE-2025-38389}
  - drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
  - spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
  - spi: spi-fsl-dspi: Fix interrupt-less DMA mode taking an XSPI code path (Vladimir Oltean)
  - spi: spi-fsl-dspi: Rename fifo_{read,write} and {tx,cmd}_fifo_write (Vladimir Oltean)
  - dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
  - ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
  - btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
  - btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
  - RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad)
  - RDMA/core: Create and destroy counters in the ib_core (Leon Romanovsky)
  - scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
  - drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal)
  - mtk-sd: reset host->mrq on prepare_data() error (Sergey Senozhatsky)
  - mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu)
  - mmc: mediatek: use data instead of mrq parameter from msdc_{un}prepare_data() (Yue Hu)
  - regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253907] {CVE-2025-38395}
  - regulator: gpio: Add input_supply support in gpio_regulator_config (Jerome Neanne)
  - ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253875] {CVE-2025-38386}
  - wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253946] {CVE-2025-38406}
  - wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
  - powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
  - ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
  - ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
  - nui: Fix dma_mapping_error() check (Thomas Fourier)
  - enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
  - amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
  - lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
  - drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
  - btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
  - scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
  - nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253923] {CVE-2025-38400}
  - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253881] {CVE-2025-38387}
  - platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
  - mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
  - usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253894] {CVE-2025-38391}
  - mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
  - vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253937] {CVE-2025-38403}
  - btrfs: don't abort filesystem when attempting to snapshot deleted subvolume (Omar Sandoval) [Orabug: 36530119] {CVE-2024-26644}
  - arm64: Restrict pagetable teardown to avoid false warning (Dev Jain)
  - s390: Add '-std=gnu11' to decompressor and purgatory CFLAGS (Nathan Chancellor)
  - drm/bridge: cdns-dsi: Check return value when getting default PHY config (Aradhya Bhatia)
  - drm/bridge: cdns-dsi: Fix connecting to next bridge (Aradhya Bhatia)
  - drm/bridge: cdns-dsi: Fix the clock variable for mode_valid() (Aradhya Bhatia)
  - drm/tegra: Assign plane type before registration (Thierry Reding)
  - HID: wacom: fix kobject reference count leak (Qasim Ijaz)
  - HID: wacom: fix memory leak on sysfs attribute creation failure (Qasim Ijaz)
  - HID: wacom: fix memory leak on kobject creation failure (Qasim Ijaz)
  - dm-raid: fix variable in journal device check (Heinz Mauelshagen)
  - Bluetooth: L2CAP: Fix L2CAP MTU negotiation (Frédéric Danis)
  - atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). (Kuniyuki Iwashima) [Orabug: 38175045] {CVE-2025-38245}
  - net: enetc: Correct endianness handling in _enetc_rd_reg64 (Simon Horman)
  - um: ubd: Add missing error check in start_io_thread() (Tiwei Bie)
  - vsock/uapi: fix linux/vm_sockets.h userspace compilation errors (Stefano Garzarella)
  - wifi: mac80211: fix beacon interval calculation overflow (Lachlan Hodges)
  - attach_recursive_mnt(): do not lock the covering tree when sliding something under it (Al Viro)
  - ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() (Youngjun Lee) [Orabug: 38175065] {CVE-2025-38249}
  - i2c: robotfuzz-osif: disable zero-length read messages (Wolfram Sang)
  - i2c: tiny-usb: disable zero-length read messages (Wolfram Sang)
  - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Shin'Ichiro Kawasaki) [Orabug: 38158592] {CVE-2025-38211}
  - RDMA/core: Use refcount_t instead of atomic_t on refcount of iwcm_id_private (Weihang Li)
  - media: vivid: Change the siize of the composing (Denis Arefev)
  - media: omap3isp: use sgtable-based scatterlist wrappers (Marek Szyprowski)
  - media: cxusb: no longer judge rbuf when the write fails (Edward Adam Davis) [Orabug: 38158692] {CVE-2025-38229}
  - media: cxusb: use dev_dbg() rather than hand-rolled debug (Sean Young)
  - jfs: validate AG parameters in dbMount() to prevent crashes (Vasiliy Kovalev)
  - fs/jfs: consolidate sanity checking in dbMount (Dave Kleikamp)
  - ASoC: meson: meson-card-utils: use of_property_present() for DT parsing (Martin Blumenstingl)
  - of: Add of_property_present() helper (Rob Herring)
  - of: property: define of_property_read_u{8,16,32,64}_array() unconditionally (Michael Walle)
  - kbuild: hdrcheck: fix cross build with clang (Arnd Bergmann)
  - kbuild: add --target to correctly cross-compile UAPI headers with Clang (Masahiro Yamada)
  - bpfilter: match bit size of bpfilter_umh to that of the kernel (Masahiro Yamada)
  - kbuild: use -MMD instead of -MD to exclude system headers from dependency (Masahiro Yamada)
  - VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify (Ma Wupeng) [Orabug: 38152869] {CVE-2025-38102}
  - VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF (George Kennedy)
  - ovl: Check for NULL d_inode() in ovl_dentry_upper() (Kees Cook)
  - ceph: fix possible integer overflow in ceph_zero_objects() (Dmitry Kandybka)
  - ALSA: hda: Ignore unsol events for cards being shut down (Cezary Rojewski)
  - usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode (Jos Wang)
  - usb: cdc-wdm: avoid setting WDM_READ for ZLP-s (Robert Hodaszi)
  - usb: Add checks for snprintf() calls in usb_alloc_dev() (Andy Shevchenko)
  - tty: serial: uartlite: register uart driver in init (Jakub Lewalski)
  - usb: potential integer overflow in usbg_make_tpg() (Chen Yufeng)
  - iio: pressure: zpa2326: Use aligned_s64 for the timestamp (Jonathan Cameron)
  - md/md-bitmap: fix dm-raid max_write_behind setting (Yu Kuai)
  - dmaengine: xilinx_dma: Set dma_device directions (Thomas Gessler)
  - mfd: max14577: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
  - mailbox: Not protect module_put with spin_lock_irqsave (Peng Fan)
  - cifs: Fix cifs_query_path_info() for Windows NT servers (Pali Rohár)


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.348.2.el8uek]
changelog:
  - uek-rpm: Move ifb module to nano modules (Harshit Mogalapalli) [Orabug: 38443798]
  - clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310007] {CVE-2025-38499}
  - x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta) [Orabug: 38424094]
  - x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta) [Orabug: 38424094]
  - x86/vmscape: Enable the mitigation (Pawan Gupta) [Orabug: 38424094]
  - x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta) [Orabug: 38424094]
  - x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta) [Orabug: 38424094]
  - x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta) [Orabug: 38424094]
  - Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta) [Orabug: 38424094]


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.348.3.el8uek]
changelog:
  - hugetlbfs: take read_lock on i_mmap for PMD sharing (Waiman Long)  [Orabug: 38459576]  
  - kallsyms: add module_kallsyms_on_each_symbol_locked (Julian Pidancet)  [Orabug: 37629344] [Orabug: 38418686]  
  - kallsyms: export module_kallsyms_on_each_symbol (Julian Pidancet)  [Orabug: 37629344] [Orabug: 38418686]


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.348.1.el8uek]
changelog:
  - LTS tag: v5.4.298 (Sherry Yang)
  - Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" (Imre Deak)
  - net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
  - Revert "drm/amdgpu: fix incorrect vm flags to map bo" (Alex Deucher) [Orabug: 38343661]
  - HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [Orabug: 38440228] {CVE-2025-39808}
  - HID: wacom: Add a new Art Pen 2 (Ping Cheng)
  - HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [Orabug: 38440310] {CVE-2025-39824}
  - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [Orabug: 38440277] {CVE-2025-39817}
  - sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [Orabug: 38440251] {CVE-2025-39812}
  - net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts (Rohan G Thomas)
  - net/mlx5e: Set local Xoff after FW update (Alexei Lazar)
  - net/mlx5e: Update and set Xon/Xoff upon port speed set (Alexei Lazar)
  - net/mlx5e: Update and set Xon/Xoff upon MTU set (Alexei Lazar)
  - net: dlink: fix multicast stats being counted incorrectly (Moon Yeounsu)
  - atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [Orabug: 38440347] {CVE-2025-39828}
  - net/atm: remove the atmdev_ops {get, set}sockopt methods (Christoph Hellwig)
  - Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced (Luiz Augusto von Dentz)
  - powerpc/kvm: Fix ifdef to remove build warning (Madhavan Srinivasan)
  - net: ipv4: fix regression in local-broadcast routes (Oscar Maes) [Orabug: 38343661]
  - vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() (Nikolay Kuratov)
  - scsi: core: sysfs: Correct sysfs attributes access rights (Damien Le Moal)
  - ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [Orabug: 38440259] {CVE-2025-39813}
  - pinctrl: STMFX: add missing HAS_IOMEM dependency (Randy Dunlap)
  - LTS tag: v5.4.297 (Sherry Yang)
  - alloc_fdtable(): change calling conventions. (Al Viro)
  - s390/hypfs: Enable limited access during lockdown (Peter Oberparleiter)
  - s390/hypfs: Avoid unnecessary ioctl registration in debugfs (Peter Oberparleiter)
  - ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation (Takashi Iwai)
  - net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate (William Liu)
  - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (William Liu)
  - ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc (Jason Xing)
  - ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add (Heminhong)
  - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [Orabug: 38343661]
  - scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [Orabug: 38401514] {CVE-2025-39676}
  - usb: xhci: Fix slot_id resource race conflict (Weitao Wang)
  - nfs: fix UAF in direct writes (Josef Bacik) [Orabug: 36596831] {CVE-2024-26958}
  - NFS: Fix up commit deadlocks (Trond Myklebust)
  - cifs: Fix UAF in cifs_demultiplex_thread() (Zhang Xiaoxu)
  - Bluetooth: fix use-after-free in device_for_each_child() (Dmitry Antipov) [Orabug: 37433654] {CVE-2024-53237}
  - act_mirred: use the backlog for nested calls to mirred ingress (Davide Caratti)
  - net/sched: act_mirred: better wording on protection against excessive stack growth (Davide Caratti)
  - net/sched: act_mirred: refactor the handle of xmit (Wenxu)
  - selftests: forwarding: tc_actions.sh: add matchall mirror test (Jiri Pirko)
  - net: sched: don't expose action qstats to skb_tc_reinsert() (Vlad Buslov)
  - net: sched: extract qstats update code into functions (Vlad Buslov)
  - net: sched: extract bstats update code into function (Vlad Buslov)
  - net: sched: extract common action counters update code into function (Vlad Buslov)
  - mm: perform the mapping_map_writable() check after call_mmap() (Lorenzo Stoakes)
  - mm: update memfd seal write check to include F_SEAL_WRITE (Lorenzo Stoakes)
  - mm: drop the assumption that VM_SHARED always implies writable (Lorenzo Stoakes)
  - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Cong Wang) [Orabug: 37908492] {CVE-2025-37798}
  - sch_qfq: make qfq_qlen_notify() idempotent (Cong Wang)
  - sch_hfsc: make hfsc_qlen_notify() idempotent (Cong Wang) [Orabug: 38158396] {CVE-2025-38177}
  - sch_drr: make drr_qlen_notify() idempotent (Cong Wang)
  - btrfs: populate otime when logging an inode item (Qu Wenruo)
  - media: venus: hfi: explicitly release IRQ during teardown (Jorge Ramirez-Ortiz)
  - f2fs: fix to avoid out-of-boundary access in dnode page (Chao Yu)
  - media: venus: protect against spurious interrupts during probe (Jorge Ramirez-Ortiz)
  - media: qcom: camss: cleanup media device allocated resource on error path (Vladimir Zapolskiy)
  - media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. (Ricardo Ribalda)
  - drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS (Imre Deak)
  - pwm: mediatek: Fix duty and period setting (Uwe Kleine-König)
  - pwm: mediatek: Handle hardware enable and clock enable separately (Uwe Kleine-König)
  - pwm: mediatek: Implement .apply() callback (Uwe Kleine-König)
  - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [Orabug: 38401677] {CVE-2025-39713}
  - media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() (Sakari Ailus)
  - media: v4l2-ctrls: always copy the controls on completion (Hans Verkuil)
  - ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig (Damien Le Moal)
  - soc: qcom: mdt_loader: Ensure we don't read past the ELF header (Bjorn Andersson) [Orabug: 38423524] {CVE-2025-39787}
  - rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 (Meagan Lloyd)
  - usb: musb: omap2430: fix device leak at unbind (Johan Hovold)
  - NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug: 38429211] {CVE-2025-39798}
  - NFS: Fix up handling of outstanding layoutcommit in nfs_update_inode() (Trond Myklebust)
  - NFSv4: Fix nfs4_bitmap_copy_adjust() (Trond Myklebust)
  - usb: typec: fusb302: cache PD RX state (Sebastian Reichel)
  - cdc-acm: fix race between initial clearing halt and open (Oliver Neukum)
  - USB: cdc-acm: do not log successful probe on later errors (Johan Hovold)
  - mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock (Breno Leitao)
  - mm/kmemleak: turn kmemleak_lock and object->lock to raw_spinlock_t (He Zhe)
  - ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (Geoffrey D. Bennett)
  - x86/fpu: Delay instruction pointer fixup until after warning (Dave Hansen)
  - mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery (Andy Shevchenko)
  - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395081,38501612] {CVE-2025-38724}
  - pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
  - tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324271] {CVE-2025-38539}
  - usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
  - usb: hub: avoid warm port reset during USB3 disconnect (Mathias Nyman)
  - x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
  - iio: hid-sensor-prox: Fix incorrect OFFSET calculation (Zhang Lixu)
  - f2fs: fix to do sanity check on ino and xnid (Chao Yu)
  - mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n (Harry Yoo)
  - mm/zsmalloc.c: convert to use kmem_cache_zalloc in cache_alloc_zspage() (Miaohe Lin)
  - drm/sched: Remove optimization that causes hang when killing dependent jobs (Lin Cao)
  - ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351930] {CVE-2025-38664}
  - net: usbnet: Fix the wrong netif_carrier_on() call (Ammar Faizi)
  - net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (John Ernberg)
  - PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (Lukas Wunner)
  - ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value (Li Zhong)
  - comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott)
  - comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott)
  - kbuild: Add KBUILD_CPPFLAGS to as-option invocation (Nathan Chancellor)
  - kbuild: add $(CLANG_FLAGS) to KBUILD_CPPFLAGS (Masahiro Yamada)
  - kbuild: Add CLANG_FLAGS to as-instr (Nathan Chancellor)
  - mips: Include KBUILD_CPPFLAGS in CHECKFLAGS invocation (Nathan Chancellor)
  - kbuild: Update assembler calls to use proper flags and language target (Nick Desaulniers)
  - ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS (Nathan Chancellor)
  - usb: dwc3: Ignore late xferNotReady event to prevent halt timeout (Kuen-Han Tsai)
  - USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles (Zenm Chen)
  - usb: storage: realtek_cr: Use correct byte order for bcs->Residue (Thorsten Blum)
  - USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera (Mael Guerin)
  - usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive (Miao Li)
  - iio: proximity: isl29501: fix buffered read on big-endian systems (David Lechner)
  - ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [Orabug: 38401581] {CVE-2025-39689}
  - fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() (Xu Yilun)
  - use uniform permission checks for all mount propagation changes (Al Viro)
  - move_mount: allow to add a mount into an existing group (Pavel Tikhomirov)
  - fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [Orabug: 38401587] {CVE-2025-39691}
  - drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs (Timur Kristóf)
  - drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 (Timur Kristóf)
  - memstick: Fix deadlock by moving removing flag earlier (Jiayi Li)
  - media: venus: Add a check for packet size after reading from shared memory (Vedang Nagar)
  - media: ov2659: Fix memory leaks in ov2659_probe() (Zhang Shurong)
  - media: usbtv: Lock resolution while streaming (Ludwig Disterhof) [Orabug: 38401684] {CVE-2025-39714}
  - media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (Haoxiang Li)
  - media: gspca: Add bounds checking to firmware parser (Dan Carpenter)
  - soc/tegra: pmc: Ensure power-domains are in a known state (Jonathan Hunter)
  - jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [Orabug: 38423509] {CVE-2025-39782}
  - PCI: endpoint: Fix configfs group removal on driver teardown (Damien Le Moal)
  - PCI: endpoint: Fix configfs group list head handling (Damien Le Moal)
  - mtd: rawnand: fsmc: Add missing check after DMA map (Thomas Fourier)
  - pwm: imx-tpm: Reset counter if CMOD is 0 (Laurentiu Mihalcea)
  - wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (Nathan Chancellor)
  - zynq_fpga: use sgtable-based scatterlist wrappers (Marek Szyprowski)
  - ata: libata-scsi: Fix ata_to_sense_error() status handling (Damien Le Moal)
  - ext4: fix reserved gdt blocks handling in fsmap (Ojaswin Mujoo)
  - ext4: fix fsmap end of range reporting with bigalloc (Ojaswin Mujoo)
  - ext4: check fast symlink for ea_inode correctly (Andreas Dilger)
  - vt: defkeymap: Map keycodes above 127 to K_HOLE (Myrrh Periwinkle)
  - vt: keyboard: Don't process Unicode characters in K_OFF mode (Myrrh Periwinkle)
  - usb: dwc3: meson-g12a: fix device leaks at unbind (Johan Hovold)
  - usb: gadget: udc: renesas_usb3: fix device leak at unbind (Johan Hovold)
  - usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (Nathan Chancellor)
  - m68k: Fix lost column on framebuffer debug console (Finn Thain)
  - cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (Dan Carpenter)
  - serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [Orabug: 38401729] {CVE-2025-39724}
  - media: uvcvideo: Do not mark valid metadata as invalid (Ricardo Ribalda)
  - media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394816] {CVE-2025-38680}
  - mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() (Waiman Long)
  - parisc: Makefile: fix a typo in palo.conf (Randy Dunlap)
  - btrfs: fix log tree replay failure due to file with 0 links and extents (Filipe Manana)
  - thunderbolt: Fix copy+paste error in match_service_id() (Eric Biggers)
  - comedi: fix race between polling and detaching (Ian Abbott)
  - misc: rtsx: usb: Ensure mmc child device is active when card is present (Ricky Wu)
  - drm/amdgpu: fix incorrect vm flags to map bo (Jack Xiao)
  - scsi: lpfc: Remove redundant assignment to avoid memory leak (Jiasheng Jiang)
  - rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe (Meagan Lloyd)
  - pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394867] {CVE-2025-38691}
  - pNFS: Handle RPC size limit for layoutcommits (Sergey Bashirov)
  - pNFS: Fix disk addr range check in block/scsi layout (Sergey Bashirov)
  - pNFS: Fix stripe mapping in block/scsi layout (Sergey Bashirov)
  - net: phy: smsc: add proper reset flags for LAN8710A (Csaba Buday)
  - ipmi: Fix strcpy source and destination the same (Corey Minyard)
  - kconfig: lxdialog: fix 'space' to (de)select options (Yann E. MORIN)
  - kconfig: gconf: fix potential memory leak in renderer_edited() (Masahiro Yamada)
  - kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() (Masahiro Yamada)
  - ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Breno Leitao)
  - scsi: aacraid: Stop using PCI_IRQ_AFFINITY (John Garry)
  - scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (Ranjan Kumar)
  - kconfig: nconf: Ensure null termination where strncpy is used (Shankari Anand)
  - kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c (Suchit Karunakaran)
  - i3c: don't fail if GETHDRCAP is unsupported (Wolfram Sang)
  - PCI: pnv_php: Work around switches with broken presence detection (Timothy Pearson)
  - i3c: add missing include to internal header (Wolfram Sang)
  - media: uvcvideo: Fix bandwidth issue for Alcor camera (Chenchangcheng)
  - media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394880] {CVE-2025-38693}
  - media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394887] {CVE-2025-38694}
  - media: usb: hdpvr: disable zero-length read messages (Wolfram Sang)
  - media: tc358743: Increase FIFO trigger level to 374 (Dave Stevenson)
  - media: tc358743: Return an appropriate colorspace from tc358743_set_fmt (Dave Stevenson)
  - media: tc358743: Check I2C succeeded during probe (Dave Stevenson)
  - pinctrl: stm32: Manage irq affinity settings (Cheick Traore)
  - scsi: mpt3sas: Correctly handle ATA device errors (Damien Le Moal)
  - scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug: 38394894] {CVE-2025-38695}
  - RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423286] {CVE-2025-39742}
  - MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh)
  - jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte)
  - jfs: Regular file corruption check (Edward Adam Davis)
  - jfs: truncate good inode pages when hard link is 0 (Lizhi Xu)
  - scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394925] {CVE-2025-38699}
  - MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} (Shiji Yang)
  - watchdog: dw_wdt: Fix default timeout (Sebastian Reichel)
  - fs/orangefs: use snprintf() instead of sprintf() (Amir Mohammad Jahangirzad)
  - scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated (Showrya M N) [Orabug: 38394931] {CVE-2025-38700}
  - ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394937] {CVE-2025-38701}
  - cifs: Fix calling CIFSFindFirst() for root path without msearch (Pali Rohár)
  - vhost: fail early when __vhost_add_used() fails (Jason Wang)
  - net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 (Álvaro Fernández Rojas)
  - uapi: in6: restore visibility of most IPv6 socket options (Jakub Kicinski)
  - net: ncsi: Fix buffer overflow in fetching version id (Hari Kalavakunta)
  - net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 (Álvaro Fernández Rojas)
  - net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 (Álvaro Fernández Rojas)
  - net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs (Gal Pressman)
  - wifi: iwlegacy: Check rate_idx range after addition (Stanislaw Gruszka)
  - netmem: fix skb_frag_address_safe with unreadable skbs (Mina Almasry)
  - wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. (Thomas Fourier)
  - wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect (Anjaneyulu)
  - wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() (Rand Deeb)
  - net: fec: allow disable coalescing (Jonas Rebmann)
  - (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer (Thomas Fourier)
  - s390/stp: Remove udelay from stp_sync_clock() (Sven Schnelle)
  - wifi: iwlwifi: mvm: fix scan request validation (Avraham Stern)
  - net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() (Alok Tiwari)
  - net: ipv4: fix incorrect MTU in broadcast routes (Oscar Maes)
  - wifi: cfg80211: Fix interface type validation (Ilan Peer)
  - rcu: Protect ->defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423341] {CVE-2025-39749}
  - net: ag71xx: Add missing check after DMA map (Thomas Fourier)
  - et131x: Add missing check after DMA map (Thomas Fourier)
  - be2net: Use correct byte order and format string for TCP seq and ack_seq (Alok Tiwari)
  - s390/time: Use monotonic clock in get_cycles() (Sven Schnelle)
  - wifi: cfg80211: reject HTC bit for management frames (Johannes Berg)
  - ktest.pl: Prevent recursion of default variable options (Steven Rostedt)
  - ASoC: codecs: rt5640: Retry DEVICE_ID verification (Xinxin Wan)
  - ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros (Cristian Ciocaltea)
  - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun)
  - platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches (Kees Cook)
  - pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() (Gautham R. Shenoy)
  - usb: core: usb_submit_urb: downgrade type check (Oliver Neukum)
  - ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 (Alok Tiwari)
  - ASoC: hdac_hdmi: Rate limit logging on connection and disconnection (Mark Brown)
  - mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() (Ulf Hansson)
  - ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (Breno Leitao)
  - ACPI: processor: fix acpi_object initialization (Sebastian Ott)
  - PM: sleep: console: Fix the black screen issue (Tuhaowen)
  - thermal: sysfs: Return ENODATA instead of EAGAIN for reads (Hsin-Te Yuan)
  - PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() (Rafael J. Wysocki)
  - selftests: tracing: Use mutex_unlock for testing glob filter (Masami Hiramatsu)
  - ARM: tegra: Use I/O memcpy to write to IRAM (Aaron Kling)
  - gpio: tps65912: check the return value of regmap_update_bits() (Bartosz Golaszewski)
  - ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed (Kuninori Morimoto)
  - ARM: rockchip: fix kernel hang during smp initialization (Alexander Kochetkov)
  - cpufreq: Exit governor when failed to start old governor (Lifeng Zheng)
  - usb: xhci: Avoid showing errors during surprise removal (Mario Limonciello)
  - usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command (Jay Chen)
  - usb: xhci: Avoid showing warnings for dying controller (Mario Limonciello)
  - selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t (Cynthia Huang)
  - usb: xhci: print xhci->xhc_state when queue_command failed (Su Hui)
  - securityfs: don't pin dentries twice, once is enough... (Al Viro)
  - hfs: fix not erasing deleted b-tree node issue (Viacheslav Dubeyko)
  - drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394995] {CVE-2025-38708}
  - udf: Verify partition map count (Jan Kara)
  - arm64: Handle KCOV __init vs inline mismatches (Kees Cook)
  - hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa)
  - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko)
  - hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko)
  - hfs: fix slab-out-of-bounds in hfs_bnode_read() (Viacheslav Dubeyko)
  - sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395059] {CVE-2025-38718}
  - netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395068] {CVE-2025-38721}
  - udp: also consider secpath when evaluating ipsec use for checksumming (Sabrina Dubroca)
  - ACPI: processor: perflib: Move problematic pr->performance check (Rafael J. Wysocki)
  - ACPI: processor: perflib: Fix initial _PPC limit application (Jiayi Li)
  - Documentation: ACPI: Fix parent device references (Andy Shevchenko)
  - fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423397] {CVE-2025-39756}
  - sunvdc: Balance device refcount in vdc_port_mpgroup_check (Ma Ke)
  - NFSD: detect mismatch of file handle and delegation stateid in OPEN op (Dai Ngo)
  - net: dpaa: fix device leak when querying time stamp info (Johan Hovold)
  - net: gianfar: fix device leak when querying time stamp info (Johan Hovold)
  - netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38401319] {CVE-2025-38727}
  - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423407] {CVE-2025-39757}
  - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395101] {CVE-2025-38729}
  - io_uring: don't use int for ABI (Pavel Begunkov)
  - usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue) [Orabug: 38334898] {CVE-2025-38555}
  - MIPS: mm: tlb-r4k: Uniquify TLB entries on init (Jiaxun Yang)
  - USB: serial: option: add Foxconn T99W709 (Slark Xiao)
  - vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351771,38453914] {CVE-2025-38618}
  - net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351764] {CVE-2025-38617}
  - perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334948] {CVE-2025-38563}
  - perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334959] {CVE-2025-38565}
  - perf/core: Don't leak AUX buffer refcount on allocation failure (Thomas Gleixner)
  - pptp: fix pptp_xmit() error path (Eric Dumazet)
  - smb: client: let recv_done() cleanup before notifying the callers. (Stefan Metzmacher)
  - benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334976] {CVE-2025-38569}
  - net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351786] {CVE-2025-38622}
  - ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334988] {CVE-2025-38572}
  - pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335004] {CVE-2025-38574}
  - netpoll: prevent hanging NAPI when netcons gets enabled (Jakub Kicinski)
  - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401745] {CVE-2025-39730}
  - pci/hotplug/pnv-php: Wrap warnings in macro (Frederic Barrat)
  - pci/hotplug/pnv-php: Improve error msg on power state change failure (Frederic Barrat)
  - usb: chipidea: udc: fix sleeping function called from invalid context (Peter Chen)
  - f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu)
  - f2fs: fix to avoid panic in f2fs_evict_inode (Chao Yu)
  - f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu)
  - rtc: pcf8563: fix incorrect maximum clock rate handling (Brian Masney)
  - rtc: hym8563: fix incorrect maximum clock rate handling (Brian Masney)
  - rtc: ds1307: fix incorrect maximum clock rate handling (Brian Masney)
  - module: Restore the moduleparam prefix length check (Petr Pavlu)
  - bpf: Check flow_dissector ctx accesses are aligned (Paul Chaignon)
  - mtd: rawnand: atmel: set pmecc data setup time (Balamanikandan Gunasundar)
  - mtd: rawnand: atmel: Fix dma_mapping_error() address (Thomas Fourier)
  - jfs: fix metapage reference count leak in dbAllocCtl (Zheng Yu)
  - fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (Chenyuan Yang)
  - crypto: qat - fix seq_file position update in adf_ring_next() (Giovanni Cabiddu)
  - dmaengine: nbpfaxi: Add missing check after DMA map (Thomas Fourier)
  - dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (Thomas Fourier)
  - fs/orangefs: Allow 2 more characters in do_c_string() (Dan Carpenter)
  - soundwire: stream: restore params when prepare ports fail (Bard Liao)
  - crypto: img-hash - Fix dma_unmap_sg() nents value (Thomas Fourier)
  - hwrng: mtk - handle devm_pm_runtime_enable errors (Ovidiu Panait)
  - watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (Dan Carpenter)
  - scsi: isci: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - scsi: mvsas: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - clk: sunxi-ng: v3s: Fix de clock definition (Paul Kocialkowski)
  - perf tests bp_account: Fix leaked file descriptor (Leo Yan)
  - crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong)
  - pinctrl: sunxi: Fix memory leak on krealloc failure (Yuan Chen)
  - power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (Charles Han)
  - clk: davinci: Add NULL check in davinci_lpsc_clk_register() (Henry Martin)
  - mtd: fix possible integer overflow in erase_xfer() (Ivan Stepchenko)
  - crypto: marvell/cesa - Fix engine load inaccuracy (Herbert Xu)
  - PCI: rockchip-host: Fix "Unexpected Completion" log message (Hans Zhang)
  - vrf: Drop existing dst reference in vrf_ip6_input_dst (Stanislav Fomichev)
  - selftests: rtnetlink.sh: remove esp4_offload after test (Xiumei Mu)
  - netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351854] {CVE-2025-38639}
  - can: kvaser_usb: Assign netdev.dev_port based on device channel index (Jimmy Assarsson)
  - can: kvaser_pciefd: Store device channel index (Jimmy Assarsson)
  - wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (Gokul Sivakumar)
  - Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Remi Pommarel)
  - mwl8k: Add missing check after DMA map (Thomas Fourier)
  - wifi: rtl8xxxu: Fix RX skb size for aggregation disabled (Martin Kaistra)
  - net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug: 38331466] {CVE-2025-38553}
  - arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX (Johan Korsnes)
  - drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (Fedor Pchelkin)
  - m68k: Don't unregister boot console needlessly (Finn Thain)
  - tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range (Xin Guo)
  - iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335110] {CVE-2025-38602}
  - wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (Xiu Jianfeng)
  - wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335120] {CVE-2025-38604}
  - caif: reduce stack size, again (Arnd Bergmann)
  - bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure (Yuan Chen)
  - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335131] {CVE-2025-38608}
  - staging: nvec: Fix incorrect null termination of battery manufacturer (Alok Tiwari)
  - samples: mei: Fix building on musl libc (Brahmajit Das)
  - cpufreq: Init policy->rwsem before it may be possibly used (Lifeng Zheng)
  - ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface (Annette Kobou)
  - usb: early: xhci-dbc: Fix early_ioremap leak (Lucas De Marchi)
  - Revert "vmci: Prevent the dispatching of uninitialized payloads" (Greg Kroah-Hartman)
  - pps: fix poll support (Denis Osterland-Heim)
  - vmci: Prevent the dispatching of uninitialized payloads (Lizhi Xu)
  - staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal) [Orabug: 38335153] {CVE-2025-38612}
  - ARM: dts: vfxxx: Correctly use two tuples for timer address (Krzysztof Kozlowski)
  - hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li)
  - ASoC: Intel: fix SND_SOC_SOF dependencies (Arnd Bergmann)
  - ethernet: intel: fix building with large NR_CPUS (Arnd Bergmann)
  - usb: phy: mxs: disconnect line when USB charger is attached (Xu Yang)
  - usb: chipidea: add USB PHY event (Xu Yang)
  - usb: chipidea: introduce CI_HDRC_CONTROLLER_VBUS_EVENT glue layer use (Peter Chen)
  - usb: chipidea: udc: protect usb interrupt enable (Li Jun)
  - usb: chipidea: udc: add new API ci_hdrc_gadget_connect (Peter Chen)
  - ALSA: hda: Add missing NVIDIA HDA codec IDs (Daniel Dadap)
  - comedi: comedi_test: Fix possible deletion of uninitialized timers (Ian Abbott)
  - nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi)
  - i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351994] {CVE-2025-38671}
  - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei)
  - net: appletalk: Fix use-after-free in AARP proxy probe (Kito Xu)
  - net: appletalk: fix kerneldoc warnings (Andrew Lunn)
  - RDMA/core: Rate limit GID cache warning messages (Maor Gottlieb)
  - regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati) [Orabug: 38351978] {CVE-2025-38668}
  - usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
  - usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
  - net_sched: sch_sfq: reject invalid perturb period (Eric Dumazet) [Orabug: 38158477] {CVE-2025-38193}
  - power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition (Zheng Wang)
  - power: supply: bq24190_charger: using pm_runtime_resume_and_get instead of pm_runtime_get_sync (Minghao Chi)
  - power: supply: bq24190_charger: Fix runtime PM imbalance on error (Dinghao Liu)
  - xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
  - virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253834] {CVE-2025-38375}
  - ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
  - usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
  - usb: musb: fix gadget state on disconnect (Drew Hamilton)
  - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254214] {CVE-2025-38468}
  - net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254225] {CVE-2025-38470}
  - Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
  - Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
  - Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
  - Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254241] {CVE-2025-38473}
  - usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254249] {CVE-2025-38474}
  - net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254266] {CVE-2025-38477}
  - net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
  - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott)
  - comedi: Fix some signed shift left operations (Ian Abbott)
  - comedi: das6402: Fix bit shift out of bounds (Ian Abbott)
  - comedi: das16m1: Fix bit shift out of bounds (Ian Abbott)
  - comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott)
  - comedi: pcl812: Fix bit shift out of bounds (Ian Abbott)
  - iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
  - iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
  - iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
  - soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
  - soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
  - mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
  - mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
  - mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
  - isofs: Verify inode mode when loading from disk (Jan Kara)
  - dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter)
  - af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
  - af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
  - phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
  - HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254340,38453904] {CVE-2025-38494}
  - HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
  - HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254348,38453908] {CVE-2025-38495}
  - pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
  - Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
  - i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
  - usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254358] {CVE-2025-38497}
  - USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
  - USB: serial: option: add Foxconn T99W640 (Slark Xiao)
  - USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
  - LTS tag: v5.4.296 (Sherry Yang)
  - x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
  - Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID (Hans de Goede)
  - HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324280] {CVE-2025-38540}
  - HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
  - vt: add missing notification when switching back to text mode (Nicolas Pitre)
  - net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
  - atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
  - bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254090] {CVE-2025-38439}
  - bnxt_en: Fix DCB ETS validation (Shravya Kn)
  - can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
  - net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
  - net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu)
  - md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254109] {CVE-2025-38445}
  - wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324161] {CVE-2025-38513}
  - dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
  - Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
  - Input: xpad - add VID for Turtle Beach controllers (Vicki Pfau)
  - Input: xpad - add support for Amazon Game Controller (Matt Reynolds)
  - NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
  - flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Tigran Mkrtchyan)
  - RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad)
  - netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
  - netlink: make sure we allow at least one dump skb (Jakub Kicinski)
  - Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
  - usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254118] {CVE-2025-38448}
  - drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324180] {CVE-2025-38515}
  - pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324186] {CVE-2025-38516}
  - x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
  - x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
  - x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
  - rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells)
  - net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254147] {CVE-2025-38457}
  - atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254153] {CVE-2025-38458}
  - atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254161] {CVE-2025-38459}
  - atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324309] {CVE-2025-38546}
  - atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254167] {CVE-2025-38460}
  - tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254181] {CVE-2025-38464}
  - netlink: Fix wraparounds of sk->sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254188] {CVE-2025-38465}
  - fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
  - proc: Clear the pieces of proc_inode that proc_evict_inode cares about (Eric W. Biederman)
  - drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254203] {CVE-2025-38467}
  - staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() (Nathan Chancellor)
  - media: uvcvideo: Rollback non processed entities on error (Ricardo Ribalda)
  - media: uvcvideo: Send control events for partial succeeds (Ricardo Ribalda)
  - media: uvcvideo: Return the number of processed controls (Ricardo Ribalda)
  - ACPI: PAD: fix crash in exit_round_robin() (Seiji Nishikawa) [Orabug: 37206006] {CVE-2024-49935}
  - usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38401436] {CVE-2025-38404}
  - Logitech C-270 even more broken (Oliver Neukum)
  - rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju)
  - net: rose: Fix fall-through warnings for Clang (Gustavo A R Silva)
  - drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253887] {CVE-2025-38389}
  - drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
  - spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
  - spi: spi-fsl-dspi: Fix interrupt-less DMA mode taking an XSPI code path (Vladimir Oltean)
  - spi: spi-fsl-dspi: Rename fifo_{read,write} and {tx,cmd}_fifo_write (Vladimir Oltean)
  - dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
  - ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
  - btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
  - btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
  - RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad)
  - RDMA/core: Create and destroy counters in the ib_core (Leon Romanovsky)
  - scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
  - drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal)
  - mtk-sd: reset host->mrq on prepare_data() error (Sergey Senozhatsky)
  - mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu)
  - mmc: mediatek: use data instead of mrq parameter from msdc_{un}prepare_data() (Yue Hu)
  - regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253907] {CVE-2025-38395}
  - regulator: gpio: Add input_supply support in gpio_regulator_config (Jerome Neanne)
  - ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253875] {CVE-2025-38386}
  - wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253946] {CVE-2025-38406}
  - wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
  - powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
  - ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
  - ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
  - nui: Fix dma_mapping_error() check (Thomas Fourier)
  - enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
  - amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
  - lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
  - drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
  - btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
  - scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
  - nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253923] {CVE-2025-38400}
  - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253881] {CVE-2025-38387}
  - platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
  - mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
  - usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253894] {CVE-2025-38391}
  - mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
  - vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253937] {CVE-2025-38403}
  - btrfs: don't abort filesystem when attempting to snapshot deleted subvolume (Omar Sandoval) [Orabug: 36530119] {CVE-2024-26644}
  - arm64: Restrict pagetable teardown to avoid false warning (Dev Jain)
  - s390: Add '-std=gnu11' to decompressor and purgatory CFLAGS (Nathan Chancellor)
  - drm/bridge: cdns-dsi: Check return value when getting default PHY config (Aradhya Bhatia)
  - drm/bridge: cdns-dsi: Fix connecting to next bridge (Aradhya Bhatia)
  - drm/bridge: cdns-dsi: Fix the clock variable for mode_valid() (Aradhya Bhatia)
  - drm/tegra: Assign plane type before registration (Thierry Reding)
  - HID: wacom: fix kobject reference count leak (Qasim Ijaz)
  - HID: wacom: fix memory leak on sysfs attribute creation failure (Qasim Ijaz)
  - HID: wacom: fix memory leak on kobject creation failure (Qasim Ijaz)
  - dm-raid: fix variable in journal device check (Heinz Mauelshagen)
  - Bluetooth: L2CAP: Fix L2CAP MTU negotiation (Frédéric Danis)
  - atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). (Kuniyuki Iwashima) [Orabug: 38175045] {CVE-2025-38245}
  - net: enetc: Correct endianness handling in _enetc_rd_reg64 (Simon Horman)
  - um: ubd: Add missing error check in start_io_thread() (Tiwei Bie)
  - vsock/uapi: fix linux/vm_sockets.h userspace compilation errors (Stefano Garzarella)
  - wifi: mac80211: fix beacon interval calculation overflow (Lachlan Hodges)
  - attach_recursive_mnt(): do not lock the covering tree when sliding something under it (Al Viro)
  - ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() (Youngjun Lee) [Orabug: 38175065] {CVE-2025-38249}
  - i2c: robotfuzz-osif: disable zero-length read messages (Wolfram Sang)
  - i2c: tiny-usb: disable zero-length read messages (Wolfram Sang)
  - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Shin'Ichiro Kawasaki) [Orabug: 38158592] {CVE-2025-38211}
  - RDMA/core: Use refcount_t instead of atomic_t on refcount of iwcm_id_private (Weihang Li)
  - media: vivid: Change the siize of the composing (Denis Arefev)
  - media: omap3isp: use sgtable-based scatterlist wrappers (Marek Szyprowski)
  - media: cxusb: no longer judge rbuf when the write fails (Edward Adam Davis) [Orabug: 38158692] {CVE-2025-38229}
  - media: cxusb: use dev_dbg() rather than hand-rolled debug (Sean Young)
  - jfs: validate AG parameters in dbMount() to prevent crashes (Vasiliy Kovalev)
  - fs/jfs: consolidate sanity checking in dbMount (Dave Kleikamp)
  - ASoC: meson: meson-card-utils: use of_property_present() for DT parsing (Martin Blumenstingl)
  - of: Add of_property_present() helper (Rob Herring)
  - of: property: define of_property_read_u{8,16,32,64}_array() unconditionally (Michael Walle)
  - kbuild: hdrcheck: fix cross build with clang (Arnd Bergmann)
  - kbuild: add --target to correctly cross-compile UAPI headers with Clang (Masahiro Yamada)
  - bpfilter: match bit size of bpfilter_umh to that of the kernel (Masahiro Yamada)
  - kbuild: use -MMD instead of -MD to exclude system headers from dependency (Masahiro Yamada)
  - VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify (Ma Wupeng) [Orabug: 38152869] {CVE-2025-38102}
  - VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF (George Kennedy)
  - ovl: Check for NULL d_inode() in ovl_dentry_upper() (Kees Cook)
  - ceph: fix possible integer overflow in ceph_zero_objects() (Dmitry Kandybka)
  - ALSA: hda: Ignore unsol events for cards being shut down (Cezary Rojewski)
  - usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode (Jos Wang)
  - usb: cdc-wdm: avoid setting WDM_READ for ZLP-s (Robert Hodaszi)
  - usb: Add checks for snprintf() calls in usb_alloc_dev() (Andy Shevchenko)
  - tty: serial: uartlite: register uart driver in init (Jakub Lewalski)
  - usb: potential integer overflow in usbg_make_tpg() (Chen Yufeng)
  - iio: pressure: zpa2326: Use aligned_s64 for the timestamp (Jonathan Cameron)
  - md/md-bitmap: fix dm-raid max_write_behind setting (Yu Kuai)
  - dmaengine: xilinx_dma: Set dma_device directions (Thomas Gessler)
  - mfd: max14577: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
  - mailbox: Not protect module_put with spin_lock_irqsave (Peng Fan)
  - cifs: Fix cifs_query_path_info() for Windows NT servers (Pali Rohár)


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.349.1.el8uek]
changelog:
  - NFSv4: Don't clear capabilities that won't be reset (Trond Myklebust)
  - power: supply: bq27xxx: restrict no-battery detection to bq27000 (H. Nikolaus Schaller)
  - power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery (H. Nikolaus Schaller)
  - usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
  - soc: qcom: mdt_loader: Deal with zero e_shentsize (Bjorn Andersson)
  - Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" (Tariq Toukan)
  - LTS tag: v5.4.299 (Alok Tiwari)
  - scsi: lpfc: Fix buffer free/clear order in deferred receive path (John Evans) [Orabug: 38456754] {CVE-2025-39841}
  - dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
  - cifs: fix integer overflow in match_server() (Roman Smirnov)
  - spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort (Larisa Grigore)
  - spi: spi-fsl-lpspi: Set correct chip-select polarity bit (Larisa Grigore)
  - spi: spi-fsl-lpspi: Fix transmissions when using CONT (Larisa Grigore)
  - pcmcia: Add error handling for add_interval() in do_validate_mem() (Xu Wang)
  - ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model (Takashi Iwai)
  - randstruct: gcc-plugin: Fix attribute addition (Kees Cook)
  - randstruct: gcc-plugin: Remove bogus void member (Kees Cook)
  - vmxnet3: update MTU after device quiesce (Ronak Doshi)
  - net: dsa: microchip: linearize skb for tail-tagging switches (Jakob Unterwurzacher)
  - net: dsa: microchip: update tag_ksz masks for KSZ9477 family (Pieter Van Trappen)
  - dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
  - ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup (Chris Chiu)
  - gpio: pca953x: fix IRQ storm on system wake up (Emanuele Ghidoli)
  - iio: light: opt3001: fix deadlock due to concurrent flag access (Luca Ceresoli) [Orabug: 37977028] {CVE-2025-37968}
  - iio: chemical: pms7003: use aligned_s64 for timestamp (David Lechner)
  - cpufreq/sched: Explicitly synchronize limits_changed flag handling (Rafael J. Wysocki)
  - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Li Qiong) [Orabug: 38494761] {CVE-2025-39902}
  - mm/khugepaged: fix ->anon_vma race (Jann Horn)
  - e1000e: fix heap overflow in e1000_set_eeprom (Vitaly Lifshits) [Orabug: 38494740] {CVE-2025-39898}
  - batman-adv: fix OOB read/write in network-coding decode (Stanislav Fort)
  - drm/amdgpu: drop hw access in non-DC audio fini (Alex Deucher)
  - wifi: mwifiex: Initialize the chan_stats array to zero (Rong Qianfeng) [Orabug: 38494723] {CVE-2025-39891}
  - pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() (Ma Ke)
  - ALSA: usb-audio: Add mute TLV for playback volumes on some devices (Cryolitia Pukngae)
  - ppp: fix memory leak in pad_compress_skb (Qingfang Deng) [Orabug: 38456781] {CVE-2025-39847}
  - net: atm: fix memory leak in atm_register_sysfs when device_register fail (Wang Liang)
  - ax25: properly unshare skbs in ax25_kiss_rcv() (Eric Dumazet)
  - ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() (Dan Carpenter)
  - net: thunder_bgx: add a missing of_node_put (Rosen Penev)
  - wifi: libertas: cap SSID len in lbs_associate() (Dan Carpenter)
  - wifi: cw1200: cap SSID length in cw1200_do_join() (Dan Carpenter)
  - net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets (Felix Fietkau)
  - i40e: Fix potential invalid access when MAC list is empty (Zhen Ni) [Orabug: 38456814] {CVE-2025-39853}
  - icmp: fix icmp_ndo_send address translation for reply direction (Fabian Bläse)
  - mISDN: Fix memory leak in dsp_hwec_enable() (Miaoqian Lin)
  - xirc2ps_cs: fix register access when enabling FullDuplex (Alok Tiwari)
  - Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (Kuniyuki Iwashima) [Orabug: 38456834] {CVE-2025-39860}
  - netfilter: conntrack: helper: Replace -EEXIST by -EBUSY (Phil Sutter)
  - wifi: cfg80211: fix use-after-free in cmp_bss() (Dmitry Antipov) [Orabug: 38456860] {CVE-2025-39864}
  - powerpc: boot: Remove leading zero in label in udelay() (Nathan Chancellor)


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.349.2.el8uek]
changelog:
  - bpf/bpf_get,set_sockopt: add option to set TCP-BPF sock ops flags (Alan Maguire) [Orabug: 36699199]


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.349.3.el8uek]
changelog:
  - Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (Jakub Kicinski) [Orabug: 38545204]
  - KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer (Sean Christopherson) [Orabug: 38494247]
  - rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492234]


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.349.3.1.el8uek]
changelog:
  - i40e: add validation for ring_len param (Lukasz Czapnik)  [Orabug: 38604171]  {CVE-2025-39973} 
  - i40e: increase max descriptors for XL710 (Justin Bronder)  [Orabug: 38604171]  {CVE-2025-39973}


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.349.3.1.el8uek]
changelog:
  - i40e: add validation for ring_len param (Lukasz Czapnik)  [Orabug: 38604171]  {CVE-2025-39973}
  - i40e: increase max descriptors for XL710 (Justin Bronder)  [Orabug: 38604171]  {CVE-2025-39973}


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.349.3.2.el8uek]
changelog:
  - crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu)  [Orabug: 38705546]  {CVE-2025-40019}


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.348.1.el8uek]
changelog:
  - LTS tag: v5.4.298 (Sherry Yang)
  - Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" (Imre Deak)
  - net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
  - Revert "drm/amdgpu: fix incorrect vm flags to map bo" (Alex Deucher) [Orabug: 38343661]
  - HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [Orabug: 38440228] {CVE-2025-39808}
  - HID: wacom: Add a new Art Pen 2 (Ping Cheng)
  - HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [Orabug: 38440310] {CVE-2025-39824}
  - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [Orabug: 38440277] {CVE-2025-39817}
  - sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [Orabug: 38440251] {CVE-2025-39812}
  - net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts (Rohan G Thomas)
  - net/mlx5e: Set local Xoff after FW update (Alexei Lazar)
  - net/mlx5e: Update and set Xon/Xoff upon port speed set (Alexei Lazar)
  - net/mlx5e: Update and set Xon/Xoff upon MTU set (Alexei Lazar)
  - net: dlink: fix multicast stats being counted incorrectly (Moon Yeounsu)
  - atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [Orabug: 38440347] {CVE-2025-39828}
  - net/atm: remove the atmdev_ops {get, set}sockopt methods (Christoph Hellwig)
  - Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced (Luiz Augusto von Dentz)
  - powerpc/kvm: Fix ifdef to remove build warning (Madhavan Srinivasan)
  - net: ipv4: fix regression in local-broadcast routes (Oscar Maes) [Orabug: 38343661]
  - vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() (Nikolay Kuratov)
  - scsi: core: sysfs: Correct sysfs attributes access rights (Damien Le Moal)
  - ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [Orabug: 38440259] {CVE-2025-39813}
  - pinctrl: STMFX: add missing HAS_IOMEM dependency (Randy Dunlap)
  - LTS tag: v5.4.297 (Sherry Yang)
  - alloc_fdtable(): change calling conventions. (Al Viro)
  - s390/hypfs: Enable limited access during lockdown (Peter Oberparleiter)
  - s390/hypfs: Avoid unnecessary ioctl registration in debugfs (Peter Oberparleiter)
  - ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation (Takashi Iwai)
  - net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate (William Liu)
  - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (William Liu)
  - ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc (Jason Xing)
  - ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add (Heminhong)
  - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [Orabug: 38343661]
  - scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [Orabug: 38401514] {CVE-2025-39676}
  - usb: xhci: Fix slot_id resource race conflict (Weitao Wang)
  - nfs: fix UAF in direct writes (Josef Bacik) [Orabug: 36596831] {CVE-2024-26958}
  - NFS: Fix up commit deadlocks (Trond Myklebust)
  - cifs: Fix UAF in cifs_demultiplex_thread() (Zhang Xiaoxu)
  - Bluetooth: fix use-after-free in device_for_each_child() (Dmitry Antipov) [Orabug: 37433654] {CVE-2024-53237}
  - act_mirred: use the backlog for nested calls to mirred ingress (Davide Caratti) [Orabug: 34882838] {CVE: CVE-2022-4269}
  - net/sched: act_mirred: better wording on protection against excessive stack growth (Davide Caratti)
  - net/sched: act_mirred: refactor the handle of xmit (Wenxu)
  - selftests: forwarding: tc_actions.sh: add matchall mirror test (Jiri Pirko)
  - net: sched: don't expose action qstats to skb_tc_reinsert() (Vlad Buslov)
  - net: sched: extract qstats update code into functions (Vlad Buslov)
  - net: sched: extract bstats update code into function (Vlad Buslov)
  - net: sched: extract common action counters update code into function (Vlad Buslov)
  - mm: perform the mapping_map_writable() check after call_mmap() (Lorenzo Stoakes)
  - mm: update memfd seal write check to include F_SEAL_WRITE (Lorenzo Stoakes)
  - mm: drop the assumption that VM_SHARED always implies writable (Lorenzo Stoakes)
  - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Cong Wang) [Orabug: 37908492] {CVE-2025-37798}
  - sch_qfq: make qfq_qlen_notify() idempotent (Cong Wang)
  - sch_hfsc: make hfsc_qlen_notify() idempotent (Cong Wang) [Orabug: 38158396] {CVE-2025-38177}
  - sch_drr: make drr_qlen_notify() idempotent (Cong Wang)
  - btrfs: populate otime when logging an inode item (Qu Wenruo)
  - media: venus: hfi: explicitly release IRQ during teardown (Jorge Ramirez-Ortiz)
  - f2fs: fix to avoid out-of-boundary access in dnode page (Chao Yu)
  - media: venus: protect against spurious interrupts during probe (Jorge Ramirez-Ortiz)
  - media: qcom: camss: cleanup media device allocated resource on error path (Vladimir Zapolskiy)
  - media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. (Ricardo Ribalda)
  - drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS (Imre Deak)
  - pwm: mediatek: Fix duty and period setting (Uwe Kleine-König)
  - pwm: mediatek: Handle hardware enable and clock enable separately (Uwe Kleine-König)
  - pwm: mediatek: Implement .apply() callback (Uwe Kleine-König)
  - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [Orabug: 38401677] {CVE-2025-39713}
  - media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() (Sakari Ailus)
  - media: v4l2-ctrls: always copy the controls on completion (Hans Verkuil)
  - ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig (Damien Le Moal)
  - soc: qcom: mdt_loader: Ensure we don't read past the ELF header (Bjorn Andersson) [Orabug: 38423524] {CVE-2025-39787}
  - rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 (Meagan Lloyd)
  - usb: musb: omap2430: fix device leak at unbind (Johan Hovold)
  - NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug: 38429211] {CVE-2025-39798}
  - NFS: Fix up handling of outstanding layoutcommit in nfs_update_inode() (Trond Myklebust)
  - NFSv4: Fix nfs4_bitmap_copy_adjust() (Trond Myklebust)
  - usb: typec: fusb302: cache PD RX state (Sebastian Reichel)
  - cdc-acm: fix race between initial clearing halt and open (Oliver Neukum)
  - USB: cdc-acm: do not log successful probe on later errors (Johan Hovold)
  - mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock (Breno Leitao)
  - mm/kmemleak: turn kmemleak_lock and object->lock to raw_spinlock_t (He Zhe)
  - ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (Geoffrey D. Bennett)
  - x86/fpu: Delay instruction pointer fixup until after warning (Dave Hansen)
  - mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery (Andy Shevchenko)
  - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395081,38501612] {CVE-2025-38724}
  - pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
  - tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324271] {CVE-2025-38539}
  - usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
  - usb: hub: avoid warm port reset during USB3 disconnect (Mathias Nyman)
  - x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
  - iio: hid-sensor-prox: Fix incorrect OFFSET calculation (Zhang Lixu)
  - f2fs: fix to do sanity check on ino and xnid (Chao Yu)
  - mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n (Harry Yoo)
  - mm/zsmalloc.c: convert to use kmem_cache_zalloc in cache_alloc_zspage() (Miaohe Lin)
  - drm/sched: Remove optimization that causes hang when killing dependent jobs (Lin Cao)
  - ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351930] {CVE-2025-38664}
  - net: usbnet: Fix the wrong netif_carrier_on() call (Ammar Faizi)
  - net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (John Ernberg)
  - PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (Lukas Wunner)
  - ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value (Li Zhong)
  - comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott)
  - comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott)
  - kbuild: Add KBUILD_CPPFLAGS to as-option invocation (Nathan Chancellor)
  - kbuild: add $(CLANG_FLAGS) to KBUILD_CPPFLAGS (Masahiro Yamada)
  - kbuild: Add CLANG_FLAGS to as-instr (Nathan Chancellor)
  - mips: Include KBUILD_CPPFLAGS in CHECKFLAGS invocation (Nathan Chancellor)
  - kbuild: Update assembler calls to use proper flags and language target (Nick Desaulniers)
  - ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS (Nathan Chancellor)
  - usb: dwc3: Ignore late xferNotReady event to prevent halt timeout (Kuen-Han Tsai)
  - USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles (Zenm Chen)
  - usb: storage: realtek_cr: Use correct byte order for bcs->Residue (Thorsten Blum)
  - USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera (Mael Guerin)
  - usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive (Miao Li)
  - iio: proximity: isl29501: fix buffered read on big-endian systems (David Lechner)
  - ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [Orabug: 38401581] {CVE-2025-39689}
  - fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() (Xu Yilun)
  - use uniform permission checks for all mount propagation changes (Al Viro)
  - move_mount: allow to add a mount into an existing group (Pavel Tikhomirov)
  - fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [Orabug: 38401587] {CVE-2025-39691}
  - drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs (Timur Kristóf)
  - drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 (Timur Kristóf)
  - memstick: Fix deadlock by moving removing flag earlier (Jiayi Li)
  - media: venus: Add a check for packet size after reading from shared memory (Vedang Nagar)
  - media: ov2659: Fix memory leaks in ov2659_probe() (Zhang Shurong)
  - media: usbtv: Lock resolution while streaming (Ludwig Disterhof) [Orabug: 38401684] {CVE-2025-39714}
  - media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (Haoxiang Li)
  - media: gspca: Add bounds checking to firmware parser (Dan Carpenter)
  - soc/tegra: pmc: Ensure power-domains are in a known state (Jonathan Hunter)
  - jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [Orabug: 38423509] {CVE-2025-39782}
  - PCI: endpoint: Fix configfs group removal on driver teardown (Damien Le Moal)
  - PCI: endpoint: Fix configfs group list head handling (Damien Le Moal)
  - mtd: rawnand: fsmc: Add missing check after DMA map (Thomas Fourier)
  - pwm: imx-tpm: Reset counter if CMOD is 0 (Laurentiu Mihalcea)
  - wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (Nathan Chancellor)
  - zynq_fpga: use sgtable-based scatterlist wrappers (Marek Szyprowski)
  - ata: libata-scsi: Fix ata_to_sense_error() status handling (Damien Le Moal)
  - ext4: fix reserved gdt blocks handling in fsmap (Ojaswin Mujoo)
  - ext4: fix fsmap end of range reporting with bigalloc (Ojaswin Mujoo)
  - ext4: check fast symlink for ea_inode correctly (Andreas Dilger)
  - vt: defkeymap: Map keycodes above 127 to K_HOLE (Myrrh Periwinkle)
  - vt: keyboard: Don't process Unicode characters in K_OFF mode (Myrrh Periwinkle)
  - usb: dwc3: meson-g12a: fix device leaks at unbind (Johan Hovold)
  - usb: gadget: udc: renesas_usb3: fix device leak at unbind (Johan Hovold)
  - usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (Nathan Chancellor)
  - m68k: Fix lost column on framebuffer debug console (Finn Thain)
  - cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (Dan Carpenter)
  - serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [Orabug: 38401729] {CVE-2025-39724}
  - media: uvcvideo: Do not mark valid metadata as invalid (Ricardo Ribalda)
  - media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394816] {CVE-2025-38680}
  - mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() (Waiman Long)
  - parisc: Makefile: fix a typo in palo.conf (Randy Dunlap)
  - btrfs: fix log tree replay failure due to file with 0 links and extents (Filipe Manana)
  - thunderbolt: Fix copy+paste error in match_service_id() (Eric Biggers)
  - comedi: fix race between polling and detaching (Ian Abbott)
  - misc: rtsx: usb: Ensure mmc child device is active when card is present (Ricky Wu)
  - drm/amdgpu: fix incorrect vm flags to map bo (Jack Xiao)
  - scsi: lpfc: Remove redundant assignment to avoid memory leak (Jiasheng Jiang)
  - rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe (Meagan Lloyd)
  - pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394867] {CVE-2025-38691}
  - pNFS: Handle RPC size limit for layoutcommits (Sergey Bashirov)
  - pNFS: Fix disk addr range check in block/scsi layout (Sergey Bashirov)
  - pNFS: Fix stripe mapping in block/scsi layout (Sergey Bashirov)
  - net: phy: smsc: add proper reset flags for LAN8710A (Csaba Buday)
  - ipmi: Fix strcpy source and destination the same (Corey Minyard)
  - kconfig: lxdialog: fix 'space' to (de)select options (Yann E. MORIN)
  - kconfig: gconf: fix potential memory leak in renderer_edited() (Masahiro Yamada)
  - kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() (Masahiro Yamada)
  - ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Breno Leitao)
  - scsi: aacraid: Stop using PCI_IRQ_AFFINITY (John Garry)
  - scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (Ranjan Kumar)
  - kconfig: nconf: Ensure null termination where strncpy is used (Shankari Anand)
  - kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c (Suchit Karunakaran)
  - i3c: don't fail if GETHDRCAP is unsupported (Wolfram Sang)
  - PCI: pnv_php: Work around switches with broken presence detection (Timothy Pearson)
  - i3c: add missing include to internal header (Wolfram Sang)
  - media: uvcvideo: Fix bandwidth issue for Alcor camera (Chenchangcheng)
  - media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394880] {CVE-2025-38693}
  - media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394887] {CVE-2025-38694}
  - media: usb: hdpvr: disable zero-length read messages (Wolfram Sang)
  - media: tc358743: Increase FIFO trigger level to 374 (Dave Stevenson)
  - media: tc358743: Return an appropriate colorspace from tc358743_set_fmt (Dave Stevenson)
  - media: tc358743: Check I2C succeeded during probe (Dave Stevenson)
  - pinctrl: stm32: Manage irq affinity settings (Cheick Traore)
  - scsi: mpt3sas: Correctly handle ATA device errors (Damien Le Moal)
  - scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug: 38394894] {CVE-2025-38695}
  - RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423286] {CVE-2025-39742}
  - MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh)
  - jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte)
  - jfs: Regular file corruption check (Edward Adam Davis)
  - jfs: truncate good inode pages when hard link is 0 (Lizhi Xu)
  - scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394925] {CVE-2025-38699}
  - MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} (Shiji Yang)
  - watchdog: dw_wdt: Fix default timeout (Sebastian Reichel)
  - fs/orangefs: use snprintf() instead of sprintf() (Amir Mohammad Jahangirzad)
  - scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated (Showrya M N) [Orabug: 38394931] {CVE-2025-38700}
  - ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394937] {CVE-2025-38701}
  - cifs: Fix calling CIFSFindFirst() for root path without msearch (Pali Rohár)
  - vhost: fail early when __vhost_add_used() fails (Jason Wang)
  - net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 (Álvaro Fernández Rojas)
  - uapi: in6: restore visibility of most IPv6 socket options (Jakub Kicinski)
  - net: ncsi: Fix buffer overflow in fetching version id (Hari Kalavakunta)
  - net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 (Álvaro Fernández Rojas)
  - net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 (Álvaro Fernández Rojas)
  - net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs (Gal Pressman)
  - wifi: iwlegacy: Check rate_idx range after addition (Stanislaw Gruszka)
  - netmem: fix skb_frag_address_safe with unreadable skbs (Mina Almasry)
  - wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. (Thomas Fourier)
  - wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect (Anjaneyulu)
  - wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() (Rand Deeb)
  - net: fec: allow disable coalescing (Jonas Rebmann)
  - (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer (Thomas Fourier)
  - s390/stp: Remove udelay from stp_sync_clock() (Sven Schnelle)
  - wifi: iwlwifi: mvm: fix scan request validation (Avraham Stern)
  - net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() (Alok Tiwari)
  - net: ipv4: fix incorrect MTU in broadcast routes (Oscar Maes)
  - wifi: cfg80211: Fix interface type validation (Ilan Peer)
  - rcu: Protect ->defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423341] {CVE-2025-39749}
  - net: ag71xx: Add missing check after DMA map (Thomas Fourier)
  - et131x: Add missing check after DMA map (Thomas Fourier)
  - be2net: Use correct byte order and format string for TCP seq and ack_seq (Alok Tiwari)
  - s390/time: Use monotonic clock in get_cycles() (Sven Schnelle)
  - wifi: cfg80211: reject HTC bit for management frames (Johannes Berg)
  - ktest.pl: Prevent recursion of default variable options (Steven Rostedt)
  - ASoC: codecs: rt5640: Retry DEVICE_ID verification (Xinxin Wan)
  - ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros (Cristian Ciocaltea)
  - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun)
  - platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches (Kees Cook)
  - pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() (Gautham R. Shenoy)
  - usb: core: usb_submit_urb: downgrade type check (Oliver Neukum)
  - ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 (Alok Tiwari)
  - ASoC: hdac_hdmi: Rate limit logging on connection and disconnection (Mark Brown)
  - mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() (Ulf Hansson)
  - ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (Breno Leitao)
  - ACPI: processor: fix acpi_object initialization (Sebastian Ott)
  - PM: sleep: console: Fix the black screen issue (Tuhaowen)
  - thermal: sysfs: Return ENODATA instead of EAGAIN for reads (Hsin-Te Yuan)
  - PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() (Rafael J. Wysocki)
  - selftests: tracing: Use mutex_unlock for testing glob filter (Masami Hiramatsu)
  - ARM: tegra: Use I/O memcpy to write to IRAM (Aaron Kling)
  - gpio: tps65912: check the return value of regmap_update_bits() (Bartosz Golaszewski)
  - ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed (Kuninori Morimoto)
  - ARM: rockchip: fix kernel hang during smp initialization (Alexander Kochetkov)
  - cpufreq: Exit governor when failed to start old governor (Lifeng Zheng)
  - usb: xhci: Avoid showing errors during surprise removal (Mario Limonciello)
  - usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command (Jay Chen)
  - usb: xhci: Avoid showing warnings for dying controller (Mario Limonciello)
  - selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t (Cynthia Huang)
  - usb: xhci: print xhci->xhc_state when queue_command failed (Su Hui)
  - securityfs: don't pin dentries twice, once is enough... (Al Viro)
  - hfs: fix not erasing deleted b-tree node issue (Viacheslav Dubeyko)
  - drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394995] {CVE-2025-38708}
  - udf: Verify partition map count (Jan Kara)
  - arm64: Handle KCOV __init vs inline mismatches (Kees Cook)
  - hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa)
  - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko)
  - hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko)
  - hfs: fix slab-out-of-bounds in hfs_bnode_read() (Viacheslav Dubeyko)
  - sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395059] {CVE-2025-38718}
  - netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395068] {CVE-2025-38721}
  - udp: also consider secpath when evaluating ipsec use for checksumming (Sabrina Dubroca)
  - ACPI: processor: perflib: Move problematic pr->performance check (Rafael J. Wysocki)
  - ACPI: processor: perflib: Fix initial _PPC limit application (Jiayi Li)
  - Documentation: ACPI: Fix parent device references (Andy Shevchenko)
  - fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423397] {CVE-2025-39756}
  - sunvdc: Balance device refcount in vdc_port_mpgroup_check (Ma Ke)
  - NFSD: detect mismatch of file handle and delegation stateid in OPEN op (Dai Ngo)
  - net: dpaa: fix device leak when querying time stamp info (Johan Hovold)
  - net: gianfar: fix device leak when querying time stamp info (Johan Hovold)
  - netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38401319] {CVE-2025-38727}
  - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423407] {CVE-2025-39757}
  - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395101] {CVE-2025-38729}
  - io_uring: don't use int for ABI (Pavel Begunkov)
  - usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue) [Orabug: 38334898] {CVE-2025-38555}
  - MIPS: mm: tlb-r4k: Uniquify TLB entries on init (Jiaxun Yang)
  - USB: serial: option: add Foxconn T99W709 (Slark Xiao)
  - vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351771,38453914] {CVE-2025-38618}
  - net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351764] {CVE-2025-38617}
  - perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334948] {CVE-2025-38563}
  - perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334959] {CVE-2025-38565}
  - perf/core: Don't leak AUX buffer refcount on allocation failure (Thomas Gleixner)
  - pptp: fix pptp_xmit() error path (Eric Dumazet)
  - smb: client: let recv_done() cleanup before notifying the callers. (Stefan Metzmacher)
  - benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334976] {CVE-2025-38569}
  - net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351786] {CVE-2025-38622}
  - ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334988] {CVE-2025-38572}
  - pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335004] {CVE-2025-38574}
  - netpoll: prevent hanging NAPI when netcons gets enabled (Jakub Kicinski)
  - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401745] {CVE-2025-39730}
  - pci/hotplug/pnv-php: Wrap warnings in macro (Frederic Barrat)
  - pci/hotplug/pnv-php: Improve error msg on power state change failure (Frederic Barrat)
  - usb: chipidea: udc: fix sleeping function called from invalid context (Peter Chen)
  - f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu)
  - f2fs: fix to avoid panic in f2fs_evict_inode (Chao Yu)
  - f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu)
  - rtc: pcf8563: fix incorrect maximum clock rate handling (Brian Masney)
  - rtc: hym8563: fix incorrect maximum clock rate handling (Brian Masney)
  - rtc: ds1307: fix incorrect maximum clock rate handling (Brian Masney)
  - module: Restore the moduleparam prefix length check (Petr Pavlu)
  - bpf: Check flow_dissector ctx accesses are aligned (Paul Chaignon)
  - mtd: rawnand: atmel: set pmecc data setup time (Balamanikandan Gunasundar)
  - mtd: rawnand: atmel: Fix dma_mapping_error() address (Thomas Fourier)
  - jfs: fix metapage reference count leak in dbAllocCtl (Zheng Yu)
  - fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (Chenyuan Yang)
  - crypto: qat - fix seq_file position update in adf_ring_next() (Giovanni Cabiddu)
  - dmaengine: nbpfaxi: Add missing check after DMA map (Thomas Fourier)
  - dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (Thomas Fourier)
  - fs/orangefs: Allow 2 more characters in do_c_string() (Dan Carpenter)
  - soundwire: stream: restore params when prepare ports fail (Bard Liao)
  - crypto: img-hash - Fix dma_unmap_sg() nents value (Thomas Fourier)
  - hwrng: mtk - handle devm_pm_runtime_enable errors (Ovidiu Panait)
  - watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (Dan Carpenter)
  - scsi: isci: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - scsi: mvsas: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - clk: sunxi-ng: v3s: Fix de clock definition (Paul Kocialkowski)
  - perf tests bp_account: Fix leaked file descriptor (Leo Yan)
  - crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong)
  - pinctrl: sunxi: Fix memory leak on krealloc failure (Yuan Chen)
  - power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (Charles Han)
  - clk: davinci: Add NULL check in davinci_lpsc_clk_register() (Henry Martin)
  - mtd: fix possible integer overflow in erase_xfer() (Ivan Stepchenko)
  - crypto: marvell/cesa - Fix engine load inaccuracy (Herbert Xu)
  - PCI: rockchip-host: Fix "Unexpected Completion" log message (Hans Zhang)
  - vrf: Drop existing dst reference in vrf_ip6_input_dst (Stanislav Fomichev)
  - selftests: rtnetlink.sh: remove esp4_offload after test (Xiumei Mu)
  - netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351854] {CVE-2025-38639}
  - can: kvaser_usb: Assign netdev.dev_port based on device channel index (Jimmy Assarsson)
  - can: kvaser_pciefd: Store device channel index (Jimmy Assarsson)
  - wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (Gokul Sivakumar)
  - Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Remi Pommarel)
  - mwl8k: Add missing check after DMA map (Thomas Fourier)
  - wifi: rtl8xxxu: Fix RX skb size for aggregation disabled (Martin Kaistra)
  - net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug: 38331466] {CVE-2025-38553}
  - arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX (Johan Korsnes)
  - drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (Fedor Pchelkin)
  - m68k: Don't unregister boot console needlessly (Finn Thain)
  - tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range (Xin Guo)
  - iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335110] {CVE-2025-38602}
  - wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (Xiu Jianfeng)
  - wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335120] {CVE-2025-38604}
  - caif: reduce stack size, again (Arnd Bergmann)
  - bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure (Yuan Chen)
  - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335131] {CVE-2025-38608}
  - staging: nvec: Fix incorrect null termination of battery manufacturer (Alok Tiwari)
  - samples: mei: Fix building on musl libc (Brahmajit Das)
  - cpufreq: Init policy->rwsem before it may be possibly used (Lifeng Zheng)
  - ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface (Annette Kobou)
  - usb: early: xhci-dbc: Fix early_ioremap leak (Lucas De Marchi)
  - Revert "vmci: Prevent the dispatching of uninitialized payloads" (Greg Kroah-Hartman)
  - pps: fix poll support (Denis Osterland-Heim)
  - vmci: Prevent the dispatching of uninitialized payloads (Lizhi Xu)
  - staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal) [Orabug: 38335153] {CVE-2025-38612}
  - ARM: dts: vfxxx: Correctly use two tuples for timer address (Krzysztof Kozlowski)
  - hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li)
  - ASoC: Intel: fix SND_SOC_SOF dependencies (Arnd Bergmann)
  - ethernet: intel: fix building with large NR_CPUS (Arnd Bergmann)
  - usb: phy: mxs: disconnect line when USB charger is attached (Xu Yang)
  - usb: chipidea: add USB PHY event (Xu Yang)
  - usb: chipidea: introduce CI_HDRC_CONTROLLER_VBUS_EVENT glue layer use (Peter Chen)
  - usb: chipidea: udc: protect usb interrupt enable (Li Jun)
  - usb: chipidea: udc: add new API ci_hdrc_gadget_connect (Peter Chen)
  - ALSA: hda: Add missing NVIDIA HDA codec IDs (Daniel Dadap)
  - comedi: comedi_test: Fix possible deletion of uninitialized timers (Ian Abbott)
  - nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi)
  - i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351994] {CVE-2025-38671}
  - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei)
  - net: appletalk: Fix use-after-free in AARP proxy probe (Kito Xu)
  - net: appletalk: fix kerneldoc warnings (Andrew Lunn)
  - RDMA/core: Rate limit GID cache warning messages (Maor Gottlieb)
  - regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati) [Orabug: 38351978] {CVE-2025-38668}
  - usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
  - usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
  - net_sched: sch_sfq: reject invalid perturb period (Eric Dumazet) [Orabug: 38158477] {CVE-2025-38193}
  - power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition (Zheng Wang)
  - power: supply: bq24190_charger: using pm_runtime_resume_and_get instead of pm_runtime_get_sync (Minghao Chi)
  - power: supply: bq24190_charger: Fix runtime PM imbalance on error (Dinghao Liu)
  - xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
  - virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253834] {CVE-2025-38375}
  - ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
  - usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
  - usb: musb: fix gadget state on disconnect (Drew Hamilton)
  - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254214] {CVE-2025-38468}
  - net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254225] {CVE-2025-38470}
  - Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
  - Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
  - Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
  - Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254241] {CVE-2025-38473}
  - usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254249] {CVE-2025-38474}
  - net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254266] {CVE-2025-38477}
  - net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
  - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott)
  - comedi: Fix some signed shift left operations (Ian Abbott)
  - comedi: das6402: Fix bit shift out of bounds (Ian Abbott)
  - comedi: das16m1: Fix bit shift out of bounds (Ian Abbott)
  - comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott)
  - comedi: pcl812: Fix bit shift out of bounds (Ian Abbott)
  - iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
  - iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
  - iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
  - soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
  - soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
  - mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
  - mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
  - mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
  - isofs: Verify inode mode when loading from disk (Jan Kara)
  - dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter)
  - af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
  - af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
  - phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
  - HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254340,38453904] {CVE-2025-38494}
  - HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
  - HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254348,38453908] {CVE-2025-38495}
  - pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
  - Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
  - i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
  - usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254358] {CVE-2025-38497}
  - USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
  - USB: serial: option: add Foxconn T99W640 (Slark Xiao)
  - USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
  - LTS tag: v5.4.296 (Sherry Yang)
  - x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
  - Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID (Hans de Goede)
  - HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324280] {CVE-2025-38540}
  - HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
  - vt: add missing notification when switching back to text mode (Nicolas Pitre)
  - net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
  - atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
  - bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254090] {CVE-2025-38439}
  - bnxt_en: Fix DCB ETS validation (Shravya Kn)
  - can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
  - net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
  - net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu)
  - md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254109] {CVE-2025-38445}
  - wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324161] {CVE-2025-38513}
  - dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
  - Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
  - Input: xpad - add VID for Turtle Beach controllers (Vicki Pfau)
  - Input: xpad - add support for Amazon Game Controller (Matt Reynolds)
  - NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
  - flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Tigran Mkrtchyan)
  - RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad)
  - netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
  - netlink: make sure we allow at least one dump skb (Jakub Kicinski)
  - Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
  - usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254118] {CVE-2025-38448}
  - drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324180] {CVE-2025-38515}
  - pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324186] {CVE-2025-38516}
  - x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
  - x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
  - x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
  - rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells)
  - net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254147] {CVE-2025-38457}
  - atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254153] {CVE-2025-38458}
  - atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254161] {CVE-2025-38459}
  - atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324309] {CVE-2025-38546}
  - atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254167] {CVE-2025-38460}
  - tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254181] {CVE-2025-38464}
  - netlink: Fix wraparounds of sk->sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254188] {CVE-2025-38465}
  - fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
  - proc: Clear the pieces of proc_inode that proc_evict_inode cares about (Eric W. Biederman)
  - drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254203] {CVE-2025-38467}
  - staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() (Nathan Chancellor)
  - media: uvcvideo: Rollback non processed entities on error (Ricardo Ribalda)
  - media: uvcvideo: Send control events for partial succeeds (Ricardo Ribalda)
  - media: uvcvideo: Return the number of processed controls (Ricardo Ribalda)
  - ACPI: PAD: fix crash in exit_round_robin() (Seiji Nishikawa) [Orabug: 37206006] {CVE-2024-49935}
  - usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38401436] {CVE-2025-38404}
  - Logitech C-270 even more broken (Oliver Neukum)
  - rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju)
  - net: rose: Fix fall-through warnings for Clang (Gustavo A R Silva)
  - drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253887] {CVE-2025-38389}
  - drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
  - spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
  - spi: spi-fsl-dspi: Fix interrupt-less DMA mode taking an XSPI code path (Vladimir Oltean)
  - spi: spi-fsl-dspi: Rename fifo_{read,write} and {tx,cmd}_fifo_write (Vladimir Oltean)
  - dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
  - ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
  - btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
  - btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
  - RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad)
  - RDMA/core: Create and destroy counters in the ib_core (Leon Romanovsky)
  - scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
  - drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal)
  - mtk-sd: reset host->mrq on prepare_data() error (Sergey Senozhatsky)
  - mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu)
  - mmc: mediatek: use data instead of mrq parameter from msdc_{un}prepare_data() (Yue Hu)
  - regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253907] {CVE-2025-38395}
  - regulator: gpio: Add input_supply support in gpio_regulator_config (Jerome Neanne)
  - ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253875] {CVE-2025-38386}
  - wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253946] {CVE-2025-38406}
  - wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
  - powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
  - ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
  - ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
  - nui: Fix dma_mapping_error() check (Thomas Fourier)
  - enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
  - amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
  - lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
  - drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
  - btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
  - scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
  - nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253923] {CVE-2025-38400}
  - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253881] {CVE-2025-38387}
  - platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
  - mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
  - usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253894] {CVE-2025-38391}
  - mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
  - vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253937] {CVE-2025-38403}
  - btrfs: don't abort filesystem when attempting to snapshot deleted subvolume (Omar Sandoval) [Orabug: 36530119] {CVE-2024-26644}
  - arm64: Restrict pagetable teardown to avoid false warning (Dev Jain)
  - s390: Add '-std=gnu11' to decompressor and purgatory CFLAGS (Nathan Chancellor)
  - drm/bridge: cdns-dsi: Check return value when getting default PHY config (Aradhya Bhatia)
  - drm/bridge: cdns-dsi: Fix connecting to next bridge (Aradhya Bhatia)
  - drm/bridge: cdns-dsi: Fix the clock variable for mode_valid() (Aradhya Bhatia)
  - drm/tegra: Assign plane type before registration (Thierry Reding)
  - HID: wacom: fix kobject reference count leak (Qasim Ijaz)
  - HID: wacom: fix memory leak on sysfs attribute creation failure (Qasim Ijaz)
  - HID: wacom: fix memory leak on kobject creation failure (Qasim Ijaz)
  - dm-raid: fix variable in journal device check (Heinz Mauelshagen)
  - Bluetooth: L2CAP: Fix L2CAP MTU negotiation (Frédéric Danis)
  - atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). (Kuniyuki Iwashima) [Orabug: 38175045] {CVE-2025-38245}
  - net: enetc: Correct endianness handling in _enetc_rd_reg64 (Simon Horman)
  - um: ubd: Add missing error check in start_io_thread() (Tiwei Bie)
  - vsock/uapi: fix linux/vm_sockets.h userspace compilation errors (Stefano Garzarella)
  - wifi: mac80211: fix beacon interval calculation overflow (Lachlan Hodges)
  - attach_recursive_mnt(): do not lock the covering tree when sliding something under it (Al Viro)
  - ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() (Youngjun Lee) [Orabug: 38175065] {CVE-2025-38249}
  - i2c: robotfuzz-osif: disable zero-length read messages (Wolfram Sang)
  - i2c: tiny-usb: disable zero-length read messages (Wolfram Sang)
  - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Shin'Ichiro Kawasaki) [Orabug: 38158592] {CVE-2025-38211}
  - RDMA/core: Use refcount_t instead of atomic_t on refcount of iwcm_id_private (Weihang Li)
  - media: vivid: Change the siize of the composing (Denis Arefev)
  - media: omap3isp: use sgtable-based scatterlist wrappers (Marek Szyprowski)
  - media: cxusb: no longer judge rbuf when the write fails (Edward Adam Davis) [Orabug: 38158692] {CVE-2025-38229}
  - media: cxusb: use dev_dbg() rather than hand-rolled debug (Sean Young)
  - jfs: validate AG parameters in dbMount() to prevent crashes (Vasiliy Kovalev)
  - fs/jfs: consolidate sanity checking in dbMount (Dave Kleikamp)
  - ASoC: meson: meson-card-utils: use of_property_present() for DT parsing (Martin Blumenstingl)
  - of: Add of_property_present() helper (Rob Herring)
  - of: property: define of_property_read_u{8,16,32,64}_array() unconditionally (Michael Walle)
  - kbuild: hdrcheck: fix cross build with clang (Arnd Bergmann)
  - kbuild: add --target to correctly cross-compile UAPI headers with Clang (Masahiro Yamada)
  - bpfilter: match bit size of bpfilter_umh to that of the kernel (Masahiro Yamada)
  - kbuild: use -MMD instead of -MD to exclude system headers from dependency (Masahiro Yamada)
  - VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify (Ma Wupeng) [Orabug: 38152869] {CVE-2025-38102}
  - VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF (George Kennedy)
  - ovl: Check for NULL d_inode() in ovl_dentry_upper() (Kees Cook)
  - ceph: fix possible integer overflow in ceph_zero_objects() (Dmitry Kandybka)
  - ALSA: hda: Ignore unsol events for cards being shut down (Cezary Rojewski)
  - usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode (Jos Wang)
  - usb: cdc-wdm: avoid setting WDM_READ for ZLP-s (Robert Hodaszi)
  - usb: Add checks for snprintf() calls in usb_alloc_dev() (Andy Shevchenko)
  - tty: serial: uartlite: register uart driver in init (Jakub Lewalski)
  - usb: potential integer overflow in usbg_make_tpg() (Chen Yufeng)
  - iio: pressure: zpa2326: Use aligned_s64 for the timestamp (Jonathan Cameron)
  - md/md-bitmap: fix dm-raid max_write_behind setting (Yu Kuai)
  - dmaengine: xilinx_dma: Set dma_device directions (Thomas Gessler)
  - mfd: max14577: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
  - mailbox: Not protect module_put with spin_lock_irqsave (Peng Fan)
  - cifs: Fix cifs_query_path_info() for Windows NT servers (Pali Rohár)


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.349.1.el8uek]
changelog:
  - NFSv4: Don't clear capabilities that won't be reset (Trond Myklebust)
  - power: supply: bq27xxx: restrict no-battery detection to bq27000 (H. Nikolaus Schaller)
  - power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery (H. Nikolaus Schaller)
  - usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
  - soc: qcom: mdt_loader: Deal with zero e_shentsize (Bjorn Andersson)
  - Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" (Tariq Toukan)
  - LTS tag: v5.4.299 (Alok Tiwari)
  - scsi: lpfc: Fix buffer free/clear order in deferred receive path (John Evans) [Orabug: 38456754] {CVE-2025-39841}
  - dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
  - cifs: fix integer overflow in match_server() (Roman Smirnov)
  - spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort (Larisa Grigore)
  - spi: spi-fsl-lpspi: Set correct chip-select polarity bit (Larisa Grigore)
  - spi: spi-fsl-lpspi: Fix transmissions when using CONT (Larisa Grigore)
  - pcmcia: Add error handling for add_interval() in do_validate_mem() (Xu Wang)
  - ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model (Takashi Iwai)
  - randstruct: gcc-plugin: Fix attribute addition (Kees Cook)
  - randstruct: gcc-plugin: Remove bogus void member (Kees Cook)
  - vmxnet3: update MTU after device quiesce (Ronak Doshi)
  - net: dsa: microchip: linearize skb for tail-tagging switches (Jakob Unterwurzacher)
  - net: dsa: microchip: update tag_ksz masks for KSZ9477 family (Pieter Van Trappen)
  - dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
  - ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup (Chris Chiu)
  - gpio: pca953x: fix IRQ storm on system wake up (Emanuele Ghidoli)
  - iio: light: opt3001: fix deadlock due to concurrent flag access (Luca Ceresoli) [Orabug: 37977028] {CVE-2025-37968}
  - iio: chemical: pms7003: use aligned_s64 for timestamp (David Lechner)
  - cpufreq/sched: Explicitly synchronize limits_changed flag handling (Rafael J. Wysocki)
  - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Li Qiong) [Orabug: 38494761] {CVE-2025-39902}
  - mm/khugepaged: fix ->anon_vma race (Jann Horn)
  - e1000e: fix heap overflow in e1000_set_eeprom (Vitaly Lifshits)
  - batman-adv: fix OOB read/write in network-coding decode (Stanislav Fort)
  - drm/amdgpu: drop hw access in non-DC audio fini (Alex Deucher)
  - wifi: mwifiex: Initialize the chan_stats array to zero (Rong Qianfeng) [Orabug: 38494723] {CVE-2025-39891}
  - pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() (Ma Ke)
  - ALSA: usb-audio: Add mute TLV for playback volumes on some devices (Cryolitia Pukngae)
  - ppp: fix memory leak in pad_compress_skb (Qingfang Deng) [Orabug: 38456781] {CVE-2025-39847}
  - net: atm: fix memory leak in atm_register_sysfs when device_register fail (Wang Liang)
  - ax25: properly unshare skbs in ax25_kiss_rcv() (Eric Dumazet)
  - ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() (Dan Carpenter)
  - net: thunder_bgx: add a missing of_node_put (Rosen Penev)
  - wifi: libertas: cap SSID len in lbs_associate() (Dan Carpenter)
  - wifi: cw1200: cap SSID length in cw1200_do_join() (Dan Carpenter)
  - net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets (Felix Fietkau)
  - i40e: Fix potential invalid access when MAC list is empty (Zhen Ni) [Orabug: 38456814] {CVE-2025-39853}
  - icmp: fix icmp_ndo_send address translation for reply direction (Fabian Bläse)
  - mISDN: Fix memory leak in dsp_hwec_enable() (Miaoqian Lin)
  - xirc2ps_cs: fix register access when enabling FullDuplex (Alok Tiwari)
  - Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (Kuniyuki Iwashima) [Orabug: 38456834] {CVE-2025-39860}
  - netfilter: conntrack: helper: Replace -EEXIST by -EBUSY (Phil Sutter)
  - wifi: cfg80211: fix use-after-free in cmp_bss() (Dmitry Antipov) [Orabug: 38456860] {CVE-2025-39864}
  - powerpc: boot: Remove leading zero in label in udelay() (Nathan Chancellor)


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.350.1.el8uek]
changelog:
  - device-dax: correct pgoff align in dax_set_mapping() (Kun(Llfl)) [Orabug: 37206404] {CVE-2024-50022}


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.350.2.el8uek]
changelog:
  - LTS tag: v5.4.301 (Alok Tiwari)
  - net: rtnetlink: fix module reference count leak issue in rtnetlink_rcv_msg (Zhengchao Shao)
  - media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
  - NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
  - NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
  - padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
  - KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
  - NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601819] {CVE-2025-40087}
  - vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601924] {CVE-2025-40105}
  - jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
  - ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey) [Orabug: 38649223] {CVE-2025-40167}
  - drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
  - ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (Theodore Ts'O) [Orabug: 38649412] {CVE-2025-40198}
  - spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
  - spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
  - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
  - memory: samsung: exynos-srom: Correct alignment (Krzysztof Kozlowski)
  - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Rutland)
  - arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
  - comedi: fix divide-by-zero in comedi_buf_munge() (Deepanshu Kartikey)
  - binder: remove "invalid inc weak" check (Alice Ryhl)
  - xhci: dbc: enable back DbC in resume if it was enabled before suspend (Mathias Nyman)
  - usb/core/quirks: Add Huawei ME906S to wakeup quirk (Tim Guttzeit)
  - USB: serial: option: add Telit FN920C04 ECM compositions (Li Qingwu)
  - USB: serial: option: add Quectel RG255C (Reinhard Speyerer)
  - USB: serial: option: add UNISOC UIS7720 (Renjun Wang)
  - net: ravb: Ensure memory write completes before ringing TX doorbell (Lad Prabhakar)
  - net: usb: rtl8150: Fix frame padding (Michał Pecio)
  - ocfs2: clear extent cache after moving/defragmenting extents (Deepanshu Kartikey) [Orabug: 38730547] {CVE-2025-40233}
  - MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering (Maciej W. Rozycki)
  - Revert "cpuidle: menu: Avoid discarding useful information" (Rafael J. Wysocki)
  - net: bonding: fix possible peer notify event loss or dup issue (Tonghao Zhang)
  - sctp: avoid NULL dereference when chunk data buffer is missing (Alexey Simakov) [Orabug: 38730567] {CVE-2025-40240}
  - arm64, mm: avoid always making PTE dirty in pte_mkwrite() (Huang, Ying)
  - net: enetc: correct the value of ENETC_RXB_TRUESIZE (Wei Fang)
  - rtnetlink: Allow deleting FDB entries in user namespace (Johannes Wiesboeck)
  - net: rtnetlink: add NLM_F_BULK support to rtnl_fdb_del (Nikolay Aleksandrov)
  - net: add ndo_fdb_del_bulk (Nikolay Aleksandrov)
  - net: rtnetlink: add bulk delete support flag (Nikolay Aleksandrov)
  - net: netlink: add NLM_F_BULK delete request modifier (Nikolay Aleksandrov)
  - net: rtnetlink: use BIT for flag values (Nikolay Aleksandrov)
  - net: rtnetlink: add helper to extract msg type's kind (Nikolay Aleksandrov)
  - net: rtnetlink: add msg kind names (Nikolay Aleksandrov)
  - net: rtnetlink: remove redundant assignment to variable err (Colin Ian King)
  - m68k: bitops: Fix find_*_bit() signatures (Geert Uytterhoeven)
  - hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() (Yangtao Li)
  - hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() (Viacheslav Dubeyko)
  - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring)
  - hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (Viacheslav Dubeyko)
  - hfs: validate record offset in hfsplus_bmap_alloc (Yang Chenzhi)
  - hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() (Viacheslav Dubeyko)
  - hfs: make proper initalization of struct hfs_find_data (Viacheslav Dubeyko)
  - hfs: clear offset and space out of valid records in b-tree node (Viacheslav Dubeyko)
  - exec: Fix incorrect type for ret (Xichao Zhao)
  - hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
  - ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
  - sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
  - sched/balancing: Rename newidle_balance() => sched_balance_newidle() (Ingo Molnar)
  - sched/fair: Trivial correction of the newidle_balance() comment (Barry Song)
  - sched: Make newidle_balance() static again (Chen Yu)
  - tls: don't rely on tx_work during send() (Sabrina Dubroca)
  - tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
  - tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
  - tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
  - amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
  - net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov) [Orabug: 38649261] {CVE-2025-40173}
  - net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
  - net: dl2k: switch from 'pci_' to 'dma_' API (Christophe Jaillet)
  - media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
  - media: pci/ivtv: switch from 'pci_' to 'dma_' API (Christophe Jaillet)
  - xen/events: Update virq_to_irq on migration (Jason Andryuk)
  - media: lirc: Fix error handling in lirc_register() (Ma Ke)
  - media: rc: Directly use ida_free() (Keliu)
  - drm/exynos: exynos7_drm_decon: remove ctx->suspended (Kaustabh Chakraborty)
  - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento) [Orabug: 38649463] {CVE-2025-40205}
  - pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
  - media: cx18: Add missing check after DMA map (Thomas Fourier)
  - xen/events: Cleanup find_virq() return codes (Jason Andryuk)
  - cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
  - fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
  - pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17) [Orabug: 38649276] {CVE-2025-40178}
  - minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
  - tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592033] {CVE-2025-40042}
  - dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing) [Orabug: 38649057] {CVE-2025-40134}
  - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
  - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
  - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
  - Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher) [Orabug: 38649425] {CVE-2025-40200}
  - Squashfs: add additional inode sanity checking (Phillip Lougher)
  - media: mc: Clear minor number before put device (Edward Adam Davis) [Orabug: 38649399] {CVE-2025-40197}
  - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
  - fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592048] {CVE-2025-40044}
  - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591959] {CVE-2025-40026}
  - net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591965] {CVE-2025-40027}
  - ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag) [Orabug: 38649330] {CVE-2025-40190}
  - ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
  - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
  - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
  - x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
  - x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
  - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
  - PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
  - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle) [Orabug: 38730513] {CVE-2025-40219}
  - rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
  - rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
  - rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
  - mmc: core: SPI mode remove cmd7 (Rex Chen)
  - mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
  - sparc: fix error handling in scan_one_device() (Ma Ke)
  - sparc64: fix hugetlb for sun4u (Anthony Yznaga)
  - sctp: Fix MAC comparison to be constant-time (Eric Biggers) [Orabug: 38649451] {CVE-2025-40204}
  - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
  - parisc: don't reference obsolete termio struct for TC* constants (Sam James)
  - lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
  - iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
  - iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
  - iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
  - crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
  - cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki) [Orabug: 38649367] {CVE-2025-40194}
  - drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
  - media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
  - firmware: meson_sm: fix device leak at probe (Johan Hovold)
  - xen/manage: Fix suspend error path (Lukas Wunner)
  - arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
  - ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
  - ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
  - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
  - tpm, tpm_tis: Claim locality before writing interrupt registers (Lino Sanfilippo)
  - crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581456,38705546] {CVE-2025-40019}
  - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
  - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
  - tools build: Align warning options with perf (Leo Yan)
  - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
  - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima) [Orabug: 38649579] {CVE-2025-40186}
  - net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov) [Orabug: 38649313] {CVE-2025-40187}
  - drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes) [Orabug: 38643546] {CVE-2025-40111}
  - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
  - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557654] {CVE-2025-40001}
  - scsi: mvsas: Use sas_task_find_rq() for tagging (John Garry)
  - scsi: mvsas: Delete mvs_tag_init() (John Garry)
  - scsi: libsas: Add sas_task_find_rq() (John Garry)
  - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
  - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
  - perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
  - rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
  - perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
  - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
  - clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
  - pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591981] {CVE-2025-40030}
  - Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38592002] {CVE-2025-40035}
  - mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi) [Orabug: 38649150] {CVE-2025-40153}
  - uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592067] {CVE-2025-40048}
  - Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592077] {CVE-2025-40049}
  - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
  - nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
  - drivers/base/node: fix double free in register_one_node() (Donet Tom)
  - ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592110] {CVE-2025-40055}
  - net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath) [Orabug: 38649096] {CVE-2025-40140}
  - RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
  - usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
  - scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar) [Orabug: 38648982] {CVE-2025-40115}
  - ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581446] {CVE-2025-40018}
  - NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
  - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
  - sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
  - sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
  - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
  - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
  - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
  - IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
  - RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
  - wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
  - drivers/base/node: handle error properly in register_one_node() (Donet Tom)
  - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
  - netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
  - iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
  - ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai)
  - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai)
  - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
  - pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592170] {CVE-2025-40070}
  - misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
  - usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
  - usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
  - tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
  - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation (Alok Tiwari)
  - wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
  - ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
  - media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
  - scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
  - scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel) [Orabug: 38649567] {CVE-2025-40118}
  - serial: max310x: Add error checking in probe() (Dan Carpenter)
  - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
  - drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
  - i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
  - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
  - bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592205] {CVE-2025-40078}
  - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
  - pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
  - block: use int to store blk_stack_limits() return value (Rong Qianfeng)
  - blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan) [Orabug: 38649026] {CVE-2025-40125}
  - pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
  - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
  - ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
  - regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
  - x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
  - perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592223] {CVE-2025-40081}
  - driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
  - staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
  - staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
  - perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
  - dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
  - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
  - USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
  - media: rc: fix races with imon_disconnect() (Larshin Sergey) [Orabug: 38548027] {CVE-2025-39993}
  - media: imon: grab lock earlier in imon_ir_change_protocol() (Tetsuo Handa)
  - media: imon: reorganize serialization (Tetsuo Handa)
  - media: rc: Add support for another iMON 0xffdc device (Flavius Georgescu)
  - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou) [Orabug: 38548044] {CVE-2025-39995}
  - media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou) [Orabug: 38548037] {CVE-2025-39994}
  - media: tunner: xc5000: Refactor firmware load (Ricardo Ribalda)
  - udp: Fix memory accounting leak. (Kuniyuki Iwashima) [Orabug: 37844325] {CVE-2025-22058}
  - media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou) [Orabug: 38548051] {CVE-2025-39996}
  - scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran) [Orabug: 38548059] {CVE-2025-39998}
  - LTS tag: v5.4.300 (Alok Tiwari)
  - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active (Maciej S. Szmigiero)
  - mm/hugetlb: fix folio is still mapped when deleted (Tu Jinjiang) [Orabug: 38560482] {CVE-2025-40006}
  - i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)
  - i40e: fix validation of VF state in get resources (Lukasz Czapnik) [Orabug: 38547929] {CVE-2025-39969}
  - i40e: fix idx validation in config queues msg (Lukasz Czapnik) [Orabug: 38547938] {CVE-2025-39971}
  - i40e: add validation for ring_len param (Lukasz Czapnik) [Orabug: 38547952,38604168,38604171] {CVE-2025-39973}
  - i40e: increase max descriptors for XL710 (Justin Bronder)
  - mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize() (David Hildenbrand)
  - fbcon: Fix OOB access in font allocation (Thomas Zimmermann)
  - fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda) [Orabug: 38547913] {CVE-2025-39967}
  - i40e: add max boundary check for VF filters (Lukasz Czapnik) [Orabug: 38547923] {CVE-2025-39968}
  - i40e: fix input validation logic for action_meta (Lukasz Czapnik) [Orabug: 38547933] {CVE-2025-39970}
  - i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik) [Orabug: 38547946] {CVE-2025-39972}
  - drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita) [Orabug: 38560496] {CVE-2025-40011}
  - can: peak_usb: fix shift-out-of-bounds issue (Stephane Grosjean) [Orabug: 38581463] {CVE-2025-40020}
  - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
  - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
  - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
  - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)
  - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)
  - usb: core: Add 0x prefix to quirks debug output (Jiayi Li)
  - ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)
  - ALSA: usb-audio: Convert comma to semicolon (Chen Ni)
  - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)
  - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)
  - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)
  - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)
  - ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)
  - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer (Hans de Goede)
  - net: rfkill: gpio: add DT support (Philipp Zabel)
  - serial: sc16is7xx: fix bug in flow control levels init (Hugo Villeneuve)
  - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels (Alan Stern)
  - usb: gadget: dummy_hcd: remove usage of list iterator past the loop body (Jakob Koschel)
  - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message (Colin Ian King)
  - ASoC: wm8974: Correct PLL rate rounding (Charles Keepax)
  - ASoC: wm8940: Correct typo in control name (Charles Keepax)
  - mmc: mvsdio: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* (Nathan Chancellor)
  - cnic: Fix use-after-free bugs in cnic_delete_task (Duoming Zhou) [Orabug: 38503849] {CVE-2025-39945}
  - net: liquidio: fix overflow in octeon_init_instr_queue() (Alexey Nepomnyashih)
  - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Kuniyuki Iwashima) [Orabug: 38526388] {CVE-2025-39955}
  - i40e: remove redundant memory barrier when cleaning Tx descs (Maciej Fijalkowski)
  - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure (Moon Yeounsu)
  - cgroup: split cgroup_destroy_wq into 3 workqueues (Chen Ridong) [Orabug: 38503892] {CVE-2025-39953}
  - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch (Geert Uytterhoeven)
  - wifi: mac80211: fix incorrect type for ret (Liao Yuanhong)
  - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported (Takashi Sakamoto)
  - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Miaohe Lin) [Orabug: 38461848] {CVE-2025-39883}
  - phy: ti-pipe3: fix device leak at unbind (Johan Hovold)
  - dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees (Stephan Gerhold) [Orabug: 38494822] {CVE-2025-39923}
  - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (Anders Roxell)
  - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails (Tetsuo Handa)
  - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed (Tetsuo Handa)
  - i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (Michal Schmidt) [Orabug: 38494787] {CVE-2025-39911}
  - i40e: Use irq_update_affinity_hint() (Nitesh Narayan Lal)
  - genirq: Provide new interfaces for affinity hints (Thomas Gleixner)
  - genirq: Export affinity setter for modules (Thomas Gleixner)
  - genirq/affinity: Add irq_update_affinity_desc() (John Garry)
  - igb: fix link test skipping when interface is admin down (Kohei Enju)
  - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (Stefan Wahren)
  - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
  - USB: serial: option: add Telit Cinterion FN990A w/audio compositions (Fabio Porcedda)
  - tty: hvc_console: Call hvc_kick in hvc_write unconditionally (Fabian Vogt)
  - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing (Alexander Sverdlin)
  - mtd: nand: raw: atmel: Fix comment in timings preparation (Alexander Dahl)
  - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer (Christophe Kerello)
  - mm/khugepaged: fix the address passed to notifier on testing young (Wei Yang)
  - fuse: prevent overflow in copy_file_range return value (Miklos Szeredi)
  - fuse: check if copy_file_range() returns larger than requested size (Miklos Szeredi)
  - mtd: rawnand: stm32_fmc2: fix ECC overwrite (Christophe Kerello)
  - ocfs2: fix recursive semaphore deadlock in fiemap call (Mark Tinguely) [Orabug: 38461859] {CVE-2025-39885}
  - EDAC/altera: Delete an inappropriate dma_free_coherent() call (Salah Triki)
  - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. (Kuniyuki Iwashima) [Orabug: 38494797] {CVE-2025-39913}
  - net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod. (Kuniyuki Iwashima) [Orabug: 37901604] {CVE-2025-23143}


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.350.3.1.el8uek]
changelog:
  - Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha)  [Orabug: 38744458]  
  - fbcon: fix integer overflow in font allocation (Samasth Norway Ananda)  [Orabug: 38744453]


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.350.3.1.el8uek]
changelog:
  - Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha)  [Orabug: 38744458]
  - fbcon: fix integer overflow in font allocation (Samasth Norway Ananda)  [Orabug: 38744453]


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.351.1.el8uek]
changelog:
  - scsi: megaraid_sas: Fix concurrent access to ISR between IRQ polling and real interrupt (Sumit Saxena) [Orabug: 38630482]


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.351.2.el8uek]
changelog:
  - uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu) [Orabug: 38609548]
  - rds: Add smp_rmb before reading c_destroy_in_prog (Håkon Bugge) [Orabug: 38352486]
  - uio_hv_generic: Set event for all channels on the device (Long Li)
  - ata: libata-scsi: Fix system suspend for a security locked drive (Niklas Cassel)
  - HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 (Zhang Heng)


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.351.3.el8uek]
changelog:
  - Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha)  [Orabug: 38715366]
  - fbcon: fix integer overflow in font allocation (Samasth Norway Ananda)  [Orabug: 38702507]
  - uek-rpm: Replace check-kabi tool with kabi (Yifei Liu)  [Orabug: 38673382]
  - uek-rpm: Introduce check function for uek-rpm/tools/kabi (Yifei Liu)  [Orabug: 38673382]


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.351.3.2.el8uek]
changelog:
  - tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima)  [Orabug: 38855323]  {CVE-2025-40280} 
  - tipc: simplify the finalize work queue (Xin Long)  [Orabug: 38855323]  
  - vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj)  [Orabug: 38855319]  {CVE-2025-40248} 
  - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu)  [Orabug: 38855313]  {CVE-2025-39964}


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.351.3.2.el8uek]
changelog:
  - tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima)  [Orabug: 38855323]  {CVE-2025-40280}
  - tipc: simplify the finalize work queue (Xin Long)  [Orabug: 38855323]
  - vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj)  [Orabug: 38855319]  {CVE-2025-40248}
  - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu)  [Orabug: 38855313]  {CVE-2025-39964}


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.351.3.3.el8uek]
changelog:
  - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers)  [Orabug: 38884602]  {CVE-2025-40022}


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.351.3.el8uek]
changelog:
  - Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38715366]
  - fbcon: fix integer overflow in font allocation (Samasth Norway Ananda) [Orabug: 38702507]
  - uek-rpm: Replace check-kabi tool with kabi (Yifei Liu) [Orabug: 38673382]
  - uek-rpm: Introduce check function for uek-rpm/tools/kabi (Yifei Liu) [Orabug: 38673382]


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.352.1.el8uek]
changelog:
  - RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge) [Orabug: 38753401]
  - soc/pensando: giglio: hack dts to make things right (Rob Gardner) [Orabug: 38688154]
  - soc/pensando: Add AMD Pensando Giglio SoC support (Brad Larson) [Orabug: 38688154]
  - soc/pensando: psci support (David Clear) [Orabug: 38688154]
  - soc/pensando: Giglio SoC eMMC interrupt driver (Brad Larson) [Orabug: 38688154]


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.352.2.el8uek]
changelog:
  - LTS tag: v5.4.302 (Sherry Yang)
  - Input: pegasus-notetaker - fix potential out-of-bounds access (Seungjin Bae)
  - Input: remove third argument of usb_maxpacket() (Vincent Mailhol)
  - usb: deprecate the third argument of usb_maxpacket() (Vincent Mailhol)
  - fs/proc: fix uaf in proc_readdir_de() (Wei Yang) [Orabug: 38737034,38786776,38787139] {CVE-2025-40271}
  - pmdomain: imx: Fix reference count leak in imx_gpc_remove (Miaoqian Lin)
  - pmdomain: arm: scmi: Fix genpd leak on provider registration failure (Sudeep Holla)
  - net: netpoll: fix incorrect refcount handling causing incorrect cleanup (Breno Leitao) [Orabug: 38773510] {CVE-2025-68245}
  - net: qede: Initialize qede_ll_ops with designated initializer (Nathan Chancellor)
  - net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error (Nishanth Menon)
  - ALSA: usb-audio: fix uac2 clock source at terminal parser (René Rebe)
  - mm/page_alloc: fix hash table order logging in alloc_large_system_hash() (Isaac J. Manjarres)
  - kconfig/nconf: Initialize the default locale at startup (Jakub Horký)
  - kconfig/mconf: Initialize the default locale at startup (Jakub Horký)
  - vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj) [Orabug: 38730612] {CVE-2025-40248}
  - s390/ctcm: Fix double-kfree (Aleksei Nikiforov)
  - net: openvswitch: remove never-working support for setting nsh fields (Ilya Maximets) [Orabug: 38730650] {CVE-2025-40254}
  - mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() (Zilin Guan)
  - MIPS: Malta: Fix !EVA SOC-it PCI MMIO (Maciej W. Rozycki)
  - scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() (Hamza Mahfooz) [Orabug: 38773441] {CVE-2025-68229}
  - scsi: sg: Do not sleep in atomic context (Bart Van Assche) [Orabug: 38730664] {CVE-2025-40259}
  - Input: cros_ec_keyb - fix an invalid memory access (Tzung-Bi Shih) [Orabug: 38730681] {CVE-2025-40263}
  - be2net: pass wrb_params in case of OS2BMC (Andrey Vatoropin) [Orabug: 38730691] {CVE-2025-40264}
  - isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (Abdun Nihaal) [Orabug: 38798908] {CVE-2025-68734}
  - EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection (Niravkumar L Rabara)
  - EDAC/altera: Handle OCRAM ECC enable after warm reset (Niravkumar L Rabara)
  - spi: Try to get ACPI GPIO IRQ earlier (Hans de Goede)
  - ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (Chuang Wang) [Orabug: 38773496] {CVE-2025-68241}
  - strparser: Fix signed/unsigned mismatch bug (Nate Karstens)
  - gcov: add support for GCC 15 (Peter Oberparleiter)
  - mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs)
  - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (Haein Lee) [Orabug: 38737052] {CVE-2025-40275}
  - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (Ian Forbes) [Orabug: 38737061] {CVE-2025-40277}
  - ASoC: cs4271: Fix regulator leak on probe failure (Xu Wang)
  - regulator: fixed: fix GPIO descriptor leak on register failure (Xu Wang)
  - regulator: fixed: use dev_err_probe for register (Chris Morgan)
  - Bluetooth: L2CAP: export l2cap_chan_hold for modules (Pauli Virtanen)
  - net_sched: limit try_bulk_dequeue_skb() batches (Eric Dumazet)
  - net_sched: remove need_resched() from qdisc_run() (Eric Dumazet)
  - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Gal Pressman)
  - net/mlx5e: Fix maxrate wraparound in threshold between units (Gal Pressman)
  - net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (Ranganath V N)
  - wifi: mac80211: skip rate verification for not captured PSDUs (Benjamin Berg)
  - net: mdio: fix resource leak in mdiobus_register_device() (Csaba Buday)
  - tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima) [Orabug: 38737084] {CVE-2025-40280}
  - tipc: simplify the finalize work queue (Xin Long)
  - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto (Eric Dumazet) [Orabug: 38737091] {CVE-2025-40281}
  - sctp: get netns from asoc and ep base (Xin Long)
  - Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions (Pauli Virtanen)
  - Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion (Pauli Virtanen)
  - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (Pauli Virtanen)
  - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (Raphael Pinsonneault-Thibeault) [Orabug: 38737104] {CVE-2025-40283}
  - net: fec: correct rx_bytes statistic for the case SHIFT16 is set (Wei Fang)
  - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (Sharique Mohammad)
  - HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (Tristan Lobb)
  - NFS4: Fix state renewals missing after boot (Joshua Watt)
  - compiler_types: Move unused static inline functions warning to W=2 (Peter Zijlstra)
  - extcon: adc-jack: Cleanup wakeup source only if it was enabled (Krzysztof Kozlowski)
  - tracing: Fix memory leaks in create_field_var() (Zilin Guan)
  - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (Qendrim Maxhuni) [Orabug: 38773283] {CVE-2025-68192}
  - sctp: Prevent TOCTOU out-of-bounds write (Stefan Wiehler) [Orabug: 38747447] {CVE-2025-40331}
  - sctp: Hold RCU read lock while iterating over address list (Stefan Wiehler)
  - net: dsa: b53: stop reading ARL entries if search is done (Jonas Gorski)
  - net: dsa: b53: fix enabling ip multicast (Jonas Gorski)
  - net: dsa: b53: fix resetting speed and pause on forced link (Jonas Gorski)
  - net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 (Álvaro Fernández Rojas)
  - net: dsa/b53: change b53_force_port_config() pause argument (Russell King)
  - net: vlan: sync VLAN features with lower device (Hangbin Liu)
  - ceph: add checking of wait_for_completion_killable() return value (Viacheslav Dubeyko)
  - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (Albin Babu Varghese) [Orabug: 38737182] {CVE-2025-40304}
  - ACPI: property: Return present device nodes only on fwnode interface (Sakari Ailus)
  - 9p: sysfs_init: don't hardcode error to ENOMEM (Randall P. Embry)
  - 9p: fix /sys/fs/9p/caches overwriting itself (Randall P. Embry)
  - fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink (Yikang Yue)
  - ACPICA: Update dsmethod.c to get rid of unused variable warning (Saket Dumbre)
  - orangefs: fix xattr related buffer overflow... (Mike Marshall)
  - page_pool: Clamp pool size to max 16K pages (Dragos Tatulea)
  - Bluetooth: bcsp: receive data only if registered (Ivan Pravdin) [Orabug: 38737213] {CVE-2025-40308}
  - Bluetooth: SCO: Fix UAF on sco_conn_free (Luiz Augusto von Dentz) [Orabug: 38737224] {CVE-2025-40309}
  - net: macb: avoid dealing with endianness in macb_set_hwaddr() (Théo Lebrun)
  - nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing (Al Viro) [Orabug: 38773245] {CVE-2025-68185}
  - NFSv4.1: fix mount hang after CREATE_SESSION failure (Anthony Iliopoulos)
  - NFSv4: handle ERR_GRACE on delegation recalls (Olga Kornievskaia)
  - remoteproc: qcom: q6v5: Avoid handling handover twice (Stephan Gerhold)
  - sparc/module: Add R_SPARC_UA64 relocation handling (Koakuma)
  - net: intel: fm10k: Fix parameter idx set but not used (Brahmajit Das)
  - jfs: fix uninitialized waitqueue in transaction manager (Shaurya Rane)
  - jfs: Verify inode mode when loading from disk (Tetsuo Handa)
  - ipv6: np->rxpmtu race annotation (Eric Dumazet)
  - usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (Krishna Kurapati)
  - usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (Forest Crossman)
  - allow finish_no_open(file, ERR_PTR(-E...)) (Al Viro)
  - scsi: lpfc: Define size of debugfs entry for xri rebalancing (Justin Tee)
  - scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET (Justin Tee)
  - selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency (Nai-Chen Cheng)
  - net/cls_cgroup: Fix task_get_classid() during qdisc run (Yafang Shao)
  - selftests: Replace sleep with slowwait (David Ahern)
  - selftests: Disable dad for ipv6 in fcnal-test.sh (David Ahern)
  - media: redrat3: use int type to store negative error codes (Rong Qianfeng)
  - net: sh_eth: Disable WoL if system can not suspend (Niklas Söderlund)
  - phy: cadence: cdns-dphy: Enable lower resolutions in dphy (Harikrishna Shenoy)
  - usb: gadget: f_hid: Fix zero length packet transfer (William Wu)
  - net: call cond_resched() less often in __release_sock() (Eric Dumazet)
  - ALSA: usb-audio: apply quirk for MOONDROP Quark2 (Cryolitia Pukngae)
  - net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms (Juraj Šarinay)
  - dmaengine: dw-edma: Set status for callback_result (Devendra K Verma)
  - dmaengine: mv_xor: match alloc_wc and free_wc (Rosen Penev)
  - dmaengine: sh: setup_xref error handling (Thomas Andreatta)
  - scsi: pm8001: Use int instead of u32 to store error codes (Rong Qianfeng)
  - mips: lantiq: xway: sysctrl: rename stp clock (Aleksander Jan Bajkowski)
  - mips: lantiq: danube: add missing device_type in pci node (Aleksander Jan Bajkowski)
  - mips: lantiq: danube: add missing properties to cpu node (Aleksander Jan Bajkowski)
  - media: fix uninitialized symbol warnings (Chelsy Ratnawat)
  - drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (Amber Lin)
  - extcon: adc-jack: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
  - PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (Sungho Kim)
  - net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. (Kuniyuki Iwashima)
  - net: When removing nexthops, don't call synchronize_net if it is not necessary (Christoph Paasch)
  - char: misc: Does not request module for miscdevice with dynamic minor (Zijun Hu)
  - usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (Raub Camaioni)
  - iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (Rodrigo Gobbi)
  - media: imon: make send_packet() more robust (Tetsuo Handa) [Orabug: 38773298] {CVE-2025-68194}
  - net: ipv6: fix field-spanning memcpy warning in AH output (Charalampos Mitrodimas) [Orabug: 38773141] {CVE-2025-40363}
  - bridge: Redirect to backup port when port is administratively down (Ido Schimmel)
  - powerpc/eeh: Use result of error_detected() in uevent (Niklas Schnelle)
  - x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall (Kirill A. Shutemov)
  - media: pci: ivtv: Don't create fake v4l2_fh (Laurent Pinchart)
  - drm/amdkfd: return -ENOTTY for unsupported IOCTLs (Geoffrey Mcrae)
  - selftests/net: Ensure assert() triggers in psock_tpacket.c (Wake Liu)
  - selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 (Wake Liu)
  - PCI: Disable MSI on RDC PCI to PCIe bridges (Marcos Del Sol Vives)
  - drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (Seyediman Seyedarab)
  - mfd: madera: Work around false-positive -Wininitialized warning (Arnd Bergmann)
  - mfd: stmpe-i2c: Add missing MODULE_LICENSE (Alexander Stein)
  - mfd: stmpe: Remove IRQ domain upon removal (Alexander Stein)
  - tools/power x86_energy_perf_policy: Prefer driver HWP limits (Len Brown)
  - tools/power x86_energy_perf_policy: Enhance HWP enable (Len Brown)
  - tools/cpupower: Fix incorrect size in cpuidle_state_disable() (Kaushlendra Kumar)
  - hwmon: (dell-smm) Add support for Dell OptiPlex 7040 (Armin Wolf)
  - uprobe: Do not emulate/sstep original instruction when ip is changed (Jiri Olsa)
  - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Daniel Lezcano)
  - video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (Svyatoslav Ryhel)
  - tee: allow a driver to allocate a tee_device without a pool (Amirreza Zarrabi)
  - ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (Hans de Goede)
  - mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (Sarthak Garg)
  - irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment (Christian Bruel)
  - arc: Fix __fls() const-foldability via __builtin_clzl() (Kees Cook)
  - cpufreq/longhaul: handle NULL policy in longhaul_exit (Dennis Beier)
  - selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 (Ricardo B. Marlière)
  - ACPI: video: force native for Lenovo 82K8 (Mario Limonciello)
  - memstick: Add timeout to prevent indefinite waiting (Jiayi Li)
  - mmc: host: renesas_sdhi: Fix the actual clock (Biju Das)
  - bpf: Don't use %pK through printk (Thomas Weißschuh)
  - spi: loopback-test: Don't use %pK through printk (Thomas Weißschuh)
  - soc: qcom: smem: Fix endian-unaware access of num_entries (Jens Reidel)
  - usb: gadget: f_fs: Fix epfile null pointer access after ep enable. (Owen Gu)
  - serial: 8250_dw: handle reset control deassert error (Artem Shimko)
  - serial: 8250_dw: Use devm_add_action_or_reset() (Andy Shevchenko)
  - serial: 8250_dw: Use devm_clk_get_optional() to get the input clock (Andy Shevchenko)
  - can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
  - devcoredump: Fix circular locking dependency with devcd->mutex. (Maarten Lankhorst)
  - net: ravb: Enforce descriptor type ordering (Lad Prabhakar)
  - x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
  - wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode (Gokul Sivakumar) [Orabug: 38737292] {CVE-2025-40321}
  - net: phy: dp83867: Disable EEE support as not implemented (Emanuele Ghidoli)
  - regmap: slimbus: fix bus_context pointer in regmap init calls (Alexey Klimov)
  - drm/etnaviv: fix flush sequence logic (Tomeu Vizoso)
  - usbnet: Prevents free active kevent (Lizhi Xu) [Orabug: 38773784] {CVE-2025-68312}
  - wifi: ath10k: Fix memory leak on unsupported WMI command (Loic Poulain)
  - ASoC: qdsp6: q6asm: do not sleep while atomic (Srinivas Kandagatla)
  - fbdev: valkyriefb: Fix reference count leak in valkyriefb_init (Miaoqian Lin)
  - fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (Florian Fuchs)
  - fbdev: bitblit: bound-check glyph index in bit_putcs* (Junjie Cao) [Orabug: 38737301] {CVE-2025-40322}
  - ACPI: video: Fix use-after-free in acpi_video_switch_brightness() (Yuhao Jiang) [Orabug: 38687005] {CVE-2025-40211}
  - fbdev: atyfb: Check if pll_ops->init_pll failed (Daniel Palmer)
  - net: usb: asix_devices: Check return value of usbnet_get_endpoints (Miaoqian Lin)
  - btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (Filipe Manana)
  - x86/bugs: Fix reporting of LFENCE retpoline (David Kaplan)
  - net/sched: sch_qfq: Fix null-deref in agg_dequeue (Xiang Mei) [Orabug: 38597085] {CVE-2025-40083}


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.352.3.el8uek]
changelog:
  - net/sched: adjust device watchdog timer to detect stopped queue at right time (Praveen Kumar Kannoju)  [Orabug: 38340278]
  - net/mlx5: Mark the mellanox graceful_period fix as out-of-tree change (Praveen Kumar Kannoju)  [Orabug: 38252416]
  - infiniband/xsigo: Replace BUG_ON with WARN_ON_ONCE. (Siddh Raman Pant)  [Orabug: 38418469]
  - infiniband/xsigo: xsvnic_main: Remove unused functions (Siddh Raman Pant)  [Orabug: 38418469]
  - infiniband/xsigo: xve_cm: Fix mixed code warning (Siddh Raman Pant)  [Orabug: 38418469]
  - infiniband/xsigo: xve_ethtool: Remove unused variable 'priv' (Siddh Raman Pant)  [Orabug: 38418469]
  - infiniband/xsigo: xve_ib: Fix misleading indentation (Siddh Raman Pant)  [Orabug: 38418469]
  - infiniband/xsigo: xve_ib: Fix mixed code warning (Siddh Raman Pant)  [Orabug: 38418469]
  - infiniband/xsigo: xve_verbs: Remove unused label 'out_free_pd' (Siddh Raman Pant)  [Orabug: 38418469]
  - infiniband/xsigo: xve_main: Remove unused function 'xve_napi_del' (Siddh Raman Pant)  [Orabug: 38418469]
  - infiniband/xsigo: xve_main: Fix mixed code warning (Siddh Raman Pant)  [Orabug: 38418469]
  - infiniband/xsigo: xve_main: Fix misleading indentation (Siddh Raman Pant)  [Orabug: 38418469]
  - inifinibad/xsigo: xsvnic_main: Remove unused variable 'xsvnic_ethtool_ops' (Siddh Raman Pant)  [Orabug: 38418469]
  - infiniband/xsigo: xscore_impl: Remove unused label 'err_pd' (Siddh Raman Pant)  [Orabug: 38418469]
  - rds: Fix jiffies type in struct rds_conn_path (Siddh Raman Pant)  [Orabug: 38418727]
  - kernel: sysctl: Remove unused variable 'zero' (Siddh Raman Pant)  [Orabug: 38418727]
  - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu)  [Orabug: 38537469]  {CVE-2025-39964}
  - RDMA/cm: Base cm_id destruction timeout on CMA values (Håkon Bugge)  [Orabug: 38753622]
  - x86/its: Build fails with CONFIG_MITIGATION_ITS=n (Alexandre Chartre)  [Orabug: 38756954]


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.352.5.el8uek]
changelog:
  - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers)  [Orabug: 38879907]  {CVE-2025-40022}


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.352.5.1.el8uek]
changelog:
  - xfrm: flush all states in xfrm_state_fini (Sabrina Dubroca)  [Orabug: 39016499]  
  - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added (Sabrina Dubroca)  [Orabug: 39016499]  
  - Revert "xfrm: destroy xfrm_state synchronously on net exit path" (Sabrina Dubroca)  [Orabug: 39016499]  
  - xfrm: delete x->tunnel as we delete x (Sabrina Dubroca)  [Orabug: 39016501]  {CVE-2025-40215}


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.353.2.el8uek]
changelog:
  - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" (Jiri Olsa)  [Orabug: 38893604]
  - xfrm: delete x->tunnel as we delete x (Sabrina Dubroca)  [Orabug: 38730493]  {CVE-2025-40215}


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.353.3.el8uek]
changelog:
  - xfrm: flush all states in xfrm_state_fini (Sabrina Dubroca)  [Orabug: 38934000]  
  - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added (Sabrina Dubroca)  [Orabug: 38934000]  
  - Revert "xfrm: destroy xfrm_state synchronously on net exit path" (Sabrina Dubroca)  [Orabug: 38934000]  
  - Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan)  [Orabug: 38923520]  
  - Revert "IB/core: Implement clear counters" (Sharath Srinivasan)  [Orabug: 38923520]  
  - Revert "ib/core: add SET_DEVICE_OP call for clear_hw_stats()" (Sharath Srinivasan)  [Orabug: 38923520]  
  - fs: proc: inode: delay put_pid() by RCU (Stephen Brennan)  [Orabug: 38766812]


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.352.3.el8uek]
changelog:
  - net/sched: adjust device watchdog timer to detect stopped queue at right time (Praveen Kumar Kannoju) [Orabug: 38340278]
  - net/mlx5: Mark the mellanox graceful_period fix as out-of-tree change (Praveen Kumar Kannoju) [Orabug: 38252416]
  - infiniband/xsigo: Replace BUG_ON with WARN_ON_ONCE. (Siddh Raman Pant) [Orabug: 38418469]
  - infiniband/xsigo: xsvnic_main: Remove unused functions (Siddh Raman Pant) [Orabug: 38418469]
  - infiniband/xsigo: xve_cm: Fix mixed code warning (Siddh Raman Pant) [Orabug: 38418469]
  - infiniband/xsigo: xve_ethtool: Remove unused variable 'priv' (Siddh Raman Pant) [Orabug: 38418469]
  - infiniband/xsigo: xve_ib: Fix misleading indentation (Siddh Raman Pant) [Orabug: 38418469]
  - infiniband/xsigo: xve_ib: Fix mixed code warning (Siddh Raman Pant) [Orabug: 38418469]
  - infiniband/xsigo: xve_verbs: Remove unused label 'out_free_pd' (Siddh Raman Pant) [Orabug: 38418469]
  - infiniband/xsigo: xve_main: Remove unused function 'xve_napi_del' (Siddh Raman Pant) [Orabug: 38418469]
  - infiniband/xsigo: xve_main: Fix mixed code warning (Siddh Raman Pant) [Orabug: 38418469]
  - infiniband/xsigo: xve_main: Fix misleading indentation (Siddh Raman Pant) [Orabug: 38418469]
  - inifinibad/xsigo: xsvnic_main: Remove unused variable 'xsvnic_ethtool_ops' (Siddh Raman Pant) [Orabug: 38418469]
  - infiniband/xsigo: xscore_impl: Remove unused label 'err_pd' (Siddh Raman Pant) [Orabug: 38418469]
  - rds: Fix jiffies type in struct rds_conn_path (Siddh Raman Pant) [Orabug: 38418727]
  - kernel: sysctl: Remove unused variable 'zero' (Siddh Raman Pant) [Orabug: 38418727]
  - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu) [Orabug: 38537469,38855313] {CVE-2025-39964}
  - RDMA/cm: Base cm_id destruction timeout on CMA values (Håkon Bugge) [Orabug: 38753622]
  - x86/its: Build fails with CONFIG_MITIGATION_ITS=n (Alexandre Chartre) [Orabug: 38756954]


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.352.5.el8uek]
changelog:
  - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers) [Orabug: 38879907,38884602,39004445] {CVE-2025-40022}


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.353.2.el8uek]
changelog:
  - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" (Jiri Olsa) [Orabug: 38893604]
  - xfrm: delete x->tunnel as we delete x (Sabrina Dubroca) [Orabug: 38730493,39016501] {CVE-2025-40215}


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.353.3.el8uek]
changelog:
  - xfrm: flush all states in xfrm_state_fini (Sabrina Dubroca) [Orabug: 38934000]
  - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added (Sabrina Dubroca) [Orabug: 38934000,39004270] {CVE-2025-40256}
  - Revert "xfrm: destroy xfrm_state synchronously on net exit path" (Sabrina Dubroca) [Orabug: 38934000]
  - Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923520]
  - Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923520]
  - Revert "ib/core: add SET_DEVICE_OP call for clear_hw_stats()" (Sharath Srinivasan) [Orabug: 38923520]
  - fs: proc: inode: delay put_pid() by RCU (Stephen Brennan) [Orabug: 38766812]


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.354.1.el8uek]
changelog:
  - genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001911]
  - rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870347]


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.354.2.el8uek]
changelog:
  - ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916908]
  - jbd2: store more accurate errno in superblock (Wengang Wang) [Orabug: 38916908]
  - ext4: save the error code which triggered an (Wengang Wang) [Orabug: 38916908]


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.354.3.el8uek]
changelog:
  - io_uring: fix filename leak in __io_openat_prep() (Prithvi Tambewagh)  [Orabug: 39064937]  {CVE-2025-68814}
  - rds: Drop rds conn in connect worker if not in down state. (Rohit Nair)  [Orabug: 39045035]


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.354.4.el8uek]
changelog:
  - macvlan: fix possible UAF in macvlan_forward_source() (Eric Dumazet)  [Orabug: 38887731]  {CVE-2026-23001}
  - macvlan: Use 'hash' iterators to simplify code (Christophe JAILLET)  [Orabug: 38887731]
  - macvlan: Add nodst option to macvlan type source (Jethro Beekman)  [Orabug: 38887731]
  - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet)  [Orabug: 38970510]
  - macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet)  [Orabug: 38970510]  {CVE-2026-23209}


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.354.4.1.el8uek]
changelog:
  - Revert "rds: Drop rds conn in connect worker if not in down state." (Alok Tiwari)  [Orabug: 39200399]


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.354.4.2.el8uek]
changelog:
  - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu)  [Orabug: 39292250]  
  - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39292250]  
  - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39292250]  
  - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39292250]  
  - crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39292250]  
  - crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39292250]  
  - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39292250]  
  - crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39292250]  {CVE-2026-31431} 
  - crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39292250]  
  - crypto: doc - fix kernel-doc notation in chacha.c and af_alg.c (Randy Dunlap)  [Orabug: 39292250]  
  - x86/CPU: Fix FPDSS on Zen1 (Siddh Raman Pant)  [Orabug: 39292236]


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.354.4.2.el8uek]
changelog:
  - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu)  [Orabug: 39292250]
  - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)  [Orabug: 39292250]
  - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)  [Orabug: 39292250]
  - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)  [Orabug: 39292250]
  - crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39292250]
  - crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)  [Orabug: 39292250]
  - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39292250]
  - crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)  [Orabug: 39292250]  {CVE-2026-31431}
  - crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)  [Orabug: 39292250]
  - crypto: doc - fix kernel-doc notation in chacha.c and af_alg.c (Randy Dunlap)  [Orabug: 39292250]
  - x86/CPU: Fix FPDSS on Zen1 (Siddh Raman Pant)  [Orabug: 39292236]


author: Samasth Norway Ananda <samasth.norway.ananda@oracle.com> [5.4.17-2136.354.4.3.el8uek]
changelog:
  - xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39342682]  {CVE-2026-43284}


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.354.3.el8uek]
changelog:
  - io_uring: fix filename leak in __io_openat_prep() (Prithvi Tambewagh) [Orabug: 39064937] {CVE-2025-68814}
  - rds: Drop rds conn in connect worker if not in down state. (Rohit Nair) [Orabug: 39045035]


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.354.4.el8uek]
changelog:
  - macvlan: fix possible UAF in macvlan_forward_source() (Eric Dumazet) [Orabug: 38887731] {CVE-2026-23001}
  - macvlan: Use 'hash' iterators to simplify code (Christophe Jaillet) [Orabug: 38887731] {CVE-2026-23001}
  - macvlan: Add nodst option to macvlan type source (Jethro Beekman) [Orabug: 38887731] {CVE-2026-23001}
  - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug: 38970510,39188399] {CVE-2026-23209,CVE-2026-23273}
  - macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970510] {CVE-2026-23209}


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.355.1.el8uek]
changelog:
  - net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930950] {CVE-2026-23074}


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.355.2.el8uek]
changelog:
  - Revert "rds: Drop rds conn in connect worker if not in down state." (Alok Tiwari) [Orabug: 39253770]
  - x86/CPU: Fix FPDSS on Zen1 (Siddh Raman Pant) [Orabug: 39241225,39273723] {CVE-2026-31628}
  - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (Joshua Rogers) [Orabug: 38852342] {CVE-2025-71120}


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.355.3.el8uek]
changelog:
  - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [Orabug: 39250687,39331106] {CVE-2026-43077}
  - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [Orabug: 39250687,39331111] {CVE-2026-43078}
  - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [Orabug: 39250687]
  - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [Orabug: 39250687,39300911] {CVE-2026-43033}
  - crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers) [Orabug: 39250687]
  - crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le) [Orabug: 39250687]
  - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [Orabug: 39250687,39283868,39292250] {CVE-2026-31431}
  - crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers) [Orabug: 39250687] {CVE-2026-31431}
  - crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers) [Orabug: 39250687]
  - crypto: doc - fix kernel-doc notation in chacha.c and af_alg.c (Randy Dunlap) [Orabug: 39250687]


author: Samasth Norway Ananda <samasth.norway.ananda@oracle.com> [5.4.17-2136.355.3.1.el8uek]
changelog:
  - xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39344527]  {CVE-2026-43284} 
  - x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39344576]  {CVE-2025-54518}


author: Samasth Norway Ananda <samasth.norway.ananda@oracle.com> [5.4.17-2136.355.3.1.el8uek]
changelog:
  - xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39344527]  {CVE-2026-43284}
  - x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39344576]  {CVE-2025-54518}


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.355.3.2.el8uek]
changelog:
  - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi)  [Orabug: 39368774]  {CVE-2026-23193}
  - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi)  [Orabug: 39368732]  {CVE-2026-23216}
  - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Jeff Layton)  [Orabug: 39368718]  {CVE-2026-31402}


author: Samasth Norway Ananda <samasth.norway.ananda@oracle.com> [5.4.17-2136.355.3.3.el8uek]
changelog:
  - ptrace: slightly saner 'get_dumpable()' logic (Linus Torvalds)  [Orabug: 39391459]  {CVE-2026-46333}


author: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> [5.4.17-2136.355.3.4.el8uek]
changelog:
  - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim)  [Orabug: 39420568]  {CVE-2026-46300} 
  - net: skbuff: preserve shared-frag marker during coalescing (William Bowling)  [Orabug: 39420568]


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.355.3.el8uek]
changelog:
  - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [Orabug: 39250687,39331106] {CVE-2026-43077}
  - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [Orabug: 39250687,39331111] {CVE-2026-43078}
  - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [Orabug: 39250687]
  - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [Orabug: 39250687,39300911] {CVE-2026-43033}
  - crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers) [Orabug: 39250687]
  - crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le) [Orabug: 39250687,39452217] {CVE-2026-46028}
  - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [Orabug: 39250687,39283868,39292250] {CVE-2026-31431}
  - crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers) [Orabug: 39250687] {CVE-2026-31431}
  - crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers) [Orabug: 39250687]
  - crypto: doc - fix kernel-doc notation in chacha.c and af_alg.c (Randy Dunlap) [Orabug: 39250687]


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.356.1.el8uek]
changelog:
  - arm64/kvm: Include linux/random.h in trng.c (Siddh Raman Pant) [Orabug: 39327096]
  - i2c: designware: Disable TX_EMPTY irq while waiting for block length byte (Tam Nguyen) [Orabug: 39174662]
  - i2c: designware: Handle invalid SMBus block data response length value (Tam Nguyen) [Orabug: 39174662]
  - i2c: designware: fix __i2c_dw_disable() in case master is holding SCL low (Yann Sionneau) [Orabug: 39174662]


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.356.2.el8uek]
changelog:
  - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Jeff Layton) [Orabug: 39167617,39368718] {CVE-2026-31402}
  - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985173,39368732] {CVE-2026-23216}
  - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970455,39368774] {CVE-2026-23193}
  - xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen) [Orabug: 39334580,39367147] {CVE-2026-43284}
  - x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia) [Orabug: 39218897] {CVE-2025-54518}


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.356.3.el8uek]
changelog:
  - ptrace: slightly saner 'get_dumpable()' logic (Linus Torvalds) [Orabug: 39384275,39391459] {CVE-2026-46333}
  - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim) [Orabug: 39368828,39441326] {CVE-2026-43503,CVE-2026-46300}
  - net: skbuff: preserve shared-frag marker during coalescing (William Bowling) [Orabug: 39368828] {CVE-2026-46300}


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.356.4.el8uek]
changelog:
  - tun: free page on build_skb failure in tun_xdp_one() (Weiming Shi) [Orabug: 39429147]
  - tap: free page on error paths in tap_get_user_xdp() (Weiming Shi) [Orabug: 39429147]
  - tun: free page on short-frame rejection in tun_xdp_one() (Weiming Shi) [Orabug: 39429147]


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.356.4.1.el8uek]
changelog:
  - smb: client: reject userspace cifs.spnego descriptions (Asim Viladi Oglu Manizada)  [Orabug: 39463669]


author: Samasth Norway Ananda <samasth.norway.ananda@oracle.com> [5.4.17-2136.356.4.2.el8uek]
changelog:
  - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Rutland)  [Orabug: 39017592]  {CVE-2025-10263} 
  - arm64: tlb: Add ARM64_WORKAROUND_REPEAT_TLBI_SYNC (Mark Rutland)  [Orabug: 39017592]  
  - ARM: uek: Disable CONFIG_QCOM_FALKOR_ERRATUM_1003 (Boris Ostrovsky)  [Orabug: 39017592]  
  - arm64: tlb: allow XZR argument to TLBI ops (Mark Rutland)  [Orabug: 39017592]  
  - arm64: cputype: Add C1-Premium definitions (Mark Rutland)  [Orabug: 39017592]  
  - arm64: cputype: Add C1-Ultra definitions (Mark Rutland)  [Orabug: 39017592]


author: Samasth Norway Ananda <samasth.norway.ananda@oracle.com> [5.4.17-2136.356.4.2.el8uek]
changelog:
  - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Rutland)  [Orabug: 39017592]  {CVE-2025-10263}
  - arm64: tlb: Add ARM64_WORKAROUND_REPEAT_TLBI_SYNC (Mark Rutland)  [Orabug: 39017592]
  - ARM: uek: Disable CONFIG_QCOM_FALKOR_ERRATUM_1003 (Boris Ostrovsky)  [Orabug: 39017592]
  - arm64: tlb: allow XZR argument to TLBI ops (Mark Rutland)  [Orabug: 39017592]
  - arm64: cputype: Add C1-Premium definitions (Mark Rutland)  [Orabug: 39017592]
  - arm64: cputype: Add C1-Ultra definitions (Mark Rutland)  [Orabug: 39017592]


author: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> [5.4.17-2136.356.4.3.el8uek]
changelog:
  - net: skbuff: fix missing zerocopy reference in pskb_carve helpers (Minh Nguyen)  [Orabug: 39639989]  {CVE-2026-52943}


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.356.4.1.el8uek]
changelog:
  - smb: client: reject userspace cifs.spnego descriptions (Asim Viladi Oglu Manizada)  [Orabug: 39463669] {CVE-2026-46243}


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.357.1.el8uek]
changelog:
  - batman-adv: hold claim backbone gateways by reference (Haoze Xie)  [Orabug: 39262375]  {CVE-2026-31657}
  - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (Michael Bommarito)  [Orabug: 39446045]
  - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Michael Bommarito)  [Orabug: 39446045]
  - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Michael Bommarito)  [Orabug: 39446045]
  - rds: Drop rds conn in connect worker if not in down state. (Rohit Nair)  [Orabug: 39152239]


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.357.2.el8uek]
changelog:
  - net: fix fanout UAF in packet_release() via NETDEV_UP race (Yochai Eisenrich)  [Orabug: 39250953]  {CVE-2026-31504}
  - x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers (Dan Williams)  [Orabug: 39429802]
  - x86/kaslr: Reduce KASLR entropy on most x86 systems (Balbir Singh)  [Orabug: 39429802]
  - net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null (Cezar Bulinaru)  [Orabug: 39526882]  {CVE-2022-50073}
  - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Rutland)  [Orabug: 39548666]  {CVE-2025-10263}
  - arm64: tlb: Add ARM64_WORKAROUND_REPEAT_TLBI_SYNC (Mark Rutland)  [Orabug: 39548666]
  - ARM: uek: Disable CONFIG_QCOM_FALKOR_ERRATUM_1003 (Boris Ostrovsky)  [Orabug: 39548666]
  - arm64: tlb: allow XZR argument to TLBI ops (Mark Rutland)  [Orabug: 39548666]
  - arm64: cputype: Add C1-Premium definitions (Mark Rutland)  [Orabug: 39548666]
  - arm64: cputype: Add C1-Ultra definitions (Mark Rutland)  [Orabug: 39548666]
  - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Eric Dumazet)  [Orabug: 39300926]  {CVE-2026-43037}


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.357.3.el8uek]
changelog:
  - net: skbuff: fix missing zerocopy reference in pskb_carve helpers (Minh Nguyen)  [Orabug: 39619389]  {CVE-2026-52943}


author: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> [5.4.17-2136.357.3.1.el8uek]
changelog:
  - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini)  [Orabug: 39673892]  
  - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Sean Christopherson)  [Orabug: 39673892]  
  - KVM: x86/MMU: Recursively zap nested TDP SPs when zapping last/only parent (Ben Gardon)  [Orabug: 39673892]  
  - KVM: x86/mmu: Move flush logic from mmu_page_zap_pte() to FNAME(invlpg) (Sean Christopherson)  [Orabug: 39673892]  
  - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini)  [Orabug: 39673892]  
  - KVM: x86/mmu: Passing up the error state of mmu_alloc_shadow_roots() (Like Xu)  [Orabug: 39673892]  
  - KVM: MMU: load PDPTRs outside mmu_lock (Paolo Bonzini)  [Orabug: 39673892]  
  - KVM: x86/mmu: Check PDPTRs before allocating PAE roots (Sean Christopherson)  [Orabug: 39673892]  
  - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (David Matlack)  [Orabug: 39673892]  
  - KVM: x86/mmu: Derive shadow MMU page role from parent (David Matlack)  [Orabug: 39673892]  
  - KVM: X86: Remove useless code to set role.gpte_is_8_bytes when role.direct (Lai Jiangshan)  [Orabug: 39673892]  
  - KVM: X86: Synchronize the shadow pagetable before link it (Lai Jiangshan)  [Orabug: 39673892]  
  - KVM: X86: Fix missed remote tlb flush in rmap_write_protect() (Lai Jiangshan)  [Orabug: 39673892]  
  - KVM: x86/mmu: Refactor shadow walk in __direct_map() to reduce indentation (Sean Christopherson)  [Orabug: 39673892]  
  - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (David Matlack)  [Orabug: 39673892]  
  - KVM: x86/mmu: Use a bool for direct (David Matlack)  [Orabug: 39673892]  
  - kvm: mmu: Replace unsigned with unsigned int for PTE access (Ben Gardon)  [Orabug: 39673892]  
  - KVM: x86/mmu: Ensure MMU pages are available when allocating roots (Sean Christopherson)  [Orabug: 39673892]  
  - KVM: x86/mmu: Allocate pae_root and lm_root pages in dedicated helper (Sean Christopherson)  [Orabug: 39673892]  
  - KVM: x86/mmu: Allocate the lm_root before allocating PAE roots (Sean Christopherson)  [Orabug: 39673892]  
  - KVM: x86/mmu: Capture 'mmu' in a local variable when allocating roots (Sean Christopherson)  [Orabug: 39673892]  
  - KVM: x86/mmu: Alloc page for PDPTEs when shadowing 32-bit NPT with 64-bit (Sean Christopherson)  [Orabug: 39673892]  
  - KVM: x86/mmu: Stash 'kvm' in a local variable in kvm_mmu_free_roots() (Sean Christopherson)  [Orabug: 39673892]  
  - KVM: x86/mmu: Add a helper to consolidate root sp allocation (Sean Christopherson)  [Orabug: 39673892]  
  - net/sched: act_pedit: fix action bind logic (Pedro Tammela)  [Orabug: 39680880]  
  - net/sched: act_pedit: free pedit keys on bail from offset check (Pedro Tammela)  [Orabug: 39680880]  
  - net/sched: fix pedit partial COW leading to page cache corruption (Rajat Gupta)  [Orabug: 39680880]  {CVE-2026-46331} 
  - net/sched: act_pedit: Parse L3 Header for L4 offset (Max Tottenham)  [Orabug: 39680880]  
  - net/sched: act_pedit: rate limit datapath messages (Pedro Tammela)  [Orabug: 39680880]  
  - net/sched: act_pedit: check static offsets a priori (Pedro Tammela)  [Orabug: 39680880]  
  - net/sched: act_pedit: remove extra check for key type (Pedro Tammela)  [Orabug: 39680880]  
  - net/sched: simplify tcf_pedit_act (Pedro Tammela)  [Orabug: 39680880]  
  - net/sched: transition act_pedit to rcu and percpu stats (Pedro Tammela)  [Orabug: 39680880]  
  - net/sched: act_pedit: use NLA_POLICY for parsing 'ex' keys (Pedro Tammela)  [Orabug: 39680880]


author: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> [5.4.17-2136.357.3.1.el8uek]
changelog:
  - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini)  [Orabug: 39673892]
  - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Sean Christopherson)  [Orabug: 39673892]
  - KVM: x86/MMU: Recursively zap nested TDP SPs when zapping last/only parent (Ben Gardon)  [Orabug: 39673892]
  - KVM: x86/mmu: Move flush logic from mmu_page_zap_pte() to FNAME(invlpg) (Sean Christopherson)  [Orabug: 39673892]
  - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini)  [Orabug: 39673892]
  - KVM: x86/mmu: Passing up the error state of mmu_alloc_shadow_roots() (Like Xu)  [Orabug: 39673892]
  - KVM: MMU: load PDPTRs outside mmu_lock (Paolo Bonzini)  [Orabug: 39673892]
  - KVM: x86/mmu: Check PDPTRs before allocating PAE roots (Sean Christopherson)  [Orabug: 39673892]
  - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (David Matlack)  [Orabug: 39673892]
  - KVM: x86/mmu: Derive shadow MMU page role from parent (David Matlack)  [Orabug: 39673892]
  - KVM: X86: Remove useless code to set role.gpte_is_8_bytes when role.direct (Lai Jiangshan)  [Orabug: 39673892]
  - KVM: X86: Synchronize the shadow pagetable before link it (Lai Jiangshan)  [Orabug: 39673892]
  - KVM: X86: Fix missed remote tlb flush in rmap_write_protect() (Lai Jiangshan)  [Orabug: 39673892]
  - KVM: x86/mmu: Refactor shadow walk in __direct_map() to reduce indentation (Sean Christopherson)  [Orabug: 39673892]
  - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (David Matlack)  [Orabug: 39673892]
  - KVM: x86/mmu: Use a bool for direct (David Matlack)  [Orabug: 39673892]
  - kvm: mmu: Replace unsigned with unsigned int for PTE access (Ben Gardon)  [Orabug: 39673892]
  - KVM: x86/mmu: Ensure MMU pages are available when allocating roots (Sean Christopherson)  [Orabug: 39673892]
  - KVM: x86/mmu: Allocate pae_root and lm_root pages in dedicated helper (Sean Christopherson)  [Orabug: 39673892]
  - KVM: x86/mmu: Allocate the lm_root before allocating PAE roots (Sean Christopherson)  [Orabug: 39673892]
  - KVM: x86/mmu: Capture 'mmu' in a local variable when allocating roots (Sean Christopherson)  [Orabug: 39673892]
  - KVM: x86/mmu: Alloc page for PDPTEs when shadowing 32-bit NPT with 64-bit (Sean Christopherson)  [Orabug: 39673892]
  - KVM: x86/mmu: Stash 'kvm' in a local variable in kvm_mmu_free_roots() (Sean Christopherson)  [Orabug: 39673892]
  - KVM: x86/mmu: Add a helper to consolidate root sp allocation (Sean Christopherson)  [Orabug: 39673892]
  - net/sched: act_pedit: fix action bind logic (Pedro Tammela)  [Orabug: 39680880]
  - net/sched: act_pedit: free pedit keys on bail from offset check (Pedro Tammela)  [Orabug: 39680880]
  - net/sched: fix pedit partial COW leading to page cache corruption (Rajat Gupta)  [Orabug: 39680880]  {CVE-2026-46331}
  - net/sched: act_pedit: Parse L3 Header for L4 offset (Max Tottenham)  [Orabug: 39680880]
  - net/sched: act_pedit: rate limit datapath messages (Pedro Tammela)  [Orabug: 39680880]
  - net/sched: act_pedit: check static offsets a priori (Pedro Tammela)  [Orabug: 39680880]
  - net/sched: act_pedit: remove extra check for key type (Pedro Tammela)  [Orabug: 39680880]
  - net/sched: simplify tcf_pedit_act (Pedro Tammela)  [Orabug: 39680880]
  - net/sched: transition act_pedit to rcu and percpu stats (Pedro Tammela)  [Orabug: 39680880]
  - net/sched: act_pedit: use NLA_POLICY for parsing 'ex' keys (Pedro Tammela)  [Orabug: 39680880]


author: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> [5.4.17-2136.357.3.2.el8uek]
changelog:
  - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Davidlohr Bueso)  [Orabug: 39706958]  
  - rtmutex: Use waiter::task instead of current in remove_waiter() (Keenan Dong)  [Orabug: 39706958]  {CVE-2026-43499}


author: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> [5.4.17-2136.357.3.2.el8uek]
changelog:
  - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Davidlohr Bueso)  [Orabug: 39706958]
  - rtmutex: Use waiter::task instead of current in remove_waiter() (Keenan Dong)  [Orabug: 39706958]  {CVE-2026-43499}


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.358.1.el8uek]
changelog:
  - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini)  [Orabug: 39673871]
  - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Sean Christopherson)  [Orabug: 39673871]
  - KVM: x86/MMU: Recursively zap nested TDP SPs when zapping last/only parent (Ben Gardon)  [Orabug: 39673871]
  - KVM: x86/mmu: Move flush logic from mmu_page_zap_pte() to FNAME(invlpg) (Sean Christopherson)  [Orabug: 39673871]
  - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini)  [Orabug: 39673871]
  - KVM: x86/mmu: Passing up the error state of mmu_alloc_shadow_roots() (Like Xu)  [Orabug: 39673871]
  - KVM: MMU: load PDPTRs outside mmu_lock (Paolo Bonzini)  [Orabug: 39673871]
  - KVM: x86/mmu: Check PDPTRs before allocating PAE roots (Sean Christopherson)  [Orabug: 39673871]
  - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (David Matlack)  [Orabug: 39673871]
  - KVM: x86/mmu: Derive shadow MMU page role from parent (David Matlack)  [Orabug: 39673871]
  - KVM: X86: Remove useless code to set role.gpte_is_8_bytes when role.direct (Lai Jiangshan)  [Orabug: 39673871]
  - KVM: X86: Synchronize the shadow pagetable before link it (Lai Jiangshan)  [Orabug: 39673871]
  - KVM: X86: Fix missed remote tlb flush in rmap_write_protect() (Lai Jiangshan)  [Orabug: 39673871]
  - KVM: x86/mmu: Refactor shadow walk in __direct_map() to reduce indentation (Sean Christopherson)  [Orabug: 39673871]
  - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (David Matlack)  [Orabug: 39673871]
  - KVM: x86/mmu: Use a bool for direct (David Matlack)  [Orabug: 39673871]
  - kvm: mmu: Replace unsigned with unsigned int for PTE access (Ben Gardon)  [Orabug: 39673871]
  - KVM: x86/mmu: Ensure MMU pages are available when allocating roots (Sean Christopherson)  [Orabug: 39673871]
  - KVM: x86/mmu: Allocate pae_root and lm_root pages in dedicated helper (Sean Christopherson)  [Orabug: 39673871]
  - KVM: x86/mmu: Allocate the lm_root before allocating PAE roots (Sean Christopherson)  [Orabug: 39673871]
  - KVM: x86/mmu: Capture 'mmu' in a local variable when allocating roots (Sean Christopherson)  [Orabug: 39673871]
  - KVM: x86/mmu: Alloc page for PDPTEs when shadowing 32-bit NPT with 64-bit (Sean Christopherson)  [Orabug: 39673871]
  - KVM: x86/mmu: Stash 'kvm' in a local variable in kvm_mmu_free_roots() (Sean Christopherson)  [Orabug: 39673871]
  - KVM: x86/mmu: Add a helper to consolidate root sp allocation (Sean Christopherson)  [Orabug: 39673871]
  - Revert "net/rds: poll eq during user-reset" (Praveen Kumar Kannoju)  [Orabug: 39659401]
  - net/sched: act_pedit: fix action bind logic (Pedro Tammela)  [Orabug: 39567287]
  - net/sched: act_pedit: free pedit keys on bail from offset check (Pedro Tammela)  [Orabug: 39567287]
  - net/sched: fix pedit partial COW leading to page cache corruption (Rajat Gupta)  [Orabug: 39567287]  {CVE-2026-46331}
  - net/sched: act_pedit: Parse L3 Header for L4 offset (Max Tottenham)  [Orabug: 39567287]
  - net/sched: act_pedit: rate limit datapath messages (Pedro Tammela)  [Orabug: 39567287]
  - net/sched: act_pedit: check static offsets a priori (Pedro Tammela)  [Orabug: 39567287]
  - net/sched: act_pedit: remove extra check for key type (Pedro Tammela)  [Orabug: 39567287]
  - net/sched: simplify tcf_pedit_act (Pedro Tammela)  [Orabug: 39567287]
  - net/sched: transition act_pedit to rcu and percpu stats (Pedro Tammela)  [Orabug: 39567287]
  - net/sched: act_pedit: use NLA_POLICY for parsing 'ex' keys (Pedro Tammela)  [Orabug: 39567287]
  - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (hkbinbin)  [Orabug: 39452261]  {CVE-2026-46043}
  - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Davidlohr Bueso)  [Orabug: 39426001]
  - rtmutex: Use waiter::task instead of current in remove_waiter() (Keenan Dong)  [Orabug: 39426001]  {CVE-2026-43499}
  - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Eric Dumazet)  [Orabug: 39300930]  {CVE-2026-43038}
  - tracing/events: Expand global buffer for in-kernel event enables (Manjunath Patil)  [Orabug: 38790406]
  - net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju)  [Orabug: 38776184]


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.358.2.el8uek]
changelog:
  - xfs: resample the data fork mapping after cycling ILOCK (Darrick J. Wong)  [Orabug: 39776792]  {CVE-2026-64600}
  - net: Work around Marvell NIC TX stalls (Venkat Venkatsubra)  [Orabug: 39765820]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.4.17-2136.358.2.0.1.el8uek]
changelog:
  - x86/bugs: Make Safe-RET robust against interrupt injection (Borislav Petkov (AMD))  [Orabug: 39832992]  {CVE-2026-68480}
  - x86/alternatives: Disable interrupts and sync when optimizing NOPs in place (Thomas Gleixner)  [Orabug: 39832992]
  - x86/alternative: Support relocations in alternatives (Peter Zijlstra)  [Orabug: 39832992]
  - x86/alternative: Make debug-alternative selective (Peter Zijlstra)  [Orabug: 39832992]
  - x86/alternatives: Add alt_instr.flags (Borislav Petkov (AMD))  [Orabug: 39832992]
  - x86/asm: Provide ALTERNATIVE_3 (Peter Zijlstra)  [Orabug: 39832992]
  - x86/alternative: Optimize single-byte NOPs at an arbitrary position (Borislav Petkov)  [Orabug: 39832992]
  - x86/alternative: Align insn bytes vertically (Borislav Petkov)  [Orabug: 39832992]
  - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (H. Peter Anvin (Intel))  [Orabug: 39832992]
  - x86/alternatives: Optimize optimize_nops() (Peter Zijlstra)  [Orabug: 39832992]
  - x86: Add insn_decode_kernel() (Peter Zijlstra)  [Orabug: 39832992]
  - x86/insn: Add an insn_decode() API (Borislav Petkov)  [Orabug: 39832992]
  - x86/alternative: Use ALTERNATIVE_TERNARY() in _static_cpu_has() (Juergen Gross)  [Orabug: 39832992]
  - x86/alternative: Support ALTERNATIVE_TERNARY (Juergen Gross)  [Orabug: 39832992]
  - x86/alternative: Merge include files (Juergen Gross)  [Orabug: 39832992]
  - x86/alternative: Drop unused feature parameter from ALTINSTR_REPLACEMENT() (Juergen Gross)  [Orabug: 39832992]
  - x86/insn: Support big endian cross-compiles (Martin Schwidefsky)  [Orabug: 39832992]
  - x86/tools: Use tools headers for instruction decoder selftests (Vasily Gorbik)  [Orabug: 39832992]
  - tools headers: Get tools's linux/compiler.h closer to the kernel's (Arnaldo Carvalho de Melo)  [Orabug: 39832992]
  - perf build: Allow nested externs to enable BUILD_BUG() usage (Vasily Gorbik)  [Orabug: 39832992]
  - objtool: Allow nested externs to enable BUILD_BUG() (Vasily Gorbik)  [Orabug: 39832992]
  - objtool: Make relocation in alternative handling arch dependent (Julien Thierry)  [Orabug: 39832992]
  - x86/alternatives: Add pr_fmt() to debug macros (Borislav Petkov)  [Orabug: 39832992]
  - tools headers: Adopt verbatim copy of compiletime_assert() from kernel sources (Arnaldo Carvalho de Melo)  [Orabug: 39832992]
  - x86/alternatives: Teach text_poke_bp() to emulate instructions (Peter Zijlstra)  [Orabug: 39832992]
  - tools headers: Synchronize linux/bits.h with the kernel sources (Arnaldo Carvalho de Melo)  [Orabug: 39832992]
  - net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() (Dongli Zhang)  [Orabug: 39832997]


author: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> [5.4.17-2136.358.2.1.el8uek]
changelog:
  - Partial revert of "x86/alternatives: Optimize optimize_nops()" (Harshit Mogalapalli)  [Orabug: 39855738]  
  - Revert "x86/alternatives: Add alt_instr.flags" (Harshit Mogalapalli)  [Orabug: 39855738]


author: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> [5.4.17-2136.358.2.1.el8uek]
changelog:
  - Partial revert of "x86/alternatives: Optimize optimize_nops()" (Harshit Mogalapalli)  [Orabug: 39855738]
  - Revert "x86/alternatives: Add alt_instr.flags" (Harshit Mogalapalli)  [Orabug: 39855738]


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.358.2.2.el8uek]
changelog:
  - net/rds: restrict RDS_INFO dumps to caller netns (Praveen Kumar Kannoju)  [Orabug: 39870267]  
  - net/rds: harden rds_rm_size (Manjunath Patil)  [Orabug: 39870266]  
  - net/rds: zero per-item info buffer before handing it to visitors (Michael Bommarito)  [Orabug: 39870263]  
  - rds: Prevent kernel-infoleak in rds_notify_queue_get() (Peilin Ye)  [Orabug: 39870261]  
  - rds: do not leak kernel memory to user land (Eric Dumazet)  [Orabug: 39870261]  
  - rds: tcp: fix uninit-value in __inet_bind (Tabrez Ahmed)  [Orabug: 39870260]  
  - rds: tcp: cleanup if kmem_cache_alloc fails in rds_tcp_conn_alloc() (Sowmini Varadhan)  [Orabug: 39870260]  
  - rds: ib: move gc_count reset before free_percpu (Manjunath Patil)  [Orabug: 39870258]  
  - rds: fix lfstack_pop_all sequence reset (Manjunath Patil)  [Orabug: 39870258]  
  - IB/rxe: use rxe_drop_ref to release rxe_pd (Wengang Wang)  [Orabug: 39870256]  
  - IB/uverbs: enhance authorization checks for ib_uverbs_share_pd() (Wengang Wang)  [Orabug: 39870256]


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.358.2.el8uek]
changelog:
  - xfs: resample the data fork mapping after cycling ILOCK (Darrick J. Wong)  [Orabug: 39776792]  {CVE-2026-64600} 
  - net: Work around Marvell NIC TX stalls (Venkat Venkatsubra)  [Orabug: 39765820]


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.356.4.el8uek]
changelog:
  - tun: free page on build_skb failure in tun_xdp_one() (Weiming Shi) [Orabug: 39429147] {CVE-2026-46322}
  - tap: free page on error paths in tap_get_user_xdp() (Weiming Shi) [Orabug: 39429147] {CVE-2026-46320}
  - tun: free page on short-frame rejection in tun_xdp_one() (Weiming Shi) [Orabug: 39429147] {CVE-2026-46321}


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.357.1.el8uek]
changelog:
  - batman-adv: hold claim backbone gateways by reference (Haoze Xie)  [Orabug: 39262375]  {CVE-2026-31657}
  - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (Michael Bommarito)  [Orabug: 39446045] {CVE-2026-63890}
  - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Michael Bommarito)  [Orabug: 39446045] {CVE-2026-63888}
  - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Michael Bommarito)  [Orabug: 39446045] {CVE-2026-63887}
  - rds: Drop rds conn in connect worker if not in down state. (Rohit Nair)  [Orabug: 39152239]


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.357.2.el8uek]
changelog:
  - net: fix fanout UAF in packet_release() via NETDEV_UP race (Yochai Eisenrich)  [Orabug: 39250953]  {CVE-2026-31504}
  - x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers (Dan Williams)  [Orabug: 39429802]
  - x86/kaslr: Reduce KASLR entropy on most x86 systems (Balbir Singh)  [Orabug: 39429802]
  - net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null (Cezar Bulinaru)  [Orabug: 39526882]  {CVE-2022-50073}
  - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Rutland)  [Orabug: 39548666]  {CVE-2025-10263} {CVE-2026-53354}
  - arm64: tlb: Add ARM64_WORKAROUND_REPEAT_TLBI_SYNC (Mark Rutland)  [Orabug: 39548666]
  - ARM: uek: Disable CONFIG_QCOM_FALKOR_ERRATUM_1003 (Boris Ostrovsky)  [Orabug: 39548666]
  - arm64: tlb: allow XZR argument to TLBI ops (Mark Rutland)  [Orabug: 39548666]
  - arm64: cputype: Add C1-Premium definitions (Mark Rutland)  [Orabug: 39548666]
  - arm64: cputype: Add C1-Ultra definitions (Mark Rutland)  [Orabug: 39548666]
  - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Eric Dumazet)  [Orabug: 39300926]  {CVE-2026-43037}


author: Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.358.1.el8uek]
changelog:
  - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini)  [Orabug: 39673871] {CVE-2026-53359}
  - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Sean Christopherson)  [Orabug: 39673871] {CVE-2026-46113}
  - KVM: x86/MMU: Recursively zap nested TDP SPs when zapping last/only parent (Ben Gardon)  [Orabug: 39673871]
  - KVM: x86/mmu: Move flush logic from mmu_page_zap_pte() to FNAME(invlpg) (Sean Christopherson)  [Orabug: 39673871]
  - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini)  [Orabug: 39673871]
  - KVM: x86/mmu: Passing up the error state of mmu_alloc_shadow_roots() (Like Xu)  [Orabug: 39673871]
  - KVM: MMU: load PDPTRs outside mmu_lock (Paolo Bonzini)  [Orabug: 39673871]
  - KVM: x86/mmu: Check PDPTRs before allocating PAE roots (Sean Christopherson)  [Orabug: 39673871]
  - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (David Matlack)  [Orabug: 39673871]
  - KVM: x86/mmu: Derive shadow MMU page role from parent (David Matlack)  [Orabug: 39673871]
  - KVM: X86: Remove useless code to set role.gpte_is_8_bytes when role.direct (Lai Jiangshan)  [Orabug: 39673871]
  - KVM: X86: Synchronize the shadow pagetable before link it (Lai Jiangshan)  [Orabug: 39673871]
  - KVM: X86: Fix missed remote tlb flush in rmap_write_protect() (Lai Jiangshan)  [Orabug: 39673871]
  - KVM: x86/mmu: Refactor shadow walk in __direct_map() to reduce indentation (Sean Christopherson)  [Orabug: 39673871]
  - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (David Matlack)  [Orabug: 39673871]
  - KVM: x86/mmu: Use a bool for direct (David Matlack)  [Orabug: 39673871]
  - kvm: mmu: Replace unsigned with unsigned int for PTE access (Ben Gardon)  [Orabug: 39673871]
  - KVM: x86/mmu: Ensure MMU pages are available when allocating roots (Sean Christopherson)  [Orabug: 39673871]
  - KVM: x86/mmu: Allocate pae_root and lm_root pages in dedicated helper (Sean Christopherson)  [Orabug: 39673871]
  - KVM: x86/mmu: Allocate the lm_root before allocating PAE roots (Sean Christopherson)  [Orabug: 39673871]
  - KVM: x86/mmu: Capture 'mmu' in a local variable when allocating roots (Sean Christopherson)  [Orabug: 39673871]
  - KVM: x86/mmu: Alloc page for PDPTEs when shadowing 32-bit NPT with 64-bit (Sean Christopherson)  [Orabug: 39673871]
  - KVM: x86/mmu: Stash 'kvm' in a local variable in kvm_mmu_free_roots() (Sean Christopherson)  [Orabug: 39673871]
  - KVM: x86/mmu: Add a helper to consolidate root sp allocation (Sean Christopherson)  [Orabug: 39673871]
  - Revert "net/rds: poll eq during user-reset" (Praveen Kumar Kannoju)  [Orabug: 39659401]
  - net/sched: act_pedit: fix action bind logic (Pedro Tammela)  [Orabug: 39567287]
  - net/sched: act_pedit: free pedit keys on bail from offset check (Pedro Tammela)  [Orabug: 39567287]
  - net/sched: fix pedit partial COW leading to page cache corruption (Rajat Gupta)  [Orabug: 39567287]  {CVE-2026-46331}
  - net/sched: act_pedit: Parse L3 Header for L4 offset (Max Tottenham)  [Orabug: 39567287]
  - net/sched: act_pedit: rate limit datapath messages (Pedro Tammela)  [Orabug: 39567287]
  - net/sched: act_pedit: check static offsets a priori (Pedro Tammela)  [Orabug: 39567287]
  - net/sched: act_pedit: remove extra check for key type (Pedro Tammela)  [Orabug: 39567287]
  - net/sched: simplify tcf_pedit_act (Pedro Tammela)  [Orabug: 39567287]
  - net/sched: transition act_pedit to rcu and percpu stats (Pedro Tammela)  [Orabug: 39567287]
  - net/sched: act_pedit: use NLA_POLICY for parsing 'ex' keys (Pedro Tammela)  [Orabug: 39567287]
  - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (hkbinbin)  [Orabug: 39452261]  {CVE-2026-46043}
  - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Davidlohr Bueso)  [Orabug: 39426001] {CVE-2026-53163}
  - rtmutex: Use waiter::task instead of current in remove_waiter() (Keenan Dong)  [Orabug: 39426001]  {CVE-2026-43499}
  - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Eric Dumazet)  [Orabug: 39300930]  {CVE-2026-43038}
  - tracing/events: Expand global buffer for in-kernel event enables (Manjunath Patil)  [Orabug: 38790406]
  - net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju)  [Orabug: 38776184]


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.359.1.el8uek]
changelog:
  - KVM: arm64: Make nVHE ASLR conditional on RANDOMIZE_BASE (David Brazdil)  [Orabug: 39374251]
  - arm64: kvm: Fix IDMAP overlap with HYP VA (Russell King)  [Orabug: 39374251]
  - arm64: KVM: Invoke compute_layout() before alternatives are applied (Sebastian Andrzej Siewior)  [Orabug: 39374251]
  - ocfs2: fix possible deadlock between unlink and dio_end_io_write (Joseph Qi)  [Orabug: 39273589]  {CVE-2026-31598}
  - fs/ocfs2: fix comments mentioning i_mutex (hongnanli)  [Orabug: 39273589]
  - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Michal Kosiorek)  [Orabug: 39460235]  {CVE-2026-46116}
  - net/rds: zero per-item info buffer before handing it to visitors (Michael Bommarito)  [Orabug: 39638198] {CVE-2026-52995}
  - uek: kabi: update x86_64 kABI files for a new symbol (Saeed Mirzamohammadi)  [Orabug: 39651636]
  - IB/rxe: use rxe_drop_ref to release rxe_pd (Wengang Wang)  [Orabug: 39674348]
  - IB/uverbs: enhance authorization checks for ib_uverbs_share_pd() (Wengang Wang)  [Orabug: 39674348]
  - fs/binfmt_elf: validate reserved VA ELF notes (Jianfeng Wang)  [Orabug: 39681044]
  - mm: preserve page-table boundaries for reserved VA mappings (Jianfeng Wang)  [Orabug: 39681044]
  - mm: enforce max_map_count for reserved VA mappings (Jianfeng Wang)  [Orabug: 39681044]
  - xen/ovmapi: terminate values passed to xenbus_write (Joe Jin)  [Orabug: 39726701]
  - xen/ovmapi: free queued events on release (Joe Jin)  [Orabug: 39726701]
  - xen/ovmapi: prevent duplicate app registration (Joe Jin)  [Orabug: 39726701]
  - xen/ovmapi: avoid raw user pointer access in get_next_event (Joe Jin)  [Orabug: 39726701]
  - xen/ovmapi: reject oversized posted event payloads (Joe Jin)  [Orabug: 39726701]
  - rds: Prevent kernel-infoleak in rds_notify_queue_get() (Peilin Ye)  [Orabug: 39772651]
  - rds: do not leak kernel memory to user land (Eric Dumazet)  [Orabug: 39772651]


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.359.2.el8uek]
changelog:
  - net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() (Dongli Zhang)  [Orabug: 39558751]
  - rds: tcp: fix uninit-value in __inet_bind (Tabrez Ahmed)  [Orabug: 39668203]
  - rds: tcp: cleanup if kmem_cache_alloc fails in rds_tcp_conn_alloc() (Sowmini Varadhan)  [Orabug: 39668203]
  - net/rds: harden rds_rm_size (Manjunath Patil)  [Orabug: 39812534]
  - rds: ib: move gc_count reset before free_percpu (Manjunath Patil)  [Orabug: 39818510]
  - rds: fix lfstack_pop_all sequence reset (Manjunath Patil)  [Orabug: 39818510]


author: Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.359.3.el8uek]
changelog:
  - Partial revert of "x86/alternatives: Optimize optimize_nops()" (Harshit Mogalapalli)  [Orabug: 39866546]  
  - Revert "x86/alternatives: Add alt_instr.flags" (Harshit Mogalapalli)  [Orabug: 39866546]  
  - x86/bugs: Make Safe-RET robust against interrupt injection (Borislav Petkov (AMD))  [Orabug: 39784513]  {CVE-2026-68480} 
  - x86/alternatives: Disable interrupts and sync when optimizing NOPs in place (Thomas Gleixner)  [Orabug: 39784513]  
  - x86/alternative: Support relocations in alternatives (Peter Zijlstra)  [Orabug: 39784513]  
  - x86/alternative: Make debug-alternative selective (Peter Zijlstra)  [Orabug: 39784513]  
  - x86/alternatives: Add alt_instr.flags (Borislav Petkov (AMD))  [Orabug: 39784513]  
  - x86/asm: Provide ALTERNATIVE_3 (Peter Zijlstra)  [Orabug: 39784513]  
  - x86/alternative: Optimize single-byte NOPs at an arbitrary position (Borislav Petkov)  [Orabug: 39784513]  
  - x86/alternative: Align insn bytes vertically (Borislav Petkov)  [Orabug: 39784513]  
  - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (H. Peter Anvin (Intel))  [Orabug: 39784513]  
  - x86/alternatives: Optimize optimize_nops() (Peter Zijlstra)  [Orabug: 39784513]  
  - x86: Add insn_decode_kernel() (Peter Zijlstra)  [Orabug: 39784513]  
  - x86/insn: Add an insn_decode() API (Borislav Petkov)  [Orabug: 39784513]  
  - x86/alternative: Use ALTERNATIVE_TERNARY() in _static_cpu_has() (Juergen Gross)  [Orabug: 39784513]  
  - x86/alternative: Support ALTERNATIVE_TERNARY (Juergen Gross)  [Orabug: 39784513]  
  - x86/alternative: Merge include files (Juergen Gross)  [Orabug: 39784513]  
  - x86/alternative: Drop unused feature parameter from ALTINSTR_REPLACEMENT() (Juergen Gross)  [Orabug: 39784513]  
  - x86/insn: Support big endian cross-compiles (Martin Schwidefsky)  [Orabug: 39784513]  
  - x86/tools: Use tools headers for instruction decoder selftests (Vasily Gorbik)  [Orabug: 39784513]  
  - tools headers: Get tools's linux/compiler.h closer to the kernel's (Arnaldo Carvalho de Melo)  [Orabug: 39784513]  
  - perf build: Allow nested externs to enable BUILD_BUG() usage (Vasily Gorbik)  [Orabug: 39784513]  
  - objtool: Allow nested externs to enable BUILD_BUG() (Vasily Gorbik)  [Orabug: 39784513]  
  - objtool: Make relocation in alternative handling arch dependent (Julien Thierry)  [Orabug: 39784513]  
  - x86/alternatives: Add pr_fmt() to debug macros (Borislav Petkov)  [Orabug: 39784513]  
  - tools headers: Adopt verbatim copy of compiletime_assert() from kernel sources (Arnaldo Carvalho de Melo)  [Orabug: 39784513]  
  - x86/alternatives: Teach text_poke_bp() to emulate instructions (Peter Zijlstra)  [Orabug: 39784513]  
  - tools headers: Synchronize linux/bits.h with the kernel sources (Arnaldo Carvalho de Melo)  [Orabug: 39784513]  
  - net/rds: restrict RDS_INFO dumps to caller netns (Praveen Kumar Kannoju)  [Orabug: 39681637]


author: Pingfan Liu <piliu@redhat.com> - 2.0.17-24
changelog:
  - makedumpfile/arm64: Fix 'info->page_offset' calculation for both KASLR and non-KASLR cases
  - makedumpfile: Prepare paddr_to_vaddr() for arch-specific p2v conversion


author: Pingfan Liu <piliu@redhat.com> - 2.0.17-26
changelog:
  - earlykdump: fix kexec fails to load the early kdump kernel
  - makedumpfile/x86_64: fix an unnecessary message with --mem-usage option


author: Pingfan Liu <piliu@redhat.com> - 2.0.17-27
changelog:
  - Revert "kdumpctl, earlykdump: Don't use kexec_file_load when secure boot is enabled"
  - mkdumprd: refine regex on dropping mount options


author: EL Errata <el-errata_ww@oracle.com> - 2.0.17-28.0.1
changelog:
  - rebase kexec-tools-2.0.8-dracut-module-setup-ibft-avoid-dup-config.patch [Orabug: 28872281]
  - don't patch files in SOURCES directory. That breaks building from the srpm (dave.kleikamp@oracle.com)
  - dracut-module-setup: avoid duplicate config for ibft [Orabug: 22780125]
  - kdumpctl: exclude default_hugepagesz setting from kdump kernel cmdline
    (Sriharsha Yadagudde) [Orabug: 19134999]
  - kdumpctl: verify if kernel support securelevel interface
    (Sriharsha Yadagudde) [Orabug: 18905671]


author: Pingfan Liu <piliu@redhat.com> - 2.0.19-4
changelog:
  - kexec-kdump-howto.txt: Add document about encrypted targets
  - kexec-kdump-howto.txt: Add document about initramfs rebiuld
  - kexec-kdump-howto: Add note on setting correct value of kptr_restrict
  - doc: fix dead links in the file kexec-kdump-howto.txt
  - earlykdump: provide a prompt message after the rebuilding of kdump initramfs.
  - Get rid of duplicated strip_comments when reading config
  - mkdumprd: Improve the config reading logic
  - kdumpctl: don't always rebuild when extra_modules is set
  - kdumpctl: follow symlink when checking for modified files
  - fadump: leverage kernel support to re-regisgter FADump


author: Pingfan Liu <piliu@redhat.com> - 2.0.19-5
changelog:
  - kdumpctl: check for ssh path availability when rebuild
  - kdumpctl: Check kdump.conf for error when rebuild is called
  - makedumpfile: x86_64: Add support for AMD Secure Memory Encryption
  - aarch64/kdump.sysconfig: Make config options similar to x86_64


author: Pingfan Liu <piliu@redhat.com> - 2.0.19-9
changelog:
  - kexec/arm64: Add support for handling zlib compressed (Image.gz) image
  - kexec/kexec-zlib.h: Add 'is_zlib_file()' helper function
  - kexec-uImage-arm64.c: Fix return value of uImage_arm64_probe()
  - kexec/kexec.c: Add the missing close() for fd used for kexec_file_load()


author: Edward Leung <edward.leung@oracle.com> - 2.0.19-12.0.1
changelog:
  - change makedumpfile fixed size buffer for VMCOREINFO [Orabug: 29870551]
  - 99kdumpbase: Do not append ip=<devname>:dhcp if ip=dhcp is present [Orabug: 29518713]
  - rebase kexec-tools-2.0.8-dracut-module-setup-ibft-avoid-dup-config.patch [Orabug: 28872281]
  - don't patch files in SOURCES directory. That breaks building from the srpm (dave.kleikamp@oracle.com)
  - dracut-module-setup: avoid duplicate config for ibft [Orabug: 22780125]
  - kdumpctl: exclude default_hugepagesz setting from kdump kernel cmdline
    (Sriharsha Yadagudde) [Orabug: 19134999]
  - kdumpctl: verify if kernel support securelevel interface
    (Sriharsha Yadagudde) [Orabug: 18905671]


author: Pingfan Liu <piliu@redhat.com> - 2.0.19-12.1
changelog:
  - Don't execute final_action if failure_action terminates the system
  - dracut-module-setup.sh: Don't use squash module for fadump
  - Don't mount the dump target unless needed


author: Pingfan Liu <piliu@redhat.com> - 2.0.19-12.2
changelog:
  - arm64: kdump: deal with a lot of resource entries in /proc/iomem
  - arm64: kexec: allocate memory space avoiding reserved regions
  - kexec: add variant helper functions for handling memory regions


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-6
changelog:
  -rhel-8.2.0, origin/rhel-8.2.0) Increase SECTION_MAP_LAST_BIT to 4
  - spec: move binaries from /sbin to /usr/sbin
  - As /etc/kdump.conf timestamp is updated do not compare it when doing rpm --verify
  - kdumpctl: make reload fail proof


author: Kevin Lyons <kevin.x.lyons@oracle.com> - 2.0.20-14.0.1
changelog:
  - kdump: append no_timer_check to kdump kernel cmdline on xen guests [Orabug: 30928441]
  - arm64: skip purgatory integrity checks to speed up reboot [Orabug: 30822387]
  - kdump: append iommu=off to kdump kernel cmdline [Orabug: 30832988]
  - makedumpfile: fix RHCK makedumpfile [Orabug: 30580398]
  - makedumpfile: backport latest upstream 52-bit VA arm patch [Orabug: 30580398]
  - makedumpfile: rebase rhonly-kexec-tools-2.0.18-makedumpfile* patch [Orabug: 30580398]
  - makedumpfile: backport latest aarch64-related upstream patches [Orabug: 30352094]
  - makedumpfile: update to 1.6.7, drop patches, now present in upstream code [Orabug: 30446702]
  - change makedumpfile fixed size buffer for VMCOREINFO [Orabug: 29870551]
  - 99kdumpbase: Do not append ip=<devname>:dhcp if ip=dhcp is present [Orabug: 29518713]
  - rebase kexec-tools-2.0.8-dracut-module-setup-ibft-avoid-dup-config.patch [Orabug: 28872281]
  - don't patch files in SOURCES directory. That breaks building from the srpm (dave.kleikamp@oracle.com)
  - dracut-module-setup: avoid duplicate config for ibft [Orabug: 22780125]
  - kdumpctl: exclude default_hugepagesz setting from kdump kernel cmdline
    (Sriharsha Yadagudde) [Orabug: 19134999]
  - kdumpctl: verify if kernel support securelevel interface
    (Sriharsha Yadagudde) [Orabug: 18905671]


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-28
changelog:
  - mkdumprd: Fix nfs detection in to_mount
  - Always wrap up call to dracut get_persistent_dev function
  - man: improve description about /etc/kdump/{pre.d,post.d}interface


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-30
changelog:
  - x86_64: enable the kexec file load by default
  - Revert "kdump-lib: switch to the kexec_file_load() syscall on x86_64 by default"


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-31
changelog:
  - ppc64/kdump: use kexec_file_load when secureboot is enabled
  - kdump_pre: make notes more precise
  - dracut-kdump.sh: exit shell when machine reboot
  - kdump.conf: fix a grammar issue
  - kdumpctl: detect modification of scripts by its directory's timestamp
  - module-setup.sh: suppress false alarm
  - kexec-tools.spec: make the existence of pre.d and post.d mandatory


author: Alex Burmashev <alexander.burmashev@oracle.com> - 2.0.20-34.0.1
changelog:
  - kdump: append no_timer_check to kdump kernel cmdline on xen guests [Orabug: 30928441]
  - arm64: skip purgatory integrity checks to speed up reboot [Orabug: 30822387]
  - kdump: append iommu=off to kdump kernel cmdline [Orabug: 30832988]
  - makedumpfile: fix RHCK makedumpfile [Orabug: 30580398]
  - makedumpfile: backport latest upstream 52-bit VA arm patch [Orabug: 30580398]
  - makedumpfile: rebase rhonly-kexec-tools-2.0.18-makedumpfile* patch [Orabug: 30580398]
  - makedumpfile: backport latest aarch64-related upstream patches [Orabug: 30352094]
  - change makedumpfile fixed size buffer for VMCOREINFO [Orabug: 29870551]
  - 99kdumpbase: Do not append ip=<devname>:dhcp if ip=dhcp is present [Orabug: 29518713]
  - rebase kexec-tools-2.0.8-dracut-module-setup-ibft-avoid-dup-config.patch [Orabug: 28872281]
  - don't patch files in SOURCES directory. That breaks building from the srpm (dave.kleikamp@oracle.com)
  - dracut-module-setup: avoid duplicate config for ibft [Orabug: 22780125]
  - kdumpctl: exclude default_hugepagesz setting from kdump kernel cmdline
    (Sriharsha Yadagudde) [Orabug: 19134999]
  - kdumpctl: verify if kernel support securelevel interface
    (Sriharsha Yadagudde) [Orabug: 18905671]


author: EL Errata <el-errata_ww@oracle.com> - 2.0.20-34.0.3
changelog:
  - kdump: add threshold for the required memory (Chen Zhou) [Orabug: 32258986]
  - Fix duplicate -s option for kexec [Orabug: 32127375]
  - kdump: append no_timer_check to kdump kernel cmdline on xen guests [Orabug: 30928441]
  - arm64: skip purgatory integrity checks to speed up reboot [Orabug: 30822387]
  - kdump: append iommu=off to kdump kernel cmdline [Orabug: 30832988]
  - makedumpfile: fix RHCK makedumpfile [Orabug: 30580398]
  - makedumpfile: backport latest upstream 52-bit VA arm patch [Orabug: 30580398]
  - makedumpfile: rebase rhonly-kexec-tools-2.0.18-makedumpfile* patch [Orabug: 30580398]
  - makedumpfile: backport latest aarch64-related upstream patches [Orabug: 30352094]
  - change makedumpfile fixed size buffer for VMCOREINFO [Orabug: 29870551]
  - 99kdumpbase: Do not append ip=<devname>:dhcp if ip=dhcp is present [Orabug: 29518713]
  - rebase kexec-tools-2.0.8-dracut-module-setup-ibft-avoid-dup-config.patch [Orabug: 28872281]
  - don't patch files in SOURCES directory. That breaks building from the srpm (dave.kleikamp@oracle.com)
  - dracut-module-setup: avoid duplicate config for ibft [Orabug: 22780125]
  - kdumpctl: exclude default_hugepagesz setting from kdump kernel cmdline
    (Sriharsha Yadagudde) [Orabug: 19134999]
  - kdumpctl: verify if kernel support securelevel interface
    (Sriharsha Yadagudde) [Orabug: 18905671]


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-34.2
changelog:
  - kdump-lib.sh: Remove is_atomic
  - Refactor kernel image and initrd detection code
  - early-kdump: Use consistent symbol link for kernel and initramfs
  - kdump-lib: strip grub device from kdump_bootdir
  - kdumpctl: fix driver change detection on latest Fedora


author: Kevin Lyons <kevin.x.lyons@oracle.com> - 2.0.20-34.0.5.el8_u3.2
changelog:
  - 99kdumpbase: Do not append ip=<devname>:dhcp if ip=single-dhcp is present [Orabug: 32404661]
  - kdump-lib: Fix get_bind_mount_source to support btrfs and fstab [Orabug: 32297893]
  - kdump: add threshold for the required memory (Chen Zhou) [Orabug: 32258986]
  - Fix duplicate -s option for kexec [Orabug: 32127375]
  - kdump: append no_timer_check to kdump kernel cmdline on xen guests [Orabug: 30928441]
  - arm64: skip purgatory integrity checks to speed up reboot [Orabug: 30822387]
  - kdump: append iommu=off to kdump kernel cmdline [Orabug: 30832988]
  - makedumpfile: fix RHCK makedumpfile [Orabug: 30580398]
  - makedumpfile: backport latest upstream 52-bit VA arm patch [Orabug: 30580398]
  - makedumpfile: rebase rhonly-kexec-tools-2.0.18-makedumpfile* patch [Orabug: 30580398]
  - makedumpfile: backport latest aarch64-related upstream patches [Orabug: 30352094]
  - change makedumpfile fixed size buffer for VMCOREINFO [Orabug: 29870551]
  - 99kdumpbase: Do not append ip=<devname>:dhcp if ip=dhcp is present [Orabug: 29518713]
  - rebase kexec-tools-2.0.8-dracut-module-setup-ibft-avoid-dup-config.patch [Orabug: 28872281]
  - don't patch files in SOURCES directory. That breaks building from the srpm (dave.kleikamp@oracle.com)
  - dracut-module-setup: avoid duplicate config for ibft [Orabug: 22780125]
  - kdumpctl: exclude default_hugepagesz setting from kdump kernel cmdline
    (Sriharsha Yadagudde) [Orabug: 19134999]
  - kdumpctl: verify if kernel support securelevel interface
    (Sriharsha Yadagudde) [Orabug: 18905671]


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-38
changelog:
  - Don's try to restart dracut-initqueue if it's already failed
  - fadump-howto: update about 'nocma' and 'off' options for 'fadump=' parameter
  - dracut-module-setup.sh: use auto6 for ipv6
  - module-setup.sh: enable vlan on team interface
  - Fix rootfs detection in dump_fs
  - Remove RHEL-only patch: kexec-tools-2.0.18-makedumpfile-arm64-Add-support-for-ARMv8.2-LVA-52-bi.patch
  - Rebase to makedumpfile-1.6.8 (step1)


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-43
changelog:
  - Always include watchdog-modules
  - mkdumprd: Ensure kdumpbase is added
  - Move watchdog detect and install code to module-setup.sh
  - Add a helper to omit non-mandatory dracut module
  - Move some dracut module dependencies checks to module-setup.sh
  - Set watchdog's pretimeout to zero in kdump kernel
  - kdump-lib.sh: Use a more generic helper to detect omitted dracut module
  - Fix the watchdog drivers detection code
  - Add a helper for detecting watchdog drivers
  - Remove a redundant nfs check
  - kdumpctl: split the driver detection from fs dection function
  - kdump.service: use ConditionKernelCommandLine=crashkernel
  - Revert "Append both nofail and x-systemd.before to kdump mount target"
  - Revert "Don's try to restart dracut-initqueue if it's already failed"
  - Fix dump_fs mount point detection and fallback mount
  - kdump.conf: Update doc about core_collector for ssh target
  - Save the final failure information to log file if saving vmcore failed
  - Doc: Improve the kdump sysconfig document
  - kdumpctl: fix a variable expansion in check_fence_kdump_config()
  - Fedora 33 rhpkg build bug


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-44
changelog:
  - module-setup.sh: don't polute the namespace unnecessarily
  - module-setup.sh: don't source $dracutfunctions
  - logger: source the logger file individually
  - dracut-module-setup.sh: enable ForwardToConsole=yes in fadump mode


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-45
changelog:
  - origin/rhel-8.4.0) Revert "Revert "Append both nofail and x-systemd.before to kdump mount target""
  - kdump.conf: add ipv6 example for nfs and ssh dump
  - fix kdump failure of saving vmcore with the scp + ipv6 method


author: EL Errata <el-errata_ww@oracle.com> - 2.0.20-46.0.1
changelog:
  - Added the following patches from https://github.com/makedumpfile version 1.6.8++ [Orabug: 32851262]
  - Added Patch1009, orabug32851262-PATCH-2-3-arm64-Make-use-of-NUMBER-VA_BITS-in-vmcore.patch
  - Added Patch1010, orabug32851262-PATCH-3-3-arm64-support-flipped-VA-and-52-bit-kernel.patch
  - Removed Patch701 which was in conflict with Patch1010
  - Remove -s setting for KEXEC_ARGS in kdump.sysconfig.aarch64 [Orabug: 3280449]
  - 99kdumpbase: Do not append ip=<devname>:dhcp if ip=single-dhcp is present [Orabug: 32404661]
  - kdump-lib: Fix get_bind_mount_source to support btrfs and fstab [Orabug: 32297893]
  - kdump: add threshold for the required memory (Chen Zhou) [Orabug: 32258986]
  - Fix duplicate -s option for kexec [Orabug: 32127375]
  - kdump: append no_timer_check to kdump kernel cmdline on xen guests [Orabug: 30928441]
  - arm64: skip purgatory integrity checks to speed up reboot [Orabug: 30822387]
  - kdump: append iommu=off to kdump kernel cmdline [Orabug: 30832988]
  - 99kdumpbase: Do not append ip=<devname>:dhcp if ip=dhcp is present [Orabug: 29518713]
  - rebase kexec-tools-2.0.8-dracut-module-setup-ibft-avoid-dup-config.patch [Orabug: 28872281]
  - don't patch files in SOURCES directory. That breaks building from the srpm (dave.kleikamp@oracle.com)
  - dracut-module-setup: avoid duplicate config for ibft [Orabug: 22780125]
  - kdumpctl: exclude default_hugepagesz setting from kdump kernel cmdline
    (Sriharsha Yadagudde) [Orabug: 19134999]
  - kdumpctl: verify if kernel support securelevel interface
    (Sriharsha Yadagudde) [Orabug: 18905671]


author: EL Errata <el-errata_ww@oracle.com> - 2.0.20-46.0.1
changelog:
  - Added the following patches from https://github.com/makedumpfile version 1.6.8++ [Orabug: 32851262]
  - Added Patch1009, orabug32851262-PATCH-2-3-arm64-Make-use-of-NUMBER-VA_BITS-in-vmcore.patch
  - Added Patch1010, orabug32851262-PATCH-3-3-arm64-support-flipped-VA-and-52-bit-kernel.patch
  - Removed Patch701 which was in conflict with Patch1010
  - Remove -s setting for KEXEC_ARGS in kdump.sysconfig.aarch64 [Orabug: 3280449]
  - 99kdumpbase: Do not append ip=<devname>:dhcp if ip=single-dhcp is present [Orabug: 32404661]
  - kdump-lib: Fix get_bind_mount_source to support btrfs and fstab [Orabug: 32297893]
  - kdump: add threshold for the required memory (Chen Zhou) [Orabug: 32258986]
  - Fix duplicate -s option for kexec [Orabug: 32127375]
  - kdump: append no_timer_check to kdump kernel cmdline on xen guests [Orabug: 30928441]
  - arm64: skip purgatory integrity checks to speed up reboot [Orabug: 30822387]
  - kdump: append iommu=off to kdump kernel cmdline [Orabug: 30832988]
  - 99kdumpbase: Do not append ip=<devname>:dhcp if ip=dhcp is present [Orabug: 29518713]
  - rebase kexec-tools-2.0.8-dracut-module-setup-ibft-avoid-dup-config.patch [Orabug: 28872281]
  - don't patch files in SOURCES directory. That breaks building from the srpm (dave.kleikamp@oracle.com)
  - dracut-module-setup: avoid duplicate config for ibft [Orabug: 22780125]
  - kdumpctl: exclude default_hugepagesz setting from kdump kernel cmdline
    (Sriharsha Yadagudde) [Orabug: 19134999]
  - kdumpctl: verify if kernel support securelevel interface
    (Sriharsha Yadagudde) [Orabug: 18905671]
    (Sriharsha Yadagudde) [Orabug: 18905671]


author: EL Errata <el-errata_ww@oracle.com> - 2.0.20-46.0.1
changelog:
  - Added the following patches from https://github.com/makedumpfile version 1.6.8++ [Orabug: 32851262]
  - Added Patch1009, orabug32851262-PATCH-2-3-arm64-Make-use-of-NUMBER-VA_BITS-in-vmcore.patch
  - Added Patch1010, orabug32851262-PATCH-3-3-arm64-support-flipped-VA-and-52-bit-kernel.patch
  - Removed Patch701 which was in conflict with Patch1010
  - Remove -s setting for KEXEC_ARGS in kdump.sysconfig.aarch64 [Orabug: 3280449]
  - 99kdumpbase: Do not append ip=<devname>:dhcp if ip=single-dhcp is present [Orabug: 32404661]
  - kdump-lib: Fix get_bind_mount_source to support btrfs and fstab [Orabug: 32297893]
  - kdump: add threshold for the required memory (Chen Zhou) [Orabug: 32258986]
  - Fix duplicate -s option for kexec [Orabug: 32127375]
  - kdump: append no_timer_check to kdump kernel cmdline on xen guests [Orabug: 30928441]
  - arm64: skip purgatory integrity checks to speed up reboot [Orabug: 30822387]
  - kdump: append iommu=off to kdump kernel cmdline [Orabug: 30832988]
  - 99kdumpbase: Do not append ip=<devname>:dhcp if ip=dhcp is present [Orabug: 29518713]
  - rebase kexec-tools-2.0.8-dracut-module-setup-ibft-avoid-dup-config.patch [Orabug: 28872281]
  - don't patch files in SOURCES directory. That breaks building from the srpm (dave.kleikamp@oracle.com)
  - dracut-module-setup: avoid duplicate config for ibft [Orabug: 22780125]
  - kdumpctl: exclude default_hugepagesz setting from kdump kernel cmdline
    (Sriharsha Yadagudde) [Orabug: 19134999]
  - kdumpctl: verify if kernel support securelevel interface
    (Sriharsha Yadagudde) [Orabug: 18905671]
    (Sriharsha Yadagudde) [Orabug: 18905671]
    (Sriharsha Yadagudde) [Orabug: 18905671]


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-51
changelog:
  - Stop reloading kdump service on CPU hotplug event for FADump
  - fadump: improve fadump-howto.txt about remote dump target setup


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-52
changelog:
  - Write to `/var/lib/kdump` if $KDUMP_BOOTDIR not writable
  - Iterate /sys/bus/ccwgroup/devices to tell if we should set up rd.znet
  - mkdumprd: display the absolute path of dump location in the check_user_configured_target()


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-53
changelog:
  - check for invalid physical address of /proc/kcore when making ELF dumpfile
  - check for invalid physical address of /proc/kcore when finding max_paddr
  - fix format issue in find_online_znet_device
  - check the existence of /sys/bus/ccwgroup/devices before trying to find online network device
  - kdump-lib.sh: fix a warning in prepare_kdump_bootinfo()


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-54
changelog:
  - kdump/ppc64: rebuild initramfs image after migration
  - Check the existence of /sys/bus/ccwgroup/devices/*/online beforehand
  - kdump.sysconfig.s390: Remove "prot_virt" from kdump kernel cmdline


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-50
changelog:
  - rd.route should use the name from kdump_setup_ifname
  - get kdump ifname once in kdump_install_netdev


author: EL Errata <el-errata_ww@oracle.com> - 2.0.20-57.0.3
changelog:
  - Merge 8.4 extra patches for SB boot environment [Orabug: 33512440]
  - Merge SRPM/ol8-u4 orabug patches into SRPM/ol8-u5 [Orabug: 33471981]
  - makedumpfile: Add support for newer kernels up to v5.12 [Orabug: 33250117]


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-60
changelog:
  - fadump-init: clean up mount points properly
  - fadump: kdumpctl should check the modules used by the fadump initramfs
  - fadump: isolate fadump initramfs image within the default one
  - mkdumprd: Use xz for squash image compression


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-66
changelog:
  - kdump/ppc64: suppress the error message "Could not find a registered notification tool" from servicelog_notify
  - Enable zstd compression for makedumpfile in kexec-tools.spec


author: Kevin Lyons <kevin.x.lyons@oracle.com> - 2.0.20-68.0.1
changelog:
  - kdump/kexec: fix saving vmcore-dmesg.txt failed on aarch64 with UEK7 [Orabug: 33748084]
  - kdump: skip lvm private devices [Orabug: 33822070]
  - Merge 8.4 extra patches for SB boot environment [Orabug: 33512440]
  - Merge SRPM/ol8-u4 orabug patches into SRPM/ol8-u5 [Orabug: 33471981]


author: Brian Maly <brian.maly@oracle.com> - 2.0.20-68.0.2
changelog:
  - rebase makdumpfile to version 1.7.1 [Orabug: 34125577] [Orabug: 34105778]
  - add requires for virt-what [Orabug: 34015178]


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-69
changelog:
  - s390: add support for --reuse-cmdline
  - use slurp_proc_file() in get_command_line()
  - add slurp_proc_file()
  - s390: use KEXEC_ALL_OPTIONS
  - s390: add variable command line size
  - util_lib/elf_info: harden parsing of printk buffer
  - print error when reading with unsupported compression
  - use cycle detection when parsing the prink log_buf
  - use pointer arithmetics for dump_dmesg
  - add generic cycle detection


author: Pingfan Liu <piliu@redhat.com> - 2.0.24-1
changelog:
  - kdumpctl: sync the $TARGET_INITRD after rebuild
  - Avoid false-positive mem_section validation with vmlinux
  - Rebase kexec-tools to 2.0.24
  - Rebase makedumpfile to 1.7.1


author: Pingfan Liu <piliu@redhat.com> - 2.0.24-6
changelog:
  - kdump-lib: Add the CoreOS kernel dir to the boot_dirlist
  - kdump-lib: attempt to fix BOOT_IMAGE detection
  - kdump-lib: change how ostree based systems are detected
  - kdump-lib: clear up references to Atomic/CoreOS


author: Brian Maly <brian.maly@oracle.com> - 2.0.24-6.0.1
changelog:
  - makedumpfile: fix issue where manpage wont load [Orabug: 34219528]
  - add requires for virt-what [Orabug: 34015178]
  - kdump/kexec: fix saving vmcore-dmesg.txt failed on aarch64 with UEK7 [Orabug: 33748084]
  - kdump: skip lvm private devices [Orabug: 33822070]
  - Merge 8.4 extra patches for SB boot environment [Orabug: 33512440]
  - Merge SRPM/ol8-u4 orabug patches into SRPM/ol8-u5 [Orabug: 33471981]
  - Reformat orabug33822070-kdump-skip-lvm-private-devices.patch [Orabug: 33822070]
  - Drop oracle specific patches no longer applicable [Orabug: 32258986] [Orabug: 33748084]


author: Pingfan Liu <piliu@redhat.com> - 2.0.25-2
changelog:
  - mkdumprd: Improve error messages on non-existing NFS target directories
  - fadump: avoid non-debug kernel use for fadump case


author: Pingfan Liu <piliu@redhat.com> - 2.0.25-3
changelog:
  - kdump.conf: use a simple generator script to maintain
  - Reduce kdump memory consumption by not letting NetworkManager manage unneeded network interfaces


author: Pingfan Liu <piliu@redhat.com> - 2.0.25-4
changelog:
  - Don't check fs modified when dump target is lvm2 thinp
  - Add dependency of dracut lvmthinpool-monitor module
  - lvm.conf should be check modified if lvm2 thinp enabled
  - Add lvm2 thin provision dump target checker
  - Fix the sync issue for dump_fs


author: Pingfan Liu <piliu@redhat.com> - 2.0.25-5
changelog:
  dracut-module-setup: Fix invalid rd.znet command line entry
   dracut-module-setup: Fix persistent nic name on s390


author: Pingfan Liu <piliu@redhat.com> - 2.0.26-6
changelog:
  - dracut-module-setup.sh: skip installing driver for the loopback interface
  - Reduce kdump memory consumption by only installing needed NIC drivers


author: Pingfan Liu <piliu@redhat.com> - 2.0.26-8
changelog:
  - mkdumprd: Use the correct syntax to redirect the stderr to null
  - mkdumprd: call dracut with --add-device to install the drivers needed by /boot partition automatically for FIPS
  - Add NICs that handle DNS queries to the allowlist


author: EL Errata <el-errata_ww@oracle.com> - 2.0.26-8.0.1
changelog:
  - Backport of upstream crash hotplug support [Orabug: 35884454]
  - Drop kexec-tools-2.0.25-makedumpfile-sadump-fix-failure-of-reading-memory-when-5-le.patch
  - Insert new udev rules for crash hotplug into 98-kexec.rules
  - sadump: fix failure of reading memory when 5-level paging is enabled
  - Update UEK reserved sizes [Orabug: 35224510]
  - makedumpfile: fix issue where manpage wont load [Orabug: 34219528]
  - add requires for virt-what [Orabug: 34015178]
  - kdump/kexec: fix saving vmcore-dmesg.txt failed on aarch64 with UEK7 [Orabug: 33748084]
  - kdump: skip lvm private devices [Orabug: 33822070]
  - Merge 8.4 extra patches for SB boot environment [Orabug: 33512440]
  - Merge SRPM/ol8-u4 orabug patches into SRPM/ol8-u5 [Orabug: 33471981]
  - Reformat orabug33822070-kdump-skip-lvm-private-devices.patch [Orabug: 33822070]
  - Drop oracle specific patches no longer applicable [Orabug: 32258986] [Orabug: 33748084]


author: Brian Maly <brian.maly@oracle.com> - 2.0.26-8.0.2
changelog:
  - Rebase makedumpfile to 1.7.4 [Orabug: 36157739]
  - kdumpctl check if FIPS is enabled [Orabug: 35982140]


author: Pingfan Liu <piliu@redhat.com> - 2.0.26-11
changelog:
  - powerpc: update kdumpctl to load kernel signing key for fadump
  - powerpc: update kdumpctl to remove deletion of kernel signing key once loaded


author: Pingfan Liu <piliu@redhat.com> - 2.0.26-13
changelog:
  - dracut-module-setup.sh: also install the driver of physical NIC for Hyper-V VM with accelerated networking


author: Darren Archibald <darren.archibald@oracle.com> - 2.0.28-1.0.3
changelog:
  - Increase crashkernel reservation for aarch64 [Orabug: 35887460]
  - kdumpctl check if FIPS is enabled [Orabug: 35982140]
  - Backport of upstream crash hotplug support [Orabug: 35884454]
  - Drop kexec-tools-2.0.25-makedumpfile-sadump-fix-failure-of-reading-memory-when-5-le.patch
  - Insert new udev rules for crash hotplug into 98-kexec.rules
  - sadump: fix failure of reading memory when 5-level paging is enabled
  - Update UEK reserved sizes [Orabug: 35224510]
  - makedumpfile: fix issue where manpage wont load [Orabug: 34219528]
  - add requires for virt-what [Orabug: 34015178]
  - kdump/kexec: fix saving vmcore-dmesg.txt failed on aarch64 with UEK7 [Orabug: 33748084]
  - kdump: skip lvm private devices [Orabug: 33822070]
  - Merge 8.4 extra patches for SB boot environment [Orabug: 33512440]
  - Merge SRPM/ol8-u4 orabug patches into SRPM/ol8-u5 [Orabug: 33471981]
  - Reformat orabug33822070-kdump-skip-lvm-private-devices.patch [Orabug: 33822070]
  - Drop oracle specific patches no longer applicable [Orabug: 32258986] [Orabug: 33748084]


author: Darren Archibald <darren.archibald@oracle.com> - 2.0.28-1.0.5
changelog:
  - Fix KEXEC_KERNEL_CHECK IMA rule & valid PE signature regression [Orabug: 36560887]
  - Increase crashkernel reservation for aarch64 [Orabug: 35887460]
  - kdumpctl check if FIPS is enabled [Orabug: 35982140]
  - Backport of upstream crash hotplug support [Orabug: 35884454]
  - Drop kexec-tools-2.0.25-makedumpfile-sadump-fix-failure-of-reading-memory-when-5-le.patch
  - Insert new udev rules for crash hotplug into 98-kexec.rules
  - sadump: fix failure of reading memory when 5-level paging is enabled
  - Update UEK reserved sizes [Orabug: 35224510]
  - makedumpfile: fix issue where manpage wont load [Orabug: 34219528]
  - add requires for virt-what [Orabug: 34015178]
  - kdump/kexec: fix saving vmcore-dmesg.txt failed on aarch64 with UEK7 [Orabug: 33748084]
  - kdump: skip lvm private devices [Orabug: 33822070]
  - Merge 8.4 extra patches for SB boot environment [Orabug: 33512440]
  - Merge SRPM/ol8-u4 orabug patches into SRPM/ol8-u5 [Orabug: 33471981]
  - Reformat orabug33822070-kdump-skip-lvm-private-devices.patch [Orabug: 33822070]
  - Drop oracle specific patches no longer applicable [Orabug: 32258986] [Orabug: 33748084]


author: Darren Archibald <darren.archibald@oracle.com> - 2.0.28-1.0.6
changelog:
  - Add kdump-shutdown-sysctl.service to ensure shutdown is dumpable [Orabug: 36990863]
  - Fix KEXEC_KERNEL_CHECK IMA rule & valid PE signature regression [Orabug: 36560887]
  - Increase crashkernel reservation for aarch64 [Orabug: 35887460]
  - kdumpctl check if FIPS is enabled [Orabug: 35982140]
  - Backport of upstream crash hotplug support [Orabug: 35884454]
  - Drop kexec-tools-2.0.25-makedumpfile-sadump-fix-failure-of-reading-memory-when-5-le.patch
  - Insert new udev rules for crash hotplug into 98-kexec.rules
  - sadump: fix failure of reading memory when 5-level paging is enabled
  - Update UEK reserved sizes [Orabug: 35224510]
  - makedumpfile: fix issue where manpage wont load [Orabug: 34219528]
  - add requires for virt-what [Orabug: 34015178]
  - kdump/kexec: fix saving vmcore-dmesg.txt failed on aarch64 with UEK7 [Orabug: 33748084]
  - kdump: skip lvm private devices [Orabug: 33822070]
  - Merge 8.4 extra patches for SB boot environment [Orabug: 33512440]
  - Merge SRPM/ol8-u4 orabug patches into SRPM/ol8-u5 [Orabug: 33471981]
  - Reformat orabug33822070-kdump-skip-lvm-private-devices.patch [Orabug: 33822070]
  - Drop oracle specific patches no longer applicable [Orabug: 32258986] [Orabug: 33748084]


author: Darren Kenny <darren.kenny@oracle.com> - 2.0.31-1.0.2
changelog:
  - Fix failure to trigger kdump environment on panic [Orabug: 38537007]
  - Handle building for kernels without KEXEC_LOAD_DEBUG flag [Orabug: 38551849]


author: Harshvardhan Jha <harshvardhan.j.jha@oracle.com> - 2.0.31-1.0.5
changelog:
  - kdump: add iscsi driver injection, ipv6 network-legacy omission, and fix iscsi srcaddr parsing [Orabug: 37836073]


author: David Howells <dhowells@redhat.com> - 1.5.9-1
changelog:
  - Add manpages for get_persistent.
  - Fix memory leaks in keyctl_describe/read/get_security_alloc().
  - Use keyctl_describe_alloc in dump_key_tree_aux rather than open coding it.
  - Exit rather than returning from act_xxx() functions.
  - Fix memory leak in dump_key_tree_aux.
  - Only get the groups list if we need it.
  - Don't trust sscanf's %n argument.
  - Use the correct path macros in the specfile.
  - Avoid use realloc when the memory has no content.
  - Fix a bunch of issues in key.dns_resolver.
  - Fix command table searching in keyctl utility.
  - Fix a typo in the permissions mask constants.
  - Improve the keyctl_read manpage.
  - Add man7 pages describing various keyrings concepts.


author: David Howells <dhowells@redhat.com> - 1.5.10-1
changelog:
  - Include sys/types.h in keyutils.h.
  - The dns resolver needs limits.h.
  - Overhaul of all manual pages.
  - Some manual pages moved to Linux man-pages project.
  - Add Diffie-Helman keyctl function.


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 25-5
changelog:
  - weak-modules: handle versions with + and other special regex symbols
  - weak-modules: fix misleading message when cannot find dracut.
    Resolves: rhbz#1609372.


author: Eugene Syromiatnikov <esyr@redhat.com> - 25-6
changelog:
  - weak-modules: check also for /lib/modules/$krel/symvers.gz as a possible
    symvers file path.
    Resolves: rhbz#1614119.


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 25-7
changelog:
  - weak-modules: use is_kernel_installed wrapper in update_modules_for_krel.
  - weak-modules: more abstract symvers search implementation.
  - weak-modules: use additional paths for System.map file.
    Resolves: rhbz#1621306.


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 25-8
changelog:
  - weak-modules: fix initial state creation for dry-run
  - weak-modules: check compatibility in a temporary directory
    Resolves: rhbz#1622990.


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 25-10
changelog:
  - weak-modules: group modules on add-kernel
  - weak-modules: do not make groups if there are no extra modules
    Resolves: rhbz#1649211


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 25-16
changelog:
  - weak-modules: update_modules_for_krel: always finish sandbox
  - weak-modules: groupping: use dependencies of extra/ provider
    Resolves: rhbz#1778889


author: EL Errata <el-errata_ww@oracle.com> - 25-20.0.1
changelog:
  - weak-modules: Fix add_kernel to handle suffix [Orabug: 34623248] (Todd Vierling)
  - add weak-modules patch for [Orabug: 26672773]


author: - Andy Walsh <awalsh@redhat.com> - 6.2.1.102-53
changelog:
  - Continued converting the VDO device to conform to the DM convention of
    not issuing I/O while suspended.
    - Resolves: rhbz#1659303
  - Added more rate limiting of error logging in both the kvdo and uds
    modules in order to avoid soft-lockups on newer kernels.
    - Resolves: rhbz#1703243
  - Eliminated the passing of addresses of unaligned fields in packed
    - Resolves: rhbz#1718058


author: - Andy Walsh <awalsh@redhat.com> - 6.2.1.134-56
changelog:
  - Finished converting the VDO device to conform to the DM convention of not
    issuing I/O while suspended.
  - Resolves: rhbz#1659303
  - Fixed a bug where crash recovery could use the wrong threads for certain
    operations potentially resulting in memory corruption.
  - Resolves: rhbz#1703621
  - Fixed a bug which could cause segfaults when running the vdostatus
    command.
  - Resolves: rhbz#1669960
  - Eliminated a backtrace from the error logged when creating a VDO device
    with an erroneous physical size in the table line.
  - Resolves: rhbz#1717435
  - Fixed a possible use-after-free of the UDSConfiguration.
  - Resolves: rhbz#1653802
  - Made VDO a singleton device because multi-segment devices containing a
    VDO have a number of issues.
  - Resolves: rhbz#1725077
  - Converted the VDO device to conform to the DM convention of not issuing
    writes from the constructor.
  - Resolves: rhbz#1669086


author: - Andy Walsh <awalsh@redhat.com> - 6.2.1.138-56
changelog:
  - Fixed a crash on allocation failure and a use-after-free race introduced by
    the changes to avoid issuing I/O while suspended.
  - Resolves: rhbz#1659303


author: - Andy Walsh <awalsh@redhat.com> - 6.2.2.117-63
changelog:
  - Fixed a bug which would cause the UDS index to be perceived as corrupt
    when a VDO volume is moved to a system with a different endianness.
  - Resolves: rhbz#1745211
  - Modified UDS index rebuild to be interruptible so that shutting down a
    VDO whose index is rebuilding need not wait for the index rebuild to
    complete.
  - Resolves: rhbz#1737639
  - Prevented two VDO devices from being started on the same storage.
  - Resolves: rhbz#1725052
  - Fixed rare races which could result in VDO issuing I/O while suspended.
  - Resolves: rhbz#1766358
  - Fixed crashes when re-suspending a VDO after it had been resumed.
  - Resolves: rhbz#1765253
  - Made async mode ACID. Added async-unsafe mode to preserve the performance of
    the old implementation.
  - Resolves: rhbz#1657301


author: - Andy Walsh <awalsh@redhat.com> - 6.2.3.91-73
changelog:
  - Removed unused UDS bio statistics.
  - Resolves: rhbz#1827762
  - Removed support for old kernels.
  - Resolves: rhbz#1827762
  - Fixed Coverity errors.
  - Resolves: rhbz#1827763
  - Improved the error message when slab journal locks overflow.
  - Resolves: rhbz#1827761
  - Fixed a bug which could result in VDO issuing I/O while suspended.
  - Resolves: rhbz#1824789
  - Fixed a rare double-enqueue bug in the recovery journal.
  - Resolves: rhbz#1824802
  - Modified VDO to not allocate an index if the VDO device is started
    with deduplication disabled.
  - Resolves: rhbz#1755448
  - Nodified VDO to not log spurious journal lock warnings when cleaning up
    write requests which failed due to the VDO going read-only.
  - Resolves: rhbz#1840455


author: - Andy Walsh <awalsh@redhat.com> - 6.2.3.107-73
changelog:
  - Fixed a bug which can cause a soft lockup if users interrupt processes
    waiting on dm-setup commands.
  - Resolves: rhbz#1844651
  - Fixed a rare race which could cause a suspend of a VDO device to fail.
  - Resolves: rhbz#1847747


author: - Andy Walsh <awalsh@redhat.com> - 6.2.3.107-74
changelog:
  - Updated dependencies to prevent installing kernel-rt incorrectly.
  - Resolves: rhbz#1811923
  - Bumped requirement for new 4.18 kernel
  - Relates: rhbz#1812069


author: - Andy Walsh <awalsh@redhat.com> - 6.2.4.14-74
changelog:
  - Fixed a bug which causes the UDS index to consume an excessive
    number of CPU cycles when the VDO device is idle.
  - Resolves: rhbz#1870660


author: - Andy Walsh <awalsh@redhat.com> - 6.2.4.26-74
changelog:
  - Modified physical growth to validate the new VDO size against the size of
    the underlying storage.
  - Resolves: rhbz#1732922
  - Fixed issues which prevented lvrename from working on lvm managed
    VDO devices.
  - Resolves: rhbz#1888419


author: - Andy Walsh <awalsh@redhat.com> - 6.2.6.3-83
changelog:
  - Adjusted kernel dependencies to grab the right packages.
  - Resolves: rhbz#2011426
  - Rebuilt for latest kernel.
  - Relates: rhbz#2000909


author: - Andy Walsh <awalsh@redhat.com> - 6.2.7.17-86
changelog:
  - Fixed bug which could result in empty flushes being issued to the storage
    below vdo while suspended.
  - Resolves: rhbz#2013056
  - Fixed syntax mismatch which prevented lvm from being able to configure a
    512MB UDS index.
  - Resolves: rhbz#2073203
  - Fixed a race handling timeouts of dedupe index queries.
  - Resolves: rhbz#2092075


author: Eugene Syromiatnikov <esyr@redhat.com> 1.10.0_dup8.1-1
changelog:
  - 9158390ccae759c2c0221de6e0c9541375a480f6
  - bnxt_en kernel module for Driver Update Program
  - Resolves: #bz1802054


author: Eugene Syromiatnikov <esyr@redhat.com> 0.8_4.18.0_80.23_dup8.0-3
changelog:
  - 1d6a0fb6a4ad99d22c0a6e537e3d408b683aa60d
  - btusb kernel module for Driver Update Program
  - Resolves: #bz1755922


author: Eugene Syromiatnikov <esyr@redhat.com> 4.18.0_348_dup8.5-1
changelog:
  - 9dc660bf1362f5a22a908e61004498cf7ec063a8
  - cfg80211 kernel module for Driver Update Program
  - Resolves: #bz2051885, #bz2051886


author: Eugene Syromiatnikov <esyr@redhat.com> 4.18.0_348_dup8.5-2
changelog:
  - Bump release due to "Package build kmod-redhat-cfg80211-4.18.0_348_dup8.5-1.el8_5
    kept gated because not onboarded to gating".


author: Eugene Syromiatnikov <esyr@redhat.com> 0.8.2_k_dup8.2-1
changelog:
  - afe1694503958c189ab98273de137c65bc3909f8
  - ice kernel module for Driver Update Program
  - Resolves: #bz1875784


author: Eugene Syromiatnikov <esyr@redhat.com> 4.18.0.210_dup8.2-1
changelog:
  - 2f22e260c6b75f2acb86bd91292dc8c66f56c481
  - ionic kernel module for Driver Update Program
  - Resolves: #bz1851940


author: Eugene Syromiatnikov <esyr@redhat.com> 4.18.0.210_dup8.2-2
changelog:
  - Bump release due to "Package build kmod-redhat-ionic-4.18.0.210_dup8.2-1.el8_2
    kept gated because not onboarded to gating".


author: Eugene Syromiatnikov <esyr@redhat.com> 4.18.0_107_dup8.0-5
changelog:
  - e67217ec68636d7570e69bab9e3b1ed1728b8292
  - iwlwifi kernel module for Driver Update Program
  - Resolves: #bz1755919


author: Eugene Syromiatnikov <esyr@redhat.com> 4.18.0_348_dup8.5-1
changelog:
  - 9dc660bf1362f5a22a908e61004498cf7ec063a8
  - mac80211 kernel module for Driver Update Program
  - Resolves: #bz2051885, #bz2051886


author: Eugene Syromiatnikov <esyr@redhat.com> 4.18.0_348_dup8.5-2
changelog:
  - Bump release due to "Package build kmod-redhat-mac80211-4.18.0_348_dup8.5-1.el8_5
    kept gated because not onboarded to gating".


author: Eugene Syromiatnikov <esyr@redhat.com> 5.0_0_dup8.2-1
changelog:
  - 86de78c2e6f431762836a4ea5891f891bc0fdcb4
  - mlx5_core kernel module for Driver Update Program
  - Resolves: #bz1889733


author: Eugene Syromiatnikov <esyr@redhat.com> 5.0_0_dup8.2-2
changelog:
  - Bump release due to "Package build kmod-redhat-mlx5_core-5.0_0_dup8.2-1.el8_2
    kept gated because not onboarded to gating".


author: Eugene Syromiatnikov <esyr@redhat.com> 35.101.00.00_dup8.3-1
changelog:
  - bfcc924fa05e36abe7a039ac5ec2be581e20c288
  - mpt3sas kernel module for Driver Update Program
  - Resolves: #bz1915214


author: Eugene Syromiatnikov <esyr@redhat.com> 4.18.0_363_dup8.5-1
changelog:
  - 9dc660bf1362f5a22a908e61004498cf7ec063a8
  - mt7921 kernel module for Driver Update Program
  - Resolves: #bz2051885


author: Eugene Syromiatnikov <esyr@redhat.com> 4.18.0_363_dup8.5-2
changelog:
  - Bump release due to "Package build kmod-redhat-mt7921-4.18.0_363_dup8.5-1.el8_5
    kept gated because not onboarded to gating".


author: EL Errata <el-errata_ww@oracle.com> - 2.0.8-1.3.0.1
changelog:
  * Mon Mar 01 2021 Eugene Syromiatnikov <esyr@redhat.com> 2.0.8-1.3
  - Replace "and" with "with" in pre-4.18.0-240.14.1.el8_3 kernel dependency
    to match it more precisely (it passes when both post-4.18.0-240.14.1.el8_3
    and pre-4.18.0-240.el8 kernels installed otherwise).


author: Eugene Syromiatnikov <esyr@redhat.com> 2.0.8-18.2
changelog:
  - Add Obsoletes: tags for 8.4.z kernel-specific sub-packages (RHEL-76082).
  - Rebuild against kernel-4.18.0-553.el8_10.


author: Eugene Syromiatnikov <esyr@redhat.com> 4.18.0_363_dup8.5-1
changelog:
  - 9dc660bf1362f5a22a908e61004498cf7ec063a8
  - rtw89 kernel module for Driver Update Program
  - Resolves: #bz2051886


author: Nishant Nayan <nishant.nayan@oracle.com> - 1.18.2-14.0.1
changelog:
  - Try harder to avoid password change replay errors [Orabug: 33609767]
  - Reverting the initial fix as this fix is MIT approved.
  - Initial fix was to toggle between udp and tcp using change_pw_no_udp option.


author: Julien Rische <jrische@redhat.com> - 1.18.2-21
changelog:
  - Backport fix of memory use after free during libkrad cleanup
  - Backport support for larger RADIUS attributes in libkrad
  - Resolves: rhbz#2103125


author: Julien Rische <jrische@redhat.com> - 1.18.2-27
changelog:
  - Fix memory leak in GSSAPI interface
    Resolves: RHEL-27250
  - Fix memory leak in PMAP RPC interface
    Resolves: RHEL-27244
  - Make TCP waiting time configurable
    Resolves: RHEL-17131


author: Julien Rische <jrische@redhat.com> - 1.18.2-29
changelog:
  - CVE-2024-37370 CVE-2024-37371
    Fix vulnerabilities in GSS message token handling
    Resolves: RHEL-45398 RHEL-45386


author: Julien Rische <jrische@redhat.com> - 1.18.2-30
changelog:
  - libkrad: implement support for Message-Authenticator (CVE-2024-3596)
    Resolves: RHEL-50253
  - Remove RSA protocol for PKINIT
    Resolves: RHEL-17616


author: Julien Rische <jrische@redhat.com> - 1.18.2-31
changelog:
  - Prevent overflow when calculating ulog block size (CVE-2025-24528)
    Resolves: RHEL-78248
  - kdb5_util: fix DB entry flags on modification
    Resolves: RHEL-56060


author: Julien Rische <jrische@redhat.com> - 1.18.2-32
changelog:
  - Do not block HMAC-MD4/5 in FIPS mode
    Resolves: RHEL-86786
  - Don't issue RC4 session keys by default (CVE-2025-3576)
    Resolves: RHEL-88049
  - Add PKINIT paChecksum2 from MS-PKCA v20230920
    Resolves: RHEL-82648


author: Julien Rische <jrische@redhat.com> - 1.18.2-33
changelog:
  - krad: packet ID fetched from uninitialized variable
    Resolves: RHEL-109220
  - Improving kerberos ulog resize efficiency
    Resolves: RHEL-93333


author: Julien Rische <jrische@redhat.com> - 1.18.2-34
changelog:
  - Fix NegoEx parsing vulnerabilities (CVE-2026-40355, CVE-2026-40356)
    Resolves: RHEL-171589 RHEL-171594


author: Robbie Harwood <rharwood@redhat.com> - 1.18-1
changelog:
  - New upstream version (1.18)
  - Resolves: #1802334
  - Resolves: #1820311
  - Resolves: #1791062
  - Resolves: #1784655


author: Robbie Harwood <rharwood@redhat.com> - 1.18.2-3
changelog:
  - Match Heimdal behavior for channel bindings
  - Code hygiene + test stability fix included
  - Resolves: #1840518


author: Jakub Hrozek <jhrozek@redhat.com> - 1.3.2-1
changelog:
  - New upstream release 1.3.3
  - Resolves: rhbz#1574267 - libldb-1.3.3 is available
  - Backport a patch from samba upstream to not require rpc.h


author: Petr Viktorin <pviktori@redhat.com> - 1.4.0-3
changelog:
  - Use %{__python2}, not "python", as the Python2 interpreter
  - Add workaround to allow building with Python 2
  - Remove the lmdb dependency in RHEL


author: Jakub Hrozek <jhrozek@redhat.com> - 1.5.4-1
changelog:
  - Resolves: rhbz#1684582 - Rebase libldb to version 1.5.4 for Samba
  - Resolves: rhbz#1567115 - libldb: Drop Python 2 subpackages from RHEL 8
  - Resolves: rhbz#1597243 - libldb uses Python 2 to build.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.5.4-2
changelog:
  - Fix some python2-related upgrade issues
  - Related: rhbz#1567115 - libldb: Drop Python 2 subpackages from RHEL 8


author: Isaac Boukris <iboukris@redhat.com> - 2.0.7-3
changelog:
  - Resolves: rhbz#1754423 - Rebase libldb to 2.0.7 version for samba
  - Related: rhbz#1754423 - Fix sssd tests (ldb)


author: Isaac Boukris <iboukris@redhat.com> - 2.2.0-1
changelog:
  - Resolves: rhbz#1878114 - Rebase libldb to the version required by Samba
  - Resolves: rhbz#1794349 - Build libldb with lmdb support


author: Andreas Schneider <asn@redhat.com> - 2.3.0-1
changelog:
  - resolves: rhbz#1945021 - Update to version 2.3.0
  - resolves: rhbz#1897082 - Fix libldb tests on aarch64


author: Jan Macku <jamacku@redhat.com> - 0.97-1
changelog:
  - update to 0.97 (#2159588)
  - drop downstream patch - ipmi: avoid error messages on non-dell platforms


author: Jeff Moyer <jmoyer@redhat.com> - 0.3.110-12.el8
changelog:
  - Pass in the distro-provided CFLAGS and LFLAGS. (Jeff Moyer)
  - Get rid of -nostartfiles -nostdlib (Jeff Moyer)
  - Resolves: rhbz#1630578


author: Richard Hughes <richard@hughsie.com> 0.7.8-1
changelog:
  - New upstream release
  - Add as_version_string() for fwupd
  - Add support for component agreements
  - Correctly compare version numbers like '1.2.3' and '1.2.3a'
  - Don't include the path component in the name when parsing the package filename
  - If the launchable is specified don't guess it when composing
  - Never add more than one component to the AppStream store when composing


author: Richard Hughes <richard@hughsie.com> 0.7.9-1
changelog:
  - New upstream release
  - Convert local icons found in metainfo files
  - Follow the Debian tilde usage when ordering versions
  - Use the launchable to find the desktop filename


author: Richard Hughes <richard@hughsie.com> 0.7.10-1
changelog:
  - New upstream release
  - Do not parse firmware files anymore
  - Do not require a release transaction when validating in relaxed mode
  - Extract release descriptions and agreement sections for translation


author: Richard Hughes <richard@hughsie.com> 0.7.11-1
changelog:
  - New upstream release
  - Add AS_APP_QUIRK_DEVELOPER_VERIFIED
  - Escape quotes in attributes
  - Provide async variants of store load functions


author: Richard Hughes <richard@hughsie.com> 0.7.13-1
changelog:
  - New upstream release
  - Do not restrict the maximum number of releases allowed
  - Throw an error when a launchable desktop-id is invalid


author: Richard Hughes <richard@hughsie.com> 0.7.14-1
changelog:
  - New upstream release
  - Add new API for gnome-software
  - Set the AppStream ID from the X-Flatpak desktop key


author: Karel Zak <kzak@redhat.com> 2.32.1-10
changelog:
  - fix #1699310 - rpm -V setup fail on /var/log/lastlog
  - fix #1702712 - pam_env bypassed for root user when using su


author: Karel Zak <kzak@redhat.com> 2.32.1-13
changelog:
  - fix #1734553 - blkid_get_dev() leak file descriptor to underlying block device
  - fix #1719069 - findmnt warning "recommended root FS passno is 1" for XFS


author: Karel Zak <kzak@redhat.com> 2.32.1-18
changelog:
  - fix #1739443 - lscpu reports wrong hypervisor in nested virt on s390x
  - fix #1743555 - command chfn adds some useless commas with GECOS information into /etc/password


author: Karel Zak <kzak@redhat.com> 2.32.1-23
changelog:
  - fix #1826251 - remove MD metadata 0.90 based tests from util-linux CI
  - fix #1812576 - RFE: Bitlocker detection for RHEL 8.3
  - fix #1817726 - add libblkid BLOCK_SIZE
  - fix #1803753 - RHEL-8: col struct char_str c_column field should be of unsigned type and/or larger than 16 bit
  - fix #1812118 - mount -a always tries to mount smb3 share subdir despite being already mounted
  - fix #1824727 - util-linux: Include python3-libmount package in the release
  - fix #1829245 - mount -a tries to mount already mounted cifs shares when we cannot query up to root dir


author: Karel Zak <kzak@redhat.com> 2.32.1-25
changelog:
  - fix #1884194 - RHEL-8: chrt command does not support the -R option
  - fix #1855759 - mount.8: clarify (no)suid behavior on file capabilities
  - fix #1861670 - lsblk can not show serial information for virtio disk
  - fix #1883783 - lscpu: avoid segfault on PowerPC systems with valid hardware configurations
  - fix #1900498 - libfdisk/libmount: backport two patches for upstream systemd
  - fix #1883056 - lscpu support for Fujitsu A64FX
  - fix #1882740 - lscpu: use SMBIOS Type 4 strings for CPU vendor and model on ARM


author: Karel Zak <kzak@redhat.com> 2.32.1-28
changelog:
  - fix #1906157 - after su from root to a normal user mesg is unable to show current status
  - fix #1917852 - findmnt: add option to list all fs-independent flags
  - fix #1922299 - throws error using /sbin/nologin: invalid option -- 'c'
  - fix #1940607 - lsblk sometimes returns block devices in wrong order with --pairs
  - fix #1919529 - [RFE] RHEL-8: Support option flags with mount(8) --bind
  - fix #1946921 - RHEL8: mount --rbind -o rprivate doesn't do recursive bind mount


author: Karel Zak <kzak@redhat.com> 2.32.1-29
changelog:
  - fix #1988955 - script command continues without stopping.
  - fix #2041498 - incorrect partition size calculation for BLKPG_* ioctls
  - fix #2011602 - logger from util-linux incorrectly handles long messages
  - fix #1916151 - [RFE] spread fstrim.timer across time
  - fix #1894192 - Update or backport setpriv --pdeathsig
  - fix #2026511 - blkid fails to complete when targeting  non-block devices


author: Karel Zak <kzak@redhat.com> 2.32.1-31
changelog:
  - improve #2026511 fix - blkid fails to complete when targeting non-block devices
  - fix #1950187 - Ambient capabilities failed to applied to non-root user


author: Karel Zak <kzak@redhat.com> 2.32.1-36
changelog:
  - fix #2060030 - Please backport patches for atari partition detection to RHEL 8
  - fix #2069187 - Internal testsuite for lscpu failed on aarch64
  - fix #2093166 - lslogins reports incorrect "Password is locked" status
  - fix #2059241 - rpm -V / --verify reports bad user/group/mtime for /run/uuidd
  - fix #2044592 - Move /var/log/lastlog ownership to systemd


author: Karel Zak <kzak@redhat.com> 2.32.1-40
changelog:
  - fix #2121699 - fstrim -av fails to trim root filesystem on Red Hat Coreos 
  - fix #2142496 - update upstream tests
  - fix #2149394 - umount outputs inaccurate error message when umount() fails with EACCES
  - fix #2159544 - lslogins "Password is locked" status changed in util-linux-2.32.1-38
  - fix #2160321 - [last] ut->ut_user is not null terminated


author: Karel Zak <kzak@redhat.com> 2.32.1-43
changelog:
  - fix #2117355 - Add additional documentation for fstab
  - fix #2184728 - libuuid - downport cache related patch
  - fix #2188894 - The swapon man page of -p(priority) option shows incorrect.
  - fix #2227097 - wall(1) fail when trying to use seat0


author: Karel Zak <kzak@redhat.com> 2.32.1-46
changelog:
  - fix RHEL-13741 - lscpu: avoid EBUSY on cpuinfo_max_freq
  - fix RHEL-18451 - logger: initialize socket credentials control union
  - fix RHEL-16070 - util-linux: issues in libblkid
  - fix RHEL-6274 - lslogins incorrect account expiration field


author: Karel Zak <kzak@redhat.com> 2.32.1-48
changelog:
  - fix RHEL-134296 - libblkid: use snprintf() instead of sprintf()
  - fix RHEL-133946 - login-utils: fix setpwnam() buffer use [CVE-2025-14104]


author: Karel Zak <kzak@redhat.com> - 2.32-3
changelog:
  - sync spec file with Fedora
  - move /etc/adjtime config from initscripts to util-linux
  - fix #1560642 - uuidd.service does not start
  - remove unused build option --enable-libmount-force-mountinfo (it's default now)
  - disable assert code


