# changelog

author: Brian Maly <brian.maly@oracle.com> [5.15.0-311.185.3.el9uek]
changelog:
  - net_sched: sch_sfq: move the limit validation (Octavian Purdila)  [Orabug: 38160459]  {CVE-2025-37752}
  - net_sched: sch_sfq: use a temporary work area for validating configuration (Octavian Purdila)
  - mm: synchronise PGD in x86 when utilising dax vmemmap optimisation (Lorenzo Stoakes)  [Orabug: 38055896]
  - rds: ib: Make sure a QP in INIT state is transitioned to ERR (Håkon Bugge)  [Orabug: 38119112]
  - Reapply "rds: ib: Make sure receives are posted before connection is up" (Håkon Bugge)  [Orabug: 38119112]
  - rds: Fix array index out of bounds in rds_message_purge() (Harshit Mogalapalli)  [Orabug: 38158026]
  - block: assign bi_bdev for cloned bios in blk_rq_prep_clone (Christoph Hellwig)  [Orabug: 38172722]
  - fs/proc: do_task_stat: use __for_each_thread() (Oleg Nesterov)  [Orabug: 38092818]
  - Add Zen34 clients (Borislav Petkov (AMD))  [Orabug: 38167060]  {CVE-2024-36350} {CVE-2024-36357}
  - x86/process: Move the buffer clearing before MONITOR (Kim Phillips)  [Orabug: 38167060]  {CVE-2024-36350} {CVE-2024-36357}
  - Add normal counters (Borislav Petkov (AMD))  [Orabug: 38167060]  {CVE-2024-36350} {CVE-2024-36357}
  - KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov (AMD))  [Orabug: 38167060]  {CVE-2024-36350} {CVE-2024-36357}
  - x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov (AMD))  [Orabug: 38167060]  {CVE-2024-36350} {CVE-2024-36357}
  - x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov (AMD))  [Orabug: 38167060]  {CVE-2024-36350} {CVE-2024-36357}
  - x86/CPU/AMD: Add ZenX generations flags (Borislav Petkov (AMD))  [Orabug: 38167060]  {CVE-2024-36350} {CVE-2024-36357}
  - x86/bugs: Free X86_BUG_AMD_APIC_C1E and X86_BUG_AMD_E400 bits (Boris Ostrovsky)  [Orabug: 38167060]  {CVE-2024-36350} {CVE-2024-36357}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-311.185.4.el9uek]
changelog:
  - KVM: arm64: Sanitize PM{C,I}NTEN{SET,CLR}, PMOVS{SET,CLR} before first run (Raghavendra Rao Ananta)  [Orabug: 38178527]
  - KVM: arm64: PMU: Add a helper to read a vCPU's PMCR_EL0 (Reiji Watanabe)  [Orabug: 38178527]
  - vhost-scsi: Fix vhost_scsi struct use after free (Mike Christie)  [Orabug: 38178300]
  - sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton)  [Orabug: 38137450]  {CVE-2025-38089}
  - bnxt_en: Cap the size of HWRM_PORT_PHY_QCFG forwarded response (Michael Chan)  [Orabug: 35789734]


author: Brian Maly <brian.maly@oracle.com> [5.15.0-311.185.5.el9uek]
changelog:
  - KVM: x86: Remove VT-d mention in posted interrupt tracepoint (Alejandro Jimenez)  [Orabug: 38195091]
  - KVM: x86: Only set APICV_INHIBIT_REASON_ABSENT if APICv is enabled (Alejandro Jimenez)  [Orabug: 38195091]
  - KVM: x86: Print names of apicv inhibit reasons in traces (Alejandro Jimenez)  [Orabug: 38195091]
  - KVM: SVM: Always update local APIC on writes to logical dest register (Sean Christopherson)  [Orabug: 38195091]
  - x86: Pin task-stack in __get_wchan() (Peter Zijlstra)  [Orabug: 38161988]
  - x86: Fix __get_wchan() for !STACKTRACE (Peter Zijlstra)  [Orabug: 38161988]
  - sched: Add wrapper for get_wchan() to keep task blocked (Kees Cook)  [Orabug: 38161988]
  - x86: Fix get_wchan() to support the ORC unwinder (Qi Zheng)  [Orabug: 38161988]
  - nvme: tcp: avoid race between queue_lock lock and destroy (Hannes Reinecke)  [Orabug: 37331887]  {CVE-2024-53100}
  - PCI/AER: Add sysfs attributes for log ratelimits (Jon Pan-Doh)  [Orabug: 36952192]
  - PCI/AER: Ratelimit correctable and non-fatal error logging (Jon Pan-Doh)  [Orabug: 36952192]
  - PCI/AER: Simplify add_error_device() (Bjorn Helgaas)  [Orabug: 36952192]
  - PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index (Bjorn Helgaas)  [Orabug: 36952192]
  - PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING (Karolina Stolarek)  [Orabug: 36952192]
  - PCI/AER: Check log level once and remember it (Karolina Stolarek)  [Orabug: 36952192]
  - PCI/AER: Trace error event before ratelimiting (Bjorn Helgaas)  [Orabug: 36952192]
  - PCI/AER: Update statistics before ratelimiting (Bjorn Helgaas)  [Orabug: 36952192]
  - PCI/AER: Simplify pci_print_aer() (Bjorn Helgaas)  [Orabug: 36952192]
  - PCI/AER: Initialize aer_err_info before using it (Bjorn Helgaas)  [Orabug: 36952192]
  - PCI/AER: Move aer_print_source() earlier in file (Bjorn Helgaas)  [Orabug: 36952192]
  - PCI/AER: Rename aer_print_port_info() to aer_print_source() (Jon Pan-Doh)  [Orabug: 36952192]
  - PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc (Bjorn Helgaas)  [Orabug: 36952192]
  - PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() (Bjorn Helgaas)  [Orabug: 36952192]
  - PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() (Bjorn Helgaas)  [Orabug: 36952192]
  - PCI/AER: Descope pci_printk() to aer_printk() (Ilpo Järvinen)  [Orabug: 36952192]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-311.185.6.el9uek]
changelog:
  - gre: Fix IPv6 multicast route creation. (Guillaume Nault)
  - pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
  - Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
  - net/sched: Always pass notifications when child class becomes empty (Lion Ackermann)
  - Revert "ipv6: save dontfrag in cork" (Brett A C Sheffield (Librecast))
  - net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju)  [Orabug: 38182990]
  - Revert "net/rds: Add krefs to struct rds_connection" (Håkon Bugge)  [Orabug: 38165949]
  - Revert "net/rds: tracepoints for rds_conn_kref_get and put" (Håkon Bugge)  [Orabug: 38165949]
  - sched: Change nr_uninterruptible type to unsigned long (Aruna Ramakrishna)  [Orabug: 37942383]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-311.185.7.el9uek]
changelog:
  - perf: Fix perf_event_validate_size() lockdep splat (Mark Rutland)  [Orabug: 36261485]  {CVE-2023-6931}
  - perf: Fix perf_event_validate_size() (Peter Zijlstra)  [Orabug: 36261485]  {CVE-2023-6931}


author: Brian Maly <brian.maly@oracle.com> [5.15.0-311.185.8.el9uek]
changelog:
  - net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju)  [Orabug: 38182400]
  - net/rds: poll eq during user-reset (Praveen Kumar Kannoju)  [Orabug: 38189328]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-311.185.6.el9uek]
changelog:
  - gre: Fix IPv6 multicast route creation. (Guillaume Nault)
  - pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
  - Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
  - net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217338] {CVE-2025-38350}
  - Revert "ipv6: save dontfrag in cork" (Brett A C Sheffield)
  - net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju) [Orabug: 38182990]
  - Revert "net/rds: Add krefs to struct rds_connection" (Håkon Bugge) [Orabug: 38165949]
  - Revert "net/rds: tracepoints for rds_conn_kref_get and put" (Håkon Bugge) [Orabug: 38165949]
  - sched: Change nr_uninterruptible type to unsigned long (Aruna Ramakrishna) [Orabug: 37942383]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-311.185.7.el9uek]
changelog:
  - perf: Fix perf_event_validate_size() lockdep splat (Mark Rutland) [Orabug: 36261485] {CVE-2023-6931}
  - perf: Fix perf_event_validate_size() (Peter Zijlstra) [Orabug: 36261485] {CVE-2023-6931}


author: Brian Maly <brian.maly@oracle.com> [5.15.0-311.185.8.el9uek]
changelog:
  - net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38182400]
  - net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189328]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-312.185.1.el9uek]
changelog:
  - uek-rpm: mips: Disable CONFIG_TRANSPARENT_HUGEPAGE (Dave Kleikamp) [Orabug: 38280961]
  - KVM: x86/MMU: Allow faulting at hugepages during dirty tracking (Joao Martins) [Orabug: 36409415]
  - KVM: x86/MMU: Dirty tracking without write-protection for shadow paging (Joao Martins) [Orabug: 36409415]
  - KVM: x86/MMU: Track rmap present pages (Joao Martins) [Orabug: 36409415]
  - nvme: check for valid nvme_identify_ns() before using it (Ewan D. Milne) [Orabug: 38207640]
  - nvme: bring back auto-removal of deleted namespaces during sequential scan (Christoph Hellwig) [Orabug: 38207640]
  - rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38236843]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-312.187.2.el9uek]
changelog:
  - EDAC: Octeon: Fix compile error by replacing sdei_init() with acpi_sdei_init() (Vijayendra Suman) [Orabug: 38294908]
  - LTS version: v5.15.187 (Vijayendra Suman)
  - usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38309912] {CVE-2025-38404}
  - platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
  - Logitech C-270 even more broken (Oliver Neukum)
  - i2c/designware: Fix an initialization issue (Michael J. Ruhl) [Orabug: 38253850] {CVE-2025-38380}
  - usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
  - xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
  - xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
  - platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
  - platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
  - dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
  - net: dpaa2-eth: rearrange variable in dpaa2_eth_get_ethtool_stats (Ioana Ciornei)
  - dpaa2-eth: Update SINGLE_STEP register access (Radu Bulie)
  - dpaa2-eth: Update dpni_get_single_step_cfg command (Radu Bulie)
  - ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
  - NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
  - drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal) [Orabug: 38253820] {CVE-2025-38371}
  - regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253906] {CVE-2025-38395}
  - regulator: gpio: Add input_supply support in gpio_regulator_config (Jerome Neanne)
  - mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
  - rcu: Return early if callback is not specified (Uladzislau Rezki)
  - mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez) [Orabug: 38253863] {CVE-2025-38384}
  - ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253874] {CVE-2025-38386}
  - wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253945] {CVE-2025-38406}
  - wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
  - scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253914] {CVE-2025-38399}
  - powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
  - ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
  - ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
  - ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
  - drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253967] {CVE-2025-38410}
  - nui: Fix dma_mapping_error() check (Thomas Fourier)
  - rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253841] {CVE-2025-38377}
  - enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
  - amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
  - lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
  - igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
  - drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253886] {CVE-2025-38389}
  - platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253976] {CVE-2025-38412}
  - drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
  - spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
  - drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
  - btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
  - scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
  - scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
  - scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
  - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253900] {CVE-2025-38393}
  - nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253922] {CVE-2025-38400}
  - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253880] {CVE-2025-38387}
  - platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
  - mtk-sd: reset host->mrq on prepare_data() error (Sergey Senozhatsky)
  - mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253927] {CVE-2025-38401}
  - mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
  - usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253893] {CVE-2025-38391}
  - mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
  - vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253936] {CVE-2025-38403}
  - rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
  - ARM: 9354/1: ptrace: Use bitfield helpers (Geert Uytterhoeven)
  - btrfs: don't drop extent_map for free space inode on write error (Josef Bacik) [Orabug: 36530624] {CVE-2024-26726}
  - arm64: Restrict pagetable teardown to avoid false warning (Dev Jain)
  - s390: Add '-std=gnu11' to decompressor and purgatory CFLAGS (Nathan Chancellor)
  - s390/entry: Fix last breaking event handling in case of stack corruption (Heiko Carstens)
  - media: uvcvideo: Rollback non processed entities on error (Ricardo Ribalda)
  - PCI: hv: Do not set PCI_COMMAND_MEMORY to reduce VM boot time (Dexuan Cui)
  - drm/amd/display: Add null pointer check for get_first_active_display() (Xu Wang) [Orabug: 38253794] {CVE-2025-38362}
  - drm/bridge: cdns-dsi: Wait for Clk and Data Lanes to be ready (Aradhya Bhatia)
  - drm/bridge: cdns-dsi: Check return value when getting default PHY config (Aradhya Bhatia)
  - drm/bridge: cdns-dsi: Fix connecting to next bridge (Aradhya Bhatia)
  - drm/bridge: cdns-dsi: Fix the clock variable for mode_valid() (Aradhya Bhatia)
  - drm/amdkfd: Fix race in GWS queue scheduling (Jay Cornwall)
  - drm/udl: Unregister device before cleaning up on disconnect (Thomas Zimmermann)
  - drm/tegra: Fix a possible null pointer dereference (Qiu-Ji Chen) [Orabug: 38253800] {CVE-2025-38363}
  - drm/tegra: Assign plane type before registration (Thierry Reding)
  - HID: wacom: fix kobject reference count leak (Qasim Ijaz)
  - HID: wacom: fix memory leak on sysfs attribute creation failure (Qasim Ijaz)
  - HID: wacom: fix memory leak on kobject creation failure (Qasim Ijaz)
  - btrfs: update superblock's device bytes_used when dropping chunk (Mark Harmstone)
  - dm-raid: fix variable in journal device check (Heinz Mauelshagen)
  - Bluetooth: L2CAP: Fix L2CAP MTU negotiation (Frédéric Danis)
  - dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive (Yao Zi)
  - staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() (Nathan Chancellor)
  - net: selftests: fix TCP packet checksum (Jakub Kicinski)
  - atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). (Kuniyuki Iwashima) [Orabug: 38175043] {CVE-2025-38245}
  - net: enetc: Correct endianness handling in _enetc_rd_reg64 (Simon Horman)
  - um: ubd: Add missing error check in start_io_thread() (Tiwei Bie)
  - vsock/uapi: fix linux/vm_sockets.h userspace compilation errors (Stefano Garzarella)
  - af_unix: Don't set -ECONNRESET for consumed OOB skb. (Kuniyuki Iwashima)
  - wifi: mac80211: fix beacon interval calculation overflow (Lachlan Hodges)
  - libbpf: Fix null pointer dereference in btf_dump__free on allocation failure (Yuan Chen)
  - attach_recursive_mnt(): do not lock the covering tree when sliding something under it (Al Viro)
  - ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() (Youngjun Lee) [Orabug: 38175063] {CVE-2025-38249}
  - atm: clip: prevent NULL deref in clip_push() (Eric Dumazet) [Orabug: 38175077] {CVE-2025-38251}
  - s390/pkey: Prevent overflow in size calculation for memdup_user() (Fedor Pchelkin) [Orabug: 38175091] {CVE-2025-38257}
  - i2c: robotfuzz-osif: disable zero-length read messages (Wolfram Sang)
  - i2c: tiny-usb: disable zero-length read messages (Wolfram Sang)
  - platform/x86: ideapad-laptop: use usleep_range() for EC polling (Rongrong)
  - dummycon: Trigger redraw when switching consoles with deferred takeover (Thomas Zimmermann)
  - tty: vt: make consw::con_switch() return a bool (Jiri Slaby)
  - tty: vt: sanitize arguments of consw::con_clear() (Jiri Slaby)
  - tty: vt: make init parameter of consw::con_init() a bool (Jiri Slaby)
  - vgacon: remove unneeded forward declarations (Jiri Slaby)
  - vgacon: switch vgacon_scrolldelta() and vgacon_restore_screen() (Jiri Slaby)
  - tty/vt: consolemap: rename and document struct uni_pagedir (Jiri Slaby)
  - fbcon: delete a few unneeded forward decl (Daniel Vetter)
  - uio_hv_generic: Align ring size to system page (Long Li)
  - uio_hv_generic: Query the ringbuffer size for device (Saurabh Singh Sengar)
  - Drivers: hv: vmbus: Add utility function for querying ring size (Saurabh Singh Sengar)
  - Drivers: hv: Rename 'alloced' to 'allocated' (Vitaly Kuznetsov)
  - f2fs: don't over-report free space or inodes in statvfs (Chao Yu)
  - media: imx-jpeg: Drop the first error frames (Ming Qian)
  - clk: ti: am43xx: Add clkctrl data for am43xx ADC1 (Miquel Raynal)
  - media: omap3isp: use sgtable-based scatterlist wrappers (Marek Szyprowski)
  - media: davinci: vpif: Fix memory leak in probe error path (Dmitry Nikiforov)
  - jfs: validate AG parameters in dbMount() to prevent crashes (Vasiliy Kovalev) [Orabug: 38158700] {CVE-2025-38230}
  - fs/jfs: consolidate sanity checking in dbMount (Dave Kleikamp)
  - ovl: Check for NULL d_inode() in ovl_dentry_upper() (Kees Cook)
  - ceph: fix possible integer overflow in ceph_zero_objects() (Dmitry Kandybka)
  - ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock (Mario Limonciello)
  - ALSA: hda: Add new pci id for AMD GPU display HD audio controller (Vijendar Mukunda)
  - ALSA: hda: Ignore unsol events for cards being shut down (Cezary Rojewski)
  - usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode (Jos Wang)
  - usb: cdc-wdm: avoid setting WDM_READ for ZLP-s (Robert Hodaszi)
  - usb: Add checks for snprintf() calls in usb_alloc_dev() (Andy Shevchenko)
  - usb: common: usb-conn-gpio: use a unique name for usb connector device (Chance Yang)
  - tty: serial: uartlite: register uart driver in init (Jakub Lewalski) [Orabug: 38175113] {CVE-2025-38262}
  - usb: potential integer overflow in usbg_make_tpg() (Chen Yufeng)
  - usb: dwc2: also exit clock_gating when stopping udc while suspended (Michael Grzeschik)
  - coresight: Only check bottom two claim bits (James Clark)
  - um: Add cmpxchg8b_emu and checksum functions to asm-prototypes.h (Sami Tolvanen)
  - iio: pressure: zpa2326: Use aligned_s64 for the timestamp (Jonathan Cameron)
  - bcache: fix NULL pointer in cache_set_flush() (Linggang Zeng) [Orabug: 38175119] {CVE-2025-38263}
  - md/md-bitmap: fix dm-raid max_write_behind setting (Yu Kuai)
  - dmaengine: xilinx_dma: Set dma_device directions (Thomas Gessler)
  - ksmbd: allow a filename to contain special characters on SMB3.1.1 posix extension (Namjae Jeon)
  - hwmon: (pmbus/max34440) Fix support for max34451 (Alexis Czezar Torreno)
  - leds: multicolor: Fix intensity setting while SW blinking (Sven Schwermer)
  - mfd: max14577: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
  - mailbox: Not protect module_put with spin_lock_irqsave (Peng Fan)
  - NFSv4.2: fix listxattr to return selinux security label (Olga Kornievskaia)
  - NFSv4: Always set NLINK even if the server doesn't support it (Han Young)
  - cifs: Fix cifs_query_path_info() for Windows NT servers (Pali Rohár)
  - LTS version: v5.15.186 (Vijayendra Suman)
  - scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops (Kees Cook)
  - scsi: elx: efct: Fix memory leak in efct_hw_parse_filter() (Vitaliy Shevtsov)
  - arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (Tengda Wu) [Orabug: 38180595] {CVE-2025-38320}
  - perf: Fix sample vs do_exit() (Peter Zijlstra) [Orabug: 38254029] {CVE-2025-38424}
  - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Heiko Carstens)
  - bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE (Paul Chaignon)
  - net: Fix checksum update for ILA adj-transport (Paul Chaignon)
  - ext4: avoid remount errors with 'abort' mount option (Jan Kara)
  - ext4: make 'abort' mount option handling standard (Jan Kara)
  - mm/huge_memory: fix dereferencing invalid pmd migration entry (Gavin Guo) [Orabug: 37976983] {CVE-2025-37958}
  - net_sched: sch_sfq: reject invalid perturb period (Eric Dumazet) [Orabug: 38158476] {CVE-2025-38193}
  - arm64: proton-pack: Add new CPUs 'k' values for branch mitigation (James Morse)
  - arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (James Morse) [Orabug: 37977005] {CVE-2025-37963}
  - arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs (James Morse) [Orabug: 37976929] {CVE-2025-37948}
  - arm64: spectre: increase parameters that can be used to turn off bhb mitigation individually (Liu Song)
  - arm64: proton-pack: Expose whether the branchy loop k value (James Morse)
  - arm64: proton-pack: Expose whether the platform is mitigated by firmware (James Morse)
  - arm64: insn: Add support for encoding DSB (James Morse)
  - arm64: insn: add encoders for atomic operations (Hou Tao)
  - arm64: move AARCH64_BREAK_FAULT into insn-def.h (Hou Tao)
  - serial: sh-sci: Increment the runtime usage counter for the earlycon device (Claudiu Beznea)
  - ARM: dts: am335x-bone-common: Increase MDIO reset deassert delay to 50ms (Geert Uytterhoeven)
  - ARM: dts: am335x-bone-common: Increase MDIO reset deassert time (Colin Foster)
  - ARM: dts: am335x-bone-common: Add GPIO PHY reset on revision C3 board (Shengyu Qu)
  - net: atm: fix /proc/net/atm/lec handling (Eric Dumazet) [Orabug: 38158405] {CVE-2025-38180}
  - net: atm: add lec_mutex (Eric Dumazet) [Orabug: 38180611] {CVE-2025-38323}
  - calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). (Kuniyuki Iwashima) [Orabug: 38158412] {CVE-2025-38181}
  - tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (Haixia Qu) [Orabug: 38158424] {CVE-2025-38184}
  - tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior (Neal Cardwell)
  - atm: atmtcp: Free invalid length skb in atmtcp_c_send(). (Kuniyuki Iwashima) [Orabug: 38158433] {CVE-2025-38185}
  - mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (Kuniyuki Iwashima) [Orabug: 38180617] {CVE-2025-38324}
  - wifi: carl9170: do not ping device which has failed to load firmware (Dmitry Antipov) [Orabug: 38254010] {CVE-2025-38420}
  - ptp: fix breakage after ptp_vclock_in_use() rework (Vladimir Oltean)
  - net: ice: Perform accurate aRFS flow match (Krishna Kumar)
  - aoe: clean device rq_list in aoedev_downdev() (Justin Sanders) [Orabug: 38180627] {CVE-2025-38326}
  - pldmfw: Select CRC32 when PLDMFW is selected (Simon Horman)
  - hwmon: (occ) fix unaligned accesses (Arnd Bergmann)
  - hwmon: (occ) Rework attribute registration for stack usage (Arnd Bergmann)
  - hwmon: (occ) Add soft minimum power cap attribute (Eddie James)
  - drm/nouveau/bl: increase buffer size to avoid truncate warning (Jacob Keller)
  - drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
  - erofs: remove unused trace event erofs_destroy_inode (Gao Xiang)
  - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Jann Horn) [Orabug: 38132180] {CVE-2025-38085}
  - mm: hugetlb: independent PMD page table shared count (Liu Shixin) [Orabug: 37484959] {CVE-2024-57883}
  - mm/hugetlb: unshare page tables during VMA split, not before (Jann Horn) [Orabug: 38132171] {CVE-2025-38084}
  - iio: accel: fxls8962af: Fix temperature calculation (Sean Nyekjaer)
  - ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged (Jonathan Lane)
  - ALSA: hda/intel: Add Thinkpad E15 to PM deny list (Takashi Iwai)
  - ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card (Wangdicheng)
  - Input: sparcspkr - avoid unannotated fall-through (Yuli Wang)
  - block: default BLOCK_LEGACY_AUTOLOAD to y (Christoph Hellwig)
  - HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (Terry Junge) [Orabug: 38152876] {CVE-2025-38103}
  - atm: Revert atm_account_tx() if copy_from_iter_full() fails. (Kuniyuki Iwashima) [Orabug: 38158457] {CVE-2025-38190}
  - selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len (Stephen Smalley)
  - selftests/x86: Add a test to detect infinite SIGTRAP handler loop (Xin Li)
  - udmabuf: use sgtable-based scatterlist wrappers (Marek Szyprowski)
  - scsi: s390: zfcp: Ensure synchronous unit_add (Peter Oberparleiter)
  - scsi: storvsc: Increase the timeouts to storvsc_timeout (Dexuan Cui)
  - jffs2: check jffs2_prealloc_raw_node_refs() result in few other places (Fedor Pchelkin) [Orabug: 38180635] {CVE-2025-38328}
  - jffs2: check that raw node were preallocated before writing summary (Artem Sadovnikov) [Orabug: 38158483] {CVE-2025-38194}
  - drivers/rapidio/rio_cm.c: prevent possible heap overwrite (Andrew Morton) [Orabug: 38137453] {CVE-2025-38090}
  - powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery (Narayana Murty N)
  - platform/x86: dell_rbu: Stop overwriting data buffer (Stuart Hayes)
  - platform/x86: dell_rbu: Fix list usage (Stuart Hayes) [Orabug: 38158494] {CVE-2025-38197}
  - Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first" (Alexander Sverdlin)
  - tee: Prevent size calculation wraparound on 32-bit kernels (Jann Horn)
  - ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY (Sukrut Bellary)
  - bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value (Laurentiu Tudor)
  - watchdog: da9052_wdt: respect TWDMIN (Marcus Folkesson)
  - octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer() (Xu Wang)
  - bpf, sockmap: Fix data lost during EAGAIN retries (Jiayuan Chen)
  - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Kyungwook Boo) [Orabug: 38158517] {CVE-2025-38200}
  - sock: Correct error checking condition for (assign|release)_proto_idx() (Zijun Hu)
  - scsi: lpfc: Use memcpy() for BIOS version (Daniel Wagner) [Orabug: 38180667] {CVE-2025-38332}
  - pinctrl: mcp23s08: Reset all pins to input at probe (Mike Looijmans)
  - software node: Correct a OOB check in software_node_get_reference_args() (Zijun Hu) [Orabug: 38180730] {CVE-2025-38342}
  - vxlan: Do not treat dst cache initialization errors as fatal (Ido Schimmel)
  - net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions (Yong Wang)
  - iommu/amd: Ensure GA log notifier callbacks finish running before module unload (Sean Christopherson)
  - scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Justin Tee)
  - libbpf: Add identical pointer detection to btf_dedup_is_equiv() (Alan Maguire)
  - clk: rockchip: rk3036: mark ddrphy as critical (Heiko Stuebner)
  - wifi: mac80211: do not offer a mesh path if forwarding is disabled (Benjamin Berg)
  - net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info (Jason Xing)
  - pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() (Gabor Juhos)
  - pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction() (Gabor Juhos)
  - pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction() (Gabor Juhos)
  - pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name() (Gabor Juhos)
  - net: atlantic: generate software timestamp just before the doorbell (Jason Xing)
  - ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT (Sebastian Andrzej Siewior)
  - tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows (Eric Dumazet)
  - tcp: always seek for minimal rtt in tcp_rcv_rtt_update() (Eric Dumazet)
  - net: dlink: add synchronization for stats update (Moon Yeounsu)
  - i2c: npcm: Add clock toggle recovery (Tali Perry)
  - cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs (Mike Tipton)
  - sctp: Do not wake readers in __sctp_write_space() (Petr Malat)
  - wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R (Henk Vergonet)
  - emulex/benet: correct command version selection in be_cmd_get_stats() (Alok Tiwari)
  - i2c: designware: Invoke runtime suspend on quick slave re-registration (Tan En De)
  - tipc: use kfree_sensitive() for aead cleanup (Zilin Guan)
  - net: macb: Check return value of dma_set_mask_and_coherent() (Sergio Perez Gonzalez)
  - cpufreq: Force sync policy boost with global boost on sysfs update (Viresh Kumar)
  - thermal/drivers/qcom/tsens: Update conditions to strictly evaluate for IP v2+ (George Moussalem)
  - pmdomain: ti: Fix STANDBY handling of PER power domain (Sukrut Bellary)
  - nios2: force update_mmu_cache on spurious tlb-permission--related pagefaults (Simon Schuster)
  - media: i2c: imx334: update mode_3840x2160_regs array (Shravan Chippa)
  - media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() (Xu Wang) [Orabug: 38175013] {CVE-2025-38237}
  - media: tc358743: ignore video while HPD is low (Hans Verkuil)
  - drm/amdkfd: Set SDMA_RLCx_IB_CNTL/SWITCH_INSIDE_IB (Amber Lin)
  - drm/msm/dpu: don't select single flush for active CTL blocks (Dmitry Baryshkov)
  - jfs: Fix null-ptr-deref in jfs_ioc_trim (Dylan Wolff) [Orabug: 38158545] {CVE-2025-38203}
  - drm/amdgpu/gfx9: fix CSIB handling (Alex Deucher)
  - drm/amdgpu/gfx8: fix CSIB handling (Alex Deucher)
  - ext4: prevent stale extent cache entries caused by concurrent get es_cache (Zhang Yi)
  - sunrpc: fix race in cache cleanup causing stale nextcheck time (Long Li)
  - media: rkvdec: Initialize the m2m context before the controls (Nicolas Dufresne)
  - media: ti: cal: Fix wrong goto on error path (Tomi Valkeinen)
  - jfs: fix array-index-out-of-bounds read in add_missing_indices (Aditya Dutt) [Orabug: 38158552] {CVE-2025-38204}
  - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Zhang Yi)
  - drm/amdgpu/gfx7: fix CSIB handling (Alex Deucher)
  - media: uapi: v4l: Change V4L2_TYPE_IS_CAPTURE condition (Nas Chung)
  - media: ccs-pll: Better validate VT PLL branch (Sakari Ailus)
  - drm/amdgpu/gfx10: fix CSIB handling (Alex Deucher)
  - media: i2c: imx334: Fix runtime PM handling in remove function (Tarang Raval)
  - drm/msm/a6xx: Increase HFI response timeout (Akhil P Oommen)
  - drm/amd/display: Add NULL pointer checks in dm_force_atomic_commit() (Srinivasan Shanmugam)
  - media: uapi: v4l: Fix V4L2_TYPE_IS_OUTPUT condition (Nas Chung)
  - drm/msm/hdmi: add runtime PM calls to DDC transfer function (Dmitry Baryshkov)
  - media: i2c: imx334: Enable runtime PM before sub-device registration (Tarang Raval)
  - drm/bridge: anx7625: change the gpiod_set_value API (Ayushi Makhija)
  - exfat: fix double free in delayed_free (Namjae Jeon) [Orabug: 38158566] {CVE-2025-38206}
  - drm/bridge: analogix_dp: Add irq flag IRQF_NO_AUTOEN instead of calling disable_irq() (Damon Ding)
  - sunrpc: update nextcheck time when adding new cache entries (Long Li)
  - drm/amdgpu/gfx6: fix CSIB handling (Alex Deucher)
  - ACPI: battery: negate current when discharging (Peter Marheine)
  - PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() (Charan Teja Kalla)
  - ASoC: tegra210_ahub: Add check to of_device_get_match_data() (Yuanjun Gong)
  - ACPICA: utilities: Fix overflow check in vsnprintf() (Philip Redkin)
  - power: supply: bq27xxx: Retrieve again when busy (Jerry Lv)
  - ACPICA: fix acpi parse and parseext cache leaks (Seunghun Han) [Orabug: 38180747] {CVE-2025-38344}
  - ACPI: bus: Bail out if acpi_kobj registration fails (Armin Wolf)
  - ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change (Hector Martin)
  - ACPICA: Avoid sequence overread in call to strncmp() (Ahmed Salem)
  - clocksource: Fix the CPUs' choice in the watchdog per CPU verification (Guilherme G. Piccoli)
  - ACPICA: fix acpi operand cache leak in dswstate.c (Seunghun Han) [Orabug: 38180755] {CVE-2025-38345}
  - iio: adc: ad7606_spi: fix reg write value mask (David Lechner)
  - iio: imu: inv_icm42600: Fix temperature calculation (Sean Nyekjaer)
  - iio: accel: fxls8962af: Fix temperature scan element sign (Sean Nyekjaer)
  - PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit() (Diederik de Haas)
  - PCI: Fix lock symmetry in pci_slot_unlock() (Ilpo Järvinen)
  - PCI: Add ACS quirk for Loongson PCIe (Huacai Chen)
  - PCI: cadence-ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
  - uio_hv_generic: Use correct size for interrupt and monitor pages (Long Li)
  - remoteproc: core: Release rproc->clean_table after rproc_attach() fails (Xiaolei Wang) [Orabug: 38254002] {CVE-2025-38418}
  - remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (Xiaolei Wang) [Orabug: 38254006] {CVE-2025-38419}
  - regulator: max14577: Add error check for max14577_read_reg() (Xu Wang)
  - mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS (Khem Raj)
  - staging: iio: ad5933: Correct settling cycles encoding per datasheet (Gabriel)
  - net: ch9200: fix uninitialised access during mii_nway_restart (Qasim Ijaz) [Orabug: 38132188] {CVE-2025-38086}
  - ftrace: Fix UAF when lookup kallsym after ftrace disabled (Ye Bin) [Orabug: 38180767] {CVE-2025-38346}
  - dm-mirror: fix a tiny race condition (Mikulas Patocka)
  - mtd: nand: sunxi: Add randomizer configuration before randomizer enable (Xu Wang)
  - mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk (Xu Wang)
  - mm: fix ratelimit_pages update error in dirty_ratio_handler() (Jinliang Zheng)
  - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Shin'Ichiro Kawasaki) [Orabug: 38158591] {CVE-2025-38211}
  - ipc: fix to protect IPCS lookups using RCU (Jeongjun Park) [Orabug: 38158597] {CVE-2025-38212}
  - clk: meson-g12a: add missing fclk_div2 to spicc (Da Xue)
  - parisc: fix building with gcc-15 (Arnd Bergmann)
  - vgacon: Add check for vc_origin address range in vgacon_scroll() (Gong, Ruiqi)
  - fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [Orabug: 38158614] {CVE-2025-38214}
  - EDAC/altera: Use correct write width with the INTTEST register (Niravkumar L Rabara)
  - NFC: nci: uart: Set tty->disc_data only in success path (Krzysztof Kozlowski) [Orabug: 38253991] {CVE-2025-38416}
  - f2fs: fix to do sanity check on sit_bitmap_size (Chao Yu) [Orabug: 38158639] {CVE-2025-38218}
  - f2fs: prevent kernel warning due to negative i_nlink from corrupted image (Jaegeuk Kim) [Orabug: 38158647] {CVE-2025-38219}
  - Input: ims-pcu - check record size in ims_pcu_flash_firmware() (Dan Carpenter) [Orabug: 38254053] {CVE-2025-38428}
  - ext4: ensure i_size is smaller than maxbytes (Zhang Yi)
  - ext4: factor out ext4_get_maxbytes() (Zhang Yi)
  - ext4: fix calculation of credits for extent tree modification (Jan Kara)
  - ext4: inline: fix len overflow in ext4_prepare_inline_data (Thadeu Lima de Souza Cascardo) [Orabug: 38158661] {CVE-2025-38222}
  - bus: fsl-mc: fix GET/SET_TAILDROP command ids (Wan Junjie)
  - bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device (Ioana Ciornei)
  - ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 (Tasos Sahanidis) [Orabug: 38180696] {CVE-2025-38336}
  - can: tcan4x5x: fix power regulator retrieval during probe (Brett Werling)
  - bus: mhi: host: Fix conflict between power_up and SYSERR (Jeffrey Hugo)
  - ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4 (Andreas Kemnade)
  - ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap() (Ross Stutterheim)
  - media: uvcvideo: Fix deferred probing error (Ricardo Ribalda)
  - media: uvcvideo: Send control events for partial succeeds (Ricardo Ribalda)
  - media: uvcvideo: Return the number of processed controls (Ricardo Ribalda)
  - media: vivid: Change the siize of the composing (Denis Arefev) [Orabug: 38158680] {CVE-2025-38226}
  - media: vidtv: Terminating the subsequent process of initialization failure (Edward Adam Davis) [Orabug: 38158685] {CVE-2025-38227}
  - media: videobuf2: use sgtable-based scatterlist wrappers (Marek Szyprowski)
  - media: venus: Fix probe error handling (Loic Poulain)
  - media: v4l2-dev: fix error handling in __video_register_device() (Ma Ke)
  - media: gspca: Add error handling for stv06xx_read_sensor() (Xu Wang)
  - media: cxusb: no longer judge rbuf when the write fails (Edward Adam Davis) [Orabug: 38158691] {CVE-2025-38229}
  - media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case (Sakari Ailus)
  - media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div (Sakari Ailus)
  - media: ccs-pll: Start OP pre-PLL multiplier search from correct value (Sakari Ailus)
  - media: ccs-pll: Start VT pre-PLL multiplier search from correct value (Sakari Ailus)
  - media: ov8856: suppress probe deferral errors (Johan Hovold)
  - wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723 (Mingcong Bai)
  - jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (Jeongjun Park) [Orabug: 38180706] {CVE-2025-38337}
  - nfsd: Initialize ssc before laundromat_work to prevent NULL dereference (Li Lingfeng) [Orabug: 38158706] {CVE-2025-38231}
  - nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request (Neil Brown) [Orabug: 38254061] {CVE-2025-38430}
  - wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() (Christian Lamparter) [Orabug: 38180782] {CVE-2025-38348}
  - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Xu Wang)
  - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Xu Wang)
  - powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states (Gautam Menghani)
  - ASoC: meson: meson-card-utils: use of_property_present() for DT parsing (Martin Blumenstingl)
  - ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params() (Xu Wang)
  - gfs2: move msleep to sleepable context (Alexander Aring)
  - crypto: marvell/cesa - Do not chain submitted requests (Herbert Xu)
  - configfs: Do not override creating attribute file failure in populate_attrs() (Zijun Hu)
  - xfs: allow inode inactivation during a ro mount log recovery (Darrick J. Wong)
  - kbuild: hdrcheck: fix cross build with clang (Arnd Bergmann)
  - kbuild: userprogs: fix bitsize and target detection on clang (Thomas Weißschuh)
  - drm/meson: Use 1000ULL when operating with mode->clock (I Hsin Cheng)
  - net: usb: aqc111: debug info before sanitation (Oliver Neukum)
  - calipso: unlock rcu before returning -EAFNOSUPPORT (Eric Dumazet)
  - x86/iopl: Cure TIF_IO_BITMAP inconsistencies (Thomas Gleixner) [Orabug: 38152863] {CVE-2025-38100}
  - xen/arm: call uaccess_ttbr0_enable for dm_op hypercall (Stefano Stabellini)
  - usb: typec: tcpm/tcpci_maxim: Fix bounds check in process_rx() (Amit Sunil Dhamne)
  - usb: Flush altsetting 0 endpoints before reinitializating them after reset. (Mathias Nyman)
  - usb: cdnsp: Fix issue with detecting USB 3.2 speed (Pawel Laszczak)
  - usb: cdnsp: Fix issue with detecting command completion event (Pawel Laszczak)
  - VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify (Ma Wupeng) [Orabug: 38152868] {CVE-2025-38102}
  - drm/amd/display: Do not add '-mhard-float' to dcn2{1,0}_resource.o for clang (Nathan Chancellor)
  - kbuild: Add KBUILD_CPPFLAGS to as-option invocation (Nathan Chancellor)
  - kbuild: add $(CLANG_FLAGS) to KBUILD_CPPFLAGS (Masahiro Yamada)
  - kbuild: Add CLANG_FLAGS to as-instr (Nathan Chancellor)
  - mips: Include KBUILD_CPPFLAGS in CHECKFLAGS invocation (Nathan Chancellor)
  - drm/amd/display: Do not add '-mhard-float' to dml_ccflags for clang (Nathan Chancellor)
  - kbuild: Update assembler calls to use proper flags and language target (Nick Desaulniers)
  - MIPS: Prefer cc-option for additions to cflags (Nathan Chancellor)
  - MIPS: Move '-Wa,-msoft-float' check from as-option to cc-option (Nathan Chancellor)
  - x86/boot/compressed: prefer cc-option for CFLAGS additions (Nick Desaulniers)
  - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [Orabug: 38223086] {CVE-2025-38352}
  - ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1 (David Heimann)
  - perf: Ensure bpf_perf_link path is properly serialized (Peter Zijlstra)
  - nvmet-fcloop: access fcpreq only when holding reqlock (Daniel Wagner)
  - fs/filesystems: Fix potential unsigned integer underflow in fs_name() (Zijun Hu)
  - net_sched: ets: fix a race in ets_qdisc_change() (Eric Dumazet) [Orabug: 38152893] {CVE-2025-38107}
  - sch_ets: make est_qlen_notify() idempotent (Cong Wang)
  - net_sched: tbf: fix a race in tbf_change() (Eric Dumazet)
  - net_sched: red: fix a race in __red_change() (Eric Dumazet) [Orabug: 38152898] {CVE-2025-38108}
  - net_sched: prio: fix a race in prio_tune() (Eric Dumazet) [Orabug: 38105333] {CVE-2025-38083}
  - net/mlx5: Fix return value when searching for existing flow group (Patrisious Haddad)
  - net/mlx5: Ensure fw pages are always allocated on same NUMA (Moshe Shemesh)
  - net/mdiobus: Fix potential out-of-bounds read/write access (Jakub Raczynski) [Orabug: 38152911] {CVE-2025-38111}
  - net: mdio: C22 is now optional, EOPNOTSUPP if not provided (Andrew Lunn)
  - macsec: MACsec SCI assignment for ES = 0 (Carlos Fernandez)
  - net: Fix TOCTOU issue in sk_is_readable() (Michal Luczaj) [Orabug: 38152915] {CVE-2025-38112}
  - i40e: retry VFLR handling if there is ongoing VF reset (Robert Malz)
  - i40e: return false from i40e_reset_vf if reset is in progress (Robert Malz)
  - drm/meson: fix more rounding issues with 59.94Hz modes (Martin Blumenstingl)
  - drm/meson: use vclk_freq instead of pixel_freq in debug print (Martin Blumenstingl)
  - drm/meson: fix debug log statement when setting the HDMI clocks (Martin Blumenstingl)
  - drm/meson: use unsigned long long / Hz for frequency types (Martin Blumenstingl)
  - powerpc/vas: Return -EINVAL if the offset is non-zero in mmap() (Haren Myneni)
  - powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap (Ritesh Harjani) [Orabug: 38137444] {CVE-2025-38088}
  - net_sched: sch_sfq: fix a potential crash on gso_skb handling (Eric Dumazet) [Orabug: 38152922] {CVE-2025-38115}
  - scsi: iscsi: Fix incorrect error path labels for flashnode operations (Alok Tiwari)
  - ath10k: snoc: fix unbalanced IRQ enable in crash recovery (Caleb Connolly)
  - ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use() (Jeongjun Park) [Orabug: 38180545] {CVE-2025-38305}
  - scsi: core: ufs: Fix a hang in the error handler (Sanjeev Yadav) [Orabug: 38152945] {CVE-2025-38119}
  - serial: sh-sci: Clean sci_ports[0] after at earlycon exit (Claudiu Beznea)
  - serial: sh-sci: Move runtime PM enable to sci_probe_single() (Claudiu Beznea)
  - serial: sh-sci: Check if TX data was written to device in .tx_empty() (Claudiu Beznea)
  - arm64: dts: ti: k3-am65-main: Add missing taps to sdhci0 (Judith Mendez)
  - arm64: dts: ti: k3-am65-main: Fix sdhci node properties (Judith Mendez)
  - arm64: dts: ti: k3-am65-main: Drop deprecated ti,otap-del-sel property (Nishanth Menon)
  - Input: synaptics-rmi - fix crash with unsupported versions of F34 (Dmitry Torokhov)
  - Input: synaptics-rmi4 - convert to use sysfs_emit() APIs (Zhang Songyi)
  - pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id() (Dan Carpenter)
  - do_change_type(): refuse to operate on unmounted/not ours mounts (Al Viro) [Orabug: 38256449] {CVE-2025-38498}
  - fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2) (Al Viro)
  - seg6: Fix validation of nexthop addresses (Ido Schimmel) [Orabug: 38180555] {CVE-2025-38310}
  - wireguard: device: enable threaded NAPI (Mirco Barone)
  - netfilter: nf_set_pipapo_avx2: fix initial map fill (Florian Westphal) [Orabug: 38152957] {CVE-2025-38120}
  - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Alok Tiwari) [Orabug: 38152965] {CVE-2025-38122}
  - vmxnet3: correctly report gso type for UDP tunnels (Ronak Doshi)
  - net: dsa: tag_brcm: legacy: fix pskb_may_pull length (Álvaro Fernández Rojas)
  - ice: create new Tx scheduler nodes for new queues only (Michal Kubiak)
  - Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION (Luiz Augusto von Dentz)
  - spi: bcm63xx-hsspi: fix shared reset (Álvaro Fernández Rojas)
  - spi: bcm63xx-spi: fix shared reset (Álvaro Fernández Rojas)
  - net/mlx4_en: Prevent potential integer overflow calculating Hz (Dan Carpenter)
  - driver: net: ethernet: mtk_star_emac: fix suspend/resume issue (Yanqing Wang)
  - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Alok Tiwari)
  - net: stmmac: platform: guarantee uniqueness of bus_id (Quentin Schulz)
  - vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl() (Nicolas Pitre)
  - MIPS: Loongson64: Add missing '#interrupt-cells' for loongson64c_ls7a (Yuli Wang)
  - iio: adc: ad7124: Fix 3dB filter frequency reading (Uwe Kleine-König)
  - serial: Fix potential null-ptr-deref in mlb_usio_probe() (Henry Martin) [Orabug: 38153011] {CVE-2025-38135}
  - usb: renesas_usbhs: Reorder clock handling and power management in probe (Lad Prabhakar) [Orabug: 38153016] {CVE-2025-38136}
  - PCI/DPC: Initialize aer_err_info before using it (Bjorn Helgaas)
  - dmaengine: ti: Add NULL check in udma_probe() (Henry Martin) [Orabug: 38153029] {CVE-2025-38138}
  - PCI: cadence: Fix runtime atomic count underflow (Hans Zhang)
  - rtc: sh: assign correct interrupts with DT (Wolfram Sang)
  - perf record: Fix incorrect --user-regs comments (Dapeng Mi)
  - perf tests switch-tracking: Fix timestamp comparison (Leo Yan)
  - mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE (Alexey Gladkov)
  - mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove() (Christophe Jaillet)
  - rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() (Dan Carpenter)
  - remoteproc: qcom_wcnss_iris: Add missing put_device() on error in probe (Dan Carpenter)
  - perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3 (Adrian Hunter)
  - backlight: pm8941: Add NULL check in wled_configure() (Henry Martin) [Orabug: 38153050] {CVE-2025-38143}
  - perf ui browser hists: Set actions->thread before calling do_zoom_thread() (Arnaldo Carvalho de Melo)
  - perf build: Warn when libdebuginfod devel files are not available (Arnaldo Carvalho de Melo)
  - fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (Sergey Shtylyov) [Orabug: 38180565] {CVE-2025-38312}
  - soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() (Henry Martin) [Orabug: 38153059] {CVE-2025-38145}
  - soc: aspeed: lpc: Fix impossible judgment condition (Su Hui)
  - arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou (Quentin Schulz)
  - ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device (Dmitry Baryshkov)
  - bus: fsl-mc: fix double-free on mc_dev (Ioana Ciornei) [Orabug: 38180572] {CVE-2025-38313}
  - nilfs2: do not propagate ENOENT error from nilfs_btree_propagate() (Ryusuke Konishi)
  - nilfs2: add pointer check for nilfs_direct_propagate() (Xu Wang)
  - ocfs2: fix possible memory leak in ocfs2_finish_quota_recovery (Murad Masimov)
  - Squashfs: check return result of sb_min_blocksize (Phillip Lougher) [Orabug: 38253984] {CVE-2025-38415}
  - arm64: dts: imx8mn-beacon: Fix RTC capacitive load (Adam Ford)
  - arm64: dts: imx8mm-beacon: Fix RTC capacitive load (Adam Ford)
  - ARM: dts: at91: at91sam9263: fix NAND chip selects (Wolfram Sang)
  - ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select (Wolfram Sang)
  - f2fs: fix to correct check conditions in f2fs_cross_rename (Zhiguo Niu)
  - f2fs: use d_inode(dentry) cleanup dentry->d_inode (Zhiguo Niu)
  - net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames (Horatiu Vultur)
  - net: openvswitch: Fix the dead loop of MPLS parse (Faicker Mo) [Orabug: 38153064] {CVE-2025-38146}
  - calipso: Don't call calipso functions for AF_INET sk. (Kuniyuki Iwashima) [Orabug: 38153069] {CVE-2025-38147}
  - net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy (Thangaraj Samynathan)
  - bpf: Avoid __bpf_prog_ret0_warn when jit fails (Kafai Wan) [Orabug: 38180470] {CVE-2025-38280}
  - net: usb: aqc111: fix error handling of usbnet read calls (Nikita Zhandarovich) [Orabug: 38153088] {CVE-2025-38153}
  - netfilter: nft_tunnel: fix geneve_opt dump (Fernando Fernandez Mancera)
  - bpf, sockmap: Avoid using sk_socket after free when sending (Jiayuan Chen) [Orabug: 38153094] {CVE-2025-38154}
  - vfio/type1: Fix error unwind in migration dirty bitmap allocation (Li Rongqing)
  - netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy (Florian Westphal)
  - wifi: ath9k_htc: Abort software beacon handling if disabled (Toke Høiland-Jørgensen) [Orabug: 38153109] {CVE-2025-38157}
  - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (Alexey Kodanev) [Orabug: 38153121] {CVE-2025-38159}
  - s390/bpf: Store backchain even for leaf progs (Ilya Leoshkevich)
  - clk: qcom: gcc-msm8939: Fix mclk0 & mclk1 for 24 MHz (Vincent Knecht)
  - bpf: Fix WARN() in get_bpf_raw_tp_regs (Tao Chen) [Orabug: 38180488] {CVE-2025-38285}
  - pinctrl: at91: Fix possible out-of-boundary access (Andy Shevchenko) [Orabug: 38180494] {CVE-2025-38286}
  - libbpf: Use proper errno value in nlattr (Anton Protopopov)
  - ktls, sockmap: Fix missing uncharge operation (Jiayuan Chen)
  - clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (Henry Martin) [Orabug: 38153131] {CVE-2025-38160}
  - clk: qcom: gcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
  - bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ (Anton Protopopov)
  - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Patrisious Haddad) [Orabug: 38153138] {CVE-2025-38161}
  - netfilter: nft_quota: match correctly when the quota just depleted (Zhongqiu Duan)
  - netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it (Huajian Yang)
  - libbpf: Use proper errno value in linker (Anton Protopopov)
  - f2fs: fix to detect gcing page in f2fs_is_cp_guaranteed() (Chao Yu)
  - f2fs: clean up w/ fscrypt_is_bounce_page() (Chao Yu)
  - iommu: Protect against overflow in iommu_pgsize() (Jason Gunthorpe)
  - RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h (Junxian Huang)
  - wifi: rtw88: do not ignore hardware read error during DPK (Dmitry Antipov)
  - libbpf: Fix buffer overflow in bpf_object__init_prog (Viktor Malik)
  - net: ncsi: Fix GCPS 64-bit member variables (Hari Kalavakunta)
  - f2fs: fix to do sanity check on sbi->total_valid_block_count (Chao Yu) [Orabug: 38153149] {CVE-2025-38163}
  - bpf, sockmap: fix duplicated data transmission (Jiayuan Chen)
  - IB/cm: use rwlock for MAD agent lock (Jacob Moroni)
  - wifi: ath11k: fix node corruption in ar->arvifs list (Stone Zhang) [Orabug: 38180515] {CVE-2025-38293}
  - firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES (Huang Yiwei)
  - drm/tegra: rgb: Fix the unbound reference count (Biju Das)
  - drm/vkms: Adjust vkms_state->active_planes allocation type (Kees Cook)
  - drm: rcar-du: Fix memory leak in rcar_du_vsps_init() (Biju Das)
  - selftests/seccomp: fix syscall_restart test for arm compat (Neill Kapron)
  - firmware: psci: Fix refcount leak in psci_dt_init (Miaoqian Lin)
  - m68k: mac: Fix macintosh_config for Mac II (Finn Thain)
  - fs/ntfs3: handle hdr_first_de() return value (Andrey Vatoropin) [Orabug: 38153172] {CVE-2025-38167}
  - media: rkvdec: Fix frame size enumeration (Jonas Karlman)
  - drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table (Charles Han) [Orabug: 38180589] {CVE-2025-38319}
  - spi: sh-msiof: Fix maximum DMA transfer size (Geert Uytterhoeven)
  - ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions" (Armin Wolf)
  - x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (Jiaqing Zhao)
  - PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks() (Zijun Hu)
  - power: reset: at91-reset: Optimize at91_reset() (Alexander Shiyan)
  - EDAC/skx_common: Fix general protection fault (Qiuxu Zhuo) [Orabug: 38180524] {CVE-2025-38298}
  - crypto: sun8i-ce - move fallback ahash_request to the end of the struct (Ovidiu Panait)
  - crypto: xts - Only add ecb if it is not already there (Herbert Xu)
  - crypto: lrw - Only add ecb if it is not already there (Herbert Xu)
  - crypto: marvell/cesa - Avoid empty transfer descriptor (Herbert Xu)
  - crypto: marvell/cesa - Handle zero-length skcipher requests (Herbert Xu) [Orabug: 38153188] {CVE-2025-38173}
  - x86/cpu: Sanitize CPUID(0x80000000) output (Ahmed S. Darwish)
  - crypto: sun8i-ss - do not use sg_dma_len before calling DMA functions (Corentin Labbe)
  - perf/core: Fix broken throttling when max_samples_per_tick=1 (Qing Wang)
  - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher)
  - thunderbolt: Do not double dequeue a configuration request (Sergey Senozhatsky) [Orabug: 38158383] {CVE-2025-38174}
  - usb: usbtmc: Fix timeout value in get_stb (Dave Penkler)
  - USB: serial: pl2303: add new chip PL2303GC-Q20 and PL2303GT-2AB (Charles Yeh)
  - usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device (Hongyu Xie)
  - usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE (Jiayi Li)
  - rtc: Fix offset calculation for .start_secs < 0 (Alexandre Mergnat)
  - rtc: Make rtc_time64_to_tm() support dates before 1970 (Alexandre Mergnat)
  - pinctrl: armada-37xx: set GPIO output value before setting direction (Gabor Juhos)
  - pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs > 31 (Gabor Juhos)


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-312.187.3.el9uek]
changelog:
  - TIOCSTI: Document CAP_SYS_ADMIN behaviour in Kconfig (Günther Noack) [Orabug: 38255504]
  - TIOCSTI: always enable for CAP_SYS_ADMIN (Samuel Thibault) [Orabug: 38255504]
  - tty: Fix typo in LEGACY_TIOCSTI Kconfig description (Hanno Böck) [Orabug: 38255504]
  - tty: Move TIOCSTI toggle variable before kerndoc (Kees Cook) [Orabug: 38255504]
  - tty: Allow TIOCSTI to be disabled (Kees Cook) [Orabug: 38255504]
  - tty: Move sysctl setup into "core" tty logic (Kees Cook) [Orabug: 38255504]
  - tty: reformat kernel-doc in tty_io.c (Jiri Slaby) [Orabug: 38255504]
  - tty: reformat kernel-doc in tty_ldisc.c (Jiri Slaby) [Orabug: 38255504]
  - net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38236297]
  - net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38236297]
  - net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38236297]
  - IB/mlx5: Support querying eswitch functions from DEVX (Bodong Wang) [Orabug: 38236297]
  - RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161800]
  - RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161800]
  - Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161800]
  - RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-312.187.4.el9uek]
changelog:
  - rds: Fix NULL ptr deref in xas_start (Håkon Bugge)  [Orabug: 38166374]
  - KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers)  [Orabug: 38319943]
  - hugetlb: arm64: add mte support (Dave Kleikamp)  [Orabug: 38177800]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-312.187.5.el9uek]
changelog:
  - Revert "mm: hugetlb: independent PMD page table shared count" (Harshit Mogalapalli)  [Orabug: 38327655]


author: Jack Vogel <jack.vogel@oracle.com> [5.15.0-312.187.5.1.el9uek]
changelog:
  - x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta)  [Orabug: 38343660]  
  - x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta)  [Orabug: 38343660]  
  - x86/vmscape: Enable the mitigation (Pawan Gupta)  [Orabug: 38343660]  
  - x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta)  [Orabug: 38343660]  
  - x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf)  [Orabug: 38343660]  
  - x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta)  [Orabug: 38343660]  
  - x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta)  [Orabug: 38343660]  
  - Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta)  [Orabug: 38343660]


author: Jack Vogel <jack.vogel@oracle.com> [5.15.0-312.187.5.1.el9uek]
changelog:
  - x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta)  [Orabug: 38343660]
  - x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta)  [Orabug: 38343660]
  - x86/vmscape: Enable the mitigation (Pawan Gupta)  [Orabug: 38343660]
  - x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta)  [Orabug: 38343660]
  - x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf)  [Orabug: 38343660]
  - x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta)  [Orabug: 38343660]
  - x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta)  [Orabug: 38343660]
  - Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta)  [Orabug: 38343660]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-312.187.5.2.el9uek]
changelog:
  - arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips)  [Orabug: 38435500]  
  - ARM: UEK: Disable arm64 erratum QCOM_FALKOR_ERRATUM_1003 (Boris Ostrovsky)  [Orabug: 38435500]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-312.187.5.2.el9uek]
changelog:
  - arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips)  [Orabug: 38435500]
  - ARM: UEK: Disable arm64 erratum QCOM_FALKOR_ERRATUM_1003 (Boris Ostrovsky)  [Orabug: 38435500]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-312.187.5.3.el9uek]
changelog:
  - HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires)  [Orabug: 38454666]  {CVE-2025-38494} 
  - vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic)  [Orabug: 38454665]  {CVE-2025-38618} 
  - clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro)  [Orabug: 38454664]  {CVE-2025-38499} 
  - HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires)  [Orabug: 38454662]  {CVE-2025-38495} 
  - nvme-tcp: sanitize request list handling (Hannes Reinecke)  [Orabug: 38454661]  {CVE-2025-38264} 
  - llist: add interface to check if a node is on a list. (NeilBrown)  [Orabug: 38454661]


author: Brian Maly <brian.maly@oracle.com> [5.15.0-311.185.5.el9uek]
changelog:
  - KVM: x86: Remove VT-d mention in posted interrupt tracepoint (Alejandro Jimenez) [Orabug: 38195091]
  - KVM: x86: Only set APICV_INHIBIT_REASON_ABSENT if APICv is enabled (Alejandro Jimenez) [Orabug: 38195091]
  - KVM: x86: Print names of apicv inhibit reasons in traces (Alejandro Jimenez) [Orabug: 38195091]
  - KVM: SVM: Always update local APIC on writes to logical dest register (Sean Christopherson) [Orabug: 38195091]
  - x86: Pin task-stack in __get_wchan() (Peter Zijlstra) [Orabug: 38161988]
  - x86: Fix __get_wchan() for !STACKTRACE (Peter Zijlstra) [Orabug: 38161988]
  - sched: Add wrapper for get_wchan() to keep task blocked (Kees Cook) [Orabug: 38161988]
  - x86: Fix get_wchan() to support the ORC unwinder (Qi Zheng) [Orabug: 38161988]
  - nvme: tcp: avoid race between queue_lock lock and destroy (Hannes Reinecke) [Orabug: 37331887] {CVE-2024-53100}
  - PCI/AER: Add sysfs attributes for log ratelimits (Jon Pan-Doh) [Orabug: 36952192]
  - PCI/AER: Ratelimit correctable and non-fatal error logging (Jon Pan-Doh) [Orabug: 36952192]
  - PCI/AER: Simplify add_error_device() (Bjorn Helgaas) [Orabug: 36952192]
  - PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index (Bjorn Helgaas) [Orabug: 36952192]
  - PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING (Karolina Stolarek) [Orabug: 36952192]
  - PCI/AER: Check log level once and remember it (Karolina Stolarek) [Orabug: 36952192]
  - PCI/AER: Trace error event before ratelimiting (Bjorn Helgaas) [Orabug: 36952192]
  - PCI/AER: Update statistics before ratelimiting (Bjorn Helgaas) [Orabug: 36952192]
  - PCI/AER: Simplify pci_print_aer() (Bjorn Helgaas) [Orabug: 36952192]
  - PCI/AER: Initialize aer_err_info before using it (Bjorn Helgaas) [Orabug: 36952192]
  - PCI/AER: Move aer_print_source() earlier in file (Bjorn Helgaas) [Orabug: 36952192]
  - PCI/AER: Rename aer_print_port_info() to aer_print_source() (Jon Pan-Doh) [Orabug: 36952192]
  - PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc (Bjorn Helgaas) [Orabug: 36952192]
  - PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() (Bjorn Helgaas) [Orabug: 36952192]
  - PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() (Bjorn Helgaas) [Orabug: 36952192]
  - PCI/AER: Descope pci_printk() to aer_printk() (Ilpo Järvinen) [Orabug: 36952192]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-312.187.2.el9uek]
changelog:
  - EDAC: Octeon: Fix compile error by replacing sdei_init() with acpi_sdei_init() (Vijayendra Suman) [Orabug: 38294908]
  - LTS version: v5.15.187 (Vijayendra Suman)
  - usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38309912] {CVE-2025-38404}
  - platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
  - Logitech C-270 even more broken (Oliver Neukum)
  - i2c/designware: Fix an initialization issue (Michael J. Ruhl)
  - usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
  - xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
  - xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
  - platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
  - platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
  - dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
  - net: dpaa2-eth: rearrange variable in dpaa2_eth_get_ethtool_stats (Ioana Ciornei)
  - dpaa2-eth: Update SINGLE_STEP register access (Radu Bulie)
  - dpaa2-eth: Update dpni_get_single_step_cfg command (Radu Bulie)
  - ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
  - NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
  - drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal) [Orabug: 38253820] {CVE-2025-38371}
  - regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253906] {CVE-2025-38395}
  - regulator: gpio: Add input_supply support in gpio_regulator_config (Jerome Neanne)
  - mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
  - rcu: Return early if callback is not specified (Uladzislau Rezki)
  - mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez) [Orabug: 38253863] {CVE-2025-38384}
  - ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253874] {CVE-2025-38386}
  - wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253945] {CVE-2025-38406}
  - wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
  - scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253914] {CVE-2025-38399}
  - powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
  - ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
  - ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
  - ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
  - drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253967] {CVE-2025-38410}
  - nui: Fix dma_mapping_error() check (Thomas Fourier)
  - rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253841] {CVE-2025-38377}
  - enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
  - amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
  - lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
  - igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
  - drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253886] {CVE-2025-38389}
  - platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253976] {CVE-2025-38412}
  - drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
  - spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
  - drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
  - btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
  - scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
  - scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
  - scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
  - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253900] {CVE-2025-38393}
  - nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253922] {CVE-2025-38400}
  - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253880] {CVE-2025-38387}
  - platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
  - mtk-sd: reset host->mrq on prepare_data() error (Sergey Senozhatsky)
  - mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253927] {CVE-2025-38401}
  - mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
  - usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253893] {CVE-2025-38391}
  - mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
  - vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253936] {CVE-2025-38403}
  - rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
  - ARM: 9354/1: ptrace: Use bitfield helpers (Geert Uytterhoeven)
  - btrfs: don't drop extent_map for free space inode on write error (Josef Bacik) [Orabug: 36530624] {CVE-2024-26726}
  - arm64: Restrict pagetable teardown to avoid false warning (Dev Jain)
  - s390: Add '-std=gnu11' to decompressor and purgatory CFLAGS (Nathan Chancellor)
  - s390/entry: Fix last breaking event handling in case of stack corruption (Heiko Carstens)
  - media: uvcvideo: Rollback non processed entities on error (Ricardo Ribalda)
  - PCI: hv: Do not set PCI_COMMAND_MEMORY to reduce VM boot time (Dexuan Cui)
  - drm/amd/display: Add null pointer check for get_first_active_display() (Xu Wang) [Orabug: 38253794] {CVE-2025-38362}
  - drm/bridge: cdns-dsi: Wait for Clk and Data Lanes to be ready (Aradhya Bhatia)
  - drm/bridge: cdns-dsi: Check return value when getting default PHY config (Aradhya Bhatia)
  - drm/bridge: cdns-dsi: Fix connecting to next bridge (Aradhya Bhatia)
  - drm/bridge: cdns-dsi: Fix the clock variable for mode_valid() (Aradhya Bhatia)
  - drm/amdkfd: Fix race in GWS queue scheduling (Jay Cornwall)
  - drm/udl: Unregister device before cleaning up on disconnect (Thomas Zimmermann)
  - drm/tegra: Fix a possible null pointer dereference (Qiu-Ji Chen) [Orabug: 38253800] {CVE-2025-38363}
  - drm/tegra: Assign plane type before registration (Thierry Reding)
  - HID: wacom: fix kobject reference count leak (Qasim Ijaz)
  - HID: wacom: fix memory leak on sysfs attribute creation failure (Qasim Ijaz)
  - HID: wacom: fix memory leak on kobject creation failure (Qasim Ijaz)
  - btrfs: update superblock's device bytes_used when dropping chunk (Mark Harmstone)
  - dm-raid: fix variable in journal device check (Heinz Mauelshagen)
  - Bluetooth: L2CAP: Fix L2CAP MTU negotiation (Frédéric Danis)
  - dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive (Yao Zi)
  - staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() (Nathan Chancellor)
  - net: selftests: fix TCP packet checksum (Jakub Kicinski)
  - atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). (Kuniyuki Iwashima) [Orabug: 38175043] {CVE-2025-38245}
  - net: enetc: Correct endianness handling in _enetc_rd_reg64 (Simon Horman)
  - um: ubd: Add missing error check in start_io_thread() (Tiwei Bie)
  - vsock/uapi: fix linux/vm_sockets.h userspace compilation errors (Stefano Garzarella)
  - af_unix: Don't set -ECONNRESET for consumed OOB skb. (Kuniyuki Iwashima)
  - wifi: mac80211: fix beacon interval calculation overflow (Lachlan Hodges)
  - libbpf: Fix null pointer dereference in btf_dump__free on allocation failure (Yuan Chen)
  - attach_recursive_mnt(): do not lock the covering tree when sliding something under it (Al Viro)
  - ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() (Youngjun Lee) [Orabug: 38175063] {CVE-2025-38249}
  - atm: clip: prevent NULL deref in clip_push() (Eric Dumazet) [Orabug: 38175077] {CVE-2025-38251}
  - s390/pkey: Prevent overflow in size calculation for memdup_user() (Fedor Pchelkin) [Orabug: 38175091] {CVE-2025-38257}
  - i2c: robotfuzz-osif: disable zero-length read messages (Wolfram Sang)
  - i2c: tiny-usb: disable zero-length read messages (Wolfram Sang)
  - platform/x86: ideapad-laptop: use usleep_range() for EC polling (Rongrong)
  - dummycon: Trigger redraw when switching consoles with deferred takeover (Thomas Zimmermann)
  - tty: vt: make consw::con_switch() return a bool (Jiri Slaby)
  - tty: vt: sanitize arguments of consw::con_clear() (Jiri Slaby)
  - tty: vt: make init parameter of consw::con_init() a bool (Jiri Slaby)
  - vgacon: remove unneeded forward declarations (Jiri Slaby)
  - vgacon: switch vgacon_scrolldelta() and vgacon_restore_screen() (Jiri Slaby)
  - tty/vt: consolemap: rename and document struct uni_pagedir (Jiri Slaby)
  - fbcon: delete a few unneeded forward decl (Daniel Vetter)
  - uio_hv_generic: Align ring size to system page (Long Li)
  - uio_hv_generic: Query the ringbuffer size for device (Saurabh Singh Sengar)
  - Drivers: hv: vmbus: Add utility function for querying ring size (Saurabh Singh Sengar)
  - Drivers: hv: Rename 'alloced' to 'allocated' (Vitaly Kuznetsov)
  - f2fs: don't over-report free space or inodes in statvfs (Chao Yu)
  - media: imx-jpeg: Drop the first error frames (Ming Qian)
  - clk: ti: am43xx: Add clkctrl data for am43xx ADC1 (Miquel Raynal)
  - media: omap3isp: use sgtable-based scatterlist wrappers (Marek Szyprowski)
  - media: davinci: vpif: Fix memory leak in probe error path (Dmitry Nikiforov)
  - jfs: validate AG parameters in dbMount() to prevent crashes (Vasiliy Kovalev) [Orabug: 38158700] {CVE-2025-38230}
  - fs/jfs: consolidate sanity checking in dbMount (Dave Kleikamp)
  - ovl: Check for NULL d_inode() in ovl_dentry_upper() (Kees Cook)
  - ceph: fix possible integer overflow in ceph_zero_objects() (Dmitry Kandybka)
  - ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock (Mario Limonciello)
  - ALSA: hda: Add new pci id for AMD GPU display HD audio controller (Vijendar Mukunda)
  - ALSA: hda: Ignore unsol events for cards being shut down (Cezary Rojewski)
  - usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode (Jos Wang)
  - usb: cdc-wdm: avoid setting WDM_READ for ZLP-s (Robert Hodaszi)
  - usb: Add checks for snprintf() calls in usb_alloc_dev() (Andy Shevchenko)
  - usb: common: usb-conn-gpio: use a unique name for usb connector device (Chance Yang)
  - tty: serial: uartlite: register uart driver in init (Jakub Lewalski) [Orabug: 38175113] {CVE-2025-38262}
  - usb: potential integer overflow in usbg_make_tpg() (Chen Yufeng)
  - usb: dwc2: also exit clock_gating when stopping udc while suspended (Michael Grzeschik)
  - coresight: Only check bottom two claim bits (James Clark)
  - um: Add cmpxchg8b_emu and checksum functions to asm-prototypes.h (Sami Tolvanen)
  - iio: pressure: zpa2326: Use aligned_s64 for the timestamp (Jonathan Cameron)
  - bcache: fix NULL pointer in cache_set_flush() (Linggang Zeng) [Orabug: 38175119] {CVE-2025-38263}
  - md/md-bitmap: fix dm-raid max_write_behind setting (Yu Kuai)
  - dmaengine: xilinx_dma: Set dma_device directions (Thomas Gessler)
  - ksmbd: allow a filename to contain special characters on SMB3.1.1 posix extension (Namjae Jeon)
  - hwmon: (pmbus/max34440) Fix support for max34451 (Alexis Czezar Torreno)
  - leds: multicolor: Fix intensity setting while SW blinking (Sven Schwermer)
  - mfd: max14577: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
  - mailbox: Not protect module_put with spin_lock_irqsave (Peng Fan)
  - NFSv4.2: fix listxattr to return selinux security label (Olga Kornievskaia)
  - NFSv4: Always set NLINK even if the server doesn't support it (Han Young)
  - cifs: Fix cifs_query_path_info() for Windows NT servers (Pali Rohár)
  - LTS version: v5.15.186 (Vijayendra Suman)
  - scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops (Kees Cook)
  - scsi: elx: efct: Fix memory leak in efct_hw_parse_filter() (Vitaliy Shevtsov)
  - arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (Tengda Wu) [Orabug: 38180595] {CVE-2025-38320}
  - perf: Fix sample vs do_exit() (Peter Zijlstra) [Orabug: 38254029] {CVE-2025-38424}
  - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Heiko Carstens)
  - bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE (Paul Chaignon)
  - net: Fix checksum update for ILA adj-transport (Paul Chaignon)
  - ext4: avoid remount errors with 'abort' mount option (Jan Kara)
  - ext4: make 'abort' mount option handling standard (Jan Kara)
  - mm/huge_memory: fix dereferencing invalid pmd migration entry (Gavin Guo) [Orabug: 37976983] {CVE-2025-37958}
  - net_sched: sch_sfq: reject invalid perturb period (Eric Dumazet) [Orabug: 38158476] {CVE-2025-38193}
  - arm64: proton-pack: Add new CPUs 'k' values for branch mitigation (James Morse)
  - arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (James Morse) [Orabug: 37977005] {CVE-2025-37963}
  - arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs (James Morse) [Orabug: 37976929] {CVE-2025-37948}
  - arm64: spectre: increase parameters that can be used to turn off bhb mitigation individually (Liu Song)
  - arm64: proton-pack: Expose whether the branchy loop k value (James Morse)
  - arm64: proton-pack: Expose whether the platform is mitigated by firmware (James Morse)
  - arm64: insn: Add support for encoding DSB (James Morse)
  - arm64: insn: add encoders for atomic operations (Hou Tao)
  - arm64: move AARCH64_BREAK_FAULT into insn-def.h (Hou Tao)
  - serial: sh-sci: Increment the runtime usage counter for the earlycon device (Claudiu Beznea)
  - ARM: dts: am335x-bone-common: Increase MDIO reset deassert delay to 50ms (Geert Uytterhoeven)
  - ARM: dts: am335x-bone-common: Increase MDIO reset deassert time (Colin Foster)
  - ARM: dts: am335x-bone-common: Add GPIO PHY reset on revision C3 board (Shengyu Qu)
  - net: atm: fix /proc/net/atm/lec handling (Eric Dumazet) [Orabug: 38158405] {CVE-2025-38180}
  - net: atm: add lec_mutex (Eric Dumazet) [Orabug: 38180611] {CVE-2025-38323}
  - calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). (Kuniyuki Iwashima) [Orabug: 38158412] {CVE-2025-38181}
  - tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (Haixia Qu) [Orabug: 38158424] {CVE-2025-38184}
  - tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior (Neal Cardwell)
  - atm: atmtcp: Free invalid length skb in atmtcp_c_send(). (Kuniyuki Iwashima) [Orabug: 38158433] {CVE-2025-38185}
  - mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (Kuniyuki Iwashima) [Orabug: 38180617] {CVE-2025-38324}
  - wifi: carl9170: do not ping device which has failed to load firmware (Dmitry Antipov) [Orabug: 38254010] {CVE-2025-38420}
  - ptp: fix breakage after ptp_vclock_in_use() rework (Vladimir Oltean)
  - net: ice: Perform accurate aRFS flow match (Krishna Kumar)
  - aoe: clean device rq_list in aoedev_downdev() (Justin Sanders) [Orabug: 38180627] {CVE-2025-38326}
  - pldmfw: Select CRC32 when PLDMFW is selected (Simon Horman)
  - hwmon: (occ) fix unaligned accesses (Arnd Bergmann)
  - hwmon: (occ) Rework attribute registration for stack usage (Arnd Bergmann)
  - hwmon: (occ) Add soft minimum power cap attribute (Eddie James)
  - drm/nouveau/bl: increase buffer size to avoid truncate warning (Jacob Keller)
  - drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
  - erofs: remove unused trace event erofs_destroy_inode (Gao Xiang)
  - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Jann Horn) [Orabug: 38132180] {CVE-2025-38085}
  - mm: hugetlb: independent PMD page table shared count (Liu Shixin) [Orabug: 37484959] {CVE-2024-57883}
  - mm/hugetlb: unshare page tables during VMA split, not before (Jann Horn) [Orabug: 38132171] {CVE-2025-38084}
  - iio: accel: fxls8962af: Fix temperature calculation (Sean Nyekjaer)
  - ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged (Jonathan Lane)
  - ALSA: hda/intel: Add Thinkpad E15 to PM deny list (Takashi Iwai)
  - ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card (Wangdicheng)
  - Input: sparcspkr - avoid unannotated fall-through (Yuli Wang)
  - block: default BLOCK_LEGACY_AUTOLOAD to y (Christoph Hellwig)
  - HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (Terry Junge) [Orabug: 38152876] {CVE-2025-38103}
  - atm: Revert atm_account_tx() if copy_from_iter_full() fails. (Kuniyuki Iwashima) [Orabug: 38158457] {CVE-2025-38190}
  - selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len (Stephen Smalley)
  - selftests/x86: Add a test to detect infinite SIGTRAP handler loop (Xin Li)
  - udmabuf: use sgtable-based scatterlist wrappers (Marek Szyprowski)
  - scsi: s390: zfcp: Ensure synchronous unit_add (Peter Oberparleiter)
  - scsi: storvsc: Increase the timeouts to storvsc_timeout (Dexuan Cui)
  - jffs2: check jffs2_prealloc_raw_node_refs() result in few other places (Fedor Pchelkin) [Orabug: 38180635] {CVE-2025-38328}
  - jffs2: check that raw node were preallocated before writing summary (Artem Sadovnikov) [Orabug: 38158483] {CVE-2025-38194}
  - drivers/rapidio/rio_cm.c: prevent possible heap overwrite (Andrew Morton) [Orabug: 38137453] {CVE-2025-38090}
  - powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery (Narayana Murty N)
  - platform/x86: dell_rbu: Stop overwriting data buffer (Stuart Hayes)
  - platform/x86: dell_rbu: Fix list usage (Stuart Hayes) [Orabug: 38158494] {CVE-2025-38197}
  - Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first" (Alexander Sverdlin)
  - tee: Prevent size calculation wraparound on 32-bit kernels (Jann Horn)
  - ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY (Sukrut Bellary)
  - bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value (Laurentiu Tudor)
  - watchdog: da9052_wdt: respect TWDMIN (Marcus Folkesson)
  - octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer() (Xu Wang)
  - bpf, sockmap: Fix data lost during EAGAIN retries (Jiayuan Chen)
  - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Kyungwook Boo) [Orabug: 38158517] {CVE-2025-38200}
  - sock: Correct error checking condition for (assign|release)_proto_idx() (Zijun Hu)
  - scsi: lpfc: Use memcpy() for BIOS version (Daniel Wagner) [Orabug: 38180667] {CVE-2025-38332}
  - pinctrl: mcp23s08: Reset all pins to input at probe (Mike Looijmans)
  - software node: Correct a OOB check in software_node_get_reference_args() (Zijun Hu) [Orabug: 38180730] {CVE-2025-38342}
  - vxlan: Do not treat dst cache initialization errors as fatal (Ido Schimmel)
  - net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions (Yong Wang)
  - iommu/amd: Ensure GA log notifier callbacks finish running before module unload (Sean Christopherson)
  - scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Justin Tee)
  - libbpf: Add identical pointer detection to btf_dedup_is_equiv() (Alan Maguire)
  - clk: rockchip: rk3036: mark ddrphy as critical (Heiko Stuebner)
  - wifi: mac80211: do not offer a mesh path if forwarding is disabled (Benjamin Berg)
  - net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info (Jason Xing)
  - pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() (Gabor Juhos)
  - pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction() (Gabor Juhos)
  - pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction() (Gabor Juhos)
  - pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name() (Gabor Juhos)
  - net: atlantic: generate software timestamp just before the doorbell (Jason Xing)
  - ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT (Sebastian Andrzej Siewior)
  - tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows (Eric Dumazet)
  - tcp: always seek for minimal rtt in tcp_rcv_rtt_update() (Eric Dumazet)
  - net: dlink: add synchronization for stats update (Moon Yeounsu)
  - i2c: npcm: Add clock toggle recovery (Tali Perry)
  - cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs (Mike Tipton)
  - sctp: Do not wake readers in __sctp_write_space() (Petr Malat)
  - wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R (Henk Vergonet)
  - emulex/benet: correct command version selection in be_cmd_get_stats() (Alok Tiwari)
  - i2c: designware: Invoke runtime suspend on quick slave re-registration (Tan En De)
  - tipc: use kfree_sensitive() for aead cleanup (Zilin Guan)
  - net: macb: Check return value of dma_set_mask_and_coherent() (Sergio Perez Gonzalez)
  - cpufreq: Force sync policy boost with global boost on sysfs update (Viresh Kumar)
  - thermal/drivers/qcom/tsens: Update conditions to strictly evaluate for IP v2+ (George Moussalem)
  - pmdomain: ti: Fix STANDBY handling of PER power domain (Sukrut Bellary)
  - nios2: force update_mmu_cache on spurious tlb-permission--related pagefaults (Simon Schuster)
  - media: i2c: imx334: update mode_3840x2160_regs array (Shravan Chippa)
  - media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() (Xu Wang) [Orabug: 38175013] {CVE-2025-38237}
  - media: tc358743: ignore video while HPD is low (Hans Verkuil)
  - drm/amdkfd: Set SDMA_RLCx_IB_CNTL/SWITCH_INSIDE_IB (Amber Lin)
  - drm/msm/dpu: don't select single flush for active CTL blocks (Dmitry Baryshkov)
  - jfs: Fix null-ptr-deref in jfs_ioc_trim (Dylan Wolff) [Orabug: 38158545] {CVE-2025-38203}
  - drm/amdgpu/gfx9: fix CSIB handling (Alex Deucher)
  - drm/amdgpu/gfx8: fix CSIB handling (Alex Deucher)
  - ext4: prevent stale extent cache entries caused by concurrent get es_cache (Zhang Yi)
  - sunrpc: fix race in cache cleanup causing stale nextcheck time (Long Li)
  - media: rkvdec: Initialize the m2m context before the controls (Nicolas Dufresne)
  - media: ti: cal: Fix wrong goto on error path (Tomi Valkeinen)
  - jfs: fix array-index-out-of-bounds read in add_missing_indices (Aditya Dutt) [Orabug: 38158552] {CVE-2025-38204}
  - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Zhang Yi)
  - drm/amdgpu/gfx7: fix CSIB handling (Alex Deucher)
  - media: uapi: v4l: Change V4L2_TYPE_IS_CAPTURE condition (Nas Chung)
  - media: ccs-pll: Better validate VT PLL branch (Sakari Ailus)
  - drm/amdgpu/gfx10: fix CSIB handling (Alex Deucher)
  - media: i2c: imx334: Fix runtime PM handling in remove function (Tarang Raval)
  - drm/msm/a6xx: Increase HFI response timeout (Akhil P Oommen)
  - drm/amd/display: Add NULL pointer checks in dm_force_atomic_commit() (Srinivasan Shanmugam)
  - media: uapi: v4l: Fix V4L2_TYPE_IS_OUTPUT condition (Nas Chung)
  - drm/msm/hdmi: add runtime PM calls to DDC transfer function (Dmitry Baryshkov)
  - media: i2c: imx334: Enable runtime PM before sub-device registration (Tarang Raval)
  - drm/bridge: anx7625: change the gpiod_set_value API (Ayushi Makhija)
  - exfat: fix double free in delayed_free (Namjae Jeon) [Orabug: 38158566] {CVE-2025-38206}
  - drm/bridge: analogix_dp: Add irq flag IRQF_NO_AUTOEN instead of calling disable_irq() (Damon Ding)
  - sunrpc: update nextcheck time when adding new cache entries (Long Li)
  - drm/amdgpu/gfx6: fix CSIB handling (Alex Deucher)
  - ACPI: battery: negate current when discharging (Peter Marheine)
  - PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() (Charan Teja Kalla)
  - ASoC: tegra210_ahub: Add check to of_device_get_match_data() (Yuanjun Gong)
  - ACPICA: utilities: Fix overflow check in vsnprintf() (Philip Redkin)
  - power: supply: bq27xxx: Retrieve again when busy (Jerry Lv)
  - ACPICA: fix acpi parse and parseext cache leaks (Seunghun Han) [Orabug: 38180747] {CVE-2025-38344}
  - ACPI: bus: Bail out if acpi_kobj registration fails (Armin Wolf)
  - ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change (Hector Martin)
  - ACPICA: Avoid sequence overread in call to strncmp() (Ahmed Salem)
  - clocksource: Fix the CPUs' choice in the watchdog per CPU verification (Guilherme G. Piccoli)
  - ACPICA: fix acpi operand cache leak in dswstate.c (Seunghun Han) [Orabug: 38180755] {CVE-2025-38345}
  - iio: adc: ad7606_spi: fix reg write value mask (David Lechner)
  - iio: imu: inv_icm42600: Fix temperature calculation (Sean Nyekjaer)
  - iio: accel: fxls8962af: Fix temperature scan element sign (Sean Nyekjaer)
  - PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit() (Diederik de Haas)
  - PCI: Fix lock symmetry in pci_slot_unlock() (Ilpo Järvinen)
  - PCI: Add ACS quirk for Loongson PCIe (Huacai Chen)
  - PCI: cadence-ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
  - uio_hv_generic: Use correct size for interrupt and monitor pages (Long Li)
  - remoteproc: core: Release rproc->clean_table after rproc_attach() fails (Xiaolei Wang) [Orabug: 38254002] {CVE-2025-38418}
  - remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (Xiaolei Wang) [Orabug: 38254006] {CVE-2025-38419}
  - regulator: max14577: Add error check for max14577_read_reg() (Xu Wang)
  - mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS (Khem Raj)
  - staging: iio: ad5933: Correct settling cycles encoding per datasheet (Gabriel)
  - net: ch9200: fix uninitialised access during mii_nway_restart (Qasim Ijaz) [Orabug: 38132188] {CVE-2025-38086}
  - ftrace: Fix UAF when lookup kallsym after ftrace disabled (Ye Bin) [Orabug: 38180767] {CVE-2025-38346}
  - dm-mirror: fix a tiny race condition (Mikulas Patocka)
  - mtd: nand: sunxi: Add randomizer configuration before randomizer enable (Xu Wang)
  - mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk (Xu Wang)
  - mm: fix ratelimit_pages update error in dirty_ratio_handler() (Jinliang Zheng)
  - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Shin'Ichiro Kawasaki) [Orabug: 38158591] {CVE-2025-38211}
  - ipc: fix to protect IPCS lookups using RCU (Jeongjun Park) [Orabug: 38158597] {CVE-2025-38212}
  - clk: meson-g12a: add missing fclk_div2 to spicc (Da Xue)
  - parisc: fix building with gcc-15 (Arnd Bergmann)
  - vgacon: Add check for vc_origin address range in vgacon_scroll() (Gong, Ruiqi)
  - fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [Orabug: 38158614] {CVE-2025-38214}
  - EDAC/altera: Use correct write width with the INTTEST register (Niravkumar L Rabara)
  - NFC: nci: uart: Set tty->disc_data only in success path (Krzysztof Kozlowski) [Orabug: 38253991] {CVE-2025-38416}
  - f2fs: fix to do sanity check on sit_bitmap_size (Chao Yu) [Orabug: 38158639] {CVE-2025-38218}
  - f2fs: prevent kernel warning due to negative i_nlink from corrupted image (Jaegeuk Kim) [Orabug: 38158647] {CVE-2025-38219}
  - Input: ims-pcu - check record size in ims_pcu_flash_firmware() (Dan Carpenter) [Orabug: 38254053] {CVE-2025-38428}
  - ext4: ensure i_size is smaller than maxbytes (Zhang Yi)
  - ext4: factor out ext4_get_maxbytes() (Zhang Yi)
  - ext4: fix calculation of credits for extent tree modification (Jan Kara)
  - ext4: inline: fix len overflow in ext4_prepare_inline_data (Thadeu Lima de Souza Cascardo) [Orabug: 38158661] {CVE-2025-38222}
  - bus: fsl-mc: fix GET/SET_TAILDROP command ids (Wan Junjie)
  - bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device (Ioana Ciornei)
  - ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 (Tasos Sahanidis) [Orabug: 38180696] {CVE-2025-38336}
  - can: tcan4x5x: fix power regulator retrieval during probe (Brett Werling)
  - bus: mhi: host: Fix conflict between power_up and SYSERR (Jeffrey Hugo)
  - ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4 (Andreas Kemnade)
  - ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap() (Ross Stutterheim)
  - media: uvcvideo: Fix deferred probing error (Ricardo Ribalda)
  - media: uvcvideo: Send control events for partial succeeds (Ricardo Ribalda)
  - media: uvcvideo: Return the number of processed controls (Ricardo Ribalda)
  - media: vivid: Change the siize of the composing (Denis Arefev) [Orabug: 38158680] {CVE-2025-38226}
  - media: vidtv: Terminating the subsequent process of initialization failure (Edward Adam Davis) [Orabug: 38158685] {CVE-2025-38227}
  - media: videobuf2: use sgtable-based scatterlist wrappers (Marek Szyprowski)
  - media: venus: Fix probe error handling (Loic Poulain)
  - media: v4l2-dev: fix error handling in __video_register_device() (Ma Ke)
  - media: gspca: Add error handling for stv06xx_read_sensor() (Xu Wang)
  - media: cxusb: no longer judge rbuf when the write fails (Edward Adam Davis) [Orabug: 38158691] {CVE-2025-38229}
  - media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case (Sakari Ailus)
  - media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div (Sakari Ailus)
  - media: ccs-pll: Start OP pre-PLL multiplier search from correct value (Sakari Ailus)
  - media: ccs-pll: Start VT pre-PLL multiplier search from correct value (Sakari Ailus)
  - media: ov8856: suppress probe deferral errors (Johan Hovold)
  - wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723 (Mingcong Bai)
  - jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (Jeongjun Park) [Orabug: 38180706] {CVE-2025-38337}
  - nfsd: Initialize ssc before laundromat_work to prevent NULL dereference (Li Lingfeng) [Orabug: 38158706] {CVE-2025-38231}
  - nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request (Neil Brown) [Orabug: 38254061] {CVE-2025-38430}
  - wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() (Christian Lamparter) [Orabug: 38180782] {CVE-2025-38348}
  - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Xu Wang)
  - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Xu Wang)
  - powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states (Gautam Menghani)
  - ASoC: meson: meson-card-utils: use of_property_present() for DT parsing (Martin Blumenstingl)
  - ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params() (Xu Wang)
  - gfs2: move msleep to sleepable context (Alexander Aring)
  - crypto: marvell/cesa - Do not chain submitted requests (Herbert Xu)
  - configfs: Do not override creating attribute file failure in populate_attrs() (Zijun Hu)
  - xfs: allow inode inactivation during a ro mount log recovery (Darrick J. Wong)
  - kbuild: hdrcheck: fix cross build with clang (Arnd Bergmann)
  - kbuild: userprogs: fix bitsize and target detection on clang (Thomas Weißschuh)
  - drm/meson: Use 1000ULL when operating with mode->clock (I Hsin Cheng)
  - net: usb: aqc111: debug info before sanitation (Oliver Neukum)
  - calipso: unlock rcu before returning -EAFNOSUPPORT (Eric Dumazet)
  - x86/iopl: Cure TIF_IO_BITMAP inconsistencies (Thomas Gleixner) [Orabug: 38152863] {CVE-2025-38100}
  - xen/arm: call uaccess_ttbr0_enable for dm_op hypercall (Stefano Stabellini)
  - usb: typec: tcpm/tcpci_maxim: Fix bounds check in process_rx() (Amit Sunil Dhamne)
  - usb: Flush altsetting 0 endpoints before reinitializating them after reset. (Mathias Nyman)
  - usb: cdnsp: Fix issue with detecting USB 3.2 speed (Pawel Laszczak)
  - usb: cdnsp: Fix issue with detecting command completion event (Pawel Laszczak)
  - VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify (Ma Wupeng) [Orabug: 38152868] {CVE-2025-38102}
  - drm/amd/display: Do not add '-mhard-float' to dcn2{1,0}_resource.o for clang (Nathan Chancellor)
  - kbuild: Add KBUILD_CPPFLAGS to as-option invocation (Nathan Chancellor)
  - kbuild: add $(CLANG_FLAGS) to KBUILD_CPPFLAGS (Masahiro Yamada)
  - kbuild: Add CLANG_FLAGS to as-instr (Nathan Chancellor)
  - mips: Include KBUILD_CPPFLAGS in CHECKFLAGS invocation (Nathan Chancellor)
  - drm/amd/display: Do not add '-mhard-float' to dml_ccflags for clang (Nathan Chancellor)
  - kbuild: Update assembler calls to use proper flags and language target (Nick Desaulniers)
  - MIPS: Prefer cc-option for additions to cflags (Nathan Chancellor)
  - MIPS: Move '-Wa,-msoft-float' check from as-option to cc-option (Nathan Chancellor)
  - x86/boot/compressed: prefer cc-option for CFLAGS additions (Nick Desaulniers)
  - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [Orabug: 38223086] {CVE-2025-38352}
  - ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1 (David Heimann)
  - perf: Ensure bpf_perf_link path is properly serialized (Peter Zijlstra)
  - nvmet-fcloop: access fcpreq only when holding reqlock (Daniel Wagner)
  - fs/filesystems: Fix potential unsigned integer underflow in fs_name() (Zijun Hu)
  - net_sched: ets: fix a race in ets_qdisc_change() (Eric Dumazet) [Orabug: 38152893] {CVE-2025-38107}
  - sch_ets: make est_qlen_notify() idempotent (Cong Wang)
  - net_sched: tbf: fix a race in tbf_change() (Eric Dumazet)
  - net_sched: red: fix a race in __red_change() (Eric Dumazet) [Orabug: 38152898] {CVE-2025-38108}
  - net_sched: prio: fix a race in prio_tune() (Eric Dumazet) [Orabug: 38105333] {CVE-2025-38083}
  - net/mlx5: Fix return value when searching for existing flow group (Patrisious Haddad)
  - net/mlx5: Ensure fw pages are always allocated on same NUMA (Moshe Shemesh)
  - net/mdiobus: Fix potential out-of-bounds read/write access (Jakub Raczynski) [Orabug: 38152911] {CVE-2025-38111}
  - net: mdio: C22 is now optional, EOPNOTSUPP if not provided (Andrew Lunn)
  - macsec: MACsec SCI assignment for ES = 0 (Carlos Fernandez)
  - net: Fix TOCTOU issue in sk_is_readable() (Michal Luczaj) [Orabug: 38152915] {CVE-2025-38112}
  - i40e: retry VFLR handling if there is ongoing VF reset (Robert Malz)
  - i40e: return false from i40e_reset_vf if reset is in progress (Robert Malz)
  - drm/meson: fix more rounding issues with 59.94Hz modes (Martin Blumenstingl)
  - drm/meson: use vclk_freq instead of pixel_freq in debug print (Martin Blumenstingl)
  - drm/meson: fix debug log statement when setting the HDMI clocks (Martin Blumenstingl)
  - drm/meson: use unsigned long long / Hz for frequency types (Martin Blumenstingl)
  - powerpc/vas: Return -EINVAL if the offset is non-zero in mmap() (Haren Myneni)
  - powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap (Ritesh Harjani) [Orabug: 38137444] {CVE-2025-38088}
  - net_sched: sch_sfq: fix a potential crash on gso_skb handling (Eric Dumazet) [Orabug: 38152922] {CVE-2025-38115}
  - scsi: iscsi: Fix incorrect error path labels for flashnode operations (Alok Tiwari)
  - ath10k: snoc: fix unbalanced IRQ enable in crash recovery (Caleb Connolly)
  - ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use() (Jeongjun Park) [Orabug: 38180545] {CVE-2025-38305}
  - scsi: core: ufs: Fix a hang in the error handler (Sanjeev Yadav) [Orabug: 38152945] {CVE-2025-38119}
  - serial: sh-sci: Clean sci_ports[0] after at earlycon exit (Claudiu Beznea)
  - serial: sh-sci: Move runtime PM enable to sci_probe_single() (Claudiu Beznea)
  - serial: sh-sci: Check if TX data was written to device in .tx_empty() (Claudiu Beznea)
  - arm64: dts: ti: k3-am65-main: Add missing taps to sdhci0 (Judith Mendez)
  - arm64: dts: ti: k3-am65-main: Fix sdhci node properties (Judith Mendez)
  - arm64: dts: ti: k3-am65-main: Drop deprecated ti,otap-del-sel property (Nishanth Menon)
  - Input: synaptics-rmi - fix crash with unsupported versions of F34 (Dmitry Torokhov)
  - Input: synaptics-rmi4 - convert to use sysfs_emit() APIs (Zhang Songyi)
  - pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id() (Dan Carpenter)
  - do_change_type(): refuse to operate on unmounted/not ours mounts (Al Viro) [Orabug: 38256449] {CVE-2025-38498}
  - fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2) (Al Viro)
  - seg6: Fix validation of nexthop addresses (Ido Schimmel) [Orabug: 38180555] {CVE-2025-38310}
  - wireguard: device: enable threaded NAPI (Mirco Barone)
  - netfilter: nf_set_pipapo_avx2: fix initial map fill (Florian Westphal) [Orabug: 38152957] {CVE-2025-38120}
  - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Alok Tiwari) [Orabug: 38152965] {CVE-2025-38122}
  - vmxnet3: correctly report gso type for UDP tunnels (Ronak Doshi)
  - net: dsa: tag_brcm: legacy: fix pskb_may_pull length (Álvaro Fernández Rojas)
  - ice: create new Tx scheduler nodes for new queues only (Michal Kubiak)
  - Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION (Luiz Augusto von Dentz)
  - spi: bcm63xx-hsspi: fix shared reset (Álvaro Fernández Rojas)
  - spi: bcm63xx-spi: fix shared reset (Álvaro Fernández Rojas)
  - net/mlx4_en: Prevent potential integer overflow calculating Hz (Dan Carpenter)
  - driver: net: ethernet: mtk_star_emac: fix suspend/resume issue (Yanqing Wang)
  - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Alok Tiwari)
  - net: stmmac: platform: guarantee uniqueness of bus_id (Quentin Schulz)
  - vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl() (Nicolas Pitre)
  - MIPS: Loongson64: Add missing '#interrupt-cells' for loongson64c_ls7a (Yuli Wang)
  - iio: adc: ad7124: Fix 3dB filter frequency reading (Uwe Kleine-König)
  - serial: Fix potential null-ptr-deref in mlb_usio_probe() (Henry Martin) [Orabug: 38153011] {CVE-2025-38135}
  - usb: renesas_usbhs: Reorder clock handling and power management in probe (Lad Prabhakar) [Orabug: 38153016] {CVE-2025-38136}
  - PCI/DPC: Initialize aer_err_info before using it (Bjorn Helgaas)
  - dmaengine: ti: Add NULL check in udma_probe() (Henry Martin) [Orabug: 38153029] {CVE-2025-38138}
  - PCI: cadence: Fix runtime atomic count underflow (Hans Zhang)
  - rtc: sh: assign correct interrupts with DT (Wolfram Sang)
  - perf record: Fix incorrect --user-regs comments (Dapeng Mi)
  - perf tests switch-tracking: Fix timestamp comparison (Leo Yan)
  - mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE (Alexey Gladkov)
  - mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove() (Christophe Jaillet)
  - rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() (Dan Carpenter)
  - remoteproc: qcom_wcnss_iris: Add missing put_device() on error in probe (Dan Carpenter)
  - perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3 (Adrian Hunter)
  - backlight: pm8941: Add NULL check in wled_configure() (Henry Martin) [Orabug: 38153050] {CVE-2025-38143}
  - perf ui browser hists: Set actions->thread before calling do_zoom_thread() (Arnaldo Carvalho de Melo)
  - perf build: Warn when libdebuginfod devel files are not available (Arnaldo Carvalho de Melo)
  - fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (Sergey Shtylyov) [Orabug: 38180565] {CVE-2025-38312}
  - soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() (Henry Martin) [Orabug: 38153059] {CVE-2025-38145}
  - soc: aspeed: lpc: Fix impossible judgment condition (Su Hui)
  - arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou (Quentin Schulz)
  - ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device (Dmitry Baryshkov)
  - bus: fsl-mc: fix double-free on mc_dev (Ioana Ciornei) [Orabug: 38180572] {CVE-2025-38313}
  - nilfs2: do not propagate ENOENT error from nilfs_btree_propagate() (Ryusuke Konishi)
  - nilfs2: add pointer check for nilfs_direct_propagate() (Xu Wang)
  - ocfs2: fix possible memory leak in ocfs2_finish_quota_recovery (Murad Masimov)
  - Squashfs: check return result of sb_min_blocksize (Phillip Lougher) [Orabug: 38253984] {CVE-2025-38415}
  - arm64: dts: imx8mn-beacon: Fix RTC capacitive load (Adam Ford)
  - arm64: dts: imx8mm-beacon: Fix RTC capacitive load (Adam Ford)
  - ARM: dts: at91: at91sam9263: fix NAND chip selects (Wolfram Sang)
  - ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select (Wolfram Sang)
  - f2fs: fix to correct check conditions in f2fs_cross_rename (Zhiguo Niu)
  - f2fs: use d_inode(dentry) cleanup dentry->d_inode (Zhiguo Niu)
  - net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames (Horatiu Vultur)
  - net: openvswitch: Fix the dead loop of MPLS parse (Faicker Mo) [Orabug: 38153064] {CVE-2025-38146}
  - calipso: Don't call calipso functions for AF_INET sk. (Kuniyuki Iwashima) [Orabug: 38153069] {CVE-2025-38147}
  - net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy (Thangaraj Samynathan)
  - bpf: Avoid __bpf_prog_ret0_warn when jit fails (Kafai Wan) [Orabug: 38180470] {CVE-2025-38280}
  - net: usb: aqc111: fix error handling of usbnet read calls (Nikita Zhandarovich) [Orabug: 38153088] {CVE-2025-38153}
  - netfilter: nft_tunnel: fix geneve_opt dump (Fernando Fernandez Mancera)
  - bpf, sockmap: Avoid using sk_socket after free when sending (Jiayuan Chen) [Orabug: 38153094] {CVE-2025-38154}
  - vfio/type1: Fix error unwind in migration dirty bitmap allocation (Li Rongqing)
  - netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy (Florian Westphal)
  - wifi: ath9k_htc: Abort software beacon handling if disabled (Toke Høiland-Jørgensen) [Orabug: 38153109] {CVE-2025-38157}
  - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (Alexey Kodanev) [Orabug: 38153121] {CVE-2025-38159}
  - s390/bpf: Store backchain even for leaf progs (Ilya Leoshkevich)
  - clk: qcom: gcc-msm8939: Fix mclk0 & mclk1 for 24 MHz (Vincent Knecht)
  - bpf: Fix WARN() in get_bpf_raw_tp_regs (Tao Chen) [Orabug: 38180488] {CVE-2025-38285}
  - pinctrl: at91: Fix possible out-of-boundary access (Andy Shevchenko) [Orabug: 38180494] {CVE-2025-38286}
  - libbpf: Use proper errno value in nlattr (Anton Protopopov)
  - ktls, sockmap: Fix missing uncharge operation (Jiayuan Chen)
  - clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (Henry Martin) [Orabug: 38153131] {CVE-2025-38160}
  - clk: qcom: gcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
  - bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ (Anton Protopopov)
  - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Patrisious Haddad) [Orabug: 38153138] {CVE-2025-38161}
  - netfilter: nft_quota: match correctly when the quota just depleted (Zhongqiu Duan)
  - netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it (Huajian Yang)
  - libbpf: Use proper errno value in linker (Anton Protopopov)
  - f2fs: fix to detect gcing page in f2fs_is_cp_guaranteed() (Chao Yu)
  - f2fs: clean up w/ fscrypt_is_bounce_page() (Chao Yu)
  - iommu: Protect against overflow in iommu_pgsize() (Jason Gunthorpe)
  - RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h (Junxian Huang)
  - wifi: rtw88: do not ignore hardware read error during DPK (Dmitry Antipov)
  - libbpf: Fix buffer overflow in bpf_object__init_prog (Viktor Malik)
  - net: ncsi: Fix GCPS 64-bit member variables (Hari Kalavakunta)
  - f2fs: fix to do sanity check on sbi->total_valid_block_count (Chao Yu) [Orabug: 38153149] {CVE-2025-38163}
  - bpf, sockmap: fix duplicated data transmission (Jiayuan Chen)
  - IB/cm: use rwlock for MAD agent lock (Jacob Moroni)
  - wifi: ath11k: fix node corruption in ar->arvifs list (Stone Zhang) [Orabug: 38180515] {CVE-2025-38293}
  - firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES (Huang Yiwei)
  - drm/tegra: rgb: Fix the unbound reference count (Biju Das)
  - drm/vkms: Adjust vkms_state->active_planes allocation type (Kees Cook)
  - drm: rcar-du: Fix memory leak in rcar_du_vsps_init() (Biju Das)
  - selftests/seccomp: fix syscall_restart test for arm compat (Neill Kapron)
  - firmware: psci: Fix refcount leak in psci_dt_init (Miaoqian Lin)
  - m68k: mac: Fix macintosh_config for Mac II (Finn Thain)
  - fs/ntfs3: handle hdr_first_de() return value (Andrey Vatoropin) [Orabug: 38153172] {CVE-2025-38167}
  - media: rkvdec: Fix frame size enumeration (Jonas Karlman)
  - drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table (Charles Han) [Orabug: 38180589] {CVE-2025-38319}
  - spi: sh-msiof: Fix maximum DMA transfer size (Geert Uytterhoeven)
  - ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions" (Armin Wolf)
  - x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (Jiaqing Zhao)
  - PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks() (Zijun Hu)
  - power: reset: at91-reset: Optimize at91_reset() (Alexander Shiyan)
  - EDAC/skx_common: Fix general protection fault (Qiuxu Zhuo) [Orabug: 38180524] {CVE-2025-38298}
  - crypto: sun8i-ce - move fallback ahash_request to the end of the struct (Ovidiu Panait)
  - crypto: xts - Only add ecb if it is not already there (Herbert Xu)
  - crypto: lrw - Only add ecb if it is not already there (Herbert Xu)
  - crypto: marvell/cesa - Avoid empty transfer descriptor (Herbert Xu)
  - crypto: marvell/cesa - Handle zero-length skcipher requests (Herbert Xu) [Orabug: 38153188] {CVE-2025-38173}
  - x86/cpu: Sanitize CPUID(0x80000000) output (Ahmed S. Darwish)
  - crypto: sun8i-ss - do not use sg_dma_len before calling DMA functions (Corentin Labbe)
  - perf/core: Fix broken throttling when max_samples_per_tick=1 (Qing Wang)
  - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher)
  - thunderbolt: Do not double dequeue a configuration request (Sergey Senozhatsky) [Orabug: 38158383] {CVE-2025-38174}
  - usb: usbtmc: Fix timeout value in get_stb (Dave Penkler)
  - USB: serial: pl2303: add new chip PL2303GC-Q20 and PL2303GT-2AB (Charles Yeh)
  - usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device (Hongyu Xie)
  - usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE (Jiayi Li)
  - rtc: Fix offset calculation for .start_secs < 0 (Alexandre Mergnat)
  - rtc: Make rtc_time64_to_tm() support dates before 1970 (Alexandre Mergnat)
  - pinctrl: armada-37xx: set GPIO output value before setting direction (Gabor Juhos)
  - pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs > 31 (Gabor Juhos)


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-312.187.4.el9uek]
changelog:
  - rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38166374]
  - KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38319943,38440301] {CVE-2025-39823}
  - hugetlb: arm64: add mte support (Dave Kleikamp) [Orabug: 38177800]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-312.187.5.el9uek]
changelog:
  - Revert "mm: hugetlb: independent PMD page table shared count" (Harshit Mogalapalli) [Orabug: 38327655]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-313.187.1.el9uek]
changelog:
  - drm/amdgpu: Remove ATC L2 access for MMHUB 2.1.x (Lijo Lazar) [Orabug: 37778293]
  - PCI/portdrv: Don't disable AER reporting in get_port_device_capability() (Stefan Roese) [Orabug: 37778293]
  - PCI/AER: Enable error reporting when AER is native (Stefan Roese) [Orabug: 37778293]
  - PCI/AER: Configure ECRC for every device (Stefan Roese) [Orabug: 37778293]
  - net/rds: Add support for RDS_CMSG_TOS (Gerd Rausch) [Orabug: 38058308]
  - net/rds: Add support RDS_FEATURE ELF notes (Gerd Rausch) [Orabug: 38063328]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-313.189.2.el9uek]
changelog:
  - LTS version: v5.15.189 (Vijayendra Suman)
  - rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095071] {CVE-2025-38067}
  - x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
  - Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID (Hans de Goede)
  - HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324278] {CVE-2025-38540}
  - HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
  - vt: add missing notification when switching back to text mode (Nicolas Pitre)
  - HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
  - net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
  - um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
  - atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
  - bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254089] {CVE-2025-38439}
  - bnxt_en: Fix DCB ETS validation (Shravya Kn)
  - net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
  - can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
  - net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
  - net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu) [Orabug: 38324289] {CVE-2025-38542}
  - netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254095] {CVE-2025-38441}
  - ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
  - smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
  - nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254101] {CVE-2025-38443}
  - raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254105] {CVE-2025-38444}
  - md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254108] {CVE-2025-38445}
  - wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324160] {CVE-2025-38513}
  - dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
  - dma-buf: use new iterator in dma_resv_wait_timeout (Christian König)
  - dma-buf: add dma_resv_for_each_fence_unlocked v8 (Christian König)
  - usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
  - usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
  - usb: cdnsp: Replace snprintf() with the safer scnprintf() variant (Lee Jones)
  - usb:cdnsp: remove TRB_FLUSH_ENDPOINT command (Pawel Laszczak)
  - Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
  - xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
  - usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
  - xhci: Allow RPM on the USB controller (1022:43f7) by default (Basavaraj Natikar)
  - virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253833] {CVE-2025-38375}
  - netlink: make sure we allow at least one dump skb (Jakub Kicinski)
  - netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
  - btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
  - btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
  - Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
  - usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254117] {CVE-2025-38448}
  - drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
  - drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324179] {CVE-2025-38515}
  - pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324185] {CVE-2025-38516}
  - x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
  - x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
  - x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
  - xen: replace xen_remap() with memremap() (Juergen Gross)
  - jfs: fix null ptr deref in dtInsertEntry (Edward Adam Davis) [Orabug: 36993160] {CVE-2024-44939}
  - bpf, sockmap: Fix skb refcnt race after locking changes (John Fastabend)
  - aoe: avoid potential deadlock at set_capacity (Maksim Kiselev) [Orabug: 36530894] {CVE-2024-26775}
  - thermal/int340x_thermal: handle data_vault when the value is ZERO_SIZE_PTR (Lee, Chun-Yi) [Orabug: 37283277] {CVE-2022-48703}
  - bpf: fix precision backtracking instruction iteration (Andrii Nakryiko)
  - rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells) [Orabug: 38324169] {CVE-2025-38514}
  - net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254146] {CVE-2025-38457}
  - atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254152] {CVE-2025-38458}
  - atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254160] {CVE-2025-38459}
  - atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324308] {CVE-2025-38546}
  - atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254166] {CVE-2025-38460}
  - net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
  - net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
  - vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
  - vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254172] {CVE-2025-38461}
  - vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254175] {CVE-2025-38462}
  - tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254180] {CVE-2025-38464}
  - netlink: Fix wraparounds of sk->sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254187] {CVE-2025-38465}
  - fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
  - perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254196] {CVE-2025-38466}
  - ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
  - drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254202] {CVE-2025-38467}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-313.189.3.el9uek]
changelog:
  - x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta) [Orabug: 38424092]
  - x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta) [Orabug: 38424092]
  - x86/vmscape: Enable the mitigation (Pawan Gupta) [Orabug: 38424092]
  - x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta) [Orabug: 38424092]
  - x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf) [Orabug: 38424092]
  - x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta) [Orabug: 38424092]
  - x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta) [Orabug: 38424092]
  - Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta) [Orabug: 38424092]
  - vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38454665,38351770] {CVE-2025-38618}
  - HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254347,38454662] {CVE-2025-38495}
  - HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254339,38454666] {CVE-2025-38494}
  - clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310006,38454664] {CVE-2025-38499}
  - igc: fix disabling L1.2 PCI-E link substate on I226 on init (Valdikss) [Orabug: 38343660]
  - Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
  - ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask() (Kuninori Morimoto)
  - squashfs: fix memory leak in squashfs_fill_super (Phillip Lougher) [Orabug: 38343660]
  - ASoC: ops: dynamically allocate struct snd_ctl_elem_value (Arnd Bergmann)
  - compiler: remove __ADDRESSABLE_ASM{_STR,}() again (Jan Beulich)
  - mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn (Tu Jinjiang)
  - KVM: arm64: Fix kernel BUG() due to bad backport of FPSIMD/SVE/SME fix (Will Deacon)
  - benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334975] {CVE-2025-38569}
  - smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254323] {CVE-2025-38488}
  - kbuild: userprogs: use correct linker when mixing clang and GNU ld (Thomas Weißschuh)
  - ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS (Nathan Chancellor)
  - NFSv4.2: another fix for listxattr (Olga Kornievskaia)
  - cpuidle: governors: menu: Avoid using invalid recent intervals data (Rafael J. Wysocki)
  - netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38395124] {CVE-2025-38727}
  - Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" (Helge Deller) [Orabug: 38343660]
  - bpf, sockmap: Fix panic when calling skb_linearize (Jiayuan Chen) [Orabug: 38394723] {CVE-2025-38165}
  - netfilter: nf_tables: adjust lockdep assertions handling (Fedor Pchelkin)
  - arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38166347]
  - ARM: UEK: Disable arm64 erratum QCOM_FALKOR_ERRATUM_1003 (Boris Ostrovsky) [Orabug: 38166347]
  - vhost-scsi: Fix check for inline_sg_cnt exceeding preallocated limit (Alok Tiwari) [Orabug: 38324335]
  - mm/hugetlb: fix copy_hugetlb_page_range() to check ->pt_share_count (Jane Chu) [Orabug: 38346475]
  - Reapply "mm: hugetlb: independent PMD page table shared count" (Jane Chu) [Orabug: 38346475]
  - uek-rpm: pensando: enable config options for fips (Joseph Dobosenski) [Orabug: 38354692]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-313.189.5.el9uek]
changelog:
  - net/rds: tracepoints for rds_conn_kref_get and put (Sharath Srinivasan) [Orabug: 37793025]
  - net/rds: Add krefs to struct rds_connection (Sharath Srinivasan) [Orabug: 37793025]
  - nvme-tcp: sanitize request list handling (Hannes Reinecke) [Orabug: 38175126,38454661] {CVE-2025-38264}
  - llist: add interface to check if a node is on a list. (Neil Brown) [Orabug: 38175126] {CVE-2025-38264}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-313.189.5.1.el9uek]
changelog:
  - af_unix: Don't leave consecutive consumed OOB skbs. (Kuniyuki Iwashima)  [Orabug: 38528187]  {CVE-2025-38236} 
  - fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue)  [Orabug: 38528183]  {CVE-2025-39866} 
  - rtnetlink: Fix L3 stats disable handling in rtnl_offload_xstats_fill() (Vijayendra Suman)  [Orabug: 38528177]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-313.189.2.el9uek]
changelog:
  - LTS version: v5.15.189 (Vijayendra Suman)
  - rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095071] {CVE-2025-38067}
  - x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
  - Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID (Hans de Goede)
  - HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324278] {CVE-2025-38540}
  - HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
  - vt: add missing notification when switching back to text mode (Nicolas Pitre)
  - HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
  - net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
  - um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
  - atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
  - bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254089] {CVE-2025-38439}
  - bnxt_en: Fix DCB ETS validation (Shravya Kn)
  - net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
  - can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
  - net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
  - net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu)
  - netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254095] {CVE-2025-38441}
  - ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
  - smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
  - nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254101] {CVE-2025-38443}
  - raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254105] {CVE-2025-38444}
  - md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254108] {CVE-2025-38445}
  - wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324160] {CVE-2025-38513}
  - dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
  - dma-buf: use new iterator in dma_resv_wait_timeout (Christian König)
  - dma-buf: add dma_resv_for_each_fence_unlocked v8 (Christian König)
  - usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
  - usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
  - usb: cdnsp: Replace snprintf() with the safer scnprintf() variant (Lee Jones)
  - usb:cdnsp: remove TRB_FLUSH_ENDPOINT command (Pawel Laszczak)
  - Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
  - xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
  - usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
  - xhci: Allow RPM on the USB controller (1022:43f7) by default (Basavaraj Natikar)
  - virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253833] {CVE-2025-38375}
  - netlink: make sure we allow at least one dump skb (Jakub Kicinski)
  - netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
  - btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
  - btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
  - Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
  - usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254117] {CVE-2025-38448}
  - drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
  - drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324179] {CVE-2025-38515}
  - pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324185] {CVE-2025-38516}
  - x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
  - x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
  - x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
  - xen: replace xen_remap() with memremap() (Juergen Gross)
  - jfs: fix null ptr deref in dtInsertEntry (Edward Adam Davis)
  - bpf, sockmap: Fix skb refcnt race after locking changes (John Fastabend)
  - aoe: avoid potential deadlock at set_capacity (Maksim Kiselev) [Orabug: 36530894] {CVE-2024-26775}
  - thermal/int340x_thermal: handle data_vault when the value is ZERO_SIZE_PTR (Lee, Chun-Yi) [Orabug: 37283277] {CVE-2022-48703}
  - bpf: fix precision backtracking instruction iteration (Andrii Nakryiko)
  - rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells)
  - net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254146] {CVE-2025-38457}
  - atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254152] {CVE-2025-38458}
  - atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254160] {CVE-2025-38459}
  - atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324308] {CVE-2025-38546}
  - atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254166] {CVE-2025-38460}
  - net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
  - net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
  - vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
  - vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254172] {CVE-2025-38461}
  - vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254175] {CVE-2025-38462}
  - tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254180] {CVE-2025-38464}
  - netlink: Fix wraparounds of sk->sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254187] {CVE-2025-38465}
  - fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
  - perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254196] {CVE-2025-38466}
  - ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
  - drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254202] {CVE-2025-38467}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-313.189.3.el9uek]
changelog:
  - x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta) [Orabug: 38424092]
  - x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta) [Orabug: 38424092]
  - x86/vmscape: Enable the mitigation (Pawan Gupta) [Orabug: 38424092]
  - x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta) [Orabug: 38424092]
  - x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf) [Orabug: 38424092]
  - x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta) [Orabug: 38424092]
  - x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta) [Orabug: 38424092]
  - Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta) [Orabug: 38424092]
  - vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351770,38454665] {CVE-2025-38618}
  - HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254347,38454662] {CVE-2025-38495}
  - HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254339,38454666] {CVE-2025-38494}
  - clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310006,38454664] {CVE-2025-38499}
  - igc: fix disabling L1.2 PCI-E link substate on I226 on init (Valdikss) [Orabug: 38343660]
  - Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
  - ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask() (Kuninori Morimoto)
  - squashfs: fix memory leak in squashfs_fill_super (Phillip Lougher) [Orabug: 38343660]
  - ASoC: ops: dynamically allocate struct snd_ctl_elem_value (Arnd Bergmann)
  - compiler: remove __ADDRESSABLE_ASM{_STR,}() again (Jan Beulich)
  - mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn (Tu Jinjiang)
  - KVM: arm64: Fix kernel BUG() due to bad backport of FPSIMD/SVE/SME fix (Will Deacon)
  - benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334975] {CVE-2025-38569}
  - smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong)
  - kbuild: userprogs: use correct linker when mixing clang and GNU ld (Thomas Weißschuh)
  - ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS (Nathan Chancellor)
  - NFSv4.2: another fix for listxattr (Olga Kornievskaia)
  - cpuidle: governors: menu: Avoid using invalid recent intervals data (Rafael J. Wysocki)
  - netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38395124] {CVE-2025-38727}
  - Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" (Helge Deller) [Orabug: 38343660]
  - bpf, sockmap: Fix panic when calling skb_linearize (Jiayuan Chen) [Orabug: 38394723] {CVE-2025-38165}
  - netfilter: nf_tables: adjust lockdep assertions handling (Fedor Pchelkin)
  - arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38166347]
  - ARM: UEK: Disable arm64 erratum QCOM_FALKOR_ERRATUM_1003 (Boris Ostrovsky) [Orabug: 38166347]
  - vhost-scsi: Fix check for inline_sg_cnt exceeding preallocated limit (Alok Tiwari) [Orabug: 38324335]
  - mm/hugetlb: fix copy_hugetlb_page_range() to check ->pt_share_count (Jane Chu) [Orabug: 38346475]
  - Reapply "mm: hugetlb: independent PMD page table shared count" (Jane Chu) [Orabug: 38346475]
  - uek-rpm: pensando: enable config options for fips (Joseph Dobosenski) [Orabug: 38354692]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-313.189.5.1.el9uek]
changelog:
  - af_unix: Don't leave consecutive consumed OOB skbs. (Kuniyuki Iwashima) [Orabug: 38528187] {CVE-2025-38236}
  - fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue) [Orabug: 38528183] {CVE-2025-39866}
  - rtnetlink: Fix L3 stats disable handling in rtnl_offload_xstats_fill() (Vijayendra Suman) [Orabug: 38528177]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-313.189.5.2.el9uek]
changelog:
  - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton)  [Orabug: 38575798]  {CVE-2025-38724} 
  - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers)  [Orabug: 38575792]  
  - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu)  [Orabug: 38575792]  {CVE-2025-39964}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-313.189.5.2.el9uek]
changelog:
  - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton)  [Orabug: 38575798]  {CVE-2025-38724}
  - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers)  [Orabug: 38575792]
  - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu)  [Orabug: 38575792]  {CVE-2025-39964}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-313.189.5.3.el9uek]
changelog:
  - i40e: add validation for ring_len param (Lukasz Czapnik)  [Orabug: 38603025]  {CVE-2025-39973} 
  - i40e: increase max descriptors for XL710 (Justin Bronder)  [Orabug: 38603025]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-314.189.1.el9uek]
changelog:
  - net/mlx5: HWS, fix bad parameter in CQ creation (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: HWS, fix missing ip_version handling in definer (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5e: Use custom tunnel header for vxlan gbp (Vlad Dogaru) [Orabug: 38253291]
  - net/mlx5: HWS, Rightsize bwc matcher priority (Vlad Dogaru) [Orabug: 38253291]
  - net/mlx5: HWS, fix definer's HWS_SET32 macro for negative offset (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: HWS: Properly set bwc queue locks lock classes (Cosmin Ratiu) [Orabug: 38253291]
  - net/mlx5: HWS: Fix memory leak in mlx5hws_definer_calc_layout (Cosmin Ratiu) [Orabug: 38253291]
  - net/mlx5: HWS, don't destroy more bwc queue locks than allocated (Cosmin Ratiu) [Orabug: 38253291]
  - net/mlx5: HWS, fixed double free in error flow of definer layout (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: HWS, removed wrong access to a number of rules variable (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: HWS, changed E2BIG error to a negative return code (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: HWS, fixed double-free in error flow of creating SQ (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: Fix wrong reserved field in hca_cap_2 in mlx5_ifc (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: HWS, check the correct variable in hws_send_ring_alloc_sq() (Dan Carpenter) [Orabug: 38253291]
  - net/mlx5e: Support RX xfrm state selector's UPSPEC for packet offload (Jianbo Liu) [Orabug: 38253291]
  - net/mlx5e: Add pass flow group for IPSec RX status table (Jianbo Liu) [Orabug: 38253291]
  - net/mlx5e: Add num_reserved_entries param for ipsec_ft_create() (Jianbo Liu) [Orabug: 38253291]
  - net/mlx5e: Skip IPSec RX policy check for crypto offload (Jianbo Liu) [Orabug: 38253291]
  - net/mlx5e: Move IPSec policy check after decryption (Jianbo Liu) [Orabug: 38253291]
  - net/mlx5e: Add correct match to check IPSec syndromes for switchdev mode (Jianbo Liu) [Orabug: 38253291]
  - net/mlx5e: Change the destination of IPSec RX SA miss rule (Jianbo Liu) [Orabug: 38253291]
  - net/mlx5e: Add helper function to update IPSec default destination (Jianbo Liu) [Orabug: 38253291]
  - net/mlx5: fs, add counter object to flow destination (Moshe Shemesh) [Orabug: 38253291]
  - net/mlx5: DR, moved all the SWS code into a separate directory (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: HWS, use lock classes for bwc locks (Cosmin Ratiu) [Orabug: 38253291]
  - net/mlx5: hw counters: Remove mlx5_fc_create_ex (Cosmin Ratiu) [Orabug: 38253291]
  - net/mlx5: hw counters: Don't maintain a counter count (Cosmin Ratiu) [Orabug: 38253291]
  - net/mlx5: hw counters: Drop unneeded cacheline alignment (Cosmin Ratiu) [Orabug: 38253291]
  - net/mlx5: hw counters: Replace IDR+lists with xarray (Cosmin Ratiu) [Orabug: 38253291]
  - net/mlx5: hw counters: Use kvmalloc for bulk query buffer (Cosmin Ratiu) [Orabug: 38253291]
  - net/mlx5: hw counters: Make fc_stats & fc_pool private (Cosmin Ratiu) [Orabug: 38253291]
  - net/mlx5: fs, separate action and destination into distinct struct (Mark Bloch) [Orabug: 38253291]
  - net/mlx5: fs, remove unused member (Mark Bloch) [Orabug: 38253291]
  - net/mlx5: fs, move hardware fte deletion function reset (Mark Bloch) [Orabug: 38253291]
  - net/mlx5: fs, make get_root_namespace API function (Moshe Shemesh) [Orabug: 38253291]
  - net/mlx5: HWS, fixed error flow return values of some functions (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: HWS, updated API functions comments to kernel doc (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: HWS, added API and enabled HWS support (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: HWS, added send engine and context handling (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: HWS, added debug dump and internal headers (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: HWS, added backward-compatible API handling (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: HWS, added memory management handling (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: HWS, added vport handling (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: HWS, added modify header pattern and args handling (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: HWS, added FW commands handling (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: HWS, added matchers functionality (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: HWS, added definers handling (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: HWS, added rules handling (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: HWS, added tables handling (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: HWS, added actions handling (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: Added missing definitions in preparation for HW Steering (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/mlx5: Added missing mlx5_ifc definition for HW Steering (Yevgeny Kliteynik) [Orabug: 38253291]
  - net/rds: Enforce sibling ToS lanes are not UP when auto reaping a conn (Sharath Srinivasan) [Orabug: 38343380]
  - net/rds: replace rds_conn_addr_list with reentrant code (Sharath Srinivasan) [Orabug: 38343380]
  - net/rds: Auto-reap dropped conn via sysctl net.rds.conn_reap_after_drop_secs (Sharath Srinivasan) [Orabug: 38343380]
  - net/rds: Enable tracing for rds_conn_reap() (Sharath Srinivasan) [Orabug: 38343380]
  - net/rds: Disallow user conn reap via sysctl net.rds.conn_user_reap_enable (Sharath Srinivasan) [Orabug: 38343380]
  - net/rds: Add sockopt member all_tos to reset/reap all conns for src-dst (Sharath Srinivasan) [Orabug: 38343380]
  - net/rds: Reap rds_rdma connections via sockopt RDS_CONN_REAP (Sharath Srinivasan) [Orabug: 38343380]
  - mm, numa: fix bad pmd by atomically checking is_swap_pmd() in change_prot_numa() (Harry Yoo) [Orabug: 38410500]
  - scsi: target: Export fabric driver direct submit settings (Mike Christie) [Orabug: 38443422]
  - scsi: target: core: Unexport target_queue_submission() (Mike Christie) [Orabug: 38443422]
  - scsi: target: Allow userspace to request direct submissions (Mike Christie) [Orabug: 38443422]
  - scsi: target: core: Kill transport_handle_cdb_direct() (Mike Christie) [Orabug: 38443422]
  - scsi: target: core: Move buffer clearing hack (Mike Christie) [Orabug: 38443422]
  - scsi: target: core: Move core_alua_check_nonop_delay() call (Mike Christie) [Orabug: 38443422]
  - scsi: target: Have drivers report if they support direct submissions (Mike Christie) [Orabug: 38443422]
  - scsi: target: iscs: Make write_pending_must_be_called a bit field (Mike Christie) [Orabug: 38443422]
  - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active (Maciej S. Szmigiero) [Orabug: 38458436]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-314.189.2.el9uek]
changelog:
  - uek-rpm: Bluefield 3: Enable CONFIG_KEXEC_{FILE,SIG,IMAGE_VERIFY_SIG} and CONFIG_EDAC_GHES (Thomas Tai) [Orabug: 38474014]
  - uek-rpm: Enable the FWCTL PDS in UEK7 (Joao Martins) [Orabug: 38467344]
  - pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467344]
  - pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467344]
  - pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467344]
  - pds_core: remove write-after-free of client_id (Shannon Nelson) [Orabug: 37976798,38467344] {CVE-2025-37916}
  - pds_core: make wait_context part of q_info (Shannon Nelson) [Orabug: 37937540,38467344] {CVE-2025-37886}
  - pds_core: Remove unnecessary check in pds_client_adminq_cmd() (Brett Creeley) [Orabug: 38467344]
  - pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result (Brett Creeley) [Orabug: 37937543,38467344] {CVE-2025-37887}
  - pds_core: Prevent possible adminq overflow/stuck condition (Brett Creeley) [Orabug: 37977106,38467344] {CVE-2025-37987}
  - pds_core: fix memory leak in pdsc_debugfs_add_qcq() (Abdun Nihaal) [Orabug: 38467344]
  - pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467344]
  - pds_fwctl: add rpc and query support (Brett Creeley) [Orabug: 38467344]
  - pds_fwctl: initial driver framework (Shannon Nelson) [Orabug: 38467344]
  - pds_core: add new fwctl auxiliary_device (Shannon Nelson) [Orabug: 38467344]
  - pds_core: specify auxiliary_device to be created (Shannon Nelson) [Orabug: 38467344]
  - pds_core: make pdsc_auxbus_dev_del() void (Shannon Nelson) [Orabug: 38467344]
  - pds_core: limit loop over fw name list (Shannon Nelson) [Orabug: 38467344]
  - pds_core: Remove redundant null pointer checks (Li Zetao) [Orabug: 38467344]
  - pds_core: Fix pdsc_check_pci_health function to use work thread (Brett Creeley) [Orabug: 38467344,38498854] {CVE-2024-35968}
  - pds_core: use pci_reset_function for health reset (Shannon Nelson) [Orabug: 38467344]
  - pds_core: delete VF dev on reset (Shannon Nelson) [Orabug: 38467344]
  - pds_core: add simple AER handler (Shannon Nelson) [Orabug: 38467344]
  - pds_core: no health-thread in VF path (Shannon Nelson) [Orabug: 38467344]
  - pds_core: Clean up init/uninit flows to be more readable (Brett Creeley) [Orabug: 38467344]
  - pds_core: Fix up some minor issues (Brett Creeley) [Orabug: 38467344]
  - pds_core: Unmask adminq interrupt in work thread (Brett Creeley) [Orabug: 38467344]
  - pds_core: Don't assign interrupt index/bound_intr to notifyq (Brett Creeley) [Orabug: 38467344]
  - pds_core: Rework teardown/setup flow to be more common (Brett Creeley) [Orabug: 38467344]
  - pds_core: Clear BARs on reset (Brett Creeley) [Orabug: 38467344]
  - pds_core: Use struct pdsc for the pdsc_adminq_isr private data (Brett Creeley) [Orabug: 38467344]
  - pds_core: Cancel AQ work on teardown (Brett Creeley) [Orabug: 38467344]
  - pds_core: Prevent health thread from running during reset/remove (Brett Creeley) [Orabug: 38467344]
  - pds_core: fix up some format-truncation complaints (Shannon Nelson) [Orabug: 38467344]
  - net: pds_core: Fix possible double free in error handling path (Yongzhi Liu) [Orabug: 36530186] {CVE-2024-26652}
  - x86/its: ITS impacts performance even when mitigation is disabled (Alexandre Chartre) [Orabug: 38346576]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-314.193.3.el9uek]
changelog:
  - LTS version: v5.15.193 (Vijayendra Suman)
  - LTS version: v5.15.192 (Vijayendra Suman)
  - dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
  - spi: tegra114: Use value to check for invalid delays (Aaron Kling)
  - clk: qcom: gdsc: Set retain_ff before moving to HW CTRL (Taniya Das)
  - perf bpf-event: Fix use-after-free in synthesis (Ian Rogers)
  - drm/bridge: ti-sn65dsi86: fix REFCLK setting (Michael Walle)
  - spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort (Larisa Grigore)
  - spi: spi-fsl-lpspi: Set correct chip-select polarity bit (Larisa Grigore)
  - spi: spi-fsl-lpspi: Fix transmissions when using CONT (Larisa Grigore)
  - pcmcia: Add error handling for add_interval() in do_validate_mem() (Xu Wang)
  - ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model (Takashi Iwai)
  - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Li Qiong) [Orabug: 38494760] {CVE-2025-39902}
  - randstruct: gcc-plugin: Fix attribute addition (Kees Cook)
  - randstruct: gcc-plugin: Remove bogus void member (Kees Cook)
  - arm64: dts: marvell: uDPU: define pinctrl state for alarm LEDs (Gabor Juhos)
  - vmxnet3: update MTU after device quiesce (Ronak Doshi)
  - net: dsa: microchip: linearize skb for tail-tagging switches (Jakob Unterwurzacher)
  - net: dsa: microchip: update tag_ksz masks for KSZ9477 family (Pieter Van Trappen)
  - dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
  - dma-buf: insert memory barrier before updating num_fences (Hyejeong Choi) [Orabug: 38152833] {CVE-2025-38095}
  - gpio: pca953x: fix IRQ storm on system wake up (Emanuele Ghidoli)
  - iio: light: opt3001: fix deadlock due to concurrent flag access (Luca Ceresoli) [Orabug: 37977027] {CVE-2025-37968}
  - iio: chemical: pms7003: use aligned_s64 for timestamp (David Lechner)
  - spi: tegra114: Don't fail set_cs_timing when delays are zero (Aaron Kling)
  - spi: tegra114: Remove unnecessary NULL-pointer checks (Alexander Danilenko)
  - KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer (Sean Christopherson) [Orabug: 38494247]
  - cpufreq/sched: Explicitly synchronize limits_changed flag handling (Rafael J. Wysocki)
  - mm/khugepaged: fix ->anon_vma race (Jann Horn)
  - e1000e: fix heap overflow in e1000_set_eeprom (Vitaly Lifshits) [Orabug: 38494739] {CVE-2025-39898}
  - batman-adv: fix OOB read/write in network-coding decode (Stanislav Fort)
  - scsi: lpfc: Fix buffer free/clear order in deferred receive path (John Evans) [Orabug: 38456753] {CVE-2025-39841}
  - drm/amdgpu: drop hw access in non-DC audio fini (Alex Deucher)
  - wifi: mwifiex: Initialize the chan_stats array to zero (Rong Qianfeng) [Orabug: 38494722] {CVE-2025-39891}
  - mm: move page table sync declarations to linux/pgtable.h (Harry Yoo) [Orabug: 38456763] {CVE-2025-39844}
  - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Harry Yoo) [Orabug: 38456766] {CVE-2025-39845}
  - pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() (Ma Ke)
  - ALSA: usb-audio: Add mute TLV for playback volumes on some devices (Cryolitia Pukngae)
  - phy: mscc: Stop taking ts_lock for tx_queue and use its own lock (Horatiu Vultur)
  - net: phy: mscc: Fix memory leak when using one step timestamping (Horatiu Vultur) [Orabug: 38153076] {CVE-2025-38148}
  - ptp: Add generic PTP is_sync() function (Kurt Kanzenbach)
  - ppp: fix memory leak in pad_compress_skb (Qingfang Deng) [Orabug: 38456780] {CVE-2025-39847}
  - net: atm: fix memory leak in atm_register_sysfs when device_register fail (Wang Liang)
  - ax25: properly unshare skbs in ax25_kiss_rcv() (Eric Dumazet)
  - ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() (Dan Carpenter)
  - net: thunder_bgx: decrement cleanup index before use (Rosen Penev)
  - net: thunder_bgx: add a missing of_node_put (Rosen Penev)
  - wifi: libertas: cap SSID len in lbs_associate() (Dan Carpenter)
  - wifi: cw1200: cap SSID length in cw1200_do_join() (Dan Carpenter)
  - net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets (Felix Fietkau)
  - i40e: Fix potential invalid access when MAC list is empty (Zhen Ni) [Orabug: 38456813] {CVE-2025-39853}
  - icmp: fix icmp_ndo_send address translation for reply direction (Fabian Bläse)
  - mISDN: Fix memory leak in dsp_hwec_enable() (Miaoqian Lin)
  - xirc2ps_cs: fix register access when enabling FullDuplex (Alok Tiwari)
  - Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (Kuniyuki Iwashima) [Orabug: 38456833] {CVE-2025-39860}
  - netfilter: conntrack: helper: Replace -EEXIST by -EBUSY (Phil Sutter)
  - netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (Wang Liang) [Orabug: 38494730] {CVE-2025-39894}
  - wifi: cfg80211: fix use-after-free in cmp_bss() (Dmitry Antipov) [Orabug: 38456858] {CVE-2025-39864}
  - arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro (Peter Robinson)
  - tee: fix NULL pointer dereference in tee_shm_put (Pei Xiao) [Orabug: 38456865] {CVE-2025-39865}
  - fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue) [Orabug: 38456870,38528183] {CVE-2025-39866}
  - drm/amd/display: Don't warn when missing DCE encoder caps (Timur Kristóf)
  - bpf: Fix oob access in cgroup local storage (Daniel Borkmann) [Orabug: 38324117] {CVE-2025-38502}
  - bpf: Move bpf map owner out of common struct (Daniel Borkmann)
  - bpf: Move cgroup iterator helpers to bpf.h (Daniel Borkmann)
  - bpf: Add cookie object to bpf maps (Daniel Borkmann)
  - LTS version: v5.15.191 (Vijayendra Suman)
  - xfs: do not propagate ENODATA disk errors into xattr code (Eric Sandeen) [Orabug: 38440385] {CVE-2025-39835}
  - Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" (Imre Deak)
  - HID: mcp2221: Handle reads greater than 60 bytes (Hamish Martin)
  - HID: mcp2221: Don't set bus speed on every transfer (Hamish Martin)
  - drm/nouveau/disp: Always accept linear modifier (James Jones)
  - net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
  - dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted (Shanker Donthineni)
  - Revert "drm/amdgpu: fix incorrect vm flags to map bo" (Alex Deucher) [Orabug: 38343660]
  - HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [Orabug: 38440227] {CVE-2025-39808}
  - HID: wacom: Add a new Art Pen 2 (Ping Cheng)
  - HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (Qasim Ijaz) [Orabug: 38440223] {CVE-2025-39806}
  - HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [Orabug: 38440309] {CVE-2025-39824}
  - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [Orabug: 38440276] {CVE-2025-39817}
  - sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [Orabug: 38440249] {CVE-2025-39812}
  - net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts (Rohan G Thomas)
  - net/mlx5e: Set local Xoff after FW update (Alexei Lazar)
  - net/mlx5e: Update and set Xon/Xoff upon port speed set (Alexei Lazar)
  - net/mlx5e: Update and set Xon/Xoff upon MTU set (Alexei Lazar)
  - phy: mscc: Fix when PTP clock is register and unregister (Horatiu Vultur)
  - net: dlink: fix multicast stats being counted incorrectly (Moon Yeounsu)
  - atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [Orabug: 38440345] {CVE-2025-39828}
  - Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced (Luiz Augusto von Dentz)
  - powerpc/kvm: Fix ifdef to remove build warning (Madhavan Srinivasan)
  - net: ipv4: fix regression in local-broadcast routes (Oscar Maes) [Orabug: 38343660]
  - vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() (Nikolay Kuratov)
  - NFS: Fix a race when updating an existing write (Trond Myklebust) [Orabug: 38401609] {CVE-2025-39697}
  - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (Christoph Hellwig)
  - ASoC: codecs: tx-macro: correct tx_macro_component_drv name (Alexey Klimov)
  - scsi: core: sysfs: Correct sysfs attributes access rights (Damien Le Moal)
  - ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [Orabug: 38440258] {CVE-2025-39813}
  - pinctrl: STMFX: add missing HAS_IOMEM dependency (Randy Dunlap)
  - LTS version: v5.15.190 (Vijayendra Suman)
  - alloc_fdtable(): change calling conventions. (Al Viro)
  - wifi: mac80211: check basic rates validity in sta_link_apply_parameters (Mikhail Lobanov)
  - netfilter: nf_reject: don't leak dst refcount for loopback packets (Florian Westphal) [Orabug: 38401481] {CVE-2025-38732}
  - s390/hypfs: Enable limited access during lockdown (Peter Oberparleiter)
  - s390/hypfs: Avoid unnecessary ioctl registration in debugfs (Peter Oberparleiter)
  - ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation (Takashi Iwai)
  - bonding: update LACP activity flag after setting lacp_active (Hangbin Liu)
  - net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate (William Liu)
  - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (William Liu) [Orabug: 38423456] {CVE-2025-39766}
  - ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc (Jason Xing)
  - net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization (Yuichiro Tsuji) [Orabug: 38516727] {CVE-2025-38736}
  - phy: mscc: Fix timestamping for vsc8584 (Horatiu Vultur)
  - net: phy: Use netif_rx(). (Sebastian Andrzej Siewior)
  - ppp: fix race conditions in ppp_fill_forward_path (Qingfang Deng) [Orabug: 38401500] {CVE-2025-39673}
  - ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add (Heminhong)
  - drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() (Chenyuan Yang)
  - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [Orabug: 38343660]
  - drm/hisilicon/hibmc: fix the hibmc loaded failed bug (Baihan Li) [Orabug: 38423473] {CVE-2025-39772}
  - mlxsw: spectrum: Forward packets with an IPv4 link-local source IP (Ido Schimmel)
  - iommu/amd: Avoid stack buffer overflow from kernel cmdline (Kees Cook) [Orabug: 38360925] {CVE-2025-38676}
  - scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [Orabug: 38401513] {CVE-2025-39676}
  - net: bridge: fix soft lockup in br_multicast_query_expired() (Wang Liang) [Orabug: 38423478] {CVE-2025-39773}
  - RDMA/bnxt_re: Fix to initialize the PBL array (Anantha Prabhu)
  - cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key (Waiman Long)
  - mm/page_alloc: detect allocation forbidden by cpuset and bail out early (Feng Tang)
  - x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (Tianxiang Peng) [Orabug: 38401541] {CVE-2025-39681}
  - iio: light: as73211: Ensure buffer holes are zeroed (Jonathan Cameron)
  - tracing: Limit access to parser->buffer when trace_get_user failed (Pu Lehui) [Orabug: 38401546] {CVE-2025-39683}
  - tracing: Remove unneeded goto out logic (Steven Rostedt)
  - iio: imu: inv_icm42600: change invalid data error to -EBUSY (Jean-Baptiste Maneyrol)
  - usb: xhci: Fix slot_id resource race conflict (Weitao Wang)
  - selftests: mptcp: pm: check flush doesn't reset limits (Matthieu Baerts)
  - pwm: mediatek: Fix duty and period setting (Uwe Kleine-König)
  - pwm: mediatek: Handle hardware enable and clock enable separately (Uwe Kleine-König)
  - pwm: mediatek: Implement .apply() callback (Uwe Kleine-König)
  - scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems (Ranjan Kumar)
  - scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (Ranjan Kumar)
  - scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (André Draszik)
  - iio: adc: ad_sigma_delta: change to buffer predisable (David Lechner)
  - soc: qcom: mdt_loader: Ensure we don't read past the ELF header (Bjorn Andersson) [Orabug: 38423523] {CVE-2025-39787}
  - wifi: ath11k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
  - asm-generic: Add memory barrier dma_mb() (Kefeng Wang)
  - locking/barriers, kcsan: Support generic instrumentation (Marco Elver)
  - media: venus: protect against spurious interrupts during probe (Jorge Ramirez-Ortiz)
  - media: venus: Add support for SSR trigger using fault injection (Dikshita Agarwal)
  - media: qcom: camss: cleanup media device allocated resource on error path (Sasha Levin)
  - media: camss: Convert to platform remove callback returning void (Uwe Kleine-König)
  - f2fs: fix to avoid out-of-boundary access in dnode page (Chao Yu)
  - drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS (Imre Deak)
  - mptcp: disable add_addr retransmission when timeout is 0 (Geliang Tang)
  - drm/amd/display: Don't overclock DCE 6 by 15% (Timur Kristóf)
  - usb: dwc3: Remove WARN_ON for device endpoint command timeouts (Selvarasu Ganesan) [Orabug: 38435009] {CVE-2025-39801}
  - usb: dwc3: Ignore late xferNotReady event to prevent halt timeout (Kuen-Han Tsai)
  - USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles (Zenm Chen)
  - usb: storage: realtek_cr: Use correct byte order for bcs->Residue (Thorsten Blum)
  - USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera (Mael Guerin)
  - usb: renesas-xhci: Fix External ROM access timeouts (Marek Vasut)
  - usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test (Xu Yang)
  - comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() (Ian Abbott)
  - comedi: pcl726: Prevent invalid irq number (Edward Adam Davis)
  - comedi: Make insn_rw_emulate_bits() do insn->n samples (Ian Abbott)
  - usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive (Miao Li)
  - most: core: Drop device reference after usage in get_channel() (Miaoqian Lin)
  - iio: proximity: isl29501: fix buffered read on big-endian systems (David Lechner)
  - iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() (Salah Triki)
  - ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [Orabug: 38401580] {CVE-2025-39689}
  - fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() (Xu Yilun)
  - use uniform permission checks for all mount propagation changes (Al Viro)
  - fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [Orabug: 38401586] {CVE-2025-39691}
  - drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs (Timur Kristóf)
  - drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs (Timur Kristóf)
  - drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. (Timur Kristóf)
  - drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 (Timur Kristóf)
  - drm/amd/display: Avoid a NULL pointer dereference (Mario Limonciello) [Orabug: 38401596] {CVE-2025-39693}
  - ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 (Evgeniy Harchenko)
  - mm/debug_vm_pgtable: clear page table entries at destroy_args() (Herton Ronaldo Krzesinski)
  - mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency (Victor Shih)
  - memstick: Fix deadlock by moving removing flag earlier (Jiayi Li)
  - scsi: ufs: ufs-pci: Fix default runtime and system PM levels (Adrian Hunter)
  - scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers (Archana Patni)
  - mptcp: do not queue data on closed subflows (Paolo Abeni)
  - mptcp: drop unused sk in mptcp_push_release (Geliang Tang)
  - selftests: mptcp: Initialize variables to quiet gcc 12 warnings (Mat Martineau)
  - mptcp: introduce MAPPING_BAD_CSUM (Paolo Abeni)
  - mptcp: fix error mibs accounting (Paolo Abeni)
  - selftests: mptcp: add missing join check (Matthieu Baerts)
  - selftests: mptcp: connect: also cover checksum (Matthieu Baerts)
  - selftests: mptcp: connect: also cover alt modes (Matthieu Baerts)
  - selftests: mptcp: make sendfile selftest work (Florian Westphal)
  - ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value (Li Zhong)
  - PCI: vmd: Assign VMD IRQ domain before enumeration (Nirmal Patel)
  - sch_htb: make htb_deactivate() idempotent (Cong Wang) [Orabug: 38516621] {CVE-2025-37953}
  - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Cong Wang) [Orabug: 37908491] {CVE-2025-37798}
  - sch_drr: make drr_qlen_notify() idempotent (Cong Wang)
  - btrfs: populate otime when logging an inode item (Qu Wenruo)
  - KVM: VMX: Flush shadow VMCS on emergency reboot (Chao Gao)
  - net/sched: ets: use old 'nbands' while purging unused classes (Davide Caratti) [Orabug: 38394836] {CVE-2025-38684}
  - net_sched: sch_ets: implement lockless ets_dump() (Eric Dumazet)
  - net/sched: sch_ets: properly init all active DRR list handles (Davide Caratti) [Orabug: 35290200]
  - platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() (Tzung-Bi Shih)
  - platform/chrome: cros_ec: remove unneeded label and if-condition (Tzung-Bi Shih)
  - platform/chrome: cros_ec: Use per-device lockdep key (Chen-Yu Tsai)
  - platform/chrome: cros_ec: Make cros_ec_unregister() return void (Uwe Kleine-König)
  - usb: dwc3: imx8mp: fix device leak at unbind (Johan Hovold)
  - bus: mhi: host: Detect events pointing to unexpected TREs (Youssef Samir) [Orabug: 38423539] {CVE-2025-39790}
  - ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig (Damien Le Moal)
  - usb: musb: omap2430: fix device leak at unbind (Johan Hovold)
  - usb: musb: omap2430: Convert to platform remove callback returning void (Uwe Kleine-König)
  - mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() (Anshuman Khandual)
  - NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug: 38429210] {CVE-2025-39798}
  - NFS: Create an nfs4_server_set_init_caps() function (Anna Schumaker)
  - net: enetc: fix device and OF node leak at probe (Johan Hovold)
  - block: Make REQ_OP_ZONE_FINISH a write operation (Damien Le Moal)
  - PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (Lukas Wunner)
  - usb: typec: fusb302: cache PD RX state (Sebastian Reichel)
  - hv_netvsc: Fix panic during namespace deletion with VF (Haiyang Zhang) [Orabug: 38394830] {CVE-2025-38683}
  - smb: server: Fix extension string in ksmbd_extract_shortname() (Thorsten Blum)
  - ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (Geoffrey D. Bennett)
  - x86/fpu: Delay instruction pointer fixup until after warning (Dave Hansen)
  - usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
  - usb: hub: avoid warm port reset during USB3 disconnect (Mathias Nyman)
  - x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
  - iio: hid-sensor-prox: Fix incorrect OFFSET calculation (Zhang Lixu)
  - iio: hid-sensor-prox: Restore lost scale assignments (Zhang Lixu)
  - f2fs: fix to do sanity check on ino and xnid (Chao Yu)
  - arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() (Ada Couprie Diaz) [Orabug: 38351990] {CVE-2025-38670}
  - drm/sched: Remove optimization that causes hang when killing dependent jobs (Lin Cao)
  - ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351929] {CVE-2025-38664}
  - selftests/memfd: add test for mapping write-sealed memfd read-only (Lorenzo Stoakes)
  - mm: reinstate ability to map write-sealed memfd mappings read-only (Lorenzo Stoakes)
  - mm: update memfd seal write check to include F_SEAL_WRITE (Lorenzo Stoakes)
  - mm: drop the assumption that VM_SHARED always implies writable (Lorenzo Stoakes)
  - sch_qfq: make qfq_qlen_notify() idempotent (Cong Wang)
  - sch_hfsc: make hfsc_qlen_notify() idempotent (Cong Wang) [Orabug: 38158395] {CVE-2025-38177}
  - sch_htb: make htb_qlen_notify() idempotent (Cong Wang) [Orabug: 37976859] {CVE-2025-37932}
  - mptcp: pm: kernel: flush: do not reset ADD_ADDR limit (Matthieu Baerts)
  - mptcp: drop skb if MPTCP skb extension allocation fails (Christoph Paasch)
  - ipv6: sr: Fix MAC comparison to be constant-time (Eric Biggers)
  - net, hsr: reject HSR frame if skb can't hold tag (Jakub Acs) [Orabug: 38401632] {CVE-2025-39703}
  - drm/amd/display: Don't overwrite dce60_clk_mgr (Timur Kristóf)
  - drm/amd: Restore cached power limit during resume (Mario Limonciello)
  - media: venus: venc: Clamp param smaller than 1fps and bigger than 240 (Ricardo Ribalda)
  - media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. (Ricardo Ribalda)
  - media: venus: hfi: explicitly release IRQ during teardown (Jorge Ramirez-Ortiz)
  - media: venus: Add a check for packet size after reading from shared memory (Vedang Nagar)
  - media: ov2659: Fix memory leaks in ov2659_probe() (Zhang Shurong)
  - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [Orabug: 38401676] {CVE-2025-39713}
  - media: usbtv: Lock resolution while streaming (Ludwig Disterhof) [Orabug: 38401683] {CVE-2025-39714}
  - media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() (Sakari Ailus)
  - media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (Haoxiang Li)
  - media: hi556: correct the test pattern configuration (Bingbu Cao)
  - media: gspca: Add bounds checking to firmware parser (Dan Carpenter)
  - soc/tegra: pmc: Ensure power-domains are in a known state (Jonathan Hunter)
  - jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [Orabug: 38423508] {CVE-2025-39782}
  - PCI: endpoint: Fix configfs group removal on driver teardown (Damien Le Moal)
  - PCI: endpoint: Fix configfs group list head handling (Damien Le Moal)
  - mtd: rawnand: fsmc: Add missing check after DMA map (Thomas Fourier)
  - mtd: spinand: propagate spinand_wait() errors from spinand_write_page() (Gabor Juhos)
  - hwmon: (gsc-hwmon) fix fan pwm setpoint show functions (Tim Harvey)
  - pwm: imx-tpm: Reset counter if CMOD is 0 (Laurentiu Mihalcea)
  - wifi: ath11k: fix source ring-buffer corruption (Johan Hovold)
  - wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (Nathan Chancellor)
  - zynq_fpga: use sgtable-based scatterlist wrappers (Marek Szyprowski)
  - ata: libata-scsi: Fix ata_to_sense_error() status handling (Damien Le Moal)
  - scsi: mpi3mr: Fix race between config read submit and interrupt completion (Ranjan Kumar)
  - ext4: fix hole length calculation overflow in non-extent inodes (Zhang Yi)
  - ext4: use kmalloc_array() for array space allocation (Liao Yuanhong)
  - ext4: don't try to clear the orphan_present feature block device is r/o (Theodore Ts'O)
  - ext4: fix reserved gdt blocks handling in fsmap (Ojaswin Mujoo)
  - ext4: fix fsmap end of range reporting with bigalloc (Ojaswin Mujoo)
  - ext4: check fast symlink for ea_inode correctly (Andreas Dilger)
  - lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap (Eric Biggers)
  - vt: defkeymap: Map keycodes above 127 to K_HOLE (Myrrh Periwinkle)
  - vt: keyboard: Don't process Unicode characters in K_OFF mode (Myrrh Periwinkle)
  - bus: mhi: host: Fix endianness of BHI vector table (Alexander Wilhelm)
  - usb: dwc3: meson-g12a: fix device leaks at unbind (Johan Hovold)
  - usb: gadget: udc: renesas_usb3: fix device leak at unbind (Johan Hovold)
  - usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (Nathan Chancellor)
  - m68k: Fix lost column on framebuffer debug console (Finn Thain)
  - cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (Dan Carpenter)
  - serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [Orabug: 38401728] {CVE-2025-39724}
  - HID: magicmouse: avoid setting up battery timer when not needed (Aditya Garg)
  - media: uvcvideo: Do not mark valid metadata as invalid (Ricardo Ribalda)
  - media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394815] {CVE-2025-38680}
  - mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock (Breno Leitao)
  - mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() (Waiman Long)
  - parisc: Makefile: fix a typo in palo.conf (Randy Dunlap)
  - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (Sravan Kumar Gundu) [Orabug: 38394843] {CVE-2025-38685}
  - btrfs: do not allow relocation of partially dropped subvolumes (Qu Wenruo) [Orabug: 38423271] {CVE-2025-39738}
  - btrfs: fix log tree replay failure due to file with 0 links and extents (Filipe Manana)
  - cdc-acm: fix race between initial clearing halt and open (Oliver Neukum)
  - thunderbolt: Fix copy+paste error in match_service_id() (Eric Biggers)
  - comedi: fix race between polling and detaching (Ian Abbott)
  - usb: typec: ucsi: Update power_supply on power role change (Myrrh Periwinkle)
  - misc: rtsx: usb: Ensure mmc child device is active when card is present (Ricky Wu)
  - usb: core: config: Prevent OOB read in SS endpoint companion parsing (Xinyu Liu) [Orabug: 38423420] {CVE-2025-39760}
  - ext4: fix largest free orders lists corruption on mb_optimize_scan switch (Baokun Li)
  - drm/amdgpu: fix incorrect vm flags to map bo (Jack Xiao)
  - ASoC: fsl_sai: replace regmap_write with regmap_update_bits (Shengjiu Wang)
  - ASoC: soc-dai.h: merge DAI call back functions into ops (Kuninori Morimoto)
  - ASoC: soc-dai.c: add missing flag check at snd_soc_pcm_dai_probe() (Kuninori Morimoto)
  - scsi: lpfc: Remove redundant assignment to avoid memory leak (Jiasheng Jiang)
  - rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe (Meagan Lloyd)
  - pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394865] {CVE-2025-38691}
  - pNFS: Handle RPC size limit for layoutcommits (Sergey Bashirov)
  - pNFS: Fix disk addr range check in block/scsi layout (Sergey Bashirov)
  - pNFS: Fix stripe mapping in block/scsi layout (Sergey Bashirov)
  - block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (John Garry) [Orabug: 38429192] {CVE-2025-39795}
  - net: phy: smsc: add proper reset flags for LAN8710A (Csaba Buday)
  - ipmi: Fix strcpy source and destination the same (Corey Minyard)
  - kconfig: lxdialog: fix 'space' to (de)select options (Yann E. MORIN)
  - kconfig: gconf: fix potential memory leak in renderer_edited() (Masahiro Yamada)
  - kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() (Masahiro Yamada)
  - ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Breno Leitao)
  - scsi: aacraid: Stop using PCI_IRQ_AFFINITY (John Garry)
  - scsi: target: core: Generate correct identifiers for PR OUT transport IDs (Maurizio Lombardi)
  - scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (Ranjan Kumar)
  - kconfig: nconf: Ensure null termination where strncpy is used (Shankari Anand)
  - kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c (Suchit Karunakaran)
  - i2c: Force DLL0945 touchpad i2c freq to 100khz (Fangzhong Zhou)
  - dm-mpath: don't print the "loaded" message if registering fails (Mikulas Patocka)
  - i3c: don't fail if GETHDRCAP is unsupported (Wolfram Sang)
  - rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 (Meagan Lloyd)
  - i3c: add missing include to internal header (Wolfram Sang)
  - md: dm-zoned-target: Initialize return variable r to avoid uninitialized use (Purva Yeshi)
  - crypto: octeontx2 - add timeout for load_fvc completion poll (Bharat Bhushan)
  - media: uvcvideo: Fix bandwidth issue for Alcor camera (Chenchangcheng)
  - media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394879] {CVE-2025-38693}
  - media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394886] {CVE-2025-38694}
  - media: usb: hdpvr: disable zero-length read messages (Wolfram Sang)
  - media: tc358743: Increase FIFO trigger level to 374 (Dave Stevenson)
  - media: tc358743: Return an appropriate colorspace from tc358743_set_fmt (Dave Stevenson)
  - media: tc358743: Check I2C succeeded during probe (Dave Stevenson)
  - pinctrl: stm32: Manage irq affinity settings (Cheick Traore)
  - scsi: mpt3sas: Correctly handle ATA device errors (Damien Le Moal)
  - scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug: 38394893] {CVE-2025-38695}
  - RDMA/core: reduce stack using in nldev_stat_get_doit() (Arnd Bergmann)
  - RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423285] {CVE-2025-39742}
  - leds: leds-lp50xx: Handle reg to get correct multi_index (Johan Adolfsson)
  - media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control (Niklas Söderlund)
  - MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh)
  - jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte)
  - jfs: Regular file corruption check (Edward Adam Davis)
  - jfs: truncate good inode pages when hard link is 0 (Lizhi Xu)
  - scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394923] {CVE-2025-38699}
  - watchdog: iTCO_wdt: Report error if timeout configuration fails (Ziyan Fu)
  - MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} (Shiji Yang)
  - watchdog: dw_wdt: Fix default timeout (Sebastian Reichel)
  - fs/orangefs: use snprintf() instead of sprintf() (Amir Mohammad Jahangirzad)
  - scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated (Showrya M N) [Orabug: 38394930] {CVE-2025-38700}
  - ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394936] {CVE-2025-38701}
  - crypto: hisilicon/hpre - fix dma unmap sequence (Zhiqi Song)
  - cifs: Fix calling CIFSFindFirst() for root path without msearch (Pali Rohár)
  - watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition (Aaron Plattner)
  - vhost: fail early when __vhost_add_used() fails (Jason Wang)
  - net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 (Álvaro Fernández Rojas)
  - drm/ttm: Respect the shrinker core free target (Tvrtko Ursulin)
  - uapi: in6: restore visibility of most IPv6 socket options (Jakub Kicinski)
  - drm/ttm: Should to return the evict error (Emily Deng)
  - net: ncsi: Fix buffer overflow in fetching version id (Hari Kalavakunta)
  - wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() (Thomas Fourier)
  - net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 (Álvaro Fernández Rojas)
  - net: dsa: b53: prevent DIS_LEARNING access on BCM5325 (Álvaro Fernández Rojas)
  - net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 (Álvaro Fernández Rojas)
  - net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 (Álvaro Fernández Rojas)
  - gve: Return error for unknown admin queue command (Alok Tiwari)
  - net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs (Gal Pressman)
  - drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual (Mario Limonciello)
  - dpaa_eth: don't use fixed_phy_change_carrier (Heiner Kallweit)
  - wifi: iwlegacy: Check rate_idx range after addition (Stanislaw Gruszka)
  - netmem: fix skb_frag_address_safe with unreadable skbs (Mina Almasry)
  - wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. (Thomas Fourier)
  - drm/amd/display: Fix 'failed to blank crtc!' (Wen Chen)
  - wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect (Anjaneyulu)
  - wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() (Rand Deeb)
  - drm/amd/display: Separate set_gsl from set_gsl_source_select (Ilya Bakoulin)
  - net: fec: allow disable coalescing (Jonas Rebmann)
  - net: atlantic: add set_power to fw_ops for atl2 to fix wol (Eric Work)
  - net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() (Jianrong Zhang)
  - drm/msm: use trylock for debugfs (Rob Clark)
  - ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in __ipv6_dev_mc_inc(). (Kuniyuki Iwashima)
  - (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer (Thomas Fourier)
  - wifi: mac80211: don't complete management TX on SAE commit (Johannes Berg)
  - s390/stp: Remove udelay from stp_sync_clock() (Sven Schnelle)
  - wifi: iwlwifi: mvm: fix scan request validation (Avraham Stern)
  - sched/deadline: Fix accounting after global limits change (Juri Lelli)
  - net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() (Alok Tiwari)
  - net: ipv4: fix incorrect MTU in broadcast routes (Oscar Maes)
  - wifi: cfg80211: Fix interface type validation (Ilan Peer)
  - net: mctp: Prevent duplicate binds (Matt Johnston)
  - rcu: Protect ->defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423340] {CVE-2025-39749}
  - arm64: Mark kernel as tainted on SAE and SError panic (Breno Leitao)
  - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Leon Romanovsky)
  - net: ag71xx: Add missing check after DMA map (Thomas Fourier)
  - et131x: Add missing check after DMA map (Thomas Fourier)
  - be2net: Use correct byte order and format string for TCP seq and ack_seq (Alok Tiwari)
  - s390/time: Use monotonic clock in get_cycles() (Sven Schnelle)
  - wifi: cfg80211: reject HTC bit for management frames (Johannes Berg)
  - ktest.pl: Prevent recursion of default variable options (Steven Rostedt)
  - xen/netfront: Fix TX response spurious interrupts (Anthoine Bourgeois)
  - ASoC: codecs: rt5640: Retry DEVICE_ID verification (Xinxin Wan)
  - iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement (Jonathan Santos)
  - ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros (Cristian Ciocaltea)
  - ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop (Christophe Leroy)
  - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun)
  - platform/chrome: cros_ec_typec: Defer probe on missing EC parent (Tomasz Michalec)
  - platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches (Kees Cook)
  - pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() (Gautham R. Shenoy)
  - usb: core: usb_submit_urb: downgrade type check (Oliver Neukum)
  - usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present (Tomasz Michalec)
  - ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (Peter Ujfalusi) [Orabug: 38394977] {CVE-2025-38706}
  - ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 (Alok Tiwari)
  - ASoC: hdac_hdmi: Rate limit logging on connection and disconnection (Mark Brown)
  - x86/bugs: Avoid warning when overriding return thunk (Pawan Gupta)
  - mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() (Ulf Hansson)
  - reset: brcmstb: Enable reset drivers for ARCH_BCM2835 (Peter Robinson)
  - pps: clients: gpio: fix interrupt handling order in remove path (Eliav Farber)
  - ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (Breno Leitao)
  - mmc: sdhci-msm: Ensure SD card power isn't ON when card removed (Sarthak Garg)
  - ACPI: processor: fix acpi_object initialization (Sebastian Ott)
  - PM: sleep: console: Fix the black screen issue (Tuhaowen)
  - thermal: sysfs: Return ENODATA instead of EAGAIN for reads (Hsin-Te Yuan)
  - PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() (Rafael J. Wysocki)
  - ACPI: PRM: Reduce unnecessary printing to avoid user confusion (Zhu Qiyu)
  - selftests: tracing: Use mutex_unlock for testing glob filter (Masami Hiramatsu)
  - ARM: tegra: Use I/O memcpy to write to IRAM (Aaron Kling)
  - gpio: tps65912: check the return value of regmap_update_bits() (Bartosz Golaszewski)
  - tools/nolibc: define time_t in terms of __kernel_old_time_t (Thomas Weißschuh)
  - thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required (David Collins)
  - ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed (Kuninori Morimoto)
  - EDAC/synopsys: Clear the ECC counters on init (Shubhrajyoti Datta)
  - PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() (Lifeng Zheng)
  - ARM: rockchip: fix kernel hang during smp initialization (Alexander Kochetkov)
  - cpufreq: Exit governor when failed to start old governor (Lifeng Zheng)
  - gpio: wcd934x: check the return value of regmap_update_bits() (Bartosz Golaszewski)
  - usb: xhci: Avoid showing errors during surprise removal (Mario Limonciello)
  - usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command (Jay Chen)
  - usb: xhci: Avoid showing warnings for dying controller (Mario Limonciello)
  - usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default (Benson Leung)
  - selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t (Cynthia Huang)
  - cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag (Prashant Malani)
  - usb: xhci: print xhci->xhc_state when queue_command failed (Su Hui)
  - securityfs: don't pin dentries twice, once is enough... (Al Viro)
  - ext2: Handle fiemap on empty files to prevent EINVAL (Wei Gao)
  - fs/ntfs3: correctly create symlink for relative path (Rong Zhang)
  - fs/ntfs3: Add sanity check for file name (Lizhi Xu)
  - ata: libata-sata: Disallow changing LPM state if not supported (Damien Le Moal)
  - better lockdep annotations for simple_recursive_removal() (Al Viro)
  - hfs: fix not erasing deleted b-tree node issue (Viacheslav Dubeyko)
  - drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394994] {CVE-2025-38708}
  - udf: Verify partition map count (Jan Kara)
  - smb/server: avoid deadlock when linking with ReplaceIfExists (Neil Brown)
  - arm64: Handle KCOV __init vs inline mismatches (Kees Cook)
  - hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa)
  - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko)
  - hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko)
  - hfs: fix slab-out-of-bounds in hfs_bnode_read() (Viacheslav Dubeyko)
  - ptp: prevent possible ABBA deadlock in ptp_clock_freerun() (Jeongjun Park)
  - intel_idle: Allow loading ACPI tables for any family (Len Brown)
  - sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395058] {CVE-2025-38718}
  - netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395066] {CVE-2025-38721}
  - udp: also consider secpath when evaluating ipsec use for checksumming (Sabrina Dubroca)
  - ACPI: processor: perflib: Move problematic pr->performance check (Rafael J. Wysocki)
  - ACPI: processor: perflib: Fix initial _PPC limit application (Jiayi Li)
  - Documentation: ACPI: Fix parent device references (Andy Shevchenko)
  - eventpoll: Fix semi-unbounded recursion (Jann Horn) [Orabug: 38335161] {CVE-2025-38614}
  - fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423396] {CVE-2025-39756}
  - sunvdc: Balance device refcount in vdc_port_mpgroup_check (Ma Ke)
  - NFSD: detect mismatch of file handle and delegation stateid in OPEN op (Dai Ngo)
  - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395080] {CVE-2025-38724}
  - net: usb: asix_devices: add phy_mask for ax88772 mdio bus (Xu Yang) [Orabug: 38395088] {CVE-2025-38725}
  - net: dpaa: fix device leak when querying time stamp info (Johan Hovold)
  - net: gianfar: fix device leak when querying time stamp info (Johan Hovold)
  - gpio: virtio: Fix config space reading. (Harald Mommer)
  - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423406] {CVE-2025-39757}
  - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395100] {CVE-2025-38729}
  - io_uring: don't use int for ABI (Pavel Begunkov)
  - usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue) [Orabug: 38334897] {CVE-2025-38555}
  - mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery (Andy Shevchenko)
  - MIPS: mm: tlb-r4k: Uniquify TLB entries on init (Jiaxun Yang)
  - ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() (Thorsten Blum)
  - net: usbnet: Fix the wrong netif_carrier_on() call (Ammar Faizi)
  - net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (John Ernberg)
  - USB: serial: option: add Foxconn T99W709 (Slark Xiao)
  - net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351763] {CVE-2025-38617}
  - selftests/perf_events: Add a mmap() correctness test (Lorenzo Stoakes)
  - perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334947] {CVE-2025-38563}
  - perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334957] {CVE-2025-38565}
  - perf/core: Don't leak AUX buffer refcount on allocation failure (Thomas Gleixner)
  - pptp: fix pptp_xmit() error path (Eric Dumazet)
  - smb: client: let recv_done() cleanup before notifying the callers. (Stefan Metzmacher)
  - smb: server: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
  - smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection (Stefan Metzmacher)
  - smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
  - smb: server: remove separate empty_recvmsg_queue (Stefan Metzmacher)
  - ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() (Takashi Iwai)
  - net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351785] {CVE-2025-38622}
  - ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334987] {CVE-2025-38572}
  - net/mlx5: Correctly set gso_segs when LRO is used (Christoph Paasch)
  - pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335003] {CVE-2025-38574}
  - phy: mscc: Fix parsing of unicast frames (Horatiu Vultur)
  - netpoll: prevent hanging NAPI when netcons gets enabled (Jakub Kicinski)
  - NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY (Benjamin Coddington)
  - XArray: Add calls to might_alloc() (Matthew Wilcox)
  - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401744] {CVE-2025-39730}
  - pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Tigran Mkrtchyan)
  - PCI: pnv_php: Fix surprise plug detection and recovery (Timothy Pearson)
  - powerpc/eeh: Make EEH driver device hotplug safe (Timothy Pearson)
  - powerpc/eeh: Rely on dev->link_active_reporting (Maciej W. Rozycki)
  - powerpc/eeh: Export eeh_unfreeze_pe() (Timothy Pearson)
  - PCI: pnv_php: Work around switches with broken presence detection (Timothy Pearson)
  - PCI: pnv_php: Clean up allocated IRQs on unplug (Timothy Pearson)
  - kconfig: qconf: fix ConfigList::updateListAllforAll() (Masahiro Yamada)
  - scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume (Seunghui Lee)
  - scsi: mpt3sas: Fix a fw_event memory leak (Tomas Henzl)
  - f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu)
  - f2fs: fix to avoid panic in f2fs_evict_inode (Chao Yu)
  - f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu)
  - f2fs: doc: fix wrong quota mount option description (Chao Yu)
  - f2fs: fix KMSAN uninit-value in extent_info usage (Abinash Singh)
  - rtc: rv3028: fix incorrect maximum clock rate handling (Brian Masney)
  - rtc: pcf8563: fix incorrect maximum clock rate handling (Brian Masney)
  - rtc: pcf85063: fix incorrect maximum clock rate handling (Brian Masney)
  - rtc: hym8563: fix incorrect maximum clock rate handling (Brian Masney)
  - rtc: ds1307: fix incorrect maximum clock rate handling (Brian Masney)
  - ucount: fix atomic_long_inc_below() argument type (Uros Bizjak)
  - module: Restore the moduleparam prefix length check (Petr Pavlu)
  - apparmor: ensure WB_HISTORY_SIZE value is a power of 2 (Ryan Lee)
  - bpf: Check flow_dissector ctx accesses are aligned (Paul Chaignon)
  - mtd: rawnand: atmel: set pmecc data setup time (Balamanikandan Gunasundar)
  - mtd: rawnand: rockchip: Add missing check after DMA map (Thomas Fourier)
  - mtd: rawnand: atmel: Fix dma_mapping_error() address (Thomas Fourier)
  - jfs: fix metapage reference count leak in dbAllocCtl (Zheng Yu)
  - fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (Chenyuan Yang)
  - crypto: qat - fix seq_file position update in adf_ring_next() (Giovanni Cabiddu)
  - sh: Do not use hyphen in exported variable name (Ben Hutchings)
  - dmaengine: nbpfaxi: Add missing check after DMA map (Thomas Fourier)
  - dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (Thomas Fourier)
  - fs/orangefs: Allow 2 more characters in do_c_string() (Dan Carpenter)
  - PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute (Manivannan Sadhasivam)
  - soundwire: stream: restore params when prepare ports fail (Bard Liao)
  - crypto: img-hash - Fix dma_unmap_sg() nents value (Thomas Fourier)
  - crypto: keembay - Fix dma_unmap_sg() nents value (Thomas Fourier)
  - hwrng: mtk - handle devm_pm_runtime_enable errors (Ovidiu Panait)
  - watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (Dan Carpenter)
  - scsi: isci: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - scsi: mvsas: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - clk: sunxi-ng: v3s: Fix de clock definition (Paul Kocialkowski)
  - perf tests bp_account: Fix leaked file descriptor (Leo Yan)
  - kernel: trace: preemptirq_delay_test: use offstack cpu mask (Arnd Bergmann)
  - RDMA/hns: Fix -Wframe-larger-than issue (Junxian Huang)
  - crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong)
  - crypto: inside-secure - Fix `dma_unmap_sg()` nents value (Thomas Fourier)
  - perf sched: Fix memory leaks for evsel->priv in timehist (Namhyung Kim)
  - clk: clk-axi-clkgen: fix fpfd_max frequency for zynq (Nuno Sa)
  - pinctrl: sunxi: Fix memory leak on krealloc failure (Yuan Chen)
  - PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails (Jerome Brunet)
  - power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (Charles Han)
  - power: supply: cpcap-charger: Fix null check for power_supply_get_by_name (Charles Han)
  - clk: xilinx: vcu: unregister pll_post only if registered correctly (Rohit Visavalia)
  - media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check (James Cowgill)
  - clk: davinci: Add NULL check in davinci_lpsc_clk_register() (Henry Martin)
  - mtd: fix possible integer overflow in erase_xfer() (Ivan Stepchenko)
  - crypto: marvell/cesa - Fix engine load inaccuracy (Herbert Xu)
  - PCI: rockchip-host: Fix "Unexpected Completion" log message (Hans Zhang)
  - vrf: Drop existing dst reference in vrf_ip6_input_dst (Stanislav Fomichev)
  - selftests: rtnetlink.sh: remove esp4_offload after test (Xiumei Mu)
  - netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351853] {CVE-2025-38639}
  - can: kvaser_usb: Assign netdev.dev_port based on device channel index (Jimmy Assarsson)
  - can: kvaser_pciefd: Store device channel index (Jimmy Assarsson)
  - wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (Gokul Sivakumar)
  - Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Remi Pommarel)
  - wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() (Remi Pommarel)
  - wifi: mac80211: Don't call fq_flow_idx() for management frames (Alexander Wetzel)
  - mwl8k: Add missing check after DMA map (Thomas Fourier)
  - wifi: rtl8xxxu: Fix RX skb size for aggregation disabled (Martin Kaistra)
  - xen/gntdev: remove struct gntdev_copy_batch from stack (Juergen Gross)
  - net_sched: act_ctinfo: use atomic64_t for three counters (Eric Dumazet)
  - net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug: 38331465] {CVE-2025-38553}
  - um: rtc: Avoid shadowing err in uml_rtc_start() (Tiwei Bie)
  - arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX (Johan Korsnes)
  - drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (Fedor Pchelkin)
  - m68k: Don't unregister boot console needlessly (Finn Thain)
  - net/mlx5: Check device memory pointer before usage (Stav Aviram) [Orabug: 38351877] {CVE-2025-38645}
  - tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range (Xin Guo)
  - wifi: ath11k: clear initialized flag for deinit-ed srng lists (Sergey Senozhatsky) [Orabug: 38335105] {CVE-2025-38601}
  - iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335109] {CVE-2025-38602}
  - wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (Xiu Jianfeng)
  - wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335118] {CVE-2025-38604}
  - caif: reduce stack size, again (Arnd Bergmann)
  - bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure (Yuan Chen)
  - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335130] {CVE-2025-38608}
  - bpf, sockmap: Fix psock incorrectly pointing to sk (Jiayuan Chen)
  - drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed (Andy Yan)
  - selftests/tracing: Fix false failure of subsystem event test (Steven Rostedt)
  - staging: nvec: Fix incorrect null termination of battery manufacturer (Alok Tiwari)
  - samples: mei: Fix building on musl libc (Brahmajit Das)
  - cpufreq: Init policy->rwsem before it may be possibly used (Lifeng Zheng)
  - cpufreq: Initialize cpufreq-based frequency-invariance later (Lifeng Zheng)
  - cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode (Rafael J. Wysocki)
  - PM / devfreq: Check governor before using governor->name (Lifeng Zheng) [Orabug: 38335134] {CVE-2025-38609}
  - arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed (Adam Ford)
  - arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed (Adam Ford)
  - ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface (Annette Kobou)
  - arm: dts: ti: omap: Fixup pinheader typo (Albin Törnqvist)
  - usb: early: xhci-dbc: Fix early_ioremap leak (Lucas De Marchi)
  - Revert "vmci: Prevent the dispatching of uninitialized payloads" (Greg Kroah-Hartman)
  - pps: fix poll support (Denis Osterland-Heim)
  - vmci: Prevent the dispatching of uninitialized payloads (Lizhi Xu)
  - staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal)
  - usb: misc: apple-mfi-fastcharge: Make power supply names unique (Charalampos Mitrodimas)
  - ARM: dts: vfxxx: Correctly use two tuples for timer address (Krzysztof Kozlowski)
  - selftests: Fix errno checking in syscall_user_dispatch test (Dmitry Vyukov)
  - Revert "fs/ntfs3: Replace inode_trylock with inode_lock" (Konstantin Komarov)
  - hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li)
  - fs_context: fix parameter name in infofc() macro (Rubenkelevra)
  - ASoC: Intel: fix SND_SOC_SOF dependencies (Arnd Bergmann)
  - ethernet: intel: fix building with large NR_CPUS (Arnd Bergmann)
  - usb: phy: mxs: disconnect line when USB charger is attached (Xu Yang)
  - usb: chipidea: add USB PHY event (Xu Yang)
  - ALSA: hda: Add missing NVIDIA HDA codec IDs (Daniel Dadap)
  - comedi: comedi_test: Fix possible deletion of uninitialized timers (Ian Abbott)
  - jfs: reject on-disk inodes of an unsupported type (Dmitry Antipov)
  - usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach (Rd Babiera)
  - usb: typec: tcpm: allow switching to mode accessory to mux properly (Michael Grzeschik)
  - usb: typec: tcpm: allow to use sink in accessory mode (Michael Grzeschik)
  - mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n (Harry Yoo)
  - nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi)
  - gve: Fix stuck TX queue for DQ queue format (Praveen Kaligineedi)
  - e1000e: ignore uninitialized checksum word on tgp (Jacek Kowalski)
  - e1000e: disregard NVM checksum on tgp when valid checksum bit is not set (Jacek Kowalski)
  - dpaa2-switch: Fix device reference count leak in MAC endpoint handling (Ma Ke)
  - dpaa2-eth: Fix device reference count leak in MAC endpoint handling (Ma Ke)
  - ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx (Dawid Rezler)
  - bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() (Ma Ke)
  - i2c: virtio: Avoid hang by using interruptible completion wait (Viresh Kumar)
  - i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351993] {CVE-2025-38671}
  - platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots (Rongrong)
  - net: hns3: fixed vf get max channels bug (Jian Shen)
  - net: hns3: disable interrupt when ptp init failed (Yonglong Liu)
  - net: hns3: fix concurrent setting vlan filter issue (Jian Shen)
  - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei)
  - net: appletalk: Fix use-after-free in AARP proxy probe (Kito Xu)
  - i40e: report VF tx_dropped with tx_errors instead of tx_discards (Dennis Chen)
  - i40e: Add rx_missed_errors for buffer exhaustion (Yajun Deng)
  - regmap: fix potential memory leak of regmap_bus (Abdun Nihaal)
  - interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node (Xilin Wu)
  - RDMA/core: Rate limit GID cache warning messages (Maor Gottlieb)
  - regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati) [Orabug: 38351977] {CVE-2025-38668}
  - Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT (Fabrice Gasnier) [Orabug: 38180692] {CVE-2025-38335}
  - platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
  - powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
  - mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
  - ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
  - usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
  - usb: musb: fix gadget state on disconnect (Drew Hamilton)
  - usb: musb: Add and use inline functions musb_{get,set}_state (Paul Cercueil)
  - usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
  - usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
  - usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
  - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254213] {CVE-2025-38468}
  - net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
  - net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254224] {CVE-2025-38470}
  - Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
  - ipv6: mcast: Delay put pmc->idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324326] {CVE-2025-38550}
  - net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
  - Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
  - Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
  - Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254240] {CVE-2025-38473}
  - usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254248] {CVE-2025-38474}
  - hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann)
  - selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
  - selftests: udpgro: report error when receive failed (Hangbin Liu)
  - nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
  - smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong)
  - pinctrl: mediatek: moore: check if pin_desc is valid before use (Sam Shih)
  - rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima)
  - net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254265] {CVE-2025-38477}
  - net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
  - bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324226] {CVE-2025-38528}
  - comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott)
  - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott)
  - comedi: Fix some signed shift left operations (Ian Abbott)
  - comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott)
  - comedi: das6402: Fix bit shift out of bounds (Ian Abbott)
  - comedi: das16m1: Fix bit shift out of bounds (Ian Abbott)
  - comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott)
  - comedi: pcl812: Fix bit shift out of bounds (Ian Abbott)
  - iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
  - iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
  - iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
  - soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
  - soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
  - pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
  - mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
  - mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
  - mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
  - isofs: Verify inode mode when loading from disk (Jan Kara)
  - dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter)
  - af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
  - af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
  - phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
  - tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324269] {CVE-2025-38539}
  - HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
  - pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
  - thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
  - i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
  - usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254357] {CVE-2025-38497}
  - USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
  - USB: serial: option: add Foxconn T99W640 (Slark Xiao)
  - USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
  - phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324257] {CVE-2025-38535}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-314.193.4.el9uek]
changelog:
  - af_unix: Don't leave consecutive consumed OOB skbs. (Kuniyuki Iwashima) [Orabug: 38528187] {CVE-2025-38236}
  - Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" (Tariq Toukan)
  - NFSv4: Don't clear capabilities that won't be reset (Trond Myklebust)
  - soc: qcom: mdt_loader: Deal with zero e_shentsize (Bjorn Andersson)
  - cpufreq: Initialize cpufreq-based invariance before subsys (Christian Loehle)
  - tracing: Do not add length to print format in synthetic events (Steven Rostedt)
  - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Tigran Mkrtchyan)
  - drm/amdgpu: fix a memory leak in fence cleanup when unloading (Alex Deucher)
  - rtnetlink: Fix L3 stats disable handling in rtnl_offload_xstats_fill() (Vijayendra Suman) [Orabug: 38511910]
  - Revert "md/raid10: fix missing discard IO accounting" (Richard Li) [Orabug: 38483693]
  - uek: kabi: Update check-kabi to support namespace checks (Saeed Mirzamohammadi) [Orabug: 38459104]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-314.193.5.el9uek]
changelog:
  - Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (Jakub Kicinski) [Orabug: 38545203]
  - uek-rpm/config-aarch64: Enable configs for Grace platform support (Vijay Kumar) [Orabug: 38526393]
  - uek-rpm: mips: Enable CONFIG_TRANSPARENT_HUGEPAGE (Henry Willard) [Orabug: 38526762]
  - crypto: ccp - Add support for PCI device 0x17D8 (John Allen) [Orabug: 38332429]
  - x86/CPU/AMD: Add X86_FEATURE_ZEN6 (Yazen Ghannam) [Orabug: 38332429]
  - x86/cpufeatures: Free up unused feature bits (Sohil Mehta) [Orabug: 38332429]
  - x86/CPU/AMD: Rename init_amd_zn() to init_amd_zen_common() (Borislav Petkov) [Orabug: 38332429]
  - x86/CPU/AMD: Call the spectral chicken in the Zen2 init function (Borislav Petkov) [Orabug: 38332429]
  - x86/CPU/AMD: Move erratum 1076 fix into the Zen1 init function (Borislav Petkov) [Orabug: 38332429]
  - x86/CPU/AMD: Move the Zen3 BTC_NO detection to the Zen3 init function (Borislav Petkov) [Orabug: 38332429]
  - x86/CPU/AMD: Carve out the erratum 1386 fix (Borislav Petkov) [Orabug: 38332429]
  - x86/CPU/AMD: Add X86_FEATURE_ZEN5 (Borislav Petkov) [Orabug: 38332429]
  - rds: Free all frags when rds_ib_recv_cache_put() fails (Hans Westgaard Ry) [Orabug: 38492233]
  - cpufreq: CPPC: Fix unused-function warning (Pierre Gondois) [Orabug: 38471683]
  - PM: EM: Add .get_cost() callback (Lukasz Luba) [Orabug: 38471683]
  - PM: EM: add macro to set .active_power() callback conditionally (Lukasz Luba) [Orabug: 38471683]
  - cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (Beata Michalska) [Orabug: 38471683]
  - cpufreq: update to sysfs_emit() for safer buffer handling (Perry Yuan) [Orabug: 38471683]
  - cpufreq: Optimize cpufreq_show_cpus() (Viresh Kumar) [Orabug: 38471683]
  - PCI: Use downstream bridges for distributing resources (Kai-Heng Feng) [Orabug: 38471683]
  - PCI: Distribute available resources for root buses, too (Mika Westerberg) [Orabug: 38471683]
  - PCI: Move pci_assign_unassigned_root_bus_resources() (Mika Westerberg) [Orabug: 38471683]
  - cppc_cpufreq: Remove HiSilicon CPPC workaround (Jie Zhan) [Orabug: 38471683]
  - cpufreq: remove useless INIT_LIST_HEAD() (Han Wang) [Orabug: 38471683]
  - cpufreq/cppc: Don't compare desired_perf in target() (Riwen Lu) [Orabug: 38471683]
  - cpufreq/cppc: Move and rename cppc_cpufreq_{perf_to_khz|khz_to_perf}() (Vincent Guittot) [Orabug: 38471683]
  - cpufreq: CPPC: Register EM based on efficiency class information (Pierre Gondois) [Orabug: 38471683]
  - cpufreq: CPPC: Enable fast_switch (Pierre Gondois) [Orabug: 38471683]
  - i2c: tegra: check msg length in SMBUS block read (Akhil R) [Orabug: 38254038,38471683] {CVE-2025-38425}
  - PCI/ACS: Fix 'pci=config_acs=' parameter (Tushar Dave) [Orabug: 38471683]
  - RDMA/mlx5: Add support to multi-plane device and port (Mark Zhang) [Orabug: 38471683]
  - net/mlx5: mlx5_ifc update for multi-plane support (Mark Zhang) [Orabug: 38471683]
  - RDMA/core: Create "issm*" device nodes only when SMI is supported (Mark Zhang) [Orabug: 38471683]
  - RDMA/mlx5: Limit usage of over-sized mkeys from the MR cache (Michael Guralnik) [Orabug: 38471683]
  - RDMA/mlx5: Fix counter update on MR cache mkey creation (Michael Guralnik) [Orabug: 38471683]
  - RDMA/mlx5: Enable ATS when allocating kernel MRs (Maher Sanalla) [Orabug: 38471683]
  - ACPI: PRM: Remove unnecessary strict handler address checks (Aubrey Li) [Orabug: 38471683]
  - ACPI/HMAT: Move HMAT messages to pr_debug() (Dan Williams) [Orabug: 38471683]
  - ACPI: HMAT: Drop unused dev_fmt() and redundant 'HMAT' prefix (Liu Shixin) [Orabug: 38471683]
  - perf: arm_cspmu: nvidia: monitor all ports by default (Besar Wicaksono) [Orabug: 38471683]
  - perf: arm_cspmu: nvidia: enable NVLINK-C2C port filtering (Besar Wicaksono) [Orabug: 38471683]
  - perf: arm_cspmu: nvidia: fix sysfs path in the kernel doc (Besar Wicaksono) [Orabug: 38471683]
  - perf: arm_cspmu: nvidia: remove unsupported SCF events (Besar Wicaksono) [Orabug: 38471683]
  - device-dax: correct pgoff align in dax_set_mapping() (Kun(Llfl)) [Orabug: 37206403] {CVE-2024-50022}
  - vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages() (Yishai Hadas) [Orabug: 37434467] {CVE-2024-56742}
  - sched/fair: add opt-in knob to use runnable_avg in wakeup fast path (Daniel Jordan) [Orabug: 38404517]
  - RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad) [Orabug: 38225626]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-314.193.5.1.el9uek]
changelog:
  - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers)  [Orabug: 38575804]
  - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu)  [Orabug: 38575804]  {CVE-2025-39964}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-314.193.5.2.el9uek]
changelog:
  - i40e: add validation for ring_len param (Lukasz Czapnik)  [Orabug: 38607608]  {CVE-2025-39973}
  - i40e: increase max descriptors for XL710 (Justin Bronder)  [Orabug: 38607608]
  - uek-rpm: Enable CONFIG_COMPAT_32BIT_TIME for x86 container kernel (Boris Ostrovsky)  [Orabug: 38607625]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-314.193.5.3.el9uek]
changelog:
  - Revert "cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry" (Samasth Norway Ananda)  [Orabug: 38633525]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-314.193.5.4.el9uek]
changelog:
  - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence (Will Deacon)  [Orabug: 38513233]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-314.193.5.5.el9uek]
changelog:
  - crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu)  [Orabug: 38705933]  {CVE-2025-40019}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-314.193.3.el9uek]
changelog:
  - LTS version: v5.15.193 (Vijayendra Suman)
  - LTS version: v5.15.192 (Vijayendra Suman)
  - dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
  - spi: tegra114: Use value to check for invalid delays (Aaron Kling)
  - clk: qcom: gdsc: Set retain_ff before moving to HW CTRL (Taniya Das)
  - perf bpf-event: Fix use-after-free in synthesis (Ian Rogers)
  - drm/bridge: ti-sn65dsi86: fix REFCLK setting (Michael Walle)
  - spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort (Larisa Grigore)
  - spi: spi-fsl-lpspi: Set correct chip-select polarity bit (Larisa Grigore)
  - spi: spi-fsl-lpspi: Fix transmissions when using CONT (Larisa Grigore)
  - pcmcia: Add error handling for add_interval() in do_validate_mem() (Xu Wang)
  - ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model (Takashi Iwai)
  - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Li Qiong) [Orabug: 38494760] {CVE-2025-39902}
  - randstruct: gcc-plugin: Fix attribute addition (Kees Cook)
  - randstruct: gcc-plugin: Remove bogus void member (Kees Cook)
  - arm64: dts: marvell: uDPU: define pinctrl state for alarm LEDs (Gabor Juhos)
  - vmxnet3: update MTU after device quiesce (Ronak Doshi)
  - net: dsa: microchip: linearize skb for tail-tagging switches (Jakob Unterwurzacher)
  - net: dsa: microchip: update tag_ksz masks for KSZ9477 family (Pieter Van Trappen)
  - dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
  - dma-buf: insert memory barrier before updating num_fences (Hyejeong Choi) [Orabug: 38152833] {CVE-2025-38095}
  - gpio: pca953x: fix IRQ storm on system wake up (Emanuele Ghidoli)
  - iio: light: opt3001: fix deadlock due to concurrent flag access (Luca Ceresoli) [Orabug: 37977027] {CVE-2025-37968}
  - iio: chemical: pms7003: use aligned_s64 for timestamp (David Lechner)
  - spi: tegra114: Don't fail set_cs_timing when delays are zero (Aaron Kling)
  - spi: tegra114: Remove unnecessary NULL-pointer checks (Alexander Danilenko)
  - KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer (Sean Christopherson) [Orabug: 38494247]
  - cpufreq/sched: Explicitly synchronize limits_changed flag handling (Rafael J. Wysocki)
  - mm/khugepaged: fix ->anon_vma race (Jann Horn)
  - e1000e: fix heap overflow in e1000_set_eeprom (Vitaly Lifshits)
  - batman-adv: fix OOB read/write in network-coding decode (Stanislav Fort)
  - scsi: lpfc: Fix buffer free/clear order in deferred receive path (John Evans) [Orabug: 38456753] {CVE-2025-39841}
  - drm/amdgpu: drop hw access in non-DC audio fini (Alex Deucher)
  - wifi: mwifiex: Initialize the chan_stats array to zero (Rong Qianfeng) [Orabug: 38494722] {CVE-2025-39891}
  - mm: move page table sync declarations to linux/pgtable.h (Harry Yoo) [Orabug: 38456763] {CVE-2025-39844}
  - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Harry Yoo) [Orabug: 38456766] {CVE-2025-39845}
  - pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() (Ma Ke)
  - ALSA: usb-audio: Add mute TLV for playback volumes on some devices (Cryolitia Pukngae)
  - phy: mscc: Stop taking ts_lock for tx_queue and use its own lock (Horatiu Vultur)
  - net: phy: mscc: Fix memory leak when using one step timestamping (Horatiu Vultur) [Orabug: 38153076] {CVE-2025-38148}
  - ptp: Add generic PTP is_sync() function (Kurt Kanzenbach)
  - ppp: fix memory leak in pad_compress_skb (Qingfang Deng) [Orabug: 38456780] {CVE-2025-39847}
  - net: atm: fix memory leak in atm_register_sysfs when device_register fail (Wang Liang)
  - ax25: properly unshare skbs in ax25_kiss_rcv() (Eric Dumazet)
  - ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() (Dan Carpenter)
  - net: thunder_bgx: decrement cleanup index before use (Rosen Penev)
  - net: thunder_bgx: add a missing of_node_put (Rosen Penev)
  - wifi: libertas: cap SSID len in lbs_associate() (Dan Carpenter)
  - wifi: cw1200: cap SSID length in cw1200_do_join() (Dan Carpenter)
  - net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets (Felix Fietkau)
  - i40e: Fix potential invalid access when MAC list is empty (Zhen Ni) [Orabug: 38456813] {CVE-2025-39853}
  - icmp: fix icmp_ndo_send address translation for reply direction (Fabian Bläse)
  - mISDN: Fix memory leak in dsp_hwec_enable() (Miaoqian Lin)
  - xirc2ps_cs: fix register access when enabling FullDuplex (Alok Tiwari)
  - Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (Kuniyuki Iwashima) [Orabug: 38456833] {CVE-2025-39860}
  - netfilter: conntrack: helper: Replace -EEXIST by -EBUSY (Phil Sutter)
  - netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (Wang Liang) [Orabug: 38494730] {CVE-2025-39894}
  - wifi: cfg80211: fix use-after-free in cmp_bss() (Dmitry Antipov) [Orabug: 38456858] {CVE-2025-39864}
  - arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro (Peter Robinson)
  - tee: fix NULL pointer dereference in tee_shm_put (Pei Xiao) [Orabug: 38456865] {CVE-2025-39865}
  - fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue) [Orabug: 38456870,38528183] {CVE-2025-39866}
  - drm/amd/display: Don't warn when missing DCE encoder caps (Timur Kristóf)
  - bpf: Fix oob access in cgroup local storage (Daniel Borkmann) [Orabug: 38324117] {CVE-2025-38502}
  - bpf: Move bpf map owner out of common struct (Daniel Borkmann)
  - bpf: Move cgroup iterator helpers to bpf.h (Daniel Borkmann)
  - bpf: Add cookie object to bpf maps (Daniel Borkmann)
  - LTS version: v5.15.191 (Vijayendra Suman)
  - xfs: do not propagate ENODATA disk errors into xattr code (Eric Sandeen) [Orabug: 38440385] {CVE-2025-39835}
  - Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" (Imre Deak)
  - HID: mcp2221: Handle reads greater than 60 bytes (Hamish Martin)
  - HID: mcp2221: Don't set bus speed on every transfer (Hamish Martin)
  - drm/nouveau/disp: Always accept linear modifier (James Jones)
  - net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
  - dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted (Shanker Donthineni)
  - Revert "drm/amdgpu: fix incorrect vm flags to map bo" (Alex Deucher) [Orabug: 38343660]
  - HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [Orabug: 38440227] {CVE-2025-39808}
  - HID: wacom: Add a new Art Pen 2 (Ping Cheng)
  - HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (Qasim Ijaz) [Orabug: 38440223] {CVE-2025-39806}
  - HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [Orabug: 38440309] {CVE-2025-39824}
  - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [Orabug: 38440276] {CVE-2025-39817}
  - sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [Orabug: 38440249] {CVE-2025-39812}
  - net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts (Rohan G Thomas)
  - net/mlx5e: Set local Xoff after FW update (Alexei Lazar)
  - net/mlx5e: Update and set Xon/Xoff upon port speed set (Alexei Lazar)
  - net/mlx5e: Update and set Xon/Xoff upon MTU set (Alexei Lazar)
  - phy: mscc: Fix when PTP clock is register and unregister (Horatiu Vultur)
  - net: dlink: fix multicast stats being counted incorrectly (Moon Yeounsu)
  - atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [Orabug: 38440345] {CVE-2025-39828}
  - Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced (Luiz Augusto von Dentz)
  - powerpc/kvm: Fix ifdef to remove build warning (Madhavan Srinivasan)
  - net: ipv4: fix regression in local-broadcast routes (Oscar Maes) [Orabug: 38343660]
  - vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() (Nikolay Kuratov)
  - NFS: Fix a race when updating an existing write (Trond Myklebust) [Orabug: 38401609] {CVE-2025-39697}
  - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (Christoph Hellwig)
  - ASoC: codecs: tx-macro: correct tx_macro_component_drv name (Alexey Klimov)
  - scsi: core: sysfs: Correct sysfs attributes access rights (Damien Le Moal)
  - ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [Orabug: 38440258] {CVE-2025-39813}
  - pinctrl: STMFX: add missing HAS_IOMEM dependency (Randy Dunlap)
  - LTS version: v5.15.190 (Vijayendra Suman)
  - alloc_fdtable(): change calling conventions. (Al Viro)
  - wifi: mac80211: check basic rates validity in sta_link_apply_parameters (Mikhail Lobanov)
  - netfilter: nf_reject: don't leak dst refcount for loopback packets (Florian Westphal) [Orabug: 38401481] {CVE-2025-38732}
  - s390/hypfs: Enable limited access during lockdown (Peter Oberparleiter)
  - s390/hypfs: Avoid unnecessary ioctl registration in debugfs (Peter Oberparleiter)
  - ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation (Takashi Iwai)
  - bonding: update LACP activity flag after setting lacp_active (Hangbin Liu)
  - net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate (William Liu)
  - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (William Liu) [Orabug: 38423456] {CVE-2025-39766}
  - ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc (Jason Xing)
  - net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization (Yuichiro Tsuji) [Orabug: 38516727] {CVE-2025-38736}
  - phy: mscc: Fix timestamping for vsc8584 (Horatiu Vultur)
  - net: phy: Use netif_rx(). (Sebastian Andrzej Siewior)
  - ppp: fix race conditions in ppp_fill_forward_path (Qingfang Deng) [Orabug: 38401500] {CVE-2025-39673}
  - ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add (Heminhong)
  - drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() (Chenyuan Yang)
  - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [Orabug: 38343660]
  - drm/hisilicon/hibmc: fix the hibmc loaded failed bug (Baihan Li) [Orabug: 38423473] {CVE-2025-39772}
  - mlxsw: spectrum: Forward packets with an IPv4 link-local source IP (Ido Schimmel)
  - iommu/amd: Avoid stack buffer overflow from kernel cmdline (Kees Cook) [Orabug: 38360925] {CVE-2025-38676}
  - scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [Orabug: 38401513] {CVE-2025-39676}
  - net: bridge: fix soft lockup in br_multicast_query_expired() (Wang Liang) [Orabug: 38423478] {CVE-2025-39773}
  - RDMA/bnxt_re: Fix to initialize the PBL array (Anantha Prabhu)
  - cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key (Waiman Long)
  - mm/page_alloc: detect allocation forbidden by cpuset and bail out early (Feng Tang)
  - x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (Tianxiang Peng) [Orabug: 38401541] {CVE-2025-39681}
  - iio: light: as73211: Ensure buffer holes are zeroed (Jonathan Cameron)
  - tracing: Limit access to parser->buffer when trace_get_user failed (Pu Lehui) [Orabug: 38401546] {CVE-2025-39683}
  - tracing: Remove unneeded goto out logic (Steven Rostedt)
  - iio: imu: inv_icm42600: change invalid data error to -EBUSY (Jean-Baptiste Maneyrol)
  - usb: xhci: Fix slot_id resource race conflict (Weitao Wang)
  - selftests: mptcp: pm: check flush doesn't reset limits (Matthieu Baerts)
  - pwm: mediatek: Fix duty and period setting (Uwe Kleine-König)
  - pwm: mediatek: Handle hardware enable and clock enable separately (Uwe Kleine-König)
  - pwm: mediatek: Implement .apply() callback (Uwe Kleine-König)
  - scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems (Ranjan Kumar)
  - scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (Ranjan Kumar)
  - scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (André Draszik)
  - iio: adc: ad_sigma_delta: change to buffer predisable (David Lechner)
  - soc: qcom: mdt_loader: Ensure we don't read past the ELF header (Bjorn Andersson) [Orabug: 38423523] {CVE-2025-39787}
  - wifi: ath11k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
  - asm-generic: Add memory barrier dma_mb() (Kefeng Wang)
  - locking/barriers, kcsan: Support generic instrumentation (Marco Elver)
  - media: venus: protect against spurious interrupts during probe (Jorge Ramirez-Ortiz)
  - media: venus: Add support for SSR trigger using fault injection (Dikshita Agarwal)
  - media: qcom: camss: cleanup media device allocated resource on error path (Sasha Levin)
  - media: camss: Convert to platform remove callback returning void (Uwe Kleine-König)
  - f2fs: fix to avoid out-of-boundary access in dnode page (Chao Yu)
  - drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS (Imre Deak)
  - mptcp: disable add_addr retransmission when timeout is 0 (Geliang Tang)
  - drm/amd/display: Don't overclock DCE 6 by 15% (Timur Kristóf)
  - usb: dwc3: Remove WARN_ON for device endpoint command timeouts (Selvarasu Ganesan) [Orabug: 38435009] {CVE-2025-39801}
  - usb: dwc3: Ignore late xferNotReady event to prevent halt timeout (Kuen-Han Tsai)
  - USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles (Zenm Chen)
  - usb: storage: realtek_cr: Use correct byte order for bcs->Residue (Thorsten Blum)
  - USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera (Mael Guerin)
  - usb: renesas-xhci: Fix External ROM access timeouts (Marek Vasut)
  - usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test (Xu Yang)
  - comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() (Ian Abbott)
  - comedi: pcl726: Prevent invalid irq number (Edward Adam Davis)
  - comedi: Make insn_rw_emulate_bits() do insn->n samples (Ian Abbott)
  - usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive (Miao Li)
  - most: core: Drop device reference after usage in get_channel() (Miaoqian Lin)
  - iio: proximity: isl29501: fix buffered read on big-endian systems (David Lechner)
  - iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() (Salah Triki)
  - ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [Orabug: 38401580] {CVE-2025-39689}
  - fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() (Xu Yilun)
  - use uniform permission checks for all mount propagation changes (Al Viro)
  - fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [Orabug: 38401586] {CVE-2025-39691}
  - drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs (Timur Kristóf)
  - drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs (Timur Kristóf)
  - drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. (Timur Kristóf)
  - drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 (Timur Kristóf)
  - drm/amd/display: Avoid a NULL pointer dereference (Mario Limonciello) [Orabug: 38401596] {CVE-2025-39693}
  - ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 (Evgeniy Harchenko)
  - mm/debug_vm_pgtable: clear page table entries at destroy_args() (Herton Ronaldo Krzesinski)
  - mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency (Victor Shih)
  - memstick: Fix deadlock by moving removing flag earlier (Jiayi Li)
  - scsi: ufs: ufs-pci: Fix default runtime and system PM levels (Adrian Hunter)
  - scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers (Archana Patni)
  - mptcp: do not queue data on closed subflows (Paolo Abeni)
  - mptcp: drop unused sk in mptcp_push_release (Geliang Tang)
  - selftests: mptcp: Initialize variables to quiet gcc 12 warnings (Mat Martineau)
  - mptcp: introduce MAPPING_BAD_CSUM (Paolo Abeni)
  - mptcp: fix error mibs accounting (Paolo Abeni)
  - selftests: mptcp: add missing join check (Matthieu Baerts)
  - selftests: mptcp: connect: also cover checksum (Matthieu Baerts)
  - selftests: mptcp: connect: also cover alt modes (Matthieu Baerts)
  - selftests: mptcp: make sendfile selftest work (Florian Westphal)
  - ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value (Li Zhong)
  - PCI: vmd: Assign VMD IRQ domain before enumeration (Nirmal Patel)
  - sch_htb: make htb_deactivate() idempotent (Cong Wang) [Orabug: 38516621] {CVE-2025-37953}
  - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Cong Wang) [Orabug: 37908491] {CVE-2025-37798}
  - sch_drr: make drr_qlen_notify() idempotent (Cong Wang)
  - btrfs: populate otime when logging an inode item (Qu Wenruo)
  - KVM: VMX: Flush shadow VMCS on emergency reboot (Chao Gao)
  - net/sched: ets: use old 'nbands' while purging unused classes (Davide Caratti) [Orabug: 38394836] {CVE-2025-38684}
  - net_sched: sch_ets: implement lockless ets_dump() (Eric Dumazet)
  - net/sched: sch_ets: properly init all active DRR list handles (Davide Caratti) [Orabug: 35290200]
  - platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() (Tzung-Bi Shih)
  - platform/chrome: cros_ec: remove unneeded label and if-condition (Tzung-Bi Shih)
  - platform/chrome: cros_ec: Use per-device lockdep key (Chen-Yu Tsai)
  - platform/chrome: cros_ec: Make cros_ec_unregister() return void (Uwe Kleine-König)
  - usb: dwc3: imx8mp: fix device leak at unbind (Johan Hovold)
  - bus: mhi: host: Detect events pointing to unexpected TREs (Youssef Samir) [Orabug: 38423539] {CVE-2025-39790}
  - ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig (Damien Le Moal)
  - usb: musb: omap2430: fix device leak at unbind (Johan Hovold)
  - usb: musb: omap2430: Convert to platform remove callback returning void (Uwe Kleine-König)
  - mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() (Anshuman Khandual)
  - NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug: 38429210] {CVE-2025-39798}
  - NFS: Create an nfs4_server_set_init_caps() function (Anna Schumaker)
  - net: enetc: fix device and OF node leak at probe (Johan Hovold)
  - block: Make REQ_OP_ZONE_FINISH a write operation (Damien Le Moal)
  - PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (Lukas Wunner)
  - usb: typec: fusb302: cache PD RX state (Sebastian Reichel)
  - hv_netvsc: Fix panic during namespace deletion with VF (Haiyang Zhang) [Orabug: 38394830] {CVE-2025-38683}
  - smb: server: Fix extension string in ksmbd_extract_shortname() (Thorsten Blum)
  - ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (Geoffrey D. Bennett)
  - x86/fpu: Delay instruction pointer fixup until after warning (Dave Hansen)
  - usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
  - usb: hub: avoid warm port reset during USB3 disconnect (Mathias Nyman)
  - x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
  - iio: hid-sensor-prox: Fix incorrect OFFSET calculation (Zhang Lixu)
  - iio: hid-sensor-prox: Restore lost scale assignments (Zhang Lixu)
  - f2fs: fix to do sanity check on ino and xnid (Chao Yu)
  - arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() (Ada Couprie Diaz) [Orabug: 38351990] {CVE-2025-38670}
  - drm/sched: Remove optimization that causes hang when killing dependent jobs (Lin Cao)
  - ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351929] {CVE-2025-38664}
  - selftests/memfd: add test for mapping write-sealed memfd read-only (Lorenzo Stoakes)
  - mm: reinstate ability to map write-sealed memfd mappings read-only (Lorenzo Stoakes)
  - mm: update memfd seal write check to include F_SEAL_WRITE (Lorenzo Stoakes)
  - mm: drop the assumption that VM_SHARED always implies writable (Lorenzo Stoakes)
  - sch_qfq: make qfq_qlen_notify() idempotent (Cong Wang)
  - sch_hfsc: make hfsc_qlen_notify() idempotent (Cong Wang) [Orabug: 38158395] {CVE-2025-38177}
  - sch_htb: make htb_qlen_notify() idempotent (Cong Wang) [Orabug: 37976859] {CVE-2025-37932}
  - mptcp: pm: kernel: flush: do not reset ADD_ADDR limit (Matthieu Baerts)
  - mptcp: drop skb if MPTCP skb extension allocation fails (Christoph Paasch)
  - ipv6: sr: Fix MAC comparison to be constant-time (Eric Biggers)
  - net, hsr: reject HSR frame if skb can't hold tag (Jakub Acs) [Orabug: 38401632] {CVE-2025-39703}
  - drm/amd/display: Don't overwrite dce60_clk_mgr (Timur Kristóf)
  - drm/amd: Restore cached power limit during resume (Mario Limonciello)
  - media: venus: venc: Clamp param smaller than 1fps and bigger than 240 (Ricardo Ribalda)
  - media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. (Ricardo Ribalda)
  - media: venus: hfi: explicitly release IRQ during teardown (Jorge Ramirez-Ortiz)
  - media: venus: Add a check for packet size after reading from shared memory (Vedang Nagar)
  - media: ov2659: Fix memory leaks in ov2659_probe() (Zhang Shurong)
  - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [Orabug: 38401676] {CVE-2025-39713}
  - media: usbtv: Lock resolution while streaming (Ludwig Disterhof) [Orabug: 38401683] {CVE-2025-39714}
  - media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() (Sakari Ailus)
  - media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (Haoxiang Li)
  - media: hi556: correct the test pattern configuration (Bingbu Cao)
  - media: gspca: Add bounds checking to firmware parser (Dan Carpenter)
  - soc/tegra: pmc: Ensure power-domains are in a known state (Jonathan Hunter)
  - jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [Orabug: 38423508] {CVE-2025-39782}
  - PCI: endpoint: Fix configfs group removal on driver teardown (Damien Le Moal)
  - PCI: endpoint: Fix configfs group list head handling (Damien Le Moal)
  - mtd: rawnand: fsmc: Add missing check after DMA map (Thomas Fourier)
  - mtd: spinand: propagate spinand_wait() errors from spinand_write_page() (Gabor Juhos)
  - hwmon: (gsc-hwmon) fix fan pwm setpoint show functions (Tim Harvey)
  - pwm: imx-tpm: Reset counter if CMOD is 0 (Laurentiu Mihalcea)
  - wifi: ath11k: fix source ring-buffer corruption (Johan Hovold)
  - wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (Nathan Chancellor)
  - zynq_fpga: use sgtable-based scatterlist wrappers (Marek Szyprowski)
  - ata: libata-scsi: Fix ata_to_sense_error() status handling (Damien Le Moal)
  - scsi: mpi3mr: Fix race between config read submit and interrupt completion (Ranjan Kumar)
  - ext4: fix hole length calculation overflow in non-extent inodes (Zhang Yi)
  - ext4: use kmalloc_array() for array space allocation (Liao Yuanhong)
  - ext4: don't try to clear the orphan_present feature block device is r/o (Theodore Ts'O)
  - ext4: fix reserved gdt blocks handling in fsmap (Ojaswin Mujoo)
  - ext4: fix fsmap end of range reporting with bigalloc (Ojaswin Mujoo)
  - ext4: check fast symlink for ea_inode correctly (Andreas Dilger)
  - lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap (Eric Biggers)
  - vt: defkeymap: Map keycodes above 127 to K_HOLE (Myrrh Periwinkle)
  - vt: keyboard: Don't process Unicode characters in K_OFF mode (Myrrh Periwinkle)
  - bus: mhi: host: Fix endianness of BHI vector table (Alexander Wilhelm)
  - usb: dwc3: meson-g12a: fix device leaks at unbind (Johan Hovold)
  - usb: gadget: udc: renesas_usb3: fix device leak at unbind (Johan Hovold)
  - usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (Nathan Chancellor)
  - m68k: Fix lost column on framebuffer debug console (Finn Thain)
  - cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (Dan Carpenter)
  - serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [Orabug: 38401728] {CVE-2025-39724}
  - HID: magicmouse: avoid setting up battery timer when not needed (Aditya Garg)
  - media: uvcvideo: Do not mark valid metadata as invalid (Ricardo Ribalda)
  - media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394815] {CVE-2025-38680}
  - mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock (Breno Leitao)
  - mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() (Waiman Long)
  - parisc: Makefile: fix a typo in palo.conf (Randy Dunlap)
  - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (Sravan Kumar Gundu) [Orabug: 38394843] {CVE-2025-38685}
  - btrfs: do not allow relocation of partially dropped subvolumes (Qu Wenruo) [Orabug: 38423271] {CVE-2025-39738}
  - btrfs: fix log tree replay failure due to file with 0 links and extents (Filipe Manana)
  - cdc-acm: fix race between initial clearing halt and open (Oliver Neukum)
  - thunderbolt: Fix copy+paste error in match_service_id() (Eric Biggers)
  - comedi: fix race between polling and detaching (Ian Abbott)
  - usb: typec: ucsi: Update power_supply on power role change (Myrrh Periwinkle)
  - misc: rtsx: usb: Ensure mmc child device is active when card is present (Ricky Wu)
  - usb: core: config: Prevent OOB read in SS endpoint companion parsing (Xinyu Liu) [Orabug: 38423420] {CVE-2025-39760}
  - ext4: fix largest free orders lists corruption on mb_optimize_scan switch (Baokun Li)
  - drm/amdgpu: fix incorrect vm flags to map bo (Jack Xiao)
  - ASoC: fsl_sai: replace regmap_write with regmap_update_bits (Shengjiu Wang)
  - ASoC: soc-dai.h: merge DAI call back functions into ops (Kuninori Morimoto)
  - ASoC: soc-dai.c: add missing flag check at snd_soc_pcm_dai_probe() (Kuninori Morimoto)
  - scsi: lpfc: Remove redundant assignment to avoid memory leak (Jiasheng Jiang)
  - rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe (Meagan Lloyd)
  - pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394865] {CVE-2025-38691}
  - pNFS: Handle RPC size limit for layoutcommits (Sergey Bashirov)
  - pNFS: Fix disk addr range check in block/scsi layout (Sergey Bashirov)
  - pNFS: Fix stripe mapping in block/scsi layout (Sergey Bashirov)
  - block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (John Garry) [Orabug: 38429192] {CVE-2025-39795}
  - net: phy: smsc: add proper reset flags for LAN8710A (Csaba Buday)
  - ipmi: Fix strcpy source and destination the same (Corey Minyard)
  - kconfig: lxdialog: fix 'space' to (de)select options (Yann E. MORIN)
  - kconfig: gconf: fix potential memory leak in renderer_edited() (Masahiro Yamada)
  - kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() (Masahiro Yamada)
  - ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Breno Leitao)
  - scsi: aacraid: Stop using PCI_IRQ_AFFINITY (John Garry)
  - scsi: target: core: Generate correct identifiers for PR OUT transport IDs (Maurizio Lombardi)
  - scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (Ranjan Kumar)
  - kconfig: nconf: Ensure null termination where strncpy is used (Shankari Anand)
  - kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c (Suchit Karunakaran)
  - i2c: Force DLL0945 touchpad i2c freq to 100khz (Fangzhong Zhou)
  - dm-mpath: don't print the "loaded" message if registering fails (Mikulas Patocka)
  - i3c: don't fail if GETHDRCAP is unsupported (Wolfram Sang)
  - rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 (Meagan Lloyd)
  - i3c: add missing include to internal header (Wolfram Sang)
  - md: dm-zoned-target: Initialize return variable r to avoid uninitialized use (Purva Yeshi)
  - crypto: octeontx2 - add timeout for load_fvc completion poll (Bharat Bhushan)
  - media: uvcvideo: Fix bandwidth issue for Alcor camera (Chenchangcheng)
  - media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394879] {CVE-2025-38693}
  - media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394886] {CVE-2025-38694}
  - media: usb: hdpvr: disable zero-length read messages (Wolfram Sang)
  - media: tc358743: Increase FIFO trigger level to 374 (Dave Stevenson)
  - media: tc358743: Return an appropriate colorspace from tc358743_set_fmt (Dave Stevenson)
  - media: tc358743: Check I2C succeeded during probe (Dave Stevenson)
  - pinctrl: stm32: Manage irq affinity settings (Cheick Traore)
  - scsi: mpt3sas: Correctly handle ATA device errors (Damien Le Moal)
  - scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug: 38394893] {CVE-2025-38695}
  - RDMA/core: reduce stack using in nldev_stat_get_doit() (Arnd Bergmann)
  - RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423285] {CVE-2025-39742}
  - leds: leds-lp50xx: Handle reg to get correct multi_index (Johan Adolfsson)
  - media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control (Niklas Söderlund)
  - MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh)
  - jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte)
  - jfs: Regular file corruption check (Edward Adam Davis)
  - jfs: truncate good inode pages when hard link is 0 (Lizhi Xu)
  - scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394923] {CVE-2025-38699}
  - watchdog: iTCO_wdt: Report error if timeout configuration fails (Ziyan Fu)
  - MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} (Shiji Yang)
  - watchdog: dw_wdt: Fix default timeout (Sebastian Reichel)
  - fs/orangefs: use snprintf() instead of sprintf() (Amir Mohammad Jahangirzad)
  - scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated (Showrya M N) [Orabug: 38394930] {CVE-2025-38700}
  - ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394936] {CVE-2025-38701}
  - crypto: hisilicon/hpre - fix dma unmap sequence (Zhiqi Song)
  - cifs: Fix calling CIFSFindFirst() for root path without msearch (Pali Rohár)
  - watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition (Aaron Plattner)
  - vhost: fail early when __vhost_add_used() fails (Jason Wang)
  - net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 (Álvaro Fernández Rojas)
  - drm/ttm: Respect the shrinker core free target (Tvrtko Ursulin)
  - uapi: in6: restore visibility of most IPv6 socket options (Jakub Kicinski)
  - drm/ttm: Should to return the evict error (Emily Deng)
  - net: ncsi: Fix buffer overflow in fetching version id (Hari Kalavakunta)
  - wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() (Thomas Fourier)
  - net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 (Álvaro Fernández Rojas)
  - net: dsa: b53: prevent DIS_LEARNING access on BCM5325 (Álvaro Fernández Rojas)
  - net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 (Álvaro Fernández Rojas)
  - net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 (Álvaro Fernández Rojas)
  - gve: Return error for unknown admin queue command (Alok Tiwari)
  - net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs (Gal Pressman)
  - drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual (Mario Limonciello)
  - dpaa_eth: don't use fixed_phy_change_carrier (Heiner Kallweit)
  - wifi: iwlegacy: Check rate_idx range after addition (Stanislaw Gruszka)
  - netmem: fix skb_frag_address_safe with unreadable skbs (Mina Almasry)
  - wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. (Thomas Fourier)
  - drm/amd/display: Fix 'failed to blank crtc!' (Wen Chen)
  - wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect (Anjaneyulu)
  - wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() (Rand Deeb)
  - drm/amd/display: Separate set_gsl from set_gsl_source_select (Ilya Bakoulin)
  - net: fec: allow disable coalescing (Jonas Rebmann)
  - net: atlantic: add set_power to fw_ops for atl2 to fix wol (Eric Work)
  - net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() (Jianrong Zhang)
  - drm/msm: use trylock for debugfs (Rob Clark)
  - ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in __ipv6_dev_mc_inc(). (Kuniyuki Iwashima)
  - (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer (Thomas Fourier)
  - wifi: mac80211: don't complete management TX on SAE commit (Johannes Berg)
  - s390/stp: Remove udelay from stp_sync_clock() (Sven Schnelle)
  - wifi: iwlwifi: mvm: fix scan request validation (Avraham Stern)
  - sched/deadline: Fix accounting after global limits change (Juri Lelli)
  - net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() (Alok Tiwari)
  - net: ipv4: fix incorrect MTU in broadcast routes (Oscar Maes)
  - wifi: cfg80211: Fix interface type validation (Ilan Peer)
  - net: mctp: Prevent duplicate binds (Matt Johnston)
  - rcu: Protect ->defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423340] {CVE-2025-39749}
  - arm64: Mark kernel as tainted on SAE and SError panic (Breno Leitao)
  - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Leon Romanovsky)
  - net: ag71xx: Add missing check after DMA map (Thomas Fourier)
  - et131x: Add missing check after DMA map (Thomas Fourier)
  - be2net: Use correct byte order and format string for TCP seq and ack_seq (Alok Tiwari)
  - s390/time: Use monotonic clock in get_cycles() (Sven Schnelle)
  - wifi: cfg80211: reject HTC bit for management frames (Johannes Berg)
  - ktest.pl: Prevent recursion of default variable options (Steven Rostedt)
  - xen/netfront: Fix TX response spurious interrupts (Anthoine Bourgeois)
  - ASoC: codecs: rt5640: Retry DEVICE_ID verification (Xinxin Wan)
  - iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement (Jonathan Santos)
  - ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros (Cristian Ciocaltea)
  - ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop (Christophe Leroy)
  - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun)
  - platform/chrome: cros_ec_typec: Defer probe on missing EC parent (Tomasz Michalec)
  - platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches (Kees Cook)
  - pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() (Gautham R. Shenoy)
  - usb: core: usb_submit_urb: downgrade type check (Oliver Neukum)
  - usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present (Tomasz Michalec)
  - ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (Peter Ujfalusi) [Orabug: 38394977] {CVE-2025-38706}
  - ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 (Alok Tiwari)
  - ASoC: hdac_hdmi: Rate limit logging on connection and disconnection (Mark Brown)
  - x86/bugs: Avoid warning when overriding return thunk (Pawan Gupta)
  - mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() (Ulf Hansson)
  - reset: brcmstb: Enable reset drivers for ARCH_BCM2835 (Peter Robinson)
  - pps: clients: gpio: fix interrupt handling order in remove path (Eliav Farber)
  - ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (Breno Leitao)
  - mmc: sdhci-msm: Ensure SD card power isn't ON when card removed (Sarthak Garg)
  - ACPI: processor: fix acpi_object initialization (Sebastian Ott)
  - PM: sleep: console: Fix the black screen issue (Tuhaowen)
  - thermal: sysfs: Return ENODATA instead of EAGAIN for reads (Hsin-Te Yuan)
  - PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() (Rafael J. Wysocki)
  - ACPI: PRM: Reduce unnecessary printing to avoid user confusion (Zhu Qiyu)
  - selftests: tracing: Use mutex_unlock for testing glob filter (Masami Hiramatsu)
  - ARM: tegra: Use I/O memcpy to write to IRAM (Aaron Kling)
  - gpio: tps65912: check the return value of regmap_update_bits() (Bartosz Golaszewski)
  - tools/nolibc: define time_t in terms of __kernel_old_time_t (Thomas Weißschuh)
  - thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required (David Collins)
  - ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed (Kuninori Morimoto)
  - EDAC/synopsys: Clear the ECC counters on init (Shubhrajyoti Datta)
  - PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() (Lifeng Zheng)
  - ARM: rockchip: fix kernel hang during smp initialization (Alexander Kochetkov)
  - cpufreq: Exit governor when failed to start old governor (Lifeng Zheng)
  - gpio: wcd934x: check the return value of regmap_update_bits() (Bartosz Golaszewski)
  - usb: xhci: Avoid showing errors during surprise removal (Mario Limonciello)
  - usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command (Jay Chen)
  - usb: xhci: Avoid showing warnings for dying controller (Mario Limonciello)
  - usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default (Benson Leung)
  - selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t (Cynthia Huang)
  - cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag (Prashant Malani)
  - usb: xhci: print xhci->xhc_state when queue_command failed (Su Hui)
  - securityfs: don't pin dentries twice, once is enough... (Al Viro)
  - ext2: Handle fiemap on empty files to prevent EINVAL (Wei Gao)
  - fs/ntfs3: correctly create symlink for relative path (Rong Zhang)
  - fs/ntfs3: Add sanity check for file name (Lizhi Xu)
  - ata: libata-sata: Disallow changing LPM state if not supported (Damien Le Moal)
  - better lockdep annotations for simple_recursive_removal() (Al Viro)
  - hfs: fix not erasing deleted b-tree node issue (Viacheslav Dubeyko)
  - drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394994] {CVE-2025-38708}
  - udf: Verify partition map count (Jan Kara)
  - smb/server: avoid deadlock when linking with ReplaceIfExists (Neil Brown)
  - arm64: Handle KCOV __init vs inline mismatches (Kees Cook)
  - hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa)
  - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko)
  - hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko)
  - hfs: fix slab-out-of-bounds in hfs_bnode_read() (Viacheslav Dubeyko)
  - ptp: prevent possible ABBA deadlock in ptp_clock_freerun() (Jeongjun Park)
  - intel_idle: Allow loading ACPI tables for any family (Len Brown)
  - sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395058] {CVE-2025-38718}
  - netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395066] {CVE-2025-38721}
  - udp: also consider secpath when evaluating ipsec use for checksumming (Sabrina Dubroca)
  - ACPI: processor: perflib: Move problematic pr->performance check (Rafael J. Wysocki)
  - ACPI: processor: perflib: Fix initial _PPC limit application (Jiayi Li)
  - Documentation: ACPI: Fix parent device references (Andy Shevchenko)
  - eventpoll: Fix semi-unbounded recursion (Jann Horn) [Orabug: 38335161] {CVE-2025-38614}
  - fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423396] {CVE-2025-39756}
  - sunvdc: Balance device refcount in vdc_port_mpgroup_check (Ma Ke)
  - NFSD: detect mismatch of file handle and delegation stateid in OPEN op (Dai Ngo)
  - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395080,38575798] {CVE-2025-38724}
  - net: usb: asix_devices: add phy_mask for ax88772 mdio bus (Xu Yang) [Orabug: 38395088] {CVE-2025-38725}
  - net: dpaa: fix device leak when querying time stamp info (Johan Hovold)
  - net: gianfar: fix device leak when querying time stamp info (Johan Hovold)
  - gpio: virtio: Fix config space reading. (Harald Mommer)
  - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423406] {CVE-2025-39757}
  - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395100] {CVE-2025-38729}
  - io_uring: don't use int for ABI (Pavel Begunkov)
  - usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue) [Orabug: 38334897] {CVE-2025-38555}
  - mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery (Andy Shevchenko)
  - MIPS: mm: tlb-r4k: Uniquify TLB entries on init (Jiaxun Yang)
  - ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() (Thorsten Blum)
  - net: usbnet: Fix the wrong netif_carrier_on() call (Ammar Faizi)
  - net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (John Ernberg)
  - USB: serial: option: add Foxconn T99W709 (Slark Xiao)
  - net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351763] {CVE-2025-38617}
  - selftests/perf_events: Add a mmap() correctness test (Lorenzo Stoakes)
  - perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334947] {CVE-2025-38563}
  - perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334957] {CVE-2025-38565}
  - perf/core: Don't leak AUX buffer refcount on allocation failure (Thomas Gleixner)
  - pptp: fix pptp_xmit() error path (Eric Dumazet)
  - smb: client: let recv_done() cleanup before notifying the callers. (Stefan Metzmacher)
  - smb: server: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
  - smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection (Stefan Metzmacher)
  - smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
  - smb: server: remove separate empty_recvmsg_queue (Stefan Metzmacher)
  - ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() (Takashi Iwai)
  - net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351785] {CVE-2025-38622}
  - ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334987] {CVE-2025-38572}
  - net/mlx5: Correctly set gso_segs when LRO is used (Christoph Paasch)
  - pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335003] {CVE-2025-38574}
  - phy: mscc: Fix parsing of unicast frames (Horatiu Vultur)
  - netpoll: prevent hanging NAPI when netcons gets enabled (Jakub Kicinski)
  - NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY (Benjamin Coddington)
  - XArray: Add calls to might_alloc() (Matthew Wilcox)
  - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401744] {CVE-2025-39730}
  - pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Tigran Mkrtchyan)
  - PCI: pnv_php: Fix surprise plug detection and recovery (Timothy Pearson)
  - powerpc/eeh: Make EEH driver device hotplug safe (Timothy Pearson)
  - powerpc/eeh: Rely on dev->link_active_reporting (Maciej W. Rozycki)
  - powerpc/eeh: Export eeh_unfreeze_pe() (Timothy Pearson)
  - PCI: pnv_php: Work around switches with broken presence detection (Timothy Pearson)
  - PCI: pnv_php: Clean up allocated IRQs on unplug (Timothy Pearson)
  - kconfig: qconf: fix ConfigList::updateListAllforAll() (Masahiro Yamada)
  - scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume (Seunghui Lee)
  - scsi: mpt3sas: Fix a fw_event memory leak (Tomas Henzl)
  - f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu)
  - f2fs: fix to avoid panic in f2fs_evict_inode (Chao Yu)
  - f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu)
  - f2fs: doc: fix wrong quota mount option description (Chao Yu)
  - f2fs: fix KMSAN uninit-value in extent_info usage (Abinash Singh)
  - rtc: rv3028: fix incorrect maximum clock rate handling (Brian Masney)
  - rtc: pcf8563: fix incorrect maximum clock rate handling (Brian Masney)
  - rtc: pcf85063: fix incorrect maximum clock rate handling (Brian Masney)
  - rtc: hym8563: fix incorrect maximum clock rate handling (Brian Masney)
  - rtc: ds1307: fix incorrect maximum clock rate handling (Brian Masney)
  - ucount: fix atomic_long_inc_below() argument type (Uros Bizjak)
  - module: Restore the moduleparam prefix length check (Petr Pavlu)
  - apparmor: ensure WB_HISTORY_SIZE value is a power of 2 (Ryan Lee)
  - bpf: Check flow_dissector ctx accesses are aligned (Paul Chaignon)
  - mtd: rawnand: atmel: set pmecc data setup time (Balamanikandan Gunasundar)
  - mtd: rawnand: rockchip: Add missing check after DMA map (Thomas Fourier)
  - mtd: rawnand: atmel: Fix dma_mapping_error() address (Thomas Fourier)
  - jfs: fix metapage reference count leak in dbAllocCtl (Zheng Yu)
  - fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (Chenyuan Yang)
  - crypto: qat - fix seq_file position update in adf_ring_next() (Giovanni Cabiddu)
  - sh: Do not use hyphen in exported variable name (Ben Hutchings)
  - dmaengine: nbpfaxi: Add missing check after DMA map (Thomas Fourier)
  - dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (Thomas Fourier)
  - fs/orangefs: Allow 2 more characters in do_c_string() (Dan Carpenter)
  - PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute (Manivannan Sadhasivam)
  - soundwire: stream: restore params when prepare ports fail (Bard Liao)
  - crypto: img-hash - Fix dma_unmap_sg() nents value (Thomas Fourier)
  - crypto: keembay - Fix dma_unmap_sg() nents value (Thomas Fourier)
  - hwrng: mtk - handle devm_pm_runtime_enable errors (Ovidiu Panait)
  - watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (Dan Carpenter)
  - scsi: isci: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - scsi: mvsas: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - clk: sunxi-ng: v3s: Fix de clock definition (Paul Kocialkowski)
  - perf tests bp_account: Fix leaked file descriptor (Leo Yan)
  - kernel: trace: preemptirq_delay_test: use offstack cpu mask (Arnd Bergmann)
  - RDMA/hns: Fix -Wframe-larger-than issue (Junxian Huang)
  - crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong)
  - crypto: inside-secure - Fix `dma_unmap_sg()` nents value (Thomas Fourier)
  - perf sched: Fix memory leaks for evsel->priv in timehist (Namhyung Kim)
  - clk: clk-axi-clkgen: fix fpfd_max frequency for zynq (Nuno Sa)
  - pinctrl: sunxi: Fix memory leak on krealloc failure (Yuan Chen)
  - PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails (Jerome Brunet)
  - power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (Charles Han)
  - power: supply: cpcap-charger: Fix null check for power_supply_get_by_name (Charles Han)
  - clk: xilinx: vcu: unregister pll_post only if registered correctly (Rohit Visavalia)
  - media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check (James Cowgill)
  - clk: davinci: Add NULL check in davinci_lpsc_clk_register() (Henry Martin)
  - mtd: fix possible integer overflow in erase_xfer() (Ivan Stepchenko)
  - crypto: marvell/cesa - Fix engine load inaccuracy (Herbert Xu)
  - PCI: rockchip-host: Fix "Unexpected Completion" log message (Hans Zhang)
  - vrf: Drop existing dst reference in vrf_ip6_input_dst (Stanislav Fomichev)
  - selftests: rtnetlink.sh: remove esp4_offload after test (Xiumei Mu)
  - netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351853] {CVE-2025-38639}
  - can: kvaser_usb: Assign netdev.dev_port based on device channel index (Jimmy Assarsson)
  - can: kvaser_pciefd: Store device channel index (Jimmy Assarsson)
  - wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (Gokul Sivakumar)
  - Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Remi Pommarel)
  - wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() (Remi Pommarel)
  - wifi: mac80211: Don't call fq_flow_idx() for management frames (Alexander Wetzel)
  - mwl8k: Add missing check after DMA map (Thomas Fourier)
  - wifi: rtl8xxxu: Fix RX skb size for aggregation disabled (Martin Kaistra)
  - xen/gntdev: remove struct gntdev_copy_batch from stack (Juergen Gross)
  - net_sched: act_ctinfo: use atomic64_t for three counters (Eric Dumazet)
  - net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug: 38331465] {CVE-2025-38553}
  - um: rtc: Avoid shadowing err in uml_rtc_start() (Tiwei Bie)
  - arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX (Johan Korsnes)
  - drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (Fedor Pchelkin)
  - m68k: Don't unregister boot console needlessly (Finn Thain)
  - net/mlx5: Check device memory pointer before usage (Stav Aviram) [Orabug: 38351877] {CVE-2025-38645}
  - tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range (Xin Guo)
  - wifi: ath11k: clear initialized flag for deinit-ed srng lists (Sergey Senozhatsky) [Orabug: 38335105] {CVE-2025-38601}
  - iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335109] {CVE-2025-38602}
  - wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (Xiu Jianfeng)
  - wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335118] {CVE-2025-38604}
  - caif: reduce stack size, again (Arnd Bergmann)
  - bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure (Yuan Chen)
  - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335130] {CVE-2025-38608}
  - bpf, sockmap: Fix psock incorrectly pointing to sk (Jiayuan Chen)
  - drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed (Andy Yan)
  - selftests/tracing: Fix false failure of subsystem event test (Steven Rostedt)
  - staging: nvec: Fix incorrect null termination of battery manufacturer (Alok Tiwari)
  - samples: mei: Fix building on musl libc (Brahmajit Das)
  - cpufreq: Init policy->rwsem before it may be possibly used (Lifeng Zheng)
  - cpufreq: Initialize cpufreq-based frequency-invariance later (Lifeng Zheng)
  - cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode (Rafael J. Wysocki)
  - PM / devfreq: Check governor before using governor->name (Lifeng Zheng) [Orabug: 38335134] {CVE-2025-38609}
  - arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed (Adam Ford)
  - arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed (Adam Ford)
  - ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface (Annette Kobou)
  - arm: dts: ti: omap: Fixup pinheader typo (Albin Törnqvist)
  - usb: early: xhci-dbc: Fix early_ioremap leak (Lucas De Marchi)
  - Revert "vmci: Prevent the dispatching of uninitialized payloads" (Greg Kroah-Hartman)
  - pps: fix poll support (Denis Osterland-Heim)
  - vmci: Prevent the dispatching of uninitialized payloads (Lizhi Xu)
  - staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal)
  - usb: misc: apple-mfi-fastcharge: Make power supply names unique (Charalampos Mitrodimas)
  - ARM: dts: vfxxx: Correctly use two tuples for timer address (Krzysztof Kozlowski)
  - selftests: Fix errno checking in syscall_user_dispatch test (Dmitry Vyukov)
  - Revert "fs/ntfs3: Replace inode_trylock with inode_lock" (Konstantin Komarov)
  - hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li)
  - fs_context: fix parameter name in infofc() macro (Rubenkelevra)
  - ASoC: Intel: fix SND_SOC_SOF dependencies (Arnd Bergmann)
  - ethernet: intel: fix building with large NR_CPUS (Arnd Bergmann)
  - usb: phy: mxs: disconnect line when USB charger is attached (Xu Yang)
  - usb: chipidea: add USB PHY event (Xu Yang)
  - ALSA: hda: Add missing NVIDIA HDA codec IDs (Daniel Dadap)
  - comedi: comedi_test: Fix possible deletion of uninitialized timers (Ian Abbott)
  - jfs: reject on-disk inodes of an unsupported type (Dmitry Antipov)
  - usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach (Rd Babiera)
  - usb: typec: tcpm: allow switching to mode accessory to mux properly (Michael Grzeschik)
  - usb: typec: tcpm: allow to use sink in accessory mode (Michael Grzeschik)
  - mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n (Harry Yoo)
  - nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi)
  - gve: Fix stuck TX queue for DQ queue format (Praveen Kaligineedi)
  - e1000e: ignore uninitialized checksum word on tgp (Jacek Kowalski)
  - e1000e: disregard NVM checksum on tgp when valid checksum bit is not set (Jacek Kowalski)
  - dpaa2-switch: Fix device reference count leak in MAC endpoint handling (Ma Ke)
  - dpaa2-eth: Fix device reference count leak in MAC endpoint handling (Ma Ke)
  - ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx (Dawid Rezler)
  - bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() (Ma Ke)
  - i2c: virtio: Avoid hang by using interruptible completion wait (Viresh Kumar)
  - i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351993] {CVE-2025-38671}
  - platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots (Rongrong)
  - net: hns3: fixed vf get max channels bug (Jian Shen)
  - net: hns3: disable interrupt when ptp init failed (Yonglong Liu)
  - net: hns3: fix concurrent setting vlan filter issue (Jian Shen)
  - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei)
  - net: appletalk: Fix use-after-free in AARP proxy probe (Kito Xu)
  - i40e: report VF tx_dropped with tx_errors instead of tx_discards (Dennis Chen)
  - i40e: Add rx_missed_errors for buffer exhaustion (Yajun Deng)
  - regmap: fix potential memory leak of regmap_bus (Abdun Nihaal)
  - interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node (Xilin Wu)
  - RDMA/core: Rate limit GID cache warning messages (Maor Gottlieb)
  - regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati) [Orabug: 38351977] {CVE-2025-38668}
  - Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT (Fabrice Gasnier) [Orabug: 38180692] {CVE-2025-38335}
  - platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
  - powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
  - mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
  - ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
  - usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
  - usb: musb: fix gadget state on disconnect (Drew Hamilton)
  - usb: musb: Add and use inline functions musb_{get,set}_state (Paul Cercueil)
  - usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
  - usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
  - usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
  - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254213] {CVE-2025-38468}
  - net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
  - net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254224] {CVE-2025-38470}
  - Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
  - ipv6: mcast: Delay put pmc->idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324326] {CVE-2025-38550}
  - net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
  - Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
  - Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
  - Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254240] {CVE-2025-38473}
  - usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254248] {CVE-2025-38474}
  - hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann)
  - selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
  - selftests: udpgro: report error when receive failed (Hangbin Liu)
  - nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
  - smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong)
  - pinctrl: mediatek: moore: check if pin_desc is valid before use (Sam Shih)
  - rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima)
  - net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254265] {CVE-2025-38477}
  - net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
  - bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324226] {CVE-2025-38528}
  - comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott)
  - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott)
  - comedi: Fix some signed shift left operations (Ian Abbott)
  - comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott)
  - comedi: das6402: Fix bit shift out of bounds (Ian Abbott)
  - comedi: das16m1: Fix bit shift out of bounds (Ian Abbott)
  - comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott)
  - comedi: pcl812: Fix bit shift out of bounds (Ian Abbott)
  - iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
  - iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
  - iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
  - soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
  - soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
  - pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
  - mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
  - mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
  - mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
  - isofs: Verify inode mode when loading from disk (Jan Kara)
  - dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter)
  - af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
  - af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
  - phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
  - tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324269] {CVE-2025-38539}
  - HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
  - pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
  - thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
  - i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
  - usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254357] {CVE-2025-38497}
  - USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
  - USB: serial: option: add Foxconn T99W640 (Slark Xiao)
  - USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
  - phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324257] {CVE-2025-38535}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-315.193.1.el9uek]
changelog:
  - uek-rpm: Set KFENCE_SAMPLE_INTERVAL to 100. (Imran Khan) [Orabug: 38549476]
  - uek-rpm: Enable CONFIG_COMPAT_32BIT_TIME for x86 container kernel (Boris Ostrovsky) [Orabug: 38540641]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-315.193.2.el9uek]
changelog:
  - KVM: x86: Don't unnecessarily force masterclock update on vCPU hotplug (Sean Christopherson) [Orabug: 38530514]
  - KVM: x86: Expose TSC offset controls to userspace (Oliver Upton) [Orabug: 38530514]
  - KVM: x86: Refactor tsc synchronization code (Oliver Upton) [Orabug: 38530514]
  - kvm: x86: protect masterclock with a seqcount (Paolo Bonzini) [Orabug: 38530514]
  - KVM: x86: Report host tsc and realtime values in KVM_GET_CLOCK (Oliver Upton) [Orabug: 38530514]
  - KVM: x86: Fix potential race in KVM_GET_CLOCK (Oliver Upton) [Orabug: 38530514]
  - KVM: x86: extract KVM_GET_CLOCK/KVM_SET_CLOCK to separate functions (Paolo Bonzini) [Orabug: 38530514]
  - kvm: x86: abstract locking around pvclock_update_vm_gtod_copy (Paolo Bonzini) [Orabug: 38530514]
  - Revert "KVM: x86: Don't unnecessarily force masterclock update on vCPU hotplug" (Dongli Zhang) [Orabug: 38530514]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-315.196.3.el9uek]
changelog:
  - KVM: VMX: Intercept reads to invalid and write-only x2APIC registers (Sean Christopherson) [Orabug: 38535186]
  - KVM: VMX: Always intercept accesses to unsupported "extended" x2APIC regs (Sean Christopherson) [Orabug: 38535186]
  - KVM: x86: Split out logic to generate "readable" APIC regs mask to helper (Sean Christopherson) [Orabug: 38535186]
  - KVM: x86: Mark x2APIC DFR reg as non-existent for x2APIC (Sean Christopherson) [Orabug: 38535186]
  - uek-rpm/ol9/config-mips64-emb: Enable NF_TABLES for MIPS64 (Vijay Kumar) [Orabug: 38578981]
  - LTS version: v5.15.196 (Vijayendra Suman)
  - PCI: rcar: Demote WARN() to dev_warn_ratelimited() in rcar_pcie_wakeup() (Marek Vasut) [Orabug: 38641258] {CVE-2024-43876}
  - net: rtnetlink: fix module reference count leak issue in rtnetlink_rcv_msg (Zhengchao Shao)
  - usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai) [Orabug: 38601854] {CVE-2025-40094}
  - usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai) [Orabug: 38601837] {CVE-2025-40092}
  - usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
  - usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
  - arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (Kaushlendra Kumar)
  - xfs: always warn about deprecated mount options (Darrick J. Wong)
  - devcoredump: Fix circular locking dependency with devcd->mutex. (Maarten Lankhorst)
  - PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
  - PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
  - PCI: rcar: Finish transition to L1 state in rcar_pcie_config_access() (Marek Vasut)
  - PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
  - f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
  - NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601818] {CVE-2025-40087}
  - vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601923] {CVE-2025-40105}
  - drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
  - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
  - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
  - PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
  - PCI: j721e: Enable ACSPCIE Refclk if "ti,syscon-acspcie-proxy-ctrl" exists (Siddharth Vadapalli)
  - fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong)
  - fuse: allocate ff->release_args only if release is needed (Amir Goldstein)
  - padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
  - iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
  - PM: runtime: Add new devm functions (Csókás Bence)
  - iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
  - iio: imu: inv_icm42600: use = { } instead of memset() (David Lechner)
  - NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
  - NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
  - NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
  - xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
  - xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
  - s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
  - arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
  - serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 (Florian Eckert)
  - most: usb: hdm_probe: Fix calling put_device() before device initialization (Victoria Votokina)
  - most: usb: Fix use-after-free in hdm_disconnect (Victoria Votokina)
  - mei: me: add wildcat lake P DID (Alexander Usyskin)
  - comedi: fix divide-by-zero in comedi_buf_munge() (Deepanshu Kartikey)
  - binder: remove "invalid inc weak" check (Alice Ryhl)
  - xhci: dbc: enable back DbC in resume if it was enabled before suspend (Mathias Nyman)
  - usb: raw-gadget: do not limit transfer length (Andrey Konovalov)
  - usb/core/quirks: Add Huawei ME906S to wakeup quirk (Tim Guttzeit)
  - USB: serial: option: add Telit FN920C04 ECM compositions (Li Qingwu)
  - USB: serial: option: add Quectel RG255C (Reinhard Speyerer)
  - USB: serial: option: add UNISOC UIS7720 (Renjun Wang)
  - net: ravb: Ensure memory write completes before ringing TX doorbell (Lad Prabhakar)
  - net: usb: rtl8150: Fix frame padding (Michał Pecio)
  - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella)
  - ocfs2: clear extent cache after moving/defragmenting extents (Deepanshu Kartikey)
  - MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering (Maciej W. Rozycki)
  - Revert "cpuidle: menu: Avoid discarding useful information" (Rafael J. Wysocki)
  - net: bonding: fix possible peer notify event loss or dup issue (Tonghao Zhang)
  - sctp: avoid NULL dereference when chunk data buffer is missing (Alexey Simakov)
  - arm64, mm: avoid always making PTE dirty in pte_mkwrite() (Huang, Ying)
  - dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path (Ioana Ciornei)
  - net: enetc: correct the value of ENETC_RXB_TRUESIZE (Wei Fang)
  - rtnetlink: Allow deleting FDB entries in user namespace (Johannes Wiesboeck)
  - net: rtnetlink: add NLM_F_BULK support to rtnl_fdb_del (Nikolay Aleksandrov)
  - net: rtnetlink: add bulk delete support flag (Nikolay Aleksandrov)
  - net: netlink: add NLM_F_BULK delete request modifier (Nikolay Aleksandrov)
  - net: rtnetlink: use BIT for flag values (Nikolay Aleksandrov)
  - net: rtnetlink: add helper to extract msg type's kind (Nikolay Aleksandrov)
  - m68k: bitops: Fix find_*_bit() signatures (Geert Uytterhoeven)
  - hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() (Yangtao Li)
  - hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() (Viacheslav Dubeyko)
  - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring)
  - hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (Viacheslav Dubeyko)
  - hfs: validate record offset in hfsplus_bmap_alloc (Yang Chenzhi)
  - hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() (Viacheslav Dubeyko)
  - hfs: make proper initalization of struct hfs_find_data (Viacheslav Dubeyko)
  - hfs: clear offset and space out of valid records in b-tree node (Viacheslav Dubeyko)
  - nios2: ensure that memblock.current_limit is set when setting pfn limits (Simon Schuster)
  - exec: Fix incorrect type for ret (Xichao Zhao)
  - PCI/sysfs: Ensure devices are powered for config reads (part 2) (Brian Norris)
  - hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
  - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597093] {CVE-2025-40085}
  - ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
  - sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
  - sched/balancing: Rename newidle_balance() => sched_balance_newidle() (Ingo Molnar)
  - drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
  - net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset (I Viswanath)
  - net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
  - net: usb: use eth_hw_addr_set() instead of ether_addr_copy() (Jakub Kicinski)
  - tls: don't rely on tx_work during send() (Sabrina Dubroca)
  - tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
  - tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
  - net: tls: wait for async completion on last message (Sascha Hauer)
  - tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
  - tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
  - amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
  - net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov) [Orabug: 38649259] {CVE-2025-40173}
  - r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
  - doc: fix seg6_flowlabel path (Nicolas Dichtel)
  - net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
  - can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
  - dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
  - HID: multitouch: fix sticky fingers (Benjamin Tissoires)
  - cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
  - crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
  - drm/exynos: exynos7_drm_decon: remove ctx->suspended (Kaustabh Chakraborty)
  - drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
  - drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
  - blk-crypto: fix missing blktrace bio split events (Yu Kuai)
  - media: lirc: Fix error handling in lirc_register() (Ma Ke)
  - media: rc: Directly use ida_free() (Keliu)
  - media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
  - btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
  - ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey) [Orabug: 38649222] {CVE-2025-40167}
  - jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
  - r8152: add error handling in rtl8152_driver_init (Yi Cong)
  - LTS version: v5.15.195 (Vijayendra Suman)
  - selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
  - mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
  - media: pci: ivtv: Add check for DMA map result (Mikhail Kobuk) [Orabug: 38641260] {CVE-2024-43877}
  - xen/events: Update virq_to_irq on migration (Jason Andryuk)
  - media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
  - media: pci/ivtv: switch from 'pci_' to 'dma_' API (Christophe Jaillet)
  - arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
  - media: cx18: Add missing check after DMA map (Thomas Fourier)
  - media: switch from 'pci_' to 'dma_' API (Christophe Jaillet)
  - writeback: Avoid excessively long inode switching times (Jan Kara)
  - writeback: Avoid softlockup when switching many inodes (Jan Kara)
  - cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
  - fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
  - pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17) [Orabug: 38649275] {CVE-2025-40178}
  - minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
  - minmax.h: remove some #defines that are only expanded once (David Laight)
  - minmax.h: simplify the variants of clamp() (David Laight)
  - minmax.h: move all the clamp() definitions after the min/max() ones (David Laight)
  - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() (David Laight)
  - minmax.h: reduce the #define expansion of min(), max() and clamp() (David Laight)
  - minmax.h: update some comments (David Laight)
  - minmax.h: add whitespace around operators and after commas (David Laight)
  - minmax: fix up min3() and max3() too (Linus Torvalds)
  - minmax: improve macro expansion and type checking (Linus Torvalds)
  - minmax: simplify min()/max()/clamp() implementation (Linus Torvalds)
  - minmax: don't use max() in situations that want a C constant expression (Linus Torvalds)
  - minmax: make generic MIN() and MAX() macros available everywhere (Linus Torvalds)
  - minmax: simplify and clarify min_t()/max_t() implementation (Linus Torvalds)
  - minmax: add a few more MIN_T/MAX_T users (Linus Torvalds)
  - minmax: avoid overly complicated constant expressions in VM code (Linus Torvalds)
  - minmax: fix indentation of __cmp_once() and __clamp_once() (David Laight)
  - minmax: deduplicate __unconst_integer_typeof() (Andy Shevchenko)
  - minmax: Introduce {min,max}_array() (Herve Codina)
  - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
  - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
  - fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
  - dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing) [Orabug: 38649056] {CVE-2025-40134}
  - tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592032] {CVE-2025-40042}
  - ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
  - net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel) [Orabug: 38649002] {CVE-2025-40120}
  - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
  - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
  - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
  - media: mc: Clear minor number before put device (Edward Adam Davis) [Orabug: 38649397] {CVE-2025-40197}
  - Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher) [Orabug: 38649424] {CVE-2025-40200}
  - Squashfs: add additional inode sanity checking (Phillip Lougher)
  - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
  - ASoC: codecs: wcd934x: Simplify with dev_err_probe (Krzysztof Kozlowski)
  - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591958] {CVE-2025-40026}
  - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
  - ext4: free orphan info with kvfree (Jan Kara)
  - ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag) [Orabug: 38649329] {CVE-2025-40190}
  - ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
  - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
  - ext4: verify orphan file size is not too big (Jan Kara) [Orabug: 38649284] {CVE-2025-40179}
  - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
  - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
  - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
  - x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
  - x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
  - spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
  - spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
  - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
  - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
  - PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
  - PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
  - PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
  - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle)
  - PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
  - rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
  - rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
  - rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
  - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
  - mmc: core: SPI mode remove cmd7 (Rex Chen)
  - mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
  - sparc: fix error handling in scan_one_device() (Ma Ke)
  - sparc64: fix hugetlb for sun4u (Anthony Yznaga)
  - sctp: Fix MAC comparison to be constant-time (Eric Biggers) [Orabug: 38649450] {CVE-2025-40204}
  - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
  - pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
  - powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
  - powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
  - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
  - parisc: don't reference obsolete termio struct for TC* constants (Sam James)
  - openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
  - lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
  - KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
  - iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
  - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
  - init: handle bootloader identifier in kernel parameters (Huacai Chen)
  - iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
  - iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
  - iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
  - fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
  - crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
  - cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki) [Orabug: 38649365] {CVE-2025-40194}
  - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) (Simon Schuster)
  - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
  - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento) [Orabug: 38649461] {CVE-2025-40205}
  - drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
  - media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
  - firmware: meson_sm: fix device leak at probe (Johan Hovold)
  - xen/manage: Fix suspend error path (Lukas Wunner)
  - xen/events: Cleanup find_virq() return codes (Jason Andryuk)
  - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
  - arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
  - ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
  - ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
  - bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
  - gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
  - gpio: wcd934x: Remove duplicate assignment of of_gpio_n_cells (Andy Shevchenko)
  - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
  - crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581454] {CVE-2025-40019}
  - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
  - drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
  - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
  - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
  - drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
  - bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann) [Orabug: 38649299] {CVE-2025-40183}
  - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
  - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
  - tools build: Align warning options with perf (Leo Yan)
  - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
  - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima) [Orabug: 38649578] {CVE-2025-40186}
  - net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov) [Orabug: 38649311] {CVE-2025-40187}
  - drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes) [Orabug: 38643545] {CVE-2025-40111}
  - drm/vmwgfx: Copy DRM hash-table code into driver (Thomas Zimmermann)
  - s390/cio: unregister the subchannel while purging (Vineeth Vijayan)
  - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
  - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557653] {CVE-2025-40001}
  - scsi: mvsas: Use sas_task_find_rq() for tagging (John Garry)
  - scsi: mvsas: Delete mvs_tag_init() (John Garry)
  - scsi: libsas: Add sas_task_find_rq() (John Garry)
  - cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
  - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
  - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
  - perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
  - rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
  - perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
  - clk: at91: peripheral: fix return value (Brian Masney)
  - libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
  - perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
  - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
  - clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
  - fs: always return zero on success from replace_fd() (Thomas Weißschuh)
  - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
  - bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
  - pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591980] {CVE-2025-40030}
  - Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38592000] {CVE-2025-40035}
  - Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
  - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
  - mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi) [Orabug: 38649149] {CVE-2025-40153}
  - ext4: fix checks for orphan inodes (Jan Kara)
  - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
  - net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
  - fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592047] {CVE-2025-40044}
  - uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592066] {CVE-2025-40048}
  - Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592076] {CVE-2025-40049}
  - net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592097] {CVE-2025-40053}
  - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
  - nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
  - drivers/base/node: fix double free in register_one_node() (Donet Tom)
  - ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592109] {CVE-2025-40055}
  - hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
  - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
  - net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath) [Orabug: 38649095] {CVE-2025-40140}
  - RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
  - usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
  - scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar) [Orabug: 38648980] {CVE-2025-40115}
  - ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581444] {CVE-2025-40018}
  - NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
  - coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
  - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
  - sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
  - sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
  - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
  - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
  - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
  - wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
  - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
  - IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
  - RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
  - Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
  - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
  - scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
  - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
  - wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
  - RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
  - drivers/base/node: handle error properly in register_one_node() (Donet Tom)
  - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
  - netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
  - iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
  - fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
  - ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai) [Orabug: 38649006] {CVE-2025-40121}
  - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai) [Orabug: 38649156] {CVE-2025-40154}
  - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
  - pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592169] {CVE-2025-40070}
  - misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
  - usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
  - usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
  - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
  - tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
  - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation (Alok Tiwari)
  - wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
  - drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
  - ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
  - media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
  - scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
  - scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel) [Orabug: 38649566] {CVE-2025-40118}
  - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
  - drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
  - i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
  - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
  - thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
  - thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
  - tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
  - smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
  - bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592204] {CVE-2025-40078}
  - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
  - i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
  - nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner) [Orabug: 38649248] {CVE-2025-40171}
  - pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
  - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
  - firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
  - pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
  - PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
  - block: use int to store blk_stack_limits() return value (Rong Qianfeng)
  - regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
  - ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
  - blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan) [Orabug: 38649025] {CVE-2025-40125}
  - pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
  - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
  - ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
  - cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
  - libbpf: Fix reuse of DEVMAP (Yureka Lilian)
  - regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
  - x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
  - perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592220] {CVE-2025-40081}
  - coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
  - selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
  - filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
  - net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591964] {CVE-2025-40027}
  - minmax: add in_range() macro (Matthew Wilcox)
  - crypto: rng - Ensure set_ent is always present (Herbert Xu) [Orabug: 38643530] {CVE-2025-40109}
  - platform/x86: int3472: Check for adev == NULL (Hans de Goede)
  - driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
  - staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
  - staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
  - serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
  - hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
  - perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
  - dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
  - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
  - USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
  - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
  - media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou) [Orabug: 38548036] {CVE-2025-39994}
  - media: tunner: xc5000: Refactor firmware load (Ricardo Ribalda)
  - udp: Fix memory accounting leak. (Kuniyuki Iwashima) [Orabug: 37844324] {CVE-2025-22058}
  - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence (Will Deacon) [Orabug: 38513233]
  - media: rc: fix races with imon_disconnect() (Larshin Sergey) [Orabug: 38548026] {CVE-2025-39993}
  - media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou) [Orabug: 38548050] {CVE-2025-39996}
  - scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran) [Orabug: 38548058] {CVE-2025-39998}
  - LTS version: v5.15.194 (Vijayendra Suman)
  - drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)
  - i40e: add validation for ring_len param (Lukasz Czapnik) [Orabug: 38547951,38603025,38607608] {CVE-2025-39973}
  - i40e: increase max descriptors for XL710 (Justin Bronder)
  - i40e: fix idx validation in config queues msg (Lukasz Czapnik) [Orabug: 38547937] {CVE-2025-39971}
  - i40e: fix validation of VF state in get resources (Lukasz Czapnik) [Orabug: 38547928] {CVE-2025-39969}
  - mm/hugetlb: fix folio is still mapped when deleted (Tu Jinjiang) [Orabug: 38560480] {CVE-2025-40006}
  - mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize() (David Hildenbrand)
  - fbcon: Fix OOB access in font allocation (Thomas Zimmermann)
  - fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda) [Orabug: 38547912] {CVE-2025-39967}
  - tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu) [Orabug: 38581470] {CVE-2025-40021}
  - i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)
  - i40e: add max boundary check for VF filters (Lukasz Czapnik) [Orabug: 38547922] {CVE-2025-39968}
  - i40e: fix input validation logic for action_meta (Lukasz Czapnik) [Orabug: 38547932] {CVE-2025-39970}
  - i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik) [Orabug: 38547945] {CVE-2025-39972}
  - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers) [Orabug: 38641289] {CVE-2025-40022}
  - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu) [Orabug: 38537468,38575792,38575804] {CVE-2025-39964}
  - drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita) [Orabug: 38560495] {CVE-2025-40011}
  - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir Oltean)
  - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)
  - net: dsa: lantiq_gswip: do also enable or disable cpu port (Martin Schiller)
  - selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)
  - nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel) [Orabug: 38547971] {CVE-2025-39980}
  - bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)
  - ethernet: rvu-af: Remove slash from the driver name (Petr Malat)
  - can: peak_usb: fix shift-out-of-bounds issue (Stephane Grosjean) [Orabug: 38581461] {CVE-2025-40020}
  - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
  - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
  - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
  - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
  - can: etas_es58x: sort the includes by alphabetic order (Vincent Mailhol)
  - can: etas_es58x: advertise timestamping capabilities and add ioctl support (Vincent Mailhol)
  - can: dev: add generic function can_eth_ioctl_hwts() (Vincent Mailhol)
  - can: dev: add generic function can_ethtool_op_get_ts_info_hwts() (Vincent Mailhol)
  - can: bittiming: replace CAN units with the generic ones from linux/units.h (Vincent Mailhol)
  - can: bittiming: allow TDC{V,O} to be zero and add can_tdc_const::tdc{v,o,f}_min (Vincent Mailhol)
  - bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)
  - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)
  - arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)
  - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)
  - usb: core: Add 0x prefix to quirks debug output (Jiayi Li)
  - ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)
  - ALSA: usb-audio: Convert comma to semicolon (Chen Ni)
  - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)
  - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)
  - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)
  - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)
  - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)
  - ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)
  - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer (Hans de Goede)
  - net: rfkill: gpio: add DT support (Philipp Zabel)
  - mptcp: propagate shutdown to subflows when possible (Matthieu Baerts)
  - ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer (Namjae Jeon)
  - mptcp: set remote_deny_join_id0 on SYN recv (Matthieu Baerts)
  - phy: ti: omap-usb2: fix device leak at unbind (Johan Hovold)
  - phy: Use device_get_match_data() (Rob Herring)
  - phy: broadcom: ns-usb3: fix Wvoid-pointer-to-enum-cast warning (Krzysztof Kozlowski)
  - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels (Alan Stern)
  - usb: gadget: dummy_hcd: remove usage of list iterator past the loop body (Jakob Koschel)
  - xhci: dbc: Fix full DbC transfer ring after several reconnects (Mathias Nyman)
  - xhci: dbc: decouple endpoint allocation from initialization (Mathias Nyman)
  - serial: sc16is7xx: fix bug in flow control levels init (Hugo Villeneuve)
  - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path (Qi Xi)
  - drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ (Loic Poulain)
  - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message (Colin Ian King)
  - ASoC: wm8974: Correct PLL rate rounding (Charles Keepax)
  - ASoC: wm8940: Correct typo in control name (Charles Keepax)
  - mmc: mvsdio: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - btrfs: tree-checker: fix the incorrect inode ref size check (Qu Wenruo)
  - power: supply: bq27xxx: restrict no-battery detection to bq27000 (H. Nikolaus Schaller)
  - power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery (H. Nikolaus Schaller)
  - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* (Nathan Chancellor)
  - cnic: Fix use-after-free bugs in cnic_delete_task (Duoming Zhou) [Orabug: 38503848] {CVE-2025-39945}
  - net: liquidio: fix overflow in octeon_init_instr_queue() (Alexey Nepomnyashih)
  - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Kuniyuki Iwashima) [Orabug: 38526387] {CVE-2025-39955}
  - i40e: remove redundant memory barrier when cleaning Tx descs (Maciej Fijalkowski)
  - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure (Moon Yeounsu)
  - qed: Don't collect too many protection override GRC elements (Jamie Bainbridge) [Orabug: 38503869] {CVE-2025-39949}
  - dpaa2-switch: fix buffer pool seeding for control traffic (Ioana Ciornei)
  - um: virtio_uml: Fix use-after-free after put_device in probe (Miaoqian Lin)
  - cgroup: split cgroup_destroy_wq into 3 workqueues (Chen Ridong) [Orabug: 38503891] {CVE-2025-39953}
  - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch (Geert Uytterhoeven)
  - wifi: mac80211: fix incorrect type for ret (Liao Yuanhong)
  - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported (Takashi Sakamoto)
  - net: hsr: hsr_slave: Fix the promiscuous mode in offload mode (Ravi Gunasekaran)
  - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Miaohe Lin) [Orabug: 38461847] {CVE-2025-39883}
  - drm/i915/power: fix size for for_each_set_bit() in abox iteration (Jani Nikula)
  - phy: ti-pipe3: fix device leak at unbind (Johan Hovold)
  - phy: tegra: xusb: fix device and OF node leak at probe (Johan Hovold)
  - dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees (Stephan Gerhold) [Orabug: 38494821] {CVE-2025-39923}
  - regulator: sy7636a: fix lifecycle of power good gpio (Andreas Kemnade)
  - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (Anders Roxell)
  - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr (Hangbin Liu)
  - hsr: use rtnl lock when iterating over ports (Hangbin Liu)
  - net: hsr: Add VLAN CTAG filter support (Murali Karicheri)
  - net: hsr: Add support for MC filtering at the slave device (Murali Karicheri)
  - net: hsr: Disable promiscuous mode in offload mode (Ravi Gunasekaran)
  - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB (Anssi Hannula)
  - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails (Tetsuo Handa)
  - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed (Tetsuo Handa)
  - i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (Michal Schmidt) [Orabug: 38494786] {CVE-2025-39911}
  - i40e: Use irq_update_affinity_hint() (Nitesh Narayan Lal)
  - igb: fix link test skipping when interface is admin down (Kohei Enju)
  - tunnels: reset the GSO metadata before reusing the skb (Antoine Tenart)
  - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (Stefan Wahren)
  - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
  - USB: serial: option: add Telit Cinterion FN990A w/audio compositions (Fabio Porcedda)
  - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks (Krzysztof Kozlowski)
  - tty: hvc_console: Call hvc_kick in hvc_write unconditionally (Fabian Vogt)
  - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
  - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer (Christophe Kerello)
  - mtd: rawnand: stm32_fmc2: Fix dma_map_sg error check (Jack Wang)
  - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing (Alexander Sverdlin)
  - mtd: nand: raw: atmel: Fix comment in timings preparation (Alexander Dahl)
  - mm/khugepaged: fix the address passed to notifier on testing young (Wei Yang)
  - libceph: fix invalid accesses to ceph_connection_v1_info (Ilya Dryomov) [Orabug: 38461836] {CVE-2025-39880}
  - fuse: prevent overflow in copy_file_range return value (Miklos Szeredi)
  - fuse: check if copy_file_range() returns larger than requested size (Miklos Szeredi)
  - mtd: rawnand: stm32_fmc2: fix ECC overwrite (Christophe Kerello)
  - ocfs2: fix recursive semaphore deadlock in fiemap call (Mark Tinguely) [Orabug: 38461858] {CVE-2025-39885}
  - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN (Krister Johansen)
  - compiler-clang.h: define __SANITIZE_*__ macros only when undefined (Nathan Chancellor)
  - EDAC/altera: Delete an inappropriate dma_free_coherent() call (Salah Triki)
  - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. (Kuniyuki Iwashima) [Orabug: 38494796] {CVE-2025-39913}
  - NFSv4/flexfiles: Fix layout merge mirror check. (Jonathan Curley)
  - tracing: Fix tracing_marker may trigger page fault during preempt_disable (Luo Gengkun)
  - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server (Trond Myklebust)
  - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set (Trond Myklebust)
  - mm/rmap: reject hugetlb folios in folio_make_device_exclusive() (David Hildenbrand)
  - net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod. (Kuniyuki Iwashima) [Orabug: 37901603] {CVE-2025-23143}
  - media: i2c: imx214: Fix link frequency validation (André Apitzsch)
  - media: mtk-vcodec: venc: avoid -Wenum-compare-conditional warning (Arnd Bergmann)
  - mm: introduce and use {pgd,p4d}_populate_kernel() (Harry Yoo)
  - kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
  - xfs: short circuit xfs_growfs_data_private() if delta is zero (Eric Sandeen)
  - Revert "fbdev: Disable sysfb device registration when removing conflicting FBs" (Brett A C Sheffield)


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-315.196.5.el9uek]
changelog:
  - uek-rpm: add "bpf" to CONFIG_LSM (Alan Maguire) [Orabug: 35653191]
  - Revert "cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry" (Samasth Norway Ananda) [Orabug: 38613264]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-315.196.5.1.el9uek]
changelog:
  - netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)  [Orabug: 38744086]  {CVE-2025-38678} 
  - Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha)  [Orabug: 38744084]  
  - rtc: expose RTC_FEATURE_UPDATE_INTERRUPT (Alexandre Belloni)  [Orabug: 38744082]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-315.196.5.1.el9uek]
changelog:
  - netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)  [Orabug: 38744086]  {CVE-2025-38678}
  - Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha)  [Orabug: 38744084]
  - rtc: expose RTC_FEATURE_UPDATE_INTERRUPT (Alexandre Belloni)  [Orabug: 38744082]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-315.196.5.2.el9uek]
changelog:
  - tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima)  [Orabug: 38786195]  {CVE-2025-40280} 
  - fs/proc: fix uaf in proc_readdir_de() (Wei Yang)  [Orabug: 38786194]  {CVE-2025-40271} 
  - vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj)  [Orabug: 38786193]  {CVE-2025-40248}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-315.196.3.el9uek]
changelog:
  - KVM: VMX: Intercept reads to invalid and write-only x2APIC registers (Sean Christopherson) [Orabug: 38535186]
  - KVM: VMX: Always intercept accesses to unsupported "extended" x2APIC regs (Sean Christopherson) [Orabug: 38535186]
  - KVM: x86: Split out logic to generate "readable" APIC regs mask to helper (Sean Christopherson) [Orabug: 38535186]
  - KVM: x86: Mark x2APIC DFR reg as non-existent for x2APIC (Sean Christopherson) [Orabug: 38535186]
  - uek-rpm/ol9/config-mips64-emb: Enable NF_TABLES for MIPS64 (Vijay Kumar) [Orabug: 38578981]
  - LTS version: v5.15.196 (Vijayendra Suman)
  - PCI: rcar: Demote WARN() to dev_warn_ratelimited() in rcar_pcie_wakeup() (Marek Vasut) [Orabug: 38641258] {CVE-2024-43876}
  - net: rtnetlink: fix module reference count leak issue in rtnetlink_rcv_msg (Zhengchao Shao)
  - usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai) [Orabug: 38601854] {CVE-2025-40094}
  - usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai) [Orabug: 38601837] {CVE-2025-40092}
  - usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
  - usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
  - arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() (Kaushlendra Kumar)
  - xfs: always warn about deprecated mount options (Darrick J. Wong)
  - devcoredump: Fix circular locking dependency with devcd->mutex. (Maarten Lankhorst)
  - PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
  - PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
  - PCI: rcar: Finish transition to L1 state in rcar_pcie_config_access() (Marek Vasut)
  - PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
  - f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
  - NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601818] {CVE-2025-40087}
  - vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601923] {CVE-2025-40105}
  - drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
  - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
  - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
  - PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
  - PCI: j721e: Enable ACSPCIE Refclk if "ti,syscon-acspcie-proxy-ctrl" exists (Siddharth Vadapalli)
  - fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong) [Orabug: 38730516] {CVE-2025-40220}
  - fuse: allocate ff->release_args only if release is needed (Amir Goldstein)
  - padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
  - iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
  - PM: runtime: Add new devm functions (Csókás Bence)
  - iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
  - iio: imu: inv_icm42600: use = { } instead of memset() (David Lechner)
  - NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
  - NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
  - NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
  - xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
  - xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
  - s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
  - arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
  - serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 (Florian Eckert)
  - most: usb: hdm_probe: Fix calling put_device() before device initialization (Victoria Votokina)
  - most: usb: Fix use-after-free in hdm_disconnect (Victoria Votokina)
  - mei: me: add wildcat lake P DID (Alexander Usyskin)
  - comedi: fix divide-by-zero in comedi_buf_munge() (Deepanshu Kartikey)
  - binder: remove "invalid inc weak" check (Alice Ryhl)
  - xhci: dbc: enable back DbC in resume if it was enabled before suspend (Mathias Nyman)
  - usb: raw-gadget: do not limit transfer length (Andrey Konovalov)
  - usb/core/quirks: Add Huawei ME906S to wakeup quirk (Tim Guttzeit)
  - USB: serial: option: add Telit FN920C04 ECM compositions (Li Qingwu)
  - USB: serial: option: add Quectel RG255C (Reinhard Speyerer)
  - USB: serial: option: add UNISOC UIS7720 (Renjun Wang)
  - net: ravb: Ensure memory write completes before ringing TX doorbell (Lad Prabhakar)
  - net: usb: rtl8150: Fix frame padding (Michał Pecio)
  - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [Orabug: 38730748] {CVE-2025-40231}
  - ocfs2: clear extent cache after moving/defragmenting extents (Deepanshu Kartikey) [Orabug: 38730546] {CVE-2025-40233}
  - MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering (Maciej W. Rozycki)
  - Revert "cpuidle: menu: Avoid discarding useful information" (Rafael J. Wysocki)
  - net: bonding: fix possible peer notify event loss or dup issue (Tonghao Zhang)
  - sctp: avoid NULL dereference when chunk data buffer is missing (Alexey Simakov) [Orabug: 38730566] {CVE-2025-40240}
  - arm64, mm: avoid always making PTE dirty in pte_mkwrite() (Huang, Ying)
  - dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path (Ioana Ciornei)
  - net: enetc: correct the value of ENETC_RXB_TRUESIZE (Wei Fang)
  - rtnetlink: Allow deleting FDB entries in user namespace (Johannes Wiesboeck)
  - net: rtnetlink: add NLM_F_BULK support to rtnl_fdb_del (Nikolay Aleksandrov)
  - net: rtnetlink: add bulk delete support flag (Nikolay Aleksandrov)
  - net: netlink: add NLM_F_BULK delete request modifier (Nikolay Aleksandrov)
  - net: rtnetlink: use BIT for flag values (Nikolay Aleksandrov)
  - net: rtnetlink: add helper to extract msg type's kind (Nikolay Aleksandrov)
  - m68k: bitops: Fix find_*_bit() signatures (Geert Uytterhoeven)
  - hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() (Yangtao Li)
  - hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() (Viacheslav Dubeyko)
  - dlm: check for defined force value in dlm_lockspace_release (Alexander Aring)
  - hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (Viacheslav Dubeyko)
  - hfs: validate record offset in hfsplus_bmap_alloc (Yang Chenzhi)
  - hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() (Viacheslav Dubeyko)
  - hfs: make proper initalization of struct hfs_find_data (Viacheslav Dubeyko)
  - hfs: clear offset and space out of valid records in b-tree node (Viacheslav Dubeyko)
  - nios2: ensure that memblock.current_limit is set when setting pfn limits (Simon Schuster)
  - exec: Fix incorrect type for ret (Xichao Zhao)
  - PCI/sysfs: Ensure devices are powered for config reads (part 2) (Brian Norris)
  - hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
  - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597093] {CVE-2025-40085}
  - ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
  - sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
  - sched/balancing: Rename newidle_balance() => sched_balance_newidle() (Ingo Molnar)
  - drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
  - net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset (I Viswanath)
  - net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
  - net: usb: use eth_hw_addr_set() instead of ether_addr_copy() (Jakub Kicinski)
  - tls: don't rely on tx_work during send() (Sabrina Dubroca)
  - tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
  - tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
  - net: tls: wait for async completion on last message (Sascha Hauer)
  - tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
  - tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
  - amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
  - net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov) [Orabug: 38649259] {CVE-2025-40173}
  - r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
  - doc: fix seg6_flowlabel path (Nicolas Dichtel)
  - net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
  - can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
  - dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
  - HID: multitouch: fix sticky fingers (Benjamin Tissoires)
  - cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
  - crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
  - drm/exynos: exynos7_drm_decon: remove ctx->suspended (Kaustabh Chakraborty)
  - drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
  - drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
  - blk-crypto: fix missing blktrace bio split events (Yu Kuai)
  - media: lirc: Fix error handling in lirc_register() (Ma Ke)
  - media: rc: Directly use ida_free() (Keliu)
  - media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
  - btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
  - ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey) [Orabug: 38649222] {CVE-2025-40167}
  - jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
  - r8152: add error handling in rtl8152_driver_init (Yi Cong)
  - LTS version: v5.15.195 (Vijayendra Suman)
  - selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
  - mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
  - media: pci: ivtv: Add check for DMA map result (Mikhail Kobuk) [Orabug: 38641260] {CVE-2024-43877}
  - xen/events: Update virq_to_irq on migration (Jason Andryuk)
  - media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
  - media: pci/ivtv: switch from 'pci_' to 'dma_' API (Christophe Jaillet)
  - arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
  - media: cx18: Add missing check after DMA map (Thomas Fourier)
  - media: switch from 'pci_' to 'dma_' API (Christophe Jaillet)
  - writeback: Avoid excessively long inode switching times (Jan Kara)
  - writeback: Avoid softlockup when switching many inodes (Jan Kara)
  - cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
  - fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
  - pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17) [Orabug: 38649275] {CVE-2025-40178}
  - minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
  - minmax.h: remove some #defines that are only expanded once (David Laight)
  - minmax.h: simplify the variants of clamp() (David Laight)
  - minmax.h: move all the clamp() definitions after the min/max() ones (David Laight)
  - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() (David Laight)
  - minmax.h: reduce the #define expansion of min(), max() and clamp() (David Laight)
  - minmax.h: update some comments (David Laight)
  - minmax.h: add whitespace around operators and after commas (David Laight)
  - minmax: fix up min3() and max3() too (Linus Torvalds)
  - minmax: improve macro expansion and type checking (Linus Torvalds)
  - minmax: simplify min()/max()/clamp() implementation (Linus Torvalds)
  - minmax: don't use max() in situations that want a C constant expression (Linus Torvalds)
  - minmax: make generic MIN() and MAX() macros available everywhere (Linus Torvalds)
  - minmax: simplify and clarify min_t()/max_t() implementation (Linus Torvalds)
  - minmax: add a few more MIN_T/MAX_T users (Linus Torvalds)
  - minmax: avoid overly complicated constant expressions in VM code (Linus Torvalds)
  - minmax: fix indentation of __cmp_once() and __clamp_once() (David Laight)
  - minmax: deduplicate __unconst_integer_typeof() (Andy Shevchenko)
  - minmax: Introduce {min,max}_array() (Herve Codina)
  - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
  - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
  - fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
  - dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing) [Orabug: 38649056] {CVE-2025-40134}
  - tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592032] {CVE-2025-40042}
  - ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
  - net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel) [Orabug: 38649002] {CVE-2025-40120}
  - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
  - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
  - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
  - media: mc: Clear minor number before put device (Edward Adam Davis) [Orabug: 38649397] {CVE-2025-40197}
  - Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher) [Orabug: 38649424] {CVE-2025-40200}
  - Squashfs: add additional inode sanity checking (Phillip Lougher)
  - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
  - ASoC: codecs: wcd934x: Simplify with dev_err_probe (Krzysztof Kozlowski)
  - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591958] {CVE-2025-40026}
  - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
  - ext4: free orphan info with kvfree (Jan Kara)
  - ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag) [Orabug: 38649329] {CVE-2025-40190}
  - ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
  - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
  - ext4: verify orphan file size is not too big (Jan Kara) [Orabug: 38649284] {CVE-2025-40179}
  - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
  - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
  - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
  - x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
  - x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
  - spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
  - spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
  - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
  - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
  - PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
  - PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
  - PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
  - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle) [Orabug: 38730511] {CVE-2025-40219}
  - PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
  - rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
  - rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
  - rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
  - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
  - mmc: core: SPI mode remove cmd7 (Rex Chen)
  - mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
  - sparc: fix error handling in scan_one_device() (Ma Ke)
  - sparc64: fix hugetlb for sun4u (Anthony Yznaga)
  - sctp: Fix MAC comparison to be constant-time (Eric Biggers) [Orabug: 38649450] {CVE-2025-40204}
  - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
  - pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
  - powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
  - powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
  - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
  - parisc: don't reference obsolete termio struct for TC* constants (Sam James)
  - openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
  - lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
  - KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
  - iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
  - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
  - init: handle bootloader identifier in kernel parameters (Huacai Chen)
  - iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
  - iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
  - iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
  - fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
  - crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
  - cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki) [Orabug: 38649365] {CVE-2025-40194}
  - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) (Simon Schuster)
  - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
  - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento) [Orabug: 38649461] {CVE-2025-40205}
  - drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
  - media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
  - firmware: meson_sm: fix device leak at probe (Johan Hovold)
  - xen/manage: Fix suspend error path (Lukas Wunner)
  - xen/events: Cleanup find_virq() return codes (Jason Andryuk)
  - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
  - arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
  - ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
  - ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
  - bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
  - gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
  - gpio: wcd934x: Remove duplicate assignment of of_gpio_n_cells (Andy Shevchenko)
  - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
  - crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581454,38705933] {CVE-2025-40019}
  - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
  - drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
  - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
  - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
  - drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
  - bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann) [Orabug: 38649299] {CVE-2025-40183}
  - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
  - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
  - tools build: Align warning options with perf (Leo Yan)
  - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
  - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima) [Orabug: 38649578] {CVE-2025-40186}
  - net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov) [Orabug: 38649311] {CVE-2025-40187}
  - drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes) [Orabug: 38643545] {CVE-2025-40111}
  - drm/vmwgfx: Copy DRM hash-table code into driver (Thomas Zimmermann)
  - s390/cio: unregister the subchannel while purging (Vineeth Vijayan)
  - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
  - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557653] {CVE-2025-40001}
  - scsi: mvsas: Use sas_task_find_rq() for tagging (John Garry)
  - scsi: mvsas: Delete mvs_tag_init() (John Garry)
  - scsi: libsas: Add sas_task_find_rq() (John Garry)
  - cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
  - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
  - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
  - perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
  - rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
  - perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
  - clk: at91: peripheral: fix return value (Brian Masney)
  - libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
  - perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
  - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
  - clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
  - fs: always return zero on success from replace_fd() (Thomas Weißschuh)
  - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
  - bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
  - pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591980] {CVE-2025-40030}
  - Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38592000] {CVE-2025-40035}
  - Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
  - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
  - mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi) [Orabug: 38649149] {CVE-2025-40153}
  - ext4: fix checks for orphan inodes (Jan Kara)
  - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
  - net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
  - fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592047] {CVE-2025-40044}
  - uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592066] {CVE-2025-40048}
  - Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592076] {CVE-2025-40049}
  - net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592097] {CVE-2025-40053}
  - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
  - nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
  - drivers/base/node: fix double free in register_one_node() (Donet Tom)
  - ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592109] {CVE-2025-40055}
  - hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
  - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
  - net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath) [Orabug: 38649095] {CVE-2025-40140}
  - RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
  - usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
  - scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar) [Orabug: 38648980] {CVE-2025-40115}
  - ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581444] {CVE-2025-40018}
  - NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
  - coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
  - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
  - sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
  - sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
  - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
  - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
  - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
  - wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
  - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
  - IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
  - RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
  - Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
  - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
  - scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
  - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
  - wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
  - RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
  - drivers/base/node: handle error properly in register_one_node() (Donet Tom)
  - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
  - netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
  - iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
  - fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
  - ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai) [Orabug: 38649006] {CVE-2025-40121}
  - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai) [Orabug: 38649156] {CVE-2025-40154}
  - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
  - pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592169] {CVE-2025-40070}
  - misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
  - usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
  - usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
  - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
  - tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
  - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation (Alok Tiwari)
  - wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
  - drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
  - ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
  - media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
  - scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
  - scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel) [Orabug: 38649566] {CVE-2025-40118}
  - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
  - drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
  - i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
  - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
  - thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
  - thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
  - tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
  - smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
  - bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592204] {CVE-2025-40078}
  - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
  - i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
  - nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner) [Orabug: 38649248] {CVE-2025-40171}
  - pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
  - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
  - firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
  - pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
  - PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
  - block: use int to store blk_stack_limits() return value (Rong Qianfeng)
  - regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
  - ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
  - blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan) [Orabug: 38649025] {CVE-2025-40125}
  - pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
  - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
  - ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
  - cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
  - libbpf: Fix reuse of DEVMAP (Yureka Lilian)
  - regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
  - x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
  - perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592220] {CVE-2025-40081}
  - coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
  - selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
  - filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
  - net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591964] {CVE-2025-40027}
  - minmax: add in_range() macro (Matthew Wilcox)
  - crypto: rng - Ensure set_ent is always present (Herbert Xu) [Orabug: 38643530] {CVE-2025-40109}
  - platform/x86: int3472: Check for adev == NULL (Hans de Goede)
  - driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
  - staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
  - staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
  - serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
  - hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
  - perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
  - dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
  - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
  - USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
  - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
  - media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou) [Orabug: 38548036] {CVE-2025-39994}
  - media: tunner: xc5000: Refactor firmware load (Ricardo Ribalda)
  - udp: Fix memory accounting leak. (Kuniyuki Iwashima) [Orabug: 37844324] {CVE-2025-22058}
  - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence (Will Deacon) [Orabug: 38513233]
  - media: rc: fix races with imon_disconnect() (Larshin Sergey) [Orabug: 38548026] {CVE-2025-39993}
  - media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou) [Orabug: 38548050] {CVE-2025-39996}
  - scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran) [Orabug: 38548058] {CVE-2025-39998}
  - LTS version: v5.15.194 (Vijayendra Suman)
  - drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)
  - i40e: add validation for ring_len param (Lukasz Czapnik) [Orabug: 38547951,38603025,38607608] {CVE-2025-39973}
  - i40e: increase max descriptors for XL710 (Justin Bronder)
  - i40e: fix idx validation in config queues msg (Lukasz Czapnik) [Orabug: 38547937] {CVE-2025-39971}
  - i40e: fix validation of VF state in get resources (Lukasz Czapnik) [Orabug: 38547928] {CVE-2025-39969}
  - mm/hugetlb: fix folio is still mapped when deleted (Tu Jinjiang) [Orabug: 38560480] {CVE-2025-40006}
  - mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize() (David Hildenbrand)
  - fbcon: Fix OOB access in font allocation (Thomas Zimmermann)
  - fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda) [Orabug: 38547912] {CVE-2025-39967}
  - tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu) [Orabug: 38581470] {CVE-2025-40021}
  - i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)
  - i40e: add max boundary check for VF filters (Lukasz Czapnik) [Orabug: 38547922] {CVE-2025-39968}
  - i40e: fix input validation logic for action_meta (Lukasz Czapnik) [Orabug: 38547932] {CVE-2025-39970}
  - i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik) [Orabug: 38547945] {CVE-2025-39972}
  - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers) [Orabug: 38641289] {CVE-2025-40022}
  - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu) [Orabug: 38537468,38575792,38575804] {CVE-2025-39964}
  - drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita) [Orabug: 38560495] {CVE-2025-40011}
  - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir Oltean)
  - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)
  - net: dsa: lantiq_gswip: do also enable or disable cpu port (Martin Schiller)
  - selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)
  - nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel) [Orabug: 38547971] {CVE-2025-39980}
  - bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)
  - ethernet: rvu-af: Remove slash from the driver name (Petr Malat)
  - can: peak_usb: fix shift-out-of-bounds issue (Stephane Grosjean) [Orabug: 38581461] {CVE-2025-40020}
  - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
  - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
  - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
  - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
  - can: etas_es58x: sort the includes by alphabetic order (Vincent Mailhol)
  - can: etas_es58x: advertise timestamping capabilities and add ioctl support (Vincent Mailhol)
  - can: dev: add generic function can_eth_ioctl_hwts() (Vincent Mailhol)
  - can: dev: add generic function can_ethtool_op_get_ts_info_hwts() (Vincent Mailhol)
  - can: bittiming: replace CAN units with the generic ones from linux/units.h (Vincent Mailhol)
  - can: bittiming: allow TDC{V,O} to be zero and add can_tdc_const::tdc{v,o,f}_min (Vincent Mailhol)
  - bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)
  - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)
  - arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)
  - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)
  - usb: core: Add 0x prefix to quirks debug output (Jiayi Li)
  - ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)
  - ALSA: usb-audio: Convert comma to semicolon (Chen Ni)
  - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)
  - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)
  - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)
  - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)
  - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)
  - ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)
  - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer (Hans de Goede)
  - net: rfkill: gpio: add DT support (Philipp Zabel)
  - mptcp: propagate shutdown to subflows when possible (Matthieu Baerts)
  - ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer (Namjae Jeon)
  - mptcp: set remote_deny_join_id0 on SYN recv (Matthieu Baerts)
  - phy: ti: omap-usb2: fix device leak at unbind (Johan Hovold)
  - phy: Use device_get_match_data() (Rob Herring)
  - phy: broadcom: ns-usb3: fix Wvoid-pointer-to-enum-cast warning (Krzysztof Kozlowski)
  - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels (Alan Stern)
  - usb: gadget: dummy_hcd: remove usage of list iterator past the loop body (Jakob Koschel)
  - xhci: dbc: Fix full DbC transfer ring after several reconnects (Mathias Nyman)
  - xhci: dbc: decouple endpoint allocation from initialization (Mathias Nyman)
  - serial: sc16is7xx: fix bug in flow control levels init (Hugo Villeneuve)
  - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path (Qi Xi)
  - drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ (Loic Poulain)
  - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message (Colin Ian King)
  - ASoC: wm8974: Correct PLL rate rounding (Charles Keepax)
  - ASoC: wm8940: Correct typo in control name (Charles Keepax)
  - mmc: mvsdio: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - btrfs: tree-checker: fix the incorrect inode ref size check (Qu Wenruo)
  - power: supply: bq27xxx: restrict no-battery detection to bq27000 (H. Nikolaus Schaller)
  - power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery (H. Nikolaus Schaller)
  - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* (Nathan Chancellor)
  - cnic: Fix use-after-free bugs in cnic_delete_task (Duoming Zhou) [Orabug: 38503848] {CVE-2025-39945}
  - net: liquidio: fix overflow in octeon_init_instr_queue() (Alexey Nepomnyashih)
  - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Kuniyuki Iwashima) [Orabug: 38526387] {CVE-2025-39955}
  - i40e: remove redundant memory barrier when cleaning Tx descs (Maciej Fijalkowski)
  - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure (Moon Yeounsu)
  - qed: Don't collect too many protection override GRC elements (Jamie Bainbridge) [Orabug: 38503869] {CVE-2025-39949}
  - dpaa2-switch: fix buffer pool seeding for control traffic (Ioana Ciornei)
  - um: virtio_uml: Fix use-after-free after put_device in probe (Miaoqian Lin)
  - cgroup: split cgroup_destroy_wq into 3 workqueues (Chen Ridong) [Orabug: 38503891] {CVE-2025-39953}
  - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch (Geert Uytterhoeven)
  - wifi: mac80211: fix incorrect type for ret (Liao Yuanhong)
  - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported (Takashi Sakamoto)
  - net: hsr: hsr_slave: Fix the promiscuous mode in offload mode (Ravi Gunasekaran)
  - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Miaohe Lin) [Orabug: 38461847] {CVE-2025-39883}
  - drm/i915/power: fix size for for_each_set_bit() in abox iteration (Jani Nikula)
  - phy: ti-pipe3: fix device leak at unbind (Johan Hovold)
  - phy: tegra: xusb: fix device and OF node leak at probe (Johan Hovold)
  - dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees (Stephan Gerhold) [Orabug: 38494821] {CVE-2025-39923}
  - regulator: sy7636a: fix lifecycle of power good gpio (Andreas Kemnade)
  - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (Anders Roxell)
  - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr (Hangbin Liu)
  - hsr: use rtnl lock when iterating over ports (Hangbin Liu)
  - net: hsr: Add VLAN CTAG filter support (Murali Karicheri)
  - net: hsr: Add support for MC filtering at the slave device (Murali Karicheri)
  - net: hsr: Disable promiscuous mode in offload mode (Ravi Gunasekaran)
  - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB (Anssi Hannula)
  - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails (Tetsuo Handa)
  - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed (Tetsuo Handa)
  - i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (Michal Schmidt) [Orabug: 38494786] {CVE-2025-39911}
  - i40e: Use irq_update_affinity_hint() (Nitesh Narayan Lal)
  - igb: fix link test skipping when interface is admin down (Kohei Enju)
  - tunnels: reset the GSO metadata before reusing the skb (Antoine Tenart)
  - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (Stefan Wahren)
  - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
  - USB: serial: option: add Telit Cinterion FN990A w/audio compositions (Fabio Porcedda)
  - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks (Krzysztof Kozlowski)
  - tty: hvc_console: Call hvc_kick in hvc_write unconditionally (Fabian Vogt)
  - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
  - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer (Christophe Kerello)
  - mtd: rawnand: stm32_fmc2: Fix dma_map_sg error check (Jack Wang)
  - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing (Alexander Sverdlin)
  - mtd: nand: raw: atmel: Fix comment in timings preparation (Alexander Dahl)
  - mm/khugepaged: fix the address passed to notifier on testing young (Wei Yang)
  - libceph: fix invalid accesses to ceph_connection_v1_info (Ilya Dryomov) [Orabug: 38461836] {CVE-2025-39880}
  - fuse: prevent overflow in copy_file_range return value (Miklos Szeredi)
  - fuse: check if copy_file_range() returns larger than requested size (Miklos Szeredi)
  - mtd: rawnand: stm32_fmc2: fix ECC overwrite (Christophe Kerello)
  - ocfs2: fix recursive semaphore deadlock in fiemap call (Mark Tinguely) [Orabug: 38461858] {CVE-2025-39885}
  - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN (Krister Johansen)
  - compiler-clang.h: define __SANITIZE_*__ macros only when undefined (Nathan Chancellor)
  - EDAC/altera: Delete an inappropriate dma_free_coherent() call (Salah Triki)
  - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. (Kuniyuki Iwashima) [Orabug: 38494796] {CVE-2025-39913}
  - NFSv4/flexfiles: Fix layout merge mirror check. (Jonathan Curley)
  - tracing: Fix tracing_marker may trigger page fault during preempt_disable (Luo Gengkun)
  - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server (Trond Myklebust)
  - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set (Trond Myklebust)
  - mm/rmap: reject hugetlb folios in folio_make_device_exclusive() (David Hildenbrand)
  - net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod. (Kuniyuki Iwashima) [Orabug: 37901603] {CVE-2025-23143}
  - media: i2c: imx214: Fix link frequency validation (André Apitzsch)
  - media: mtk-vcodec: venc: avoid -Wenum-compare-conditional warning (Arnd Bergmann)
  - mm: introduce and use {pgd,p4d}_populate_kernel() (Harry Yoo)
  - kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
  - xfs: short circuit xfs_growfs_data_private() if delta is zero (Eric Sandeen)
  - Revert "fbdev: Disable sysfb device registration when removing conflicting FBs" (Brett A C Sheffield)


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-316.196.1.el9uek]
changelog:
  - uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu) [Orabug: 38609547]
  - bnxt_en: Fix memory corruption when FW resources change during ifdown (Sreekanth Reddy) [Orabug: 38440240] {CVE-2025-39810}
  - selftests/proc: add PROCMAP_QUERY ioctl tests (Andrii Nakryiko) [Orabug: 38410775]
  - tools: sync uapi/linux/fs.h header into tools subdir (Andrii Nakryiko) [Orabug: 38410775]
  - docs/procfs: call out ioctl()-based PROCMAP_QUERY command existence (Andrii Nakryiko) [Orabug: 38410775]
  - fs/procfs: add build ID fetching to PROCMAP_QUERY API (Andrii Nakryiko) [Orabug: 38410775]
  - fs/procfs: implement efficient VMA querying API for /proc/<pid>/maps (Andrii Nakryiko) [Orabug: 38410775]
  - fs/procfs: extract logic for getting VMA name constituents (Andrii Nakryiko) [Orabug: 38410775]
  - fs: create helper file_user_path() for user displayed mapped file path (Amir Goldstein) [Orabug: 38410775]
  - mm: factor out VMA stack and heap checks (Kefeng Wang) [Orabug: 38410775]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-316.196.2.el9uek]
changelog:
  - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Pradyumn Rahar) [Orabug: 37961220,38730620] {CVE-2025-40250}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-316.196.3.el9uek]
changelog:
  - rds: Add smp_rmb before reading c_destroy_in_prog (Håkon Bugge) [Orabug: 38352484]
  - Revert "block: don't add or resize partition on the disk with GENHD_FL_NO_PART" (Gulam Mohamed) [Orabug: 38652797]
  - Revert "block: Move checking GENHD_FL_NO_PART to bdev_add_partition()" (Gulam Mohamed) [Orabug: 38652797]


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-316.196.4.el9uek]
changelog:
  - vhost_scsi: Sync up cmd completion locking with upstream (Mike Christie)  [Orabug: 38545946]
  - vhost_scsi: add support for worker ioctls (Mike Christie)  [Orabug: 38545946]
  - vhost: Limit access to vhost worker ioctls (Mike Christie)  [Orabug: 38545946]
  - vhost: allow userspace to create workers (Mike Christie)  [Orabug: 38545946]
  - vhost: replace single worker pointer with xarray (Mike Christie)  [Orabug: 38545946]
  - vhost: add helper to parse userspace vring state/file (Mike Christie)  [Orabug: 38545946]
  - vhost: remove vhost_work_queue (Mike Christie)  [Orabug: 38545946]
  - vhost_scsi: flush IO vqs then send TMF rsp (Mike Christie)  [Orabug: 38545946]
  - vhost_scsi: convert to vhost_vq_work_queue (Mike Christie)  [Orabug: 38545946]
  - vhost_scsi: make SCSI cmd completion per vq (Mike Christie)  [Orabug: 38545946]
  - vhost_sock: convert to vhost_vq_work_queue (Mike Christie)  [Orabug: 38545946]
  - vhost: convert poll work to be vq based (Mike Christie)  [Orabug: 38545946]
  - vhost: take worker or vq for flushing (Mike Christie)  [Orabug: 38545946]
  - vhost: take worker or vq instead of dev for queueing (Mike Christie)  [Orabug: 38545946]
  - vhost, vhost_net: add helper to check if vq has work (Mike Christie)  [Orabug: 38545946]
  - vhost: add vhost_worker pointer to vhost_virtqueue (Mike Christie)  [Orabug: 38545946]
  - vhost: dynamically allocate vhost_worker (Mike Christie)  [Orabug: 38545946]
  - vhost: create worker at end of vhost_dev_set_owner (Mike Christie)  [Orabug: 38545946]
  - vhost-scsi: Fix crash during LUN unmapping (Mike Christie)  [Orabug: 38545946]
  - vhost: move worker thread fields to new struct (Mike Christie)  [Orabug: 38545946]
  - vhost: Fix livepatch timeouts in vhost_worker() (Josh Poimboeuf)  [Orabug: 38545946]
  - vhost: rename vhost_work_dev_flush (Mike Christie)  [Orabug: 38545946]
  - vhost-test: drop flush after vhost_dev_cleanup (Mike Christie)  [Orabug: 38545946]
  - vhost/test: fix memory leak of vhost virtqueues (Xianting Tian)  [Orabug: 38545946]
  - vhost-scsi: drop flush after vhost_dev_cleanup (Mike Christie)  [Orabug: 38545946]
  - vhost_vsock: simplify vhost_vsock_flush() (Andrey Ryabinin)  [Orabug: 38545946]
  - vhost_test: remove vhost_test_flush_vq() (Andrey Ryabinin)  [Orabug: 38545946]
  - vhost_net: get rid of vhost_net_flush_vq() and extra flush calls (Andrey Ryabinin)  [Orabug: 38545946]
  - vhost: flush dev once during vhost_dev_stop (Mike Christie)  [Orabug: 38545946]
  - vhost: get rid of vhost_poll_flush() wrapper (Andrey Ryabinin)  [Orabug: 38545946]
  - net/mlx5e: Add a miss level for ipsec crypto offload (Lama Kayal)  [Orabug: 38600056]
  - net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)  [Orabug: 38600056]
  - mm/hugetlb: add option to allows disabling CVE-2025-38085 mitigation (Joe Jin)  [Orabug: 38728358]
  - uek-rpm: Replace check-kabi tool with kabi (Yifei Liu)  [Orabug: 38673381]
  - uek-rpm: Introduce check function for uek-rpm/tools/kabi (Yifei Liu)  [Orabug: 38673381]
  - rtc: expose RTC_FEATURE_UPDATE_INTERRUPT (Alexandre Belloni)  [Orabug: 38708842]
  - Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha)  [Orabug: 38710346]
  - netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso)  [Orabug: 38389767]  {CVE-2025-38678}
  - HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 (Zhang Heng)
  - mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR (Matthieu Baerts (NGI0))
  - USB: storage: Remove subclass and protocol overrides from Novatek quirk (Alan Stern)
  - most: usb: fix double free on late probe failure (Johan Hovold)
  - uio_hv_generic: Set event for all channels on the device (Long Li)
  - regmap: slimbus: fix bus_context pointer in regmap init calls (Alexey Klimov)
  - usb: typec: ucsi: psy: Set max current to zero when disconnected (Jameson Thies)
  - ata: libata-scsi: Fix system suspend for a security locked drive (Niklas Cassel)
  - MIPS: mm: Prevent a TLB shutdown on initial uniquification (Maciej W. Rozycki)


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-316.196.4.1.el9uek]
changelog:
  - tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima)  [Orabug: 38788585]  {CVE-2025-40280} 
  - fs/proc: fix uaf in proc_readdir_de() (Wei Yang)  [Orabug: 38788587]  {CVE-2025-40271} 
  - vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj)  [Orabug: 38788594]  {CVE-2025-40248}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-316.196.4.1.el9uek]
changelog:
  - tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima)  [Orabug: 38788585]  {CVE-2025-40280}
  - fs/proc: fix uaf in proc_readdir_de() (Wei Yang)  [Orabug: 38788587]  {CVE-2025-40271}
  - vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj)  [Orabug: 38788594]  {CVE-2025-40248}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-316.196.4.2.el9uek]
changelog:
  - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added (Sabrina Dubroca)   
  - usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE (Gopi Krishna Menon)   
  - ext4: clear i_state_flags when alloc inode (Haibo Chen)   
  - ext4: align max orphan file size with e2fsprogs limit (Baokun Li)   
  - PM: runtime: Do not clear needs_force_resume with enabled runtime PM (Rafael J. Wysocki)   
  - net: enetc: fix build warning when PAGE_SIZE is greater than 128K (Wei Fang)   
  - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Xiang Mei)   
  - block: fix comment for op_is_zone_mgmt() to include RESET_ALL (shechenglong)   
  - fuse: fix readahead reclaim deadlock (Joanne Koong)   
  - i40e: validate ring_len parameter against hardware-specific values (Gregory Herrero)   
  - fs/ntfs3: fix mount failure for sparse runs in run_unpack() (Konstantin Komarov)   
  - xfrm: delete x->tunnel as we delete x (Sabrina Dubroca)  [Orabug: 38933003]  {CVE-2025-40215} 
  - mptcp: fix race condition in mptcp_schedule_work() (Eric Dumazet)  [Orabug: 38932997]  {CVE-2025-40258} 
  - mlx5: Fix default values in create CQ (Akiva Goldberger)  [Orabug: 38932992]  
  - sunrpc: fix handling of server side tls alerts (Olga Kornievskaia)  [Orabug: 38932991]  {CVE-2025-38566} 
  - sunrpc: fix client side handling of tls alerts (Olga Kornievskaia)  [Orabug: 38932988]  {CVE-2025-38571}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-316.196.4.el9uek]
changelog:
  - vhost_scsi: Sync up cmd completion locking with upstream (Mike Christie) [Orabug: 38545946]
  - vhost_scsi: add support for worker ioctls (Mike Christie) [Orabug: 38545946]
  - vhost: Limit access to vhost worker ioctls (Mike Christie) [Orabug: 38545946]
  - vhost: allow userspace to create workers (Mike Christie) [Orabug: 38545946]
  - vhost: replace single worker pointer with xarray (Mike Christie) [Orabug: 38545946]
  - vhost: add helper to parse userspace vring state/file (Mike Christie) [Orabug: 38545946]
  - vhost: remove vhost_work_queue (Mike Christie) [Orabug: 38545946]
  - vhost_scsi: flush IO vqs then send TMF rsp (Mike Christie) [Orabug: 38545946]
  - vhost_scsi: convert to vhost_vq_work_queue (Mike Christie) [Orabug: 38545946]
  - vhost_scsi: make SCSI cmd completion per vq (Mike Christie) [Orabug: 38545946]
  - vhost_sock: convert to vhost_vq_work_queue (Mike Christie) [Orabug: 38545946]
  - vhost: convert poll work to be vq based (Mike Christie) [Orabug: 38545946]
  - vhost: take worker or vq for flushing (Mike Christie) [Orabug: 38545946]
  - vhost: take worker or vq instead of dev for queueing (Mike Christie) [Orabug: 38545946]
  - vhost, vhost_net: add helper to check if vq has work (Mike Christie) [Orabug: 38545946]
  - vhost: add vhost_worker pointer to vhost_virtqueue (Mike Christie) [Orabug: 38545946]
  - vhost: dynamically allocate vhost_worker (Mike Christie) [Orabug: 38545946]
  - vhost: create worker at end of vhost_dev_set_owner (Mike Christie) [Orabug: 38545946]
  - vhost-scsi: Fix crash during LUN unmapping (Mike Christie) [Orabug: 38545946]
  - vhost: move worker thread fields to new struct (Mike Christie) [Orabug: 38545946]
  - vhost: Fix livepatch timeouts in vhost_worker() (Josh Poimboeuf) [Orabug: 38545946]
  - vhost: rename vhost_work_dev_flush (Mike Christie) [Orabug: 38545946]
  - vhost-test: drop flush after vhost_dev_cleanup (Mike Christie) [Orabug: 38545946]
  - vhost/test: fix memory leak of vhost virtqueues (Xianting Tian) [Orabug: 38545946]
  - vhost-scsi: drop flush after vhost_dev_cleanup (Mike Christie) [Orabug: 38545946]
  - vhost_vsock: simplify vhost_vsock_flush() (Andrey Ryabinin) [Orabug: 38545946]
  - vhost_test: remove vhost_test_flush_vq() (Andrey Ryabinin) [Orabug: 38545946]
  - vhost_net: get rid of vhost_net_flush_vq() and extra flush calls (Andrey Ryabinin) [Orabug: 38545946]
  - vhost: flush dev once during vhost_dev_stop (Mike Christie) [Orabug: 38545946]
  - vhost: get rid of vhost_poll_flush() wrapper (Andrey Ryabinin) [Orabug: 38545946]
  - net/mlx5e: Add a miss level for ipsec crypto offload (Lama Kayal) [Orabug: 38600056]
  - net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu) [Orabug: 38600056]
  - mm/hugetlb: add option to allows disabling CVE-2025-38085 mitigation (Joe Jin) [Orabug: 38728358] {CVE-2025-38085}
  - uek-rpm: Replace check-kabi tool with kabi (Yifei Liu) [Orabug: 38673381]
  - uek-rpm: Introduce check function for uek-rpm/tools/kabi (Yifei Liu) [Orabug: 38673381]
  - rtc: expose RTC_FEATURE_UPDATE_INTERRUPT (Alexandre Belloni) [Orabug: 38708842]
  - Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38710346]
  - netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso) [Orabug: 38389767,38744086] {CVE-2025-38678}
  - HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 (Zhang Heng)
  - mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR (Matthieu Baerts)
  - USB: storage: Remove subclass and protocol overrides from Novatek quirk (Alan Stern)
  - most: usb: fix double free on late probe failure (Johan Hovold)
  - uio_hv_generic: Set event for all channels on the device (Long Li)
  - regmap: slimbus: fix bus_context pointer in regmap init calls (Alexey Klimov)
  - usb: typec: ucsi: psy: Set max current to zero when disconnected (Jameson Thies)
  - ata: libata-scsi: Fix system suspend for a security locked drive (Niklas Cassel)
  - MIPS: mm: Prevent a TLB shutdown on initial uniquification (Maciej W. Rozycki)


author: Vijayendra Suman <vijayendra.suman@oracle.com> [5.15.0-317.197.1.el9uek]
changelog:
  - LTS version: v5.15.197 (Vijayendra Suman)
  - libbpf: Fix invalid return address register in s390 (Daniel T. Lee)
  - libbpf, riscv: Use a0 for RC register (Yixun Lan)
  - libbpf: Fix riscv register names (Ilya Leoshkevich)
  - selftests/bpf: Don't rely on preserving volatile in PT_REGS macros in loop3 (Andrii Nakryiko)
  - scsi: pm80xx: Set phy->enable_completion only when we (Igor Pylypiv) [Orabug: 37159744] {CVE-2024-47666}
  - Bluetooth: Add more enc key size check (Alex Lu)
  - usb: renesas_usbhs: Fix synchronous external abort on unbind (Claudiu Beznea) [Orabug: 38792571] {CVE-2025-68327}
  - usb: renesas_usbhs: Convert to platform remove callback returning void (Uwe Kleine-König)
  - smb: client: fix memory leak in cifs_construct_tcon() (Paulo Alcantara) [Orabug: 38773704] {CVE-2025-68295}
  - mptcp: Fix proto fallback detection with BPF (Jiayuan Chen) [Orabug: 38773435] {CVE-2025-68227}
  - mptcp: avoid unneeded subflow-level drops (Paolo Abeni)
  - selftests: mptcp: join: rm: set backup flag (Matthieu Baerts)
  - staging: rtl8712: Remove driver using deprecated API wext (Philipp Hortmann)
  - libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (Ziming Zhang) [Orabug: 38773649] {CVE-2025-68284}
  - libceph: fix potential use-after-free in have_mon_and_osd_map() (Ilya Dryomov) [Orabug: 38773655] {CVE-2025-68285}
  - drm/amd/display: Check NULL before accessing (Alex Hung) [Orabug: 38773664] {CVE-2025-68286}
  - drm: sti: fix device leaks at component probe (Johan Hovold)
  - USB: serial: option: add support for Rolling RW101R-GL (Vanillan Wang)
  - USB: serial: ftdi_sio: add support for u-blox EVK-M101 (Oleksandr Suvorov)
  - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host (Mathias Nyman)
  - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths (Manish Nagar) [Orabug: 38773671] {CVE-2025-68287}
  - usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer (Owen Gu) [Orabug: 38792593] {CVE-2025-68331}
  - usb: storage: sddr55: Reject out-of-bound new_pba (Tianchu Chen) [Orabug: 38762730] {CVE-2025-40345}
  - usb: storage: Fix memory leak in USB bulk transport (Desnes Nunes) [Orabug: 38773677] {CVE-2018-1000204,CVE-2025-68288}
  - usb: gadget: f_eem: Fix memory leak in eem_unwrap (Kuen-Han Tsai) [Orabug: 38773687] {CVE-2025-68289}
  - usb: cdns3: Fix double resource release in cdns3_pci_probe (Miaoqian Lin)
  - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking (Miaoqian Lin)
  - firmware: stratix10-svc: fix bug in saving controller data (Khairul Anuar Romli)
  - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves (Miaoqian Lin)
  - thunderbolt: Add support for Intel Wildcat Lake (Alan Borzeszkowski)
  - drivers/usb/dwc3: fix PCI parent check (Jamie Iles)
  - dm-verity: fix unreliable memory allocation (Mikulas Patocka)
  - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling (Marc Kleine-Budde)
  - can: sja1000: fix max irq loop handling (Thomas Mühlbacher)
  - atm/fore200e: Fix possible data race in fore200e_open() (Gui-Dong Han)
  - iio: accel: bmc150: Fix irq assumption regression (Linus Walleij) [Orabug: 38792587] {CVE-2025-68330}
  - iio:common:ssp_sensors: Fix an error handling path ssp_probe() (Christophe Jaillet)
  - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields (Francesco Lavra)
  - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" (Jiri Olsa)
  - spi: bcm63xx: fix premature CS deassertion on RX-only transactions (Hang Zhou)
  - mailbox: mailbox-test: Fix debugfs_create_dir error checking (Xu Wang)
  - net: atlantic: fix fragment overflow handling in RX path (Jiefeng Zhang) [Orabug: 38773729] {CVE-2025-68301}
  - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic (Vladimir Oltean)
  - net: dsa: sja1105: simplify static configuration reload (Russell King)
  - net: dsa: sja1105: Convert to mdiobus_c45_read (Andrew Lunn)
  - net: sxgbe: fix potential NULL dereference in sxgbe_rx() (Alexey Kodanev)
  - net/mlx5e: Fix validation logic in rate limiting (Danielle Costantino)
  - net: aquantia: Add missing descriptor cache invalidation on ATL2 (Kai-Heng Feng)
  - platform/x86: intel: punit_ipc: fix memory corruption (Dan Carpenter)
  - Bluetooth: SMP: Fix not generating mackey and ltk when repairing (Luiz Augusto von Dentz)
  - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers (Seungjin Bae) [Orabug: 38773760] {CVE-2025-68308}
  - Revert "block: don't add or resize partition on the disk with GENHD_FL_NO_PART" (Gulam Mohamed) [Orabug: 38652797]
  - Revert "block: Move checking GENHD_FL_NO_PART to bdev_add_partition()" (Gulam Mohamed) [Orabug: 38652797]
  - mptcp: do not fallback when OoO is present (Paolo Abeni)
  - mptcp: fix a race in mptcp_pm_del_add_timer() (Eric Dumazet) [Orabug: 38730656] {CVE-2025-40257}
  - mptcp: fix premature close in case of fallback (Paolo Abeni)
  - mptcp: fix ack generation for fallback msk (Paolo Abeni)
  - dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups (Krzysztof Kozlowski)
  - Input: pegasus-notetaker - fix potential out-of-bounds access (Seungjin Bae)
  - Input: remove third argument of usb_maxpacket() (Vincent Mailhol)
  - usb: deprecate the third argument of usb_maxpacket() (Vincent Mailhol)
  - mptcp: Disallow MPTCP subflows from sockmap (Jiayuan Chen)
  - selftests: mptcp: connect: fix fallback note due to OoO (Matthieu Baerts)
  - pmdomain: samsung: plug potential memleak during probe (André Draszik)
  - pmdomain: arm: scmi: Fix genpd leak on provider registration failure (Sudeep Holla)
  - pmdomain: imx: Fix reference count leak in imx_gpc_remove (Miaoqian Lin)
  - net: netpoll: fix incorrect refcount handling causing incorrect cleanup (Breno Leitao) [Orabug: 38773509] {CVE-2025-68245}
  - mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 (Shawn Lin)
  - net: qede: Initialize qede_ll_ops with designated initializer (Nathan Chancellor)
  - btrfs: fix crash on racing fsync and size-extending write into prealloc (Omar Sandoval) [Orabug: 36774582] {CVE-2024-37354}
  - btrfs: add helper to truncate inode items when logging inode (Filipe Manana)
  - Makefile.compiler: replace cc-ifversion with compiler-specific macros (Nick Desaulniers)
  - tracing/tools: Fix incorrcet short option in usage text for --threads (Zhang Chujun)
  - net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error (Nishanth Menon)
  - ALSA: usb-audio: fix uac2 clock source at terminal parser (René Rebe)
  - mm/secretmem: fix use-after-free race in fault handler (Lance Yang) [Orabug: 38737039] {CVE-2025-40272}
  - mm/mm_init: fix hash table order logging in alloc_large_system_hash() (Isaac J. Manjarres)
  - kconfig/nconf: Initialize the default locale at startup (Jakub Horký)
  - kconfig/mconf: Initialize the default locale at startup (Jakub Horký)
  - net: tls: Cancel RX async resync request on rcd_delta overflow (Shahar Shitrit)
  - selftests: net: use BASH for bareudp testing (Po-Hsu Lin)
  - scsi: core: Fix a regression triggered by scsi_host_busy() (Bart Van Assche) [Orabug: 38773426]
  - vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj) [Orabug: 38730611,38786193,38788594] {CVE-2025-40248}
  - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Pavel Zhigulin) [Orabug: 38730629] {CVE-2025-40252}
  - kernel.h: Move ARRAY_SIZE() to a separate header (Alejandro Colomar)
  - platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos (Xu Wang)
  - s390/ctcm: Fix double-kfree (Aleksei Nikiforov)
  - net: openvswitch: remove never-working support for setting nsh fields (Ilya Maximets) [Orabug: 38730648] {CVE-2025-40254}
  - net: dsa: hellcreek: fix missing error handling in LED registration (Pavel Zhigulin)
  - mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() (Zilin Guan)
  - drm/tegra: dc: Fix reference leak in tegra_dc_couple() (Ma Ke)
  - mptcp: fix race condition in mptcp_schedule_work() (Eric Dumazet) [Orabug: 38730659] {CVE-2025-40258}
  - MIPS: Malta: Fix !EVA SOC-it PCI MMIO (Maciej W. Rozycki)
  - scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() (Hamza Mahfooz) [Orabug: 38773440] {CVE-2025-68229}
  - scsi: sg: Do not sleep in atomic context (Bart Van Assche) [Orabug: 38730663] {CVE-2025-40259}
  - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [Orabug: 38730673] {CVE-2025-40261}
  - Input: imx_sc_key - fix memory corruption on unload (Dan Carpenter)
  - Input: cros_ec_keyb - fix an invalid memory access (Tzung-Bi Shih) [Orabug: 38730680] {CVE-2025-40263}
  - be2net: pass wrb_params in case of OS2BMC (Andrey Vatoropin) [Orabug: 38730689] {CVE-2025-40264}
  - exfat: check return value of sb_min_blocksize in exfat_read_boot_sector (Yongpeng Yang)
  - mtd: rawnand: cadence: fix DMA device NULL pointer dereference (Niravkumar L Rabara)
  - net/sched: act_connmark: handle errno on tcf_idr_check_alloc (Pedro Tammela)
  - isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (Abdun Nihaal) [Orabug: 38798907] {CVE-2025-68734}
  - EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection (Niravkumar L Rabara)
  - EDAC/altera: Handle OCRAM ECC enable after warm reset (Niravkumar L Rabara)
  - spi: Try to get ACPI GPIO IRQ earlier (Hans de Goede)
  - ALSA: usb-audio: Fix missing unlock at error path of maxpacksize check (Takashi Iwai)
  - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (Takashi Iwai) [Orabug: 38737023] {CVE-2025-40269}
  - fs/proc: fix uaf in proc_readdir_de() (Wei Yang) [Orabug: 38737033,38786194,38788587] {CVE-2025-40271}
  - ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (Chuang Wang) [Orabug: 38773495] {CVE-2025-68241}
  - strparser: Fix signed/unsigned mismatch bug (Nate Karstens)
  - gcov: add support for GCC 15 (Peter Oberparleiter)
  - NFSD: free copynotify stateid in nfs4_free_ol_stateid() (Olga Kornievskaia) [Orabug: 38737042] {CVE-2025-40273}
  - HID: hid-ntrig: Prevent memory leak in ntrig_report_version() (Masami Ichikawa)
  - mtd: onenand: Pass correct pointer to IRQ handler (Dan Carpenter)
  - lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN (Eric Biggers)
  - mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592026] {CVE-2025-40040}
  - bpf: Add bpf_prog_run_data_pointers() (Eric Dumazet) [Orabug: 38773327] {CVE-2025-68200}
  - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (Haein Lee) [Orabug: 38737051] {CVE-2025-40275}
  - NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() (Trond Myklebust)
  - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (Ian Forbes) [Orabug: 38737060] {CVE-2025-40277}
  - ASoC: cs4271: Fix regulator leak on probe failure (Xu Wang)
  - regulator: fixed: fix GPIO descriptor leak on register failure (Xu Wang)
  - acpi,srat: Fix incorrect device handle check for Generic Initiator (Shuai Xue)
  - Bluetooth: L2CAP: export l2cap_chan_hold for modules (Pauli Virtanen)
  - hsr: Fix supervision frame sending on HSRv0 (Felix Maurer)
  - net_sched: limit try_bulk_dequeue_skb() batches (Eric Dumazet)
  - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Gal Pressman)
  - net/mlx5e: Fix maxrate wraparound in threshold between units (Gal Pressman)
  - net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (Ranganath V N)
  - net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (Ranganath V N) [Orabug: 38737072] {CVE-2025-40279}
  - net_sched: act_connmark: use RCU in tcf_connmark_dump() (Eric Dumazet)
  - net/sched: act_connmark: transition to percpu stats and rcu (Pedro Tammela)
  - net: sched: act_connmark: get rid of tcf_connmark_walker and tcf_connmark_search (Zhengchao Shao)
  - net: sched: act: move global static variable net_id to tc_action_ops (Zhengchao Shao)
  - wifi: mac80211: skip rate verification for not captured PSDUs (Benjamin Berg)
  - net: mdio: fix resource leak in mdiobus_register_device() (Csaba Buday)
  - tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima) [Orabug: 38737082,38786195,38788585] {CVE-2025-40280}
  - net/smc: fix mismatch between CLC header and proposal (D. Wythe)
  - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto (Eric Dumazet) [Orabug: 38737090] {CVE-2025-40281}
  - Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions (Pauli Virtanen)
  - Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion (Pauli Virtanen)
  - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (Pauli Virtanen)
  - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (Raphael Pinsonneault-Thibeault) [Orabug: 38737103] {CVE-2025-40283}
  - net: fec: correct rx_bytes statistic for the case SHIFT16 is set (Wei Fang)
  - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (Sharique Mohammad)
  - NFS: check if suid/sgid was cleared after a write as needed (Scott Mayhew)
  - HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (Tristan Lobb)
  - NFS4: Fix state renewals missing after boot (Joshua Watt)
  - RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors (Danil Skrebenkov)
  - compiler_types: Move unused static inline functions warning to W=2 (Peter Zijlstra)
  - drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (Janusz Krzysztofik) [Orabug: 38773506] {CVE-2025-68244}
  - selftests: netdevsim: set test timeout to 10 minutes (Jakub Kicinski)
  - extcon: adc-jack: Cleanup wakeup source only if it was enabled (Krzysztof Kozlowski)
  - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC (Nathan Chancellor)
  - rtc: rx8025: fix incorrect register reference (Yuta Hayama)
  - tracing: Fix memory leaks in create_field_var() (Zilin Guan)
  - bnxt_en: Fix a possible memory leak in bnxt_ptp_init (Kalesh Ap)
  - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (Qendrim Maxhuni) [Orabug: 38773282] {CVE-2025-68192}
  - sctp: Hold sock lock while iterating over address list (Stefan Wiehler)
  - sctp: Prevent TOCTOU out-of-bounds write (Stefan Wiehler) [Orabug: 38747446] {CVE-2025-40331}
  - sctp: Hold RCU read lock while iterating over address list (Stefan Wiehler)
  - net: dsa: b53: stop reading ARL entries if search is done (Jonas Gorski)
  - net: dsa: b53: fix enabling ip multicast (Jonas Gorski)
  - net: dsa: b53: fix resetting speed and pause on forced link (Jonas Gorski)
  - net: vlan: sync VLAN features with lower device (Hangbin Liu)
  - selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh (Wang Liang)
  - netdevsim: add Makefile for selftests (David Wei)
  - selftests/net: use destination options instead of hop-by-hop (Anubhav Singh)
  - selftests/net: fix GRO coalesce test and add ext header coalesce tests (Richard Gobert)
  - selftests/net: fix out-of-order delivery of FIN in gro:tcp test (Anubhav Singh)
  - net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx (Jonas Gorski)
  - riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro (Josephine Pfeiffer)
  - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" (Baochen Qiang)
  - ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again (Kailang Yang)
  - ceph: add checking of wait_for_completion_killable() return value (Viacheslav Dubeyko)
  - ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (Valerio Setti)
  - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (Albin Babu Varghese) [Orabug: 38737181] {CVE-2025-40304}
  - ACPI: property: Return present device nodes only on fwnode interface (Sakari Ailus)
  - 9p: sysfs_init: don't hardcode error to ENOMEM (Randall P. Embry)
  - cpufreq: tegra186: Initialize all cores to max frequencies (Aaron Kling)
  - 9p: fix /sys/fs/9p/caches overwriting itself (Randall P. Embry)
  - clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled (Matthias Schiffer)
  - clk: at91: clk-master: Add check for divide by 3 (Ryan Wanner)
  - ARM: at91: pm: save and restore ACR during PLL disable/enable (Nicolas Ferre)
  - rtc: pcf2127: clear minute/second interrupt (Josua Mayer)
  - um: Fix help message for ssl-non-raw (Tiwei Bie)
  - fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink (Yikang Yue)
  - btrfs: mark dirty extent range for out of bound prealloc extents (Austinchang)
  - RDMA/hns: Fix wrong WQE data when QP wraps around (Junxian Huang)
  - RDMA/irdma: Set irdma_cq cq_num field during CQ create (Jacob Moroni)
  - RDMA/irdma: Remove unused struct irdma_cq fields (Jacob Moroni)
  - RDMA/irdma: Fix SD index calculation (Jacob Moroni)
  - ACPICA: Update dsmethod.c to get rid of unused variable warning (Saket Dumbre)
  - orangefs: fix xattr related buffer overflow... (Mike Marshall)
  - page_pool: Clamp pool size to max 16K pages (Dragos Tatulea)
  - exfat: limit log print for IO error (Chi Zhiling)
  - ALSA: usb-audio: add mono main switch to Presonus S1824c (Roy Vegard Ovesen)
  - Bluetooth: bcsp: receive data only if registered (Ivan Pravdin) [Orabug: 38737212] {CVE-2025-40308}
  - Bluetooth: SCO: Fix UAF on sco_conn_free (Luiz Augusto von Dentz) [Orabug: 38737223] {CVE-2025-40309}
  - net: macb: avoid dealing with endianness in macb_set_hwaddr() (Théo Lebrun)
  - fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock (Chuguangqing) [Orabug: 38773127] {CVE-2025-40361}
  - scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() (Alok Tiwari)
  - nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing (Al Viro) [Orabug: 38773244] {CVE-2025-68185}
  - NFSv4.1: fix mount hang after CREATE_SESSION failure (Anthony Iliopoulos)
  - NFSv4: handle ERR_GRACE on delegation recalls (Olga Kornievskaia)
  - remoteproc: qcom: q6v5: Avoid handling handover twice (Stephan Gerhold)
  - sparc/module: Add R_SPARC_UA64 relocation handling (Koakuma)
  - PCI: cadence: Check for the existence of cdns_pcie::ops before using it (Chen Wang)
  - r8169: set EEE speed down ratio to 1 (Chunhao Lin)
  - net: intel: fm10k: Fix parameter idx set but not used (Brahmajit Das)
  - wifi: ath10k: Fix connection after GTK rekeying (Loic Poulain)
  - iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() (Seyediman Seyedarab)
  - net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X (Robert Marko)
  - jfs: fix uninitialized waitqueue in transaction manager (Shaurya Rane)
  - jfs: Verify inode mode when loading from disk (Tetsuo Handa)
  - ipv6: np->rxpmtu race annotation (Eric Dumazet)
  - usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (Krishna Kurapati)
  - usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (Forest Crossman)
  - allow finish_no_open(file, ERR_PTR(-E...)) (Al Viro)
  - scsi: lpfc: Define size of debugfs entry for xri rebalancing (Justin Tee)
  - scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup (Justin Tee)
  - scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET (Justin Tee)
  - selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency (Nai-Chen Cheng)
  - page_pool: always add GFP_NOWARN for ATOMIC allocations (Jakub Kicinski) [Orabug: 38773835] {CVE-2025-68321}
  - drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl (Tvrtko Ursulin)
  - net/cls_cgroup: Fix task_get_classid() during qdisc run (Yafang Shao)
  - udp_tunnel: use netdev_warn() instead of netdev_WARN() (Alok Tiwari) [Orabug: 38773275] {CVE-2025-68191}
  - selftests: Replace sleep with slowwait (David Ahern)
  - eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP (Daniel Palmer)
  - selftests: Disable dad for ipv6 in fcnal-test.sh (David Ahern)
  - x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT (Li Rongqing)
  - netfilter: nf_reject: don't reply to icmp error messages (Florian Westphal)
  - selftests: traceroute: Use require_command() (Ido Schimmel)
  - media: redrat3: use int type to store negative error codes (Rong Qianfeng)
  - net: sh_eth: Disable WoL if system can not suspend (Niklas Söderlund)
  - phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 (Michael Riesch)
  - phy: cadence: cdns-dphy: Enable lower resolutions in dphy (Harikrishna Shenoy)
  - ntfs3: pretend $Extend records as regular files (Tetsuo Handa)
  - net: phy: marvell: Fix 88e1510 downshift counter errata (Rohan G Thomas)
  - drm/msm: make sure to not queue up recovery more than once (Antonino Maniscalco)
  - usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (Chen Yufeng)
  - usb: gadget: f_hid: Fix zero length packet transfer (William Wu)
  - iommu/amd: Skip enabling command/event buffers for kdump (Ashish Kalra)
  - net: call cond_resched() less often in __release_sock() (Eric Dumazet)
  - net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms (Juraj Šarinay)
  - ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled (Yue Haibing)
  - drm/msm/dsi/phy_7nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
  - drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL (Krzysztof Kozlowski)
  - dmaengine: dw-edma: Set status for callback_result (Devendra K Verma)
  - dmaengine: mv_xor: match alloc_wc and free_wc (Rosen Penev)
  - dmaengine: sh: setup_xref error handling (Thomas Andreatta)
  - ptp: Limit time setting of PTP clocks (Miroslav Lichvar)
  - scsi: pm8001: Use int instead of u32 to store error codes (Rong Qianfeng)
  - mips: lantiq: xway: sysctrl: rename stp clock (Aleksander Jan Bajkowski)
  - mips: lantiq: danube: add missing device_type in pci node (Aleksander Jan Bajkowski)
  - mips: lantiq: danube: add missing properties to cpu node (Aleksander Jan Bajkowski)
  - media: fix uninitialized symbol warnings (Chelsy Ratnawat)
  - drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (Amber Lin)
  - extcon: adc-jack: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
  - scsi: pm80xx: Fix race condition caused by static variables (Francisco Gutierrez)
  - scsi: mpi3mr: Fix controller init failure on fault during queue creation (Chandrakanth Patil)
  - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (Takashi Iwai)
  - PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (Sungho Kim)
  - net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. (Kuniyuki Iwashima)
  - net: When removing nexthops, don't call synchronize_net if it is not necessary (Christoph Paasch)
  - char: misc: Does not request module for miscdevice with dynamic minor (Zijun Hu)
  - usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (Raub Camaioni)
  - iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (Rodrigo Gobbi)
  - drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts (Dmitry Baryshkov)
  - media: imon: make send_packet() more robust (Tetsuo Handa) [Orabug: 38773297] {CVE-2025-68194}
  - net: ipv6: fix field-spanning memcpy warning in AH output (Charalampos Mitrodimas) [Orabug: 38773140] {CVE-2025-40363}
  - bridge: Redirect to backup port when port is administratively down (Ido Schimmel)
  - powerpc/eeh: Use result of error_detected() in uevent (Niklas Schnelle)
  - thunderbolt: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
  - net: stmmac: Check stmmac_hw_setup() in stmmac_resume() (Tiezhu Yang)
  - x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall (Kirill A. Shutemov)
  - drm/tidss: Set crtc modesetting parameters with adjusted mode (Jayesh Choudhary)
  - drm/tidss: Use the crtc_* timings when programming the HW (Tomi Valkeinen)
  - media: pci: ivtv: Don't create fake v4l2_fh (Laurent Pinchart)
  - drm/amdkfd: return -ENOTTY for unsupported IOCTLs (Geoffrey Mcrae)
  - selftests/net: Ensure assert() triggers in psock_tpacket.c (Wake Liu)
  - selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 (Wake Liu)
  - PCI: Disable MSI on RDC PCI to PCIe bridges (Marcos Del Sol Vives)
  - drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (Seyediman Seyedarab)
  - drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff (Sathishkumar S)
  - drm/amd/pm: Use cached metrics data on arcturus (Lijo Lazar)
  - drm/amd/pm: Use cached metrics data on aldebaran (Lijo Lazar)
  - mfd: da9063: Split chip variant reading in two bus transactions (Jens Kehne)
  - mfd: madera: Work around false-positive -Wininitialized warning (Arnd Bergmann)
  - mfd: stmpe-i2c: Add missing MODULE_LICENSE (Alexander Stein)
  - mfd: stmpe: Remove IRQ domain upon removal (Alexander Stein)
  - tools/power x86_energy_perf_policy: Prefer driver HWP limits (Len Brown)
  - tools/power x86_energy_perf_policy: Enhance HWP enable (Len Brown)
  - tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage (Kaushlendra Kumar)
  - tools/cpupower: Fix incorrect size in cpuidle_state_disable() (Kaushlendra Kumar)
  - hwmon: (dell-smm) Add support for Dell OptiPlex 7040 (Armin Wolf)
  - uprobe: Do not emulate/sstep original instruction when ip is changed (Jiri Olsa)
  - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Daniel Lezcano)
  - cpuidle: Fail cpuidle device registration if there is one already (Rafael J. Wysocki)
  - tools/cpupower: fix error return value in cpupower_write_sysfs() (Kaushlendra Kumar)
  - video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (Svyatoslav Ryhel)
  - nvme-fc: use lock accessing port_state and rport state (Daniel Wagner) [Orabug: 38747531] {CVE-2025-40342}
  - nvmet-fc: avoid scheduling association deletion twice (Daniel Wagner) [Orabug: 38747538] {CVE-2025-40343}
  - tee: allow a driver to allocate a tee_device without a pool (Amirreza Zarrabi)
  - ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (Hans de Goede)
  - mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (Sarthak Garg)
  - power: supply: sbs-charger: Support multiple devices (Fabien Proriol)
  - hwmon: (sbtsi_temp) AMD CPU extended temperature range support (Chuande Chen)
  - ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] (Hans de Goede)
  - ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (Shang Song)
  - irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment (Christian Bruel)
  - arc: Fix __fls() const-foldability via __builtin_clzl() (Kees Cook)
  - cpufreq/longhaul: handle NULL policy in longhaul_exit (Dennis Beier)
  - selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 (Ricardo B. Marlière)
  - ACPI: video: force native for Lenovo 82K8 (Mario Limonciello)
  - memstick: Add timeout to prevent indefinite waiting (Jiayi Li)
  - mmc: host: renesas_sdhi: Fix the actual clock (Biju Das)
  - pinctrl: single: fix bias pull up/down handling in pin_config_set (Chi Zhang)
  - bpf: Don't use %pK through printk (Thomas Weißschuh)
  - soc: ti: pruss: don't use %pK through printk (Thomas Weißschuh)
  - spi: loopback-test: Don't use %pK through printk (Thomas Weißschuh)
  - soc: qcom: smem: Fix endian-unaware access of num_entries (Jens Reidel)
  - soc: aspeed: socinfo: Add AST27xx silicon IDs (Ryan Chen)
  - block: make REQ_OP_ZONE_OPEN a write operation (Damien Le Moal)
  - drm/sysfb: Do not dereference NULL pointer in plane reset (Thomas Zimmermann) [Orabug: 38773123] {CVE-2025-40360}
  - drm/sched: Fix race in drm_sched_entity_select_rq() (Philipp Stanner)
  - usb: gadget: f_fs: Fix epfile null pointer access after ep enable. (Owen Gu)
  - Revert "docs/process/howto: Replace C89 with C11" (Matthieu Baerts)
  - arch: back to -std=gnu89 in < v5.18 (Matthieu Baerts)
  - x86/boot: Compile boot code with -std=gnu11 too (Alexey Dobriyan)
  - xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event (Mathias Nyman)
  - xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive. (Mathias Nyman)
  - xhci: dbc: Improve performance by removing delay in transfer event polling. (Mathias Nyman)
  - xhci: dbc: Allow users to modify DbC poll interval via sysfs (Uday M Bhat)
  - xhci: dbc: poll at different rate depending on data transfer activity (Mathias Nyman)
  - xhci: dbc: Provide sysfs option to configure dbc descriptors (Mathias Nyman)
  - x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
  - net: phy: dp83867: Disable EEE support as not implemented (Emanuele Ghidoli)
  - can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
  - net: ravb: Enforce descriptor type ordering (Lad Prabhakar)
  - ravb: Exclude gPTP feature support for RZ/G2L (Biju Das)
  - dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp (Xu Yang)
  - serial: 8250_dw: handle reset control deassert error (Artem Shimko)
  - serial: 8250_dw: Use devm_add_action_or_reset() (Andy Shevchenko)
  - block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL (Damien Le Moal)
  - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland (John Smith)
  - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji (John Smith)
  - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (Yang Wang)
  - net: hns3: return error code when function fails (Jijie Shao)
  - drm/etnaviv: fix flush sequence logic (Tomeu Vizoso)
  - usbnet: Prevents free active kevent (Lizhi Xu) [Orabug: 38773783] {CVE-2025-68312}
  - libbpf: Fix powerpc's stack register definition in bpf_tracing.h (Andrii Nakryiko)
  - libbpf: Normalize PT_REGS_xxx() macro definitions (Andrii Nakryiko)
  - riscv, libbpf: Add RISC-V (RV64) support to bpf_tracing.h (Björn Töpel)
  - bpf: Do not audit capability check in do_jit() (Ondrej Mosnacek)
  - bpf: Sync pending IRQ work before freeing ring buffer (Noorain Eqbal) [Orabug: 38737284] {CVE-2025-40319}
  - ALSA: usb-audio: fix control pipe direction (Roy Vegard Ovesen)
  - drm/msm/a6xx: Fix GMU firmware parser (Akhil P Oommen)
  - wifi: ath10k: Fix memory leak on unsupported WMI command (Loic Poulain)
  - ASoC: qdsp6: q6asm: do not sleep while atomic (Srinivas Kandagatla)
  - mptcp: restore window probe (Paolo Abeni)
  - fbdev: valkyriefb: Fix reference count leak in valkyriefb_init (Miaoqian Lin)
  - fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (Florian Fuchs)
  - wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode (Gokul Sivakumar) [Orabug: 38737291] {CVE-2025-40321}
  - fbdev: bitblit: bound-check glyph index in bit_putcs* (Junjie Cao) [Orabug: 38737300] {CVE-2025-40322}
  - ACPI: video: Fix use-after-free in acpi_video_switch_brightness() (Yuhao Jiang) [Orabug: 38687004] {CVE-2025-40211}
  - fbdev: atyfb: Check if pll_ops->init_pll failed (Daniel Palmer)
  - net: usb: asix_devices: Check return value of usbnet_get_endpoints (Miaoqian Lin)
  - NFSD: Fix crash in nfsd4_read_release() (Chuck Lever) [Orabug: 38737315] {CVE-2025-40324}
  - btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (Filipe Manana)
  - btrfs: always drop log root tree reference in btrfs_replay_log() (Filipe Manana)
  - btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() (Thorsten Blum)
  - x86/bugs: Fix reporting of LFENCE retpoline (David Kaplan)
  - net/sched: sch_qfq: Fix null-deref in agg_dequeue (Xiang Mei) [Orabug: 38597084] {CVE-2025-40083}


