-
Tue Oct 20 2026 Samasth Norway Ananda <samasth.norway.ananda@oracle.com> [6.12.0-207.111.5.5.el10uek]
- KVM: x86: Use active memslots for the per-vCPU MMIO cache (Jinu Kim) [Orabug: 40180749]
-
Fri Oct 16 2026 Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> [6.12.0-207.111.5.4.el10uek]
- ipv4: free inet_opt and ireq_opt after an RCU grace period (Eric Dumazet) [Orabug: 40167669] {CVE-2026-98432}
- ipv4: validate checksum_start before completing checksum (Michael S. Tsirkin) [Orabug: 40167684] {CVE-2026-99999}
-
Wed Oct 14 2026 Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> [6.12.0-207.111.5.3.el10uek]
- mm/pagewalk: fix stale walk->action escaping walk_pmd_range() (Hyunwoo Kim) [Orabug: 40157478] {CVE-2026-89754}
- exec: Cleanup POSIX timers right after de_thread() (Hyunwoo Kim) [Orabug: 40157474] {CVE-2026-98260}
-
Thu Oct 08 2026 Sherry Yang <sherry.yang@oracle.com> [6.12.0-207.111.5.2.el10uek]
- PCI: Fix BAR resize for devices on a root bus (Liz Fong-Jones)
- PCI: Fix Resizable BAR restore order (Ilpo Järvinen)
- dpll: use exact lookup for reference sync pin id (Ivan Vecera)
- Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() (Hui Peng)
- ocfs2: make ocfs2_calc_xattr_init() return void (Joseph Qi)
- selinux: recheck intermediate backing files on mprotect() (Karl Mehltretter)
- selinux: preserve user SID across nested backing files (Karl Mehltretter)
- ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments (Sasha Levin)
- Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (ThangNN99)
- Bluetooth: hci_core: Print number of packets in conn->data_q (Luiz Augusto von Dentz)
- drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL (Dmitry Baryshkov)
- ALSA: bcd2000: Fix race between rawmidi and disconnect (Takashi Iwai)
- Revert "hwmon: (emc1403) Rely on subsystem locking" (Sasha Levin)
- Revert "hwmon: (emc1403) Drop hysteresis for low limit temperature" (Sasha Levin)
- landlock: Fix use-after-free of the source's parent directory (Norbert Szetei) [Orabug: 40132006] {CVE-2026-97594}
- landlock: Clarify documentation for the IOCTL access right (Günther Noack) [Orabug: 40132006]
- xfrm: Fix dev use-after-free in xfrm async resumption (Dong Chenchen) [Orabug: 40131990] {CVE-2026-72463}
- xfrm: Refactor xfrm_input lock to reduce contention with RSS (Jianbo Liu) [Orabug: 40131990]
- pidfd: hold exec_update_lock around namespace ioctl (Chen Linxuan) [Orabug: 40131986] {CVE-2026-89766}
- ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source() (Eric Dumazet) [Orabug: 40131835] {CVE-2026-98101}
- ipv6: mcast: Don't hold RTNL for MCAST_ socket options. (Kuniyuki Iwashima) [Orabug: 40131835]
- ipv6: mcast: Don't hold RTNL for IPV6_DROP_MEMBERSHIP and MCAST_LEAVE_GROUP. (Kuniyuki Iwashima) [Orabug: 40131835]
- ipv6: mcast: Don't hold RTNL for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP. (Kuniyuki Iwashima) [Orabug: 40131835]
- ipv6: mcast: Use in6_dev_get() in ipv6_dev_mc_dec(). (Kuniyuki Iwashima) [Orabug: 40131835]
- net: cpsw: Execute ndo_set_rx_mode callback in a work queue (Kevin Hao) [Orabug: 40131835]
- net: cpsw_new: Execute ndo_set_rx_mode callback in a work queue (Kevin Hao) [Orabug: 40131835]
-
Thu Oct 01 2026 Sherry Yang <sherry.yang@oracle.com> [6.12.0-207.111.5.1.el10uek]
- selftests/mm/khugepaged: include kselftest.h in khugepaged (Sherry Yang) [Orabug: 40099804]
-
Wed Sep 23 2026 Sherry Yang <sherry.yang@oracle.com> [6.12.0-207.111.5.el10uek]
- Rename ONOS kernel flavor to OSP for OL9 and OL10 (Vijay Kumar) [Orabug: 40055216]
- tcp: Remove hashinfo test for inet6?_lookup_run_sk_lookup(). (Kuniyuki Iwashima) [Orabug: 40052306]
- LTS version: v6.12.111 (Sherry Yang)
- mptcp: fix bad accounting in __mptcp_subflow_push_pending() (Paolo Abeni) [Orabug: 40078583] {CVE-2026-97522}
- mptcp: close race between scheduler and state change (Paolo Abeni) [Orabug: 40078588] {CVE-2026-97523}
- mptcp: avoid unneeded actions on subflow reset (Paolo Abeni) [Orabug: 40078594] {CVE-2026-97524}
- SUNRPC: Restore NUMA_NO_NODE for svc thread allocations in global mode (Ameer Hamza)
- workqueue: Update documentation as per system_percpu_wq naming (Mallesh Koujalagi)
- ocfs2: validate directory-index entry counts when reading metadata (Doruk Tan Ozturk) [Orabug: 40020935] {CVE-2026-89492}
- ocfs2: validate dx_root extent list fields during block read (Joseph Qi)
- sched_ext: Fix inverted ops.core_sched_before() invocation (Tejun Heo)
- svcrdma: Reject Write/Reply chunks with segcount 0 (Chris Mason) [Orabug: 40072707] {CVE-2026-93228}
- svcrdma: Adjust the number of entries in svc_rdma_recv_ctxt::rc_pages (Chuck Lever)
- sunrpc: Add a helper to derive maxpages from sv_max_mesg (Chuck Lever)
- svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id (Chuck Lever) [Orabug: 40021075] {CVE-2026-89535}
- svcrdma: Release transport resources synchronously (Chuck Lever)
- rpcrdma: arm rn_done before publishing the notification (Chuck Lever) [Orabug: 40033153] {CVE-2026-89798}
- sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir (Luxiao Xu) [Orabug: 40021120] {CVE-2026-89543}
- rpc_pipe: don't overdo directory locking (Al Viro)
- rpc_mkpipe_dentry(): saner calling conventions (Al Viro)
- rpc_populate(): lift cleanup into callers (Al Viro)
- SUNRPC: fix gssx_dec_option_array error path bugs (Chris Mason) [Orabug: 40021135] {CVE-2026-89544}
- sunrpc: defer rq_argp and rq_resp free until after RCU grace period (Jeff Layton) [Orabug: 40021143] {CVE-2026-89545}
- SUNRPC: Update svcxdr_init_decode() to call xdr_set_scratch_folio() (Anna Schumaker)
- SUNRPC: Introduce xdr_set_scratch_folio() (Anna Schumaker)
- ip: orphan prefetched skbs before multicast forwarding (Zhiling Zou) [Orabug: 40021224] {CVE-2026-89564}
- ipv6: ip6_mc_input() and ip6_mr_input() cleanups (Eric Dumazet)
- ipv6: adopt skb_dst_dev() and skb_dst_dev_net[_rcu]() helpers (Eric Dumazet)
- ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv() (Andrea Mayer) [Orabug: 40021207] {CVE-2026-89561}
- ipv6: annotate data-races around devconf->rpl_seg_enabled (Yue Haibing)
- cxl/ras: Fix cxl_rch_get_aer_severity() wrong severity register (Terry Bowman)
- ACPI: TAD: Add locking around AML evaluations (Rafael J. Wysocki)
- ACPI: TAD: Split three functions to untangle runtime PM handling (Rafael J. Wysocki)
- ACPI: TAD: Rearrange RT data validation checking (Rafael J. Wysocki)
- bpf: Disable preemption in bpf_get_stackid (Jiri Olsa) [Orabug: 40033158] {CVE-2026-89799}
- bpf: Use stack id functions instead of __bpf_get_stackid (Jiri Olsa)
- bpf: Factor stackid_new_bucket from __bpf_get_stackid (Jiri Olsa)
- bpf: Factor stackid_fastpath function from __bpf_get_stackid (Jiri Olsa)
- bpf: Factor stackid_init function from __bpf_get_stackid (Jiri Olsa)
- cpufreq: apple-soc: Fix OPP table cleanup (Haoxiang Li)
- acpi/apei/ghes: Use raw_spinlock_t for CXL CPER work locks (Terry Bowman) [Orabug: 40021333] {CVE-2026-89589}
- efi/cper, cxl: Make definitions and structures global (Smita Koralahalli)
- efi/cper, cxl: Prefix protocol error struct and function names with cxl_ (Smita Koralahalli)
- erofs: skip sufficiently large global buffers when resizing (Nikhil Gurudasani) [Orabug: 40021393] {CVE-2026-89602}
- NFSD: Prevent client use-after-free during close_lru reaping (Chuck Lever) [Orabug: 40034294] {CVE-2026-90037}
- NFSD: Prevent client use-after-free during blocked-lock reaping (Chuck Lever) [Orabug: 40034286] {CVE-2026-90036}
- NFSD: Consolidate the revocation-path client unpin (Chuck Lever)
- HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes (Jiangshan Yi)
- HID: mcp2221: fix OOB write in mcp2221_raw_event() (Florian Pradines)
- HID: sony: clean up device list on probe failure (Doruk Tan Ozturk) [Orabug: 40034309] {CVE-2026-90041}
- HID: sony: use guard() and scoped_guard() (Rosalie Wanders)
- HID: universal-pidff: stop the device when force-feedback init fails (Baul Lee)
- HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind (Doruk Tan Ozturk) [Orabug: 40021493] {CVE-2026-89625}
- btrfs: do not overwrite NODATASUM flag when removing NODATACOW flag (Qu Wenruo)
- btrfs: fix extent map leak in NOCOW direct I/O write (Shuangpeng Bai) [Orabug: 40021561] {CVE-2026-89644}
- btrfs: rename extent map functions to get block start, end and check if in tree (Filipe Manana)
- btrfs: add btrfs prefix to main lock, try lock and unlock extent functions (Filipe Manana)
- btrfs: use BTRFS_PATH_AUTO_FREE in can_nocow_extent() (David Sterba)
- btrfs: prepare btrfs_punch_hole_lock_range() for large data folios (Qu Wenruo)
- btrfs: pass struct btrfs_inode to btrfs_sync_inode_flags_to_i_flags() (David Sterba)
- btrfs: parameter constification in ioctl.c (David Sterba)
- btrfs: update include and forward declarations in headers (David Sterba)
- btrfs: expose per-inode stable writes flag (Qu Wenruo)
- btrfs: move btrfs_alloc_write_mask() into fs.h (Filipe Manana)
- btrfs: move BTRFS_BYTES_TO_BLKS() into fs.h (Filipe Manana)
- btrfs: move btrfs_is_empty_uuid() from ioctl.c into fs.c (Filipe Manana)
- HID: apple: preserve keyboard backlight across T2 resume (Andre Eikmeyer)
- ceph: properly decrypt filenames in vmalloc() buffers (Sam Edwards) [Orabug: 40034317] {CVE-2026-90042}
- NFSD: Guard admin state-revocation walks with NFSD_NET_UP (Chuck Lever) [Orabug: 40034301] {CVE-2026-90039}
- ceph: force a cap message when a deferred revoke can't be acked immediately (Max Kellermann)
- ceph: Remove fs/ceph deadcode (Dr. David Alan Gilbert)
- NFSD: Prevent client use-after-free during delegation revoke (Chuck Lever) [Orabug: 40021620] {CVE-2026-89659}
- nfsd: disallow file locking and delegations for NFSv4 reexport (Mike Snitzer)
- NFSD: Prevent client use-after-free during admin state revocation (Chuck Lever) [Orabug: 40021626] {CVE-2026-89660}
- nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache (Jeff Layton) [Orabug: 40021653] {CVE-2026-89667}
- nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Jeff Layton) [Orabug: 40021687] {CVE-2026-89676}
- nfsd: update mtime/ctime on COPY in presence of delegated attributes (Olga Kornievskaia)
- nfsd: fix netlink dumpit error handling for rpc_status_get (Jeff Layton)
- nfsd: fix clock domain mismatch in clients_still_reclaiming() (Jeff Layton) [Orabug: 40021710] {CVE-2026-89685}
- nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown (Jeff Layton) [Orabug: 40021778] {CVE-2026-89708}
- nfsd: dedup nfs4_client_to_reclaim inserts (Jeff Layton)
- nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage (Jeff Layton) [Orabug: 40021748] {CVE-2026-89698}
- Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND" (Chuck Lever) [Orabug: 38686996] {CVE-2025-40210}
- NFSD: Make nfsd_genl_rqstp::rq_ops array best-effort (Chuck Lever)
- NFSD: Rename a function parameter (Chuck Lever)
- nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create() (Jeff Layton) [Orabug: 40021727] {CVE-2026-89693}
- nfsd: validate sockaddr length per family in listener_set (Jeff Layton) [Orabug: 40021754] {CVE-2026-89700}
- zram: set default primary compressor in zram_destroy_comps() (Sergey Senozhatsky) [Orabug: 40021806] {CVE-2026-89717}
- zram: switch to guard() for init_lock (Sergey Senozhatsky)
- zram: fix out-of-bounds access in writeback_store() (Longlong Xia) [Orabug: 40021808] {CVE-2026-89718}
- zram: use zram_read_from_zspool() in writeback (Sergey Senozhatsky)
- zram: remove entry element member (Sergey Senozhatsky)
- zram: fix out-of-bounds access in read_block_state() (Longlong Xia) [Orabug: 40021813] {CVE-2026-89719}
- zram: fixup read_block_state() (Sergey Senozhatsky)
- usb: gadget: f_fs: Fix Use-After-Free in AIO error path (Neill Kapron)
- USB: gadget: ffs: fix mm lifetime handling (Gabriel Prostitis)
- cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read (Terry Bowman) [Orabug: 40021856] {CVE-2026-89731}
- cxl/pci: Remove CXL VH handling in CONFIG_PCIEAER_CXL conditional blocks from core/pci.c (Dave Jiang)
- cxl/pci: Remove unnecessary CXL RCH handling helper functions (Terry Bowman)
- cxl/pci: Remove unnecessary CXL Endpoint handling helper functions (Terry Bowman)
- x86/xen: fix init of balloon stats again (Roger Pau Monné)
- xen/balloon: improve accuracy of initial balloon target for dom0 (Roger Pau Monné)
- x86/locking: Use sfence for wmb() if SSE is available (Yao Zi)
- x86/locking: Remove semicolon from "lock" prefix (Uros Bizjak)
- mm/slub: fix missing debugfs entries for caches created before sysfs init (Li Xiasong)
- mm/slab: move and refactor __kmem_cache_alias() (Vlastimil Babka)
- mm/migrate_device: clear stale mapping after freeing swapcache (Arvind Yadav) [Orabug: 40021923] {CVE-2026-89755}
- KEYS: trusted: Fix TPM teardown ordering (Chengfeng Ye) [Orabug: 40021952] {CVE-2026-89763}
- mm, swap: ratelimit bad swap entry reports (Breno Leitao)
- mm: fix possible NULL pointer dereference in __swap_duplicate (Gao Xu)
- crypto: iaa - unmap dst before software fallback on decompress (Vinicius Costa Gomes) [Orabug: 40020455] {CVE-2026-80945}
- crypto: atmel-ecc - avoid stale fallback key after set_secret failure (Thorsten Blum)
- KVM: SEV: Track the GPA of the guest-controlled VMSA used for SNP guests (Sean Christopherson)
- KVM: SVM: Move SEV-ES VMSA allocation to a dedicated sev_vcpu_create() helper (Sean Christopherson)
- KVM: SEV: Disable SEV-SNP support on initialization failure (Ashish Kalra)
- KVM: SVM: Invalidate "next" SNP VMSA GPA even on failure (Sean Christopherson)
- KVM: SVM: Use guard(mutex) to simplify SNP vCPU state updates (Sean Christopherson)
- KVM: SVM: Mark VMCB dirty before processing incoming snp_vmsa_gpa (Sean Christopherson)
- net: advertise TCP MSS from the configured MTU, not the learned PMTU (Jiayuan Chen)
- crypto: virtio - bound the akcipher result length (Bryam Vargas) [Orabug: 39982162] {CVE-2026-80836}
- crypto: virtio - Drop superfluous [as]kcipher_req pointer (Lukas Wunner)
- crypto: virtio - Drop superfluous [as]kcipher_ctx pointer (Lukas Wunner)
- crypto: virtio - Drop sign/verify operations (Lukas Wunner)
- vlan: fix skb_under_panic and races when toggling HW VLAN offload (Eric Dumazet) [Orabug: 40013132] {CVE-2026-80925}
- net/packet: defer vmalloc TX_RING free until skbs finish (Kyle Zeng) [Orabug: 39982175] {CVE-2026-80841}
- tcp: clamp route advmss to TCP_MIN_MSS (Yong Wang) [Orabug: 39982195] {CVE-2026-80847}
- ipv4: use dst4_mtu() instead of dst_mtu() (Eric Dumazet)
- ipv6: use dst6_mtu() instead of dst_mtu() (Eric Dumazet)
- inet: add dst4_mtu() and dst6_mtu() helpers (Eric Dumazet)
- ipv6: add some unlikely()/likely() clauses in ip6_output.c (Eric Dumazet)
- ipv6: pass proto by value to ipv6_push_nfrag_opts() and ipv6_push_frag_opts() (Eric Dumazet)
- KVM: SEV: Add an anonymous "psc" struct to track current PSC metadata (Sean Christopherson)
- KVM: SEV: Make it more obvious when KVM is writing back the current PSC index (Sean Christopherson)
- KVM: SEV: Wire up kvm_x86_ops.gmem_xxx() if and only if CONFIG_KVM_AMD_SEV=y (Sean Christopherson)
- fuse: fix race between interrupt and resend (Miklos Szeredi) [Orabug: 39982400] {CVE-2026-80860}
- usb: xhci: bail out of setup if the controller is inaccessible (Breno Leitao) [Orabug: 39982230] {CVE-2026-80861}
- usb: xhci: simplify handling of Structural Parameters 1 values (Niklas Neronin)
- usb: xhci: use cached HCSPARAMS1 value (Niklas Neronin)
- usb: xhci: add USB Port Register Set struct (Niklas Neronin)
- netfilter: nft_set_pipapo_avx2: add missing vzeroupper (Eric Biggers)
- bpf: fix the return value of push_stack (Anton Protopopov)
- xfs: initialise args->total for parent pointer updates (Javier Tia) [Orabug: 40078705] {CVE-2026-97551}
- fou: Fix use-after-free in fou_create() (Luoxuanqiang) [Orabug: 39886929] {CVE-2026-74496}
- net: appletalk: fix NULL pointer dereference in aarp_send_ddp() (Weiming Shi)
- i2c: smbus: reject oversized block transfers in the common path (Weiming Shi) [Orabug: 40073050] {CVE-2026-93287}
- ALSA: us122l: Prevent write upgrades for read mappings (Kazuki Hanai) [Orabug: 40079109] {CVE-2026-97931}
- net: usb: pegasus: don't rely on id table pointer arithmetic (Gary Guo) [Orabug: 40078670] {CVE-2026-97540}
- media: as102: do not rely on id table address comparison (Gary Guo)
- usb: serial: spcp8x5: don't store usb_device_id (Gary Guo)
- usb: usbtmc: don't store usb_device_id (Gary Guo)
- wifi: ath9k_htc: don't store usb_device_id (Gary Guo) [Orabug: 40078677] {CVE-2026-97541}
- usb: xusbatm: don't rely on id table pointer arithmetic (Gary Guo) [Orabug: 40078663] {CVE-2026-97539}
- xdrgen: Fix union declarations (Chuck Lever)
- perf evsel: Add per-thread warning for EOPNOTSUPP open failues (Ian Rogers)
- Revert "perf tests: Fix flakiness in BPF counters test on hybrid systems" (Sasha Levin)
- Revert "slab: reset slab->obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL" (Sasha Levin)
- Revert "selftests/mm: report unique test names for each cow test" (Sasha Levin)
- Revert "selftests/mm: skip COW tmpfile cases when fallocate() is unsupported" (Sasha Levin)
- Revert "selftests: harness: Mark test fixture objects __maybe_unused" (Sasha Levin)
- Revert "nvme: apple: Add Apple A11 support" (Sasha Levin)
- Revert "nvme-apple: Drop the PRP null check chicken bit" (Sasha Levin)
- Revert "nvme-apple: Prevent shared tags across queues on Apple A11" (Sasha Levin)
- Revert "nvme-apple: Reset q->sq_tail during queue init" (Sasha Levin)
- Revert "arm64: dts: qcom: sc8180x: Fix the PCIe iommu-map entries" (Sasha Levin)
- Revert "arm64: dts: qcom: sdm845: Fix the PCIe iommu-map entries" (Sasha Levin)
- Revert "arm64: dts: qcom: sm8150: Fix the PCIe iommu-map entries" (Sasha Levin)
- Revert "arm64: dts: qcom: sm8250: Fix the PCIe iommu-map entries" (Sasha Levin)
- Revert "arm64: dts: qcom: sm8350: Fix the PCIe iommu-map entries" (Sasha Levin)
- Revert "arm64: dts: qcom: sm8450: Fix the PCIe iommu-map entries" (Sasha Levin)
- Revert "arm64: dts: qcom: sm8550: Fix the PCIe iommu-map entries" (Sasha Levin)
- Revert "arm64: dts: qcom: sm8650: Fix the PCIe iommu-map entries" (Sasha Levin)
- iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized (Nicolin Chen)
- crypto: ccp - Fix possible deadlock in SEV init failure path (Atish Patra)
- smb: client: fix UBSAN array-index-out-of-bounds in smb2_copychunk_range (Henrique Carvalho)
- xfs: actually recover intended file sizes in xfs_xmi_item_recover_intent (Darrick J. Wong)
- xfs: advance the findparent inode scan cursor while holding ILOCK (Darrick J. Wong)
- xfs: bail out on bitmap errors in xrep_agfl_fill (Darrick J. Wong) [Orabug: 40078682] {CVE-2026-97542}
- xfs: compute dquot checksum after resetting dd_lsn in repair (Darrick J. Wong)
- xfs: count escaped corruption errors in scrub stats (Darrick J. Wong)
- xfs: destroy seen inode bitmap when we fail to add a dirpath (Darrick J. Wong) [Orabug: 40078684] {CVE-2026-97543}
- xfs: don't leak dqacct if rhashtable insertion fails (Darrick J. Wong) [Orabug: 40078687] {CVE-2026-97544}
- xfs: don't leak new_bp if xfs_btree_bload_drop_buf fails (Darrick J. Wong) [Orabug: 40078689] {CVE-2026-97545}
- xfs: don't modify file attributes or poke fsnotify for dry runs (Darrick J. Wong)
- xfs: don't spin forever on zero-length dirents when salvaging them (Darrick J. Wong) [Orabug: 40078692] {CVE-2026-97546}
- xfs: fix backwards skipping logic in xrep_quota_block (Darrick J. Wong)
- xfs: fix bnobt repair space reservation disposal failure (Darrick J. Wong)
- xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lin Jiapeng) [Orabug: 39972815,40078696] {CVE-2026-80530,CVE-2026-97547}
- xfs: fix name string recording in slowpath pptr tracepoints (Darrick J. Wong)
- xfs: fix replaying dirent removals into the temporary directory (Darrick J. Wong)
- xfs: initialise error in xfs_defer_finish_one() (Javier Tia) [Orabug: 40078708] {CVE-2026-97552}
- xfs: log the tempip after we convert it to extents format (Darrick J. Wong)
- xfs: preserve owner on in-memory btree creation (Darrick J. Wong)
- xfs: report nonexistent parents as a filesystem corruption (Darrick J. Wong)
- xfs: reset parent pointer args before each dir tree unlink repair (Darrick J. Wong)
- xfs: signal inode btree xref error if get_rec returns an error (Darrick J. Wong)
- xfs: snapshot old AGFL before rewriting it (Darrick J. Wong)
- xfs: snapshot scrub stats when rendering them (Darrick J. Wong)
- xfs: truncate quota file correctly when repairing quota file (Darrick J. Wong)
- smb: client: fix heap overflow in DACL owner/group rewrite (Bjoern Doebel) [Orabug: 40078720] {CVE-2026-97555}
- smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Bjoern Doebel) [Orabug: 40078724] {CVE-2026-97556}
- smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Bjoern Doebel) [Orabug: 40078730] {CVE-2026-97557}
- smb: client: fix file type corruption in wsl_to_fattr() (Paulo Alcantara)
- smb: client: fix file type corruption in cifs_reparse_point_to_fattr() (Paulo Alcantara)
- smb: client: fix one-byte OOB read in smb2_parse_native_symlink() (Paulo Alcantara) [Orabug: 40078747] {CVE-2026-97560}
- smb: client: pin DFS superblock in iterator callback (Karl Mehltretter) [Orabug: 40078757] {CVE-2026-97562}
- smb: client: reject userspace cifs.idmap descriptions (Aohan Mei) [Orabug: 40078772] {CVE-2026-97564}
- selftests: mptcp: fix an UAF in mptcp_connect.c (Gang Yan)
- mptcp: syncookies: remember the request backup flag (Matthieu Baerts) [Orabug: 40078794] {CVE-2026-97568}
- mptcp: subflow: no need to copy thmac during ulp_clone (Matthieu Baerts)
- mptcp: options: handle MPC data + csum reqd + no csum (Matthieu Baerts)
- bnxt_en: Propagate RX ring init failures in bnxt_init_nic() (Joe Damato) [Orabug: 40078806] {CVE-2026-97572}
- bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset() (Joe Damato) [Orabug: 40078811] {CVE-2026-97573}
- bnxt_en: bring back rtnl_lock() in the bnxt_open() path (Michael Chan)
- bnxt_en: Only restore LRO if the device supports TPA (Joe Damato)
- media: v4l2-ctrls: validate AV1 tile counts (Michael Bommarito) [Orabug: 40078824] {CVE-2026-97575}
- media: v4l2-ctrls: validate HEVC tile counts (Michael Bommarito) [Orabug: 40078826] {CVE-2026-97576}
- media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity (Michael Bommarito)
- media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer (Michael Bommarito)
- media: v4l2-h264: Fix memcmp() size in B1 reference list comparison (Xu Wang)
- media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity (Michael Bommarito)
- media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity (Michael Bommarito)
- media: hevc: add bounded tile-count helpers (Michael Bommarito)
- hwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTS (Vishnu Razdan)
- hwmon: (gpio-fan) Fix use-after-free in alarm work (Fan Wu)
- hwmon: (chipcap2) fix channels in humidity alarm notifications (Javier Carrasco)
- hwmon: (applesmc) fix key backlight workqueue leak on register failure (Cong Nguyen)
- afs: Clear stale peer app data after address list changes (Chengfeng Ye) [Orabug: 40078852] {CVE-2026-97583}
- afs: Fix incorrect free in candidate cleanup in afs_lookup_server() (David Howells) [Orabug: 40078858] {CVE-2026-97584}
- perf: RISC-V: use BIT_ULL for u64 overflow masks (Xixin Liu)
- perf: RISC-V: store available counter mask as bitmap (Xixin Liu)
- s390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithm (Harald Freudenberger)
- s390/crypto: Fix use of mutex in atomic context (Harald Freudenberger)
- s390/crypto: Fix skcipher_walk return code handling in aes_s390 (Harald Freudenberger)
- s390/qeth: allow bridgeport queries despite OS_MISMATCH (Nagamani Pv)
- KVM: PPC: Book3S HV: Set irqfd->producer only on success (Leixiang)
- mac802154: fix use-after-free of sdata via queued RX frames (Ibrahim Hashimov) [Orabug: 40078888] {CVE-2026-97595}
- ipvs: reject invalid states in connection template sync records (Kyle Zeng) [Orabug: 40078891] {CVE-2026-97596}
- ipv4: fib: bound automatic table ID allocation (Zihan Xi) [Orabug: 40078901] {CVE-2026-97598}
- ieee802154: hwsim: serialize pib updates to fix double-free (David Carlier)
- ieee802154: cc2520: fix FIFOP work use-after-free (Fan Wu) [Orabug: 40078912] {CVE-2026-97600}
- ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink (Zhiling Zou) [Orabug: 40078919] {CVE-2026-97601}
- inet: frags: invalidate queues before flushing them (Yilin Zhang) [Orabug: 40078925] {CVE-2026-97602}
- fbdev: vfb: defer cleanup until the last reference (Weiming Shi) [Orabug: 40078939] {CVE-2026-97604}
- erofs: preserve LZMA decoders on resize failure (Nikhil Gurudasani) [Orabug: 40078947] {CVE-2026-97605}
- fs: autofs: fix memory leak in autofs_fill_super() (Jeffin Philip) [Orabug: 40078951] {CVE-2026-97606}
- scripts/sorttable: Mark long_size as __maybe_unused (Nathan Chancellor)
- vdpa: solidrun: Free IRQs after request failure (Xiongweimin)
- vdpa: ifcvf: Put device on unsupported feature error (Xiongweimin) [Orabug: 40078955] {CVE-2026-97607}
- netfilter: report NLM_F_DUMP_FILTERED when all is filtered out (Ilya Maximets)
- netfilter: nf_log: unregister loggers before per-net teardown (Chengfeng Ye) [Orabug: 40078958] {CVE-2026-97608}
- net: openvswitch: fix use-after-free of the flow table mask array (Norbert Szetei) [Orabug: 40078968] {CVE-2026-97611}
- net: mpls: clear inner_protocol when the last label is popped (Fourie Zhang) [Orabug: 40078972] {CVE-2026-97612}
- net: mana: Reserve extra CQ slot for the fence completion CQE (Sahil Chandna) [Orabug: 40078976] {CVE-2026-97613}
- net: hso: fix TIOCMIWAIT race (Johan Hovold)
- net/sched: act_api: release all action references on NEWACTION failure (Luoxuanqiang) [Orabug: 40078985] {CVE-2026-97616}
- ring-buffer: Check resize_disabled before publishing the new subbuf order (David Carlier) [Orabug: 40078989] {CVE-2026-97617}
- ring-buffer: Acquire the lock with irqsave in rb_wake_up_waiters() (Sebastian Andrzej Siewior)
- io_uring/net: let io_recv_buf_select return the length of the buffer region (Gabriel Krisman Bertazi)
- drm/i915: Fix memory leak in query_perf_config_list() (Thorsten Blum) [Orabug: 40079005] {CVE-2026-97899}
- drm/drm_exec: fix up contended obj when num_objects is 0 (Sunil Khatri) [Orabug: 40079009] {CVE-2026-97900}
- fs: don't return -EINVAL for successful nested thaw (Moritz Tanner) [Orabug: 40079015] {CVE-2026-97902}
- exec: do_close_on_exec() before taking exec_update_lock (Jann Horn)
- cpufreq: initialize policy rwsem before sysfs publication (Runyu Xiao) [Orabug: 40079019] {CVE-2026-97904}
- cpufreq: zero-initialize policy cpumask before sysfs publication (Zhongqiu Han) [Orabug: 40079023] {CVE-2026-97905}
- Bluetooth: btrtl: Don't leak return code when parsing firmware format v2 (Rongrong) [Orabug: 40079032] {CVE-2026-97907}
- Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev (Xu Rao)
- ASoC: sti: initialize IRQ lock before requesting IRQ (Runyu Xiao)
- ASoC: sprd: validate compress buffer sizes against fixed allocations (Tianchu Chen)
- accel/ivpu: Limit firmware log name prints to field size (Dawid Osuchowski)
- accel/ivpu: Validate firmware log buffer metadata (Magdalena Schulfer)
- accel/ivpu: Validate full buffer range in ivpu_to_cpu_addr (Magdalena Schulfer) [Orabug: 40079055] {CVE-2026-97917}
- tracing: Keep the entry count when the histogram stats allocation fails (Donggeun Yoo) [Orabug: 40079065] {CVE-2026-97920}
- tracing: Let histogram values keep the percent and graph modifiers (Donggeun Yoo)
- tracing: Free histogram the field rejected for a bad modifier (Donggeun Yoo) [Orabug: 40079067] {CVE-2026-97921}
- tracing: Free histogram var refs regardless of how often they are referenced (Donggeun Yoo) [Orabug: 40079069] {CVE-2026-97922}
- tracing: Free histogram the var ref when its initialization fails (Donggeun Yoo) [Orabug: 40079077] {CVE-2026-97923}
- tracing/user_events: Don't destroy fields when event removal fails (Henry Martin)
- tick/broadcast: Plug clockevents replacement race (Thomas Gleixner) [Orabug: 40079083] {CVE-2026-97925}
- tunnels: Drop stale dst when building an ICMP error for PMTUD (Ido Schimmel)
- ufs: validate cylinder group metadata before caching it (Ali Ahmet Memis)
- ufs: create the root dentry after loading cylinder metadata (Ali Ahmet Memis)
- watchdog: sunxi_wdt: preserve boot-enabled watchdog (James Hilliard)
- dm/amdgpu: fix malformed link_settings debugfs output (Harry Wentland)
- ALSA: usbusx2y: validate URB actual_length in interrupt callback (Tristan Madani) [Orabug: 40079099] {CVE-2026-97929}
- ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf (Tristan Madani) [Orabug: 40079104] {CVE-2026-97930}
- ALSA: ctxfi: Fix CA20K2 S/PDIF passthrough (Roman Prucha)
- rust: allow `unknown_lints` in generated bindings for Rust < 1.88 (Miguel Ojeda)
- tracing: Fix memory corruption from the histogram stacktrace modifier (Donggeun Yoo) [Orabug: 40079129] {CVE-2026-97936}
- ipv6: fix fib6 walker UAF on seq stop (Zihan Xi) [Orabug: 40079142] {CVE-2026-97940}
- x86/mm: Fix user-space data loss with MADV_FREE and THP (Vernon Yang) [Orabug: 40079153] {CVE-2026-97945}
- crypto: x86/aria - add missing vzeroupper in AVX-512 code (Eric Biggers)
- crypto: x86/aria - add missing vzeroupper in AVX2 code (Eric Biggers)
- powerpc/eeh: Fix recursive locking on devices without EEH sensitive driver (Shivaprasad G Bhat)
- powerpc/ps3: Fix repository.c build failure (Thorsten Blum)
- ksmbd: prevent out-of-bounds reads in share config responses (Namjae Jeon)
- scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands (Maurizio Lombardi) [Orabug: 40079174] {CVE-2026-97951}
- scripts/mksysmap: fix escape of '$' in the __pi_ pattern (Lorenzo Stoakes)
- sunvdc: unmap LDC cookies when the descriptor send fails (Stian Halseth)
- openvswitch: fix wrong flag value in get_ipv6_ext_hdrs() (Eelco Chaudron)
- net: hsr: enable promiscuous mode on interlink port with fwd offload (Md Danish Anwar)
- net: stmmac: fix TX descriptor availability check for TSO traffic (Lorenzo Bianconi) [Orabug: 40079183] {CVE-2026-97953}
- net: stmmac: add TSO check for header length (Russell King)
- net: stmmac: add stmmac_tso_header_size() (Russell King)
- net: stmmac: fix TSO support when some channels have TBS available (Russell King)
- net: stmmac: TSO: Simplify the code flow of DMA descriptor allocations (Furong Xu)
- octeontx2-af: fix PF/CGX debugfs PCI bus lookup (Ratheesh Kannoth)
- net: phy: mediatek-ge: disable EEE on the MT7530 PHY (Vladislav Karmanov)
- net: phy: add phy_disable_eee (Heiner Kallweit)
- net: phy: mediatek: Re-organize MediaTek ethernet phy drivers (Sky Huang)
- cxgb4: clip_tbl: Fix spelling mistake "wont" -> "won't" (Colin Ian King)
- net: hinic: fix mailbox segment buffer overflow (Aamir Ahmed) [Orabug: 40079196] {CVE-2026-97957}
- net: sun4i-emac: fix missing of_node_put() for phy_node (Liyouhong)
- net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain(). (Kuniyuki Iwashima) [Orabug: 40079199] {CVE-2026-97958}
- net/sched: cls_route: Fix in-place replace (Victor Nogueira)
- net/sched: cls_route: Reject handle aliasing (Victor Nogueira)
- net/sched: cls_route: free emptied bucket on filter move (Victor Nogueira) [Orabug: 40079204] {CVE-2026-97959}
- perf/x86/intel: Correct pt_regs->flags update for PEBS path (Dapeng Mi)
- perf/x86/intel/ds: Factor out PEBS group processing code to functions (Dapeng Mi)
- perf/x86/intel/ds: Remove redundant assignments to sample.period (Changbin Du)
- perf/x86/intel/ds: Clarify adaptive PEBS processing (Kan Liang)
- perf/core: Check sample_type in perf_sample_save_callchain (Yabin Cui)
- selftests/powerpc/tm: Fix tcheck() reading uninitialised CR value (Thibault Ferrante)
- net: stmmac: initialize ptp_lock at probe time (Lorenzo Bianconi) [Orabug: 40079216] {CVE-2026-97963}
- ppp_synctty: ensure a writeable skb header (Qingfang Deng) [Orabug: 40079219] {CVE-2026-97964}
- vxlan: initialize _md in vxlan_xmit_one() (Eric Dumazet) [Orabug: 40079222] {CVE-2026-97965}
- octeontx2-pf: reset HTB scheduler topology before freeing queues (Ratheesh Kannoth)
- hwmon: (corsair-cpro) Remove debugfs entries when probe fails (Linmao Li)
- hwmon: (aspeed-pwm-tacho) Propagate reset deassert errors (Pengpeng Hou)
- hwmon: (gpio-fan) take fan_data->lock in gpio_fan_shutdown() (Cong Nguyen)
- hwmon: (corsair-cpro) Create debugfs entries after hwmon registration (Linmao Li)
- net: ks8851: Fix receiver error in 100BASE-TX mode following software power-down (Marek Vasut)
- net/micrel: Fix typos in micrel driver code comments (Yicong Hui)
- net: dsa: lantiq_gswip: fix GSWIP_MDIO_PHY_FCONTX_EN value (Jan Havran)
- net: dsa: lantiq_gswip: move definitions to header (Daniel Golle)
- net: dsa: lantiq_gswip: prepare for more CPU port options (Daniel Golle)
- net: dsa: lantiq_gswip: deduplicate dsa_switch_ops (Daniel Golle)
- watchdog: msc313e: Sync timeout value if WDT was running at boot (Tzung-Bi Shih)
- watchdog: msc313e: Fix undefined behavior (Tzung-Bi Shih)
- watchdog: msc313e: Fix spurious reset on suspend (Tzung-Bi Shih)
- watchdog: msc313e: Enable clock before accessing hardware registers (Tzung-Bi Shih)
- watchdog: msc313e: Fix clock leak and spurious timer in settimeout() (Tzung-Bi Shih)
- watchdog: msc313e: Avoid division by zero (Tzung-Bi Shih)
- watchdog: fix hrtimer start when pretimeout is zero (David Arcari)
- mptcp: remove unneeded READ_ONCE() annotation (Paolo Abeni)
- net: macb: destroy the phylink instance on the probe error path (Nicolai Buchwitz) [Orabug: 40079249] {CVE-2026-97973}
- Bluetooth: btusb: Fix leaked runtime PM reference in btusb_reset (Jiajia Liu)
- Bluetooth: btusb: mediatek: Fix leaked runtime PM reference in reset (Jiajia Liu)
- Bluetooth: btmtk: Declare MT7920 (MT7961 1a) Bluetooth firmware (Ivan Hu)
- Bluetooth: btintel_pcie: fix tx_handle bounds off-by-one (Kiran K)
- Bluetooth: btintel_pcie: validate packet_len before skb_put_data (Kiran K) [Orabug: 40079258] {CVE-2026-97976}
- Bluetooth: btusb: Fix UAF of btusb_data by rx_work (Luiz Augusto von Dentz) [Orabug: 40079261] {CVE-2026-97977}
- eth: ice: don't dereference pointers from TP_printk() (Jakub Kicinski) [Orabug: 40079263] {CVE-2026-97978}
- ice: add missing xa_destroy for sched_node_ids (Jacob Keller) [Orabug: 40079266] {CVE-2026-97979}
- idpf: account for VLAN header when parsing RSC packet header (Joshua Hay)
- ALSA: hda: Report a change when only the channel status bytes move (Hyeongjun An)
- ALSA: hda/common: Use guard() for mutex locks (Takashi Iwai)
- ALSA: hda/common: Use cleanup macros for PM controls (Takashi Iwai)
- ALSA: hda: Introduce auto cleanup macros for PM (Takashi Iwai)
- drm/logicvc: Drop the select of the nonexistent CONFIG_DRM_KMS_DMA_HELPER (Karl Mehltretter)
- net: ethernet: cortina: Count RX descriptors for freeq refill (Linus Walleij)
- net: ethernet: cortina: Count RX drops once per frame (Linus Walleij)
- net: ethernet: cortina: No mapping is a dropped rx (Linus Walleij)
- net: ethernet: cortina: Count dropped frames as NAPI work (Linus Walleij)
- net: ethernet: cortina: Finish RX updates before NAPI completion (Linus Walleij)
- net: ethernet: cortina: Fix budget accounting (Linus Walleij)
- net: ipv6: Clamp to IP6_MAX_MTU in ip6_dst_mtu_maybe_forward (Alice Mikityanska)
- net: ipv6: Fix UDP length overflow with PMTU discover and big MTU (Alice Mikityanska) [Orabug: 40079279] {CVE-2026-97984}
- af_unix: Return immediately when manage_oob() returns NULL for 0-length buffer. (Kuniyuki Iwashima)
- af_unix: Update last skb marker in manage_oob(). (Kuniyuki Iwashima) [Orabug: 40079300] {CVE-2026-97985}
- virtio_input: stop callbacks before unregistering input device (Karl Mehltretter) [Orabug: 40079307] {CVE-2026-97986}
- virtio_input: reset device if input_register_device() fails (Xiongweimin) [Orabug: 40079311] {CVE-2026-97987}
- virtio-pci: return IRQ_HANDLED after non-zero ISR (Andrew Stellman)
- vdpa_sim_net: check TX pull result before RX copy (Linfeng Sun) [Orabug: 40079323] {CVE-2026-97990}
- vdpa_sim_blk: reject out-of-range sector starts (Linfeng Sun) [Orabug: 40079328] {CVE-2026-97991}
- vhost-vdpa: protect config_ctx from being freed under the config callback (Yu Zhang) [Orabug: 40079332] {CVE-2026-97992}
- vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx (Yu Zhang) [Orabug: 40079336] {CVE-2026-97993}
- vhost/vdpa: reject VRING_NUM larger than device max (Jia Jia) [Orabug: 40079341] {CVE-2026-97994}
- virtio_console: do not free control-out buffers on remove (Jia Jia) [Orabug: 40079347] {CVE-2026-97995}
- virtio: fix use-after-free in unregister_virtio_device() (Karl Mehltretter) [Orabug: 40079351] {CVE-2026-97996}
- ASoC: mt6351: Publish the OF module alias (Hpp Iscas)
- netfilter: ip6_tables: set F_PROTO when proto value is nonzero (Florian Westphal)
- netfilter: nfnetlink_log: cope with concurrent instance destruction (Florian Westphal) [Orabug: 40079359] {CVE-2026-97998}
- ASoC: Intel: SST: Publish the PCI module aliases (Hpp Iscas)
- ASoC: bcm: bcm63xx: Publish the OF module aliases (Hpp Iscas)
- hwmon: (ina2xx) Parameterize ina2xx_data in ina226_alert_read() (Jared Kangas)
- hwmon: Introduce 64-bit energy attribute support (Guenter Roeck)
- libnvdimm: Replace namespace_match() with device_find_child_by_name() (Zijun Hu)
- hwmon: (ltc4282) Make sure clk_init_data is fully initialized (Geert Uytterhoeven)
- ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev (Edward Adam Davis) [Orabug: 40079373] {CVE-2026-98006}
- bpf: Reject non-scalar bpf_loop iteration counts (Kumar Kartikeya Dwivedi) [Orabug: 40079377] {CVE-2026-98007}
- net: macb: fix NULL pointer dereference on unbind with fixed-link (Vineeth Karumanchi) [Orabug: 40079379] {CVE-2026-98008}
- net: macb: rename bp->sgmii_phy field to bp->phy (Théo Lebrun)
- net/sched: ets: clamp quantum in parse and fallback paths (Jamal Hadi Salim) [Orabug: 40079383] {CVE-2026-98009}
- net/sched: drr: clamp quantum in change class (Jamal Hadi Salim) [Orabug: 40079387] {CVE-2026-98010}
- net/sched: pie: clamp psched_mtu in pie_drop_early (Jamal Hadi Salim)
- net/sched: hhf: clamp quantum in change and init paths (Jamal Hadi Salim) [Orabug: 40079394] {CVE-2026-98011}
- net/sched: sfq: clamp quantum in change path (Jamal Hadi Salim) [Orabug: 40079398] {CVE-2026-98012}
- net/sched: fq_pie: clamp quantum in change path (Jamal Hadi Salim)
- net/mlx5: E-Switch, prevent mc_list repopulation during vport disable (Lama Kayal) [Orabug: 40079405] {CVE-2026-98014}
- net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put (Yael Chemla) [Orabug: 40079408] {CVE-2026-98015}
- net/mlx5e: Fix use-after-free race in sample_restore_put() (Carolina Jubran) [Orabug: 40079415] {CVE-2026-98016}
- net/mlx5e: Fix ETS zero BW reporting when one TC holds 100% (Carolina Jubran)
- net/mlx5e: Fix setting RS FEC after remapping (Shahar Shitrit)
- net/sched: defer qdisc freeing after failed creation (Weiming Shi) [Orabug: 40079419] {CVE-2026-98017}
- net: mctp: i3c: serialize probe with bus removal (Xingwang Xiang)
- powerpc/kexec_file: Use inclusive range checks in add_usable_mem() (Thorsten Blum)
- pds_core: don't release PCI regions for VFs on reset (Nikhil P. Rao)
- pds_core: fix cmd_regs access racing BAR unmap on reset (Nikhil P. Rao) [Orabug: 40079430] {CVE-2026-98020}
- net: reject oversized tx_queue_len at netlink parse time (Jamal Hadi Salim) [Orabug: 40079434] {CVE-2026-98021}
- net: cap tx_queue_len at S16_MAX to prevent oversized ring allocations (Jamal Hadi Salim) [Orabug: 40079442] {CVE-2026-98022}
- vxlan: reject dynamic fdb entries that reference a nexthop id (Seungwon Bae) [Orabug: 40079446] {CVE-2026-98023}
- s390/ism: folio_put() after error (Alexandra Winter)
- net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow (Jason Winter) [Orabug: 40079453] {CVE-2026-98025}
- ionic: use netif_txq_maybe_stop() in ionic_tx() (Nikhil P. Rao)
- octeontx2-af: mcs: Clear stale X2P calibration state before calibration (Viswajith Murali)
- net: bridge: mcast: properly convert mglist to rcu (Nikolay Aleksandrov) [Orabug: 40079458] {CVE-2026-98026}
- net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size (Jakub Kicinski) [Orabug: 40079463] {CVE-2026-98027}
- eth: nfp: drop the replaced rule from the list when reprogramming fails (Jakub Kicinski) [Orabug: 40079467] {CVE-2026-98028}
- eth: nfp: bound the ntuple rule dump by the caller's buffer size (Jakub Kicinski) [Orabug: 40079470] {CVE-2026-98029}
- eth: nfp: migrate to new RXFH callbacks (Jakub Kicinski)
- net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size (Jakub Kicinski) [Orabug: 40079473] {CVE-2026-98030}
- bonding: use skb_cow_head() in bond_do_alb_xmit() and rlb_arp_xmit() (Eric Dumazet)
- nexthop: Initialize extack in remove_nh_grp_entry() (Ido Schimmel) [Orabug: 40079482] {CVE-2026-98031}
- selftests/bpf: Fix flaky bpf_nf test when random NAT port is 0 (Jiayuan Chen)
- bpf: Reject untrusted allocated-object pointers (Ning Ding) [Orabug: 40079500] {CVE-2026-98037}
- bpf: Require MEM_PERCPU for percpu kptr stores (Kumar Kartikeya Dwivedi) [Orabug: 40079506] {CVE-2026-98039}
- thermal: sysfs: switch to use scnprintf() to suppress truncation warning (Andy Shevchenko)
- bpf: Don't predict JMP32 pointer vs zero comparisons (Eduard Zingerman) [Orabug: 40079510] {CVE-2026-98041}
- bpf: Mark faultable stack helpers as sleepable (Kumar Kartikeya Dwivedi) [Orabug: 40079520] {CVE-2026-98045}
- bpf: Mark bpf_btf_find_by_name_kind() as sleepable (Kumar Kartikeya Dwivedi) [Orabug: 40079522] {CVE-2026-98046}
- net: bcmasp: fix tx_spb_ring_full() checking same slot cnt times (Justin Chen) [Orabug: 40079537] {CVE-2026-98051}
- net: bcmasp: clear txcb->last before writing each descriptor (Justin Chen) [Orabug: 40079541] {CVE-2026-98052}
- ASoC: Intel: avs: Fix unbalanced module reference count (Cezary Rojewski) [Orabug: 40079546] {CVE-2026-98054}
- ASoC: Intel: avs: Do not ignore -ENOENT when loading a topology (Cezary Rojewski)
- ASoC: Intel: avs: Clean up the bus when fetching ML caps fails (Cezary Rojewski) [Orabug: 40079548] {CVE-2026-98055}
- nvme-tcp: defer TLS inline send to io_work (Xixin Liu)
- nvme-tcp: open-code nvme_tcp_queue_request() for R2T (Hannes Reinecke)
- nvme: remove stale namespaces by NSID range during scan (Mohamed Khalfella) [Orabug: 40079550] {CVE-2026-98056}
- ring-buffer: Add checking nr_subbufs to persistent ring buffer validation (Steven Rostedt) [Orabug: 40079555] {CVE-2026-98057}
- bpf: Mark sched_process_wait argument as nullable (Kumar Kartikeya Dwivedi) [Orabug: 40079562] {CVE-2026-98059}
- bpf: Fix NULL-ptr-deref in btf_var_show() (Jiayuan Chen) [Orabug: 40079569] {CVE-2026-98063}
- bpf: Fix NULL-ptr-deref when showing a void BTF type (Jiayuan Chen) [Orabug: 40079572] {CVE-2026-98064}
- ALSA: caiaq: Fix potential double-free at error path (Takashi Iwai) [Orabug: 40079576] {CVE-2026-98066}
- selftests/alsa: Fix the step check for INTEGER controls (Hyeongjun An)
- arm64: trans_pgd: clone only the linear map that exists at runtime (Breno Leitao)
- net: gro: Fix nesting of TCP GSO SKBs in skb_gro_receive_list() (Hw He)
- net: stmmac: reconfigure RX packet parser table in stmmac_hw_setup() after reset (Lorenzo Bianconi)
- bonding: do not clear curr_active_slave prematurely when releasing all slaves (Eric Dumazet) [Orabug: 40079606] {CVE-2026-98074}
- bpf: reject BPF_PSEUDO_FUNC reference to the main program (Eduard Zingerman) [Orabug: 40079610] {CVE-2026-98075}
- tracing/probes: Fix use-after-free on field name/type of events with multiple probes (Henry Martin) [Orabug: 40079616] {CVE-2026-98076}
- netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() (Joas Antonio Dos Santos) [Orabug: 40079621] {CVE-2026-98077}
- ipvs: fix reversed sequence option serialization (Kyle Zeng) [Orabug: 40079625] {CVE-2026-98078}
- btrfs: do not force reloc root creation during qgroup_account_snapshot() (Qu Wenruo) [Orabug: 40079634] {CVE-2026-98080}
- btrfs: send: fix lost error return value in will_overwrite_ref() (Avi Weiss)
- btrfs: zoned: finish active block group cleanup if call_zone_finish() fails (Johannes Thumshirn) [Orabug: 40079639] {CVE-2026-98081}
- btrfs: return proper negative error code for update_raid_extent_item() (Qu Wenruo)
- btrfs: fix the possible bioc_list memory leak during error (Qu Wenruo) [Orabug: 40079643] {CVE-2026-98082}
- btrfs: fix transaction use-after-free in raid stripe insertion (Shuangpeng Bai) [Orabug: 40079647] {CVE-2026-98083}
- ASoC: ux500: Program the MSP FIFO watermarks (Linus Walleij)
- ASoC: ux500: Allow repeated MSP prepare calls (Linus Walleij)
- ASoC: ux500: Remove obsolete PRCMU QoS calls (Linus Walleij)
- ASoC: ux500: Request the MSP MMIO resource (Linus Walleij)
- ASoC: ux500: Deassert the MSP reset during probe (Linus Walleij)
- mfd: db8500-prcmu: Fold dbx500 header into db8500 (Linus Walleij)
- arm: Handle KCOV __init vs inline mismatches (Kees Cook)
- mfd: db8500-prcmu: Remove needless return in three void APIs (Zijun Hu)
- ASoC: ux500: Validate MSP DAI configuration (Linus Walleij)
- ASoC: ux500: Correct MSP frame and bit clock setup (Linus Walleij)
- ASoC: ux500: Propagate MSP setup errors (Linus Walleij)
- ASoC: ux500: Fix MSP stream lifecycle handling (Linus Walleij)
- printk/nbcon: Change nbcon_irq_work to IRQ_WORK_LAZY (John Ogness)
- ALSA: ump: do not touch legacy_rmidi before it exists (Qingyu Zhang) [Orabug: 40079657] {CVE-2026-98086}
- ALSA: ump: Update rawmidi name per EP name update (Takashi Iwai)
- ALSA: ump: Copy safe string name to rawmidi (Takashi Iwai)
- ALSA: ump: Copy FB name string more safely (Takashi Iwai)
- ALSA: rawmidi: Show substream activity in info ioctl (Takashi Iwai)
- ALSA: rawmidi: Expose the tied device number in info ioctl (Takashi Iwai)
- locking/lockdep: Invalidate stale class_cache entries for zapped classes (Eric Dumazet)
- perf/core: Skip empty AUX records with only format flags (Leo Yan)
- scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues() (Ivy Lopez) [Orabug: 40079664] {CVE-2026-98088}
- perf: RISC-V: check cpu_hw_evt before dereference in overflow IRQ (Xixin Liu)
- bonding: alb: fix uninitialized transport header access in alb_determine_nd() (Eric Dumazet) [Orabug: 40079670] {CVE-2026-98089}
- btrfs: restore active device pointers after failed sprout (Guanghui Yang) [Orabug: 40079672] {CVE-2026-98090}
- btrfs: detach failed sprout device from transaction update list (Guanghui Yang) [Orabug: 40079676] {CVE-2026-98091}
- drm/xe/oa: Remove sysfs entry on idr_alloc failure in xe_oa_add_config_ioctl() (Lu Yao)
- ASoC: amd: yc: fix memory leak in acp6x_pdm_dma_close() (Wangdicheng) [Orabug: 40079682] {CVE-2026-98092}
- ASoC: amd: renoir: fix disable_pdm_interrupts() to clear mask bits (Wangdicheng)
- s390/boot: Fix physical memory search range (Vasily Gorbik)
- ALSA: hda: restore MFG widget enumeration after core split (Xu Rao)
- ALSA: hda/core: Use guard() for mutex locks (Takashi Iwai)
- staging: fbtft: make dirty_lock IRQ-safe (Sh_Def)
- af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header(). (Kuniyuki Iwashima) [Orabug: 40079695] {CVE-2026-98095}
- ipv6: sr: restore network header before routing and forwarding (Eric Dumazet) [Orabug: 40079699] {CVE-2026-98096}
- tipc: Dont send random pad bytes in RESET/ACTIVATE messages (David Laight) [Orabug: 40079706] {CVE-2026-98097}
- tipc: fix NULL deref in tipc_named_node_up() on empty publication list (Tung Nguyen) [Orabug: 40079713] {CVE-2026-98098}
- ip6_gre: check tunnel info before xmit in ip6gre_tunnel_xmit (Eric Dumazet)
- ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src() (Eric Dumazet) [Orabug: 40079730] {CVE-2026-98102}
- ppp: ppp_synctty: simplify tty disc_data access (Qingfang Deng)
- ppp: ppp_async: simplify tty disc_data access (Qingfang Deng)
- igmp: convert struct ip_sf_list to RCU (Eric Dumazet) [Orabug: 40079734] {CVE-2026-98103}
- net/sched: cls_u32: fix duplicate handle when node ID pool is exhausted (Jamal Hadi Salim) [Orabug: 40079740] {CVE-2026-98104}
- net: ethernet: oa_tc6: Fix for the wrong data type (Selvamani Rajagopal)
- net: ethernet: oa_tc6: Disable tx queues on fatal error (Selvamani Rajagopal)
- net: ethernet: oa_tc6: Improve the error recovery (Selvamani Rajagopal)
- net: ethernet: oa_tc6: Protect skb pointer used by two different kernel instances (Selvamani Rajagopal)
- net: ethernet: oa_tc6: Add the OA_TC6_ prefix to standard registers (Ciprian Regus)
- net: ethernet: oa_tc6: Export standard defined registers (Ciprian Regus)
- net: ethernet: oa_tc6: Handle the OA TC6 SPI protected mode (Ciprian Regus)
- net: ethernet: oa_tc6: Interrupt is active low, level triggered. (Selvamani Rajagopal)
- ASoC: ab8500: Validate and program TDM slots correctly (Linus Walleij)
- ASoC: ab8500: Correct digital interface format setup (Linus Walleij)
- ASoC: ab8500: Repair the DAPM capture graph (Linus Walleij)
- ASoC: ab8500: Reset the audio block before configuring it (Linus Walleij)
- Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout() (Gongwei Li)
- Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM (Pauli Virtanen)
- Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect (Pauli Virtanen) [Orabug: 40079748] {CVE-2026-98107}
- Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan (Pauli Virtanen) [Orabug: 40079753] {CVE-2026-98108}
- Bluetooth: hci_core: Fix race condition during device registration (Aleksandr Nogikh) [Orabug: 40079757] {CVE-2026-98109}
- Bluetooth: btintel: bound firmware ID by TLV length (Laxman Acharya Padhya) [Orabug: 40079759] {CVE-2026-98110}
- Bluetooth: btintel: validate version TLV value lengths (Laxman Acharya Padhya) [Orabug: 40079761] {CVE-2026-98111}
- workqueue: reject watchdog thresholds that overflow jiffies (Jiacheng Xu)
- workqueue: replace use of system_wq with system_percpu_wq (Marco Crivellari)
- Bluetooth: btintel_pcie: Clear automask on spurious interrupts (Kiran K)
- sched_ext: Fix timer pinning and return value in scx_central (Wanwu Li)
- s390/ipl: Fix NULL deref in dump_reipl without re-IPL parm block (Vasily Gorbik)
- s390/ipl: Fix NULL deref in kdump without re-IPL parm block (Vasily Gorbik)
- s390/time: Use jiffies instead of jiffies_64 (Heiko Carstens)
- s390/vtime: Use __this_cpu_read() / get rid of READ_ONCE() (Heiko Carstens)
- ksmbd: rate limit unmapped SID errors (Namjae Jeon)
- ksmbd: propagate DACL parsing errors (Namjae Jeon)
- ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF (Yilin Zhang) [Orabug: 40079779] {CVE-2026-98116}
- OPP: of: Fix potential multiplication overflow when calculating freq (Colin Ian King)
- perf symbol: Do not use debug file as the binary type (Adrian Hunter)
- watchdog: msc313e: Fix NULL pointer dereference in PM callbacks (Tzung-Bi Shih)
- vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del() (Baul Lee) [Orabug: 40079802] {CVE-2026-98122}
- net: amd-xgbe: discard rx packets with bad FCS (James Nugraha)
- raw: annotate disconnect-side IPv4 match writers (Luoxuanqiang)
- sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration (Henry Martin) [Orabug: 40079806] {CVE-2026-98123}
- smb: client: transport: Fix debug printing in __release_mid() (Andy Shevchenko)
- smb/client: fix integer truncation in collapse range (Huiwen He)
- smb/client: fix data corruption in emulated insert range (Huiwen He)
- smb: move copychunk definitions to common/smb2pdu.h (Zhangguodong)
- smb: client: batch SRV_COPYCHUNK entries to cut round trips (Henrique Carvalho)
- smb/client: mark file sparse before emulating insert range (Huiwen He)
- smb/client: validate new EOF for zero range (Huiwen He) [Orabug: 40079822] {CVE-2026-98126}
- smb/client: validate new EOF for insert range (Huiwen He) [Orabug: 40079827] {CVE-2026-98127}
- scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add() (Milan P. Gandhi) [Orabug: 40079831] {CVE-2026-98128}
- scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add() (Milan P. Gandhi) [Orabug: 40079837] {CVE-2026-98129}
- sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START (Xin Long) [Orabug: 40079843] {CVE-2026-98130}
- net/sched: act_api: fix skb sizing and action leak on reoffload delete (Victor Nogueira)
- net/sched: act_api: size the RTM_GETACTION reply from the actions (Victor Nogueira)
- net/sched: act_api: budget all shared attributes in notify skbs (Victor Nogueira)
- net: iptunnel: fix stale transport header during tunnel decapsulation (Dong Chenchen)
- tcp: use GFP_ATOMIC in tcp_send_active_reset() (Eric Dumazet)
- net: icmp: avoid invalid transport header access in icmp_send tracepoint (Eric Dumazet)
- drm/cirrus-qemu: Validate BAR0 size during probe (Slawomir Stepien) [Orabug: 40079874] {CVE-2026-98142}
- drm/cirrus: Use video aperture helpers (Thomas Zimmermann)
- ufs: do not treat unreadable directory blocks as empty (Ali Ahmet Memis)
- bpf: Fix REG INVARIANTS VIOLATION on speculative pointer arithmetic (Jiayuan Chen) [Orabug: 40079901] {CVE-2026-98151}
- selftests/cgroup: Fix cg_run_in_subcgroups ignoring arg parameter (Hongfu Li)
- sched_ext: Fix nonexistent field in sched-ext.rst example (Liang Luo)
- nvmet-rdma: fix queue leak when connect backlog is exceeded (Xixin Liu) [Orabug: 40079902] {CVE-2026-98152}
- nvme-rdma: fix -EIO cleanup order in queue_rq (Xixin Liu) [Orabug: 40079913] {CVE-2026-98154}
- accel/qaic: Address potential out-of-bounds read in resp_worker() (Youssef Samir)
- drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create() (Dan Carpenter)
- EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation (Jad Keskes) [Orabug: 40079927] {CVE-2026-98157}
- EDAC/igen6: Fix channel address decode for non-hash mode (Qiuxu Zhuo)
- EDAC/igen6: Fix channel selection hash (Qiuxu Zhuo)
- EDAC/igen6: Fix interleave boundary condition (Qiuxu Zhuo)
- RAS/AMD/ATL, EDAC/amd64: Only load ATL when needed (Yazen Ghannam)
- ARM: ensure interrupts are enabled in __do_user_fault() (Russell King)
- ARM: 9484/1: enable interrupts when unhandled user faults are triggered (Yuanbin Xie)
- mm/damon/core: avoid infinite kdamond_merge_regions() internal loop (Seongjae Park) [Orabug: 40033139] {CVE-2026-89796}
- Bluetooth: btrtl: Add the support for RTL8761CUV (Max Chou)
- af_unix: Unlink scc_entry in unix_del_edge(). (Kuniyuki Iwashima) [Orabug: 39972794] {CVE-2026-80521}
- l2tp: fix tunnel and session refcount leak on seq_file release (Eric Dumazet) [Orabug: 39972719] {CVE-2026-74735}
- ksmbd: use memcmp() to compare ClientGUIDs (Namjae Jeon)
- ASoC: meson: aiu: Validate written enum values (Hyeongjun An) [Orabug: 39886372] {CVE-2026-74294}
- ASoC: topology: Check PCM and DAI name strings before use (Cássio Gabriel) [Orabug: 39886361] {CVE-2026-74291}
- ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). (Kuniyuki Iwashima) [Orabug: 39886353] {CVE-2026-74289}
- bpf: Guard __get_user acesss with access_ok for uprobe_multi data (Jiri Olsa) [Orabug: 39886262] {CVE-2026-74258}
- RDMA/bnxt_re: Proper rollback if the ioremap fails (Selvin Xavier) [Orabug: 39886234] {CVE-2026-72496}
- coresight: platform: defer connection counter increment until alloc succeeds (Jie Gan)
- md/raid10: fix writes_pending and barrier reference leaks on discard failures (Abd-Alrhman Masalkhi) [Orabug: 39886086] {CVE-2026-72438}
- sctp: fix err_chunk memory leaks in INIT handling (Xin Long) [Orabug: 39886018] {CVE-2026-72413}
- bpf: Mask pseudo pointer values in verifier logs (Nuoqi Gui) [Orabug: 39885989] {CVE-2026-72402}
- Bluetooth: ISO: fix malformed ISO_END/CONT handling (Pauli Virtanen) [Orabug: 39885808] {CVE-2026-72334}
- bpf: Reject redirect helpers without a bpf_net_context (Daniel Borkmann) [Orabug: 39860076] {CVE-2026-68337}
- drm/vc4: hvs/v3d: Fix null dereference in unbind (Gregor Herburger) [Orabug: 39859967] {CVE-2026-68303}
- tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() (Cen Zhang) [Orabug: 39859926] {CVE-2026-68289}
- net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD (Yehyeong Lee) [Orabug: 39859921] {CVE-2026-68288}
- drop_monitor: fix size calculations for 64-bit attributes (Eric Dumazet) [Orabug: 39859917] {CVE-2026-68287}
- drop_monitor: perform u64_stats updates under IRQ-disabled section (Eric Dumazet) [Orabug: 39859913] {CVE-2026-68286}
- ppp_async: drop the errored frame instead of resetting its headroom (Vlatko Kosturjak) [Orabug: 40079934] {CVE-2026-98158}
- of: dynamic: Fix overlayed devices not probing because of fw_devlink (Saravana Kannan)
- driver core: Export get_dev_from_fwnode() (Ulf Hansson)
- drm/amd/display: clean-up dead code in dml2_mall_phantom (Brahmajit Das)
- wifi: mt76: mt7921: skip unknown CLC firmware records (Laxman Acharya Padhya)
- wifi: mt76: mt7921: validate CLC firmware records (Laxman Acharya Padhya) [Orabug: 40079939] {CVE-2026-98159}
- Revert "ARM: 9481/2: breakpoint: CFI breakpoints only on demand" (Sasha Levin)
- Revert "bpf, s390: Clear fetch destination on faulting arena atomic" (Sasha Levin)
- ksmbd: remove stale channels from all sessions on teardown (Gil Portnoy)
- bpftool: Strip all -Wformat* flags from bootstrap libbpf build (Andrii Nakryiko)
- firmware: stratix10-svc: fix FCS SMC call kernel-doc (Genevieve Chan)
- netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (Florian Westphal) [Orabug: 40073059] {CVE-2026-93288}
- ASoC: amd: yc: Add DMI quirk for HyperX OMEN Gaming Laptop 16-ap1xxx (Lin Xianglin)
- scsi: core: Do not block on tag allocation in scsi_eh_lock_door() (Zizhi Wo) [Orabug: 40073071] {CVE-2026-93781}
- ASoC: rt5645: Perform the initial jack detect at probe (Rudi Heitbaum)
- spi: dw: fix wrong RX_SAMPLE_DLY setting after resume (Jisheng Zhang)
- ata: libata-core: Disable LPM on WDC WD141KFGX-68FH9N0 (Niklas Cassel)
- hwmon: (corsair-psu) Fix linear11 calculation (Guenter Roeck)
- vhost-scsi: flush backend after device ioctls (Jia Jia) [Orabug: 40073076] {CVE-2026-93782}
- ASoC: amd: yc: Add DMI quirk for HP Victus Laptop 16-e1xxx (Zhang Heng)
- Drivers: hv: vmbus: add VTL2 redirect connection ID (Hardik Garg)
- ata: libata-core: Disable LPM on WD Green 2.5 480GB (Niklas Cassel)
- ALSA: hda/realtek: Add mute LED quirk for HP Victus 16-e0xxx (MB 88ED) (André Pragosa)
- ata: libata-core: Disable LPM on some WD drives (Niklas Cassel)
- ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision) (Robert Abrahamse)
- Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (Jiale Yao) [Orabug: 40073080] {CVE-2026-93783}
- wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie() (Deepanshu Kartikey) [Orabug: 40073087] {CVE-2026-93784}
- cifs: validate idmap key payload length (Li Qiang) [Orabug: 40073095] {CVE-2026-93785}
- powerpc/pseries: Ensure vpa,slb_shadow & dtl are unregistered during crash (Vaibhav Jain)
- ice: pass the return value of skb_checksum_help() (Michal Swiatkowski)
- ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx (Madhavender Singh)
- ALSA: usb-audio: Add dB map quirk for Razer Barracuda X 2.4 (Markus Lindner)
- phonet: check register_netdevice_notifier() error in phonet_device_init() (Heminhong)
- drm/gma500: return errors from Oaktrail HDMI I2C reads (Pengpeng Hou)
- ksmbd: preserve VFS inherited POSIX ACL mask (Namjae Jeon)
- wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO (Ibrahim Hashimov)
- regulator: core: clamp voltage constraints before applying apply_uV (Kamal Wadhwa)
- smb: client: bound dirent name against end of SMB response in cifs_filldir (Jay Vadayath) [Orabug: 40073128] {CVE-2026-93787}
- wifi: mwifiex: replace one-element arrays with flexible array members (Georgi Valkov)
- ALSA: hda/realtek: Add HDA_CODEC_QUIRK for Samsung 750XBE/730XBE (Zhang Heng)
- wifi: iwlwifi: acpi: validate WGDS table revision index (Emmanuel Grumbach) [Orabug: 40073135] {CVE-2026-93788}
- ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless (Daniel C. Ribeiro)
- wifi: iwlwifi: bound aligned TLV advance in FW parser (Emmanuel Grumbach) [Orabug: 40073140] {CVE-2026-93789}
- ALSA: hda/realtek: Add quirk for HP Pavilion x360 (Takashi Iwai)
- drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized (Timur Kristóf)
- arm64: kprobes: Allow reentering kprobes while single-stepping (Pu Hu)
- wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif (Emmanuel Grumbach) [Orabug: 40073149] {CVE-2026-93790}
- wifi: iwlwifi: mvm: add a check on the tid coming from the firmware (Emmanuel Grumbach) [Orabug: 40073156] {CVE-2026-93791}
- arm64: fixmap: Allow 256K early_ioremap() at any offset (Yu Peng)
- wifi: iwlwifi: mvm: fix a possible underflow (Emmanuel Grumbach) [Orabug: 40073161] {CVE-2026-93792}
- wifi: iwlwifi: mvm: validate TX_CMD response layout (Emmanuel Grumbach) [Orabug: 40073170] {CVE-2026-93793}
- ASoC: Intel: sof_sdw: Add quirks for new Dell laptops (Charles Keepax)
- smb/client: flush dirty data before punching a hole (Huiwen He) [Orabug: 40073176] {CVE-2026-93794}
- blk-cgroup: fix leaks and online flag on radix_tree_insert failure (Tao Cui) [Orabug: 40073183] {CVE-2026-93795}
- ALSA: hda/realtek: Add quirk for HP EliteBook 830 G8 (8AB8) to enable mute LEDs (Marcel Kłos)
- wifi: iwlwifi: pcie: null RX pointers after free (Emmanuel Grumbach) [Orabug: 40073195] {CVE-2026-93796}
- wifi: iwlwifi: mvm: fix sched scan IE sizing (Emmanuel Grumbach)
- wifi: iwlwifi: mvm: parse beacon notif per layout (Emmanuel Grumbach)
- wifi: iwlwifi: mvm: fix an off-by-1 boundary check (Emmanuel Grumbach) [Orabug: 40073204] {CVE-2026-93797}
- wifi: iwlwifi: mvm: validate mac_link_id in session protect notif (Emmanuel Grumbach)
- btrfs: fix reloc root cleanup in merge_reloc_roots() (Filipe Manana) [Orabug: 40073215] {CVE-2026-93798}
- wifi: iwlwifi: mvm: validate sta_id in BA window status notif (Emmanuel Grumbach) [Orabug: 40073224] {CVE-2026-93799}
- spi: dw-dma: Wait for controller idle before completing Tx (Wang Yuwei)
- btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol() (Filipe Manana) [Orabug: 40073232] {CVE-2026-93800}
- btrfs: only account delalloc bytes for regular file inodes in btrfs_getattr() (Dave Chen)
- cifs: Fix support for creating SFU fifo (Pali Rohár)
- ALSA: hda: cs35l56: Fail if wmfw file is missing (Richard Fitzgerald)
- ALSA: hda/realtek - Add quirk for HP Victus 15-fa0xxx (MB 8A50) (Rohit Sinha)
- ALSA: hda/realtek: Fix speakers on MECHREVO WUJIE Series (Chen Bowen)
- smb/client: zero-initialize stack-allocated cifs_open_info_data (Chenxiaosong) [Orabug: 40073242] {CVE-2026-93801}
- cifs: Fix support for creating SFU socket (Pali Rohár)
- smb/client: reduce fallocate zero buffer allocation (Huiwen He)
- ASoC: rt712-sdca: reset codec at io_init to fix silent headphone (Tianze Shao)
- wifi: rsi: validate beacon length before fixed buffer copy (Pengpeng Hou) [Orabug: 40073246] {CVE-2026-93802}
- netfilter: ipset: mark the rcu locked areas properly (Jozsef Kadlecsik)
- wifi: libipw: fix key index receive bound checks (Pengpeng Hou) [Orabug: 40073254] {CVE-2026-93803}
- gpio: dwapb: Mask interrupts at hardware initialization (Liang Hao)
- wifi: mac80211: ibss: wait for in-flight TX on disconnect (Anjaneyulu) [Orabug: 40073260] {CVE-2026-93804}
- wifi: cfg80211: validate rx/tx MLME callback frame lengths before access (Catherine) [Orabug: 40073269] {CVE-2026-93805}
- ksmbd: validate SID namespace before mapping IDs (Namjae Jeon)
- ksmbd: mark invalid session responses as signed (Namjae Jeon)
- ksmbd: find bound sessions during reauthentication (Namjae Jeon)
- wifi: cfg80211: validate assoc response length before status and IE access (Catherine) [Orabug: 40073276] {CVE-2026-93806}
- wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers (Pengpeng Hou) [Orabug: 40073284] {CVE-2026-93807}
- wifi: mac80211: validate deauth frame length before reason access (Catherine)
- wifi: ralink: RT2X00: init EEPROM properly (Corentin Labbe)
- ALSA: usb-audio: caiaq: validate EP1 reply lengths (Pengpeng Hou) [Orabug: 40073293] {CVE-2026-93808}
- ksmbd: fix credit charge calculation for SMB2 QUERY_INFO (Namjae Jeon)
- drm/amdgpu: flush pending RCU callbacks on module unload (Perry Yuan) [Orabug: 40073297] {CVE-2026-93809}
- ASoC: amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table (Jetha Chan)
- netfs: Fix decision whether to disallow write-streaming due to fscache use (David Howells)
- cachefiles: Fix double fput (David Howells) [Orabug: 40073302] {CVE-2026-93810}
- xen/gntalloc: validate grant count before allocation (Yousef Alhouseen)
- freevxfs: don't BUG() on unknown typed-extent type (Farhad Alemi)
- xen/front-pgdir-shbuf: free grant reference head on errors (Yousef Alhouseen)
- ksmbd: Fix acl.sd_buf memory leak and invalid sd_size error handling (Qiang Liu)
- ksmbd: fix n.data memory leak in ksmbd_vfs_set_dos_attrib_xattr (Qiang Liu)
- drm/arm/komeda: fix error handling for clk_prepare_enable() and callers (Gustavo Kenji Mendonça Kaneko)
- ALSA: hda/realtek: Add quirk for HP Victus 16-e0xxx (88EE) to enable mute LED (Shubham Nayak)
- ksmbd: fix sd_ndr.data memory leak in ksmbd_vfs_set_sd_xattr (Qiang Liu)
- netfilter: nf_conntrack_expect: zero at allocation time (Florian Westphal)
- drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend (Gustavo Kenji Mendonça Kaneko)
- btrfs: tree-checker: validate INODE_REF's namelen (Weiming Shi) [Orabug: 40073319] {CVE-2026-93813}
- spi: core: Abort active target transfer on controller suspend (Praveen Talari) [Orabug: 40073325] {CVE-2026-93814}
- ASoC: tas2781: Update default register address to TAS2563 (Baojun Xu)
- fbdev: pm2fb: unwind WC setup on probe failure (Haoxiang Li)
- ALSA: hda: Add Lenovo Legion 7i 16IAX7 17AA3874 quirk (Kamlesh Chhetty)
- eth: mlx5: fix macsec dependency (Arnd Bergmann)
- rtc: bq32000: add delay between RTC reads (Adriana Nicolae)
- blk-cgroup: protect iterating blkgs with blkcg->lock in blkcg_print_stat() (Yu Kuai)
- net: au1000: move free_irq out of the close-time spinlocked section (Runyu Xiao)
- regulator: da9121: Use subvariant ids in the I2C table (Pengpeng Hou)
- PCI/sysfs: Use kstrtobool() to parse the ROM attribute input (Krzysztof Wilczyński)
- PCI/proc: Fix race between pci_proc_init() and pci_bus_add_device() (Krzysztof Wilczyński)
- ksmbd: treat read-control opens as stat opens only for leases (Namjae Jeon)
- ksmbd: break RH leases before delete-on-close (Namjae Jeon)
- ksmbd: start file id allocation at 1 (Namjae Jeon)
- ksmbd: deny renaming directory with open children (Namjae Jeon)
- ksmbd: apply create security descriptor first (Namjae Jeon)
- ksmbd: treat unnamed DATA stream as base file (Namjae Jeon)
- ksmbd: use connection ClientGUID for lease lookup (Namjae Jeon)
- ksmbd: align SMB2 oplock break ack handling (Namjae Jeon)
- ksmbd: validate SMB2 lease create contexts (Namjae Jeon)
- ksmbd: fix lease break and ack state handling (Namjae Jeon)
- ceph: harden send_mds_reconnect and handle active-MDS peer reset (Alex Markuze)
- rtc: aspeed: add AST2700 compatible (Tommy Huang)
- rtc: mv: add suspend/resume support for wakeup (Xue Lei)
- f2fs: validate inline dentry name lengths before conversion (Samuel Moelius)
- ALSA: hda/realtek: Add quirk for Lenovo Yoga 7 16IAP7 (Chris Aherin)
- md/raid5: let stripe batch bm_seq comparison wrap-safe (Chen Cheng)
- mailbox: imx: use devm_of_platform_populate() (Sebastian Andrzej Siewior)
- mailbox: imx: Add a channel shutdown field (Sebastian Andrzej Siewior)
- md/raid5: account discard IO (Yu Kuai)
- mailbox: imx: Use devm_pm_runtime_enable() (Sebastian Andrzej Siewior)
- PCI: plda: Protect root bus removal with rescan lock (Hans Zhang)
- PCI: mediatek: Protect root bus removal with rescan lock (Hans Zhang)
- PCI: rockchip: Protect root bus removal with rescan lock (Hans Zhang) [Orabug: 40073356] {CVE-2026-93820}
- PCI: altera: Protect root bus removal with rescan lock (Hans Zhang)
- PCI: iproc: Protect root bus removal with rescan lock (Hans Zhang) [Orabug: 40073373] {CVE-2026-93822}
- drm/amdkfd: Properly acquire queue buffers in CRIU restore (David Francis)
- ALSA: usb-audio: Add quirk for YAMAHA CDS3000 (Jean-Louis Colaco)
- drm/amdgpu: Use system unbound workqueue for soft IH ring (Timur Kristóf)
- drm/amdkfd: check find_first_zero_bit before __set_bit on kfd->doorbell_bitmap (Xiaogang Chen)
- drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl (Xiaogang Chen) [Orabug: 40073385] {CVE-2026-93823}
- mfd: rsmu: Add 8a34002 support (Matthew Bystrin)
- leds: trigger: gpio: Use GPIOD_FLAGS_BIT_NONEXCLUSIVE (Piotr Kubik)
- mfd: tps65219: Make poweroff handler conditional on system-power-controller (Akashdeep Kaur)
- leds: pca9532: Don't stop blinking for non-zero brightness (Tobias Deiminger)
- leds: uleds: Return -EFAULT on copy_to_user() failure (Yousef Alhouseen)
- ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10 (Galen Hassen)
- tls: reject the combination of TLS and sockmap (Jakub Kicinski) [Orabug: 40073391] {CVE-2026-93824}
- ALSA: usb-audio: Add quirk flags for SC13A (Ai Chao)
- spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data() (Guoqi0226) [Orabug: 40073397] {CVE-2026-93825}
- gpio: pisosr: Read "ngpios" as u32 (Rob Herring)
- scsi: bfa: Reduce kernel stack usage in bfa_fcs_lport_fdmi_build_portattr_block() (Arnd Bergmann)
- fuse: set ff->flock only on success (Zhang Tianci)
- HID: hidpp: fix potential UAF in hidpp_connect_event() (Jiri Kosina) [Orabug: 40073406] {CVE-2026-93826}
- virtio-fs: avoid double-free on failed queue setup (Yung-Tse Cheng) [Orabug: 40073412] {CVE-2026-93827}
- ALSA: hda/realtek: Add quirk for Lenovo Xiaoxin 14 GT (Viktor Menshin)
- exfat: fix handling of damaged volume in exfat_create_upcase_table() (David Timber) [Orabug: 40073418] {CVE-2026-93828}
- sparc: Disable compat support with LLD (Rosen Penev)
- bpftool: Pass host flags to bootstrap libbpf (Leo Yan)
- i3c: mipi-i3c-hci: Tolerate i3c_master_add_i3c_dev_locked() failures in DAA (Adrian Hunter)
- smb: client: fix races in cifsd thread creation (Fredric Cover) [Orabug: 40073426] {CVE-2026-93829}
- net/sched: act_csum: don't mangle UDP tunnel GSO packets (Alice Mikityanska)
- apparmor: propagate -ENOMEM correctly in unpack_table (Maxime Bélair)
- net: hns3: improve the unused_tuple parameter setting (Jijie Shao)
- e1000e: limit endianness conversion to boundary words (Agalakov Daniil)
- vsock: use sk_acceptq_is_full() helper in all transports (Raf Dickson)
- ptp: ocp: add shutdown callback (Vadim Fedorenko)
- net: stmmac: xgmac2: disable RBUE in default RX interrupt mask (Nazim Amirul)
- sparc64: uprobes: add missing break (Rosen Penev)
- Bluetooth: btusb: Add Realtek RTL8922AE VID/PID 0bda/d923 (Zhang Chen)
- Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV (Nils Helmig)
- ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure (Bui Duc Phuc)
- ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence (Bui Duc Phuc)
- ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt (Bui Duc Phuc)
- Bluetooth: btintel_pcie: Add 50 ms delay before MAC init on BlazarIW (Kiran K)
- Bluetooth: L2CAP: validate connectionless PSM length (Samuel Moelius) [Orabug: 40073441] {CVE-2026-97408}
- Bluetooth: btusb: Add support for TP-Link TL-UB250 (Cris)
- Bluetooth: btusb: MT7925: Add VID/PID 0e8d/8c38 (Chris Lu)
- Bluetooth: btmtk: Disable remote wakeup for MT7922/MT7925 (Rongrong)
- Bluetooth: btusb: Add Mercusys MA530 for Realtek RTL8761BUV (Hrvoje Nuic)
- Bluetooth: btusb: Add Realtek RTL8922AE VID/PID 0bda/d922 (Zhang Chen)
- Bluetooth: btusb: Add support for Intel Lizard Peak 2 (0x8087:0x0040) (Ravindra)
- Bluetooth: btusb: MT7922: Add VID/PID 0e8d/223c (Chris Lu)
- spi: xilinx: let transfers timeout in case of no IRQ (Vadim Fedorenko)
- hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i (Potin Lai)
- dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc (Tze Yee Ng)
- dmaengine: altera-msgdma: Use memcpy_toio for descriptor FIFO writes (Adrian Ng Ho Yin)
- PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems (Jose Ignacio Tornos Martinez)
- hwmon: (dell-smm) Add Dell Latitude 7530 to fan control whitelist (Armin Wolf)
- HID: multitouch: Honor ContactCount for Yoga Book 9 to suppress ghost contacts (Dave Carey)
- sctp: Unwind address notifier registration on failure (Yuho Choi)
- nvme-fc: Do not cancel requests in io target before it is initialized (Mohamed Khalfella) [Orabug: 40073446] {CVE-2026-97409}
- platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table (Nikolay Metchev)
- ata: libata-pmp: add JMicron JMS562 quirk (Xu Rao)
- ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IRH8 (Moritz Baron)
- ALSA: hda/realtek: Add quirk for HP 255 15.6 inch G9 Notebook PC (Furst Blumier)
- vdpa/octeon_ep: Use 4 bytes for mailbox signature (Vamsi Attunuru)
- vdpa/ifcvf: handle dev_set_name() failure in ifcvf_vdpa_dev_add() (Evgenii Burenchev)
- net: lan966x: restore RX state on reload failure (Guangshuo Li)
- net: dsa: qca8k: Add support for force mode for fixed link topology (George Moussalem)
- btrfs: use lockless read in nr_cached_objects shrinker callback (Ben Maurer)
- btrfs: use on-disk uuid for s_uuid in temp_fsid mounts (Anand Jain)
- hwmon: (adt7462) Add of_match_table to support devicetree (Kory Maincent)
- hwmon: (raspberrypi) Fix delayed-work teardown race (Shubham Chakraborty)
- PCI: Avoid FLR for MediaTek MT7925 WiFi (Jose Ignacio Tornos Martinez)
- fbcon: don't suspend/resume when vc is graphics mode (Lu Yao)
- btrfs: protect sb_write_pointer() with invalidate lock (Kangning Liao)
- netconsole: take target_cleanup_list_lock in drop_netconsole_target() (Breno Leitao) [Orabug: 40073452] {CVE-2026-97410}
- wifi: mt76: transform aspm_conf for pci_disable_link_state (Jiajia Liu)
- wifi: mt76: mt7925: add 320MHz bandwidth to bss_rlm_tlv (Javier Tia)
- wifi: mt76: mt7925: populate EHT 320MHz MCS map in sta_rec (Javier Tia)
- wifi: mt76: mt7925: add Netgear A8500 USB device ID (Lucid Duck)
- platform/x86: msi-ec: Add support for MSI Pulse GL66 12th Gen (Luis de Carlos)
- wifi: mt76: mt7925: handle 320MHz bandwidth in RXV and TXS (Javier Tia)
- platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table (Gleb Sonichev)
- tls: Flush backlog before waiting for a new record (Chuck Lever)
- net: ibm: emac: mal: fix potential system hang in mal_remove() (Rosen Penev)
- pds_core: quiesce DMA before freeing resources (Nikhil P. Rao) [Orabug: 40073460] {CVE-2026-97412}
- configfs_depend_prep(): pass configfs_dirent instead of dentry (Al Viro)
- RDMA/mlx5: Create ODP EQ for non-pinned dmabuf MRs (Jason Gunthorpe)
- xprtrdma: Add request-pool slack for delayed recycling (Chuck Lever)
- RDMA/rtrs-srv: Fix integer underflow in process_read and process_write (Aurelien Desbrieres)
- ASoC: mediatek: mt8365-afe-pcm: fix possible NULL-pointer dereferences in mt8365_afe_suspend() (Tuo Li)
- NFS: fix eof updates after NFSv4.2 fallocate/zero-range (Dai Ngo)
- btrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF (Zhang Cen) [Orabug: 40073476] {CVE-2026-97415}
- btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk() (Zhengyuan Huang) [Orabug: 40073481] {CVE-2026-97416}
- riscv: panic if IRQ handler stacks cannot be allocated (Osama Abdelkader)
- netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (Rosen Penev) [Orabug: 40073485] {CVE-2026-97417}
- ALSA: es18xx: check control allocation before private data setup (Ruoyu Wang)
- net: microchip: sparx5: clean up PSFP resources on flower setup failure (Haoxiang Li)
- hsr: broadcast netlink notifications in the device's net namespace (Maoyi Xie) [Orabug: 40073494] {CVE-2026-97419}
- net: cpsw_new: unregister devlink on port registration failure (Guangshuo Li)
- bpf: NUL-terminate replaced sysctl value (Dawei Feng) [Orabug: 40073499] {CVE-2026-97420}
- RDMA/mlx5: Fix state and counter desync on loopback enable failure (Li Rongqing)
- RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() (Jason Gunthorpe) [Orabug: 40073503] {CVE-2026-97421}
- wifi: nl80211: Increase ie_len size to prevent truncated IEs in new peer notifications (Thiyagarajan Pandiyan)
- ipv6: use READ_ONCE() for bindv6only default in inet6_create() (Runyu Xiao)
- drm/amdkfd: Unwind debug trap enable on copy_to_user failure (Yongqiang Sun)
- ipmi: si: Use platform_get_irq_optional() to retrieve interrupt (Rosen Penev)
- ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP (Andrei Faleichyk)
- clk: keystone: don't cache clock rate (Michael Walle)
- net/mlx5: E-Switch, align disable sequence with switchdev-to-legacy transition (Shay Drory)
- RDMA/irdma: Fix typo in SQ completions generation (Cyrill Gorcunov)
- net/mlx5e: Verify unique vhca_id count instead of range (Shay Drory)
- drm/amdgpu: fix buffer overflow during vBIOS update (Morris Zhang) [Orabug: 40073529] {CVE-2026-97425}
- drm/amd/pm: bound pp_dpm_set_pp_table() memcpy (Asad Kamal) [Orabug: 40073539] {CVE-2026-97427}
- drm/amdgpu: harden FRU PIA parsing with bounded helpers (Stanley Yang) [Orabug: 40073545] {CVE-2026-97428}
- drm/amdkfd: fix UAF race in destroy_queue_cpsch (Alysa Liu) [Orabug: 40073549] {CVE-2026-97429}
- drm/amd/display: Check for sharpening case when calculating max vtaps for scaler (Samson Tam)
- xhci: Prevent queuing new commands if xhci is inaccessible (Mathias Nyman) [Orabug: 40073554] {CVE-2026-97430}
- usb: xhci: Improve Soft Retries after short transfers (Michał Pecio)
- thermal/drivers/qcom/tsens: Atomic temperature read with hardware-guided retries (Priyansh Jain)
- dpaa2-switch: fix handling of NAPI on the remove path (Ioana Ciornei)
- net: dsa: sja1105: flower: reject cross-chip redirect (David Yang)
- dpaa2-switch: fix the error path in dpaa2_switch_rx() (Ioana Ciornei)
- dpaa2-switch: rework FDB management on the bridge leave path (Ioana Ciornei)
- ALSA: seq: oss: Reject reads that cannot fit the next event (Cássio Gabriel)
- ASoC: codecs: rk3328: Use managed GPIO and clock helpers (Cássio Gabriel)
- ntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e() (Alessandro Schino)
- fs/ntfs3: validate index entry key bounds (Zhengyuan Huang) [Orabug: 40073602] {CVE-2026-97438}
- nvme: refresh multipath head zoned limits from path limits (Yao Sang)
- fs/ntfs3: preserve non-DOS attribute bits in system.dos_attrib (Zhengyuan Huang)
- powerpc/fadump: Add timeout to RTAS busy-wait loops (Adriano Vero)
- iommu/rockchip: disable fetch dte time limit (Simon Xue)
- net: wwan: t7xx: Add delay between MD and SAP suspend (Jose Ignacio Tornos Martinez)
- net: qrtr: fix node refcount leak on ctrl packet alloc failure (Xu Wang) [Orabug: 40073611] {CVE-2026-97440}
- ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach (Chen Pei)
- ACPI: scan: Honor _DEP for ACPI0016 PCI/CXL host bridge (Chen Pei)
- ata: ahci: fail probe if BAR too small for claimed ports (Liyouhong) [Orabug: 40073616] {CVE-2026-97441}
- ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive (Cezary Rojewski)
- ASoC: qcom: q6apm: return error code to consumers on failures (Srinivas Kandagatla)
- wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi (Miaoqing Pan) [Orabug: 40073621] {CVE-2026-97442}
- net: ibm: emac: Reserve VLAN header in MJS limit (Rosen Penev)
- libbpf: Also reset {insn,data}_cur on realloc failure (Daniel Borkmann)
- iio: accel: mma8452: switch to non-devm request_threaded_irq() (Sanjay Chitroda)
- perf/ftrace: Fix WARNING in __unregister_ftrace_function (Rik van Riel) [Orabug: 40073628] {CVE-2026-97443}
- iio: light: stk3310: Deal with the ps interrupt issue in PM (Miao Li)
- mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC (Lad Prabhakar)
- tracing: Disable KCOV instrumentation for trace_irqsoff.o (Karl Mehltretter)
- ARM: tegra: p880: Lower CPU thermal limit (Ion Agorria)
- mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC (Lad Prabhakar)
- mmc: davinci: fix mmc_add_host order in probe (Osama Abdelkader)
- soundwire: only handle alert events when the peripheral is attached (Bard Liao)
- gfs2: page poisoning fix (Andreas Gruenbacher)
- soundwire: dmi-quirks: Disable ghost Realtek devices (Charles Keepax)
- soc/tegra: fuse: Register nvmem lookups at probe (Kartik)
- libbpf: Add __NR_bpf definition for LoongArch (Tiezhu Yang)
- drm/nouveau/bios: skip the IFR header if present (Timur Tabi)
- ASoC: Intel: catpt: Complete coredump handling (Cezary Rojewski)
- scripts: modpost: detect and report truncated buf_printf() output (Alexandre Courbot)
- host1x: bus: Fix missing ops null check in error teardown (Shayderrr)
- pinctrl: renesas: rzv2m: Use -ENOTSUPP instead of -EOPNOTSUPP (Claudiu Beznea)
- net: sfp: add quirk for OEM 2.5G optical modules (Wei Qisen)
- hfs: rework hfsplus_readdir() logic (Viacheslav Dubeyko)
- ACPICA: add boundary checks in two places (Kang Chen) [Orabug: 40073635] {CVE-2026-97444}
- ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() (Kang Chen) [Orabug: 40073643] {CVE-2026-97445}
- ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() (Weiming Shi) [Orabug: 40073651] {CVE-2026-97446}
- ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() (Kang Chen) [Orabug: 40073657] {CVE-2026-97447}
- ACPICA: Add validation for node in acpi_ns_build_normalized_path() (Kang Chen) [Orabug: 40073661] {CVE-2026-97448}
- ACPICA: Add package limit checks in parser functions (Kang Chen) [Orabug: 40073667] {CVE-2026-97449}
- ACPICA: validate handler object type in two places (Kang Chen) [Orabug: 40073672] {CVE-2026-97450}
- ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg() (Kang Chen)
- ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) (Kang Chen) [Orabug: 40073678] {CVE-2026-97451}
- ACPICA: Prevent adding invalid references (Kang Chen) [Orabug: 40073685] {CVE-2026-97452}
- ACPICA: validate byte_count in acpi_ps_get_next_package_length() (Kang Chen) [Orabug: 40073691] {CVE-2026-97453}
- ACPICA: add boundary checks in acpi_ps_get_next_field() (Kang Chen) [Orabug: 40073697] {CVE-2026-97454}
- ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() (Kang Chen) [Orabug: 40073703] {CVE-2026-97455}
- ACPICA: Fix condition check in acpi_ps_parse_loop() (Kang Chen) [Orabug: 40073708] {CVE-2026-97456}
- drm/amd/display: Initialize dsc_caps to 0 (Ivan Lipski)
- drm/amd/pm/si: Fix updating clock limits from power states (Jeremy Klarenbeek)
- drm/dp: Add DSC virtual DPCD quirk for Realtek MST branch device (Imre Deak)
- net: thunderx: fix PTP device ref leak in nicvf_probe() (Haoxiang Li)
- ipv6: addrconf: fix temp address generation after prefix deprecation (Fernando Fernandez Mancera) [Orabug: 40073713] {CVE-2026-97472}
- net: hsr: require valid EOT supervision TLV (Luka Gejak)
- ALSA: usb-audio: Add quirk for Novation Mininova (Uwe Küchler)
- irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed (Mostafa Saleh)
- iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind (Stepan Ionichev)
- mips: cps: Assemble jr.hb with an R2 ISA level (Rosen Penev)
- drm/panel: simple: Add AM-1280800W8TZQW-T00H (Dario Binacchi)
- powercap: intel_rapl: Fix memory leak in rapl_add_package_cpuslocked() (Sumeet Pawnikar) [Orabug: 40073718] {CVE-2026-97473}
- thermal/drivers/tegra/soctherma: Switch to devm cooling device registration (Daniel Lezcano)
- clk: socfpga: agilex: implement l3_main_free_clk (Adrian Ng Ho Yin)
- s390/zcore: Removed unused variables (Heiko Carstens)
- ALSA: seq: Remove arbitrary prioq insertion limit (Cássio Gabriel)
- netlabel: fix IPv6 unlabeled address add error handling (Chenguang Zhao)
- wifi: rtw89: pci: enable LTR based on pcie control register (Dian-Syuan Yang)
- rcu-tasks: Fix possible boot-time tests failed for the call_rcu_tasks() (Zqiang)
- char/nvram: Remove redundant nvram_mutex (Venkat Rao Bagalkote)
- crypto: atmel-sha204a - remove sysfs group before hwrng (Thorsten Blum)
- usb: host: add ARCH_AIROHA in XHCI MTK dependency (Christian Marangi)
- serial: 8250: fix possible ISR soft lockup (Marco Felsch) [Orabug: 40073758] {CVE-2026-97481}
- usb: gadget: aspeed_udc: avoid past-the-end iterator in dequeue (Maoyi Xie)
- USB: cdc-acm: start bulk-IN polling when ALWAYS_POLL_CTRL is set (Dave Carey)
- usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log (Stepan Ionichev)
- usb: core: hcd: fix possible deadlock in rh control transfers (Oliver Neukum) [Orabug: 40073767] {CVE-2026-97483}
- usbip: vhci_hcd: fix NULL deref in status_show_vhci (Adrian Wowk) [Orabug: 40073772] {CVE-2026-97484}
- HID: bpf: Add Huion Inspiroy Frego M button quirk (Nikhil Chatterjee)
- isofs: handle set_blocksize failures (Christoph Hellwig)
- omfs: handle set_blocksize failures (Christoph Hellwig)
- hpfs: handle set_blocksize failures (Christoph Hellwig)
- jfs: handle set_blocksize failures (Christoph Hellwig)
- qnx4: handle set_blocksize failures (Christoph Hellwig)
- minix: handle set_blocksize failures (Christoph Hellwig)
- bfs: handle set_blocksize failures (Christoph Hellwig)
- affs: handle set_blocksize failures (Christoph Hellwig)
- ntfs3: handle set_blocksize failures (Christoph Hellwig)
- befs: handle set_blocksize failures (Christoph Hellwig)
- spi: dw-mmio: Add ACPI ID LECA0002 for LECARC SoCs (Thomas Lin)
- net/sched: sch_drr: make cl->quantum lockless (Eric Dumazet)
- net: bridge: remove stale rcu_barrier() in br_multicast_dev_del() (Eric Dumazet)
- net: usb: qmi_wwan: add MeiG SRM813Q (Jan Volckaert)
- nvme-core: align fabrics_q teardown with admin_q in nvme_free_ctrl (Maurizio Lombardi)
- bitfield: wire __bf_shf to __builtin_ctzll (Yury Norov)
- thunderbolt: Verify Router Ready bit is set after router enumeration (Gil Fine)
- wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed (Miri Korenblit) [Orabug: 40073812] {CVE-2026-97492}
- thunderbolt: Increase timeout for Configuration Ready bit (Gil Fine)
- firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size (Sudeep Holla)
- firmware: arm_scmi: Validate SENSOR_UPDATE payload size (Sudeep Holla)
- thunderbolt: Improve multi-display DisplayPort tunnel allocation (Alan Borzeszkowski)
- thunderbolt: Don't access path config space on Lane 1 adapters in tb_switch_reset_host() (Pooja Katiyar)
- bridge: Add missing READ_ONCE() annotations around FDB destination port (Ido Schimmel)
- drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw (Candice Li) [Orabug: 40073829] {CVE-2026-97494}
- 9p: use kvzalloc for readdir buffer (Pierre Barre)
- drm/imagination: Populate FW common context ID before passing to the FW (Brajesh Gupta)
- arm64/daifflags: Make local_daif_*() helpers __always_inline (Leonardo Bras)
- 9p: invalidate readdir buffer on seek (Pierre Barre)
- iommu: arm-smmu-qcom: Ensure smmu is powered up in set_ttbr0_cfg (Anna Maniscalco)
- sched/fair: Reject misfit pulls onto busy SMT siblings on asym-capacity (Andrea Righi)
- ALSA: usx2y: Drain pending US-428 pipe-4 output commands (Cássio Gabriel)
- drm/amdkfd: Check bounds on allocate_doorbell (David Francis) [Orabug: 40073835] {CVE-2026-97495}
- drm/amdkfd: Fix OOB memory exposure in get_wave_state() (Sunday Clement) [Orabug: 40073839] {CVE-2026-97496}
- drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id (David Francis) [Orabug: 40073845] {CVE-2026-97497}
- PCI: Wait for device readiness after D3hot -> D0uninitialized transition (Bjorn Helgaas)
- mailbox: Make mbox_send_message() return error code when tx fails (Joonwon Kang)
- iomap: don't make REQ_POLLED imply REQ_NOWAIT (Christoph Hellwig)
- drm/mediatek: dsi: Add compatible for mt8167-dsi (Luca Leonardo Scorcia)
- RDMA/mlx5: Use QP port when decoding responder CQEs (Chenguang Zhao)
- media: imon: Add iMON VFD HID OEM v1.2 key mappings (Alessandro Baldi)
- crypto: atmel-ecc - add support for atecc608b (Thorsten Blum)
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (Bard Liao)
- crypto: ecc - Unbreak the build on arm with CONFIG_KASAN_STACK=y (Lukas Wunner)
- scsi: pm8001: Reject non-fatal dump when controller is crashed (Kumar Meiyappan)
- scsi: pm8001: Reject firmware update in fatal error state (Kumar Meiyappan)
- clk: samsung: exynos850: mark APM I3C clocks as critical (Alexey Klimov)
- soundwire: intel: Move suspend tracking from trigger to pm suspend (Peter Ujfalusi)
- drivers/of: validate status properties in reconfig state changes (Pengpeng Hou)
- integrity: Check for NULL returned by asymmetric_key_public_key (Stefan Berger)
- net: dsa: realtek: rtl8365mb: add support for RTL8367SB (Mieczyslaw Nalewaj)
- wifi: rtw89: phy: check length before parsing PHY status IE (Ping-Ke Shih) [Orabug: 40073866] {CVE-2026-97500}
- HID: multitouch: Fix Yoga Book 9 14IAH10 touchscreen misclassification (Dave Carey)
- media: video-i2c: use vb2_video_unregister_device on driver removal (Arash Golgol)
- media: chips-media: wave5: Add range checks for dec_output_info (Ricardo Ribalda)
- drm/gud: Add RCade Display Adapter VID/PID pair (Sophie D)
- net: phy: motorcomm: use device properties for firmware tuning (Chunzhi Lin)
- hfsplus: rework hfsplus_readdir() logic (Viacheslav Dubeyko)
- PCI: intel-gw: Enable clock before PHY init (Florian Eckert)
- drm/amd/display: Fix CRC open failure during active rendering (Tom Chung)
- platform/x86: sel3350-platform: Retain LED state on load and unload (Brodie Abrew)
- mmc: davinci: avoid NULL deref of host->data in IRQ handler (Stepan Ionichev)
- mmc: core: Add validation for host-provided max_segs (Shawn Lin)
- platform/chrome: Resolve kb_wake_angle visibility race (Tzung-Bi Shih)
- net/mlx5: HWS, Handle destroying table that has a miss table (Yevgeny Kliteynik)
- watchdog: lenovo_se10_wdt: Fix use-after-free and resource leak risk (Mark Pearson)
- watchdog: imx7ulp_wdt: Keep WDOG running until A55 enters WFI on i.MX94 (Ranjani Vaidyanathan)
- watchdog: lenovo_se10_wdt: Add support for SE10 Gen 2 platform (Mark Pearson)
- ASoC: ti: omap3pandora: update board check to use DT compatible (Ethan Nelson-Moore)
- media: qcom: camss: avoid format string warning (Arnd Bergmann)
- PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store() (Krzysztof Wilczyński) [Orabug: 40073891] {CVE-2026-97505}
- dlm: add usercopy whitelist to dlm_cb cache (Ziyi Guo)
- drm/bridge: tc358768: Set pre_enable_prev_first for reverse order (Parth Pancholi)
- clk: renesas: cpg-mssr: Add number of clock cells check (Geert Uytterhoeven)
- crypto: omap - add omap_des_unregister_algs helper (Thorsten Blum)
- crypto: ixp4xx - fix buffer chain unwind on allocation failure (Ruoyu Wang)
- rtase: Fix flow control configuration (Justin Lai)
- wifi: mac80211: explicitly disable FTM responder on AP stop (Johannes Berg)
- media: em28xx-video: fix missing res_free() on init_usb_xfer failure (Haoxiang Li)
- net: dsa: mv88e6xxx: enable .rmu_disable() for 6320 family (Marek Behún)
- net: dsa: mv88e6xxx: define .pot_clear() for 6321 (Marek Behún)
- PCI: switchtec: Add Gen6 Device IDs (Ben Reed)
- net: dsa: mv88e6xxx: fix number of g1 interrupts for 6320 family (Marek Behún)
- media: dm1105: fix missing error check for dma_alloc_coherent (Zhaoyang Yu) [Orabug: 40073902] {CVE-2026-97507}
- drm/panel: Enable GPIOLIB for panels which uses functions from it (David Heidelberger)
- drm/amdgpu: Prefer ROM BAR for default VGA device (Lijo Lazar)
- drm/amd/display: Find link encoder for flexible DIG mapping cases (Ovidiu Bunea)
- thunderbolt: Don't create multiple DMA tunnels on firmware connection manager (Alan Borzeszkowski)
- thunderbolt: Set tb->root_switch to NULL when domain is stopped (Mika Westerberg) [Orabug: 40073909] {CVE-2026-97508}
- thunderbolt: Keep the domain reference while processing hotplug (Mika Westerberg)
- thunderbolt: Keep XDomain reference during the lifetime of a service (Mika Westerberg) [Orabug: 40073913] {CVE-2026-97509}
- thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response() (Mika Westerberg) [Orabug: 40073917] {CVE-2026-97510}
- thunderbolt: Don't disable lane adapter if XDomain lane bonding isn't possible (Mika Westerberg)
- thunderbolt: Avoid reserved fields in path config space for USB4 routers (Gil Fine)
- s390/cio: Purge based on the cdev's online status (Vineeth Vijayan)
- net: mana: hardening: Reject zero max_num_queues from MANA_QUERY_VPORT_CONFIG (Erni Sri Satya Vennela)
- media: rc: mceusb: Add support for 04eb:e033 (Riccardo Boninsegna)
- spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM (Viken Dadhaniya)
- media: chips-media: wave5: Fix Reports from Kernel Lock Validator (Brandon Brnich)
- soundwire: validate DT compatible before parsing it (Pengpeng Hou)
- soundwire: intel_auxdevice: Add cs42l43b to wake_capable_list (Charles Keepax)
- bridge: Do not suppress ARP probes and DAD NS unconditionally (Danielle Ratson)
- firmware: stratix10-svc: change get provision data to async SMC call (Siew Chin Lim)
- kcsan: Silence -Wmaybe-uninitialized when calling __kcsan_check_access() (Marco Elver)
- ASoC: fsl-asoc-card: reduce WM8904 PLL ratio to meet frequency limit (Shengjiu Wang)
- wifi: rtw89: disable CSI STBC for VHT 160MHz (Dian-Syuan Yang)
- wifi: rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result() (Panagiotis Petrakopoulos) [Orabug: 40073944] {CVE-2026-97516}
- wifi: mac80211: always allow transmitting null-data on TXQs (Johannes Berg)
- wifi: nl80211: reject beacons with bad HE operation (Johannes Berg) [Orabug: 40073950] {CVE-2026-97517}
- hfsplus: fix issue of direct writes beyond end-of-file (Viacheslav Dubeyko)
- wifi: cfg80211: reject duplicate wiphy cipher suite entries (Yuqi Xu) [Orabug: 40073957] {CVE-2026-97518}
- PCI: Stop setting cached power state to 'unknown' on unbind (Lukas Wunner)
- tools/nolibc: avoid call to wcslen() in _start_c() inserted by clang (Thomas Weißschuh)
- tee: optee: Allow MT_NORMAL_TAGGED shared memory (Hirokazu Honda)
- usb: gadget: udc: skip pullup() if already connected (Xu Yang)
- ima: return error early if file xattr cannot be changed (Goldwyn Rodrigues)
- ALSA: usb-audio: Propagate write errors in generic mixer put callbacks (Cássio Gabriel)
- pinctrl: renesas: rzg2l: Handle RZ/V2H(P) IOLH configuration in PM cache (Lad Prabhakar)
- iio: adc: rtq6056: add i2c_device_id support (Kevin Tung)
- gfs2: move quota_init qc iterator increment (Jie Wang) [Orabug: 40073971] {CVE-2026-97520}
- gfs2: fix quota init duplicate scan (Jie Wang) [Orabug: 40073975] {CVE-2026-97521}
- drm/amd/pm: Check SMUv13.0.6/12 metrics integrity (Lijo Lazar)
- drm/panel: jadard-jd9365da-h3: set prepare_prev_first (Dmitry Baryshkov)
- drm/amd/display: Fix DPMS using partially updated pipe context (Dominik Kaszewski)
- drm: rz-du: Ensure correct suspend/resume ordering with VSP (Tommaso Merciai)
- bus: fsl-mc: wait for the MC firmware to complete its boot (Ioana Ciornei)
- drm/gem: Consider GEM object reclaimable if shrinking fails (Boris Brezillon)
- ksmbd: fix use-after-free in oplock break notification (Abdifatah Suruur)
- LTS version: v6.12.110 (Sherry Yang)
- ACPI: processor: Add cpuidle driver check in acpi_processor_register_idle_driver() (Tony W Wang-Oc)
- integrity: Eliminate weak definition of arch_get_secureboot() (Nathan Chancellor)
- slab: reset slab->obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL (Hao Ge)
- x86/Kconfig: Reenable PTDUMP on i386 (Alexander Popov)
- pinctrl: mediatek: common-v1: Fix error checking in mtk_eint_init() (Dan Carpenter)
- tools/build: Use SYSTEM_BPFTOOL for system bpftool (Tomas Glozar)
- net_sched: add back BH safety to tcf_lock (Eric Dumazet)
- net_sched: act_tunnel_key: use RCU in tunnel_key_dump() (Eric Dumazet)
- net_sched: act_vlan: use RCU in tcf_vlan_dump() (Eric Dumazet)
- net_sched: act_skbedit: use RCU in tcf_skbedit_dump() (Eric Dumazet)
- net_sched: act_ctinfo: use RCU in tcf_ctinfo_dump() (Eric Dumazet)
- net_sched: act_ct: use RCU in tcf_ct_dump() (Eric Dumazet)
- md: fix sync_action incorrect display during resync (Zheng Qixing)
- md: add helper rdev_needs_recovery() (Zheng Qixing)
- kselftest/arm64: mte: Use the correct naming for tag check modes in check_hugetlb_options.c (Catalin Marinas)
- kselftest/arm64: mte: Skip the hugetlb tests if MTE not supported on such mappings (Catalin Marinas)
- net/sched: fq: clamp quantum and initial_quantum in change path (Jamal Hadi Salim) [Orabug: 40081010] {CVE-2026-90050}
- Bluetooth: btmtk: hide unused btmtk_mt6639_devs[] array (Arnd Bergmann)
- xsk: Fix offset calculation in unaligned mode (Eryk Kubanski)
- erofs: fix managed cache race for unaligned extents (Gao Xiang) [Orabug: 40081005] {CVE-2026-64031}
- cpuset: fix warning when disabling remote partition (Chen Ridong) [Orabug: 40081001] {CVE-2025-71142}
- nvme-apple: Reset q->sq_tail during queue init (Nick Chan)
- nvme-apple: Prevent shared tags across queues on Apple A11 (Nick Chan)
- powerpc/vdso: Remove unused clockmode asm offsets (Thomas Weißschuh)
- phy: qcom: qmp-combo: Add missing PLL (VCO) configuration on SM8750 (Krzysztof Kozlowski)
- perf test: Don't signal all processes on system when interrupting tests (James Clark)
- fscrypt: fix left shift underflow when inode->i_blkbits > PAGE_SHIFT (Yongpeng Yang)
- ACPI: processor: Update cpuidle driver check in __acpi_processor_start() (Rafael J. Wysocki)
- md: keep recovery_cp in mdp_superblock_s (Xiao Ni)
- pinctrl: mediatek: common-v1: Fix EINT breakage on older controllers (Chen-Yu Tsai)
- pinctrl: mediatek: Fix new design debounce issue (Hao Chang)
- pinctrl: mediatek: eint: Drop base from mtk_eint_chip_write_mask() (Chen-Yu Tsai)
- cpufreq/amd-pstate: Fix prefcore rankings (Mario Limonciello)
- platform/x86: lg-laptop: Check ACPI_COMPANION() against NULL (Rafael J. Wysocki)
- net/sched: sch_htb: limit htb_classify inner-class filter hops (Jamal Hadi Salim) [Orabug: 40041293] {CVE-2026-90053}
- tcp: fix corruption of urgent data on multi-segment retransmit (Jiayuan Chen) [Orabug: 40041301] {CVE-2026-90054}
- usb: atm: usbatm: fix invalid ci_range initialization (Deepanshu Kartikey) [Orabug: 40041308] {CVE-2026-90055}
- net: fec: only stop PTP if it was initialized (Bui Duc Phuc)
- slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() (Eric Dumazet) [Orabug: 40041322] {CVE-2026-90057}
- net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup (Jamal Hadi Salim) [Orabug: 40041330] {CVE-2026-90058}
- net: stmmac: selftests: Account for the UC filter list for filtering tests (Maxime Chevallier)
- net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering (Maxime Chevallier)
- net: stmmac: dwmac4: Account for the primary MAC address for UC filtering (Maxime Chevallier)
- net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering (Maxime Chevallier)
- net: stmmac: selftests: Check multiple MMC counters (Maxime Chevallier)
- selftests/arm64: Treat KSM merge_across_nodes as optional (Usama Anjum)
- selftests/arm64: Print missing MTE TAP headers (Usama Anjum)
- ALSA: control: Don't add invalid kcontrols to LED layer (Takashi Iwai) [Orabug: 40041339] {CVE-2026-90060}
- netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited() (Pablo Neira Ayuso)
- netfilter: xt_HL: add pr_fmt and checkentry validation (Marino Dzalto)
- netfilter: xt_cgroup: Make it independent from net_cls (Michal Koutný)
- netfilter: nf_tables: move hardware offload step after building the chain blob (Pablo Neira Ayuso) [Orabug: 40041351] {CVE-2026-90062}
- virtio-net: Ensure that TCP packets don't overflow gso_segs (Alice Mikityanska) [Orabug: 40041355] {CVE-2026-90063}
- net: wangxun: use BIT_ULL() to prevent shift overflow on 32-bit archs (Jiawen Wu)
- net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure (Yifei Chu)
- net: ethernet: sun4i-emac: Fix IRQ error handling (Bui Duc Phuc)
- samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify (Xu Wang)
- samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-modify (Xu Wang)
- libceph: validate banner payload length (Aleksandr Nogikh) [Orabug: 40041366] {CVE-2026-90067}
- ceph: revalidate ki_pos for O_APPEND writes after cap acquisition (Xiubo Li)
- ASoC: dapm: Fix off-by-one check on the second enum channel (Hyeongjun An) [Orabug: 40041369] {CVE-2026-90068}
- apparmor: policy_int make sure list heads are initialized before fail path (John Johansen)
- apparmor: Replace sprintf/strcpy with scnprintf/strscpy in aa_policy_init (Thorsten Blum)
- tpm: st33zp24: Validate locality read result (Ruoyu Wang)
- tpm: st33zp24: Return zero on status read failure (Ruoyu Wang) [Orabug: 40041375] {CVE-2026-90070}
- net/sched: sch_teql: restore skb->dev on the slave failure path (Victor Nogueira) [Orabug: 40043379] {CVE-2026-90071}
- net/sched: sfq: clamp quantum to avoid signed overflow soft lockup (Jamal Hadi Salim) [Orabug: 40041381] {CVE-2026-90072}
- net/sched: hhf: clamp quantum before hhf_change() to avoid overflow (Jamal Hadi Salim) [Orabug: 40041385] {CVE-2026-90073}
- net/sched: fq_pie: clamp default quantum to avoid signed overflow (Jamal Hadi Salim)
- net/sched: sch_codel: clamp default mtu to avoid disabling CoDel (Jamal Hadi Salim)
- net/sched: fq_codel: clamp default quantum and mtu (Jamal Hadi Salim) [Orabug: 40041392] {CVE-2026-90075}
- net/sched: fq: add overflow bounds to quantum and initial quantum (Jamal Hadi Salim) [Orabug: 40041397] {CVE-2026-90076}
- net: core: check skb_frags_readable before uncloning in skb_copy_ubufs (Mina Almasry)
- net/sched: act_skbmod: fix length calculations and avoid invalid header warnings (Eric Dumazet) [Orabug: 40041403] {CVE-2026-90078}
- net_sched: act_skbmod: use RCU in tcf_skbmod_dump() (Eric Dumazet)
- maple_tree: fix argument name in header (Liam R Howlett)
- maple_tree: catch race in mas_alloc_cyclic() (Liam R Howlett)
- selftests/mm: skip COW tmpfile cases when fallocate() is unsupported (Usama Anjum)
- selftests/mm: report unique test names for each cow test (Mark Brown)
- selftests/mm/cow: modify the incorrect checking parameters (Hao Ge)
- cifs: fix clearing stats for fastest execution of each smb2 command (Frank Sorenson)
- octeontx2-af: Fix TL3/TL2 link config ENA clearing (Naveen Mamindlapalli)
- net: qualcomm: rmnet: restore skb->dev on deaggregated frames (Xiang Mei)
- gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free (Cen Zhang) [Orabug: 40033099] {CVE-2026-89789}
- Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (Hyunwoo Kim) [Orabug: 40041440] {CVE-2026-90088}
- Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path (Chris Lu)
- Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX (Chris Lu)
- Bluetooth: btmtk: Do not discard the subsystem reset timeout (Ismail Tarim)
- Bluetooth: btmtk: Do not report success when subsys reset fails (Ismail Tarim)
- Bluetooth: btmtk: Fix short read errors in btmtk_usb_reg_read() (Greg Kroah-Hartman)
- Bluetooth: btmtk: Add MT6639 (MT7927) Bluetooth support (Javier Tia)
- Bluetooth: mgmt: fix 'hdev->discovery.uuids' NULL dereference (Pavel Shpakovskiy) [Orabug: 40072795] {CVE-2026-93247}
- Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN (Pauli Virtanen) [Orabug: 40043384] {CVE-2026-90092}
- arm64: ptdump: Make note_page_flush() range aware (Wei-Lin Chang)
- mm/ptdump: split note_page() into level specific callbacks (Anshuman Khandual)
- mm: rename GENERIC_PTDUMP and PTDUMP_CORE (Anshuman Khandual)
- mm: make DEBUG_WX depdendent on GENERIC_PTDUMP (Anshuman Khandual)
- powerpc: Add preempt lazy support (Shrikanth Hegde)
- s390: Add ARCH_HAS_PREEMPT_LAZY support (Heiko Carstens)
- s390: Add missing _TIF defines (Heiko Carstens)
- arm64: Enable ARCH_HAS_NONLEAF_PMD_YOUNG (Yicong Yang)
- scsi: qla2xxx: Fix an loop timeout test (Dan Carpenter)
- net: page_pool: Remove zone/policy GFP flags when allocating XArray entries (Rongrong)
- bnxt_en: Fix call to hardware monitoring event handler (Guenter Roeck) [Orabug: 40041473] {CVE-2026-90101}
- rtc: pcf85363: Add error checking to regmap calls in probe() (Cosmo Chou)
- NFSv4/pnfs: key the data server cache on the NFS version (Junrui Luo) [Orabug: 40041479] {CVE-2026-90102}
- nfs: move the nfs4_data_server_cache into struct nfs_net (Jeff Layton)
- NFSv4.2: fix LAYOUTSTATS send buffer exhaustion (Junrui Luo) [Orabug: 40041485] {CVE-2026-90103}
- net/smc: free pending qentry in smc_llc_flow_stop() before memset (Mahanta Jambigi)
- net/smc: free stashed qentry before overwrite in REQ_ADD_LINK to ADD_LINK transition (Mahanta Jambigi)
- net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue (Jamal Hadi Salim) [Orabug: 40041523] {CVE-2026-90109}
- inetpeer: randomize RB-tree node comparison using SipHash (Eric Dumazet) [Orabug: 40041529] {CVE-2026-90110}
- net: qlcnic: validate unified ROM sections before loading (Pengpeng Hou) [Orabug: 40041540] {CVE-2026-90112}
- net: add missing ref_tracker_dir_exit() to net_passive_dec() (Tetsuo Handa)
- net: ipa: balance runtime PM reference on remove error (Ruoyu Wang)
- forcedeth: stop the tx_timeout register dump past the requested window (Marek Czernohous)
- net: thunderbolt: Count delivered packets in rx_packets and rx_bytes (Fan Ye)
- net/sched: add get_fill_size callbacks for actions missing them (Victor Nogueira)
- net: bridge: Reject descending VLAN tunnel ranges (Ruoyu Wang) [Orabug: 40041548] {CVE-2026-90114}
- xsk: fix NULL pointer dereference in __xsk_rcv() (Cen Zhang) [Orabug: 40041552] {CVE-2026-90115}
- xsk: avoid double checking against rx queue being full (Maciej Fijalkowski)
- xsk: Get rid of xdp_buff_xsk::orig_addr (Maciej Fijalkowski)
- RDMA/ucma: Allow path records to exactly fit the output buffer (Serhat Kumral)
- ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup (Xu Wang) [Orabug: 40041562] {CVE-2026-90119}
- ALSA: core: Add scoped cleanup helper for card references (Cássio Gabriel)
- clk: visconti: Make sure clk_init_data is fully initialized (Geert Uytterhoeven)
- clk: ti: Make sure clk_init_data is fully initialized (Geert Uytterhoeven)
- prctl: fix PR_SET_MM_AUXV losing the forced AT_NULL terminator (Bradley Morgan)
- rtc: gamecube: check return value of devm_rtc_register_device() (Linkai Gong)
- i2c: ocores: Disable clock on failed resume (Ruoyu Wang)
- irqchip/renesas-rzg2l: Fix loss of interrupt (Biju Das)
- rtc: zynqmp: Return optional clock lookup errors (Pengpeng Hou)
- smb: client: fix request buffer leak in smb2_new_read_req() (Christopher Lusk) [Orabug: 40041584] {CVE-2026-90125}
- rtc: pcf8563: fix clock provider leak on unbind (Yi Ding) [Orabug: 40041588] {CVE-2026-90126}
- vdpa/mlx5: fix wrong list iterated in add_direct_chain error path (Li Rongqing) [Orabug: 40041594] {CVE-2026-90128}
- virtio_pci: fix wrong queue index for admin vq in intx path (Li Rongqing)
- vdpa_sim: fix cleanup after worker creation failure (Linfeng Sun) [Orabug: 40041605] {CVE-2026-90130}
- virtio_balloon: disable indirect descriptors (Michael S. Tsirkin)
- i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode (Jian-Ming Liao)
- i3c: mipi-i3c-hci: Refactor PIO register initialization (Adrian Hunter)
- i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc() (Adrian Hunter)
- i3c: mipi-i3c-hci: Quieten initialization messages (Adrian Hunter)
- net: add missing ref_tracker_dir_exit() to alloc_netdev_mqs() (Tetsuo Handa) [Orabug: 40041613] {CVE-2026-90135}
- bonding: initialize err for empty target lists (Ruoyu Wang)
- mlxbf-bootctl: fix the build error with FIELD_PREP() (Nikolay Kulikov)
- platform/x86: hp-bioscfg: fix password encoding bounds check (Guangshuo Li) [Orabug: 40041618] {CVE-2026-90137}
- vsock: use sock_error() to consume sk_err after a failed connect (Nguyen Dinh Phi)
- vsock: don't check the listener's sk_err in vsock_accept() (Nguyen Dinh Phi) [Orabug: 40041620] {CVE-2026-90138}
- vsock: avoid timeout for non-blocking accept() with empty backlog (Laurence Rowe)
- platform/x86: dell-wmi-sysman: Fix instance ID bounds (Hyeongjun An)
- net/smc: hash socket only after full initialisation in smc_sk_init() (Mahanta Jambigi)
- 8139cp: fix Rx and Tx not being disabled in cp_suspend (Karl Mehltretter)
- vxlan: mdb: Fix use-after-free in vxlan_mdb_flush() (Baul Lee) [Orabug: 40072799] {CVE-2026-93250}
- ALSA: hda: Fix connection list comparison in proc output (Xu Rao)
- fuse: check for NULL root inode in fuse_fill_super_submount (Baokun Li) [Orabug: 40041625] {CVE-2026-90139}
- fuse: check attributes staleness on fuse_iget() (Zhang Tianci)
- fuse: convert readdir to use folios (Joanne Koong)
- fuse: support folios in struct fuse_args_pages and fuse_copy_pages() (Joanne Koong)
- fs/ntfs3: validate ef->size covers the record's name and value (Weiming Shi)
- fs/ntfs3: fix out-of-bounds read in read_log_rec_buf() (Konstantin Komarov)
- cuse: wait for pending RCU callbacks on module exit (Baokun Li) [Orabug: 40041628] {CVE-2026-90140}
- net: bridge: vlan: fix inverted default vlan notification (Nikolay Aleksandrov)
- tls: fix RX desync on overlapping skbs (Maximilian Immanuel Brandtner)
- net: dsa: mv88e6xxx: Fix PCS link check on CMODE read error (Ruoyu Wang)
- vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes (Xiang Mei) [Orabug: 40033013] {CVE-2026-89776}
- ipvs: fix integer overflow in ftp helper port/address parsing (Joas Antonio Dos Santos) [Orabug: 40041631] {CVE-2026-90141}
- f2fs: fix to avoid pinfile fragment on fragment:{block, segment} mode (Chao Yu)
- f2fs: cleanup w/ f2fs_need_rand_{blk, seg, seg_blk} (Chao Yu)
- f2fs:Fix incomplete search range in f2fs_get_victim when f2fs_need_rand_seg is enabled (Liu Jinbao)
- f2fs: fix to parse temperature correctly in f2fs_get_segment_temp() (Chao Yu)
- net: hsr: free learned nodes on device setup failure (Xin Xie) [Orabug: 40079963] {CVE-2026-100071}
- pppox: drain queued packets on channel handoff (Qingfang Deng)
- net: dsa: b53: fix error propagation from b53_fdb_dump() (Vladimir Oltean)
- net: kcm: Hold RCU read lock while running BPF parser (Junseo Lim)
- ionic: fix completion descriptor access with 2x desc size (Prabu Thayalan)
- drm/xe: tests: fix error message in xe_migrate_sanity_test() (Dan Carpenter)
- clk: ti: mux: resolve parent clocks by DT index, not by name (Mathieu Dubois-Briand)
- clk: ti: use kcalloc() instead of kzalloc() (Ethan Carter Edwards)
- clk: devres: fix cleanup in devm_clk_get_optional_enabled_with_rate() (Onur Özkan) [Orabug: 40041649] {CVE-2026-90147}
- nfs: fix ENXIO on O_CREAT open of existing symlink over NFSv3 (Michael Nemanov)
- NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease() (Zhansong Gao) [Orabug: 40041651] {CVE-2026-90148}
- pnfs/blocklayout: Fix device leaks on parse failure (Zhangguodong) [Orabug: 40041658] {CVE-2026-90150}
- NFSv4: remove callback IDR entry on client allocation failure (Ruoyu Wang) [Orabug: 40041662] {CVE-2026-90151}
- nfs: refactor pNFS functions using clear_and_wake_up_bit (Arnaud Bonnet)
- nfs: replace atomic bitops sequence with clear_and_wake_up_bit helper (Arnaud Bonnet)
- smb/server: fix session leak in ksmbd_session_register() (Tanze)
- ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size (Hang Nan)
- ksmbd: disconnect on SMB3 decryption failure (Namjae Jeon)
- bpf: Reject negative optlen in cgroup getsockopt hook (Junseo Lim) [Orabug: 40041687] {CVE-2026-90157}
- m68k: nfcon: Do not call console_is_registered() in nfcon_device() (Andreas Schwab)
- bpf: Disallow bpf_{g,s}etsockopt() in cgroup UNIX getname hooks (Junseo Lim) [Orabug: 40041692] {CVE-2026-90159}
- erofs: fix unused pcluster_pools for higher page sizes (Ojaswin Mujoo)
- erofs: support unaligned encoded data (Gao Xiang)
- erofs: convert z_erofs_bind_cache() to folios (Gao Xiang)
- lwt_bpf: Restore reserved headroom after xmit program (Junseo Lim) [Orabug: 40041696] {CVE-2026-90160}
- smb/server: preserve error status in smb2_handle_negotiate() (Zhangguodong)
- smb/server: fix invalid pointer dereference in ksmbd_stop_durable_scavenger() (Zhangguodong)
- smb/server: fix null-ptr-deref in ksmbd_ipc_tree_connect_request() (Zhangguodong)
- ksmbd: free preauth sessions on connection teardown (Namjae Jeon)
- ksmbd: do not advertise unimplemented CA support (Namjae Jeon)
- ksmbd: validate ipc response length before dereferencing its fields (Yunseong Kim)
- smb: server: fix leak of ksmbd_ipc_login_request_ext() returned buffer (Enzo Matsumiya)
- ksmbd: Do not skip lock checks for single-byte ranges (Guangshuo Li)
- hwmon: (emc1403) Drop hysteresis for low limit temperature (Marius Cristea)
- hwmon: (emc1403) Rely on subsystem locking (Guenter Roeck)
- hwmon: (coretemp) Fix core_data leak on CPUs without PTS (Szymon Wilczek) [Orabug: 40041745] {CVE-2026-90178}
- block: mtip32xx: synchronize ioctls with device removal (Hongyan Xu) [Orabug: 40041748] {CVE-2026-90180}
- ublk: reject non-power-of-2 zone sizes in SET_PARAMS (Yao Sang)
- null_blk: serialize configfs attribute updates with device setup (Niklas Cassel) [Orabug: 40041769] {CVE-2026-90184}
- null_blk: serialize configfs attribute stores with the lock (Zizhi Wo) [Orabug: 40041774] {CVE-2026-90185}
- null_blk: reject per-device queue resize for shared tag set (Zizhi Wo) [Orabug: 40041778] {CVE-2026-90186}
- null_blk: free zones array on device power-off (Zizhi Wo) [Orabug: 40041782] {CVE-2026-90187}
- null_blk: free global tag_set on init error path (Zizhi Wo) [Orabug: 40041786] {CVE-2026-90188}
- null_blk: register configfs subsystem after creating default devices (Zizhi Wo) [Orabug: 40041791] {CVE-2026-90189}
- null_blk: use DEFINE_MUTEX for the file-scope mutex (Zizhi Wo) [Orabug: 40041796] {CVE-2026-90190}
- mailbox: pcc: Fix command timeout due to missed interrupt (Huisong Li)
- Revert "mailbox/pcc: support mailbox management of the shared buffer" (Sudeep Holla)
- mailbox/pcc: support mailbox management of the shared buffer (Adam Young)
- mailbox: pcc: Always map the shared memory communication address (Sudeep Holla)
- mailbox: rockchip: disable pclk on probe failure and unbind (Linmao Li)
- mailbox: qcom-cpucp: handle NULL data in send_data callback (Jia Yang)
- mailbox: qcom-cpucp: fix PREEMPT_RT self-deadlock in IRQ handler (Jia Yang)
- perf dso: Guard against cache underflow on short reads in dso_cache__memcpy() (Arnaldo Carvalho de Melo)
- perf dso: Use stored fd error instead of stale errno in file_read() and file_size() (Arnaldo Carvalho de Melo)
- perf dso: Guard close() against invalid fd in dso__decompress_kmodule_path() (Arnaldo Carvalho de Melo)
- sched_ext/scx_flatcg: Fix cvtime true-up on slice expiry (Tao Cui)
- crypto: lskcipher - propagate errors from unaligned crypt (Karl Mehltretter)
- crypto: hisilicon/sec2 - fix CCM algorithm long packet failure (Zhushuai Yin)
- bpf: Fix pending_pos walk on 32-bit ring position wrap (Israel Téllez García)
- ACPI: scan: fix bus ID cleanup on device_add() failures (Hongyan Xu) [Orabug: 40041803] {CVE-2026-90194}
- ring-buffer: Remove trace_buffer::cpus (Vincent Donnefort)
- riscv, bpf: Fix missing sign-ext for signed 1-byte and 2-byte kfunc args (Pu Lehui)
- HID: multitouch: reclassify HTIX5288 to WIN_8_FORCE_MULTI_INPUT_NSMU (Lin Xianglin)
- ASoC: SOF: validate topology volume range before allocation (Pengpeng Hou) [Orabug: 40041809] {CVE-2026-90196}
- tracing: Have trace_event_update_all() only handle module that is loading (Steven Rostedt)
- tracing: Remove "__attribute__()" from the type field of event format (Masami Hiramatsu)
- ALSA: core: Fix use-after-free in snd_card_do_free() (Aleksandr Nogikh) [Orabug: 40041814] {CVE-2026-90198}
- fs/ntfs3: reject out-of-range evcn in mi_enum_attr() (Zhan Xusheng)
- fs/ntfs3: fix integer overflow in MFT cluster validation (Zhan Xusheng)
- net: page_pool: fix UAF in __page_pool_release_netmem_dma on xa_cmpxchg race (Jijie Shao) [Orabug: 40041824] {CVE-2026-90201}
- scsi: ufs: core: Set task state before io_schedule_timeout() (Bart Van Assche)
- scsi: ufs: core: Remove redundant host_lock calls around UTMRLDBR (Avri Altman)
- scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Chandrakanth Patil) [Orabug: 40041828] {CVE-2026-90202}
- selftests/bpf: Fix for veristat file/prog filters processing (Eduard Zingerman)
- Squashfs: check block offset is not negative (Phillip Lougher) [Orabug: 40041834] {CVE-2026-90203}
- ocfs2: fix circular locking dependency in ocfs2_init_acl() (Krystian Kaniewski) [Orabug: 40072806] {CVE-2026-93252}
- bpftool: Fix double close in map dump (Yuan Chen)
- x86/pkeys: Fix pkey_alloc() return value when pkeys are not supported (Bijan Tabatabai)
- selftests/cgroup: Preserve CPU hotplug write errors (Rui Qi)
- selftest/cgroup: Clean up and restructure test_cpuset_prs.sh (Waiman Long)
- selftest/cgroup: Update test_cpuset_prs.sh to use | as effective CPUs and state separator (Waiman Long)
- cgroup/cpuset: Remove remote_partition_check() & make update_cpumasks_hier() handle remote partition (Waiman Long)
- cgroup/cpuset: Fix spelling errors in file kernel/cgroup/cpuset.c (Everest K C )
- ALSA: seq: midi: Serialize input teardown with event_input (John Keeping) [Orabug: 40041851] {CVE-2026-90207}
- clocksource/drivers/armada: Unwind timer clock on init failure (Yuho Choi)
- clocksource/drivers/clps711x: Do not unmap clocksource MMIO (Guangshuo Li)
- s390/debug: Fix deadlock during unregister (Peter Oberparleiter)
- xenbus: Unregister reboot notifier on init failure (Yuho Choi)
- power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address (Henrik Grimler)
- power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address (Henrik Grimler)
- power: supply: bq27xxx: bq27520g4: fix REG_TTES address (Henrik Grimler)
- power: supply: bd99954: Drop bad register fields (Matti Vaittinen)
- PCI/ASPM: Disable/restore ASPM on every function for multi-function devices (Krishna Chaitanya Chundru)
- PCI/ASPM: Cache L0s/L1 Supported so advertised link states can be overridden (Bjorn Helgaas)
- spi: img-spfi: don't disable runtime PM on DMA deferred probe (Felix Gu)
- selftests/bpf: vmtest.sh: Preserve command quoting when running in the VM (Vineet Gupta)
- selftests: harness: Mark test fixture objects __maybe_unused (David Matlack)
- selftests: harness: Restore order of test functions (Thomas Weißschuh)
- bpf, s390: Clear fetch destination on faulting arena atomic (Daniel Borkmann)
- kunit: tool: fix _list_tests filtering wrong variable when list has TAP prefix (Mohammad Abu-Khader)
- super: fix dying superblock warning messages (Karl Mehltretter)
- PCI/ASPM: Use pcie_capability_clear_and_set_word() for ASPM disable/restore (Krishna Chaitanya Chundru)
- firewire: core: fix memory leak in error path of build_tree() (Takashi Sakamoto) [Orabug: 40041872] {CVE-2026-90213}
- firewire: core: validate parent port count before allocating nodes in build_tree() (Takashi Sakamoto)
- firewire: core: consolidate port counting in build_tree() (Takashi Sakamoto)
- firewire: core: add KUnit tests for failure of tree building (Takashi Sakamoto)
- firewire: core: add KUnit tests for successful tree building (Takashi Sakamoto)
- firewire: core: add KUnit test skeleton for node tree (Takashi Sakamoto)
- UBI: fix two issues in the ubi.mtd MODULE_PARM_DESC (Ran Hongyun)
- ASoC: xilinx: formatter_pcm: fix stream_data leak on open error (Rosen Penev)
- mtd: ubi: Release device reference on busy detach (Yuho Choi) [Orabug: 40041880] {CVE-2026-90215}
- ubi: Fix rollback for explicit UBI device numbers (Yuho Choi) [Orabug: 40041882] {CVE-2026-90216}
- UBI: fastmap: Pass to_be_tortured when reusing old fastmap PEBs (Zhihao Cheng)
- UBI: Preserve torture flag when rescheduling failed erasures (Zhihao Cheng)
- ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready (Liangcheng Wang)
- ASoC: pxa: Use devm_clk_get_optional() for extclk clock (Bui Duc Phuc)
- ice: clear the default forwarding VSI rule when releasing a VSI (Petr Oros)
- RDMA/cma: Fix WARNING in res_to_rt (Zhu Yanjun) [Orabug: 40041893] {CVE-2026-90218}
- RDMA/cxgb4: Free debugfs on registration failure (Fan Wu) [Orabug: 40041897] {CVE-2026-90219}
- dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal (Guangshuo Li)
- nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing (Yun Zhou)
- nfc: digital: Do not dump a NULL response in command completion (Linmao Li)
- nfc: pn533: hold a reference to the request skb during send_frame (Yinhao Hu)
- nfc: llcp: bound SNL TLV parsing to the skb and add length checks (Doruk Tan Ozturk)
- nfc: nci: fix double completion race in nci_data_exchange_complete (Zhenghang Xiao)
- nfc: llcp: read llcp_sock->local under the socket lock in getsockopt (Breno Leitao)
- nfc: llcp: avoid userspace overflow on invalid optlen (Breno Leitao)
- nvme: reject passthrough of driver-managed Set Features (Chao Shi)
- nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (Yang Xiuwei) [Orabug: 40041932] {CVE-2026-90227}
- nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() (Guixin Liu) [Orabug: 40041939] {CVE-2026-90228}
- nvme-apple: Drop the PRP null check chicken bit (Sven Peter)
- nvme: apple: Add Apple A11 support (Nick Chan)
- nvme-apple: Never set the opcode in the NVMMU TCB (Sven Peter)
- nvme-apple: Don't set a DMA direction for commands without a data transfer (Sven Peter)
- nvme-apple: Destroy the admin queue on removal (Sven Peter)
- nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate() (Guixin Liu) [Orabug: 40041949] {CVE-2026-90230}
- nvme: Add the DHCHAP maximum HD IDs (Alistair Francis)
- nvme: introduce change ptpl and iekey definition (Guixin Liu)
- nvme: add reservation command's defines (Guixin Liu)
- s390/irqflags: Add out-of-line definitions of arch_local_irq_*() for KMSAN (Ilya Leoshkevich)
- s390: Drop unnecessary CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT (Coiby Xu)
- integrity: Make arch_ima_get_secureboot integrity-wide (Coiby Xu)
- powerpc: Use str_enabled_disabled() helper function (Thorsten Blum)
- powerpc/vdso: Add a page for non-time data (Christophe Leroy)
- ASoC: qcom: q6apm: keep the graph start count in sync with the DSP (Jorijn van der Graaf)
- spi: sprd-adi: Fix probe succeeding without registering the controller (Babanpreet Singh)
- phy: qcom: qmp-combo: Drop qmp_v4_calibrate_dp_phy (Esteban Urrutia)
- phy: qualcomm: qmp-combo: Add DP offsets and settings for Glymur platforms (Abel Vesa)
- phy: qualcomm: qmp-combo: Update QMP PHY with Glymur settings (Wesley Cheng)
- phy: qualcomm: Update the QMP clamp register for V6 (Wesley Cheng)
- phy: qcom-qmp-combo: Use regulator_bulk_data with init_load_uA for regulator setup (Faisal Hassan)
- phy: qcom: qmp-combo: Add new PHY sequences for SM8750 (Wesley Cheng)
- phy: qualcomm: qmp-combo: add support for SAR2130P (Dmitry Baryshkov)
- phy: qcom: qmp-combo: Correct pre-emphasis table for QMP v4 DP PHYs (Esteban Urrutia)
- iommu/amd: Fix incorrect device ID in invalid PASID error message (Vasant Hegde)
- powerpc/configs: enable CONFIG_RAS to fix EDAC support (Michael Walle)
- sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE (Runyu Xiao) [Orabug: 40041973] {CVE-2026-90235}
- SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 (Weiming Shi) [Orabug: 40033068] {CVE-2026-89784}
- arm64: Disable KCSAN instrumentation in delay.o (Marco Elver)
- xdrgen: Fix opaque and string encoders for unbounded members (Chuck Lever)
- xdrgen: Do not declare union XDR functions in the definitions header (Chuck Lever)
- xdrgen: Address some checkpatch whitespace complaints (Chuck Lever)
- xdrgen: Implement big-endian enums (Chuck Lever)
- xdrgen: Rename "enum yada" types as just "yada" (Chuck Lever)
- m68k: Fix backtraces for non-running tasks (Karl Mehltretter)
- iommu/vt-d: Tear down scalable-mode context on probe failure (Lu Baolu) [Orabug: 40041987] {CVE-2026-90241}
- iommu/vt-d: Clear Present bit before tearing down copied context entry (Lu Baolu) [Orabug: 40041992] {CVE-2026-90243}
- iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes)
- fbdev: kyro: Validate overlay viewport coordinates (Danila Chernetsov)
- fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device() (Myeonghun Pak)
- perf synthetic-events: Fix divide by zero in perf_event__synthesize_threads (Ian Rogers)
- perf python: Check counts_values size in set_values (Ian Rogers)
- perf python: Add support for 'struct perf_counts_values' to return counter data (Gautam Menghani)
- perf python: Remove python 2 scripting support (Ian Rogers)
- perf test: Fix skiplist leak in cmd_test (Ian Rogers)
- perf test: Support dynamic test suites with setup callback and private data (Ian Rogers)
- perf test: Send list output to stdout rather than stderr (Ian Rogers)
- perf test: Rename functions and variables for better clarity (Ian Rogers)
- perf test: Sort tests placing exclusive tests last (Ian Rogers)
- perf test: Add a signal handler to kill forked child processes (Ian Rogers)
- perf test: Run parallel tests in two passes (Ian Rogers)
- perf test: Add a signal handler around running a test (Ian Rogers)
- perf test: Display number of active running tests (Ian Rogers)
- perf test: Introduce workloads__for_each() (Arnaldo Carvalho de Melo)
- perf synthetic-events: Fix uninitialized pthread_join (Ian Rogers)
- perf stat: Fix evsel_list leak in cmd_stat (Ian Rogers)
- ARM: dts: helios4: add SATA regulator supplies (Rosen Penev)
- ARM: dts: helios4: add vcc-supply to GPIO expander (Rosen Penev)
- ARM: dts: helios4: add vcc-supply to EEPROM (Rosen Penev)
- arm64: dts: turris-mox: fix usb3 phys (Tomáš Macholda)
- riscv: cpufeature: Clarify ISA spec version for canonical order (Guodong Xu)
- net/sched: cls_api: fix teardown of an adopted proto on insert-race loss (Victor Nogueira) [Orabug: 40042004] {CVE-2026-90248}
- iio: light: gp2ap002: re-enable irq if runtime suspend fails (Nikhil Gautam)
- iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes (Nikhil Gautam)
- Bluetooth: MSFT: validate evt_prefix_len against the response length (Ali Ahmet Memis)
- Bluetooth: btmtksdio: fix usage_count leak when autosuspend_delay is negative (Guangshuo Li)
- Bluetooth: btmtk: add MT7902 SDIO support (Sean Wang)
- Bluetooth: btmtk: add MT7902 MCU support (Sean Wang)
- mmc: sdio: add MediaTek MT7902 SDIO device ID (Sean Wang)
- Bluetooth: MGMT: free the mesh send cancel command when it is cancelled (Linmao Li) [Orabug: 40042019] {CVE-2026-90253}
- Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths (Linmao Li) [Orabug: 40042022] {CVE-2026-90254}
- Bluetooth: hci_conn: fix the SCO setup context lifetime (Linmao Li) [Orabug: 40042026] {CVE-2026-90255}
- Bluetooth: btintel: Fix diagnostics event detection (Zijun Hu)
- Bluetooth: virtio_bt: avoid OOB read of build info string (Hyeongjun An)
- btrfs: retry verity reads for not-uptodate Merkle folios (Chenyichong) [Orabug: 40042045] {CVE-2026-90262}
- scsi: sd: Fix sd_done() sense handling condition (Yang Xiuwei)
- perf trace-event: Fix integer truncation in do_read() and skip() (Tanushree Shah)
- Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices (Zijun Hu)
- Bluetooth: btusb: Record matched usb_device_id into btusb_data (Zijun Hu)
- Bluetooth: btusb: refactor endpoint lookup (Johan Hovold)
- Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855() (Zijun Hu)
- Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event (Zijun Hu)
- sched/fair: Check CPU capacity before comparing group types during load balance (Ricardo Neri)
- ACPI: video: Release PCI device reference after lookup (Yuho Choi)
- regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling (Kamal Wadhwa)
- coresight: etm4x: fix leaked trace id (Levi Yun)
- coresight: etm4x: fix underflow for usage of (nrseqstate - 1) (Levi Yun) [Orabug: 40042070] {CVE-2026-90274}
- coresight: Change syncfreq to be a u8 (James Clark)
- coresight: etm4x: fix wrong check of etm4x_sspcicrn_present() (Levi Yun)
- md/raid1: don't set array_frozen in raid1_takeover() (Bruce Johnston) [Orabug: 40042074] {CVE-2026-90275}
- md: avoid stale clone I/O accounting timestamps (Yu Kuai)
- md/raid5: round bitmap stripes with sector division (Yu Kuai) [Orabug: 40042080] {CVE-2026-90279}
- phy: qcom: qmp-usb: Fix possible NULL-deref on early runtime suspend (Loic Poulain)
- phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend (Loic Poulain)
- phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend (Loic Poulain)
- phy: qcom: sgmii-eth: vote for both voltage rails with correct current loads (Mohd Ayaan Anwar)
- phy: qcom-sgmii-eth: relax order of .power_on() vs .set_mode*() (Russell King)
- soc: fsl: qe: check platform_driver_register() in qe_ic_of_init() (Linkai Gong)
- hugetlbfs: release subpool on fill_super failure (Chenyichong) [Orabug: 40042090] {CVE-2026-90283}
- pinctrl: rockchip: Reset the pin count when recalculating SoC data (Simon Glass)
- firmware_loader: do not queue completed sysfs fallback requests (Mukesh Ojha) [Orabug: 40042094] {CVE-2026-90284}
- scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path (Manish Rangankar) [Orabug: 40042098] {CVE-2026-90285}
- drm/amdgpu/gfx6: Use PFP on the compute queues too (Timur Kristóf)
- drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets (Timur Kristóf)
- perf trace-event: Fix buffer overflow in read_string() (Tanushree Shah)
- phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table (Gerald Loacker)
- phy: sunplus: fix error handling in sp_uphy_init() (Felix Gu)
- arm64: dts: ti: k3-am64: Fix MDIO clock reference for ICSSG0 node (Meghana Malladi)
- ext4: fix spurious message about orphan cleanup on RO fs (Jan Kara)
- drm/amdgpu/gfx6: Fixup emit_cntxcntl() (Timur Kristóf)
- mfd: iqs62x: Reject zero-length firmware records (Pengpeng Hou)
- mfd: rave-sp: validate received frame payload lengths (Pengpeng Hou)
- arm64: hibernate: Restore DAIF state on error (Vladimir Murzin) [Orabug: 40042116] {CVE-2026-90290}
- arm64: hibernate: mask DAIF before restoring hibernated kernel (Ada Couprie Diaz) [Orabug: 40072825] {CVE-2026-93256}
- wifi: mac80211: skip default WMM setup for AP_VLAN links (Felix Fietkau)
- RDMA/erdma: restrict the driver to little-endian systems (Leon Romanovsky)
- module/dups: Fix use-after-free in kmod_dup_req lifetime handling (Petr Pavlu)
- module/dups: Inform duplicate requests about the result directly (Petr Pavlu)
- module: use strscpy() to copy module names in stats and dup tracking (Naveen Kumar Chaudhary)
- module: replace use of system_wq with system_dfl_wq (Marco Crivellari)
- RDMA/siw: Fix use-after-free in siw_accept() (Shuangpeng Bai)
- IB/isert: post the full-feature receive buffers after session registration (Yehyeong Lee) [Orabug: 40042125] {CVE-2026-90293}
- IB/isert: delay the final Login Response until the session is registered (Yehyeong Lee) [Orabug: 40042129] {CVE-2026-90294}
- cpufreq: imx6q: fix out-of-bounds write when probed more than once (Karl Mehltretter)
- cpufreq: imx6q: fix devres accumulation across driver rebind (Karl Mehltretter)
- drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz (Jernej Skrabec)
- drm/sun4i: dw-hdmi: Drop TCON TOP port reference (Jernej Skrabec)
- drm/sun4i: tcon: Drop remote endpoint reference (Jernej Skrabec)
- drm/sun4i: crtc: Propagate layer initialization error (Jernej Skrabec)
- drm/sun4i: hdmi: Don't leak sync polarity bits into packet control (Jernej Skrabec)
- drm/sun4i: tcon: Drop TCON TOP device reference (Jernej Skrabec)
- drm/sun4i: tcon: Set output mux for DSI and LVDS (Jernej Skrabec)
- of: property: add of_graph_get_next_port_endpoint() (Kuninori Morimoto)
- of: property: add of_graph_get_next_port() (Kuninori Morimoto)
- drm/sun4i: vi scaler: Fix coefficient selection (Jernej Skrabec)
- clk: rockchip: rk3576: fix source muxes for SPI0..SPI4 (Alexey Charkov)
- ocfs2: synchronize heartbeat callbacks with o2net teardown (Cen Zhang) [Orabug: 40042162] {CVE-2026-90302}
- ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults (Yuanbin Xie)
- ARM: 9481/2: breakpoint: CFI breakpoints only on demand (Linus Walleij)
- RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ (Yehyeong Lee) [Orabug: 40042181] {CVE-2026-90307}
- RDMA/erdma: Hold QP references for AE and CM processing (Cheng Xu) [Orabug: 40042186] {CVE-2026-90308}
- RDMA/erdma: Hold CQ references when processing EQ events (Cheng Xu)
- modpost: prevent leak when early return no suffix .o in read_symbols() (Robertus Diawan Chris)
- scripts/tags.sh: Prevent binary files appearing in cscope.files (Sergei Litvin)
- arm64: dts: qcom: sm7225-fairphone-fp4: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies (Manivannan Sadhasivam)
- arm64: dts: qcom: qcs8550-aim300: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies (Manivannan Sadhasivam)
- selftests/mm: fix ternary operator precedence in ksm_tests (Sayali Patil)
- selftests/mm: fix ksm NUMA merge test for systems with memoryless NUMA nodes (Sayali Patil)
- selftests/mm: ksm_tests: use kselftest framework (Mike Rapoport)
- ksm_tests: skip hugepage test when Transparent Hugepages are disabled (Li Wang)
- selftests/mm: add new test cases to the migration test (Donet Tom)
- bpf, cgroup: Fix invalid storage access after __cgroup_bpf_attach failed (Pu Lehui) [Orabug: 40042198] {CVE-2026-90313}
- remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry() (Mukesh Ojha) [Orabug: 40042201] {CVE-2026-90314}
- remoteproc: use rsc_table_for_each_entry() in rproc_handle_resources() (Mukesh Ojha)
- remoteproc: Move resource table data structure to its own header (Mukesh Ojha)
- arm64: dts: qcom: agatti: Add missing CX power domain to DISPCC (Imran Shaik)
- drm/omap: dsi: Do not copy isr table (Andreas Kemnade) [Orabug: 40042210] {CVE-2026-90316}
- riscv: dts: sophgo: cv180x: Allow the DMA multiplexer to set channel number for DMA controller (Inochi Amaoto)
- fat: release buffer head after rebuilding parent (Chenyichong) [Orabug: 40042219] {CVE-2026-90318}
- rapidio: clear mport->net when rio_add_net() fails (Guangshuo Li)
- pps-gpio: remove dead capture_clear code (Calvin Owens)
- pps: pps-gpio: split IRQ handler into hardirq timestamper + threaded handler (Michael Byczkowski)
- pps: clients: gpio: Bypass edge's direction check when not needed (Bastien Curutchet)
- pps: don't try to wait for negative timeouts in PPS_FETCH (Calvin Owens)
- lib/string: fix memchr_inv() for large ranges (Bradley Morgan)
- ocfs2/cluster: keep heartbeat local node stable (Cen Zhang) [Orabug: 40042238] {CVE-2026-90322}
- o2hb_region_dev_store(): avoid goto around fdget()/fdput() (Al Viro)
- ublk: check for ublk_unmap_io() returning 0 (Caleb Sander)
- block/kyber-iosched: flush per-cpu latency buckets over possible CPUs (Tao Cui)
- block/blk-iocost: collect per-cpu latency stats over possible CPUs (Tao Cui)
- block/blk-stat: drain per-cpu callback stats over possible CPUs (Tao Cui)
- blk-cgroup: skip dying blkg in blkcg_activate_policy() (Zheng Qixing) [Orabug: 40042245] {CVE-2026-90325}
- phonet: pep: do not write beyond optlen in getsockopt (Breno Leitao)
- net: stmmac: Skip PHY attach if custom PCS is in use (Zxyan Zhu)
- iio: light: tsl2583: return zero in write_raw() on success (Sang-Heon Jeon)
- iio: light: isl29028: return zero in write_raw() on success (Sang-Heon Jeon)
- iio: light: tsl2772: fix ALS calibscale readback (Yuanshen Cao)
- perf intel-bts: Fix off-by-one in auxtrace_info minimum size check (Arnaldo Carvalho de Melo)
- perf intel-pt: Fix off-by-one in auxtrace_info minimum size check (Arnaldo Carvalho de Melo)
- perf auxtrace: Fix queue grow overflow and old array leak (Arnaldo Carvalho de Melo)
- perf thread-stack: Fix heap buffer overflow on branch stack wrap copy (Arnaldo Carvalho de Melo)
- HID: lg4ff: validate report length before fixed offsets (Jiancheng Huang)
- HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure (Chao Huang)
- HID: i2c-hid: Fix "(null)" output when reading report descriptor fails (Ai Chao)
- HID: synchronize input before cleaning up a failed probe (Yousef Alhouseen) [Orabug: 40042259] {CVE-2026-90329}
- HID: i2c-hid: Refactor _DSM helper and add i2c-hid-acpi-prp0001 driver (谢致邦)
- tty: clear cdev pointer after cdev_add() failure (Karl Mehltretter) [Orabug: 40042272] {CVE-2026-90334}
- serial: amba-pl011: unprepare console clock on unregister (Karl Mehltretter)
- MIPS: ptrace: Fix syscall skipping via PTRACE_SYSCALL (Thomas Bogendoerfer)
- powerpc/irq: Fix missing r2 clobber in PCREL inline assembly (Saket Kumar Bhaskar)
- powerpc/smp: add NULL guard for cause_ipi in smp_muxed_ipi_message_pass (Gou Hao)
- firmware: coreboot: Validate table bounds (Laxman Acharya Padhya)
- firmware: google: Add bounds checks in coreboot_table_populate() (Titouan Ameline de Cadeville)
- wifi: mac80211: disconnect on CSA to channel 0 (Johannes Berg) [Orabug: 40042307] {CVE-2026-90344}
- wifi: mac80211: skip unused probe response countdown offsets (Catherine)
- wifi: zd1211rw: reject secondary interfaces to prevent conflicts (Slawomir Stepien)
- wifi: mac80211: send TWT teardown to peer after setup TX failure (Catherine)
- perf/cxlpmu: Fix 64-bit write to 32-bit HDM filter register (Davidlohr Bueso)
- iommu/arm-smmu-v3: Convert to use atomic poll timeout (Pranjal Shrivastava)
- wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump (Linghui Wu)
- wifi: mt76: mt7925: Fix EHT Beamformee SS subfields to meet 802.11be minimum (Shengwei Lu)
- wifi: mt76: mt7925: advertise EHT 320MHz capabilities for 6GHz band (Javier Tia)
- wifi: mt76: mt7915: report RX chain signal for all RX paths (Felix Fietkau)
- wifi: mt76: mt7915: fix chainmask handling for non-dbdc phys on band 1 (Felix Fietkau)
- wifi: mt76: mt7996: fix reg addr remap when addr is 0 (Stanleyyp Wang)
- wifi: mt76: mt7915: release hif2 reference on probe IRQ failure (Felix Fietkau) [Orabug: 40042331] {CVE-2026-90352}
- wifi: mt76: mt7915: fix ext PHY use-after-free on register error path (Felix Fietkau) [Orabug: 40042333] {CVE-2026-90353}
- wifi: mt76: mt7915: fix double hif2 init on the non-WED path (Felix Fietkau) [Orabug: 40042337] {CVE-2026-90354}
- wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement (Felix Fietkau) [Orabug: 40042341] {CVE-2026-90357}
- bpf, x86: Fix trampoline stack size for 128-bit arguments (Yonghong Song) [Orabug: 40042343] {CVE-2026-90358}
- perf machine: Check snprintf truncation for guest kallsyms path (Arnaldo Carvalho de Melo)
- perf machine: Free scandir entries in guest kernel map creation (Arnaldo Carvalho de Melo)
- perf machine: Reset errno before strtol in guest kernel map creation (Arnaldo Carvalho de Melo)
- perf machine: Don't abort guest map creation on first inaccessible dir (Arnaldo Carvalho de Melo)
- perf machine: Check snprintf truncation in machines__findnew() (Arnaldo Carvalho de Melo)
- perf machine: Use snprintf() for guestmount path construction (Arnaldo Carvalho de Melo)
- perf machine: Guard against NULL strlist in machines__findnew() (Arnaldo Carvalho de Melo)
- perf machine: Fix NULL parent dereference in fork event processing (Arnaldo Carvalho de Melo)
- regulator: core: use system_freezable_wq for init complete work (Joy Zou) [Orabug: 40042348] {CVE-2026-90360}
- wifi: ath11k: fix leak in ath11k_service_ready_ext_event() (Jeff Johnson) [Orabug: 40042352] {CVE-2026-90361}
- drm/msm/dsi: Drop dev_pm_opp_set_rate(0) (Konrad Dybcio) [Orabug: 40042355] {CVE-2026-90362}
- drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0) (Konrad Dybcio)
- perf: arm_spe: Make wakeup range check overflow safe (Leo Yan)
- ACPI: processor: Unregister cpufreq notifier on init failure (Can Peng) [Orabug: 40042360] {CVE-2026-90364}
- ACPI: processor: idle: Optimize ACPI idle driver registration (Huisong Li)
- wifi: mt76: only consume the WO drop bit on WED v2 devices (Felix Fietkau)
- wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields (Felix Fietkau)
- wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV (Felix Fietkau)
- wifi: mt76: mt7915: unwind state on add_interface failure (Felix Fietkau) [Orabug: 40042380] {CVE-2026-90368}
- wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config (Felix Fietkau)
- wifi: mt76: check txfree done event on the WED hw path (Rex Lu)
- wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie (Felix Fietkau)
- wifi: mt76: fix stranded frames in mt76_txq_schedule_pending (Felix Fietkau)
- wifi: mt76: mt7915: write RX header translation bit to the correct register (Felix Fietkau)
- wifi: mt76: mt7996: don't report a zero TX bitrate (Felix Fietkau)
- wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss (Felix Fietkau) [Orabug: 40042386] {CVE-2026-90372}
- wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear (Felix Fietkau) [Orabug: 40042389] {CVE-2026-90373}
- wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset (Felix Fietkau)
- wifi: mt76: mt7996: validate RX band_idx before dereferencing phys[] (Felix Fietkau)
- wifi: mt76: fix non-AQL packet accounting for MLO stations (Michael-Cy Lee) [Orabug: 40042393] {CVE-2026-90375}
- wifi: mt76: mt7996: fix capability of EHT-MCS 15 in MRU (Shayne Chen)
- wifi: mt76: mt792x: Fix memory leak in SDIO TX path (Eason Lai)
- wifi: mt76: mt7925: fix msg len mismatch between driver and firmware (Jared Huang)
- wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete (Eason Lai) [Orabug: 40042406] {CVE-2026-90380}
- wifi: mt76: add init_wiphy callback (Sean Wang)
- wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986 (Zhi-Jun You)
- wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length (Lucid Duck) [Orabug: 40042409] {CVE-2026-90382}
- fanotify: report full event length for FIONREAD (Chenyichong)
- misc: sgi-gru: remove interrupt-context page-table walks (Usama Anjum) [Orabug: 40042413] {CVE-2026-90383}
- misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe() (Abdun Nihaal)
- powerpc/crash: Fix possible memory leak in update_crash_elfcorehdr() (Jinjie Ruan)
- locking/lockdep: Fix NULL pointer dereference in __lock_set_class() (Naveen Kumar Chaudhary)
- md/raid1: create serial pool adding rdev to array with serialize_policy=1 (Martin Wilck) [Orabug: 40042420] {CVE-2026-90385}
- md: merge mddev serialize_policy into mddev_flags (Yu Kuai)
- md: merge mddev faillast_dev into mddev_flags (Yu Kuai)
- md: merge mddev has_superblock into mddev_flags (Yu Kuai)
- i3c: master: Fix device_register() error path (Adrian Hunter)
- i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices (Jakub Kicinski)
- swiotlb: Preserve allocation virtual address for dynamic pools (Aneesh Kumar K V) [Orabug: 40042428] {CVE-2026-90387}
- iommu/dma: Check atomic pool allocation result directly (Aneesh Kumar K V) [Orabug: 40042430] {CVE-2026-90388}
- md: scope memalloc_noio to allocation critical sections (Chen Cheng) [Orabug: 40042433] {CVE-2026-90389}
- md: skip redundant raid_disks update when value is unchanged (Abd-Alrhman Masalkhi)
- md: remove unused mddev argument from export_rdev (Chen Cheng)
- md/bitmap: resume array on backlog_store() error path (Chen Cheng) [Orabug: 40042436] {CVE-2026-90390}
- clk: qcom: Return expected ENOMEM error on dynamic allocation failure (Vladimir Zapolskiy)
- clk: qcom: gpucc-qcm2290: Park RCG's clk source at XO during disable (Imran Shaik)
- lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone (Stanislav Kinsburskii)
- bpf: Fix potential UAF when reading bpf link info (Pu Lehui) [Orabug: 40042441] {CVE-2026-90392}
- bpf: Fix potential UAF in bpf_netns_link_update_prog (Pu Lehui) [Orabug: 40042446] {CVE-2026-90393}
- power: supply: sc2731_charger: cancel work on remove (Hongyan Xu)
- power: supply: isp1704_charger: cancel work on remove (Hongyan Xu) [Orabug: 40042456] {CVE-2026-90395}
- arm64: dts: qcom: sm8650: Fix the PCIe iommu-map entries (Manivannan Sadhasivam)
- arm64: dts: qcom: sm8650: add OPP table support to PCIe (Neil Armstrong)
- arm64: dts: qcom: sm8550: Fix the PCIe iommu-map entries (Manivannan Sadhasivam)
- arm64: dts: qcom: sm8450: Fix the PCIe iommu-map entries (Manivannan Sadhasivam)
- arm64: dts: qcom: sm8350: Fix the PCIe iommu-map entries (Manivannan Sadhasivam)
- arm64: dts: qcom: sm8250: Fix the PCIe iommu-map entries (Manivannan Sadhasivam)
- arm64: dts: qcom: sm8150: Fix the PCIe iommu-map entries (Manivannan Sadhasivam)
- arm64: dts: qcom: sdm845: Fix the PCIe iommu-map entries (Manivannan Sadhasivam)
- arm64: dts: qcom: sc8180x: Fix the PCIe iommu-map entries (Manivannan Sadhasivam)
- arm64: dts: qcom: sm8250-xiaomi-elish: correct the board ID (Dawid WróBel)
- firmware: qcom: scm: Fix tzmem state on probe retry (Mukesh Ojha)
- firmware: qcom: scm: Fix NULL dereference in IRQ handler before __scm is published (Mukesh Ojha) [Orabug: 40042461] {CVE-2026-90397}
- firmware: qcom: scm: instrument SMC call path with tracepoints (Yuvaraj Ranganathan)
- firmware: qcom: scm: add trace events for the SMC call interface (Yuvaraj Ranganathan)
- firmware: qcom_scm: Support multiple waitq contexts (Unnathi Chalicheemala)
- firmware: qcom_scm: Add API to get waitqueue IRQ info (Unnathi Chalicheemala)
- arm64: dts: qcom: sc8280xp-crd: Fix the pin index for misc_3p3_reg_en (Konrad Dybcio)
- clk: qcom: gcc-qcm2290: don't park QUP RCGs upon registration (Dmitry Baryshkov)
- arm64: dts: qcom: qcs404: Fix DTBS Check errors in usb controller nodes (Krishna Kurapati)
- arm64: dts: qcom: sdm632-motorola-ocean: Fix LED default trigger property (Konrad Dybcio)
- arm64: dts: qcom: msm8998: Don't pull-up I2C pins by default in sleep (Konrad Dybcio)
- rcu: Mark accesses to ->rcu_urgent_qs and ->rcu_need_heavy_qs (Itai Handler)
- wifi: ath11k: fix stride mismatch in mac_phy_caps_parse() (Jeff Johnson) [Orabug: 40042465] {CVE-2026-90398}
- wifi: ath12k: fix stride mismatch in mac_phy_caps_parse() (Jeff Johnson) [Orabug: 40042468] {CVE-2026-90399}
- selftests/zram: fix kernel_gte() for POSIX sh (Cheng-Han Wu)
- md: recheck spare changes before starting sync (Abd-Alrhman Masalkhi) [Orabug: 40042470] {CVE-2026-90400}
- tools/nolibc/powerpc: mark ctr and xer as clobbered by system call (Thomas Weißschuh)
- md/raid5: protect lockless recovery_offset accesses during reshape (Chen Cheng)
- md: add a new recovery_flag MD_RECOVERY_LAZY_RECOVER (Yu Kuai)
- md: rename recovery_cp to resync_offset (Li Nan)
- md: allow removing faulty rdev during resync (Zheng Qixing)
- md: ensure resync is prioritized over recovery (Li Nan)
- md/raid5-ppl: fix use-after-free in ppl_do_flush() (Sajal Gupta) [Orabug: 40072848] {CVE-2026-93262}
- md/raid5: protect bitmap batch counters aka seq_flush/seq_write consistency (Chen Cheng)
- bus: mhi: host: Fix controller cleanup on EDL sysfs failure (Yuho Choi) [Orabug: 40042474] {CVE-2026-90402}
- bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET (Manivannan Sadhasivam)
- wifi: rtlwifi: pci: fix error path in rtl_pci_probe() (Abdun Nihaal) [Orabug: 40042477] {CVE-2026-90403}
- platform/chrome: cros_ec_debugfs: Unregister panic notifier (Hongyan Xu) [Orabug: 40042482] {CVE-2026-90404}
- platform/chrome: cros_ec_debugfs: Clean up console log on probe failure (Hongyan Xu)
- PCI: starfive: Fix unchecked pm_runtime_get_sync() in probe (Ali Tariq)
- PCI: starfive: Fix Runtime PM handling and teardown ordering (Ali Tariq)
- wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event() (Jeff Johnson) [Orabug: 40042486] {CVE-2026-90407}
- spi: davinci: switch to managed controller allocation (Fan Wu)
- nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request (Guixin Liu) [Orabug: 40042498] {CVE-2026-90411}
- IB/isert: reject login PDUs declaring more data than was received (Yehyeong Lee) [Orabug: 40042503] {CVE-2026-90413}
- IB/isert: reject PDUs declaring more data than was received (Yehyeong Lee) [Orabug: 40042507] {CVE-2026-90414}
- RDMA/cxgb4: free STAG index when TPT entry write fails (Leon Romanovsky) [Orabug: 40042511] {CVE-2026-90415}
- RDMA/mlx5: Send cong param changes to the resolved port mdev (Leon Romanovsky)
- RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs (Leon Romanovsky) [Orabug: 40042517] {CVE-2026-90416}
- scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches. (David Strahan)
- nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch (Ryusuke Konishi)
- nilfs2: prevent out-of-bounds read in super root block parsing (David Lee)
- nilfs2: fix infinite loop in nilfs_clean_segments() (Joshua Crofts)
- clk: rockchip: Fix the fractional part denominator on RK3588/RK3576 PLLs (Alexey Charkov)
- clk: mediatek: mt8135: Fix inverted gate control for devapc_ck (Akari Tsuyukusa)
- clk/x86: pmc_atom: add kasprintf return value check (Longlong Yan)
- clk: palmas: Manage external-control prepare with devm (Myeonghun Pak)
- clk: tegra: tegra124-emc: put EMC node on register failure (Guangshuo Li)
- arm64: dts: allwinner: sun50i-a64-pinephone: Fix mpu6050 mount matrix (Ondrej Jirman)
- wifi: mac80211: fix per-STA profile length in cross-link CSA parsing (Catherine)
- RDMA/efa: Fix PBL chunk length computation (Yonatan Nachum) [Orabug: 40072857] {CVE-2026-93264}
- iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs (Nicolin Chen)
- iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs (Nicolin Chen)
- iommu/tegra241-cmdqv: Use request_threaded_irq (Nicolin Chen)
- fs/ntfs3: reject restart table growth beyond U16_MAX entries (Weiming Shi)
- staging: rtl8723bs: use kfree_sensitive() for key material (Ivy Lopez)
- remoteproc: Prevent crash handling to race with rproc_del() (Bjorn Andersson) [Orabug: 40042565] {CVE-2026-90431}
- remoteproc: core: Attach rproc asynchronously in rproc_add() path via schedule_work() (Jingyi Wang)
- remoteproc: Allow shutdown of crashed processors (Bjorn Andersson)
- remoteproc: core: Drop redundant initialization of 'ret' in rproc_shutdown() (Peng Fan)
- w1: ds2482: Fix signedness bug in ds2482_w1_triplet() (Babanpreet Singh)
- spi: oc-tiny: switch to managed controller allocation (Fan Wu)
- isofs: release zisofs block pointer buffer head (Chenyichong) [Orabug: 40042575] {CVE-2026-90434}
- powercap: intel_rapl_tpmi: Handle PMU registration failure during probe (Sumeet Pawnikar)
- RDMA/mlx5: Fix integer overflow of user QP buffer size (Maher Sanalla) [Orabug: 40042579] {CVE-2026-90435}
- crypto: keembay - publish OF module alias for OCS AES/SM4 (Can Peng)
- crypto: keembay - Initialize completion before requesting IRQ (Linmao Li)
- scsi: ufs: debugfs: Reserve space for a string terminator (Li Qiang) [Orabug: 40042587] {CVE-2026-92477}
- power: supply: sbs-battery: Use a per-device serial number buffer (Babanpreet Singh)
- tools/build: Allow versioning of all LLVM tools defined in Makefile.include (James Clark)
- tools/build: Add bpftool-skeletons feature test (Tomas Glozar)
- pinctrl: mediatek: free EINT resources on unbind (Justin Yeh) [Orabug: 40042597] {CVE-2026-92481}
- pinctrl: mediatek: eint: Fix invalid pointer dereference for v1 platforms (Nícolas F R A Prado) [Orabug: 40080999] {CVE-2025-38266}
- pinctrl: mediatek: Fix the invalid conditions (Hao Chang)
- pinctrl: mediatek: Add EINT support for multiple addresses (Hao Chang)
- cxl/region: Fix use-after-free in find_pos_and_ways() error path (Alison Schofield) [Orabug: 40042608] {CVE-2026-92484}
- selftests/bpf: Fix memory leak on subtest_states reallocation (Feng Yang)
- selftests/bpf: Fix incorrect error checking for pthread_create (Feng Yang)
- ARM: lpc32xx: only run SoC init on LPC32xx hardware (Karl Mehltretter)
- arm64: dts: rockchip: Fix Gru WLAN sideband interrupt (Fabio Estevam)
- drm/panthor: return PTR_ERR() from devm_drm_dev_alloc() (Osama Abdelkader)
- fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init (Weiming Wu)
- netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet (Florian Westphal) [Orabug: 40079957] {CVE-2026-100070}
- drm/tve200: add OF module alias for autoloading (Can Peng)
- leds: pca9532: Fix phantom device registration on missing hardware (Cosmo Chou)
- PM: hibernate: Fix memory leak in snapshot_write_next() error path (Malaya Kumar Rout)
- RDMA/erdma: complete object teardown when the destroy command fails (Leon Romanovsky)
- RDMA/erdma: Support non-sleeping erdma_post_cmd_wait() (Boshi Yu)
- RDMA/erdma: Fix incorrect response returned from query_qp (Boshi Yu)
- RDMA/erdma: Add the query_qp command to the cmdq (Boshi Yu)
- RDMA/erdma: Refactor the code of the modify_qp interface (Boshi Yu)
- RDMA/erdma: Add erdma_modify_qp_rocev2() interface (Boshi Yu)
- RDMA/erdma: Add address handle implementation (Boshi Yu)
- RDMA/erdma: Add the erdma_query_pkey() interface (Boshi Yu)
- RDMA/erdma: Add GID table management interfaces (Boshi Yu)
- RDMA/erdma: Probe the erdma RoCEv2 device (Boshi Yu)
- xfrm: Fix skb double-free in xfrm_dev_direct_output() (Sanghyun Park) [Orabug: 40042619] {CVE-2026-92489}
- perf cs-etm: Avoid truncating AUX buffer sizes to int (Leo Yan)
- perf cs-etm: Flush thread stacks after decoder reset (Leo Yan)
- firmware: arm_scmi: Unrequest devices if driver registration fails (Sudeep Holla)
- firmware: arm_scmi: Roll back partial protocol table registration (Sudeep Holla)
- cpufreq/amd-pstate: Toggle auto_sel in active mode on shared memory systems (Marco Scardovi)
- ARM: dts: allwinner: a10: Fix PMU interrupt (Andre Przywara)
- ext4: check dir entry fits before reading the hash trailer in ext4_search_dir() (Xiang Mei) [Orabug: 40033089] {CVE-2026-89787}
- ext4: fix buffer_head leak in ext4_init_orphan_info (Guanghui Yang) [Orabug: 40042630] {CVE-2026-92494}
- RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap (Selvin Xavier) [Orabug: 40042633] {CVE-2026-92495}
- wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() (Jeff Johnson) [Orabug: 40042635] {CVE-2026-92496}
- wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx() (Jeff Johnson) [Orabug: 40042638] {CVE-2026-92497}
- wifi: ath11k: Correctly copy the hint BSSID in WMI scan request (Jeff Johnson)
- wifi: ath12k: Correctly copy the hint BSSID in WMI scan request (Jeff Johnson)
- wifi: ath6kl: avoid buffer overreads in WMI event handlers (Jeff Johnson) [Orabug: 40042640] {CVE-2026-92498}
- ext4: drain in-flight DIO before buffered write fallback (Baokun Li) [Orabug: 40042652] {CVE-2026-92501}
- ext4: clear stale xarray tags on folios skipped during writeback (Gerald Yang) [Orabug: 40042656] {CVE-2026-92502}
- thermal: intel: int3400: clean up ODVP on probe failures (Pengpeng Hou) [Orabug: 40042660] {CVE-2026-92504}
- iommu/qcom: Fix inverted fault report check in qcom_iommu_fault() (Mukesh Ojha)
- iommu/qcom: Remove sysfs device on probe failure path (Haoxiang Li)
- firmware: arm_scmi: Fix requested device removal race (Sudeep Holla)
- RDMA/core: Fix potential use after free in ib_dealloc_pd_user() (Patrisious Haddad) [Orabug: 40042667] {CVE-2026-92507}
- RDMA/core: Fix potential use after free in ib_free_cq() (Patrisious Haddad) [Orabug: 40042670] {CVE-2026-92508}
- RDMA/core: Fix potential use after free in counter_release() (Patrisious Haddad) [Orabug: 40042675] {CVE-2026-92509}
- RDMA/core: Fix potential use after free in ib_destroy_srq_user() (Patrisious Haddad) [Orabug: 40042679] {CVE-2026-92510}
- RDMA/core: Fix potential use after free in ib_destroy_cq_user() (Patrisious Haddad) [Orabug: 40042683] {CVE-2026-92511}
- RDMA/core: Fix use after free in ib_query_qp() (Patrisious Haddad) [Orabug: 40042690] {CVE-2026-92512}
- RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations (Patrisious Haddad)
- RDMA/erdma: Fix CEQ tasklet use-after-free on removal (Myeonghun Pak)
- PCI: j721e: Fix incorrect max_lanes for J7200 (Takuma Fujiwara)
- RDMA/srpt: Pass the mapped task attribute to target_init_cmd() (Leon Romanovsky)
- bpf: Preserve unique-field state across nested structs (Kumar Kartikeya Dwivedi) [Orabug: 40042698] {CVE-2026-92515}
- ACPI: battery: Adjust charging status validation check (Rafael J. Wysocki)
- riscv, bpf: Fix memory leak in bpf_jit_free (Pu Lehui)
- libbpf: Search /lib64 and /lib in resolve_full_path() (Ricardo B. Marlière)
- ext4: skip extra isize expansion during mount to prevent deadlock (Yun Zhou) [Orabug: 40072873] {CVE-2026-93268}
- ext4: fix out-of-bounds read in ext4_read_inline_dir() (Xiang Mei) [Orabug: 40033082] {CVE-2026-89786}
- ext4: fix circular lock dependency in ext4_ext_migrate (Yun Zhou) [Orabug: 40072879] {CVE-2026-93269}
- ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root (Chen Pei) [Orabug: 40042713] {CVE-2026-92521}
- ACPI: processor: validate MADT IOAPIC entry bounds (Pengpeng Hou) [Orabug: 40042718] {CVE-2026-92522}
- ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer (Zhu Ling)
- RDMA/nldev: validate dynamic counter attribute length (Pengpeng Hou) [Orabug: 40042724] {CVE-2026-92523}
- irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc() (Kemeng Shi) [Orabug: 40042728] {CVE-2026-92524}
- selftests/bpf: Silence array bounds warning in global_map_resize (Viktor Malik)
- arm64: dts: imx8-ss-audio: Fix LPCG clock indices for ASRC0 (Frank Li)
- kcsan: avoid unintended access checking in NMIs (Marco Elver)
- RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (Zheng Tan) [Orabug: 40079979] {CVE-2026-100075}
- RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[] (Ibrahim Hashimov) [Orabug: 40042732] {CVE-2026-92525}
- RDMA/hfi1: Propagate sdma_txinit_ahg() errors (Danila Chernetsov) [Orabug: 40042738] {CVE-2026-93037}
- arm64: dts: amlogic: meson-axg-s400: enable mipi_pcie_analog_dphy for PCIe (Yan Jun)
- arm64: dts: amlogic: meson-axg: Add missing nand_rb0 pin to nand_all_pins (Yan Jun)
- phy: starfive: Fix runtime PM cleanup in JH7110 DPHY RX probe (Can Peng)
- phy: starfive: Fix runtime PM cleanup in JH7110 DPHY TX probe (Can Peng)
- ASoC: meson: Keep link pointers valid on realloc failure (Linmao Li) [Orabug: 40042744] {CVE-2026-93039}
- dmaengine: dw-edma: Clear stale requests on termination (Koichiro Den)
- dmaengine: dw-edma: Serialize channel state checks (Koichiro Den)
- dmaengine: dw-edma: Serialize abort state updates (Koichiro Den)
- dmaengine: dw-edma: Terminate all descriptors without callbacks (Koichiro Den)
- bpf: Reject arena frees below the arena base (Yiyang Chen) [Orabug: 40042768] {CVE-2026-93045}
- drm/msm/a6xx: Fix RBBM_CLOCK_CNTL3_TP0 value in a730_hwcg (Puranam V G Tejaswi)
- driver core: soc: Unregister bus on early device registration failure (Yuho Choi)
- software node: Fix software_node_get_reference_args() with index -1 (Alban Bedel) [Orabug: 40042771] {CVE-2026-93046}
- perf ui hists: Fix uninitialized stack memory free on pstack allocation failure (Ian Rogers)
- mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() (Zhouminqiang) [Orabug: 40042781] {CVE-2026-93048}
- mtd: mtdswap: Avoid freeing registered blktrans device twice (Ruoyu Wang) [Orabug: 40042802] {CVE-2026-93049}
- vfio/pci: clear vdev->msi_perm after freeing it on init failure (Xiang Mei) [Orabug: 40033019] {CVE-2026-89777}
- char: xilinx_hwicap: unregister class on init errors (Myeonghun Pak)
- ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove (Pei Xiao)
- ppdev: prevent overflow when setting port timeout (Linmao Li)
- cacheinfo: don't propagate DT/ACPI error when arch supplies info (arm64) (Breno Leitao)
- misc: ad525x_dpot: use driver core groups for sysfs files (Pengpeng Hou) [Orabug: 40042817] {CVE-2026-93051}
- misc: rtsx: add missing write register handling (Gleb Markov)
- misc: bcm-vk: Use acquire/release for msgq_inited (Gui-Dong Han)
- speakup: keyhelp: guard letter_offsets possible out-of-range indexing (Pavel Zhigulin) [Orabug: 40042827] {CVE-2026-93053}
- accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status() (Christophe Jaillet)
- uio: Fix stale info pointer in failed registration path (Yuho Choi) [Orabug: 40042832] {CVE-2026-93054}
- UDF symlink pathComponent header OOB read (David Lee) [Orabug: 40042840] {CVE-2026-93055}
- tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64 (Karl Mehltretter)
- usb: gadget: f_uac1_legacy: remove broken string configfs attributes (Xu Yang) [Orabug: 40042848] {CVE-2026-93056}
- ACPI: processor: idle: Expand _LPI package sanity checks (Rafael J. Wysocki)
- crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping (Thorsten Blum)
- drm/msm/a6xx: Fix stale rpmh votes after suspend (Shivam Rawat)
- gpu: host1x: Avoid stack over-read in debug output helpers (Mikko Perttunen) [Orabug: 40042864] {CVE-2026-93061}
- gpu: host1x: Fix offset calculation in trace_write_gather (Mikko Perttunen)
- wifi: iwlwifi: mei: pass correct argument to function (Avraham Stern)
- wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments (Emmanuel Grumbach) [Orabug: 40042869] {CVE-2026-93062}
- wifi: iwlwifi: mei: check SAP message length before reading it (Avraham Stern)
- wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser (Emmanuel Grumbach) [Orabug: 40042876] {CVE-2026-93064}
- wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs (Emmanuel Grumbach) [Orabug: 40042878] {CVE-2026-93065}
- perf jevents: Add more components to the metric sorting order (Ian Rogers)
- arm64: dts: qcom: sm8250: correct frequencies in the Iris OPP table (Dmitry Baryshkov)
- arm64: dts: qcom: sm8250: sort out Iris power domains (Dmitry Baryshkov)
- arm64: dts: qcom: sc8280xp-x13s: Fix the drive-strength of mclk pin (Pengyu Luo)
- arm64: dts: qcom: msm8996-xiaomi-gemini: Fix up ti,drv2604 enable GPIO (Konrad Dybcio)
- drm/bridge: tc358767: clamp the reported AUX read size to the request (Maoyi Xie) [Orabug: 40042883] {CVE-2026-93067}
- remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdev (Uday Khare)
- cpufreq: schedutil: Fix self-contradictory comment in sugov_iowait_apply() (Zhongqiu Han)
- cpufreq: intel_pstate: Fix setting minimum P-state at init time (Rafael J. Wysocki)
- drm/amd/display: Remove unused-but-set variable hubp from (Gleb Markov)
- media: ipu6: Do not free aux device pdata after init (Ruoyu Wang) [Orabug: 40042892] {CVE-2026-93070}
- media: bcm2835-unicam: Fix asc leaked in error/remove path (Eugen Hristev)
- media: i2c: rdacm21: Fix missing media_entity_cleanup() (Biren Pandya)
- irqchip/renesas-irqc: Fix generic interrupt chip leak on remove (Qingshuang Fu)
- PCI: xgene: Drop unnecessary OF node reference (Yuho Choi)
- PCI: xgene: Drop XGENE_PCIE_IP_VER_UNKN (Marc Zyngier)
- cpufreq: spear: Fix an IS_ERR() vs NULL bug in spear1340_set_cpu_rate() (Dan Carpenter)
- dax: read holder_ops once in dax_holder_notify_failure() (John Groves) [Orabug: 40042905] {CVE-2026-93073}
- libnvdimm/labels: Bound the on-media label size before the shift (Bryam Vargas)
- firmware: arm_scmi: Unwind P2A receiver mailbox setup failure (Sudeep Holla)
- firmware: arm_scmi: Unwind TX receiver mailbox setup failure (Sudeep Holla)
- firmware: arm_scmi: Drop handle on protocol bind failures (Sudeep Holla)
- firmware: arm_scmi: Protect device request lookup with RCU (Sudeep Holla)
- firmware: arm_scmi: Use channel ID for transport teardown (Sudeep Holla)
- firmware: arm_scmi: Reject out of range DT protocol IDs (Sudeep Holla)
- firmware: arm_scmi: Avoid IDR updates while cleaning channels (Sudeep Holla)
- firmware: arm_scmi: Free transport channel on IDR failure (Sudeep Holla)
- firmware: arm_scmi: Clean up channels on setup failure (Sudeep Holla)
- firmware: arm_scmi: Quiesce notifications before teardown (Sudeep Holla)
- firmware: arm_scmi: Unregister device notifier before IDR teardown (Sudeep Holla)
- firmware: arm_scmi: Publish channel state before callbacks (Sudeep Holla) [Orabug: 40042953] {CVE-2026-93093}
- x86/entry/fred: Encode frame pointer on entry (David Stevens)
- wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate (Baochen Qiang) [Orabug: 40072893] {CVE-2026-93271}
- hfsplus: validate thread record before delete key rebuild (Kyle Zeng)
- fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list() (He Wei)
- fs/ntfs3: fix KMSAN uninit-value in ni_create_attr_list (Nirbhay Sharma)
- fs/ntfs3: Mark inode as bad as soon as error detected in mi_enum_attr() (Konstantin Komarov)
- fs/ntfs3: Add more checks in mi_enum_attr (part 2) (Konstantin Komarov)
- cxl/pci: Honor -EPROBE_DEFER from component register setup (Dave Jiang)
- cxl/mbox: Break poison list loop on an empty payload (Dave Jiang) [Orabug: 40042965] {CVE-2026-93097}
- cxl/memdev: Fix firmware upload exact-fit handling (Guzebing)
- rpmsg: glink: fix deadlock in endpoint destroy during driver detach (Vishnu Santhosh) [Orabug: 40043408] {CVE-2026-93098}
- rpmsg: glink: remove duplicate code for rpmsg device remove (Srinivas Kandagatla)
- media: v4l2-async: Unregister sub-device if asc_list is empty (Hans Verkuil) [Orabug: 40042980] {CVE-2026-93101}
- iommufd/selftest: Avoid selftest dirty bitmap size wrap (Samuel Moelius)
- isofs: fix out-of-bounds page array access on empty zisofs block (Xiang Mei) [Orabug: 40033028] {CVE-2026-89778}
- ASoC: apple: mca: increase SERDES reset delay (James Calligeros)
- RDMA/hfi1: Initialize debugfs after probe completes (Leon Romanovsky)
- RDMA/hfi1: Stop flushing the global IB workqueue (Leon Romanovsky)
- RDMA/hfi1: Create workqueues before device initialization (Leon Romanovsky)
- RDMA/hfi1: Remove redundant PCI device ID validation (Leon Romanovsky)
- RDMA/hfi1: Free RX data on late probe failure (Leon Romanovsky) [Orabug: 40042982] {CVE-2026-93102}
- RDMA/hfi1: Preserve unit 0 on allocation failure (Leon Romanovsky) [Orabug: 40042986] {CVE-2026-93103}
- misc: rtsx_usb: avoid USB I/O in runtime autosuspend (Sean Rhodes)
- pmdomain: bcm: bcm2835: handle genpd provider registration errors (Pengpeng Hou)
- ALSA: hpi: Check transport errors during HPI6000 adapter initialization (Evgenii Burenchev)
- xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full (Xiang Mei) [Orabug: 40033062] {CVE-2026-89783}
- hwrng: ks-sa - Fix runtime PM cleanup on registration failure (Yuho Choi)
- crypto: ccp - Fix memory leak in SEV INIT_EX path (Atish Patra)
- RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state (Allison Henderson) [Orabug: 40043004] {CVE-2026-93107}
- RDMA/ipoib: Drain RCU callbacks during module teardown (Leon Romanovsky) [Orabug: 40043008] {CVE-2026-93108}
- RDMA/mlx5: Drain RCU callbacks during module teardown (Leon Romanovsky) [Orabug: 40043014] {CVE-2026-93109}
- RDMA/core: Wait for RCU callbacks before unloading ib_core (Leon Romanovsky) [Orabug: 40043021] {CVE-2026-93110}
- iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE (Mert Seftali)
- clk: qcom: camcc-sc8280xp: unregister CAMCC_GDSC_CLK (Brian Masney)
- bus: qcom-ebi2: use managed resources for clocks and children (Pengpeng Hou)
- soc: qcom: rpmh-rsc: manage PM notifiers with devres (Pengpeng Hou)
- perf metricgroup: Fix metric expression copy leaks (Yu Peng)
- drm/panel: samsung-s6d16d0: Power off on prepare failure (Laxman Acharya Padhya)
- usb: renesas_usbhs: Fix power-off ordering on unbind (Biju Das)
- usb: mtu3: allow system suspend during active gadget connection (Fei Shao)
- platform/surface: acpi-notify: Check ACPI companion before use (Linmao Li)
- platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL (Linmao Li)
- usb: fix UAF when probe runs concurrent to dyn ID removal (Gary Guo) [Orabug: 40043047] {CVE-2026-93117}
- USB: make to_usb_driver() use container_of_const() (Greg Kroah-Hartman)
- USB: make single lock for all usb dynamic id lists (Greg Kroah-Hartman)
- usb: gadget: aspeed_udc: check endpoint DMA allocation (Ruoyu Wang)
- usb: ljca: bound bank_num in ljca_enumerate_gpio() (Maoyi Xie) [Orabug: 40043056] {CVE-2026-93119}
- usb: gadget: configfs: fix out-of-bounds read of qw_sign (Michael Bommarito)
- usb: gadget: f_fs: Fix fence cleanup in ffs_dmabuf_transfer() error paths (Nuno Sa)
- serial: qcom-geni: do not advance stale DMA completions (Guangshuo Li)
- serial: ma35d1: Fix OF node reference leaks in console init (Yuho Choi)
- selftests/sched_ext: Fix bpf_link leak on early return in prog_run (Liang Luo)
- hwspinlock: propagate errno when registering single lock (Wolfram Sang)
- remoteproc: qcom_q6v5_adsp: Fix reference leak for device node (Felix Gu)
- platform/x86: lg-laptop: Fix LED resource handling (Armin Wolf)
- platform/x86: lg-laptop: Convert ACPI driver to a platform one (Rafael J. Wysocki)
- platform/x86: lg-laptop: Drop debug-only ACPI notify handler (Rafael J. Wysocki)
- platform/x86: dell-wmi-base: Fix resource leak on module load failure (Armin Wolf) [Orabug: 40043088] {CVE-2026-93130}
- platform/x86: dell-privacy: Fix race condition (Armin Wolf)
- ACPI: RISC-V: Fix riscv_acpi_add_prt_dep() loop handling (Lorenzo Pieralisi)
- ACPI: RISC-V: Check acpi_get_handle() status in riscv_acpi_add_prt_dep() (Lorenzo Pieralisi)
- ACPI: RISC-V: Fix riscv_acpi_irq_get_dep() loop termination (Lorenzo Pieralisi)
- panic/printk: replace other_cpu_in_panic() with panic_on_other_cpu() (Wang Jinchao)
- panic/printk: replace this_cpu_in_panic() with panic_on_this_cpu() (Wang Jinchao)
- panic: introduce helper functions for panic state (Wang Jinchao)
- printk/panic: Add option to allow non-panic CPUs to write to the ring buffer. (Donghyeok Choe)
- leds: pca9532: Fix inverted GPIO output polarity (Cosmo Chou)
- iommu/amd: Fix false positive in SB IOAPIC IVRS validation (Wei Wang)
- iommu/amd: Add support for Hygon family 18h model 4h IOAPIC (Fu Hao)
- iommu/amd: Prevent SB IOAPIC from overriding IVRS validation errors (Wei Wang)
- iommu/msm: Return -ENOMEM on memory allocation failure in probe (Vladimir Zapolskiy)
- iommu/mediatek-v1: Fix off-by-one in MT2701_LARB_NR_MAX (Akari Tsuyukusa)
- bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation (Yuho Choi)
- bpf: Fix use-after-free on mm_struct in bpf_find_vma() (Sanghyun Park) [Orabug: 40043111] {CVE-2026-93137}
- efi: fix stale reference to efi_recover_from_page_fault() (Breno Leitao)
- bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux (Daniel Borkmann) [Orabug: 40043114] {CVE-2026-93138}
- perf dso: Fix kallsyms DSO detection with fallback logic (Tanushree Shah)
- perf vendor events amd: Reintroduce deprecated Zen 5 core events (Sandipan Das)
- udf: Mark LVID buffer as uptodate before marking it dirty (Aleksandr Nogikh) [Orabug: 40043120] {CVE-2026-93140}
- usb: gadget: r8a66597: avoid double free of ep0_req in probe error path (Hongyan Xu)
- usb: typec: ucsi: unregister debugfs entries on teardown (Bjorn Andersson) [Orabug: 40079995] {CVE-2026-100079}
- thermal/drivers/rcar: Fix error checking in probe() (Dan Carpenter)
- perf data convert json: Fix trace_seq memory leak in process_sample_event() (Tanushree Shah)
- arm64: dts: qcom: sc8180x-lenovo-flex-5g: Describe the display power net (Konrad Dybcio)
- arm64: dts: qcom: sc8180x-lenovo-flex-5g: Rename regulator nodes (Konrad Dybcio)
- arm64: dts: qcom: sc8180x-primus: Describe the display power net (Konrad Dybcio)
- arm64: dts: qcom: sc8180x-primus: Rename regulator nodes (Konrad Dybcio)
- clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister() (Herman van Hazendonk) [Orabug: 40043146] {CVE-2026-93145}
- clk: qcom: gdsc: propagate gdsc_enable() failure for ALWAYS_ON domains (Herman van Hazendonk)
- clk: qcom: gdsc: propagate gdsc_check_status() errors from gdsc_poll_status (Herman van Hazendonk)
- timekeeping: Account for monotonicity adjustment in ntp_error (David Woodhouse)
- y2038: uapi: Use 64-bit __kernel_old_timespec::tv_nsec on x32 (Thomas Weißschuh)
- clocksource: Unregister subsystem on device registration failure (Yuho Choi)
- selftests: timers: leap-a-day: Fix -w option and update usage comment (Jiangshan Yi)
- irqchip/gic-v3-its: Fix its node leak in gic_acpi_parse_madt_its() (Kemeng Shi)
- irqchip/gic-v3-its: Fix memleak in its_probe_one() (Kemeng Shi)
- selftests/lsm: Fix memory leak in attr_lsm_count (Wang Yan)
- selftests/bpf: Fix memory leak in msg_alloc_iov (Feng Yang)
- selftests/bpf: Fix memory leak in msg_alloc_iov error path (Malaya Kumar Rout)
- ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer() (Evgenii Burenchev)
- staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() (Dawei Feng)
- staging: octeon: add missing napi_disable in cvm_oct_rx_shutdown (Ayush Mukkanwar)
- staging: octeon: replace pr_warn with dev_warn in fill and rx paths (Ayush Mukkanwar)
- staging: octeon: ethernet-mem: replace pr_warn with dev_warn in free functions (Ayush Mukkanwar)
- staging: octeon: fix free_irq dev_id mismatch in cvm_oct_rx_shutdown (Yuvraj Singh Chauhan)
- staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown (Ayush Mukkanwar)
- staging: fbtft: Use sysfs_emit_at() to print to sysfs file (Dan Carpenter)
- greybus: audio: bound the topology section sizes against the fetched size (Bryam Vargas)
- staging: sm750fb: Add missing Kconfig dependency (Rongrong)
- staging: sm750fb: gate dualview dataflow using g_dualview (Ahmet Sezgin Duran)
- staging: greybus: audio: correct sscanf() return value check (Alexander A. Klimov)
- wifi: mac80211_hwsim: avoid NULL skb in stop queue drain (Cen Zhang) [Orabug: 40043162] {CVE-2026-93149}
- bus: qcom-ebi2: Fix clock leak on probe failure (Ruoyu Wang)
- bus: qcom-ebi2: Simplify with scoped for each OF child loop (Krzysztof Kozlowski)
- arm64: dts: qcom: hamoa: Fix clocks for HSPHYs (Konrad Dybcio)
- arm64: dts: qcom: sm7225-fairphone-fp4: Fix address in fb node name (Luca Weiss)
- cgroup/cpuset: Make nr_deadline_tasks an atomic_t (Waiman Long) [Orabug: 40043171] {CVE-2026-93150}
- PM: sleep: Fix off-by-one in wakelocks number limit check (Tuhaowen)
- bus: ti-sysc: Fix /chosen node reference leak (Yuho Choi)
- nvmet-rdma: fix response resource leak on queue teardown (Shin'Ichiro Kawasaki) [Orabug: 40043174] {CVE-2026-93151}
- nvmet-rdma: factor out response resource cleanup (Shin'Ichiro Kawasaki)
- nvme-apple: Use acquire/release for queue enabled state (Gui-Dong Han)
- crypto: keembay - Fix AEAD unregister count in error path (Myeonghun Pak)
- crypto: rk3288 - fail ahash requests on HASH idle timeout (Pengpeng Hou)
- crypto: sa2ul - stop probe if context pool creation fails (Pengpeng Hou)
- crypto: atmel-sha204a - fix heap info leak on I2C transfer failure (Lothar Rubusch)
- crypto: atmel-ecc - reject hardware ECDH without a public key (Thorsten Blum)
- crypto: atmel-ecc - clean up and improve ECDH comments (Thorsten Blum)
- crypto: atmel-ecc - replace min_t with min (Thorsten Blum)
- crypto: qat - clear AES key schedule from stack (Giovanni Cabiddu) [Orabug: 40043210] {CVE-2026-93161}
- crypto: qat - cancel work on re-enable SR-IOV timeout (Giovanni Cabiddu) [Orabug: 40043215] {CVE-2026-93162}
- hwrng: core - fix rng list on registration error (Manos Pitsidianakis) [Orabug: 40043217] {CVE-2026-93163}
- perf vendor events amd: Update Zen 5 core events (Sandipan Das)
- perf/x86/amd/uncore: Add group validation (Sandipan Das)
- perf cs-etm: Fix thread leaks on trace queue init failure (Leo Yan)
- perf cs-etm: Queue context packets for frontend (James Clark)
- wifi: rtw89: fix HE extended capability length check (Pengpeng Hou) [Orabug: 40073017] {CVE-2026-93281}
- platform/chrome: sensorhub: Fix memory overread in ring handler (Tzung-Bi Shih) [Orabug: 40043223] {CVE-2026-93165}
- selftests/rseq: Replace glibc-specific __GNUC_PREREQ with portable check (Hisam Mehboob)
- csky: Fix a4/a5 restoration in syscall trace path (Hanlin Song)
- iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure (Sanjay Chitroda)
- soundwire: qcom: Fix port exhaustion check in stream_alloc_ports (Srinivas Kandagatla)
- dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe (Vladimir Zapolskiy)
- dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers (Suraj Gupta)
- dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure (Vladimir Zapolskiy)
- mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug (Gregory Price) [Orabug: 40043241] {CVE-2026-93172}
- mm: name the anonymous MMOP enum as enum mmop (Gregory Price)
- mm: change type of state in struct memory_block (Israel Batista)
- mm: convert memory block states (MEM_*) macros to enum (Israel Batista)
- mm: add build-time option for hotplug memory default online type (Gregory Price)
- bpf,lsm: Drop bpf_prog_free from sleepable_lsm_hooks (Sechang Lim) [Orabug: 40043245] {CVE-2026-93173}
- selftests/bpf: Mask socket type flags in mptcpify prog (Guillaume Maudoux)
- selftests/bpf: Systematically add SO_REUSEADDR in start_server_addr (Alexis Lothoré)
- bpf: Copy per-CPU map value padding in copy_map_value_long() (Leon Hwang) [Orabug: 40043250] {CVE-2026-93174}
- tools/bpf/bpftool: Reset vmlinux BTF after struct_ops commands (Chenyichong)
- tools/bpf/bpftool: Reset vmlinux BTF after map commands (Chenyichong)
- drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup (Asad Kamal) [Orabug: 40043260] {CVE-2026-93177}
- drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup (Asad Kamal) [Orabug: 40043266] {CVE-2026-93178}
- regulator: tps6594: Fix device node reference leaks in multiphase loop (Uday Khare)
- regulator: tps6594-regulator: refactor variant descriptions (Michael Walle)
- regulator: tps6594-regulator: remove hardcoded buck config (Michael Walle)
- regulator: tps6594-regulator: remove interrupt_count (Michael Walle)
- regulator: tps6594-regulator: Constify struct tps6594_regulator_irq_type (Christophe Jaillet)
- perf tests: Fix flakiness in branch stack sampling tests (Ian Rogers)
- perf test: Fixes for check branch stack sampling (Ian Rogers)
- perf test: Extend branch stack sampling test for Arm64 BRBE (James Clark)
- perf test: Add syscall and address tests to brstack test (James Clark)
- perf test: Refactor brstack test (James Clark)
- perf tests: Harden branch stack sampling test (Ian Rogers)
- perf test brstack: Speed up running test by using tr -s instead of xargs (James Clark)
- perf tests: Fix flakiness in BPF counters test on hybrid systems (Ian Rogers)
- perf test: Fix perf stat --bpf-counters on hybrid machines (Namhyung Kim)
- perf test: Use sqrtloop workload to test bperf event (Tengda Wu)
- perf tests: Skip metrics validation if system-wide recording lacks permission (Ian Rogers)
- perf test: Do not skip when some metrics tests succeeded (Namhyung Kim)
- perf test all metrics: Fully ignore Default metric failures (Ian Rogers)
- perf test metrics: Update all metrics for possibly failing default metrics (Ian Rogers)
- perf tests metrics: Permission related fixes (Ian Rogers)
- perf test stat_all_metrics: Ensure missing events fail test (Ian Rogers)
- perf test: Update all metrics test like metricgroups test (Namhyung Kim)
- media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define (Sean Young)
- media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define (Sean Young)
- riscv: kexec_file: Fix crashk_low_res not exclude bug (Jinjie Ruan)
- riscv: kexec_file: Split the loading of kernel and others (Song Shuai)
- pinctrl: bcm2835: Don't remove an unregistered GPIO chip (Daniel Mccarthy) [Orabug: 40072906] {CVE-2026-93274}
- perf/x86/intel/uncore: Keep PCI PMUs working when MMIO/MSR setup fails (Zide Chen)
- sched/fair: Fix overflow in update_tg_cfs_runnable() (Chen Yu) [Orabug: 40043282] {CVE-2026-93182}
- mm/mm_init: fix incorrect node_spanned_pages (Wei Yang)
- drm/lima: call drm_mm_init() with a valid allocation range (Henrik Grimler)
- clk: imx: scu: drop redundant init.ops variable assignment (Brian Masney)
- arm64: dts: imx93-kontron: set memory node to 0x80000000/1GiB (Frieder Schrempf)
- ARM: imx: fix device_node refcount leaks in imx7_src_init() (Weigang He)
- ARM: imx: fix device_node refcount leak in imx_src_init() (Weigang He)
- clk: hisilicon: reset: Use devm_kzalloc to initialize hisi_reset_controller (Min Zhang)
- ASoC: fsl_audmix: rework runtime PM handling in probe (Shengjiu Wang)
- ASoC: rt700-sdw: always drain jack work on remove (Runyu Xiao) [Orabug: 40043294] {CVE-2026-93185}
- clk: nuvoton: ma35d1: fix ma35d1_clk_pll_determine_rate logic (Joey Lu)
- clk: nuvoton: ma35d1-pll: convert from round_rate() to determine_rate() (Brian Masney)
- clk: nuvoton: ma35d1: fix PLL_CTL1_FRAC bit field width and fractional calc (Joey Lu)
- clk: nuvoton: ma35d1: fix ignored div_u64 return values in PLL freq calculation (Joey Lu)
- clk: moxart: remove unused variables, fix refcount leak (Alexander A. Klimov)
- clk: versaclock7: Fix APLL clock leak on probe failure (Myeonghun Pak)
- cxl/pci: Remove incorrect mbox.valid check in cxl_pci_type3_init_mailbox() (Wei Hou)
- cxl/mbox: Clamp mailbox output allocation to the payload size (Richard Cheng) [Orabug: 40043297] {CVE-2026-93186}
- media: cec-pin: Fix event FIFO ordering (Gui-Dong Han)
- soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap() (Weigang He)
- HID: roccat: bound device-supplied profile index (Michael Bommarito) [Orabug: 40043301] {CVE-2026-93188}
- HID: nintendo: Fix imu_timestamp_us double increment per report (Christos Maragkos)
- HID: core: quiesce input in hid_hw_stop() to prevent use-after-free (Philipp Weber) [Orabug: 40043305] {CVE-2026-93189}
- platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count (Maoyi Xie) [Orabug: 40043309] {CVE-2026-93190}
- x86/cfi: Use symmetric SYM_START and SYM_END in __CFI_TYPE() (Jens Remus)
- sched_ext/scx_flatcg: Fix cvtime_delta race and add hweight scaling to bypass charging (Wanwu Li)
- smack: restrict smackfs/{direct,mapped} values to 0-255 (Konstantin Andreev)
- smack: deduplicate smackfs/{direct,mapped} file_operations (Konstantin Andreev)
- smack: simplify write handlers of sysfs entries (Dmitry Antipov)
- smack: fix incorrect task context in smack_msg_queue_msgrcv (Konstantin Andreev)
- drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure (Maxime Ripard)
- drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format (Nicolas Frattaroli)
- drm/v3d: Clear queue->active_job when v3d_fence_create() fails (Maíra Canal)
- drm/v3d: Replace a global spinlock with a per-queue spinlock (Maíra Canal)
- drm: lcdif: Wait for vblank before disabling DMA (Paul Kocialkowski)
- drm: Remove unused header in drm_dumb_buffers.c (Yicong Hui)
- Smack: Fix error in capability bypass (Casey Schaufler)
- mm/damon/core: skip aging from repeated aggressive merging (Seongjae Park)
- batman-adv: fix TX priority extraction for BATADV_FORW_MCAST (Sven Eckelmann)
- clk: meson: align gxbb_32k_clk_sel number of parents with actual count (Martin Blumenstingl) [Orabug: 40033895] {CVE-2026-89947}
- perf sched: Fix register_pid() overflow, strcpy, and BUG_ON (Arnaldo Carvalho de Melo)
- batman-adv: bla: avoid CRC corruption due to parallel claim add (Sven Eckelmann) [Orabug: 40043346] {CVE-2026-93203}
- batman-adv: dat: atomically update mac addresses (Sven Eckelmann) [Orabug: 40043351] {CVE-2026-93204}
- ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE (Sean Shen)
- ksmbd: fix durable reconnect error path file lifetime (Junyi Liu)
- ksmbd: fix use-after-free in smb2_open during durable reconnect (Akif Sait)
- of: unittest: Fix memory leak in unittest_data_add() (Zilin Guan)
- mm/damon/tests/core-kunit: catch test failure in test_merge_regions_of() (Seongjae Park)
- mm/damon/core-kunit: handle region split failure in filter_out() (Seongjae Park)
- mm/damon/vaddr-kunit: check region count in three_regions test (Seongjae Park)
- mm/damon/paddr: drop last same folio access check reuse optimization (Seongjae Park)
- mm/damon/ops-common: use nr_accesses moving sum for quota score (Seongjae Park)
- mm/damon/vaddr: drop last same folio access check optimization (Seongjae Park)
- nvmet-auth: Synchronize timeout work during SQ teardown (Kazuki Hanai) [Orabug: 40033982] {CVE-2026-89970}
- net/mlx5e: xsk: Fix unlocked writing to ICOSQ (Dragos Tatulea) [Orabug: 39785088] {CVE-2026-64210}
- ksmbd: zero pipe read compound padding (Namjae Jeon)
- xhci: fix lost bounce buffers on TDs spanning several ring segments (Arthur Gautier) [Orabug: 40034133] {CVE-2026-90015}
- afs: Fix leak of ungot volume (David Howells) [Orabug: 39982279] {CVE-2026-80878}
- drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE (Zhenhao Wan) [Orabug: 40033166] {CVE-2026-89800}
- drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE (Zhenhao Wan) [Orabug: 40033173] {CVE-2026-89801}
- drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op (Zhenhao Wan) [Orabug: 40033176] {CVE-2026-89802}
- drm/nouveau: Use write-combined maps for coherent (Faith Ekstrand)
- drm/nouveau: unsubscribe the channel-kill event before the fence context (Marek Czernohous) [Orabug: 40033181] {CVE-2026-89803}
- drm/amdkfd: Reject zero-sized AQL queue allocations after size halving (Sunday Clement)
- drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore (Vladimir Marioukhine) [Orabug: 40033196] {CVE-2026-89807}
- drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT (Sunil Khatri)
- drm/amdgpu: Skip accessing psp rum time db for APUs (Kanala Ramalingeswara Reddy)
- drm/amdgpu: fix autosuspend cleanup during removal (Guangshuo Li)
- drm/amdgpu: check thunderbolt before switcheroo registration (Yang Wang)
- drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used (Thadeu Lima de Souza Cascardo) [Orabug: 40033273] {CVE-2026-89816}
- drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value (Kavan Smith)
- drm/gud: validate TV mode names before creating enum property (Tao Yu) [Orabug: 40072728] {CVE-2026-93234}
- drm/gud: NUL-terminate TV mode names read from the device (Deepanshu Kartikey) [Orabug: 40033281] {CVE-2026-89817}
- drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (David (Ming Qiang) Wu) [Orabug: 40034374] {CVE-2026-89818}
- drm/amd/display: validate plane degamma LUT size for private color prop (Harry Wentland) [Orabug: 40033287] {CVE-2026-89819}
- drm/amd/display: avoid divide-by-zero in __is_lut_linear() (Harry Wentland) [Orabug: 40033293] {CVE-2026-89821}
- drm/hibmc: Use drm_atomic_helper_check_plane_state() (Thomas Zimmermann)
- drm/hibmc: Fix list of formats on the primary plane (Thomas Zimmermann)
- drm/ssd130x: fix column and row end address in partial updates in ssd133x (Amit Barzilai)
- drm/sun4i: fix refcount leak in sun4i_backend_init_sat() (Xu Wang)
- drm/ssd130x: fix column and row end address in partial updates for ssd132x (Amit Barzilai)
- drm/i915: Guard against NULL driver_data in i915_pci_probe() (Deepanshu Kartikey) [Orabug: 40033301] {CVE-2026-89822}
- drm: fix race between partial drm_dev_register() failure and ioctl (Danilo Krummrich) [Orabug: 40033312] {CVE-2026-89823}
- drm/panel-edp: fix i2c adapter leak on probe failure (Johan Hovold) [Orabug: 40033325] {CVE-2026-89824}
- drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure (Johan Hovold)
- drm/panthor: fix firmware control interface bounds checks (Osama Abdelkader)
- f2fs: fix to zero post-EOF data when extending file size (Chao Yu)
- f2fs: fix valid block count leak on data block allocation failure (Chenchangcheng)
- f2fs: fix to off-by-one issue in f2fs_zero_post_eof_page() (Chao Yu)
- f2fs: fix to migrate all curseg types during free_segment_range (Daeho Jeong)
- f2fs: avoid NULL checkpoint thread access in sysfs (Wenjie Qi)
- f2fs: return writeback error from collapse range (Wenjie Qi)
- f2fs: use the mount idmap for the owner check in f2fs_xattr_advise_set() (Zhan Xusheng)
- f2fs: reject overlapping move range after len expansion (Hao-Qun Huang)
- f2fs: return symlink writeback errors (Wenjie Qi)
- scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started (Nilesh Javali) [Orabug: 40033428] {CVE-2026-89842}
- scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak (Nilesh Javali) [Orabug: 40033433] {CVE-2026-89843}
- scsi: qla2xxx: Use coherent DMA buffer for D_Port diagnostics (Nilesh Javali)
- scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition (Nilesh Javali) [Orabug: 40033442] {CVE-2026-89844}
- scsi: qla2xxx: Drop vport reference under lock in report ID acquisition (Nilesh Javali)
- scsi: qla2xxx: Fix NVMe abort reference leak on repeated abort (Nilesh Javali)
- scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() (Nilesh Javali) [Orabug: 40033449] {CVE-2026-89845}
- scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (Nilesh Javali) [Orabug: 40033454] {CVE-2026-89846}
- scsi: qla2xxx: Avoid double completion in async IOCB timeout (Nilesh Javali) [Orabug: 40033465] {CVE-2026-89847}
- scsi: qla2xxx: Quiesce response IRQ before freeing request queue (Nilesh Javali) [Orabug: 40033471] {CVE-2026-89848}
- scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb() (Nilesh Javali) [Orabug: 40072775] {CVE-2026-93242}
- scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path (Nilesh Javali) [Orabug: 40033477] {CVE-2026-89849}
- scsi: qla2xxx: Don't query firmware state while chip is down (Nilesh Javali) [Orabug: 40033482] {CVE-2026-89850}
- scsi: qla2xxx: Fix FCE trace enable parsing in debugfs (Nilesh Javali) [Orabug: 40033490] {CVE-2026-89851}
- scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() (Nilesh Javali) [Orabug: 40033496] {CVE-2026-89852}
- scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump (Nilesh Javali) [Orabug: 40033504] {CVE-2026-89853}
- scsi: qla2xxx: Fix cs84xx use-after-free on host teardown (Nilesh Javali) [Orabug: 40033510] {CVE-2026-89854}
- scsi: qla2xxx: Serialize flash version read in reset handler (Nilesh Javali) [Orabug: 40033519] {CVE-2026-89855}
- scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation (Nilesh Javali) [Orabug: 40033523] {CVE-2026-89856}
- scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject (Nilesh Javali) [Orabug: 40033529] {CVE-2026-89857}
- scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions() (Nilesh Javali) [Orabug: 40033532] {CVE-2026-89858}
- scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config() (Nilesh Javali)
- scsi: qla2xxx: Initialize NVMe abort_work once at submission (Nilesh Javali) [Orabug: 40033541] {CVE-2026-89860}
- scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() (Nilesh Javali) [Orabug: 40033546] {CVE-2026-89861}
- scsi: qla2xxx: Fix Name Server logout detection on FWI2 adapters (Nilesh Javali)
- scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check (Nilesh Javali) [Orabug: 40033553] {CVE-2026-89863}
- scsi: qla2xxx: Bound i2c->length in I2C bsg handlers (Nilesh Javali) [Orabug: 40033557] {CVE-2026-89864}
- scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers (Nilesh Javali) [Orabug: 40033561] {CVE-2026-89865}
- media: chips-media: wave5: Guard bit depth check with initial_info_obtained (Jackson Lee)
- media: zoran: Avoid freeing a registered video_device twice (Ruoyu Wang)
- media: vimc: fix pixel format lookup in enum_framesizes (Arash Golgol)
- media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure (Uday Khare)
- media: venus: fix payload size calculation in parse_raw_formats() (Mohammed El Kadiri)
- media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() (Mohammed El Kadiri)
- media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link (Biren Pandya) [Orabug: 40033583] {CVE-2026-89872}
- media: v4l2-ctrls: Allow unknown HDR10 white point and luminance (Ming Qian)
- media: v4l2-async: avoid deleting unlinked ASC entry on link error (Xu Rao) [Orabug: 40033590] {CVE-2026-89874}
- media: tda18250: fix possible integer overflow (Ilya Krutskih) [Orabug: 40033594] {CVE-2026-89876}
- media: saa7164: fix cleanup on resource allocation failure (Guangshuo Li) [Orabug: 40033603] {CVE-2026-89877}
- media: s2255: check firmware size before reading trailing marker (Huanglei) [Orabug: 40033609] {CVE-2026-89878}
- media: s2255: bound JPEG frame size before copying into the buffer (Hyeongjun An) [Orabug: 40033614] {CVE-2026-89879}
- media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure (Valery Borovsky) [Orabug: 40033619] {CVE-2026-89880}
- media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak (Valery Borovsky) [Orabug: 40033625] {CVE-2026-89881}
- media: rc: sunxi-cir: Unregister rc device on probe failure (Myeonghun Pak)
- media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks (Guoniu Zhou)
- media: nxp: imx8-isi: Correct color map between V4L2 and ISI (Guoniu Zhou)
- media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing (Guoniu Zhou)
- media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup (Johan Hovold)
- media: platform: mtk-mdp3: Fix SCP device refcounting (Guangshuo Li)
- media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common (Christian Hewitt)
- media: intel/ipu6: fix async notifier cleanup leak on parse error (Cong Nguyen) [Orabug: 40033642] {CVE-2026-89886}
- media: i2c: ov7740: fix use-after-destroy in remove (Biren Pandya)
- media: i2c: ov02a10: fix endpoint parsing use-after-free (Biren Pandya)
- media: i2c: imx415: Return test pattern write errors (Narasimharao Vadlamudi)
- media: i2c: alvium: Fix: Correct name of register in alvium_set_ctrl_auto_exposure (Martin Hecht)
- media: go7007: defer the ALSA v4l2 put until card release (Shuangpeng Bai) [Orabug: 40033655] {CVE-2026-89890}
- media: em28xx: fix use-after-free of dev_next->devlist on disconnect (Jiangong Han) [Orabug: 40033662] {CVE-2026-89891}
- media: em28xx: defer audio-only extension registration (Diego Fernando Mancera Gomez) [Orabug: 40033667] {CVE-2026-89892}
- media: cx23885: cancel NetUP CI work before teardown (Fan Wu) [Orabug: 40033672] {CVE-2026-89893}
- media: cx231xx: reject geometry changes while the VBI queue is busy (Bryam Vargas) [Orabug: 40033679] {CVE-2026-89894}
- media: cobalt: Avoid freeing ALSA private data twice (Ruoyu Wang)
- media: cedrus: fix memory leak in cedrus_init_ctrls() (Dawei Feng)
- media: cec: Serialize exclusive follower delivery (Ruoyu Wang) [Orabug: 40033696] {CVE-2026-89897}
- media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash (Yi Ding)
- media: cec: extron-da-hd-4k-plus: add sanity check (Hans Verkuil)
- media: cec: disable delayed work before freeing an interrupted transmit (Biren Pandya) [Orabug: 40033703] {CVE-2026-89899}
- media: amphion: Remove obsolete frame_count check in venc_start_session (Ming Qian)
- media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref (Valery Borovsky)
- LoongArch: Avoid preempt count underflow without probe (Jérémy Jean)
- LoongArch: Do not save/restore percpu base register in rethook trampoline (Guan Wentao)
- LoongArch: Do not select HAVE_RUST when KASAN is enabled (Nathan Chancellor)
- LoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY (Zeng Chi)
- LoongArch: KVM: Free init resources if kvm_init() fails (Chaithanya Lagisetty)
- LoongArch: KVM: Fix TOCTOU race on pv_features (Tao Cui)
- KVM: s390: Restore sigset on error path (Christian Borntraeger)
- KVM: s390: pv: Fix rc/rrc offset for PVM_DUMP (Christian Borntraeger)
- KVM: s390: Zero initialize irq in reinject_machine_check (Christian Borntraeger)
- KVM: s390: Take srcu when importing watchpoint data (Christian Borntraeger)
- KVM: s390: Free guest debug data on vcpu destroy (Christian Borntraeger)
- KVM: s390: Fix old_data leak in guest debug error path (Christian Borntraeger)
- KVM: s390: Fix memory leak in guest debug handling (Christian Borntraeger)
- KVM: s390: Fix length check __import_wp_info() (Christian Borntraeger)
- KVM: x86: Ensure runtime reads of disabled_quirks are resolved once (Sean Christopherson)
- KVM: x86: Serialize writes to disabled_quirks using kvm->lock (Sean Christopherson)
- KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock (Carlos López) [Orabug: 40033803] {CVE-2026-89927}
- KVM: x86/mmu: Fold kvm_mmu_zap_memslot() into kvm_arch_flush_shadow_memslot() (Sean Christopherson)
- KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU (Yosry Ahmed) [Orabug: 40033811] {CVE-2026-89929}
- KVM: nVMX: Service local TLB flushes on failed nested VM-Enter (Yosry Ahmed) [Orabug: 40033821] {CVE-2026-89930}
- KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit (Sean Christopherson) [Orabug: 40033827] {CVE-2026-89931}
- KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02 (Sean Christopherson)
- KVM: nVMX: Always flush vpid02 on first use (Yosry Ahmed) [Orabug: 40033829] {CVE-2026-89932}
- iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask (Nikhil Gautam)
- iio: light: opt4001: Reject integration times with a non-zero seconds part (Nikhil Gautam)
- iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem() (Nikhil Gautam)
- iio: light: opt4001: Fix power down clearing bits of the wrong register (Nikhil Gautam)
- iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() (Sanjay Chitroda)
- iio: srf04: fix pm_runtime handling on probe error path (Cong Nguyen)
- iio: pressure: mpl115: Fix runtime PM cleanup (Can Peng)
- iio: pressure: dps310: fix NULL pointer dereference on ACPI probe (Rupesh Majhi)
- iio: light: ltrf216a: fix runtime PM reference leak in error path (Vidhu Sarwal)
- iio: light: gp2ap002: Disable regulators on resume failure (Laxman Acharya Padhya)
- iio: light: cm32181: return zero after writing calibscale (Giorgi Tchankvetadze)
- iio: gyro: mpu3050: fix sign of raw angular velocity readings (Cong Nguyen)
- iio: dac: m62332: Fix regulator reference count imbalance (Erick Henrique)
- iio: chemical: sgp30: Handle IAQ thread creation failure (Linmao Li)
- iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF (Fan Wu)
- iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable (Moksh Panicker)
- iio: buffer: Tie IIO dma fence lock lifetime to the fence (Lars-Peter Clausen) [Orabug: 40033869] {CVE-2026-89940}
- iio: buffer: Make IIO DMA fence release RCU-safe (Lars-Peter Clausen) [Orabug: 40033873] {CVE-2026-89941}
- iio: buffer: Fix potential use-after-free in anonymous buffer release (Lars-Peter Clausen) [Orabug: 40033875] {CVE-2026-89942}
- iio: adc: pac1921: fix wrong channel used in trigger handler read (Cong Nguyen)
- iio: adc: max34408: add missing 'select REGMAP_I2C' to Kconfig (Joshua Crofts)
- ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get (Xu Wang)
- ASoC: loongson: Fix error handling in ACPI property parsing (Binbin Zhou)
- AsoC: intel: sst: fix PCI device reference leak on probe failure (Haoxiang Li)
- ASoC: hdac_hda: Fix hlink refcount leak on component registration failure (Haoxiang Li) [Orabug: 40033880] {CVE-2026-89944}
- ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure (Haoxiang Li)
- ASoC: cs35l34: drain threaded IRQ before runtime suspend (Runyu Xiao) [Orabug: 40033885] {CVE-2026-89945}
- ASoC: cs35l33: drain threaded IRQ before runtime suspend (Runyu Xiao)
- i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure (Linkai Gong)
- clk: qcom: gcc-mdm9607: Drop incorrect BIMC PLL and related clocks (Stephan Gerhold)
- clk: qcom: gcc-mdm9607: Fix halt_reg for gcc_apss_axi_clk (Stephan Gerhold)
- clk: qcom: gcc-mdm9607: Fix enable_reg for gcc_blsp1_sleep_clk (Stephan Gerhold)
- clk: qcom: gcc-mdm9607: Drop incorrect system_noc_bfdcd_clk_src (Stephan Gerhold)
- clk: qcom: gcc-mdm9607: Drop incorrect apss_tcu_clk_src (Stephan Gerhold)
- clk: rockchip: rk3588: Don't change PLL rates when setting dclk_vop2_src (Heiko Stuebner)
- clk: qcom: gcc-msm8939: Fix enable_reg for gcc_blsp1_sleep_clk (Stephan Gerhold)
- clk: qcom: gcc-msm8916: Fix enable_reg for gcc_blsp1_sleep_clk (Stephan Gerhold)
- batman-adv: bla: prevent CRC corruptions after claim flush (Sven Eckelmann)
- batman-adv: bla: fix freeing of claims on meshif deletion (Sven Eckelmann) [Orabug: 40033900] {CVE-2026-89948}
- batman-adv: dat: avoid unaligned fault in IP extraction (Sven Eckelmann)
- batman-adv: mcast: linearize skbuff for packet generation (Sven Eckelmann) [Orabug: 40033910] {CVE-2026-89950}
- batman-adv: mcast: ensure unshared skb for multicast packets (Sven Eckelmann)
- batman-adv: fix stale receive device on merged fragments (Zhiling Zou) [Orabug: 40033913] {CVE-2026-89951}
- mtd: rawnand: validate ONFI extended parameter page sections (Pengpeng Hou) [Orabug: 40033917] {CVE-2026-89952}
- mtd: mtdoops: free page bitmap when the backing MTD is removed (Xu Rao) [Orabug: 40033921] {CVE-2026-89953}
- mtd: afs: validate v2 image info bounds (Pengpeng Hou)
- s390/vfio-ap: Fix required lock not held during update of ap_matrix_mdev object (Tony Krowiak)
- s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap (Tony Krowiak)
- s390/vfio-ap: Fix NULL deref in status_show() during queue probe (Tony Krowiak)
- s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed (Tony Krowiak)
- s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL (Tony Krowiak)
- s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove (Tony Krowiak)
- s390/vfio-ap: Fix stale do_remove flag across iterations in vfio_ap_mdev_cfg_remove (Tony Krowiak)
- s390/vfio-ap: fix stale pqap_hook pointer on error in vfio_ap_mdev_set_kvm() (Tony Krowiak)
- powerpc/crash: stop watchdogs before booting kdump kernel (Sourabh Jain)
- powerpc/pseries: Move H_WATCHDOG definitions to a common header (Sourabh Jain)
- powerpc/pseries: Handle and log pseries-wdt registration failures (Sourabh Jain)
- powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population (Muchun Song)
- powerpc/kexec_file: Prevent kexec range truncation (Jinjie Ruan)
- powerpc/kexec_file: Fix null-ptr-def in extra size calculation (Jinjie Ruan)
- parisc: Fix alignment of asm statements in head.S (Helge Deller)
- parisc: eisa: Fix infinite loop when parsing invalid IRQ value (Pei Xiao)
- nvdimm/btt: reject an arena whose nfree is below the lane count (Bryam Vargas) [Orabug: 40033966] {CVE-2026-89965}
- mm/hugetlb: fix missing migratable flag on same-node hugetlb migration (Ma Wupeng)
- Revert "irqchip/mbigen: Fix mbigen node address layout" (Caina)
- nvmet-tcp: reject unsolicited H2CData PDUs (Shivam Kumar) [Orabug: 40033974] {CVE-2026-89968}
- nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU (Shivam Kumar) [Orabug: 40033978] {CVE-2026-89969}
- nvme-tcp: check the data direction of a C2HData PDU (Yehyeong Lee) [Orabug: 40033994] {CVE-2026-89973}
- nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails (Niklas Cassel) [Orabug: 40033999] {CVE-2026-89974}
- nvme-fabrics: fix DHCHAP secret leak on parse failure (Xu Rao) [Orabug: 40034002] {CVE-2026-89975}
- ALSA: pcm: Fix race between non-atomic ops and trigger-start (Takashi Iwai) [Orabug: 40034011] {CVE-2026-89979}
- ALSA: harmony: initialize locks before requesting IRQ (Runyu Xiao)
- ALSA: rawmidi: Return the error from snd_rawmidi_input_params() (Hyeongjun An)
- arm64: mm: Fix the lockless page-table walk in show_pte() (Karl Mehltretter) [Orabug: 40072757] {CVE-2026-93239}
- i2c: mux: Fix channel node leak on adapter add failure (Ahmad Byagowi) [Orabug: 40034021] {CVE-2026-89982}
- i2c: core: fix debugfs UAF on adapter removal (Vasileios Almpanis) [Orabug: 40034026] {CVE-2026-89983}
- perf trace: Refactor augmented_raw_syscalls using bpf_for (Viktor Malik)
- perf trace: Factor out BPF loop body (Viktor Malik)
- perf/x86/intel: Fix kernel address leakages in LBR stack (Dapeng Mi) [Orabug: 40034030] {CVE-2026-89984}
- rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers (Lad Prabhakar)
- rtc: rzn1: Fix weekday underflow when alarm crosses month boundary (Lad Prabhakar)
- memcg: make the v1 soft limit knob inert (Shakeel Butt) [Orabug: 40072764] {CVE-2026-93240}
- Input: aiptek - validate raw macro indices before updating state (Pengpeng Hou)
- mm/mempolicy: fix sleeping allocation in alloc_pages_bulk_weighted_interleave() (Eric Dumazet) [Orabug: 40034037] {CVE-2026-89986}
- kprobes: Protect kprobe_blacklist with RCU (Masami Hiramatsu) [Orabug: 40034043] {CVE-2026-89988}
- irqchip/stm32mp-exti: Fix the unit of the hwspinlock timeout (Junan)
- ima: Check for ERR_PTR from dentry_path() in validate_hash_algo() (Bradley Morgan) [Orabug: 40034047] {CVE-2026-89989}
- ata: ahci: work around lost interrupts on Marvell 88SE61xx (Hajo Noerenberg)
- ceph: lock mutex in ceph_mds_check_access() (Max Kellermann) [Orabug: 40034051] {CVE-2026-89990}
- block: flag zoned disks with GENHD_FL_NO_PART (Damien Le Moal)
- cpuidle: dt_idle_genpd: kfree() the original name allocation (Linkai Gong)
- dmaengine: dw-edma: Initialize IRQ data before requesting IRQs (Koichiro Den)
- dmaengine: dw-edma: Complete descriptors before pausing (Koichiro Den)
- dmaengine: dw-edma: Fix HDMA channel status register access (Koichiro Den)
- dmaengine: fsl-edma: tracing: no ptr dereference during log output (Martin Kaiser)
- dma-direct: return struct page from dma_direct_alloc_from_pool() (Aneesh Kumar K V) [Orabug: 40034065] {CVE-2026-89995}
- dm: fix resume-vs-remove race (Mikulas Patocka) [Orabug: 40034073] {CVE-2026-89997}
- dm: fix race when loading and unloading a table (Mikulas Patocka) [Orabug: 40034078] {CVE-2026-89998}
- HID: wacom: validate report length in wacom_intuos_pro2_bt_irq (Ibrahim Hashimov) [Orabug: 40034086] {CVE-2026-89999}
- HID: rmi: fix OOB access with undersized RMI reports (Wei Jie Law) [Orabug: 40034090] {CVE-2026-90000}
- HID: bpf: serialize device reference release in struct_ops destroy path (Sean Shen)
- ftrace: Synchronize the initialization of ftrace_ops (Steven Rostedt)
- futex: Prevent rcuwait use-after-free during requeue PI (Yao Kai) [Orabug: 40034103] {CVE-2026-90003}
- mm/damon/core-kunit: check region count before testing in split_at() (Seongjae Park)
- mm/damon/sysfs: kobject_del() target (normal), context and kdamond dirs (Seongjae Park)
- mm/damon/sysfs: kobject_del() region and target (error) dirs (Seongjae Park)
- mm/damon/sysfs-schemes: kobject_del() scheme region dirs (Seongjae Park)
- mm/damon/sysfs-schemes: kobject_del() scheme quota goal dirs (Seongjae Park)
- mm/damon/sysfs-schemes: kobject_del() scheme filter dirs (Seongjae Park)
- mm/damon/sysfs-schemes: kobject_del() scheme dirs (Seongjae Park)
- scsi: pm8001: Use rollback index when freeing MSI-X vectors (Runyu Xiao) [Orabug: 40034111] {CVE-2026-90007}
- scsi: target: iscsi: Reserve a terminator byte for the login payload (Sujal Tuladhar) [Orabug: 40034118] {CVE-2026-90011}
- spi: Fix DMA mapping ownership on partial map failure (Honghui Jiang) [Orabug: 40034123] {CVE-2026-90012}
- spi: bcmbca-hsspi: disable clocks on resume failure (Can Peng)
- spi: bcm63xx: disable clock on resume failure (Can Peng)
- spi: bcm63xx-hsspi: disable clocks on resume failure (Can Peng)
- ublk: clear VM_MAYWRITE on read-only ublk char device mmap (Kanishka De Silva) [Orabug: 40033117] {CVE-2026-89793}
- thermal/drivers/qoriq: Disable clock on resume failure (Can Peng)
- thermal/drivers/imx: Disable clock on runtime resume failure (Can Peng)
- staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() (Muhammad Bilal)
- staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() (Muhammad Bilal)
- usb: gadget: fix null pointer dereference in usb_put_function_instance() (Jeffin Philip)
- USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() (Lovekesh Solanki)
- usb: gadget: f_midi: initialize work in f_midi_alloc() (Jeffin Philip)
- usb: gadget: f_midi2: fix use-after-free in string attribute show path (Ivy Lopez)
- usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs (Aleksandr Nogikh)
- usb: typec: ucsi: displayport: Fix OOB altmode array index (Jameson Thies) [Orabug: 40034208] {CVE-2026-90025}
- usb: typec: qcom-pmic: cancel reset_work on stop (Fan Wu)
- usb: typec: qcom-pmic-typec: drain cc_debounce_dwork if port_start() fails (Fan Wu)
- usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop (Fan Wu)
- usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns() (Andy Shevchenko)
- usb-storage: ene_ub6250: fix race between scan work and probe (Liu Qi) [Orabug: 40034248] {CVE-2026-90031}
- media: usbtv: keep device alive while ALSA card exists (Shuangpeng Bai) [Orabug: 40034258] {CVE-2026-90032}
- clk: qcom: gcc-mdm9607: Increase delay for USB PHY reset (Stephan Gerhold)
- ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() (Hyeongjun An) [Orabug: 40034265] {CVE-2026-90033}
- usb: image: mdc800: change kmalloc() to kzalloc() (Griffin Kroah-Hartman) [Orabug: 40034274] {CVE-2026-90034}
- drm/amd/display: fix division by zero in get_estimated_bw() (Hari Mishal) [Orabug: 40034282] {CVE-2026-90035}
- fsnotify: inotify: pass mark connector to fsnotify_recalc_mask() (Sun Jian)
- objtool/rust: add one more `noreturn` Rust function (Fujita Tomonori)
- entry: Fix seccomp bypass after ptrace with TSYNC (Jinjie Ruan) [Orabug: 40021398] {CVE-2026-89603}
- fsnotify: Fix stale object mask after concurrent mark updates (Youngjae Kwon) [Orabug: 40021347] {CVE-2026-89595}
- hugetlb: only adjust reservation during unmapping if mapcount is 0 (Guillaume Morin) [Orabug: 40021338] {CVE-2026-89593}
- wifi: mt76: mt7996: validate default EEPROM firmware size (Laxman Acharya Padhya)
- mm/page_vma_mapped: use huge_ptep_get() for hugetlb (Dev Jain)
- netfs: Fix netfs_read_folio() to wait on writeback (David Howells) [Orabug: 39754667] {CVE-2026-64058}
- landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation (Günther Noack) [Orabug: 40021202] {CVE-2026-89560}
- openvswitch: Fix CT limit teardown use-after-free (Yuqi Xu) [Orabug: 40020918] {CVE-2026-89488}
- net: openvswitch: fix kernel-doc warnings in internal headers (Ilya Maximets)
- net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy() (Norbert Szetei) [Orabug: 40034342] {CVE-2026-90049}
-
Thu Sep 17 2026 Sherry Yang <sherry.yang@oracle.com> [6.12.0-207.109.4.el10uek]
- workqueue: forbid TEST_WORKQUEUE from being built-in (Breno Leitao) [Orabug: 39955160]
- workqueue: avoid unguarded 64-bit division (Arnd Bergmann) [Orabug: 39955160]
- workqueue: add test_workqueue benchmark module (Breno Leitao) [Orabug: 39955160]
- workqueue: validate cpumask_first() result in llc_populate_cpu_shard_id() (Breno Leitao) [Orabug: 39955160]
- docs: workqueue: document WQ_AFFN_CACHE_SHARD affinity scope (Breno Leitao) [Orabug: 39955160]
- tools/workqueue: add CACHE_SHARD support to wq_dump.py (Breno Leitao) [Orabug: 39955160]
- workqueue: set WQ_AFFN_CACHE_SHARD as the default affinity scope (Breno Leitao) [Orabug: 39955160]
- workqueue: add WQ_AFFN_CACHE_SHARD affinity scope (Breno Leitao) [Orabug: 39955160]
- workqueue: fix typo in WQ_AFFN_SMT comment (Breno Leitao) [Orabug: 39955160]
- workqueue: fix parse_affn_scope() prefix matching bug (Breno Leitao) [Orabug: 39955160]
- firmware: arm_ffa: Honor partition info descriptor size (Jamie Nguyen) [Orabug: 39955160]
- firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies (Sudeep Holla) [Orabug: 39786528,39955160] {CVE-2026-64520}
- firmware: arm_ffa: Fix big-endian support in __ffa_partition_info_regs_get() (Sudeep Holla) [Orabug: 39955160]
- firmware: arm_ffa: Replace UUID buffer to standard UUID format (Sudeep Holla) [Orabug: 39955160]
- SUNRPC: Fix a hang in TLS sock_close if sk_write_pending (Benjamin Coddington) [Orabug: 39812836]
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Eric Dumazet) [Orabug: 39331623] {CVE-2026-43198}
- net: ntb_netdev: Fix TX busy and drop handling (Koichiro Den)
- net: stmmac: selftests: Pass the IP proto mask in the TC selftest (Maxime Chevallier)
- Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan (Pauli Virtanen) [Orabug: 40043383] {CVE-2026-90091}
- erofs: Fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS default logic (Geert Uytterhoeven)
- ALSA: seq: midi: Optimize event_input locking with RCU (Takashi Iwai)
- ALSA: seq: Don't leak the extension cell pointer in the bounce payload (Hyeongjun An) [Orabug: 40043399] {CVE-2026-90220}
- f2fs: fix i_size when pinned fallocate partially fails (Zhan Xusheng)
- media: cec: core: Fix kmemleak due to missed rc_free_device() call (Jonas Karlman) [Orabug: 40034383] {CVE-2026-89900}
- LoongArch: Fix acpi_package_ids[] array overflow (Bibo Mao)
- pddf: psu: expose PSU firmware version via sysfs (Chinmoy Dey) [Orabug: 39976175]
- RDMA/nldev: Fix locking when accessing mr->pd (Jason Gunthorpe) [Orabug: 39886477,40028950] {CVE-2026-74334}
- RDMA/restrack: Fix typos in the comments (Kalesh Ap) [Orabug: 39886477] {CVE-2026-74334}
- tcp: clear sock_ops cb flags before force-closing a child socket (Sechang Lim) [Orabug: 39886287] {CVE-2026-74268}
- xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() (Jason Xing) [Orabug: 39637697,40028941] {CVE-2026-53250}
- printk: add kthread for long-running print (Stephen Brennan) [Orabug: 37351898]
- net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Gal Pressman) [Orabug: 39203185]
- net/mlx5e: Fix misidentification of ASO CQE during poll loop (Gal Pressman) [Orabug: 39203185]
- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Zeng Chi) [Orabug: 39203185]
- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Patrisious Haddad) [Orabug: 39203185]
- net/mlx5: make enable_mpesw idempotent (Moshe Shemesh) [Orabug: 39203185]
- net/mlx5e: Don't include PSP in the hard MTU calculations (Cosmin Ratiu) [Orabug: 39203185]
- net/mlx5e: Trim the length of the num_doorbell error (Cosmin Ratiu) [Orabug: 39203185]
- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Carolina Jubran) [Orabug: 39203185]
- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Dragos Tatulea) [Orabug: 39203185]
- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Dragos Tatulea) [Orabug: 39203185]
- net/mlx5e: kTLS, Cancel RX async resync request in error flows (Shahar Shitrit) [Orabug: 39203185]
- net/mlx5: Don't zero user_count when destroying FDB tables (Cosmin Ratiu) [Orabug: 39203185]
- net/mlx5e: Skip PPHCR register query if not supported by the device (Alexei Lazar) [Orabug: 39203185]
- net/mlx5: Add PPHCR to PCAM supported registers mask (Alexei Lazar) [Orabug: 39203185]
- net/mlx5e: psp, avoid 'accel' NULL pointer dereference (Cosmin Ratiu) [Orabug: 39203185]
- platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [Orabug: 39203185]
- net/mlx5: fix pre-2.40 binutils assembler error (Arnd Bergmann) [Orabug: 39203185]
- net/mlx5e: Do not fail PSP init on missing caps (Cosmin Ratiu) [Orabug: 39203185]
- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Carolina Jubran) [Orabug: 39203185]
- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Carolina Jubran) [Orabug: 39203185]
- vdpa: introduce map ops (Jason Wang) [Orabug: 39203185]
- vdpa: support virtio_map (Jason Wang) [Orabug: 39203185]
- virtio: introduce map ops in virtio core (Jason Wang) [Orabug: 39203185]
- virtio_ring: rename dma_handle to map_handle (Jason Wang) [Orabug: 39203185]
- virtio: introduce virtio_map container union (Jason Wang) [Orabug: 39203185]
- virtio: rename dma helpers (Jason Wang) [Orabug: 39203185]
- virtio_ring: switch to use dma_{map|unmap}_page() (Jason Wang) [Orabug: 39203185]
- virtio_ring: constify virtqueue pointer for DMA helpers (Jason Wang) [Orabug: 39203185]
- net/mlx5e: Use extack in set rxfh callback (Gal Pressman) [Orabug: 39203185]
- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Carolina Jubran) [Orabug: 39203185]
- net/mlx5e: Introduce mlx5e_rss_init_params (Carolina Jubran) [Orabug: 39203185]
- net/mlx5e: Remove unused mdev param from RSS indir init (Carolina Jubran) [Orabug: 39203185]
- net/mlx5: Improve QoS error messages with actual depth values (Carolina Jubran) [Orabug: 39203185]
- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Jianbo Liu) [Orabug: 39203185]
- net/mlx5: HWS, Generalize complex matchers (Vlad Dogaru) [Orabug: 39203185]
- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Patrisious Haddad) [Orabug: 39203185]
- net/mlx5: IFC add balance ID and LAG per MP group bits (Mark Bloch) [Orabug: 39203185]
- net/mlx5: Add IFC bit for TIR/SQ order capability (Tariq Toukan) [Orabug: 39203185]
- net/mlx5: Expose uar access and odp page fault counters (Akiva Goldberger) [Orabug: 39203185]
- selftests: forwarding: lib: Add an autodefer variant of simple_if_init() (Petr Machata) [Orabug: 39203185]
- selftests: forwarding: lib: Add an autodefer variant of vrf_prepare() (Petr Machata) [Orabug: 39203185]
- selftests: net: lib: Rename bridge_vlan_add() to adf_* (Petr Machata) [Orabug: 39203185]
- selftests: net: lib: Rename ip_route_add() to adf_* (Petr Machata) [Orabug: 39203185]
- selftests: net: lib: Rename ip_addr_add() to adf_* (Petr Machata) [Orabug: 39203185]
- selftests: net: lib: Rename ip_link_set_up() to adf_* (Petr Machata) [Orabug: 39203185]
- selftests: net: lib: Rename ip_link_set_addr() to adf_* (Petr Machata) [Orabug: 39203185]
- selftests: net: lib: Rename ip_link_set_master() to adf_* (Petr Machata) [Orabug: 39203185]
- selftests: net: lib: Rename ip_link_add() to adf_* (Petr Machata) [Orabug: 39203185]
- net/mlx5e: Report RS-FEC histogram statistics via ethtool (Carolina Jubran) [Orabug: 39203185]
- net/mlx5e: Add logic to read RS-FEC histogram bin ranges from PPHCR (Carolina Jubran) [Orabug: 39203185]
- ethtool: add FEC bins histogram report (Vadim Fedorenko) [Orabug: 39203185]
- net/mlx5: Use %pe format specifier for error pointers (Gal Pressman) [Orabug: 39203185]
- net: gso: restore ids of outer ip headers correctly (Richard Gobert) [Orabug: 39203185]
- net: gro: only merge packets with incrementing or fixed outer ids (Richard Gobert) [Orabug: 39203185]
- net: gro: remove is_ipv6 from napi_gro_cb (Richard Gobert) [Orabug: 39203185]
- selftests: bridge_fdb_local_vlan_0: Test FDB vs. NET_ADDR_SET behavior (Petr Machata) [Orabug: 39203185]
- net: replace use of system_unbound_wq with system_dfl_wq (Marco Crivellari) [Orabug: 39203185]
- pds_fwctl: Replace kzalloc + copy_from_user with memdup_user in pdsfc_fw_rpc (Thorsten Blum) [Orabug: 39203185]
- RDMA: Use %pe format specifier for error pointers (Leon Romanovsky) [Orabug: 39203185]
- net/mlx5: Remove dead code from total_vfs setter (Vlad Dumitrescu) [Orabug: 39203185]
- net/mlx5e: Add flow rules for the decrypted ESP packets (Jianbo Liu) [Orabug: 39203185]
- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Jianbo Liu) [Orabug: 39203185]
- net/mlx5e: Recirculate decrypted packets into TTC table (Jianbo Liu) [Orabug: 39203185]
- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Jianbo Liu) [Orabug: 39203185]
- net/mlx5e: Implement PSP key_rotate operation (Raed Salem) [Orabug: 39203185]
- net/mlx5e: Add Rx data path offload (Raed Salem) [Orabug: 39203185]
- net/mlx5e: Configure PSP Rx flow steering rules (Raed Salem) [Orabug: 39203185]
- net/mlx5e: Add PSP steering in local NIC RX (Raed Salem) [Orabug: 39203185]
- net/mlx5e: Implement PSP Tx data path (Raed Salem) [Orabug: 39203185]
- psp: provide encapsulation helper for drivers (Raed Salem) [Orabug: 39203185]
- net/mlx5e: Implement PSP operations .assoc_add and .assoc_del (Raed Salem) [Orabug: 39203185]
- net/mlx5e: Support PSP offload functionality (Raed Salem) [Orabug: 39203185]
- psp: add op for rotation of device key (Jakub Kicinski) [Orabug: 39203185]
- net: modify core data structures for PSP datapath support (Jakub Kicinski) [Orabug: 39203185]
- psp: base PSP device support (Jakub Kicinski) [Orabug: 39203185]
- net/mlx5: Add uar access and odp page fault counters (Akiva Goldberger) [Orabug: 39203185]
- net/mlx5e: Use the 'num_doorbells' devlink param (Cosmin Ratiu) [Orabug: 39203185]
- devlink: Add a 'num_doorbells' driverinit param (Cosmin Ratiu) [Orabug: 39203185]
- net/mlx5e: Use multiple CQ doorbells (Cosmin Ratiu) [Orabug: 39203185]
- net/mlx5e: Use multiple TX doorbells (Cosmin Ratiu) [Orabug: 39203185]
- net/mlx5e: Prepare for using multiple TX doorbells (Cosmin Ratiu) [Orabug: 39203185]
- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Cosmin Ratiu) [Orabug: 39203185]
- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Cosmin Ratiu) [Orabug: 39203185]
- fwctl/mlx5: Add Adjacent function query commands and their scope (Saeed Mahameed) [Orabug: 39203185]
- fwctl/mlx5: Allow MODIFY_CONG_STATUS command (Avihai Horon) [Orabug: 39203185]
- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Carolina Jubran) [Orabug: 39203185]
- net/mlx5: Refactor MACsec WQE metadata shifts (Carolina Jubran) [Orabug: 39203185]
- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Carolina Jubran) [Orabug: 39203185]
- net/mlx5: Lag, add net namespace support (Shay Drory) [Orabug: 39203185]
- mlxsw: spectrum_cnt: use bitmap_empty() in mlxsw_sp_counter_pool_fini() (Yury Norov) [Orabug: 39203185]
- net/mlx5: fix typo in pci_irq.c comment (Alok Tiwari) [Orabug: 39203185]
- selftests: forwarding: Add test for BR_BOOLOPT_FDB_LOCAL_VLAN_0 (Petr Machata) [Orabug: 39203185]
- selftests: net: lib.sh: Don't defer failed commands (Petr Machata) [Orabug: 39203185]
- kmsan: convert kmsan_handle_dma to use physical addresses (Leon Romanovsky) [Orabug: 39203185]
- iommu/dma: rename iommu_dma_*map_page to iommu_dma_*map_phys (Leon Romanovsky) [Orabug: 39203185]
- dma-mapping: rename trace_dma_*map_page to trace_dma_*map_phys (Leon Romanovsky) [Orabug: 39203185]
- dma-debug: refactor to use physical addresses for page mapping (Leon Romanovsky) [Orabug: 39203185]
- dma-mapping: introduce new DMA attribute to indicate MMIO memory (Leon Romanovsky) [Orabug: 39203185]
- net: xdp: pass full flags to xdp_update_skb_shared_info() (Jakub Kicinski) [Orabug: 39203185]
- RDMA/bnxt_re: Update sysfs entries with appropriate data (Anantha Prabhu) [Orabug: 39203185]
- RDMA/bnxt_re: Call strscpy() with correct size argument (Thorsten Blum) [Orabug: 39203185]
- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Edward Srouji) [Orabug: 39203185]
- RDMA/bnxt_re: Remove unnecessary condition checks (Kalesh Ap) [Orabug: 39203185]
- RDMA/bnxt_re: Use firmware provided message timeout value (Saravanan Vajravel) [Orabug: 39203185]
- RDMA/bnxt_re: Initialize fw with roce_mirror support (Saravanan Vajravel) [Orabug: 39203185]
- RDMA/bnxt_re: Add support for flow create/destroy (Saravanan Vajravel) [Orabug: 39203185]
- RDMA/bnxt_re: Add support for mirror vnic (Saravanan Vajravel) [Orabug: 39203185]
- RDMA/bnxt_re: Add support for unique GID (Saravanan Vajravel) [Orabug: 39203185]
- RDMA/bnxt_re: Refactor stats context memory allocation (Kalesh Ap) [Orabug: 39203185]
- RDMA/bnxt_re: Refactor hw context memory allocation (Kalesh Ap) [Orabug: 39203185]
- RDMA/bnxt_re: Add data structures for RoCE mirror support (Saravanan Vajravel) [Orabug: 39203185]
- RDMA/bnxt_re: Enhance a log message when bnxt_re_register_netdev fails (Kalesh Ap) [Orabug: 39203185]
- net/mlx5e: Add stale counter for PCIe congestion events (Dragos Tatulea) [Orabug: 39203185]
- net/mlx5e: Make PCIe congestion event thresholds configurable (Dragos Tatulea) [Orabug: 39203185]
- net/mlx5: Implement devlink total_vfs parameter (Vlad Dumitrescu) [Orabug: 39203185]
- net/mlx5: Implement devlink enable_sriov parameter (Vlad Dumitrescu) [Orabug: 39203185]
- net/mlx5: Implement cqe_compress_type via devlink params (Saeed Mahameed) [Orabug: 39203185]
- devlink: Add 'total_vfs' generic device param (Vlad Dumitrescu) [Orabug: 39203185]
- selftests: bonding: add test for LACP actor port priority (Hangbin Liu) [Orabug: 39203185]
- net/mlx5: Add RS FEC histogram infrastructure (Carolina Jubran) [Orabug: 39203185]
- net/mlx5: Support getcyclesx and getcrosscycles (Carolina Jubran) [Orabug: 39203185]
- net/mlx5: Extract MTCTR register read logic into helper function (Carolina Jubran) [Orabug: 39203185]
- RDMA/bnxt_re: Report udp source port for flow_label in bnxt_re_query_qp (Abhishek Mohapatra) [Orabug: 39203185]
- RDMA/bnxt_re: Optimize bnxt_qplib_get_dev_attr function (Damodharam Ammepalli) [Orabug: 39203185]
- RDMA/bnxt_re: Show srq_limit in fill_res_srq_entry hook (Kashyap Desai) [Orabug: 39203185]
- net: add helper to pre-check if PP for an Rx queue will be unreadable (Jakub Kicinski) [Orabug: 39203185]
- net/mlx5: Add PSP capabilities structures and bits (Saeed Mahameed) [Orabug: 39203185]
- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Saeed Mahameed) [Orabug: 39203185]
- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Adithya Jayachandran) [Orabug: 39203185]
- net/mlx5: E-Switch, Register representors for adjacent vports (Saeed Mahameed) [Orabug: 39203185]
- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Saeed Mahameed) [Orabug: 39203185]
- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Adithya Jayachandran) [Orabug: 39203185]
- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Saeed Mahameed) [Orabug: 39203185]
- net/mlx5: FS, Convert vport acls root namespaces to xarray (Saeed Mahameed) [Orabug: 39203185]
- eth: mlx5: remove Kconfig co-dependency with VXLAN (Jakub Kicinski) [Orabug: 39203185]
- net/mlx5e: add op for getting netdev DMA device (Dragos Tatulea) [Orabug: 39203185]
- queue_api: add support for fetching per queue DMA dev (Dragos Tatulea) [Orabug: 39203185]
- eth: fbnic: Read PHY stats via the ethtool API (Mohsin Bashir) [Orabug: 39203185]
- eth: fbnic: Move hw_stats_lock out of fbnic_dev (Mohsin Bashir) [Orabug: 39203185]
- tcp: Don't pass hashinfo to socket lookup helpers. (Kuniyuki Iwashima) [Orabug: 39203185]
- uek-rpm: Remove DCCP from onos modules list (Alexandre Chartre) [Orabug: 39203185]
- net: Retire DCCP socket. (Kuniyuki Iwashima) [Orabug: 39203185]
- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Yishai Hadas) [Orabug: 39203185]
- pds_fwctl: Remove the use of dev_err_probe() (Liao Yuanhong) [Orabug: 39203185]
- mmc: sdhci-of-dwcmshc: use modern PM macros (Jisheng Zhang) [Orabug: 39203185]
- selftests: bonding: add test for passive LACP mode (Hangbin Liu) [Orabug: 39203185]
- eth: fbnic: Report XDP stats via ethtool (Mohsin Bashir) [Orabug: 39203185]
- eth: fbnic: Collect packet statistics for XDP (Mohsin Bashir) [Orabug: 39203185]
- eth: fbnic: Add support for XDP_TX action (Mohsin Bashir) [Orabug: 39203185]
- eth: fbnic: Add support for XDP queues (Mohsin Bashir) [Orabug: 39203185]
- eth: fbnic: Add XDP pass, drop, abort support (Mohsin Bashir) [Orabug: 39203185]
- eth: fbnic: Prefetch packet headers on Rx (Mohsin Bashir) [Orabug: 39203185]
- eth: fbnic: Use shinfo to track frags state on Rx (Mohsin Bashir) [Orabug: 39203185]
- eth: fbnic: Add support for HDS configuration (Mohsin Bashir) [Orabug: 39203185]
- fwctl/mlx5: Fix memory alloc/free in mlx5ctl_fw_rpc() (Akhilesh Patil) [Orabug: 39203185]
- net/mlx5: Support disabling host PFs (Daniel Jurgens) [Orabug: 39203185]
- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Saeed Mahameed) [Orabug: 39203185]
- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Saeed Mahameed) [Orabug: 39203185]
- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Saeed Mahameed) [Orabug: 39203185]
- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Saeed Mahameed) [Orabug: 39203185]
- eth: fbnic: support RSS on IPv6 Flow Label (Jakub Kicinski) [Orabug: 39203185]
- net/mlx5: Don't use %pK through tracepoints (Thomas Weißschuh) [Orabug: 39203185]
- selftests: forwarding: Add a test for FDB activity notification control (Ido Schimmel) [Orabug: 39203185]
- eth: fbnic: Lock the tx_dropped update (Mohsin Bashir) [Orabug: 39203185]
- eth: fbnic: Fix tx_dropped reporting (Mohsin Bashir) [Orabug: 39203185]
- eth: fbnic: unlink NAPIs from queues on error to open (Jakub Kicinski) [Orabug: 39203185]
- virtio-vdpa: Remove virtqueue list (Viresh Kumar) [Orabug: 39203185]
- virtio: document ENOSPC (Michael S. Tsirkin) [Orabug: 39203185]
- net: Fix typos (Bjorn Helgaas) [Orabug: 39203185]
- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Yishai Hadas) [Orabug: 39203185]
- IB: Extend UVERBS_METHOD_REG_MR to get DMAH (Yishai Hadas) [Orabug: 39203185]
- RDMA/efa: Add CQ with external memory support (Michael Margolin) [Orabug: 39203185]
- RDMA/core: Add umem "is_contiguous" and "start_dma_addr" helpers (Michael Margolin) [Orabug: 39203185]
- selftests: net: add netdev-l2addr.sh for testing L2 address functionality (Toke Høiland-Jørgensen) [Orabug: 39203185]
- devlink: Add new "clock_id" generic device param (Ivan Vecera) [Orabug: 39203185]
- devlink: Add support for u64 parameters (Ivan Vecera) [Orabug: 39203185]
- eth: fbnic: Create ring buffer for firmware logs (Lee Trager) [Orabug: 39203185]
- virtio: introduce extended features (Paolo Abeni) [Orabug: 39203185]
- RDMA/bnxt_re: Support 2G message size (Selvin Xavier) [Orabug: 39203185]
- RDMA/counter: Check CAP_NET_RAW check in user namespace for RDMA counters (Parav Pandit) [Orabug: 39203185]
- RDMA/nldev: Check CAP_NET_RAW in user namespace for QP modify (Parav Pandit) [Orabug: 39203185]
- RDMA/uverbs: Check CAP_NET_RAW in user namespace for RAW QP create (Parav Pandit) [Orabug: 39203185]
- lib/group_cpus: Let group_cpu_evenly() return the number of initialized masks (Daniel Wagner) [Orabug: 39203185]
- RDMA/uverbs: Check CAP_NET_RAW in user namespace for RAW QP create (Parav Pandit) [Orabug: 39203185]
- RDMA/uverbs: Check CAP_NET_RAW in user namespace for QP create (Parav Pandit) [Orabug: 39203185]
- eth: fbnic: realign whitespace (Jakub Kicinski) [Orabug: 39203185]
- fbnic: Add support for setting/getting pause configuration (Alexander Duyck) [Orabug: 39203185]
- fbnic: Add support for reporting link config (Alexander Duyck) [Orabug: 39203185]
- fbnic: Set correct supported modes and speeds based on FW setting (Alexander Duyck) [Orabug: 39203185]
- fbnic: Replace link_mode with AUI (Alexander Duyck) [Orabug: 39203185]
- fbnic: Retire "AUTO" flags and cleanup handling of FW link settings (Alexander Duyck) [Orabug: 39203185]
- devlink: Add new "enable_phc" generic device param (David Arinzon) [Orabug: 39203185]
- selftests: net: lib: Add ip_link_has_flag() (Petr Machata) [Orabug: 39203185]
- eth: fbnic: migrate to new RXFH callbacks (Jakub Kicinski) [Orabug: 39203185]
- eth: fbnic: Expand coverage of mac stats (Mohsin Bashir) [Orabug: 39203185]
- selftests: net: move wait_local_port_listen to lib.sh (Hangbin Liu) [Orabug: 39203185]
- tools: ynl: enable codegen for TC (Jakub Kicinski) [Orabug: 39203185]
- tools: ynl-gen: add makefile deps for neigh (Jakub Kicinski) [Orabug: 39203185]
- eth: fbnic: Replace kzalloc/fbnic_fw_init_cmpl with fbnic_fw_alloc_cmpl (Lee Trager) [Orabug: 39203185]
- tools: ynl: enable codegen for all rt- families (Jakub Kicinski) [Orabug: 39203185]
- xdp: Use nested-BH locking for system_page_pool (Sebastian Andrzej Siewior) [Orabug: 39203185]
- eth: fbnic: Add devlink dev flash support (Lee Trager) [Orabug: 39203185]
- eth: fbnic: Add mailbox support for PLDM updates (Lee Trager) [Orabug: 39203185]
- eth: fbnic: Add support for multiple concurrent completion messages (Lee Trager) [Orabug: 39203185]
- eth: fbnic: Accept minimum anti-rollback version from firmware (Lee Trager) [Orabug: 39203185]
- selftests: net: disable rp_filter after namespace initialization (Hangbin Liu) [Orabug: 39203185]
- fbnic: Cleanup handling of completions (Alexander Duyck) [Orabug: 39203185]
- fbnic: Add additional handling of IRQs (Alexander Duyck) [Orabug: 39203185]
- devlink: avoid param type value translations (Jiri Pirko) [Orabug: 39203185]
- eth: fbnic: fix `tx_dropped` counting (Mohsin Bashir) [Orabug: 39203185]
- xsk: convert xdp_copy_frags_from_zc() to use page_pool_dev_alloc() (Bui Quang Minh) [Orabug: 39203185]
- xsk: respect the offsets when copying frags (Bui Quang Minh) [Orabug: 39203185]
- selftests/net: test tcp connection load balancing (Willem de Bruijn) [Orabug: 39203185]
- tools: ynl: fix the header guard name for OVPN (Jakub Kicinski) [Orabug: 39203185]
- tools: ynl: add missing header deps (Jakub Kicinski) [Orabug: 39203185]
- eth: bnxt: add support rx side device memory TCP (Taehee Yoo) [Orabug: 39203185]
- eth: fbnic: add support for TTI HW stats (Mohsin Bashir) [Orabug: 39203185]
- eth: fbnic: add support for TMI stats (Mohsin Bashir) [Orabug: 39203185]
- eth: fbnic: add coverage for RXB stats (Mohsin Bashir) [Orabug: 39203185]
- eth: fbnic: add coverage for hw queue stats (Mohsin Bashir) [Orabug: 39203185]
- eth: fbnic: add locking support for hw stats (Mohsin Bashir) [Orabug: 39203185]
- tools: ynl: generate code for rt-route and add a sample (Jakub Kicinski) [Orabug: 39203185]
- tools: ynl: generate code for rt-addr and add a sample (Jakub Kicinski) [Orabug: 39203185]
- selftests: net: use netdevsim in netns test (Stanislav Fomichev) [Orabug: 39203185]
- selftests: net: use the dummy bpf from net/lib (Jakub Kicinski) [Orabug: 39203185]
- gso: AccECN support (Ilpo Järvinen) [Orabug: 39203185]
- RDMA/bnxt_re: Support perf management counters (Preethi G) [Orabug: 39203185]
- eth: fbnic: support ring size configuration (Jakub Kicinski) [Orabug: 39203185]
- eth: fbnic: fix typo in compile assert (Jakub Kicinski) [Orabug: 39203185]
- eth: fbnic: link NAPIs to page pools (Jakub Kicinski) [Orabug: 39203185]
- eth: fbnic: Replace firmware field macros (Lee Trager) [Orabug: 39203185]
- eth: fbnic: Update fbnic_tlv_attr_get_string() to work like nla_strscpy() (Lee Trager) [Orabug: 39203185]
- eth: fbnic: Prepend TSENE FW fields with FBNIC_FW (Lee Trager) [Orabug: 39203185]
- xdp: remove xdp_alloc_skb_bulk() (Alexander Lobakin) [Orabug: 39203185]
- veth: use napi_skb_cache_get_bulk() instead of xdp_alloc_skb_bulk() (Alexander Lobakin) [Orabug: 39203185]
- net: skbuff: introduce napi_skb_cache_get_bulk() (Alexander Lobakin) [Orabug: 39203185]
- eth: fbnic: Update return value in kdoc (Mohsin Bashir) [Orabug: 39203185]
- eth: fbnic: Consolidate PUL_USER CSR section (Mohsin Bashir) [Orabug: 39203185]
- eth: fbnic: Add PCIe registers dump (Mohsin Bashir) [Orabug: 39203185]
- eth: fbnic: Add ethtool support for IRQ coalescing (Mohsin Bashir) [Orabug: 39203185]
- RDMA/mana_ib: Implement DMABUF MR support (Konstantin Taranov) [Orabug: 39203185]
- selftests: test_vxlan_fdb_changelink: Add a test for MC remote change (Petr Machata) [Orabug: 39203185]
- selftests: test_vxlan_fdb_changelink: Convert to lib.sh (Petr Machata) [Orabug: 39203185]
- selftests: forwarding: lib: Move require_command to net, generalize (Petr Machata) [Orabug: 39203185]
- eth: fbnic: support TCP segmentation offload (Jakub Kicinski) [Orabug: 39203185]
- netlink: specs: wireless: add a spec for nl80211 (Donald Hunter) [Orabug: 39203185]
- eth: fbnic: report software Tx queue stats (Jakub Kicinski) [Orabug: 39203185]
- eth: fbnic: report software Rx queue stats (Jakub Kicinski) [Orabug: 39203185]
- eth: fbnic: wrap tx queue stats in a struct (Jakub Kicinski) [Orabug: 39203185]
- eth: fbnic: support n-tuple filters (Alexander Duyck) [Orabug: 39203185]
- eth: fbnic: add IP TCAM programming (Alexander Duyck) [Orabug: 39203185]
- eth: fbnic: support an additional RSS context (Daniel Zahka) [Orabug: 39203185]
- tools: ynl: add all headers to makefile deps (Jakub Kicinski) [Orabug: 39203185]
- RDMA/mana_ib: Add port statistics support (Shiraz Saleem) [Orabug: 39203185]
- RDMA/mana_ib: request error CQEs when supported (Konstantin Taranov) [Orabug: 39203185]
- RDMA/mana_ib: Query feature_flags bitmask from FW (Shiraz Saleem) [Orabug: 39203185]
- RDMA/bnxt_re: Congestion control settings using debugfs hook (Selvin Xavier) [Orabug: 39203185]
- RDMA/mana_ib: polling of CQs for GSI/UD (Konstantin Taranov) [Orabug: 39203185]
- RDMA/mana_ib: extend mana QP table (Konstantin Taranov) [Orabug: 39203185]
- RDMA/mana_ib: implement req_notify_cq (Konstantin Taranov) [Orabug: 39203185]
- RDMA/mana_ib: UD/GSI work requests (Konstantin Taranov) [Orabug: 39203185]
- RDMA/mana_ib: create/destroy AH (Konstantin Taranov) [Orabug: 39203185]
- RDMA/mana_ib: UD/GSI QP creation for kernel (Konstantin Taranov) [Orabug: 39203185]
- RDMA/mana_ib: Create and destroy UD/GSI QP (Konstantin Taranov) [Orabug: 39203185]
- RDMA/mana_ib: create kernel-level CQs (Konstantin Taranov) [Orabug: 39203185]
- RDMA/mana_ib: helpers to allocate kernel queues (Konstantin Taranov) [Orabug: 39203185]
- RDMA/mana_ib: implement get_dma_mr (Konstantin Taranov) [Orabug: 39203185]
- eth: fbnic: Add hardware monitoring support via HWMON interface (Sanman Pradhan) [Orabug: 39203185]
- eth: fbnic: hwmon: Add support for reading temperature and voltage sensors (Sanman Pradhan) [Orabug: 39203185]
- eth: fbnic: hwmon: Add completion infrastructure for firmware requests (Sanman Pradhan) [Orabug: 39203185]
- tools: ynl: add install target for generated content (Jan Stancek) [Orabug: 39203185]
- eth: fbnic: Revert "eth: fbnic: Add hardware monitoring support via HWMON interface" (Su Hui) [Orabug: 39203185]
- eth: fbnic: update fbnic_poll return value (Mohsin Bashir) [Orabug: 39203185]
- RDMA/efa: Align interrupt related fields to same type (Yonatan Nachum) [Orabug: 39203185]
- eth: fbnic: support ring channel set while up (Jakub Kicinski) [Orabug: 39203185]
- eth: fbnic: support ring channel get and set while down (Jakub Kicinski) [Orabug: 39203185]
- eth: fbnic: centralize the queue count and NAPI<>queue setting (Alexander Duyck) [Orabug: 39203185]
- eth: fbnic: add IRQ reuse support (Jakub Kicinski) [Orabug: 39203185]
- eth: fbnic: store NAPIs in an array instead of the list (Jakub Kicinski) [Orabug: 39203185]
- eth: fbnic: let user control the RSS hash fields (Alexander Duyck) [Orabug: 39203185]
- eth: fbnic: support setting RSS configuration (Alexander Duyck) [Orabug: 39203185]
- eth: fbnic: don't reset the secondary RSS indir table (Jakub Kicinski) [Orabug: 39203185]
- eth: fbnic: support querying RSS config (Alexander Duyck) [Orabug: 39203185]
- eth: fbnic: reorder ethtool code (Jakub Kicinski) [Orabug: 39203185]
- selftests: net: Add a VLAN bridge binding selftest (Petr Machata) [Orabug: 39203185]
- selftests: net: lib: Add a couple autodefer helpers (Petr Machata) [Orabug: 39203185]
- xsk: add generic XSk &xdp_buff -> skb conversion (Alexander Lobakin) [Orabug: 39203185]
- xdp: add generic xdp_build_skb_from_buff() (Alexander Lobakin) [Orabug: 39203185]
- xdp: add generic xdp_buff_add_frag() (Alexander Lobakin) [Orabug: 39203185]
- xdp: make __xdp_return() MP-agnostic (Alexander Lobakin) [Orabug: 39203185]
- xdp: get rid of xdp_frame::mem.id (Alexander Lobakin) [Orabug: 39203185]
- selftests: forwarding: Add a selftest for the new reserved_bits UAPI (Petr Machata) [Orabug: 39203185]
- selftests: net: lib: Add several autodefer helpers (Petr Machata) [Orabug: 39203185]
- selftests: net: lib: Rename ip_link_master() to ip_link_set_master() (Petr Machata) [Orabug: 39203185]
- eth: fbnic: add RPC hardware statistics (Sanman Pradhan) [Orabug: 39203185]
- eth: fbnic: add PCIe hardware statistics (Sanman Pradhan) [Orabug: 39203185]
- eth: fbnic: add basic debugfs structure (Jakub Kicinski) [Orabug: 39203185]
- eth: fbnic: add missing header guards (Jakub Kicinski) [Orabug: 39203185]
- eth: fbnic: add missing SPDX headers (Jakub Kicinski) [Orabug: 39203185]
- virtio_ring: remove API virtqueue_set_dma_premapped (Xuan Zhuo) [Orabug: 39203185]
- virtio-net: rq submits premapped per-buffer (Xuan Zhuo) [Orabug: 39203185]
- virtio_ring: introduce add api for premapped (Xuan Zhuo) [Orabug: 39203185]
- virtio_ring: perform premapped operations based on per-buffer (Xuan Zhuo) [Orabug: 39203185]
- virtio_ring: packed: record extras for indirect buffers (Xuan Zhuo) [Orabug: 39203185]
- virtio_ring: split: record extras for indirect buffers (Xuan Zhuo) [Orabug: 39203185]
- virtio_ring: introduce vring_need_unmap_buffer (Xuan Zhuo) [Orabug: 39203185]
- selftests: net: fdb_notify: Add a test for FDB notifications (Petr Machata) [Orabug: 39203185]
- selftests: net: lib: Add kill_process (Petr Machata) [Orabug: 39203185]
- selftests: net: lib: Move checks from forwarding/lib.sh here (Petr Machata) [Orabug: 39203185]
- selftests: net: lib: Move tests_run from forwarding/lib.sh here (Petr Machata) [Orabug: 39203185]
- eth: fbnic: Add support to dump registers (Mohsin Bashir) [Orabug: 39203185]
- tools: ynl: extend CFLAGS to keep options from environment (Jan Stancek) [Orabug: 39203185]
- virtio_vdpa: remove redundant check on desc (Colin Ian King) [Orabug: 39203185]
- virtio_fs: store actual queue index in mq_map (Max Gurtovoy) [Orabug: 39203185]
- virtio: Make vring_new_virtqueue support packed vring (Wenyu Huang) [Orabug: 39203185]
- RDMA/bnxt_re: Add set_func_resources support for P5/P7 adapters (Kalesh Ap) [Orabug: 39203185]
- selftests: net: Add busy_poll_test (Joe Damato) [Orabug: 39203185]
- eth: fbnic: Add support to write TCE TCAM entries (Mohsin Bashir) [Orabug: 39203185]
- selftests: net: include lib/sh/*.sh with lib.sh (Matthieu Baerts) [Orabug: 39203185]
- virtio_net: rx remove premapped failover code (Xuan Zhuo) [Orabug: 39203185]
- virtio_net: enable premapped mode for merge and small by default (Xuan Zhuo) [Orabug: 39203185]
- virtio_net: big mode skip the unmap check (Xuan Zhuo) [Orabug: 39203185]
- gpiolib: remove leftover spinlock bits (Bartosz Golaszewski) [Orabug: 39203185]
- dma-mapping: use macros to define events in a class (Sean Anderson) [Orabug: 39203185]
- RDMA/bnxt_re: Add support for modify_device hook (Kalesh Ap) [Orabug: 39203185]
- bnxt_en: Update firmware interface to 1.10.3.97 (Michael Chan) [Orabug: 39203185]
- selftests: TBF: Use defer for test cleanup (Petr Machata) [Orabug: 39203185]
- selftests: forwarding: lib: Allow passing PID to stop_traffic() (Petr Machata) [Orabug: 39203185]
- selftests: forwarding: Add a fallback cleanup() (Petr Machata) [Orabug: 39203185]
- eth: fbnic: Add hardware monitoring support via HWMON interface (Sanman Pradhan) [Orabug: 39203185]
- eth: fbnic: add ethtool timestamping statistics (Vadim Fedorenko) [Orabug: 39203185]
- eth: fbnic: add TX packets timestamping support (Vadim Fedorenko) [Orabug: 39203185]
- eth: fbnic: add RX packets timestamping support (Vadim Fedorenko) [Orabug: 39203185]
- eth: fbnic: add initial PHC support (Vadim Fedorenko) [Orabug: 39203185]
- eth: fbnic: add software TX timestamping support (Vadim Fedorenko) [Orabug: 39203185]
- Fix typos in GPIO TODO document (Shivam Chaudhary) [Orabug: 39203185]
- uek-rpm/modules.yaml.S.onos: Add Arista modules (Dara Stotland) [Orabug: 39960978]
- vrm: Add driver for Infineon POLs and controllers (Justin Oliver) [Orabug: 39960978]
- vrm: Fork PMBus core into Arista namespace (Justin Oliver) [Orabug: 39960978]
- vrm: Import PMBus core from SONiC kernel (Justin Oliver) [Orabug: 39960978]
- fan-cpld: rename minke-fan-cpld to arista-fan-cpld (Arista-Hpandya) [Orabug: 39960978]
- uek-rpm: clean up failed kernel installation (Sagar Sagar) [Orabug: 39971109]
- eth: lan743x: migrate to new RXFH callbacks (Jakub Kicinski) [Orabug: 39991891]
- net: Account VLAN RPS drops (Sherry Yang) [Orabug: 40007587]
- vhost-scsi: use kvzalloc for vq array allocation (Dongli Zhang) [Orabug: 40015355]
-
Tue Sep 08 2026 Sherry Yang <sherry.yang@oracle.com> [6.12.0-207.109.3.el10uek]
- net: Work around Marvell NIC TX stalls (Wengang Wang) [Orabug: 39766659]
- uek-rpm: BF3: Restore some configs disabled between OL8 & OL9, like compaction (Jeremy Tang) [Orabug: 39931154]
- arm64: dts: amd: ubootenv and a35 gold uboot flash partition fix. (#37) (Rahul Shekhar) [Orabug: 39976184]
- arm64: configs: salina_gold: enable MCTP I2C transport and I2C designware slave (#622) (#36) (Rahul Shekhar) [Orabug: 39976184]
- spi: cadence-quadspi: salina: disable STIG mode (#624) (#35) (Rahul Shekhar) [Orabug: 39976184]
- mtd: spi-nor: gigadevice: add support for GD55LF02GF (#34) (Rahul Shekhar) [Orabug: 39976184]
- LTS version: v6.12.109 (Sherry Yang)
- mm/rmap: use huge_ptep_get() in try_to_unmap_one() (Dev Jain)
- mm: avoid unnecessary use of is_swap_pmd() (Lorenzo Stoakes)
- platform/chrome: sensorhub: Fix dropped timestamp events and log spam (Tzung-Bi Shih)
- udf: Fix i_lenExtents truncation on 32-bit kernels (Zhan Xusheng)
- timer: Keep debugobjects state consistent in migrate_timer_list() (Thomas Gleixner)
- taskstats: fix cpumask parsing cutting off the last character (Bradley Morgan)
- smack: fix cred UAF in smack_file_send_sigiotask() (Jann Horn)
- signal: avoid shared siginfo namespace rewrites (Bradley Morgan) [Orabug: 40072685] {CVE-2026-93222}
- sticon/parisc: Detect default STI graphics card for console output (Helge Deller)
- tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout (Myeonghun Pak) [Orabug: 40020405] {CVE-2026-80930}
- xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc() (Zi Yan)
- w1: ds28e17: reject an oversize length on an I2C block read (Maoyi Xie)
- vsock/virtio: flush works in dependency order (Chengfeng Ye) [Orabug: 40020417] {CVE-2026-80932}
- wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex (Runyu Xiao)
- wifi: rtw88: pci: fix resource leak on failed NAPI setup (Dawei Feng) [Orabug: 40020438] {CVE-2026-80940}
- wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() (Abdun Nihaal) [Orabug: 40020440] {CVE-2026-80941}
- wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars() (Abdun Nihaal)
- wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids (Runyu Xiao)
- wifi: rtl818x: initialize eeprom_93cx6 struct to zero (Stanislaw Gruszka)
- wifi: mwifiex: Detach sync cmd buffer on interrupted wait (Fabio Estevam) [Orabug: 40020449] {CVE-2026-80944}
- crypto: sun8i-ss - Remove crypto_rng interface (Eric Biggers)
- crypto: sun8i-ce - Remove crypto_rng interface (Eric Biggers)
- wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop (Fan Wu) [Orabug: 40020463] {CVE-2026-80947}
- wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() (Abdun Nihaal) [Orabug: 40020472] {CVE-2026-80949}
- i3c: master: svc: bound IBI payload to the requested max_payload_len (Maoyi Xie)
- i3c: master: Fix info leak and UAF in device unregister path (Adrian Hunter)
- dm-switch: use WRITE_ONCE() in switch_region_table_write() (Xu Wang)
- dm-stats: fix a crash if allocation of per-cpu data fails (Mikulas Patocka) [Orabug: 40020502] {CVE-2026-80963}
- arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map() (Nathan Chancellor)
- PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip (Naman Jain)
- KVM: selftests: Remove duplicate LAUNCH_UPDATE_VMSA call in SEV-ES migrate test (Sean Christopherson)
- rust: rust_is_available: warn for `bindgen` < 0.72.1 && libclang >= 22 (Miguel Ojeda)
- x86/sev: Fix broken SNP support with KVM module built-in (Ashish Kalra)
- iommu/amd: remove return value of amd_iommu_detect (Shiyuan Gao)
- ring-buffer: Fix subbuf resize race with ring buffer readers (Vincent Donnefort) [Orabug: 40021976] {CVE-2026-89771}
- ALSA: virmidi: Check card index validity at probe (Takashi Iwai) [Orabug: 40020509] {CVE-2026-80964}
- ALSA: serial-u16550: Check card index validity at probe (Takashi Iwai) [Orabug: 40020517] {CVE-2026-80965}
- ALSA: portman2x4: Check card index validity at probe (Takashi Iwai)
- ALSA: pcxhr: initialize mutexes before requesting threaded IRQ (Runyu Xiao) [Orabug: 40020527] {CVE-2026-80967}
- ALSA: mts64: Check card index validity at probe (Takashi Iwai)
- ALSA: mpu401: Check card index validity at probe (Takashi Iwai) [Orabug: 40020540] {CVE-2026-80969}
- ALSA: bcd2000: clear the URB pointers on disconnect (Baul Lee) [Orabug: 40020545] {CVE-2026-80971}
- ALSA: aloop: Check card index validity at probe (Takashi Iwai) [Orabug: 40020552] {CVE-2026-80972}
- ALSA: 6fire: bound the MIDI event length from the device (Baul Lee) [Orabug: 40020556] {CVE-2026-80973}
- mfd: sm501: Fix potential memory leaks during remove (Abdun Nihaal) [Orabug: 40020560] {CVE-2026-80974}
- seg6: reset IP6CB after IPv6 decapsulation (Zhiling Zou) [Orabug: 40020567] {CVE-2026-80976}
- net: skbuff: don't touch shared zerocopy state in skb_tx_error() (Norbert Szetei) [Orabug: 40020573] {CVE-2026-80977}
- net: fix spurious TX timeout after dev_activate() (Breno Leitao)
- net: cap advertised IP tunnel headroom (Zhiling Zou) [Orabug: 40020584] {CVE-2026-80978}
- net/smc: unregister the connection before draining the rx tasklet (Bryam Vargas)
- net/smc: fix use-after-free in smc_rx_pipe_buf_release() (Hidayath Khan)
- net/smc: fix socket refcount leak in smc_switch_conns() (Hidayath Khan)
- net/smc: do not dereference an unset send buffer on the SMC-D teardown path (Bryam Vargas)
- net: ntb_netdev: Count packets dropped on RX refill failure (Koichiro Den)
- net: ntb_netdev: Avoid double-accounting netif_rx() drops (Koichiro Den)
- NTB: ntb_transport: Reject oversized TX buffers (Koichiro Den) [Orabug: 40020616] {CVE-2026-80987}
- NTB: ntb_transport: Fail TX enqueue when the QP link is down (Koichiro Den) [Orabug: 40020620] {CVE-2026-80988}
- NTB: ntb_transport: Recycle TX entries before client callbacks (Koichiro Den)
- net: thunderbolt: Mark the connection down when bringing it up fails (Fan Ye) [Orabug: 40020626] {CVE-2026-80989}
- net: thunderbolt: Release the Rx HopID that was handed out on mismatch (Fan Ye) [Orabug: 40020630] {CVE-2026-80990}
- net: ravb: serialize PTP clock teardown (Luoxuanqiang)
- net: ravb: avoid dereferencing an invalid PTP clock (Luoxuanqiang)
- net: openvswitch: fix nf_connlabels leak in ovs_ct_init (Ruoyu Wang)
- net: openvswitch: fix flow mask use-after-free on flow deletion (Ilya Maximets) [Orabug: 40020650] {CVE-2026-80994}
- net: l2tp: do not propagate multicast notification errors (Zihan Xi) [Orabug: 40020658] {CVE-2026-80996}
- net: ipa: fix stalled modem TX queue after runtime resume (Jorijn van der Graaf)
- net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO (Ahmad Fatoum) [Orabug: 40020667] {CVE-2026-80999}
- net: tun: bound receive headroom (Asim Viladi Oglu Manizada) [Orabug: 40020671,40035126] {CVE-2026-81000}
- net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition (Fabio Porcedda)
- slip: fix use-after-free in sl_sync() (Aleksandr Khromov) [Orabug: 40020675] {CVE-2026-81001}
- xdp: fix zero-copy frame layout (Weiming Shi) [Orabug: 40020680] {CVE-2026-81002}
- net/iucv: filter frames in afiucv_hs_rcv() by ingress device (Alexandra Winter)
- ipmi: si: Fix NULL pointer dereference after failed registration (Seiji Nishikawa) [Orabug: 40020692] {CVE-2026-81005}
- ipmi: ipmb: validate write message length (Yousef Alhouseen)
- interconnect: Fix use after free in icc_get() and of_icc_get_by_index() (Kuan-Wei Chiu) [Orabug: 40020703] {CVE-2026-81008}
- platform/x86: hp-bioscfg: warn on element type mismatch instead of failing (Muhammad Bilal)
- platform/x86: hp-bioscfg: pass validated element count to package parsers (Muhammad Bilal) [Orabug: 40020712] {CVE-2026-81011}
- platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed (Muhammad Bilal)
- platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer() (Muhammad Bilal) [Orabug: 40020714] {CVE-2026-81012}
- platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password (Muhammad Bilal)
- platform/x86: hp-bioscfg: fix heap OOB read on empty password write (Muhammad Bilal) [Orabug: 40020717] {CVE-2026-81013}
- platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store() (Muhammad Bilal) [Orabug: 40020720] {CVE-2026-81014}
- platform/x86: hp-bioscfg: bound ordered-list parsing by the package count (Muhammad Bilal)
- platform/x86: hp-bioscfg: advance elem past consumed array elements (Muhammad Bilal)
- platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS (Muhammad Bilal)
- platform/chrome: sensorhub: Bound the EC-reported sensor number (Bryam Vargas) [Orabug: 40020727] {CVE-2026-81017}
- platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path (Ma Ke)
- platform/x86: ISST: Return error during profile addition (Srinivas Pandruvada)
- platform/x86: ISST: Validate parameter for frequency and priority (Srinivas Pandruvada)
- platform/x86: ISST: Validate parameter for core power state (Srinivas Pandruvada)
- platform/x86: ISST: Validate logical CPU id and clos id (Srinivas Pandruvada) [Orabug: 40020738] {CVE-2026-89438}
- platform/x86: ISST: Use PP level enable mask (Srinivas Pandruvada)
- platform/x86: ISST: Just allow 2 bits for SST feature enable (Srinivas Pandruvada)
- platform/x86: ISST: Add a NULL check for sst_inst[] (Srinivas Pandruvada) [Orabug: 40020742] {CVE-2026-89439}
- mmc: via-sdmmc: stop card-detect handling on probe failure (Fan Wu) [Orabug: 40020745] {CVE-2026-89440}
- platform/x86: ISST: Validate socket ID in clos_assoc ioctl (Hyeongjun An) [Orabug: 40020755] {CVE-2026-89442}
- platform/x86: ISST: Validate level in perf mask ioctls (Hyeongjun An) [Orabug: 40020757] {CVE-2026-89443}
- platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer (Hyeongjun An) [Orabug: 40020759] {CVE-2026-89444}
- iommu/vt-d: Force requesting ACS when tboot is enabled (Kevin Tian) [Orabug: 40020767] {CVE-2026-89448}
- iommu/vt-d: Fix no_iommu to disable platform opt-in (Kevin Tian)
- iommu/arm-smmu-v3: Manage teardown with devm (Shameer Kolothum) [Orabug: 40072617] {CVE-2026-93205}
- iommu/sva: Set handle->dev before the SVA handle is visible (Shuai Xue) [Orabug: 40020774] {CVE-2026-89451}
- iommu/amd: Put PCI device after handling PPR faults (Shuai Xue) [Orabug: 40020782] {CVE-2026-89453}
- PCI/proc: Warn on writes to kernel-exclusive config space regions (Krzysztof Wilczyński)
- PCI/proc: Use file_ns_capable() when checking config space read access (Krzysztof Wilczyński) [Orabug: 40072622] {CVE-2026-93206}
- PCI/proc: Avoid spurious runtime PM wakeup on config space accesses (Krzysztof Wilczyński)
- PCI/MSI: Enable memory decoding before restoring MSI-X messages (Farhan Ali)
- PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses (Krzysztof Wilczyński)
- PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] (Tim Harvey)
- PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts() (Ali Tariq)
- PCI: plda: Fix use-after-free of event IRQs during teardown (Ali Tariq)
- PCI: meson: Fix GPIO state while requesting PERST# (Ronald Claveau)
- PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk (Mohamad Raizudeen)
- s390/dasd: Propagate partial completion length across ERP recovery (Stefan Haberland)
- s390/dasd: Guard sysfs discipline callbacks against unallocated private data (Stefan Haberland)
- s390/dasd: Do not complete a failed ESE read as successful (Stefan Haberland)
- s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Thomas Richter)
- power: supply: max17040: synchronize work cancellation on suspend (Jianing Li) [Orabug: 40020806] {CVE-2026-89461}
- power: supply: max17040: drop incorrect I2C functionality check (Jianing Li)
- power: supply: max17040: propagate register read errors (Jianing Li) [Orabug: 40020810] {CVE-2026-89462}
- power: supply: ucs1002: fix use-after-free on remove (Fan Wu)
- power: supply: twl4030_charger: cancel workers via devm (Maoyi Xie)
- power: supply: rt9455: quiesce delayed work before teardown (Fan Wu)
- power: supply: qcom_battmgr: terminate the strings from firmware (Hyeongjun An)
- power: supply: lp8788-charger: fix use-after-free on remove (Fan Wu)
- power: supply: lp8727: fix use-after-free in lp8727_release_irq() (Fan Wu) [Orabug: 40020837] {CVE-2026-89469}
- power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS (Jameson Thies)
- power: supply: cros_usbpd-charger: bound the EC-reported port count (Bryam Vargas)
- power: supply: charger-manager: register regulators before exposing sysfs (Fan Wu) [Orabug: 40020850] {CVE-2026-89472}
- power: supply: bq25890: Fix power_supply reference leak (Ma Ke)
- power: supply: bq256xx: drain usb_work before freeing the charger (Fan Wu)
- power: supply: bq24257: fix use-after-free on remove (Fan Wu)
- sctp: fix stream->outcnt underflow on duplicate RECONF responses (Jun Yang) [Orabug: 40020864] {CVE-2026-89476}
- sctp: distinguish sequence zero from wildcard in reconf lookup (Jun Yang)
- sctp: fix NULL deref on untransmitted RECONF completion (Weiming Shi) [Orabug: 40020868] {CVE-2026-89477}
- sctp: drop a chunk if its transport was removed (Hyunwoo Kim) [Orabug: 40020873] {CVE-2026-89478}
- sctp: stop processing a packet once its association is deleted (Hyunwoo Kim) [Orabug: 40020878] {CVE-2026-89479}
- nvme-tcp: reject a read that transferred too few bytes (Yehyeong Lee) [Orabug: 40020883] {CVE-2026-89480}
- nvme-tcp: fix host memory disclosure on R2T for a read command (Yehyeong Lee) [Orabug: 40020887] {CVE-2026-89481}
- nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (Yehyeong Lee) [Orabug: 40020894] {CVE-2026-89482}
- nvme-pci: disable controller on admin queue IRQ setup failure (Myeonghun Pak)
- nvme: zero the discard fallback page (Yehyeong Lee) [Orabug: 40020899] {CVE-2026-89483}
- nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path (Ewan D. Milne)
- lockd: fix NULL dereference on lockowner allocation failure (Shuangpeng Bai) [Orabug: 40020903] {CVE-2026-89484}
- lockd: pin next file across nlm_inspect_file lock-drop (Michael Bommarito) [Orabug: 40020907] {CVE-2026-89485}
- hwmon: (max6621) fix temperature clamp range (Cong Nguyen)
- hwmon: (max6621) fix negative temperature offset and crit readings (Cong Nguyen)
- ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC (Christopher Tolang)
- arm64: compat: Fix decrementing LDM/STM alignment emulation (Karl Mehltretter)
- ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion (Hyeongjun An)
- openvswitch: only skb_tx_error() a packet we are about to drop (Norbert Szetei) [Orabug: 40020914] {CVE-2026-89487}
- openrisc: fix arbitrary kernel memory access via or1k_atomic syscall (Ali Ahmet Memis)
- ocfs2: fix readdir position truncation on 32-bit kernels (Zhan Xusheng) [Orabug: 40020926] {CVE-2026-89490}
- ocfs2: cluster: fix o2hb_dependent_users leak on pin failure (Joseph Qi)
- ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item (Joseph Qi)
- ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin() (Joseph Qi) [Orabug: 40020930] {CVE-2026-89491}
- ocfs2: validate rl_used against rl_count in refcount block validator (Ibrahim Hashimov) [Orabug: 40020940] {CVE-2026-89493}
- ocfs2: validate lengths in dlm_mig_lockres_handler (Bryam Vargas) [Orabug: 40020945] {CVE-2026-89494}
- ocfs2: bound namelen in dlm_migrate_request_handler (Bryam Vargas) [Orabug: 40020951] {CVE-2026-89495}
- ocfs2: always run deallocs on copy-on-write completion (Dmitry Antipov) [Orabug: 40020957] {CVE-2026-89496}
- orangefs: skip leading spaces before parsing client debug masks (Zhiling Zou)
- orangefs: fix double-free of trailer_buf on readdir copy failure (Yifei Gao)
- ring-buffer: Hold cpu_buffer::lock when resizing a subbuf (Vincent Donnefort) [Orabug: 40020973] {CVE-2026-89501}
- ring-buffer: Free cpu_buffer::free_page with subbuf_order (Vincent Donnefort) [Orabug: 40020975] {CVE-2026-89502}
- regulator: qcom-refgen: correct the regulator type to CURRENT (Kathiravan Thirumoorthy)
- regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata (Xu Wang)
- regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer (Xu Wang)
- RDMA/ucma: Lock the handler in ucma_set_ib_path() (Norbert Szetei) [Orabug: 40020988] {CVE-2026-89508}
- RDMA/cxgb4: Cancel reg_work before freeing device on remove (Fan Wu) [Orabug: 40020993] {CVE-2026-89510}
- qede: Fix NULL pointer dereference in TPA fragment processing (Vaibhav Nagare) [Orabug: 40020997] {CVE-2026-89511}
- remoteproc: scp: Fix device reference leak on failed lookup (Johan Hovold)
- riscv: acpi: Handle LPI architectural context loss flags (Peixin Xie)
- arm64: dts: rockchip: Fix rk3399-roc-pc-plus analog audio (Fabio Estevam)
- arm64: dts: rockchip: fix eMMC reset polarity on PX30 Ringneck (Quentin Schulz)
- arm64: dts: qcom: sm6115-pro1x: Correct touchscreen GPIO flags (Krzysztof Kozlowski)
- rpmsg: glink: smem: order FIFO read after availability check (Chunkai Deng)
- scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() (Petr Vaganov) [Orabug: 40021008] {CVE-2026-89515}
- staging: media: tegra-video: vi: fix probe failure on skipped last port (Hao-Qun Huang)
- staging: media: tegra-video: fix of_node_put() on VIP parse errors (Hao-Qun Huang)
- wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets (Doruk Tan Ozturk) [Orabug: 40021028] {CVE-2026-89524}
- udf: reject VAT indexes equal to the entry count (David Lee) [Orabug: 40021034] {CVE-2026-89525}
- svcrdma: Validate Read chunk positions before reconstruction (Chuck Lever) [Orabug: 40021039] {CVE-2026-89526}
- svcrdma: Reject inline replies that overflow the pull-up buffer (Chuck Lever) [Orabug: 40021052] {CVE-2026-89530}
- svcrdma: Reject connection when transport allocation fails (Chuck Lever) [Orabug: 40021062] {CVE-2026-89531}
- svcrdma: Fix unmatched rn_unregister on failed accept (Chris Mason) [Orabug: 40072695] {CVE-2026-93224}
- svcrdma: Fix pcl_for_each_segment for empty chunks (Chris Mason) [Orabug: 40021066] {CVE-2026-89532}
- svcrdma: Fix offset arithmetic in read_chunk_range (Chris Mason) [Orabug: 40021069] {CVE-2026-89533}
- SUNRPC: wait for in-flight client TLS handshake callback (Jérémy Jean) [Orabug: 40021077] {CVE-2026-89536}
- SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field (Chuck Lever) [Orabug: 40021085] {CVE-2026-89538}
- SUNRPC: reject duplicate CREDS_VALUE options (Chris Mason) [Orabug: 40021089] {CVE-2026-89539}
- sunrpc: init gssp_lock before publishing proc entry (Chris Mason) [Orabug: 40021093] {CVE-2026-89540}
- SUNRPC: harden gss_unwrap_resp_priv length checks (Chris Mason) [Orabug: 40021098] {CVE-2026-89541}
- SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (Chris Mason) [Orabug: 40021114] {CVE-2026-89542}
- SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat (Chris Mason)
- SUNRPC: Check svc pool percpu counter allocation (Chuck Lever) [Orabug: 40021150] {CVE-2026-89547}
- SUNRPC: always drain cache_cleaner before destroying a cache_detail (Jeff Layton) [Orabug: 40021153] {CVE-2026-89548}
- sunrpc: route to a populated pool in svc_pool_for_cpu() (Jeff Layton) [Orabug: 40021158] {CVE-2026-89549}
- SUNRPC: svcauth_gss: enforce krb5 token minimum length (Chris Mason) [Orabug: 40021162] {CVE-2026-89550}
- SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Chris Mason) [Orabug: 40072626] {CVE-2026-93207}
- SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (Chris Mason) [Orabug: 40021167] {CVE-2026-89551}
- params: fix charp corruption on allocation failure (Jiacheng Yu) [Orabug: 40021171] {CVE-2026-89552}
- nouveau/gem: reserve the bo in the info ioctl around the vma lookup (Dave Airlie) [Orabug: 40021175] {CVE-2026-89553}
- mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction (Harshit Varu) [Orabug: 40021180] {CVE-2026-89554}
- mpls: reload header after pskb_may_pull() (Qing Ming) [Orabug: 40021183] {CVE-2026-89555}
- md: do overflow check for sb->bblog_shift in super_1_load() (Coly Li) [Orabug: 40021189] {CVE-2026-89557}
- md/raid10: fix still_degraded being inverted in raid10_sync_request() (Yunye Zhao) [Orabug: 40021194] {CVE-2026-89558}
- mailbox: qcom-ipcc: fix duplicate channel allocation across holes (Anup Vishwakarma)
- libnvdimm/labels: Prevent integer overflow in __nd_label_validate() (Bryam Vargas) [Orabug: 40021196] {CVE-2026-89559}
- ipv6: use RCU iterator to dump route exceptions (Yuyang Huang) [Orabug: 40072698] {CVE-2026-93226}
- ip6_gre: fix hardware header length for NBMA tunnels (Zhiling Zou) [Orabug: 40021213] {CVE-2026-89562}
- ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() (Zhiling Zou) [Orabug: 40021219] {CVE-2026-89563}
- ipip: fix skb leak in collect_md mode when metadata_dst allocation fails (Anton Danilov) [Orabug: 40021228] {CVE-2026-89565}
- jbd2: check need_resched() when skipping busy checkpoint buffers (Max Kellermann) [Orabug: 40021232] {CVE-2026-89566}
- jbd2: bound shrinker scans by examined checkpoint buffers (Max Kellermann) [Orabug: 40021240] {CVE-2026-89567}
- kasan: fix cache shrink race with CPU hotplug (Sh_Def)
- Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request (Ibrahim Abdelkader)
- Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative (Guangshuo Li)
- Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative (Guangshuo Li)
- Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection (Valentin Kindschi)
- Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb (Xin Chen) [Orabug: 40072632] {CVE-2026-93209}
- Bluetooth: hci_conn: re-enable advertising only for peripheral role (Valentin Kindschi)
- Bluetooth: RFCOMM: serialize security confirmation handling (Chengfeng Ye) [Orabug: 40021244] {CVE-2026-89569}
- Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready (Hang Nan) [Orabug: 40010342] {CVE-2026-80914}
- Bluetooth: hci_uart: Fix false success return in hci_uart_setup() (Gongwei Li)
- Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative (Guangshuo Li)
- Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378 (Lorenzo Stoakes)
- cxl/pmem: Format the nvdimm serial number as unsigned decimal (Alison Schofield)
- cpufreq: schedutil: Fix rate limit overflow (Sh_Def)
- coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior (Kuan-Wei Chiu)
- dm array: reject an array block whose value size is not the caller's (Bryam Vargas) [Orabug: 40021259] {CVE-2026-89573}
- dm array: validate array block headers on read (Bryam Vargas) [Orabug: 40021267] {CVE-2026-89574}
- dm raid1: reserve space for NUL-terminator in build_constructor_string() (Ilya Krutskih) [Orabug: 40021273] {CVE-2026-89575}
- dm-era: fix shadowed superblock leak on take-snap failure (Liyouhong) [Orabug: 40021281] {CVE-2026-89576}
- bpf: Harden bloom filter sizing and indexing on 32-bit kernels (Jérémy Jean) [Orabug: 40021290] {CVE-2026-89579}
- bpf: Disable preemption in __bpf_get_stack (Daniel Borkmann) [Orabug: 40021292] {CVE-2026-89580}
- bpf, x86: Fix per-CPU address resolution into an extended register (Vineet Gupta) [Orabug: 40021299] {CVE-2026-89581}
- bnx2x: fix double free in bnx2x_init_firmware() error path (Jiangshan Yi) [Orabug: 40021302] {CVE-2026-89582}
- Bluetooth: eir: Fix OOB read in eir_get_service_data() (Hyeongjun An) [Orabug: 40021306] {CVE-2026-89583}
- Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU (Christoph Zwerschke)
- Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU (Christoph Zwerschke)
- block: set QUEUE_FLAG_DYING unconditionally in blk_mark_disk_dead() (Lianqin Hu)
- auxdisplay: charlcd: cancel backlight work on registration failure (Hongyan Xu) [Orabug: 40021313] {CVE-2026-89585}
- ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes (Niklas Cassel) [Orabug: 40021319] {CVE-2026-89586}
- ARM: 9477/1: Disable broken eBPF JIT on the Risc PC (Ethan Nelson-Moore)
- alpha: marvel: Fix lock ordering in init_io7_irqs() (Matt Turner)
- alpha: marvel: Fix irq_set_status_flags to use correct IRQ number (Matt Turner)
- alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write() (Krzysztof Wilczyński)
- ACPI: pfr_update: fix stack buffer overflow in query_capability() (Anirudh Prasad) [Orabug: 40021327] {CVE-2026-89587}
- ACPI: APEI: GHES: fix ARM section length accounting after header (Zheng Tan) [Orabug: 40022004] {CVE-2026-89588}
- ACPI: APEI: Fix ERST timeout unit conversion (Nirmoy Das)
- hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device (Ivaylo Dimitrov)
- fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration (Ang Tien Sung)
- forcedeth: fix off-by-one when saving/restoring non-PCI config space (Marek Czernohous) [Orabug: 40021353] {CVE-2026-89596}
- fbdev: uvesafb: unregister connector callback on init failure (Myeonghun Pak)
- fbdev: ssd1307fb: defer I2C transfers from damage callbacks (Sh_Def) [Orabug: 40021368] {CVE-2026-89598}
- fbdev: pvr2fb: correct user pointer annotation and sentinel initializer (Florian Fuchs)
- fbdev: omapfb: panel-dsi-cm: initialize lock before registering display (Runyu Xiao)
- fat: restore original value when fat_ent_write failed (Yemu Lu)
- efivarfs: Rate limit statfs() handler (Ard Biesheuvel) [Orabug: 40021403] {CVE-2026-89604}
- ecryptfs: show filename encryption options (Chenyichong)
- ecryptfs: release message context on send failure (Chenyichong)
- ecryptfs: reject too-small tag 70 packets (Chenyichong) [Orabug: 40021412] {CVE-2026-89606}
- ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet (Ji'An Zhou) [Orabug: 40021418] {CVE-2026-89607}
- ecryptfs: pass packet set buffer size to parser (Chenyichong) [Orabug: 40021427] {CVE-2026-89608}
- ecryptfs: hold msg ctx list lock when cleaning daemon queue (Chenyichong)
- ecryptfs: fix tag 11 packet exact-fit size check (Chenyichong)
- eCryptfs: bound the packet-length peek to the user buffer (Pengpeng Hou)
- fs/ntfs3: bound page_lcns[] index by the log record (Konstantin Komarov)
- fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame() (Samuel Page)
- fs/ntfs3: validate dirty page table on log replay (Xiang Mei)
- eventfs: Initialize ei->children and ei->list in init_ei() (Deepanshu Kartikey) [Orabug: 40021475] {CVE-2026-89618}
- HID: mcp2221: validate report size in mcp2221_raw_event() (Jiangshan Yi)
- HID: mcp2221: stop device IO before hid_hw_stop (Jiangshan Yi)
- HID: sensor: custom: Fix field sysfs group cleanup on failure (Haoxiang Li) [Orabug: 40021497] {CVE-2026-89626}
- HID: roccat: free buffered reports when destroying device (Xu Rao) [Orabug: 40021501] {CVE-2026-89627}
- HID: picolcd: clamp eeprom debugfs read to bytes actually received (Ibrahim Hashimov) [Orabug: 40021506] {CVE-2026-89628}
- smb: client: harden DFS cache against invalid target hints (Fredric Cover) [Orabug: 40072635] {CVE-2026-93210}
- smb: client: fix copy-paste error in WSL EA length accounting for $LXDEV (Frank Sorenson)
- smb: client: fix ALIGN() overflow in symlink_data() error context loop (Frank Sorenson) [Orabug: 40021526] {CVE-2026-89634}
- smb: client: clear ce->tgthint in free_tgts() (Fredric Cover) [Orabug: 40021529] {CVE-2026-89636}
- cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Frank Sorenson) [Orabug: 40021546] {CVE-2026-89640}
- audit: avoid dropping live tree ref on fsnotify rule autoremove (Jérémy Jean) [Orabug: 40021556] {CVE-2026-89643}
- btrfs: drop recovered reloc root refs on recovery failure (Guanghui Yang) [Orabug: 40021567] {CVE-2026-89645}
- ceph: do not repeat ceph_trim_dentries() if no progress possible (Max Kellermann) [Orabug: 40021571] {CVE-2026-89647}
- ceph: bound xattr value length in __build_xattrs() (Michael Bommarito) [Orabug: 40021579] {CVE-2026-89649}
- ceph: bound num_export_targets array for mds info v2/v3 (Michael Bommarito) [Orabug: 40021585] {CVE-2026-89650}
- ceph: bound MDSCapAuth path and fs_name decode in handle_session() (Michael Bommarito) [Orabug: 40021589] {CVE-2026-89651}
- ceph: bound copied dentry name length in NFS export get_name (Michael Bommarito) [Orabug: 40021591] {CVE-2026-89652}
- ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode (Jérémy Jean) [Orabug: 40021597] {CVE-2026-89653}
- ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock (Xiubo Li) [Orabug: 40021605] {CVE-2026-89655}
- libceph: reject buckets with mismatched CRUSH ids (Jérémy Jean) [Orabug: 40021609] {CVE-2026-89656}
- libceph: validate OSD extent maps before cursor advance (Michael Bommarito) [Orabug: 40021614] {CVE-2026-89657}
- NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup (Chuck Lever) [Orabug: 40021617] {CVE-2026-89658}
- NFSD: Prevent lock owner use-after-free during client teardown (Chuck Lever) [Orabug: 40021631] {CVE-2026-89662}
- nfsd: revoke copy-notify stateids before dropping their reference (Jeff Layton) [Orabug: 40021635] {CVE-2026-89663}
- nfsd: reject reclaim LOCK after RECLAIM_COMPLETE (Jeff Layton)
- nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE (Robbie Ko)
- nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops (Robbie Ko) [Orabug: 40021649] {CVE-2026-89666}
- nfsd: initialize DRC hash table before registering shrinker (Jeff Layton) [Orabug: 40072640] {CVE-2026-93211}
- nfsd: initialize copy-notify stateid before publishing it (Jeff Layton) [Orabug: 40021656] {CVE-2026-89669}
- nfsd: gate nfs3 setacl by argp->mask (Chris Mason) [Orabug: 40021663] {CVE-2026-89671}
- nfsd: gate nfs2 setacl by argp->mask (Chuck Lever)
- nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo (Jeff Layton) [Orabug: 40021671] {CVE-2026-89673}
- nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (Jeff Layton) [Orabug: 40021677] {CVE-2026-89674}
- nfsd: fix version mismatch loops in nfsd_acl_init_request() (Jeff Layton)
- nfsd: fix reply size estimate for GET_DIR_DELEGATION (Jeff Layton)
- nfsd: fix nfsd_file leak on inter-server COPY setup failure (Jeff Layton) [Orabug: 40021695] {CVE-2026-89680}
- nfsd: fix dentry ref leak on V4ROOT export filehandle lookup (Jeff Layton) [Orabug: 40021704] {CVE-2026-89683}
- nfsd: fix cpntf publish race in nfs4_init_cp_state (Chris Mason) [Orabug: 40021706] {CVE-2026-89684}
- nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke (Jeff Layton) [Orabug: 40021713] {CVE-2026-89686}
- nfsd: drop the stateid, not the stateowner, on seqid_op replay retry (Jeff Layton) [Orabug: 40021718] {CVE-2026-89688}
- nfsd: defer vfree of compound ops to fix rpc_status UAF (Jeff Layton) [Orabug: 40021721] {CVE-2026-89690}
- nfsd: clear opcnt on compound arg release to prevent OOB read (Jeff Layton) [Orabug: 40021724] {CVE-2026-89691}
- nfsd: check client ownership when cancelling a copy-notify stateid (Jeff Layton) [Orabug: 40021731] {CVE-2026-89694}
- nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref (Jeff Layton) [Orabug: 40021740] {CVE-2026-89696}
- nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry (Jeff Layton) [Orabug: 40072710] {CVE-2026-93229}
- nfsd: add filehandle match check to nfsd4_delegreturn() (Jeff Layton)
- nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() (Jeff Layton)
- nfsd: validate symlink target length in NFSv4 CREATE (Jeff Layton) [Orabug: 40021750] {CVE-2026-89699}
- nfsd: size fh_verify server sockaddr slot by xpt_locallen (Chris Mason) [Orabug: 40021759] {CVE-2026-89702}
- nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations (Zhenghang Xiao) [Orabug: 40021762] {CVE-2026-89703}
- nfsd: sample writeback error cursor before async COPY loop (Chuck Lever) [Orabug: 40021765] {CVE-2026-89704}
- nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types (Jeff Layton)
- nfsd: Reset write verifier when async COPY writeback fails (Chuck Lever) [Orabug: 40021771] {CVE-2026-89706}
- nfsd: release path refs on follow_down() error (Chris Mason) [Orabug: 40021774] {CVE-2026-89707}
- pNFS: Fix EBUSY check in pnfs_layout_need_return (Tim Menninger)
- NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path (Junrui Luo) [Orabug: 40021787] {CVE-2026-89710}
- nfsd: guard nfsd_serv deref in nfsd_file_net_dispose (Chris Mason) [Orabug: 40072643] {CVE-2026-93212}
- NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check (Mike Snitzer) [Orabug: 40021790] {CVE-2026-89711}
- NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock (Michael Bommarito) [Orabug: 40021795] {CVE-2026-89712}
- NFSD: Fix off-by-one in DRC bucket pruning limit (Chuck Lever)
- NFSD: Encode only the status in NFS-ACL v2 GETACL error replies (Chuck Lever)
- NFSD: check truncate permission under inode lock (Chuck Lever) [Orabug: 40021799] {CVE-2026-89713}
- zsmalloc: account for handle size in class lookup (Longlong Xia)
- ubifs: fix out-of-bounds read in signature length check (Ibrahim Hashimov)
- of: fix out-of-bounds read in of_alias_scan() stem parser (Abdurrahman Hussain) [Orabug: 40072645] {CVE-2026-93213}
- nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation (Ryusuke Konishi)
- media: vicodec: fix out-of-bounds write in FWHT encoder (Junrui Luo)
- media: cec: stm32: prevent out-of-bounds write on RX overflow (Weigang He)
- lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() (Vincent Mailhol) [Orabug: 40021840] {CVE-2026-89726}
- HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature (Xingrui Li) [Orabug: 40021846] {CVE-2026-89729}
- fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write (Daisuke Matsuda)
- usb: gadget: f_fs: Prevent deadlock during ep0 read loop (Neill Kapron)
- usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() (Jeffin Philip)
- usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() (Yun Zhou)
- usb: gadget: midi2: remove default configfs groups on teardown (Joshua Crofts)
- usb: gadget: snps_udc_plat: clean up PHY on probe deferral (Myeonghun Pak)
- usb: gadget: u_audio: Fix use-after-free on sound card disconnect (Sonali Pradhan)
- usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion (Huang Wei)
- usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive() (Xu Yang)
- USB: phy: fsl-usb: fix missing static keywords (Johan Hovold)
- usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed (Fan Wu)
- usb: dwc2: gadget: Exit partial power down state when changing USB pull-up (Francesco Lavra)
- staging: greybus: hid: fix SET_REPORT return value (Hao-Qun Huang)
- serial: imx: serialize imx_uart_ports[] lifetime (Karl Mehltretter)
- Revert "media: v4l2-dev: fix error handling in __video_register_device()" (Hans Verkuil) [Orabug: 40021885] {CVE-2026-89741}
- rapidio: mport_cdev: fix use-after-free in dma_req_free() (James Kim)
- powerpc/powermac: fix OF node refcount (Bartosz Golaszewski)
- misc: nsm: bound the device-reported response length (Bryam Vargas)
- device property: fix infinite loop in fwnode_for_each_child_node() (Xu Yang) [Orabug: 40022018] {CVE-2026-89744}
- cdx: Fix double free when sysfs file creation fails (Prasanna Kumar T S M)
- tracing: Fix use-after-free with same-name named triggers (Sh_Def) [Orabug: 40021900] {CVE-2026-89746}
- tracing: Fix use-after-free in trace_pipe read on sub-buffer order change (Deepanshu Kartikey) [Orabug: 40021902] {CVE-2026-89747}
- tracing: Fix logged instance name on creation failure (Vincent Donnefort)
- tracing: Fix crash passing ERR_PTR to kthread_stop() (Sh_Def) [Orabug: 40021905] {CVE-2026-89749}
- tracing/user_events: Clear copied tracing state before fork duplication (Jérémy Jean)
- hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() (Sanman Pradhan)
- x86/tdx: Fix zero-extension for 32-bit port I/O (Kiryl Shutsemau)
- x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg() (Kiryl Shutsemau)
- x86/tdx: Fix off-by-one in port I/O handling (Kiryl Shutsemau) [Orabug: 40021911] {CVE-2026-89751}
- tools/compiler: match glibc 2.42 definition of __attribute_const__ (Joy H.J. Lee)
- mm: mempolicy: fix automatic numa balancing for shmem (Johannes Weiner)
- mm: memcg: stop reclaim when a limit update is superseded (Zhangguopeng) [Orabug: 40021913] {CVE-2026-89752}
- mm/zswap: fix global shrinker when memory cgroup is disabled (Hao Jia)
- mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() (Breno Leitao) [Orabug: 40021917] {CVE-2026-89753}
- mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch() (Breno Leitao) [Orabug: 40021925] {CVE-2026-89756}
- mm/kmemleak: avoid soft lockup when scanning task stacks (Breno Leitao)
- include/linux/list.h: mark list_add and __list_add as __always_inline (Jordan R Abrahams-Whitehead)
- apparmor: fix out-of-bounds write when null terminating a label vec (Hyunwoo Kim)
- apparmor: fix cred UAF caused by begin_current_label_crit_section() (Jann Horn) [Orabug: 40021947] {CVE-2026-89762}
- timers/itimer: Zero-init old itimerval before copy to userspace (Jérémy Jean) [Orabug: 40021961] {CVE-2026-89765}
- powerpc/pseries/iommu: switch to Default DMA window during kdump (Gaurav Batra)
- fs: fix user path of nested backing files (Baokun Li) [Orabug: 40022021] {CVE-2026-89768}
- clocksource/drivers/timer-sun4i: Advertise a real minimum delta (Felix Yan) [Orabug: 40072668] {CVE-2026-93219}
- alpha: don't leak hardware-fabricated FP exception bits to user space (Matt Turner)
- alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally (Matt Turner)
- drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths (Srinivasan Shanmugam) [Orabug: 39653280] {CVE-2026-53313}
- wifi: ath11k: fix memory leaks in beacon template setup (Zilin Guan) [Orabug: 39622112] {CVE-2026-53113}
- wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req() (Zilin Guan) [Orabug: 39622083] {CVE-2026-53102}
- perf/x86/intel/uncore: Fix die ID init and look up bugs (Zide Chen) [Orabug: 39343696] {CVE-2026-43344}
- drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 (Mario Limonciello) [Orabug: 38158557] {CVE-2025-38205}
- block: mark GFP_NOIO around sysfs ->store() (Ming Lei) [Orabug: 37650276] {CVE-2025-21817}
- f2fs: fix potential deadloop in prepare_compress_overwrite() (Chao Yu)
- md: make rdev_addable usable for rcu mode (Yangerkun) [Orabug: 38351780] {CVE-2025-38621}
- bnxt_en: Mask the bd_cnt field in the TX BD properly (Michael Chan) [Orabug: 37844489] {CVE-2025-22108}
- LTS version: v6.12.108 (Sherry Yang)
- usb: usbfs: fix use-after-free of usb_device in usbdev_release() (Miguel Peñaranda) [Orabug: 39982119] {CVE-2026-80824}
- wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb (Lucid Duck) [Orabug: 39982123] {CVE-2026-80825}
- USB: c67x00: fix use-after-free in c67x00_add_iso_urb() (Shuangpeng Bai)
- USB: serial: spcp8x5: drop broken carrier detect support (Johan Hovold)
- USB: serial: option: fix slab OOB read in interrupt URB callback (Jiale Yao) [Orabug: 39982130] {CVE-2026-80827}
- ALSA: usb-audio: Complete cleanup after system-resume errors (Will Porter) [Orabug: 39982134] {CVE-2026-80828}
- ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() (Marouane El Moufid) [Orabug: 39982138] {CVE-2026-80829}
- usb: core: Strengthen error handling in hub_hub_status() (Griffin Kroah-Hartman)
- usb: core: Add lock to usb_wakeup_notification() (Griffin Kroah-Hartman) [Orabug: 39982142] {CVE-2026-80830}
- KVM: s390: vsie: zero stale crypto bits (Christian Borntraeger)
- crypto: qce - Remove unsafe/deprecated algorithms (Bartosz Golaszewski)
- crypto: mxs-dcp - fix source scatterlist length access (Thorsten Blum)
- crypto: qce - fix CCM AAD buffer underallocation (Md Sadre Alam)
- crypto: atmel-tdes - use scatterlist length before DMA mapping (Thorsten Blum)
- crypto: qcom-rng - Remove crypto_rng interface (Eric Biggers)
- crypto: qcom-rng - Allow zero as a random number (Eric Biggers)
- crypto: qcom-rng - Enable clock in hwrng case (Eric Biggers)
- mm/swap: reject swapon() on filesystem-level encrypted files (Eric Biggers)
- netfilter: nf_tables: don't queue packet path object notifications (Fourie Zhang) [Orabug: 39982164] {CVE-2026-80837}
- vxlan: keep the last remote linked during FDB flush (Kyle Zeng) [Orabug: 39982167] {CVE-2026-80838}
- batman-adv: reject unrepresentable multicast TVLV offsets (Kyle Zeng) [Orabug: 39982169] {CVE-2026-80839}
- ipv6: seg6: clear IPv4 control block on IPIP decapsulation (Kyle Zeng) [Orabug: 39982171] {CVE-2026-80840}
- net: bridge: mcast: fix use-after-free of a master VLAN's multicast context (Norbert Szetei) [Orabug: 39982179] {CVE-2026-80842}
- xfrm: bound nat keepalive state collection (Zihan Xi)
- xfrm: fix xfrm_state_construct() auth-trunc leak (Zihan Xi) [Orabug: 39982182] {CVE-2026-80843}
- xfrm: ah6: validate routing header segments_left (Asim Viladi Oglu Manizada) [Orabug: 39982186,40035125] {CVE-2026-80844}
- xfrm: avoid lock inversion in nat keepalive work (Zihan Xi) [Orabug: 39982190] {CVE-2026-80845}
- xfrm: drop ESP-in-TCP packets with no ingress device (Zhiling Zou)
- xfrm: espintcp: fix UAF during close (Sabrina Dubroca)
- net/tcp-ao: fix use-after-free of current_key on reconnect to another peer (Hyunwoo Kim)
- tcp: fix AO info use-after-free in tcp_ao_connect_init() (Qing Ming)
- net/tcp: fix TCP-AO key deletion in VRFs (Rastislav Szabo)
- x86/CPU/AMD: Carve out a Zen5 models range (Pratik Vishwakarma)
- gtp: serialize PDP context updates (Qing Ming) [Orabug: 39982207] {CVE-2026-80851}
- tls: device: fix out-of-bounds write in tls_append_frag() (Jiayuan Chen) [Orabug: 39982211] {CVE-2026-80852}
- usb: gadget: f_tcm: keep port count until LUN teardown completes (Shuangpeng Bai) [Orabug: 39982216] {CVE-2026-80854}
- usb: usbtest: disable dynamic ID support (Aleksandr Nogikh)
- fuse: fix invalidate lock leak on open O_TRUNC DAX failure (Baokun Li) [Orabug: 39982220] {CVE-2026-80855}
- fuse: fix invalidate lock leak on setattr writeback failure (Baokun Li) [Orabug: 39982223] {CVE-2026-80856}
- xhci: dbgtty: Fix unregister on tty_alloc_driver() failure (Lucas De Marchi)
- xhci: dbgtty: Fix unregister on tty_register_driver() failure (Lucas De Marchi) [Orabug: 40010371] {CVE-2026-80923}
- usb: xhci: Handle USB3 port events when there is one roothub (Semih Baskan)
- accessibility: speakup: unregister tty ldisc on later init failures (Haoxiang Li)
- fpga: dfl: fme: add error handling (Griffin Kroah-Hartman)
- HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() (Jose Villaseñor Montfort) [Orabug: 39981986] {CVE-2026-80783}
- Bluetooth: hci_sync: Fix accept list UAF during suspend (Chengfeng Ye) [Orabug: 39981936] {CVE-2026-80762}
- Bluetooth: hci_sync: Use bt_dev_err() to log error message in hci_update_event_filter_sync() (Zijun Hu)
- HID: uclogic: fix use-after-free of inrange_timer on remove (Ibrahim Hashimov) [Orabug: 39981948] {CVE-2026-80766}
- HID: ft260: fix stack-use-after-return write in I2C read race (Raman Varabets)
- HID: ft260: validate i2c input report length (Michael Zaidman)
- HID: asus: fix missing hid_is_usb() check (Jann Horn) [Orabug: 39981968] {CVE-2026-80774}
- HID: asus: simplify RGB init sequence (Antheas Kapenekakis)
- HID: pidff: fix OOB write when hid->inputs is empty (Baul Lee) [Orabug: 39981976] {CVE-2026-80780}
- HID: pidff: clang-format pass (Tomasz Pakuła)
- HID: pidff: Use ARRAY_SIZE macro instead of sizeof (Tomasz Pakuła)
- HID: pidff: Rework pidff_set_time() to fix warnings (Tomasz Pakuła)
- nfc: nci: add data_len bound checks to activation parameter extractors (Bryam Vargas)
- nilfs2: reject invalid block index in GC ioctl (Ryusuke Konishi)
- nilfs2: correct return value kernel-doc descriptions for ioctl functions (Ryusuke Konishi)
- ksmbd: harden file lifetime during session teardown (Daemyung Kang)
- powerpc/hv-gpci: fix preempt count leak in sysfs show paths (Aboorva Devarajan)
- veth: fix OOB txq access in veth_poll() with asymmetric queue counts (Jesper Dangaard Brouer)
- ring buffer: Propagate __rb_map_vma return value to caller (Ankit Khushwaha)
- selinux: switch two allocations to use kzalloc_objs() (Stephen Smalley)
- smc: Use __sk_dst_get() and dst_dev_rcu() in smc_vlan_by_tcpsk(). (Kuniyuki Iwashima)
- ASoC: nau8821: Cancel pending work before suspend (Cristian Ciocaltea)
- Revert "PM: sleep: Use complete() in device_pm_sleep_init()" (Sasha Levin)
- riscv: Fix register corruption from uninitialized cregs on error (Michael Neuling)
- bpf: Fix use-after-free in offloaded map/prog info fill (Jiayuan Chen) [Orabug: 39622046] {CVE-2026-53089}
- ASoC: nau8821: Cancel delayed work on component remove (Cristian Ciocaltea) [Orabug: 39451975] {CVE-2026-45963}
- smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (Kuniyuki Iwashima)
- smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set(). (Kuniyuki Iwashima)
- KVM: arm64: Prevent access to vCPU events before init (Oliver Upton) [Orabug: 38601895] {CVE-2025-40102}
- smc: Fix use-after-free in __pnet_find_base_ndev(). (Kuniyuki Iwashima)
- can: j1939: make j1939_sk_bind() fail if device is no longer registered (Tetsuo Handa)
- can: j1939: add missing calls in NETDEV_UNREGISTER notification handler (Tetsuo Handa)
- can: j1939: implement NETDEV_UNREGISTER notification handler (Tetsuo Handa) [Orabug: 38494826] {CVE-2025-39925}
- mISDN: hfcpci: Fix warning when deleting uninitialized timer (Vladimir Riabchun)
- media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() (Xu Wang)
- exfat: fix double free in delayed_free (Namjae Jeon) [Orabug: 38158565] {CVE-2025-38206}
- jfs: Fix null-ptr-deref in jfs_ioc_trim (Dylan Wolff)
- ibmvnic: Use kernel helpers for hex dumps (Nick Child)
- jfs: add check read-only before txBeginAnon() call (Vasiliy Kovalev)
- jfs: add check read-only before truncation in jfs_truncate_nolock() (Vasiliy Kovalev)
- perf: Reject exited events as group leaders (Kyle Zeng) [Orabug: 39973604] {CVE-2026-74753}
- selinux: require a class's permission values to cover its permission count (Bryam Vargas)
- selinux: reject a permission value exceeding the class permission count (Bryam Vargas) [Orabug: 39973489] {CVE-2026-80755}
- selinux: more strict policy parsing (Christian Göttsche)
- selinux: use u16 for security classes (Christian Göttsche)
- selinux: make more use of str_read() when loading the policy (Christian Göttsche)
- selinux: avoid unnecessary indirection in struct level_datum (Christian Göttsche)
- selinux: use known type instead of void pointer (Christian Göttsche)
- HID: uhid: convert to hid_safe_input_report() (Carlos Llamas)
- nvme-tcp: fix usage of page_frag_cache (Dmitry Bogdanov) [Orabug: 39982234] {CVE-2026-80862}
- io_uring/io-wq: fix worker accounting when canceling creation callbacks (Vishnu Razdan)
- ext4: don't enable DAX on new encrypted files (Eric Biggers) [Orabug: 39982069] {CVE-2026-80806}
- KVM: x86/mmu: Check write tracking in all address spaces (Jinu Kim)
- RDMA/rxe: Fix OOB in free_rd_atomic_resources() (Peiyang He) [Orabug: 39982236] {CVE-2026-80863}
- RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (Ibrahim Hashimov) [Orabug: 39982241] {CVE-2026-80864}
- LTS version: v6.12.107 (Sherry Yang)
- inet: frags: strip GSO state from fragments before reassembly (Xinyang Ge) [Orabug: 39972529] {CVE-2026-80590}
- LTS version: v6.12.106 (Sherry Yang)
- net: gro: properly validate BIG TCP aggregation criteria (Eric Dumazet) [Orabug: 40054426] {CVE-2026-80725}
- Bluetooth: hci_aml: validate firmware segment lengths (Laxman Acharya Padhya) [Orabug: 39981931] {CVE-2026-80759}
- Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync (Ali Ahmet Memis)
- Bluetooth: hci_event: validate LE Set CIG Parameters response (Laxman Acharya Padhya) [Orabug: 39981938] {CVE-2026-80763}
- Bluetooth: hci_event: fix LE list UAF on reset (Chengfeng Ye) [Orabug: 39981940] {CVE-2026-80764}
- HID: hyperv: validate initial device info bounds (Michael Bommarito) [Orabug: 39981944] {CVE-2026-80765}
- HID: sensor: custom: Fix use-after-free in enable_sensor (Haoxiang Li) [Orabug: 39981953] {CVE-2026-80767}
- HID: core: fix number/pointer type confusion on long items (Jann Horn) [Orabug: 40010352] {CVE-2026-80918}
- HID: nintendo: stop device IO before hid_hw_stop on probe failure (Jiangshan Yi)
- HID: nintendo: register input device after capabilities are set (Jiangshan Yi)
- HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() (Ibrahim Hashimov)
- Input: atkbd - skip deactivate for HONOR ZQC-P (Donglin Lyu)
- Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard (Cryolitia Pukngae)
- mptcp: pm: fix memory leak from alloc-during-teardown race (Shardul Bankar) [Orabug: 39981990] {CVE-2026-80784}
- ipv4: start using dst_dev_rcu() (Eric Dumazet) [Orabug: 38592180] {CVE-2025-40074}
- xfrm: fix sk_dst_cache double-free in xfrm_user_policy() (Xiang Mei) [Orabug: 39839295] {CVE-2026-64581}
- net/ionic: avoid OOB TX partner lookup for hwstamp RXQ (Anand Khoje) [Orabug: 39981974] {CVE-2026-80779}
- HID: core: fix OOB read of field->usage in hid_set_field() (Baul Lee) [Orabug: 39981978] {CVE-2026-80781}
- HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID (Lee Jones)
- HID: magicmouse: do not keep a stale msc->input if no input is claimed (Jose Villaseñor Montfort) [Orabug: 39981982] {CVE-2026-80782}
- HID: magicmouse: re-enable multitouch after reset-resume (Christopher Kodama)
- HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C (Andrei Fed)
- drm/xe: Fix DPT allocation paths. (Maarten Lankhorst) [Orabug: 40010344] {CVE-2026-80915}
- ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses (Dawid WróBel)
- mptcp: pm: fix data race in add_addr timer callback (Luoqing)
- nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations (Greg Kroah-Hartman) [Orabug: 39982001] {CVE-2026-80788}
- nvmet-tcp: bound SGL data length before allocating command buffers (Ibrahim Hashimov) [Orabug: 39982005] {CVE-2026-80789}
- nvmet-fc: fix invalid free in LS IOD error path (Honghui Jiang) [Orabug: 39982009] {CVE-2026-80790}
- nvmet-auth: zero the AUTH_RECEIVE response buffer (Bryam Vargas) [Orabug: 39982013] {CVE-2026-80791}
- ipv6: fix use-after-free in ip6_finish_output2() (Luxiao Xu) [Orabug: 39982016] {CVE-2026-80792}
- ipv4: reject undersized MTUs in ip_do_fragment() (Yong Wang) [Orabug: 39982020] {CVE-2026-80793}
- Input: byd - synchronize timer deletion before freeing private data (Linmao Li) [Orabug: 39972965] {CVE-2026-80572}
- ndisc: ndisc_send_redirect() cleanup (Eric Dumazet)
- nfc: nci: free destination parameters when closing a connection (Linmao Li)
- nfc: nci: fix uninit-value in the RF discover/activated NTF handlers (Samuel Page)
- nfc: nci: fix out-of-bounds write in nci_target_auto_activated() (Samuel Page)
- nfc: st21nfca: validate ATR_REQ length against the received frame (Doruk Tan Ozturk)
- nfc: pn533: purge fragmented skbs during cleanup (Xu Rao)
- nfc: llcp: reject PDUs shorter than the LLCP header (Doruk Tan Ozturk)
- nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers (Muhammad Bilal)
- nfc: llcp: bound the connect_sn TLV walk to the skb (Doruk Tan Ozturk)
- nfc: microread: validate target discovery payload lengths (Pengpeng Hou)
- nfc: fdp: bound the device-reported read length and fix an skb leak (Bryam Vargas)
- nfc: digital: clamp SENSF_RES length to the destination buffer (Doruk Tan Ozturk)
- libceph: fix OOB read in decode_watchers() via missing bounds check (Pavitra Jha) [Orabug: 39972905] {CVE-2026-80557}
- xfs: validate attr entry pointer before field access (Hongling Zeng) [Orabug: 39982066] {CVE-2026-80805}
- ext4: propagate errors from fast commit range replay (Guanghui Yang)
- ext4: clear error before retrying inode xattr space fallback (Guanghui Yang)
- ext4: stop retrying saturated xattr cache entries (Matthias Goergens) [Orabug: 39982076] {CVE-2026-80808}
- kcov: fix data corruption and race conditions on PREEMPT_RT (Tetsuo Handa) [Orabug: 40010346] {CVE-2026-80916}
- null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows (Rik van Riel)
- ocfs2: fix missing metadata reservation for large xattrs (Ian Bridges) [Orabug: 39982080] {CVE-2026-80809}
- ALSA: dummy: Check card index validity at probe (Takashi Iwai) [Orabug: 39982086] {CVE-2026-80812}
- xfs: don't livelock in scrub on a circular unlinked list (Darrick J. Wong) [Orabug: 39982105] {CVE-2026-80820}
- xfs: hoist per-bucket unlinked list check to helper (Darrick J. Wong)
- xfs: bounds-check buffer log item's dirty bitmap (Ibrahim Hashimov) [Orabug: 39972834] {CVE-2026-80536}
- xfs: don't use a xfs_log_iovec for ri_buf in log recovery (Christoph Hellwig)
- xfs: namespace the maximum length/refcount symbols (Darrick J. Wong)
- serial: sc16is7xx: enable THRI before filling TX FIFO (Luca Fresi)
- serial: sc16is7xx: use guards for simple mutex locks (Hugo Villeneuve)
- serial: sc16is7xx: rename EFR mutex with generic name (Hugo Villeneuve)
- serial: amba-pl011: synchronize DMA teardown (Fan Wu) [Orabug: 39973442] {CVE-2026-80737}
- NTB: ntb_netdev: Preserve RX queue depth on allocation failure (Koichiro Den) [Orabug: 39919081,40022771] {CVE-2026-74626}
- serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx (Ryan Wilbur) [Orabug: 39919154] {CVE-2026-74653}
- inet: frags: publish queues before arming timer (Zhiling Zou) [Orabug: 39919186,40022764] {CVE-2026-74662}
- inet: frags: save a pair of atomic operations in reassembly (Eric Dumazet)
- inet: frags: change inet_frag_kill() to defer refcount updates (Eric Dumazet)
- ipv4: frags: remove ipq_put() (Eric Dumazet)
- inet: frags: add inet_frag_putn() helper (Eric Dumazet)
- netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() (David Howells) [Orabug: 39785104] {CVE-2026-64216}
- hwmon: (ltc4286) Fix symbol namespace of MODULE_IMPORT_NS() (Nobuhiro Iwamatsu)
- gve: fix zero-length skb frag with header-split (Jordan Rhee)
- gpio: ml-ioh: use raw_spinlock_t for the register lock (Junjie Cao)
- rndis_host: add overflow check in rndis_rx_fixup() (Griffin Kroah-Hartman) [Orabug: 39982091] {CVE-2026-80814}
- ALSA: scarlett2: Use a private URB for the notification endpoint (Geoffrey D. Bennett) [Orabug: 39982096] {CVE-2026-80815}
- Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept (Ali Ahmet Memis) [Orabug: 39982101] {CVE-2026-80819}
- PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems (Steffen Persvold) [Orabug: 40010349] {CVE-2026-80917}
-
Tue Sep 01 2026 Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com> [6.12.0-207.105.2.el10uek]
- Revert "net/mlx5: Add poll-eq API to be used by ULP's" (Praveen Kumar Kannoju) [Orabug: 39890589]
- uek-rpm: add embedded4only build option (Joseph Dobosenski) [Orabug: 39878288]
- uek-rpm: allow zero module embedded builds (Joseph Dobosenski) [Orabug: 39878288]
- uek-rpm: revise embedded module packaging (Joseph Dobosenski) [Orabug: 39878288]
- uek: kabi: update x86_64 kABI files for new symbols (Saeed Mirzamohammadi) [Orabug: 39809826]
- kvm: x86: SRSO_USER_KERNEL_NO is not synthesized (Paolo Bonzini) [Orabug: 39641707]
- LTS version: v6.12.105 (Saeed Mirzamohammadi)
- net: ethernet: mtk_eth_soc: improve support for named interrupts (Daniel Golle)
- net: ethernet: mtk_eth_soc: only use legacy mode on missing IRQ name (Frank Wunderlich)
- ALSA: hda/realtek: Enable headset mic on F+ FLAPTOP r (Ajrat Makhmutov)
- ring-buffer: Use current_context for safe per-CPU buffer swap (Tengda Wu) [Orabug: 39919009] {CVE-2026-74601}
- ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() (Steven Rostedt)
- ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS (Eric Dumazet) [Orabug: 39969397] {CVE-2026-23459}
- binfmt_misc: use exe_file_deny_write_access() for the interpreter clone (Christian Brauner) [Orabug: 39969390] {CVE-2026-74486}
- fs: unlock the superblock during iterate_supers_type (Darrick J. Wong)
- perf/core: Fix group leader use-after-free after sibling detach (Aditya Chillara) [Orabug: 39919113] {CVE-2026-74637}
- perf: Unify perf_event_free_task() / perf_event_exit_task_context() (Peter Zijlstra)
- erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms (Gao Xiang)
- drm/xe/oa: Fix sync entry leak on OA config emit failure (Linmao Li) [Orabug: 39982343] {CVE-2026-80903}
- net/sched: cls_bpf: reject dev-bound programs bound to a different device (Jamal Hadi Salim) [Orabug: 39972725] {CVE-2026-74736}
- net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG (Siddharth Vadapalli)
- m68k: Define NR_CPUS to 1 (Uwe Kleine-König)
- net/sched: cls_u32: skip hash tables in u32_bind_class() (Zhang Changzhong) [Orabug: 39972734] {CVE-2026-74739}
- net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain (Jamal Hadi Salim) [Orabug: 39972739] {CVE-2026-74740}
- af_packet: Don't send zero-byte data in tpacket_snd(). (Eric Dumazet) [Orabug: 39973456] {CVE-2026-80742}
- ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers (Rosen Penev)
- net/tls: Fail tls_sw_splice_read() after a failed async decrypt (Chuck Lever) [Orabug: 39982345] {CVE-2026-80904}
- net: packet: fix wrong transport_header when sending VLAN-tagged frame (Wei Fang) [Orabug: 39982351] {CVE-2026-80906}
- tcp: fix icsk_ack.ato bitfield overflow (Jiayuan Chen)
- veth: fix queue index used to wake the peer txq in veth_poll (Jonas Köppeler) [Orabug: 39972745] {CVE-2026-74742}
- macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Eric Dumazet) [Orabug: 39972747] {CVE-2026-74743}
- ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Eric Dumazet) [Orabug: 39972751] {CVE-2026-74744}
- netfilter: ipset: let destroy callbacks adjust ext mem size (Florian Westphal)
- netfilter: ipset: fix list type element drift bug (Florian Westphal)
- netfilter: flowtable: publish GC-visible tuple last (Jérémy Jean) [Orabug: 39972759] {CVE-2026-74746}
- netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path (Alexey Velichayshiy) [Orabug: 39973465] {CVE-2026-80744}
- netfilter: ipset: fix refcount race between list:set GC and swap (Xiang Mei) [Orabug: 39972771] {CVE-2026-74748}
- crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (Vladis Dronov)
- crypto: ccm - Set rfc4309 maxauthsize from child (Herbert Xu)
- arm64: tegra: Add EL2 virtual timer interrupt for Tegra194 (Jonathan Hunter)
- net/x25: fix use-after-free of the socket by its timers (Baul Lee) [Orabug: 39919086] {CVE-2026-74628}
- ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget setup (Peter Ujfalusi) [Orabug: 39972801] {CVE-2026-80525}
- x86/mce: Set up the polling timer before CMCI discovery (Breno Leitao) [Orabug: 39973419] {CVE-2026-80727}
- x86/mce: Set CR4.MCE last during init (Yazen Ghannam)
- x86/mce: Remove __mcheck_cpu_init_early() (Yazen Ghannam)
- ring-buffer: Prevent resizing of persistent ring buffer (Vincent Donnefort)
- ring-buffer: Make ring_buffer_{un}map() simpler with guard(mutex) (Steven Rostedt)
- ring-buffer: Simplify ring_buffer_read_page() with guard() (Steven Rostedt)
- KVM: SVM: Serialize accesses to the owner and mirror list with separate lock (Paolo Bonzini) [Orabug: 39919026,39931893] {CVE-2026-74607}
- mm/ptdump: always stabilise against page table freeing using init_mm (Lorenzo Stoakes) [Orabug: 39919003] {CVE-2026-74599}
- mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF (Lorenzo Stoakes) [Orabug: 39919222] {CVE-2026-74672}
- ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer() (Vincent Donnefort) [Orabug: 39919013] {CVE-2026-74602}
- ring-buffer: Simplify functions with __free(kfree) to free allocations (Steven Rostedt)
- drm/vmwgfx: take fman->lock around fence list mutation in fifo_down (Zack Rusin)
- drm/amd/pm: fix pptable use-after-free (Yang Wang) [Orabug: 39886778] {CVE-2026-74450}
- drm/amd/pm: adjust the visibility of pp_table sysfs node (Yang Wang)
- drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini (Pierre-Eric Pelloux-Prayer)
- drm/amdgpu: remove unused function parameter (Yunxiang Li)
- drm/amd/pm: fix torn gpu metrics reads (Yang Wang)
- drm/amd/pm: Use macro to initialize metrics table (Lijo Lazar)
- drm/amd/pm: Use same metric table for APU (Asad Kamal)
- can: rcar_canfd: change the initializing flow for clocks and resets (Tu Nguyen)
- cifs: add fscache_resize_cookie() to cifs_setsize() (Frank Sorenson)
- smb: client: fix race with fallocate(2) and AIO+DIO (Paulo Alcantara)
- include/linux/fs.h: add inode_lock_killable() (Max Kellermann)
- ice: fix VF interrupts cleanup (Dawid Osuchowski)
- vxlan: use pskb_network_may_pull() for transmit path header pulls (Eric Dumazet) [Orabug: 39886859] {CVE-2026-74474}
- vxlan: Handle stats using NETDEV_PCPU_STAT_DSTATS. (Guillaume Nault)
- binfmt_misc: restore write access when removing an entry (Christian Brauner) [Orabug: 39886901,39931874] {CVE-2026-74487}
- fs: don't block write during exec on pre-content watched files (Amir Goldstein)
- fsnotify: opt-in for permission events at file open time (Amir Goldstein)
- fsnotify, lsm: Decouple fsnotify from lsm (Song Liu)
- binfmt_misc: don't leak the user namespace when the mount fails (Christian Brauner) [Orabug: 39886890] {CVE-2026-74483}
- net: pktgen: fix proc entry use-after-free (Chengfeng Ye) [Orabug: 39886874,39931868] {CVE-2026-74479}
- net: pktgen: fix code style (WARNING: Block comments) (Peter Seiderer)
- ksmbd: reject repeated SMB2 NEGOTIATE requests (Namjae Jeon)
- ksmbd: conn lock to serialize smb2 negotiate (Namjae Jeon)
- igc: remove napi_synchronize() in igc_down() (David Carlier) [Orabug: 39973386] {CVE-2026-80715}
- ata: libata-scsi: terminate deferred commands on time out (Damien Le Moal)
- ASoC: tas2562: Validate values for volume writes (Mark Brown)
- KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs (Weiming Shi) [Orabug: 39886991] {CVE-2026-74517}
- btrfs: zoned: fix missing chunk metadata reservation (Guanghui Yang)
- btrfs: remove fs_info argument from btrfs_zoned_activate_one_bg() (Filipe Manana)
- btrfs: add space_info argument to btrfs_chunk_alloc() (Naohiro Aota)
- btrfs: add debug build only WARN (David Sterba)
- iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace (Peiyang He) [Orabug: 39982323] {CVE-2026-80894}
- tcp: challenge ACK for non-exact RST in SYN-RECEIVED (Yuxiang Yang) [Orabug: 39859397,39931929] {CVE-2026-68118}
- tcp: reorganize tcp_sock_write_txrx group for variables later (Chia-Yu Chang)
- tcp: fast path functions later (Ilpo Järvinen)
- tcp: Pass flags to __tcp_send_ack (Ilpo Järvinen)
- eventpoll: pin files while checking reverse paths (Gui-Dong Han)
- ksmbd: validate minimum PDU size for transform requests (Namjae Jeon)
- smb/server: fix minimum SMB2 PDU size (Chenxiaosong)
- smb/server: fix minimum SMB1 PDU size (Chenxiaosong)
- ksmbd: rename smb2_get_msg to smb_get_msg (Namjae Jeon)
- smb/server: rename include guard in smb_common.h (Chenxiaosong)
- smb: move get_rfc1002_len() to common/smbglob.h (Zhangguodong)
- smb: move smb_version_values to common/smbglob.h (Zhangguodong)
- super: fix emergency thaw deadlock on frozen block devices (Christian Brauner) [Orabug: 39859441] {CVE-2026-68132}
- fs/super: fix emergency thaw double-unlock of s_umount (Chenchangcheng) [Orabug: 39969395] {CVE-2026-68150}
- super: use common iterator (Part 2) (Christian Brauner)
- super: use a common iterator (Part 1) (Christian Brauner)
- super: skip dying superblocks early (Christian Brauner)
- super: remove pointless s_root checks (Christian Brauner)
- net/sched: serialize qdisc_rtab_list against concurrent get/put (Aldo Ariel Panzardo) [Orabug: 39859461,39931864] {CVE-2026-68138}
- libceph: fix two unsafe bare decodes in decode_lockers() (Pavitra Jha) [Orabug: 39852161] {CVE-2026-68082}
- userfaultfd: prevent registration of special VMAs (Mike Rapoport) [Orabug: 39859558,39931866] {CVE-2026-68166}
- mm/khugepaged: guard is_zero_pfn() calls with pte_present() (Lance Yang)
- libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (Xiang Mei) [Orabug: 39859533] {CVE-2026-68159}
- libceph: Amend checking to fix `make W=1` build breakage (Andy Shevchenko)
- ceph: fix hanging __ceph_get_caps() with stale mds_wanted (Max Kellermann) [Orabug: 39972806] {CVE-2026-80527}
- ceph: avoid fs reclaim while using current->journal_info (Max Kellermann) [Orabug: 39972809] {CVE-2026-80528}
- ceph: fix writeback_count leak in write_folio_nounlock() (Xu Wang)
- ceph: Convert writepage_nounlock() to write_folio_nounlock() (Matthew Wilcox)
- ceph: Convert ceph_find_incompatible() to take a folio (Matthew Wilcox)
- ceph: Use a folio in ceph_page_mkwrite() (Matthew Wilcox)
- ceph: Remove ceph_writepage() (Matthew Wilcox)
- xfs: check v5 superblock features early (Christoph Hellwig)
- xfs: check xfarray iteration errors when committing unlinked inode lists (Darrick J. Wong)
- xfs: don't swallow dquot recovery verification errors (Long Li) [Orabug: 39972813] {CVE-2026-80529}
- xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lin Jiapeng) [Orabug: 39972815,40078696] {CVE-2026-80530,CVE-2026-97547}
- xfs: avoid UAF on sc->tempip in xrep_tempfile_create (Darrick J. Wong) [Orabug: 39972817] {CVE-2026-80531}
- xfs: don't return EFSCORRUPTED when scrubbing corrupt parent pointers (Darrick J. Wong)
- xfs: fix another iunlink infinite loop bug in online fsck (Darrick J. Wong) [Orabug: 39972819] {CVE-2026-80532}
- xfs: fix allocated inodes that show up in the unlinked list (Darrick J. Wong)
- xfs: don't walk off the end of a null sc->sa.agi_bp in AGI repair (Darrick J. Wong) [Orabug: 39972821] {CVE-2026-80533}
- xfs: don't zap the attr fork on repair when there are queued pptr updates (Darrick J. Wong)
- xfs: fix ilock leak on error in xfs_dq_get_next_id (Long Li) [Orabug: 39972824] {CVE-2026-80534}
- xfs: load next_agino from the correct xfarray in xrep_iunlink_relink_prev (Darrick J. Wong)
- xfs: nlink scrub must take IOLOCK before determining ILOCK state (Darrick J. Wong)
- xfs: pass runtime errors from xrep_iunlink_mark_ondisk_rec up to callers (Darrick J. Wong)
- xfs: set the prev pointer when reinserting an inode on the unlinked list (Darrick J. Wong)
- xfs: don't double-lock when deleting a self-referential directory (Darrick J. Wong) [Orabug: 39972831] {CVE-2026-80535}
- xfs: only check mergeability of bnobt records (Darrick J. Wong)
- xfs: zero i_nlink before repair puts inode on unlinked list (Darrick J. Wong)
- xfs: clear zapped attr fork state when bmap repair finds no attr fork (Maqiang)
- drm/amdgpu: disallow multiple FENCE chunks in one submit (Junrui Luo) [Orabug: 39972841] {CVE-2026-80539}
- drm/amdgpu: Fix UVD decode image min size calculation (David Rosca) [Orabug: 39972846] {CVE-2026-80540}
- drm/amdgpu: Fix UVD dpb min size calculation for H264 (David Rosca) [Orabug: 39982356] {CVE-2026-80907}
- drm/amdgpu: Fix UVD min buffer sizes (David Rosca)
- drm/amdgpu: Implement insert_end for VCE 3 (David Rosca)
- drm/amdgpu: Reject UVD message with dimensions above 4096 (David Rosca) [Orabug: 39982360] {CVE-2026-80908}
- drm/amdgpu: validate GEM_CREATE domain combinations (Candice Li) [Orabug: 39972851] {CVE-2026-80541}
- drm/amdgpu: check ASPM on the dGPU host link (Yang Wang)
- drm/amdgpu: fix nbif 6.3.1 l1 low power not functional (Yang Wang)
- drm/amdgpu: Reject UVD message with invalid number of h265 refs (David Rosca) [Orabug: 39982364] {CVE-2026-80909}
- drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE (Nathan Lucas)
- drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix (Nathan Lucas)
- s390/vfio_ccw: Implement a crw lock (Eric Farman)
- s390/vfio_ccw: Calculate idal length based on idaw type (Eric Farman)
- s390/vfio_ccw: Selectively expand io_mutex (Eric Farman)
- s390/vfio_ccw: Move cp cleanup out of not operational (Eric Farman)
- s390/vfio_ccw: Fix out of bounds check on CCW array (Eric Farman)
- s390/vfio_ccw: Ensure first IDAW remains constant (Eric Farman)
- s390/vfio_ccw: Ensure index for read/write regions are within range (Eric Farman)
- s390/vfio_ccw: Cancel existing workqueues (Eric Farman)
- s390/vfio_ccw: Limit the number of channel program segments (Eric Farman)
- s390/vfio_ccw: Free all memory if cp_init() fails (Eric Farman)
- drm/radeon: fix autosuspend cleanup during teardown (Guangshuo Li)
- drm/xe: Order ring writes before ring tail updates (Matthew Brost)
- drm/connector/hdmi: Fix out of bounds memory read (John Harrison) [Orabug: 39973476] {CVE-2026-80749}
- mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition (Pei Xiao)
- mmc: sdhci: make tuning_err a signed int (Haibo Chen)
- mmc: sdhci: unmap the bounce buffer before device release (Myeonghun Pak)
- mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit (Zhan Xusheng)
- libceph: tolerate addrvecs with multiple entries of the same type (Kefu Chai)
- ceph: fix MDS random selection readiness predicate (Yiming Zhu)
- libceph: Avoid using invalid osd indices from primary_temp (Raphael Zimmer) [Orabug: 39972914] {CVE-2026-80558}
- Input: sur40 - fix V4L error path cleanup (Dmitry Torokhov)
- Input: sur40 - fix input device registration ordering (Dmitry Torokhov)
- openrisc: signal: do not restore privileged SR bits on sigreturn (Ali Ahmet Memis)
- ftrace: Fix off-by-one fentry site disable in ftrace_free_mem() (Josh Poimboeuf)
- ftrace: Protect direct_functions in ftrace_find_rec_direct (Leon Hwang)
- libceph: fix multiple unsafe decodes in decode_locker() (Pavitra Jha) [Orabug: 39972926] {CVE-2026-80561}
- pmdomain: arm: Fix -EINVAL from scmi_pd_set_perf_state() on state 0 (Praveen Talari)
- gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind (Cengiz Can)
- crypto: qce - fix error path in devm_qce_register_algs (Thorsten Blum)
- crypto: starfive - use scatterlist length before DMA mapping (Thorsten Blum)
- Input: hynitron_cstxxx - validate touch count and finger IDs (Jianing Li)
- Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue (Dmitry Torokhov)
- Input: synaptics-rmi4 - block s_input when F54 queue is busy (Dmitry Torokhov)
- Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer (Bryam Vargas) [Orabug: 39972954] {CVE-2026-80569}
- Input: synaptics-rmi4 - zero report size on F54 work error (Dmitry Torokhov) [Orabug: 39972959] {CVE-2026-80570}
- powerpc/pseries: lparcfg - fix kbuf[] underflow (George Wilson)
- Input: iforce - validate input packet lengths (Pengpeng Hou)
- Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard (Zhefu Zhang)
- Input: psxpad-spi - set driver data before use (Linmao Li)
- Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet (Richard Davies) [Orabug: 39972974] {CVE-2026-80574}
- Input: synaptics-rmi4 - fix F55 transmitter electrode count typo (Dmitry Torokhov) [Orabug: 39973485] {CVE-2026-80754}
- powerpc/pseries: pci - logic bug (George Wilson)
- Input: cs40l50-vibra - validate custom data from user space (Hyeongjun An)
- Input: xpad - add support for ZENAIM LEVERLESS (Kadota, Kyohei)
- ASoC: SOF: topology: Use acpi mach from the machine driver (Bard Liao)
- drm/amdgpu: fix aperture iounmap skipped on device removal (Asad Kamal)
- drm/amdgpu: read TRUNCATE_COORD_MODE on gfx12 (Qiang Yu)
- drm/amdgpu: reject oversized IBs with per-ring packet limits (Candice Li) [Orabug: 39972981] {CVE-2026-80576}
- drm/panthor: skip zero-sized firmware sections (Osama Abdelkader)
- fbdev: core: Fix pointer desynchronization in fb_io_read() (Mingyu Wang) [Orabug: 39972989] {CVE-2026-80578}
- ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses (Dawid WróBel)
- ASoC: cs35l41: sort the register default table (Peter Ujfalusi)
- ASoC: cs35l45: sort the register default table (Peter Ujfalusi)
- ASoC: cs4265: sort the register default table (Peter Ujfalusi)
- ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() (Peter Ujfalusi) [Orabug: 39982371] {CVE-2026-80911}
- s390/qeth: validate user buffer length in SNMP and ARP query ioctls (Hidayath Khan)
- mptcp: fastopen: only mark MPTFO subflows with SYN data (Wyatt Feng) [Orabug: 39973010] {CVE-2026-80585}
- mptcp: options: reset DSS fields in case of unexpected size (Matthieu Baerts) [Orabug: 39973012] {CVE-2026-80586}
- mptcp: avoid combining some incoming suboptions (Matthieu Baerts) [Orabug: 39973015] {CVE-2026-80587}
- selftests: mptcp: join: mark tests with data corruption as failed (Gang Yan)
- selinux: reject an unclaimed class value in security_get_classes() (Bryam Vargas) [Orabug: 39982373] {CVE-2026-80912}
- selinux: do not cancel a policy conversion that never started (Bryam Vargas) [Orabug: 39973493] {CVE-2026-80756}
- selinux: reject a class permission count below its inherited common (Bryam Vargas) [Orabug: 39973497] {CVE-2026-80757}
- selinux: require every boolean value to be defined (Bryam Vargas) [Orabug: 39982380] {CVE-2026-80913}
- KVM: SVM: Ensure PSP module is initialized if KVM module is built-in (Sean Christopherson)
- crypto: ccp: Add external API interface for PSP module initialization (Sean Christopherson)
- net: mana: Fix EQ leak in mana_remove on NULL port (Erni Sri Satya Vennela)
- ipvs: separate destination availability state (Yizhou Zhao)
- igc: fix netdev not re-attached after resume if interface is down (Philipp David)
- mm/damon: adjust isolated pages stat for DAMOS_MIGRATE_{HOT,COLD} (Seongjae Park)
- mm/damon/ops-common: putback folios on invalid migrate nid (Liyouhong) [Orabug: 39919129,39931902] {CVE-2026-74644}
- ubi: fastmap: fix ubi->fm memory leak (Pangliyuan)
- mtd: ubi: skip programming unused bits in ubi headers (Cheng Ming Lin)
- f2fs: fix UAF issue in f2fs_merge_page_bio() (Chao Yu)
- selftests/bpf: Add tests for stale delta leaking through id reassignment (Daniel Borkmann)
- selftests/bpf: Add tests for delta tracking when src_reg == dst_reg (Daniel Borkmann)
- bpf: Clear delta when clearing reg id for non-{add,sub} ops (Daniel Borkmann)
- bpf: Fix linked reg delta tracking when src_reg == dst_reg (Daniel Borkmann) [Orabug: 39622057] {CVE-2026-53092}
- block: stop the timeout timer when releasing a never added disk (Chao Shi) [Orabug: 39973019] {CVE-2026-80589}
- LTS version: v6.12.104 (Saeed Mirzamohammadi)
- bpf: tcp: fix double sock release on batch realloc (Xiang Mei) [Orabug: 39969416] {CVE-2026-64575}
- thunderbolt: Fix bandwidth group reservation indexing (Xu Rao) [Orabug: 39973440] {CVE-2026-80736}
- thunderbolt: Bound the DROM dual link port number before indexing sw->ports (Bryam Vargas) [Orabug: 39918960] {CVE-2026-74585}
- sctp: clear new_transport when removing a peer (Qing Ming) [Orabug: 39918964] {CVE-2026-74586}
- sctp: fix use-after-free of cached ASCONF chunk (Yuxiang Yang) [Orabug: 39918968] {CVE-2026-74587}
- sctp: keep chunk->transport in step with the list it is queued on (Baul Lee) [Orabug: 39918972] {CVE-2026-74588}
- scsi: scsi_debug: Negate wrapped memcmp() result (Xu Rao)
- bpf, sockmap: Fix sk_redir use-after-free in send verdict (Chengfeng Ye) [Orabug: 39918976] {CVE-2026-74589}
- fsverity: Fix silent truncation in bpf_get_fsverity_digest() (Eric Biggers)
- fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions (Eric Biggers) [Orabug: 39918980] {CVE-2026-74590}
- ima: Instantiate file_truncate and path_truncate hooks (Mimi Zohar) [Orabug: 39918983] {CVE-2026-74592}
- sched/psi: Shut down rtpoll_timer in psi_cgroup_free() (Tejun Heo) [Orabug: 39918988] {CVE-2026-74594}
- fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() (Zhan Xusheng) [Orabug: 39918991] {CVE-2026-74595}
- ip6_tunnel: clear skb2->cb[] in ip6ip6_err() (Zhiling Zou) [Orabug: 39918995] {CVE-2026-74597}
- ipv6: fix Route Information option length validation (Yuejie Shi) [Orabug: 39918999] {CVE-2026-74598}
- ptp: ocp: Fix board ID over-read (Ahmad Byagowi) [Orabug: 39919015] {CVE-2026-74603}
- Revert "thermal/drivers/hwmon: Cleanup coding style a bit" (Rafael J. Wysocki) [Orabug: 39919018] {CVE-2026-74604}
- eventfs: Fix use-after-free in eventfs_remove_rec() (Shuangpeng Bai) [Orabug: 39919024] {CVE-2026-74606}
- KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page (Sean Christopherson) [Orabug: 39973414] {CVE-2026-80726}
- smb: client: Fix use-after-free in cifs_try_adding_channels() (Shuangpeng Bai) [Orabug: 39919029] {CVE-2026-74608}
- tipc: read le->link under the node lock in tipc_node_link_down() (Jun Yang) [Orabug: 39919031] {CVE-2026-74609}
- tls: don't leave a full plaintext sk_msg ring unpushed (Chanyoung) [Orabug: 39919035] {CVE-2026-74610}
- vhost: reset the vring metadata cache on vring reconfiguration (Jun Yang) [Orabug: 39917524] {CVE-2026-74580}
- veth: fix skb length accounting after XDP frag adjustment (Sun Jian) [Orabug: 39919039] {CVE-2026-74612}
- vsock/virtio: avoid refilling the RX queue after teardown (Weiming Shi) [Orabug: 39919041] {CVE-2026-74613}
- vsock/virtio: read virtqueues under worker locks (Weiming Shi) [Orabug: 39919045] {CVE-2026-74614}
- vxlan: do not arm the ageing timer on a device that is down (Baul Lee) [Orabug: 39919048] {CVE-2026-74615}
- xdp: reject clones that overrun skb_shared_info tailroom (Zhiling Zou) [Orabug: 39919052] {CVE-2026-74616}
- Revert "drm/amdgpu: fix aperture mapping leak" (Asad Kamal) [Orabug: 39973598] {CVE-2026-80728}
- binfmt_misc: don't warn when the mount is completed from another user namespace (Christian Brauner) [Orabug: 39919056] {CVE-2026-74618}
- ovl: don't warn when the mount is completed from another user namespace (Christian Brauner) [Orabug: 39919058] {CVE-2026-74619}
- net/sched: act_gact, act_police: range check the fallback control action (Hyunjung Ko) [Orabug: 39919060] {CVE-2026-74620}
- net/sched: act_ct: fix sk_buff leak when the header checks reject a packet (Hyunjung Ko) [Orabug: 39919064] {CVE-2026-74621}
- net: atlantic: free RX pages of consumed but not refilled buffers (Yangyu Chen) [Orabug: 39919067] {CVE-2026-74622}
- net: atlantic: free stranded TX buffers on ring deinit (Yangyu Chen) [Orabug: 39919071] {CVE-2026-74623}
- netfilter: nf_conntrack: defer invalid log until after unlock (Zihan Xi) [Orabug: 39919075] {CVE-2026-74624}
- netfilter: bridge: release template ct on non-IP path (Zhiling Zou) [Orabug: 39919077] {CVE-2026-74625}
- ipv6: prevent in6_dev_get() from resurrecting inet6_dev (Kyle Zeng) [Orabug: 39919091] {CVE-2026-74630}
- net: smc: fix splice entry lifetime imbalance in smc_rx_splice (Li Daming)
- mm/huge_memory: fix huge_zero_pfn race (Lorenzo Stoakes) [Orabug: 39919099] {CVE-2026-74632}
- ring-buffer: Prevent subbuf order change when resizing is disabled (Vincent Donnefort) [Orabug: 39919104] {CVE-2026-74634}
- fbdev: bitblit: bound-check glyph index in bit_cursor() (Rik van Riel) [Orabug: 39919106] {CVE-2026-74635}
- tracing: Fix race between update_event_fields and, event_define_fields (Michael Wu) [Orabug: 39919110] {CVE-2026-74636}
- ALSA: usx2y: bound the hwdep mmap fault offset (Baul Lee) [Orabug: 39919123] {CVE-2026-74641}
- ALSA: usb: Fix UAF at delayed release of MIDI2 EPs (Takashi Iwai) [Orabug: 39969546] {CVE-2026-74642}
- ring-buffer: Fix crash passing ERR_PTR to kthread_stop() (Sh_Def) [Orabug: 39973424] {CVE-2026-80730}
- misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free (Eddie Lin)
- misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke (Junrui Luo)
- misc: fastrpc: Remove buffer from list prior to unmap operation (Ekansh Gupta)
- misc: fastrpc: fix channel ctx ref leak when session alloc fails (Anandu Krishnan E)
- staging: rtl8723bs: validate monitor transmit frame lengths (Mariano Baragiola)
- staging: rtl8723bs: fix missing shared-key auth challenge length check (Panagiotis Petrakopoulos)
- staging: rtl8723bs: fix OOB read in WMM_param_handler() (Muhammad Bilal)
- staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() (Muhammad Bilal)
- serial: 8250_dma: Clear stale RX state on shutdown (Cunhao Lu) [Orabug: 39919158] {CVE-2026-74654}
- serial: qcom-geni: fix TX DMA buffer flush (Jan Sebastian Götte)
- nvmem: layouts: Add fixed-layout driver (Mathieu Dubois-Briand)
- mei: pull kvfree out of spinlock (Alexander Usyskin)
- ipv4: fix use-after-free in fib_nhc_update_mtu() (Chengfeng Ye) [Orabug: 39919164] {CVE-2026-74656}
- ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops (Zihan Xi) [Orabug: 39919168] {CVE-2026-74657}
- selftests/bpf: Adapt sockmap update error handling (Michal Luczaj)
- selftests/bpf: Ensure UDP sockets are bound (Michal Luczaj)
- pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP (Claudiu Beznea)
- kunit/fortify: Add back "volatile" for sizeof() constants (Kees Cook)
- kunit/fortify: Replace "volatile" with OPTIMIZER_HIDE_VAR() (Kees Cook)
- futex: Prevent robust futex exit race some more (Keno Fischer) [Orabug: 39919173] {CVE-2026-74658}
- crypto: ccp - Abort doing SEV INIT if SNP INIT fails (Ashish Kalra)
- crypto: ccp - Fix checks for SNP_VLEK_LOAD input buffer length (Michael Roth)
- KVM: SVM: Add support to initialize SEV/SNP functionality in KVM (Ashish Kalra)
- crypto: ccp - Add new SEV/SNP platform shutdown API (Ashish Kalra)
- dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk (Harshal Dev)
- block: Reorder the request allocation code in blk_mq_submit_bio() (Bart Van Assche)
- KVM: s390: pci: Fix aisb calculation (Matthew Rosato)
- KVM: s390: pci: Fix resource leak on IRQ registration failure (Farhan Ali)
- KVM: s390: pci: Fix missing error codes and memory unaccounting (Farhan Ali)
- KVM: s390: pci: Fix memory accounting for pinned/unpinned pages (Farhan Ali)
- net: bridge: mrp: fix uninitialised bytes on the wire (Baul Lee)
- netfilter: ebt_nflog: pin the NFLOG backend (Chengfeng Ye) [Orabug: 39919180] {CVE-2026-74660}
- mac802154: fix netdev use-after-free in beacon worker (Zihan Xi) [Orabug: 39919184] {CVE-2026-74661}
- net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Qihang) [Orabug: 39973426] {CVE-2026-80731}
- net: octeontx2-pf: Fix UB in shift operation (Sergey V. Frolov)
- net/sched: reject overly deep qdisc hierarchies (Zijie Huang) [Orabug: 39919190] {CVE-2026-74663}
- net: openvswitch: reallocate update replies for mismatched IDs (Zhiling Zou) [Orabug: 39919194] {CVE-2026-74664}
- net: fix skb length accounting after generic XDP frag adjustment (Sun Jian) [Orabug: 39919198] {CVE-2026-74665}
- packet: synchronize pressure clearing with ring reconfiguration (Zihan Xi) [Orabug: 39919200] {CVE-2026-74666}
- net/packet: reset the MAC header on the packet-socket transmit path (Doruk Tan Ozturk) [Orabug: 39919204] {CVE-2026-74667}
- packet: use consistent hard_header_len in TX_RING send path (Qihang) [Orabug: 39919208] {CVE-2026-74668}
- packet: use consistent hard_header_len in non-ring send paths (Qihang) [Orabug: 39917532] {CVE-2026-74582}
- ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Kyle Zeng) [Orabug: 39919212] {CVE-2026-74669}
- ipvs: properly update the overload flag on dest edit (Julian Anastasov)
- ipvs: add totalconns for dest (Julian Anastasov)
- ipvs: stop estimator after disabled calc phase (Zhiling Zou) [Orabug: 39919216] {CVE-2026-74670}
- ima: fix out-of-bounds read in xattr_verify() (Lincoln Wallace) [Orabug: 39919218] {CVE-2026-74671}
- Input: evdev - fix information leak in evdev_pass_values() (Dmitry Torokhov) [Orabug: 39919226] {CVE-2026-74673}
- vt: stabilize tty reference in kbd_keycode with tty_port_tty_get (Joshua Rogers) [Orabug: 39919231] {CVE-2026-74675}
- vt: add permission check for KDSKBMETA ioctl (Joshua Rogers) [Orabug: 39919235] {CVE-2026-74676}
- net: usb: ipheth: fix carrier_work UAF on disconnect (Doruk Tan Ozturk) [Orabug: 39919239] {CVE-2026-74677}
- net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() (Yi Cong) [Orabug: 39919243] {CVE-2026-74678}
- usb: gadget: f_ncm: Use unsigned int for ndp_index (Sonali Pradhan)
- usb: cdnsp: fix incorrect endian conversions for APB timeout register (Pawel Laszczak)
- thunderbolt: icm: Preserve USB4 proxy data-valid bit (Xu Rao)
- usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() (Aleksandr Nogikh) [Orabug: 39919250] {CVE-2026-74680}
- ALSA: usb-audio: fix OOB write on Type II inbound URBs (Baul Lee) [Orabug: 39919255] {CVE-2026-74682}
- Input: evdev - sanitize event type index when fetching event masks (Dmitry Torokhov) [Orabug: 39919259] {CVE-2026-74683}
- swapfile: call cond_resched() before locking si->lock (Guillaume Morin)
- mtd: spinand: repeat reading in regular mode if continuous reading fails (Mikhail Kshevetskiy)
- mtd: spinand: try a regular dirmap if creating a dirmap for continuous reading fails (Mikhail Kshevetskiy)
- mtd: spinand: fix direct mapping creation sizes (Mikhail Kshevetskiy)
- spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers (Larisa Grigore)
- net: fec: do not release NULL pages when RX buffer allocation fails (Mehmet Fide)
- hwmon: (ltc4282) Fix parsing adi,current-limit-sense-microvolt (Guenter Roeck)
- hwmon: (ltc4282) Clamp negative current limits (Guenter Roeck)
- hwmon: (ltc4282) Avoid overflow in maximum power calculation (Guenter Roeck)
- hwmon: (ads7828) Fix external VREF regulator handling (Qingshuang Fu)
- hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination (Wilken Gottwalt)
- tls: don't abort the connection on signal-interrupted sends (Maximilian Immanuel Brandtner)
- sctp: clear control chunk transport if it is being removed (Xin Long) [Orabug: 39919274] {CVE-2026-74688}
- net/atm: fix slab-out-of-bounds read in vcc_setsockopt() (Eric Dumazet) [Orabug: 39919278] {CVE-2026-74689}
- ata: pata_sl82c105: fix bridge revision use-after-free (Hongyan Xu)
- net: thunderbolt: Tear down DMA paths before stopping the rings (Fan Xinran) [Orabug: 39919286] {CVE-2026-74691}
- net/smc: fix TOCTOU race between smc_listen_out() and listener close (Sidraya Jayagond)
- net: remove WARN_ON_ONCE() from sk_mc_loop() (Eric Dumazet) [Orabug: 39973434] {CVE-2026-80733}
- net: prestera: validate firmware header length (Pengpeng Hou)
- net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length (Henry Martin)
- tcp: fix TFO max_qlen accounting across reuseport migration (Jiayuan Chen) [Orabug: 39919305] {CVE-2026-74696}
- sctp: fix addip_serial increment on ASCONF_ACK allocation failure (Luoqing)
- bnxt_en: Fix PTP PPS setting bug (Keegan Freyhof)
- bnxt_en: Refresh VNIC default ring on queue restart if needed (Shravya Kn)
- bnxt_en: Determine and store default RX ring in vnic structure (Shravya Kn)
- bnxt_en: Move RSS table fill outside __bnxt_hwrm_vnic_set_rss() (Shravya Kn)
- selftests/ftrace: refactor eprobes test to fix argument checks (Martin Kaiser)
- hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations (Guenter Roeck)
- hwmon: (nzxt-smart2) Check return value of init_device() in probe (Qingshuang Fu)
- net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers (Jamal Hadi Salim) [Orabug: 39919315] {CVE-2026-74700}
- net/openvswitch: check Ethernet header length in key_extract() (Cen Zhang) [Orabug: 39919319] {CVE-2026-74701}
- net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter (Toke Høiland-Jørgensen) [Orabug: 39919329] {CVE-2026-74704}
- udp: fix potential use-after-free in tunnel segmentation (Luoxuanqiang) [Orabug: 39919333] {CVE-2026-74705}
- xsk: require at least 16 bytes of TX metadata (Stanislav Fomichev) [Orabug: 39919341] {CVE-2026-74710}
- tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss() (Nathan Gao)
- vdpa/mlx5: Fix buffer length in create_direct_keys() (Christian Borntraeger) [Orabug: 39919345] {CVE-2026-74712}
- vhost/vdpa: reject overflowing PA map page counts on 32-bit (Yousef Alhouseen)
- bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() (Jose Fernandez) [Orabug: 39919352] {CVE-2026-74714}
- bpf: tcp: Avoid socket skips and repeats during iteration (Jordan Rife)
- bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items (Jordan Rife)
- bpf: tcp: Get rid of st_bucket_done (Jordan Rife)
- bpf: tcp: Make sure iter->batch always contains a full bucket snapshot (Jordan Rife)
- bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch (Jordan Rife)
- counter: microchip-tcb-capture: Fix DT channel validation (Babanpreet Singh)
- net/mlx5: fw_tracer, return NULL on create error (Michael Guralnik) [Orabug: 39919358] {CVE-2026-74717}
- devlink: fix net namespace reference leak in reload (Or Har-Toov) [Orabug: 39919362] {CVE-2026-74718}
- net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete (Jiawen Liu)
- net/sched: cls_route: fix fastmap use-after-free on filter (Jamal Hadi Salim) [Orabug: 39917537] {CVE-2026-74583}
- net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() (Mahanta Jambigi)
- bpf: Preserve pointer state for commuted arithmetic (Yiyang Chen) [Orabug: 39919368] {CVE-2026-74720}
- btrfs: fix memory leak in btrfs_do_encoded_write() (Dmitry Antipov) [Orabug: 39919373] {CVE-2026-74722}
- watchdog: bd96801_wdt: Fix timeout for enabled WDG (Matti Vaittinen)
- ipvs: return the csum validation for forward hook (Julian Anastasov)
- ipvs: avoid out-of-bounds write in ip_vs_nat_icmp (Julian Anastasov) [Orabug: 39919379] {CVE-2026-74724}
- netfilter: ipset: switch ext_size to atomic64_t (Jozsef Kadlecsik)
- pds_core: cancel pending PCI reset work on AER recovery (Nikhil P. Rao)
- pds_core: keep the health thread stopped during reset (Nikhil P. Rao)
- net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock (Shay Drory) [Orabug: 39973450] {CVE-2026-80739}
- enic: fix tx_hang_reset use-after-free on device removal (Satish Kharat) [Orabug: 39919383] {CVE-2026-74725}
- bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor (Xiang Mei) [Orabug: 39919387] {CVE-2026-74726}
- Revert "net: thunderbolt: Enable end-to-end flow control also in transmit" (Fan Ye)
- net: hns3: fix speed configuration residue after driver reload (Jijie Shao)
- drm/bridge: ps8640: propagate AUX transfer register errors (Pengpeng Hou)
- ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt (Rosen Penev)
- ARM: npcm: Fix OF node refcount leaks in SMP setup (Yuho Choi)
- arm64: dts: broadcom: bcm2712: Remove non-functional EL2 virtual timer (Daniel Drake)
- NFS: Pin the 'struct nfs_server' during a FREE_STATEID call (Anna Schumaker) [Orabug: 39919398] {CVE-2026-74730}
- s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() (Harald Freudenberger)
- drm/amd/display: Check for tg ops in dce110_set_avmute (Ray Wu) [Orabug: 39919403] {CVE-2026-74732}
- drm/amd/display: Add AV mute wait frames to dce110_set_avmute (Ray Wu)
- selftests/bpf: Fail unbound UDP on sockmap update (Michal Luczaj)
- mount: honour SB_NOUSER in the new mount API (Al Viro)
- LTS version: v6.12.103 (Saeed Mirzamohammadi)
- drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info (Thomas Zimmermann)
- drm/fb-helper: Fix a locking bug in an error path (Bart Van Assche)
- usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path (Andrei Kuchynski)
- can: isotp: fix timer drain order, wakeup handling and tx_gen ordering (Oliver Hartkopp) [Orabug: 39982402] {CVE-2026-80889}
- can: use skb hash instead of private variable in headroom (Oliver Hartkopp)
- rxrpc: Fix irq-disabled in local_bh_enable() (David Howells) [Orabug: 39969414] {CVE-2025-38525}
- rxrpc: Manage RTT per-call rather than per-peer (David Howells)
- rxrpc: Fix the calculation and use of RTO (David Howells)
- rxrpc: Adjust the rxrpc_rtt_rx tracepoint (David Howells)
- rxrpc: Generate rtt_min (David Howells)
- drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Zongyao Bai) [Orabug: 39859863] {CVE-2026-68264}
- drm/xe: Stub out new pagefault layer (Matthew Brost)
- drm/i915/hdcp: check streams[] bounds before overflow (Jani Nikula) [Orabug: 39859827] {CVE-2026-68253}
- drm/i915/hdcp: Skip inactive MST connectors when building stream list (Suraj Kandpal)
- drm/i915/hdcp: require monotonically increasing seq_num_v (Jani Nikula)
- drm/i915/hdcp: Move to using intel_display in intel_hdcp (Suraj Kandpal)
- drm/xe: Hold a dma-buf reference for imported BOs (Gote, Nitin R) [Orabug: 39859867] {CVE-2026-68266}
- drm/xe: Rename ___xe_bo_create_locked() (Thomas Hellström)
- drm/i915/vrr: require valid min/max vfreq for VRR (Jani Nikula) [Orabug: 39859831] {CVE-2026-68254}
- drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable() (Ville Syrjälä)
- drm/xe: Wait on external BO kernel fences in exec IOCTL (Matthew Brost) [Orabug: 39886747] {CVE-2026-74440}
- drm/exec: Remove the index parameter from drm_exec_for_each_locked_obj[_reverse] (Thomas Hellström)
- drm/tegra: fbdev: Remove offset into framebuffer memory (Thomas Zimmermann)
- drm/fb-helper: Allocate and release fb_info in single place (Thomas Zimmermann)
- drm/amdgpu/gfx: fix cleaner shader IB buffer overflow (Asad Kamal) [Orabug: 39859885] {CVE-2026-68276}
- drm/amdgpu: give each kernel job a unique id (Pierre-Eric Pelloux-Prayer)
- drm/sched: Store the drm client_id in drm_sched_fence (Pierre-Eric Pelloux-Prayer)
- drm/amdgpu: Fix context pstate override handling (Tvrtko Ursulin) [Orabug: 39859881] {CVE-2026-68273}
- drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions (Timur Kristóf)
- mm/kmemleak: fix checksum computation for per-cpu objects (Breno Leitao)
- kmemleak: iommu/iova: fix transient kmemleak false positive (Catalin Marinas)
- mptcp: pm: userspace: fix use-after-free in get_local_id (Geliang Tang) [Orabug: 39859563] {CVE-2026-68169}
- mptcp: pm: use addr entry for get_local_id (Geliang Tang)
- mptcp: add mptcp_userspace_pm_lookup_addr helper (Geliang Tang)
- mptcp: pm: avoid code duplication to lookup endp (Geliang Tang)
- ALSA: hda: codecs: hdmi: disable keep-alive before audio format change (Kai Vehmanen)
- wifi: brcmfmac: set F2 blocksize to 256 for BCM43752 (Liangcheng Wang)
- wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW) (Gokul Sivakumar)
- wifi: ath6kl: fix use-after-free in aggr_reset_state() (Daniel Hodges) [Orabug: 39859647] {CVE-2026-68198}
- wifi: brcmfmac: drain bus_reset work on device removal (Fan Wu) [Orabug: 39843564] {CVE-2026-64586}
- media: uapi: rkisp: Correct name version enum (Niklas Söderlund)
- media: chips-media: wave5: Support CBP profile (Jackson Lee)
- media: imx219: Fix maximum frame length in lines (Sakari Ailus)
- media: i2c: imx219: Rename VTS to FRM_LENGTH (Jai Luthra)
- usb: typec: ucsi: Fix race condition and ordering in port unregistration (Andrei Kuchynski) [Orabug: 39886749] {CVE-2026-74441}
- usb: typec: ucsi: split connector lock classes (Sergey Senozhatsky)
- usb: gadget: f_tcm: synchronize delayed set_alt with teardown (Cen Zhang)
- gpio: pch: use raw_spinlock_t for the register lock (Junjie Cao)
- lib/alloc_tag: introduce mem_alloc_profiling_permanently_disabled() (Harry Yoo)
- mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios (Kiryl Shutsemau) [Orabug: 39886886] {CVE-2026-74482}
- fs/proc/task_mmu: fix PAGEMAP_SCAN written state for unpopulated ptes (Kiryl Shutsemau)
- mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() (Kiryl Shutsemau) [Orabug: 39982321] {CVE-2026-80893}
- drm/xe/rtp: Ensure locking/ref counting for OA whitelists (Ashutosh Dixit)
- drm/xe/oa: (De-)whitelist OA registers on OA stream open/release (Ashutosh Dixit)
- drm/xe/rtp: (De-)whitelist OA registers for all hwe's for a gt (Ashutosh Dixit)
- drm/xe/rtp: Toggle 'deny' bit to (de-)whitelist OA regs (Ashutosh Dixit)
- drm/xe/rtp: Save OA nonpriv registers to register save/restore lists (Ashutosh Dixit)
- drm/xe/rtp: Generalize whitelist_apply_to_hwe (Ashutosh Dixit)
- drm/xe/rtp: Keep track of non-OA nonpriv slots (Ashutosh Dixit)
- drm/xe/rtp: Maintain OA whitelists separately (Ashutosh Dixit)
- drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (Ashutosh Dixit) [Orabug: 39859869] {CVE-2026-68267}
- drm/xe: Apply whitelist to engine save-restore (Lucas De Marchi)
- drm/xe: Introduce xe_gt_dbg_printer() (Michal Wajdeczko)
- drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (Ashutosh Dixit)
- Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release (Pauli Virtanen)
- of: reserved_mem: avoid post-init UAF when alloc_reserved_mem_array() fails (Chen Wandun) [Orabug: 39969419] {CVE-2026-74352}
- ata: ahci: Make ahci_ignore_port() handle empty mask_port_map (Niklas Cassel)
- ata: libahci_platform: Do not set mask_port_map when not needed (Damien Le Moal)
- HID: logitech-dj: Fix maxfield check in DJ short report validation (Hyeongjun An) [Orabug: 39969555] {CVE-2026-64427}
- spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX (Jun Guo)
- drm/vmwgfx: validate external BO copy bounds for both stride paths (Zack Rusin) [Orabug: 39973343] {CVE-2026-80700}
- drm/vmwgfx: use check_add_overflow for shader size+offset bound (Zack Rusin) [Orabug: 39982305] {CVE-2026-80887}
- drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure (Zack Rusin) [Orabug: 39886751] {CVE-2026-74442}
- drm/vmwgfx: bound DMA command body size against suffix pointer (Zack Rusin) [Orabug: 39886754] {CVE-2026-74443}
- drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (Zack Rusin) [Orabug: 39886758] {CVE-2026-74444}
- drm/vmwgfx: drop dma_buf reference on foreign-fd prime import (Zack Rusin) [Orabug: 39982307] {CVE-2026-80888}
- drm/vmwgfx: reject DX_BIND_QUERY without a DX context (Zack Rusin) [Orabug: 39886762] {CVE-2026-74445}
- drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size (Zack Rusin) [Orabug: 39973346] {CVE-2026-80702}
- drm/amdkfd: hold event_mutex while checkpointing CRIU events (William Palacek) [Orabug: 39886767] {CVE-2026-74446}
- drm/amdkfd: Handle invalid event type in CRIU event restore (David Francis)
- drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment (William Palacek) [Orabug: 39887243] {CVE-2026-74447}
- drm/amdkfd: fix QID bit leak in pqm_create_queue() (Vladimir Marioukhine) [Orabug: 39886770] {CVE-2026-74448}
- drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE (Gang Ba) [Orabug: 39973348] {CVE-2026-80703}
- drm/amd/display: use proper context for logging (Jiri Slaby) [Orabug: 39973350] {CVE-2026-80704}
- drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames (Ray Wu)
- drm/amdgpu: cap GTT size to physical RAM on APUs (Harkirat Gill)
- drm/amdgpu: restore UMD profile pstate after runtime resume (Candice Li)
- drm/mediatek: ovl_adaptor: balance component registrations (Myeonghun Pak)
- drm/panthor: validate firmware interface structure sizes (Osama Abdelkader)
- drm/panthor: reject firmware sections with oversized data (Osama Abdelkader)
- drm/vc4: Zero the tile state data array before each BIN job (Maíra Canal) [Orabug: 39886786] {CVE-2026-74453}
- drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size (Jose Maria Casanova Crespo) [Orabug: 39886790] {CVE-2026-74454}
- drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs (Alexander Kaplan)
- can: ctucanfd: mark error-active controller status valid (Avi Weiss)
- can: ctucanfd: handle bus error interrupts (Avi Weiss)
- can: ctucanfd: unmap BAR0 using base address (Avi Weiss)
- can: ctucanfd: use self-test mode for PRESUME_ACK (Avi Weiss)
- can: ctucanfd: add missing MODULE_DEVICE_TABLE() (Pengpeng Hou)
- can: peak_usb: validate uCAN receive record lengths (Pengpeng Hou) [Orabug: 39886794] {CVE-2026-74455}
- can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error (Maoyi Xie) [Orabug: 39886798] {CVE-2026-74456}
- can: peak_usb: add bounds check for USB channel index (James Gao) [Orabug: 39886803] {CVE-2026-74457}
- can: softing: fw_parse(): validate firmware record spans (Pengpeng Hou) [Orabug: 39973357] {CVE-2026-80706}
- can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents (Pengpeng Hou) [Orabug: 39886807] {CVE-2026-74458}
- can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() (Abdun Nihaal)
- can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking (Tetsuo Handa)
- can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer (Oleksij Rempel) [Orabug: 39973362] {CVE-2026-80707}
- can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure (Marc Kleine-Budde)
- can: ems_usb: validate CPC message lengths (Pengpeng Hou) [Orabug: 39886812] {CVE-2026-74460}
- can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured (Lucas Martins Alves)
- i2c: imx: Cancel hrtimer before clearing slave pointer (Liem)
- i2c: imx: Fix slave registration race and error handling (Liem)
- i2c: iproc: reset bus after timeout if START_BUSY is stuck (Jonas Gorski)
- i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock (H. Nikolaus Schaller)
- ice: fix memory leak in ice_lbtest_prepare_rings() (Dawei Feng)
- ice: wait for reset completion in ice_resume() (Aaron Ma)
- net: openvswitch: fix skb leak on flow key update failure during ct (Ilya Maximets) [Orabug: 39886824] {CVE-2026-74464}
- net: openvswitch: fix skb leak on flow key update failure during recirculation (Ilya Maximets)
- net: openvswitch: fix potential UAF on meter attach failure (Ilya Maximets) [Orabug: 39886828] {CVE-2026-74465}
- phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB (Nava Kishore Manne)
- phy: zynqmp: use read-modify-write for SERDES scrambler bypass (Nava Kishore Manne)
- phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask (Nava Kishore Manne)
- s390/zcrypt: Validate length for CCA ECC private key requests (Holger Dengler)
- s390/zcrypt: Validate length for CCA AES cipher key requests (Holger Dengler)
- s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs (Harald Freudenberger)
- s390/dasd: Fix undersized format-check buffer (Stefan Haberland)
- s390/dasd: Fix potential NULL pointer dereference (Jan Höppner)
- s390/qeth: Check CAP_NET_ADMIN for private ioctls (Aswin K)
- s390/pci: Fix s390_pci_mmio_write syscall error return without MIO (Niklas Schnelle)
- power: supply: max17040: handle missing status supplier (Jianing Li) [Orabug: 39973377] {CVE-2026-80711}
- power: supply: bq25890: fix the -10 C NTC lookup entry (Xu Rao)
- cpufreq: schedutil: Publish util hooks only after all sg_cpu are initialized (Zhongqiu Han)
- cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() (Abdun Nihaal)
- gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Bui Duc Phuc)
- i2c: amd-mp2: Unregister callback on adapter add failure (Myeonghun Pak)
- hwmon: (pmbus/core) notify on the hwmon device, not the i2c client (Vincent Jardin)
- hwmon: (npcm750-pwm-fan): stop fan timer on device detach (Hongyan Xu)
- sctp: prevent peer transport count overflow (Asim Viladi Oglu Manizada) [Orabug: 39886841,40035128] {CVE-2026-74469}
- sctp: reject stale cookies with mismatched verification tags (Yuxiang Yang) [Orabug: 39982312] {CVE-2026-80890}
- scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write (Ibrahim Hashimov) [Orabug: 39886846] {CVE-2026-74470}
- selftests/clone3: fix wild pointer access of getline due to missing init (Chris Gellermann)
- selftests/mm: fix potential wild pointer access of getline due to missing init (Chris Gellermann)
- spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure (Vijaya Krishna Nivarthi)
- tracing/filters: Fix false positive match in regex_match_full() (Masami Hiramatsu)
- tracing: Check return value of __register_event() in trace_module_add_events() (Masami Hiramatsu) [Orabug: 39886849] {CVE-2026-74471}
- ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() (Ming Lei) [Orabug: 39886853] {CVE-2026-74472}
- vxlan: use pskb_network_may_pull() in route_shortcircuit() (Eric Dumazet) [Orabug: 39886855] {CVE-2026-74473}
- vxlan: use neigh_ha_snapshot() in route_shortcircuit() (Eric Dumazet) [Orabug: 39886863] {CVE-2026-74475}
- vxlan: unclone skb head before modifying eth header in route_shortcircuit() (Eric Dumazet)
- vxlan: re-fetch eth header after route_shortcircuit() (Eric Dumazet) [Orabug: 39973296] {CVE-2026-80681}
- veth: convert frag_list skbs before running XDP (Matt Fleming) [Orabug: 39886867] {CVE-2026-74476}
- um: vector: fix use-after-free in vector_mmsg_rx() (Michael Bommarito)
- powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() (Thorsten Blum)
- net: ipv6: clear suppressed fib6 rule result (Zhiling Zou) [Orabug: 39917529] {CVE-2026-74581}
- net: bridge: stop fast-leave after deleting a port group (Zhiling Zou) [Orabug: 39886878] {CVE-2026-74480}
- mm: memcg: initialize *locked in memcg1_oom_prepare() stub (Breno Leitao)
- mm/page_reporting: use system_freezable_wq to fix UAF during suspend (Link Lin) [Orabug: 39886882] {CVE-2026-74481}
- binfmt_misc: don't let an 'F' entry pin its own instance (Christian Brauner) [Orabug: 39886892] {CVE-2026-74484}
- binfmt_misc: reject a flag character as the field delimiter (Christian Brauner) [Orabug: 39886896] {CVE-2026-74485}
- wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (Catherine) [Orabug: 39886905] {CVE-2026-74488}
- tipc: avoid use-after-free in poll trace queue dumps (Zihan Xi) [Orabug: 39886910] {CVE-2026-74490}
- netfilter: ipset: do not update comments from kernel-side hash adds (David Lee) [Orabug: 39886915] {CVE-2026-74492}
- net/smc: fix socket use-after-free during link group termination (Luoxuanqiang)
- ipvs: do not propagate one-packet flag to synced conns (Zhiling Zou) [Orabug: 39973382] {CVE-2026-80714}
- igbvf: Fix leak in TX DMA error cleanup (Matt Vollrath) [Orabug: 39886925] {CVE-2026-74495}
- e1000: fix memory leak in e1000_probe() (Dawei Feng)
- dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ (Md Sadre Alam)
- ALSA: usb-audio: Clamp frame size in implicit-feedback mode (Sonali Pradhan) [Orabug: 39886933] {CVE-2026-74497}
- ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set (Sonali Pradhan) [Orabug: 39886937] {CVE-2026-74498}
- ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() (Baul Lee) [Orabug: 39886941] {CVE-2026-74499}
- ALSA: usb-audio: fix stack info leak in RME Digiface status (Baul Lee) [Orabug: 39886945] {CVE-2026-74500}
- ALSA: usb-audio: fix use-after-free in ump_to_endpoint() (Baul Lee) [Orabug: 39886947] {CVE-2026-74501}
- ata: libata-sata: fix ata_scsi_lpm_supported() iteration (Niklas Cassel)
- ata: libata-eh: Increase STANDBY IMMEDIATE timeout (Matt Vollrath)
- ASoC: tas2562: fix broken entries in the volume lookup table (Haidar Lee)
- ASoC: tas2562: fix DVC coefficient write order (Haidar Lee)
- ALSA: ump: fix double free of out_cvts on rawmidi error (Baul Lee) [Orabug: 39886949] {CVE-2026-74502}
- ALSA: seq: Fix division by zero in initialize_timer() (Norbert Szetei) [Orabug: 39886952] {CVE-2026-74504}
- ALSA: pcm: wake linked drain waiters on unlink (Norbert Szetei) [Orabug: 39973389] {CVE-2026-80716}
- ALSA: lx6464es: fix period byte count for 16-bit streams (Xu Rao)
- ALSA: 6fire: Fix UAF at error handling during probe (Takashi Iwai) [Orabug: 39886954] {CVE-2026-74505}
- bpf: lwt: Fix dst reference leak on reroute failure (Luoxuanqiang)
- Bluetooth: HIDP: validate numbered report payloads (Sangho Lee) [Orabug: 39886961] {CVE-2026-74507}
- Bluetooth: HIDP: reject frames without a transaction header (Sangho Lee) [Orabug: 39886965] {CVE-2026-74508}
- Bluetooth: hci_sync: Fix advertising data UAFs (Chengfeng Ye) [Orabug: 39886969] {CVE-2026-74509}
- Bluetooth: mgmt: fix UAF in pair command cancellation (Zihan Xi) [Orabug: 39886972] {CVE-2026-74510}
- Bluetooth: mgmt: fix pending command UAF in EIR updates (Zihan Xi)
- Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read() (Greg Kroah-Hartman)
- Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req() (Greg Kroah-Hartman)
- audit: fix potential use-after-free in audit_del_rule() (Luxiao Xu) [Orabug: 39886978] {CVE-2026-74512}
- audit: fix potential integer overflow in audit_log_n_string() (Zhan Xusheng)
- sctp: validate Adaptation Indication parameter length (Charles Vosburgh) [Orabug: 39973393] {CVE-2026-80717}
- KVM: s390: pci: Validate AIBV and AISB before pinning guest pages (Farhan Ali)
- KVM: s390: pci: Fix NULL dereference on AIBV allocation failure (Farhan Ali)
- KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (Farhan Ali) [Orabug: 39886986] {CVE-2026-74515}
- KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Sean Christopherson) [Orabug: 39886989] {CVE-2026-74516}
- tracing/probes: Reject $arg0 in meta argument expansion (Jhonraushan)
- mm/vmstat: fold stranded per-cpu node stats when a node comes online (Gregory Price)
- mm/hugetlb: fix list corruption in allocate_file_region_entries() (Xiangfeng Cai) [Orabug: 39886993] {CVE-2026-74518}
- mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() (Zi Yan)
- fs/proc/task_mmu: fix PAGEMAP_SCAN written state for PMD holes (Kiryl Shutsemau)
- mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE (Kefeng Wang) [Orabug: 39973307] {CVE-2026-80686}
- fortify: Disable -Wstringop-overread in tests (Nathan Chancellor)
- pinctrl: bm1880: add missing select GENERIC_PINCONF (Benjamin Boortz)
- erofs: cap LZMA stream pool size (Michael Bommarito) [Orabug: 39982319] {CVE-2026-80892}
- pinctrl: devicetree: don't free uninitialized dev_name on error path (Karl Mehltretter) [Orabug: 39886996] {CVE-2026-74519}
- pinctrl: microchip-sgpio: add missing select REGMAP_MMIO (Benjamin Boortz)
- rhashtable: clear stale iter->p on table restart (Cen Zhang) [Orabug: 39830599] {CVE-2026-64563}
- ksmbd: fix use-after-free in __close_file_table_ids() (Namjae Jeon)
- ksmbd: return success for deferred final close (Namjae Jeon)
- qede: sync udp_tunnel ports outside qede_lock in the recovery path (Denis V. Lunev) [Orabug: 39887009] {CVE-2026-74523}
- net: libwx: fix FDIR ATR queue mismatch for software VLAN packets (Jiawen Wu)
- net: dsa: mt7530: error out on failed reads in MT7531 PHY polling (Daniel Golle)
- net: dsa: mt7530: check bus->read() errors in the MDIO regmap backend (Daniel Golle)
- riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove (Karl Mehltretter)
- accel/qaic: use sizeof(*trans_hdr) for transaction length check (Muhammad Bilal)
- tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions (Masami Hiramatsu)
- tracing/mmiotrace: Remove reference to unused per CPU data pointer (Steven Rostedt)
- tracing: Remove TRACE_EVENT_FL_FILTERED logic (Zheng Yejian)
- tracing/mmiotrace: Reset dropped_count in mmio_reset_data() (Masami Hiramatsu)
- can: isotp: check register_netdevice_notifier() error in module init (Heminhong)
- net: sxgbe: check descriptor ring allocation failures (Chenguang Zhao)
- net: sxgbe: free TX rings on RX allocation failure (Chenguang Zhao)
- scsi: target: Clear cmd_cnt when initial counter enrollment fails (Leon Romanovsky)
- scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req (Benjamin Block)
- scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE (Zheng Tan) [Orabug: 39973317] {CVE-2026-80691}
- net: phylink: put link_gpio if phylink_create fails (Christian Marangi)
- Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync (Pauli Virtanen)
- Bluetooth: hci_conn: hold conn reference in abort_conn_sync() (Pauli Virtanen) [Orabug: 39887029] {CVE-2026-74531}
- Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists (Pauli Virtanen)
- Bluetooth: btintel: Validate length before parsing diagnostics TLV (Zijun Hu) [Orabug: 39887031] {CVE-2026-74532}
- Bluetooth: ISO: avoid deadlocks in iso_sock_timeout (Pauli Virtanen) [Orabug: 39887037] {CVE-2026-74535}
- Bluetooth: ISO: fix leaking sk after socket release (Pauli Virtanen) [Orabug: 39887039] {CVE-2026-74536}
- Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis() (Pauli Virtanen)
- Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos (Pauli Virtanen)
- Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (Jiale Yao) [Orabug: 39887047] {CVE-2026-74540}
- Bluetooth: ISO: clear iso_data always when detaching conn from hcon (Pauli Virtanen) [Orabug: 39887051] {CVE-2026-74541}
- idpf: Fix mailbox IRQ name leak on request failure (Yuho Choi)
- idpf: adjust TxQ ring count minimum (Joshua Hay)
- hwmon: (pmbus) Fix return value from pmbus_update_byte_data() (Guenter Roeck)
- net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller (Chenguang Zhao)
- net: ethernet: mtk_eth_soc: add consts for irq index (Frank Wunderlich)
- net: ethernet: mtk_eth_soc: support named IRQs (Frank Wunderlich)
- wifi: mac80211: validate individual TWT params before driver setup (Catherine) [Orabug: 39973405] {CVE-2026-80722}
- net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() (Eric Dumazet) [Orabug: 39887055] {CVE-2026-74543}
- powerpc/boot: Fix treeboot-akebono CPU node lookup check (Thorsten Blum)
- powerpc/boot: Fix treeboot-currituck CPU node lookup check (Thorsten Blum)
- powerpc/boot: Fix simpleboot CPU node lookup check (Thorsten Blum)
- rtase: fix double free of multi-frag skb on DMA map failure (Yun Lu)
- hwmon: (adt7470) Fix PWM auto temp state array and bounds check (Luiz Angelo Daros de Luca)
- hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read (Luiz Angelo Daros de Luca) [Orabug: 39887069] {CVE-2026-74546}
- hwmon: (adt7470) Use cached PWM frequency value (Luiz Angelo Daros de Luca)
- hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks (Luiz Angelo Daros de Luca)
- hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() (Luiz Angelo Daros de Luca)
- hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread (Luiz Angelo Daros de Luca) [Orabug: 39887073] {CVE-2026-74547}
- hwmon: (adt7470) Fix cache updated before hardware write on I2C error (Luiz Angelo Daros de Luca)
- hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors (Luiz Angelo Daros de Luca)
- forcedeth: fix UAF of txrx_stats in nv_remove (Chenguang Zhao) [Orabug: 39887078] {CVE-2026-74548}
- net: bridge: mrp: fix Option TLV length in MRP_Test frames (David Corvaglia)
- hwmon: (nct6775-core) Prevent access to unsupported weight registers (Guenter Roeck) [Orabug: 39887082] {CVE-2026-74549}
- net: do not send ICMP/NDISC Redirects when peer allocation fails (Eric Dumazet) [Orabug: 39887086] {CVE-2026-74550}
- hwmon: (nzxt-smart2) DMA-align output buffer (Guenter Roeck)
- hwmon: (lm90) Only report alarms if driver is ready (Guenter Roeck) [Orabug: 39887092] {CVE-2026-74552}
- hwmon: (sht3x) Fix unaligned accesses (Guenter Roeck) [Orabug: 39973330] {CVE-2026-80695}
- hwmon: (ltc4282) Fix reading the minimum alarm voltage (Guenter Roeck)
- hwmon: (ina2xx) Fix various overflow issues (Guenter Roeck)
- hwmon: (ina2xx) Shift INA234 shunt and current registers (Jonas Rebmann)
- hwmon: (ina2xx) Add support for INA234 (Ian Ray)
- hwmon: (ina2xx) Make it easier to add more devices (Ian Ray)
- hwmon: (ina226) Add support for SY24655 (Wenliang Yan)
- hwmon: (ina2xx) Add support for INA260 (Guenter Roeck)
- hwmon: (ina2xx) Add support for has_alerts configuration flag (Guenter Roeck)
- hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 (Guenter Roeck) [Orabug: 39887094] {CVE-2026-74553}
- spi: spi-cadence: Move TX FIFO full busy-wait into FIFO (Srikanth Boyapally)
- spi: spi-cadence: supports transmission with bits_per_word of 16 and 32 (Jun Guo)
- smb: client: fix buffer leaks in SMB1 read and write (Dawei Feng)
- scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race (Xingui Yang) [Orabug: 39887099] {CVE-2026-74555}
- scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (Hyeongjun An) [Orabug: 39887101] {CVE-2026-74556}
- scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer (Hyeongjun An) [Orabug: 39887105] {CVE-2026-74557}
- pinctrl-amd: Don't clear S4 wake bits at probe (Mario Limonciello)
- netfilter: nft_payload: fix mask build for partial field offload (Xiang Mei) [Orabug: 39890484] {CVE-2026-74579}
- ipvs: do not mangle ICMP replies for non-first fragments (Julian Anastasov)
- ipvs: fix places with wrong packet offsets (Julian Anastasov)
- ipvs: fix the checksum validations (Julian Anastasov) [Orabug: 39982335] {CVE-2026-80901}
- netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH (Pablo Neira Ayuso) [Orabug: 39887121] {CVE-2026-74564}
- netfilter: nf_tables: make nft_object rhltable per table (Pablo Neira Ayuso) [Orabug: 39887125] {CVE-2026-74565}
- assoc_array: trim the final shortcut word using the current chunk end (Michael Bommarito)
- keys: make keyring key-chunk byte order agree with keyring_diff_objects() (Michael Bommarito) [Orabug: 39887129] {CVE-2026-74566}
- keys: fix out-of-bounds read in keyring_get_key_chunk() (Michael Bommarito) [Orabug: 39887133] {CVE-2026-74567}
- KEYS: trusted: dcp: fix key_len validation and calc_blob_len() return type (Fabrice Derepas)
- Drivers: hv: vmbus: Replace lockdep_hardirq_threaded() with lockdep annotation (Sebastian Andrzej Siewior)
- drm/mediatek: Check CRTC state before freeing (Ruoyu Wang)
- netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (Xiang Mei) [Orabug: 39887138] {CVE-2026-74569}
- phy: zynqmp: fix runtime PM leak on probe allocation failure (Radhey Shyam Pandey)
- phy: zynqmp: fix clock error handling in xpsgtr_phy_init() (Radhey Shyam Pandey)
- phy-zynqmp: Postpone getting clock rate until actually needed (Mike Looijmans)
- btrfs: zoned: fix deadlock between metadata writeback and transaction commit (Johannes Thumshirn) [Orabug: 39887145] {CVE-2026-74572}
- btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag (Qu Wenruo)
- of: reserved_mem: prevent OOB when too many dynamic regions are defined (Sang-Heon Jeon) [Orabug: 39973411] {CVE-2026-80723}
- of: reserved_mem: Add code to dynamically allocate reserved_mem array (Oreoluwa Babatunde)
- ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup (Uday Khare)
- ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup (Uday Khare)
- ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources() (Radhey Shyam Pandey)
- ahci: Introduce ahci_ignore_port() helper (Damien Le Moal)
- ata: libahci_platform: support non-consecutive port numbers (Josua Mayer)
- ata: sata_mv: accept 1 or 2 resources in platform probe (Rosen Penev)
- gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe() (Abdun Nihaal)
- dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (Yuho Choi) [Orabug: 39887148] {CVE-2026-74574}
- dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA (Hongling Zeng)
- pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 (Konrad Dybcio)
- pinctrl: qcom: Unconditionally mark gpio as wakeup enable (Sneh Mankad)
- thunderbolt: Prevent XDomain delayed work use-after-free on disconnect (Michael Bommarito) [Orabug: 39887151] {CVE-2026-74575}
- netconsole: avoid OOB reads, msg is not nul-terminated (Jakub Kicinski) [Orabug: 39331620] {CVE-2026-43197}
- bpf: Reset register bounds before narrowing retval range in check_mem_access() (Tristan Madani) [Orabug: 39885096] {CVE-2026-72111}
- HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report (Benjamin Tissoires)
- HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write (Lee Jones)
- HID: logitech-dj: Standardise hid_report_enum variable nomenclature (Lee Jones)
- net: mpls: initialize rtm_tos in mpls_getroute() (Yehyeong Lee) [Orabug: 39887157] {CVE-2026-74577}
- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Lorenzo Bianconi)
- um: Preserve errno within signal handler (Tiwei Bie)
- kunit: tool: skip stty when stdin is not a tty (Shuvam Pandey)
- kunit: tool: Terminate kernel under test on SIGINT (David Gow)
- um: Set parent death signal for userspace process (Benjamin Berg)
- um: Set parent-death signal for write_sigio thread/process (Tiwei Bie)
- um: Set parent-death signal for ubd io thread/process (Tiwei Bie)
- um: Use os_set_pdeathsig helper in winch thread/process (Tiwei Bie)
- um: Set parent death signal for winch thread/process (Benjamin Berg)
- um: Add os_set_pdeathsig helper function (Tiwei Bie)
- LTS version: v6.12.102 (Saeed Mirzamohammadi)
- LTS version: v6.12.101 (Saeed Mirzamohammadi)
- KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug (Nikunj A Dadhania) [Orabug: 39859304] {CVE-2026-68093}
- afs: Fix uninit var in afs_alloc_anon_key() (David Howells)
- Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate() (Pavitra Jha) [Orabug: 39838812] {CVE-2026-53364}
- Bluetooth: hci_conn: Fix not cleaning up PA_LINK connections (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Fix not cleaning up Broadcaster/Broadcast Source (Luiz Augusto von Dentz)
- Bluetooth: hci_conn: Fix running bis_cleanup for hci_conn->type PA_LINK (Luiz Augusto von Dentz)
- afs: handle CB.InitCallBackState3 requests without a server record (Nan Li) [Orabug: 39886717] {CVE-2026-74425}
- afs: Fix delayed allocation of a cell's anonymous key (David Howells) [Orabug: 39838822] {CVE-2025-68299}
- dpll: fix clock quality level reporting (Ivan Vecera)
- afs: Set vllist to NULL if addr parsing fails (Edward Adam Davis)
- net: ethernet: Remove accidental duplication in Kconfig file (Lukas Bulwahn)
- wifi: nl80211: fix nl80211_start_radar_detection return value (Nicolas Escande)
- rxrpc: Fix locking issues with the peer record hash (David Howells)
- rxrpc: Disable IRQ, not BH, to take the lock for ->attend_link (David Howells)
- gpu: Fix uninitialized buddy for built-in drivers (Koen Koning)
- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Gal Pressman)
- usb: musb: omap2430: Do not put borrowed of_node in probe (Guangshuo Li)
- usb: musb: omap2430: clean up probe error handling (Johan Hovold)
- USB: gadget: fsl-udc: fix dev_printk() device (Johan Hovold)
- USB: gadget: Use str_enable_disable-like helpers (Krzysztof Kozlowski)
- net: ipa: fix SMEM state handle leaks in SMP2P init (Haoxiang Li)
- net: macb: drop in-flight Tx SKBs on close (Théo Lebrun) [Orabug: 39884757] {CVE-2026-72017}
- fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list (Reinette Chatre) [Orabug: 39884752] {CVE-2026-72015}
- ata: libata-core: Reject an invalid concurrent positioning ranges count (Bryam Vargas) [Orabug: 39884802] {CVE-2026-72030}
- octeontx2-pf: fix SQB pointer leak on init failure (Dawei Feng)
- net/mlx5: HWS, fix matcher leak on resize target setup failure (Dawei Feng) [Orabug: 39884812] {CVE-2026-72032}
- ipmi: fix refcount leak in i_ipmi_request() (Xu Wang) [Orabug: 39884844] {CVE-2026-72040}
- bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() (Breno Leitao)
- bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c (Breno Leitao)
- octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Junrui Luo) [Orabug: 39884854] {CVE-2026-72045}
- gpio: mt7621: avoid corruption of shared interrupt trigger state (Sergio Paracuellos)
- gve: fix header buffer corruption with header-split and HW-GRO (Ankit Garg) [Orabug: 39884857] {CVE-2026-72046}
- net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (Maoyi Xie) [Orabug: 39884874] {CVE-2026-72051}
- net: mana: Validate the packet length reported by the NIC (Dexuan Cui) [Orabug: 39884928] {CVE-2026-72065}
- locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Thomas Gleixner)
- wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() (Maoyi Xie) [Orabug: 39884955] {CVE-2026-72070}
- dm: avoid leaking the caller's thread keyring via the table device file (Ingo Blechschmidt) [Orabug: 39885074] {CVE-2026-72103}
- cred: add scoped_with_kernel_creds() (Christian Brauner)
- cred: add kernel_cred() helper (Christian Brauner)
- cleanup: fix scoped_class() (Christian Brauner)
- cleanup: add a scoped version of CLASS() (Christian Brauner)
- dm-integrity: fix leaking uninitialized kernel memory (Mikulas Patocka) [Orabug: 39885068] {CVE-2026-72101}
- block: remove redundant GD_NEED_PART_SCAN in add_disk_final() (Connor Williamson)
- block: add helper add_disk_final() (Ming Lei)
- ovl: use linked upper dentry in copy-up tmpfile (Souvik Banerjee)
- nvmet-auth: reject short AUTH_RECEIVE buffers (Michael Bommarito) [Orabug: 39885160] {CVE-2026-72130}
- nvmet: Introduce nvmet_req_transfer_len() (Damien Le Moal)
- tcp: Decrement tcp_md5_needed static branch (Dmitry Safonov)
- tcp: defer md5sig_info kfree past RCU grace period in tcp_connect (Michael Bommarito)
- xfrm: nat_keepalive: avoid double free on send error (Qianyu Luo) [Orabug: 39885179] {CVE-2026-72137}
- xfrm: Use nested-BH locking for nat_keepalive_sk_ipv[46] (Sebastian Andrzej Siewior)
- i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Vincent Jardin)
- i2c: imx: separate atomic, dma and non-dma use case (Stefan Eichenberger)
- dmaengine: dw-edma-pcie: Reject devices without driver data (Koichiro Den)
- dmaengine: dw-edma: Fix confusing cleanup.h syntax (Krzysztof Kozlowski)
- dma: dw-edma: Fix build warning in dw_edma_pcie_probe() (Abinash Singh)
- mm/sparse-vmemmap: fix DAX vmemmap accounting with optimization (Muchun Song)
- mm: prepare to move subsection_map_init() to mm/sparse-vmemmap.c (David Hildenbrand)
- mtd: maps: vmu-flash: fix fault in unaligned fixup (Florian Fuchs)
- mm/mm_init: fix pageblock migratetype for ZONE_DEVICE compound pages (Muchun Song)
- landlock: Fix LANDLOCK_SCOPE_SIGNAL bypass on the SIGIO path (Bryam Vargas) [Orabug: 39885339] {CVE-2026-72183}
- landlock: Prepare to use credential instead of domain for fowner (Mickaël Salaün)
- mm/sparse-vmemmap: fix vmemmap accounting underflow (Muchun Song)
- mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch (Deepanshu Kartikey) [Orabug: 39885447] {CVE-2026-72213}
- remoteproc: xlnx: Check remote core state (Tanmay Shah)
- SUNRPC: Return an error from xdr_buf_to_bvec() on overflow (Chuck Lever)
- SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists (Chuck Lever)
- sunrpc: allocate a separate bvec array for socket sends (Jeff Layton)
- NFSD: pass nfsd_file to nfsd_iter_read() (Mike Snitzer)
- gpu/buddy: bail out of try_harder when alignment cannot be honoured (Arunpravin Paneer Selvam) [Orabug: 39885559] {CVE-2026-72244}
- gpu: Move DRM buddy allocator one level up (part two) (Joel Fernandes)
- netfilter: nft_fib: reject fib expression on the netdev egress hook (Theodor Arsenij Larionov-Trichkine) [Orabug: 39885588] {CVE-2026-72254}
- netfilter: nf_tables: remove register tracking infrastructure (Florian Westphal)
- netfilter: nf_tables: Remove unused nft_reduce_is_readonly() (Yue Haibing)
- netfilter: bitwise: rename some boolean operation functions (Jeremy Sowden)
- netfilter: nf_conntrack_sip: validate skb_dst() before accessing it (Pablo Neira Ayuso) [Orabug: 39885584] {CVE-2026-72253}
- netfilter: nf_conntrack_sip: remove net variable shadowing (Florian Westphal)
- ASoC: mediatek: mt8183: Check runtime resume during probe (Cássio Gabriel)
- ASoC: mediatek: mt8183-afe-pcm: use local `dev` pointer in driver callbacks (Chen-Yu Tsai)
- ASoC: mediatek: mt8183-afe-pcm: Support >32 bit DMA addresses (Chen-Yu Tsai)
- ASoC: mediatek: mt8183-afe-pcm: Shorten memif_data table using macros (Chen-Yu Tsai)
- ASoC: mediatek: mt8192: Check runtime resume during probe (Cássio Gabriel)
- ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable (Tang Bin)
- arm64: dts: qcom: hamoa: Fix OPP tables for all DisplayPort controllers (Abel Vesa)
- arm64: dts: qcom: correct RBR opp entry (Dmitry Baryshkov)
- octeontx2-pf: clear stale mailbox IRQ state before request_irq() (Runyu Xiao)
- octeontx2-vf: clear stale mailbox IRQ state before request_irq() (Runyu Xiao)
- VDUSE: avoid leaking information to userspace (Jason Wang) [Orabug: 39885722] {CVE-2026-72305}
- vduse: take out allocations from vduse_dev_alloc_coherent (Eugenio Pérez)
- vduse: remove unused vaddr parameter of vduse_domain_free_coherent (Eugenio Pérez)
- vduse: Use fixed 4KB bounce pages for non-4KB page size (Sheng Zhao)
- tipc: restrict socket queue dumps in enqueue tracepoints (Li Xiasong) [Orabug: 39885708] {CVE-2026-72299}
- rxrpc: Fix socket notification race (David Howells)
- rxrpc: Fix notification vs call-release vs recvmsg (David Howells)
- rxrpc: Use irq-disabling spinlocks between app and I/O thread (David Howells)
- rxrpc: Don't need barrier for ->tx_bottom and ->acks_hard_ack (David Howells)
- rxrpc: Fix CPU time starvation in I/O thread (David Howells)
- fbcon: Use correct type for vc_resize() return value (Jiacheng Yu)
- fbcon: Rename struct fbcon_ops to struct fbcon_par (Thomas Zimmermann)
- xfs: don't replace the wrong part of the cow fork (Darrick J. Wong)
- xfs: factor out xfs_attr3_leaf_init (Long Li)
- rxrpc: serialize kernel accept preallocation with socket teardown (Li Daming) [Orabug: 39886736] {CVE-2026-74436}
- rxrpc: Pull out certain app callback funcs into an ops table (David Howells)
- ALSA: hda: Fix cached processing coefficient verbs (Xu Rao)
- ALSA: hda: conexant: Remove mic bias threshold override (Zhang Heng)
- i2c: i801: fix hardware state machine corruption in error path (Mingyu Wang) [Orabug: 39760898] {CVE-2026-64205}
- audit: fix recursive locking deadlock in audit_dupe_exe() (Ricardo Robaina) [Orabug: 39859310] {CVE-2026-68096}
- audit: use 'unsigned int' instead of 'unsigned' (Ricardo Robaina)
- audit: widen ino fields to u64 (Jeff Layton)
- VFS/audit: introduce kern_path_parent() for audit (Neil Brown)
- i2c: davinci: Unregister cpufreq notifier on probe failure (Haoxiang Li)
- fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() (Sebastian Alba Vives)
- iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read() (Nicolin Chen)
- iommufd: Break the loop on failure in iommufd_fault_fops_read() (Nicolin Chen) [Orabug: 39785853] {CVE-2026-64290}
- iommufd: Reject invalid read count in iommufd_fault_fops_read() (Nicolin Chen)
- mm/damon/core: disallow overlapping input ranges for damon_set_regions() (Seongjae Park) [Orabug: 39859554] {CVE-2026-68164}
- mm/damon/core: validate ranges in damon_set_regions() (Seongjae Park) [Orabug: 39859556] {CVE-2026-68165}
- rust: allow `suspicious_runtime_symbol_definitions` lint for Rust >= 1.98 (Miguel Ojeda)
- gve: fix Rx queue stall on alloc failure (Eddie Phillips) [Orabug: 39859431] {CVE-2026-68129}
- net: pcs: xpcs: fix SGMII state reading (Coia Prant)
- io_uring/rw: fix missing ERESTARTSYS conversion in read paths (Yitang Yang)
- drm/amd/display: Fix DTB DTO updates breaking live pixel rate sources (Harry Wentland)
- ksmbd: validate ACE size against SID sub-authorities (Namjae Jeon)
- ksmbd: bound DACL dedup walk to copied ACEs (Namjae Jeon)
- bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops (Jiayuan Chen) [Orabug: 39622003] {CVE-2026-53078}
- drm/amdgpu: fix aperture mapping leak (Asad Kamal) [Orabug: 39859330] {CVE-2026-68102}
- drm/amdgpu: invoke pm_genpd_remove() before freeing genpd (Ce Sun)
- drm/amdgpu: fix division by zero with invalid uvd dimensions (Boyuan Zhang) [Orabug: 39859349] {CVE-2026-68106}
- drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() (Luca Coelho) [Orabug: 39868455] {CVE-2026-68429}
- drm/amdgpu/vcn4: avoid rereading IB param length (Boyuan Zhang) [Orabug: 39859353] {CVE-2026-68107}
- drm/amdgpu/vce: fix integer overflow in image size (Boyuan Zhang) [Orabug: 39859357] {CVE-2026-68108}
- drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() (Alex Deucher) [Orabug: 39859365] {CVE-2026-68110}
- drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() (Alex Deucher) [Orabug: 39859369] {CVE-2026-68111}
- drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() (Alex Deucher) [Orabug: 39859375] {CVE-2026-68112}
- drm/amdgpu/gfx8: drop unecessary BUG_ON() (Alex Deucher) [Orabug: 39868458] {CVE-2026-68430}
- drm/amdgpu/gfx12: replace BUG_ON() with WARN_ON() (Alex Deucher) [Orabug: 39859379] {CVE-2026-68113}
- drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() (Alex Deucher) [Orabug: 39859801] {CVE-2026-68246}
- drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() (Alex Deucher) [Orabug: 39859387] {CVE-2026-68115}
- drm/amd/pm: make pp_features read-only when scpm is enabled (Yang Wang)
- drm/amd/pm: fix amdgpu_pm_info power display units (Yang Wang)
- vxlan: mdb: Fix source list corruption on a failed replace (James Raphael Tiovalen) [Orabug: 39859391] {CVE-2026-68116}
- tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Daehyeon Ko) [Orabug: 39859393] {CVE-2026-68117}
- tcp: initialize standalone TCP-AO response padding (Yizhou Zhao) [Orabug: 39859402] {CVE-2026-68119}
- rtase: Workaround for TX hang caused by hardware packet parsing (Justin Lai)
- pppoe: reload header pointer after dev_hard_header() (Asim Viladi Oglu Manizada) [Orabug: 39859406,40035127] {CVE-2026-68121}
- openvswitch: fix GSO userspace truncation underflow (Kyle Zeng) [Orabug: 39859411] {CVE-2026-68123}
- mctp: serial: handle zero-length frames to prevent rx buffer overflow (Doruk Tan Ozturk)
- mac802154: llsec: reject frames shorter than the authentication tag (Doruk Tan Ozturk) [Orabug: 39859417] {CVE-2026-68125}
- mac802154: hold an interface reference across the scan worker (Ibrahim Hashimov) [Orabug: 39859421] {CVE-2026-68126}
- ila: reload IPv6 header after pskb_may_pull in checksum adjust (Michael Bommarito)
- ice: use READ_ONCE() to access cached PHC time (Sergey Temerkhanov)
- ice: reject out-of-range ptype in ice_parser_profile_init (Aleksandr Loktionov) [Orabug: 39859428] {CVE-2026-68128}
- ksmbd: defer destroy_previous_session() until after NTLM authentication (James Montgomery)
- rbd: Reset positive result codes to zero in object map update path (Raphael Zimmer) [Orabug: 39859437] {CVE-2026-68131}
- ice: fix PTP Call Trace during PTP release (Paul Greenwalt) [Orabug: 39859445] {CVE-2026-68133}
- net: hip04: fix RX buffer leak on build_skb failure (Fan Wu)
- net: gro: fix double aggregation of flush-marked skbs (Shiming Cheng) [Orabug: 39859452] {CVE-2026-68136}
- net/x25: fix use-after-free in x25_kill_by_neigh() (David Lee)
- net/mlx5e: Use sender devcom for MPV master-up (Manjunath Patil) [Orabug: 39859465] {CVE-2026-68139}
- net/iucv: fix use-after-free of a severed iucv_path (Bryam Vargas)
- net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() (Hidayath Khan)
- geneve: require CAP_NET_ADMIN in the device netns for changelink (Doruk Tan Ozturk) [Orabug: 39859476] {CVE-2026-68142}
- net: slip: serialize receive against buffer reallocation (Sungmin Kang) [Orabug: 39859480] {CVE-2026-68143}
- vxlan: require CAP_NET_ADMIN in the device netns for changelink (Doruk Tan Ozturk) [Orabug: 39868465] {CVE-2026-68432}
- phonet: pep: fix use-after-free in pep_get_sb() (Breno Leitao)
- iommu/vt-d: Disallow SVA if page walk is not coherent (Lu Baolu)
- iomap: fix out-of-bounds bitmap_set() with zero-length range (Zhang Yi) [Orabug: 39859489] {CVE-2026-68145}
- ftrace: Add global mutex to serialize trace_parser access (Tengda Wu) [Orabug: 39859491] {CVE-2026-68146}
- fscrypt: Add missing superblock check in find_or_insert_direct_key() (Eric Biggers) [Orabug: 39859499] {CVE-2026-68148}
- fs: preserve ACL_DONT_CACHE state in forget_cached_acl() (Amir Goldstein) [Orabug: 39859501] {CVE-2026-68149}
- binfmt_elf_fdpic: only honour the first PT_INTERP (Christian Brauner)
- ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP (Chancel Liu)
- amt: fix use-after-free in AMT delayed works (Shihuang Liu)
- libceph: remove debugfs files before client teardown (Douya Le) [Orabug: 39859510] {CVE-2026-68153}
- libceph: reject zero bucket types in crush_decode (Douya Le) [Orabug: 39859514] {CVE-2026-68154}
- libceph: Reject monmaps advertising zero monitors (Raphael Zimmer) [Orabug: 39859518] {CVE-2026-68155}
- libceph: refresh auth->authorizer_buf{,_len} after authorizer update (Shuangpeng Bai) [Orabug: 39859522] {CVE-2026-68156}
- libceph: guard missing CRUSH type name lookup (Zhao Zhang) [Orabug: 39859526] {CVE-2026-68157}
- libceph: Fix multiplication overflow in decode_new_up_state_weight() (Raphael Zimmer) [Orabug: 39859529] {CVE-2026-68158}
- libceph: bound get_version reply decode to front len (Douya Le) [Orabug: 39868470] {CVE-2026-68433}
- ceph: fix refcount leak in ceph_readdir() (Xu Wang)
- ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() (Bryam Vargas) [Orabug: 39859538] {CVE-2026-68160}
- sctp: close UDP tunnel sockets during netns teardown (Zhiling Zou) [Orabug: 39859544] {CVE-2026-68161}
- sctp: avoid auth_enable sysctl UAF during netns teardown (Zhiling Zou) [Orabug: 39859548] {CVE-2026-68162}
- sctp: don't free the ASCONF's own transport in DEL-IP processing (Jun Yang) [Orabug: 39830605] {CVE-2026-64564}
- mptcp: only set DATA_FIN when a mapping is present (Michael Bommarito)
- mptcp: decrement subflows counter on failed passive join (Chenguang Zhao)
- Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" (Will Deacon)
- arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates (Will Deacon)
- tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() (Masami Hiramatsu)
- tracing/probes: Fix potential underflow in LEN_OR_ZERO macro (Masami Hiramatsu)
- tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() (Masami Hiramatsu)
- tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() (Masami Hiramatsu)
- tracing: Fix resource leak on mmiotrace trace_pipe close (Deepakraog)
- tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev (Steven Rostedt)
- misc: nsm: pin the module while the device is open (Xu Rao)
- misc: nsm: only unlock nsm_dev on post-lock error paths (Runyu Xiao)
- intel_th: fix MSC output device reference leak (Guangshuo Li) [Orabug: 39860419] {CVE-2026-68180}
- mei: bus: access mei_device under device_lock on cleanup (Alexander Usyskin) [Orabug: 39859588] {CVE-2026-68181}
- serial: sc16is7xx: implement gpio get_direction() callback (Hugo Villeneuve)
- uio_hv_generic: Bind to FCopy device by default (Ben Hutchings)
- comedi: comedi_parport: deal with premature interrupt (Ian Abbott)
- x86/boot/compressed: Disable jump tables (Nathan Chancellor)
- firmware: stratix10-svc: fix memory leaks and list corruption bugs (Tze Yee Ng)
- cdrom: fix stack out-of-bounds read in CDROMVOLCTRL (Xu Rao) [Orabug: 39859600] {CVE-2026-68184}
- LoongArch: Retrieve CPU package ID from PPTT when available (Rong Bao)
- LoongArch: Move jump_label_init() before parse_early_param() (Kanglong Wang)
- LoongArch: Fix oops during single-step debugging (Haoran Jiang)
- objtool/rust: add one more `noreturn` Rust function for Rust 1.99.0 (Miguel Ojeda)
- rust: allow `clippy::unwrap_or_default` globally (Alexandre Courbot)
- platform/loongarch: laptop: Explicitly reset bl_powered state when suspend (Zixing Liu)
- binfmt_misc: set have_execfd only once the interpreter is opened (Christian Brauner) [Orabug: 39859610] {CVE-2026-68186}
- exec: fix unsigned loop counter wrap in transfer_args_to_stack() (Christian Brauner) [Orabug: 39859613] {CVE-2026-68187}
- Bluetooth: RFCOMM: Fix session UAF in set_termios (Chengfeng Ye) [Orabug: 39859617] {CVE-2026-68188}
- Bluetooth: hci_sync: Protect UUID list traversal (Chengfeng Ye) [Orabug: 39859621] {CVE-2026-68189}
- staging: rtl8723bs: fix inverted HT40 secondary channel offset (Minjea Kim)
- staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() (Moksh Panicker)
- wifi: brcmfmac: make release_scratchbuffers idempotent (Fan Wu) [Orabug: 39859628] {CVE-2026-68192}
- wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Lucid Duck) [Orabug: 39859632] {CVE-2026-68193}
- wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses (Lucid Duck) [Orabug: 39859634] {CVE-2026-68194}
- wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses (Lucid Duck)
- wifi: wilc1000: validate assoc response length before subtracting header (Huihui Huang)
- wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper (Doruk Tan Ozturk) [Orabug: 39859643] {CVE-2026-68197}
- wifi: ath6kl: fix OOB access from firmware ADDBA window size (Tristan Madani) [Orabug: 39859651] {CVE-2026-68199}
- ALSA: timer: don't re-enter an instance callback that is still running (Norbert Szetei) [Orabug: 39859655] {CVE-2026-68200}
- ALSA: timer: drain a slave's callback before its master detaches it (Norbert Szetei) [Orabug: 39859657] {CVE-2026-68201}
- ALSA: seq: close a re-opened queue timer in the destructor (Norbert Szetei) [Orabug: 39859659] {CVE-2026-68202}
- media: vpif_capture: fix OF node reference imbalance (Johan Hovold)
- media: vivid: fix cleanup bugs in vivid_init() (Guangshuo Li)
- media: vivid: check for vb2_is_busy() when toggling caps (Hans Verkuil)
- media: vivid: add vivid_update_reduced_fps() (Hans Verkuil)
- media: vimc: fix reference leak on failed device registration (Guangshuo Li)
- media: vidtv: fix reference leak on failed device registration (Guangshuo Li)
- media: vb2: use ssize_t for vb2_read/vb2_write (Zile Xiong)
- media: v4l2-subdev: Fail {enable,disable}_streams and s_streaming nicely (Sakari Ailus)
- media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() (Mirela Rabulea) [Orabug: 39859671] {CVE-2026-68205}
- media: v4l2-ctrls: validate HEVC active reference counts (Pengpeng Hou) [Orabug: 39859675] {CVE-2026-68206}
- media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() (Sergey Shtylyov)
- media: ti: vpe: unwind v4l2 device registration on probe error (Myeonghun Pak)
- media: tegra-video: vi: fix invalid u32 return value in format lookup (Hungyu Lin)
- media: sun4i-csi: Return queued buffers on start_streaming() failure (Valery Borovsky)
- media: stm32: dcmi: unregister notifier on probe failure (Myeonghun Pak)
- media: saa7134: Fix a possible memory leak in saa7134_video_init1 (Ma Ke) [Orabug: 39859694] {CVE-2026-68212}
- media: rtl2832_sdr: Return queued buffers on start_streaming() failure (Valery Borovsky) [Orabug: 39859698] {CVE-2026-68213}
- media: rtl2832: fix use-after-free in rtl2832_remove() (Deepanshu Kartikey) [Orabug: 39859703] {CVE-2026-68214}
- media: radio-si476x: Unregister v4l2_device on probe failure (Myeonghun Pak)
- media: qcom: camss: Fix RDI streaming for CSID GEN2 (Bryan O'Donoghue)
- media: pwc: Return queued buffers on start_streaming() failure (Valery Borovsky) [Orabug: 39859712] {CVE-2026-68216}
- media: pwc: Drain fill_buf on start_streaming() failure (Valery Borovsky) [Orabug: 39859716] {CVE-2026-68217}
- media: pci: dm1105: Free allocated workqueue (Krzysztof Kozlowski) [Orabug: 39859720] {CVE-2026-68218}
- media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding (Guoniu Zhou)
- media: nxp: imx8-isi: Fix potential out-of-bounds issues (Guoniu Zhou)
- media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path (Xiaolei Wang)
- media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure (Xiaolei Wang)
- media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe (Xiaolei Wang)
- media: nuvoton: npcm-video: fix memory leaks in probe and remove (David Carlier)
- media: nuvoton: npcm-video: fix error handling in npcm_video_init() (David Carlier)
- media: msi2500: Return queued buffers on start_streaming() failure (Valery Borovsky)
- media: meson: vdec: Fix memory leak in error path of vdec_open (Anand Moon)
- media: marvell-cam: fix missing pci_disable_device() on remove (Guangshuo Li)
- media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for overlapping ranges (Marco Nenciarini)
- media: i2c: alvium: fix critical pointer access in alvium_ctrl_init (Martin Hecht)
- media: cx23885: add ioremap return check and cleanup (Wang Jun) [Orabug: 39859741] {CVE-2026-68226}
- media: cx231xx: fix devres lifetime (Johan Hovold) [Orabug: 39859745] {CVE-2026-68227}
- media: chips-media: wave5: Move src_buf Removal to finish_encode (Brandon Brnich)
- media: cedrus: skip invalid H.264 reference list entries (Pengpeng Hou)
- media: cedrus: Fix missing cleanup in error path (Samuel Holland)
- media: cedrus: clean up media device on probe failure (Myeonghun Pak)
- media: cec: seco: unregister adapter on IR probe failure (Myeonghun Pak)
- media: aspeed: fix missing of_reserved_mem_device_release() on probe failure (David Carlier)
- media: airspy: Return queued buffers on start_streaming() failure (Valery Borovsky)
- drm/vc4: Prevent shader BO mappings from becoming writable (Linmao Li) [Orabug: 39868504] {CVE-2026-68445}
- drm/vmwgfx: Validate vmw_surface_metadata::array_size (Ian Forbes) [Orabug: 39868510] {CVE-2026-68446}
- drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved (Zhu Lingshan) [Orabug: 39859765] {CVE-2026-68234}
- drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge (Mario Limonciello)
- drm/amd/display: dce100: skip non-DP stream encoders for DP MST (Andriy Korud) [Orabug: 39859769] {CVE-2026-68235}
- drm/amd/display: set new_stream to NULL after release (Xu Wang) [Orabug: 39859774] {CVE-2026-68236}
- drm/amdgpu: Fix VFCT bus number matching with soft filter (Mario Limonciello)
- drm/panthor: return error on truncated firmware (Osama Abdelkader)
- drm/gfx10: Program DB_RING_CONTROL (Alex Deucher)
- drm/amd/pm: fix smu14 power limit range calculation (Yang Wang)
- drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU (Joonas Lahtinen) [Orabug: 39859791] {CVE-2026-68243}
- drm/i915/gem: Do not leak siblings[] on proto context error (Joonas Lahtinen) [Orabug: 39859794] {CVE-2026-68244}
- drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (Shahyan Soltani) [Orabug: 39859797] {CVE-2026-68245}
- drm/i915/bios: range check LFP Data Block panel_type2 (Jani Nikula) [Orabug: 39859806] {CVE-2026-68247}
- drm/i915: Return NULL on error in active_instance (Joonas Lahtinen) [Orabug: 39859808] {CVE-2026-68248}
- drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() (Alex Deucher) [Orabug: 39859811] {CVE-2026-68249}
- drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() (Alex Deucher) [Orabug: 39859815] {CVE-2026-68250}
- drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() (Alex Deucher) [Orabug: 39859819] {CVE-2026-68251}
- drm/amdgpu/sdma7.0: replace BUG_ON() with WARN_ON() (Alex Deucher) [Orabug: 39859823] {CVE-2026-68252}
- drm/virtio: bound EDID block reads to the response buffer (Bryam Vargas) [Orabug: 39859835] {CVE-2026-68255}
- drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference (Xu Wang) [Orabug: 39859839] {CVE-2026-68256}
- drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips (Thomas Zimmermann)
- drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Yongqiang Sun) [Orabug: 39859841] {CVE-2026-68257}
- drm/amdkfd: Check bounds in allocate_event_notification_slot (David Francis) [Orabug: 39859851] {CVE-2026-68259}
- drm/amdkfd: Use kvcalloc to allocate arrays (David Francis)
- drm/imagination: acquire vm_ctx->lock before mapping memory to GPU VM (Icenowy Zheng)
- drm/imagination: fix error checking of pvr_vm_context_lookup() (Luigi Santivetti)
- drm/imagination: Fix user array stride in pvr_set_uobj_array() (Shuvam Pandey)
- drm/imagination: Fix double call to drm_sched_entity_fini() (Brajesh Gupta)
- drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds (Matthew Brost)
- drm/radeon: fix r100_copy_blit for large BOs (Pavel Ondračka)
- drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() (Xu Wang)
- drm/i915/gem: Add missing nospec on parallel submit slot (Joonas Lahtinen) [Orabug: 39859872] {CVE-2026-68269}
- drm/displayid: fix Tiled Display Topology ID size (Jani Nikula)
- drm/nouveau: fix reversed error cleanup order in ucopy functions (Junrui Luo) [Orabug: 39859875] {CVE-2026-68271}
- drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 (Mario Limonciello) [Orabug: 39859878] {CVE-2026-68272}
- drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT (Timur Kristóf)
- drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older (Timur Kristóf)
- drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) (Timur Kristóf)
- drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers (Ashutosh Desai) [Orabug: 39859887] {CVE-2026-68277}
- drm/imagination: Fit paired fragment job in the correct CCCB (Alessio Belle)
- drm/dp/mst: fix buffer overflows in sideband chunk accumulation (Ashutosh Desai) [Orabug: 39859891] {CVE-2026-68278}
- drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers (Ashutosh Desai) [Orabug: 39859895] {CVE-2026-68279}
- drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() (Vitor Soares)
- drm/imagination: Count paired job fence as dependency in prepare_job() (Alessio Belle)
- drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() (Sergey Shtylyov)
- drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay (Biju Das)
- bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() (Chengfeng Ye) [Orabug: 39859908] {CVE-2026-68284}
- ice: fix LAG recipe to profile association (Marcin Szycik)
- ice: allow creating VFs when !CONFIG_ICE_SWITCHDEV (Vincent Chen)
- net: ipv6: fix dif and sdif mismatch in raw6_icmp_error (Li Rongqing)
- net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation (Alexei Lazar)
- net/mlx5e: Report zero bandwidth for non-ETS traffic classes (Alexei Lazar)
- net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule (Yael Chemla)
- net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (Gal Pressman) [Orabug: 39859936] {CVE-2026-68293}
- net/mlx5: Refactor EEPROM query error handling to return status separately (Gal Pressman)
- net: qrtr: restrict socket creation to the initial network namespace (Aldo Ariel Panzardo) [Orabug: 39859939] {CVE-2026-68294}
- hinic: remove unused ethtool RSS user configuration buffers (Chenguang Zhao)
- ppp: annotate data races in ppp_generic (Eric Dumazet)
- ppp: enable TX scatter-gather (Qingfang Deng)
- ppp: convert to percpu netstats (Qingfang Deng)
- ppp: use IFF_NO_QUEUE in virtual interfaces (Qingfang Deng)
- ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup (Eric Dumazet)
- net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM (Yun Zhou) [Orabug: 39859947] {CVE-2026-68296}
- net: stmmac: enable the MAC on link up for all supported speeds (Vadik Likholetov)
- net: stmmac: reset residual action in L3L4 filters on delete (Nazim Amirul)
- net: stmmac: fix l3l4 filter rejecting unsupported offload requests (Nazim Amirul)
- drm/tests: shmem: Set DMA mask to 64-bit in drm_gem_shmem (José Expósito)
- tipc: fix u16 MTU truncation in media and bearer MTU validation (Cen Zhang) [Orabug: 39859949] {CVE-2026-68297}
- iomap: correct the range of a partial dirty clear (Zhang Yi)
- vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (Harshaka Narayana) [Orabug: 39859954] {CVE-2026-68299}
- sctp: auth: verify auth requirement when auth_chunk is NULL (Luoqing) [Orabug: 39859958] {CVE-2026-68300}
- net: dpaa: fix mode setting (Michael Walle)
- net: hsr: fix memory leak on slave unregistration by removing synced VLANs (Eric Dumazet) [Orabug: 39859962] {CVE-2026-68301}
- net: bridge: vlan: fix vlan range dumps starting with pvid (Nikolay Aleksandrov)
- amt: make the head writable before rewriting the L2 header (Michael Bommarito)
- amt: re-read skb header pointers after every pull (Michael Bommarito)
- ovl: fix trusted xattr escape prefix matching (Chenyichong)
- wifi: brcmfmac: fix 802.1X-SHA256 call trace warning (Shelley Yang) [Orabug: 39859972] {CVE-2026-68304}
- wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() (Lorenzo Bianconi)
- wifi: mt76: mt7925: fix crash in reset link replay (Sean Wang) [Orabug: 39859979] {CVE-2026-68307}
- wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() (Lorenzo Bianconi)
- wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv() (Lorenzo Bianconi) [Orabug: 39868486] {CVE-2026-68439}
- wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() (Lorenzo Bianconi) [Orabug: 39859983] {CVE-2026-68309}
- wifi: mt76: mt7915: guard HE capability lookups (Ruoyu Wang) [Orabug: 39859988] {CVE-2026-68310}
- wifi: mt76: mt7925: guard link STA in decap offload (Guangshuo Li) [Orabug: 39859990] {CVE-2026-68311}
- tipc: fix infinite loop in __tipc_nl_compat_dumpit (Helen Koike) [Orabug: 39859995] {CVE-2026-68313}
- nexthop: initialize extack in nh_res_bucket_migrate() (Xiang Mei) [Orabug: 39837137] {CVE-2026-64576}
- gtp: check skb_pull_data() return in gtp1u_send_echo_resp() (Xiang Mei) [Orabug: 39837140] {CVE-2026-64577}
- selftests: openvswitch: add config file (Matthieu Baerts)
- selftests: af_unix: add USER_NS config (Matthieu Baerts)
- tls: device: push pending open record on splice EOF (Rishikesh Jethwani)
- net: mctp i3c: clean up notifier and buses if driver register fails (Myeonghun Pak)
- sctp: validate stream count in sctp_process_strreset_inreq() (Cen Zhang) [Orabug: 39860001] {CVE-2026-68315}
- pds_core: check for workqueue allocation failure (Nikhil P. Rao)
- pds_core: fix auxiliary device add/del races (Nikhil P. Rao) [Orabug: 39860008] {CVE-2026-68317}
- pds_core: order completion reads after the ownership check (Nikhil P. Rao)
- pds_core: yield the CPU while waiting for the adminq to drain (Nikhil P. Rao)
- pds_core: fix use-after-free on workqueue during remove (Nikhil P. Rao) [Orabug: 39860011] {CVE-2026-68318}
- pds_core: fix deadlock between reset thread and remove (Nikhil P. Rao) [Orabug: 39860014] {CVE-2026-68319}
- sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid (Ji'An Zhou) [Orabug: 39860017] {CVE-2026-68320}
- net: txgbe: fix FDIR filter leak on remove (Chenguang Zhao)
- amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN (Prashanth Kumar K R)
- pds_core: reject component parameter in legacy firmware update (Nikhil P. Rao)
- wifi: mac80211: recalculate TIM when a station enters power save (Andrew Pope)
- iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() (Li Rongqing)
- iommu/amd: Bound the early ACPI HID map (Pengpeng Hou) [Orabug: 39860036] {CVE-2026-68325}
- wifi: mwifiex: bound uAP association event IEs to the event buffer (He Wei) [Orabug: 39860040] {CVE-2026-68326}
- wan: wanxl: Only reset hardware after BAR mapping (Ruoyu Wang)
- nfp: Check resource mutex allocation (Ruoyu Wang) [Orabug: 39860049] {CVE-2026-68328}
- wifi: mac80211: tear down new links on vif update error path (Xiang Mei) [Orabug: 39837133] {CVE-2026-64574}
- iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() (Guanghui Feng) [Orabug: 39860053] {CVE-2026-68329}
- dpaa2-eth: put MAC endpoint device on disconnect (Guangshuo Li)
- dpaa2-switch: put MAC endpoint device on disconnect (Guangshuo Li)
- gtp: parse extension headers before reading inner protocol (Zhixing Chen)
- bonding: fix devconf_all NULL dereference when IPv6 is disabled (Zhaolong Zhang) [Orabug: 39860073] {CVE-2026-68336}
- net/packet: avoid fanout hook re-registration after unregister (David Lee) [Orabug: 39860079] {CVE-2026-68338}
- netlink: specs: rt-link: convert bridge port flag attributes to u8 (Danielle Ratson)
- Bluetooth: btusb: validate Realtek vendor event length (Pengpeng Hou) [Orabug: 39860083] {CVE-2026-68339}
- regulator: mt6358: use regmap helper to read fixed LDO calibration (Daniel Golle)
- hwmon: occ: validate poll response sensor blocks (Pengpeng Hou)
- smb: client: validate DFS referral PathConsumed (Chenyichong) [Orabug: 39860093] {CVE-2026-68343}
- hwmon: (asus-ec-sensors) add missed handle for ENOMEM (Eugene Shalygin)
- hwmon: (asus-ec-sensors) fix EC read intervals (Eugene Shalygin)
- hwmon: (asus-ec-sensors) fix looping over banks while reading from EC (Eugene Shalygin)
- drivers/virt: pkvm: Fix end calculation in mmio_guard_ioremap_hook() (Mostafa Saleh)
- wifi: iwlwifi: mvm: fix read in wake packet notification handler (Shahar Tzarfati)
- wifi: iwlwifi: mvm: validate SAR GEO response payload size (Anjaneyulu)
- ASoC: cs35l56: Use complete_all() to signal init_completion (Richard Fitzgerald)
- ASoC: cs35l56: Fix potential probe() deadlock (Richard Fitzgerald)
- ASoC: cs35l56: Don't use devres to unregister component (Richard Fitzgerald)
- ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI (Shengjiu Wang)
- ALSA: hda: cs35l41: validate and free ACPI mute object (Guangshuo Li) [Orabug: 39860100] {CVE-2026-68346}
- ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() (Denis Arefev)
- ASoC: tas2781: bound firmware description string parsing (Pengpeng Hou) [Orabug: 39860104] {CVE-2026-68348}
- btrfs: free mapping node on duplicate reloc root insert (Guanghui Yang) [Orabug: 39868528] {CVE-2026-68450}
- btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps (Leo Martins) [Orabug: 39868497] {CVE-2026-68442}
- btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8 (You-Kai Zheng)
- wifi: carl9170: fix buffer overflow in rx_stream failover path (Tristan Madani) [Orabug: 39860106] {CVE-2026-68349}
- wifi: carl9170: fix OOB read from off-by-two in TX status handler (Tristan Madani) [Orabug: 39860110] {CVE-2026-68350}
- wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read (Tristan Madani) [Orabug: 39860114] {CVE-2026-68351}
- wifi: ath6kl: fix OOB read from firmware IE lengths in connect event (Tristan Madani) [Orabug: 39860119] {CVE-2026-68352}
- wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler (Tristan Madani) [Orabug: 39860123] {CVE-2026-68353}
- firewire: net: Fix fragmented datagram reassembly (Ruoyu Wang)
- wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (Manivannan Sadhasivam)
- wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (Manivannan Sadhasivam)
- wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() (Dmitry Morgun) [Orabug: 39860132] {CVE-2026-68355}
- watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() (Tzung-Bi Shih)
- hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop (Guenter Roeck)
- hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop (Guenter Roeck)
- hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop (Guenter Roeck)
- hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop (Guenter Roeck)
- hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop (Edward Adam Davis)
- wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin (Gaole Zhang) [Orabug: 39860151] {CVE-2026-68362}
- wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Cheng Yongkang) [Orabug: 39860155] {CVE-2026-68363}
- usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits (Zhang Xincheng)
- RISC-V: KVM: Serialize virtual interrupt pending state updates (Xie Bo)
- crypto: rsa-pkcs1pad: Don't WARN on an empty digest (Doruk Tan Ozturk)
- USB: serial: option: add TDTECH MT5710-CN (Chukun Pan)
- USB: serial: keyspan_pda: fix data loss on receive throttling (Johan Hovold)
- USB: serial: io_edgeport: cap received transmit credits (Sunho Park) [Orabug: 39860163] {CVE-2026-68365}
- USB: serial: ftdi_sio: add support for E+H FXA291 (Tim Pambor)
- usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer (Muhammad Bilal)
- usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown (Fan Wu)
- usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() (Sonali Pradhan)
- USB: gadget: fsl-udc: fix device name leak on probe failure (Johan Hovold)
- USB: gadget: snps-udc: fix device name leak on probe failure (Johan Hovold)
- usb: gadget: printer: fix infinite loop in printer_read() (Melbin K Mathew)
- usb: gadget: f_midi: cancel pending IN work before freeing the midi object (Fan Wu)
- usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback (Wang Jinchao)
- usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Xu Yang)
- USB: storage: add NO_ATA_1X quirk for Longmai USB Key (Huang Wei)
- usb: core: port: Deattach Type-C connector on component unbind (Chia-Lin Kao) [Orabug: 39860190] {CVE-2026-68372}
- wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() (Huihui Huang) [Orabug: 39860192] {CVE-2026-68373}
- usb: core: sysfs: add lock to bos_descriptors_read() (Griffin Kroah-Hartman) [Orabug: 39860197] {CVE-2026-68374}
- mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n (Weiming Shi) [Orabug: 39837113] {CVE-2026-64569}
- sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [Orabug: 39860204] {CVE-2026-68376}
- net/sched: act_tunnel_key: Defer dst_release to RCU callback (Jamal Hadi Salim) [Orabug: 39860208] {CVE-2026-68377}
- drm/i915/selftests: Fix GT PM sort comparators (Emre Cecanpunar)
- ksmbd: validate compound request size before reading StructureSize2 (Xiang Mei)
- ksmbd: pin conn during async oplock break notification (Qihang)
- smb: move some duplicate definitions to common/cifsglob.h (Zhangguodong)
- drm/xe/wopcm: fix WOPCM size for LNL+ (Daniele Ceraolo Spurio)
- can: j1939: fix lockless local-destination check (Shuhao Fu)
- riscv: hwprobe: Avoid uninitialized read in hwprobe_get_cpus() (Mark Harris)
- s390/checksum: Fix csum_partial() without vector facility (Vasily Gorbik)
- bpf, sockmap: Reject unhashed UDP sockets on sockmap update (Michal Luczaj) [Orabug: 39860227] {CVE-2026-68386}
- powerpc/vtime: Initialize starttime at boot for native accounting (Shrikanth Hegde)
- powerpc/time: Prepare to stop elapsing in dynticks-idle (Frederic Weisbecker)
- powerpc/85xx: Add fsl,ifc to common device ids (Rosen Penev)
- drm/i915/gt: use correct selftest config symbol (Pengpeng Hou)
- smb/client: handle overlapping allocated ranges in fallocate (Huiwen He) [Orabug: 39860231] {CVE-2026-68388}
- Bluetooth: hci_qca: Clear memdump state on invalid dump size (Ruoyu Wang)
- Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (Pauli Virtanen) [Orabug: 39860238] {CVE-2026-68391}
- Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync (Pauli Virtanen) [Orabug: 39860240] {CVE-2026-68392}
- Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update (Cen Zhang) [Orabug: 39860244] {CVE-2026-68394}
- Bluetooth: qca: fix NVM tag length underflow in TLV parser (Xiang Mei)
- ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC (Takashi Iwai)
- accel/ivpu: Fix wrong register read in LNL failure diagnostics (Karol Wachowski)
- ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning (Rosen Penev)
- ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts (Rosen Penev)
- ata: sata_dwc_460ex: use platform_get_irq() (Rosen Penev)
- ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered (Rosen Penev)
- net/iucv: take a reference on the socket found in afiucv_hs_rcv() (Bryam Vargas)
- ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Weiming Shi) [Orabug: 39837127] {CVE-2026-64572}
- ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF (Norbert Szetei) [Orabug: 39860257] {CVE-2026-68398}
- cpufreq: Make cpufreq_update_pressure() fall back to cpuinfo.max_freq (Rafael J. Wysocki)
- firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context (Pushpendra Singh)
- ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup (Uday Khare)
- ASoC: cs42l43: Correct report for forced microphone jack (Charles Keepax)
- ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() (Vijendar Mukunda)
- ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop (Christian Hewitt)
- wifi: cfg80211: bound element ID read when checking non-inheritance (He Wei) [Orabug: 39860270] {CVE-2026-68402}
- wifi: brcmfmac: initialize SDIO data work before cleanup (Runyu Xiao) [Orabug: 39860274] {CVE-2026-68403}
- wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock (Cen Zhang) [Orabug: 39860282] {CVE-2026-68405}
- wifi: cfg80211: reject unsupported PMSR FTM location requests (Catherine)
- wifi: cfg80211: validate PMSR FTM preamble range (Catherine) [Orabug: 39860286] {CVE-2026-68406}
- wifi: cfg80211: validate PMSR measurement type data (Catherine)
- wifi: nl80211: validate nested MBSSID IE blobs (Catherine)
- wifi: cfg80211: derive S1G beacon TSF from S1G fields (Catherine)
- wifi: nl80211: free RNR data on MBSSID mismatch (Catherine) [Orabug: 39860291] {CVE-2026-68407}
- wifi: p54: validate RX frame length in p54_rx_eeprom_readback() (Xiang Mei) [Orabug: 39837122] {CVE-2026-64571}
- wifi: libertas: fix memory leak in helper_firmware_cb() (Dawei Feng) [Orabug: 39860297] {CVE-2026-68410}
- wifi: mac80211: fix fils_discovery double free on alloc failure (Xiang Mei) [Orabug: 39837118] {CVE-2026-64570}
- wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure (Xiang Mei) [Orabug: 39837110] {CVE-2026-64568}
- wifi: mac80211_hwsim: clamp virtio RX length before skb_put (Bryam Vargas) [Orabug: 39860301] {CVE-2026-68411}
- wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() (Abdun Nihaal) [Orabug: 39860308] {CVE-2026-68413}
- wifi: cfg80211: cancel sched scan results work on unregister (Cen Zhang) [Orabug: 39860312] {CVE-2026-68414}
- xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert (Xiang Mei) [Orabug: 39837148] {CVE-2026-64579}
- xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (Xiang Mei) [Orabug: 39837153] {CVE-2026-64580}
- RDMA/irdma: Prevent overflows in memory contiguity checks (Aleksandrova Alyona)
- selftests/alsa: Fix memory leak in find_controls error path (Malaya Kumar Rout)
- mtd: fix double free and WARN_ON in add_mtd_device() error paths (Xue Lei) [Orabug: 39860318] {CVE-2026-68416}
- RDMA/siw: publish QP after initialization (Ruoyu Wang)
- RDMA/hns: Fix potential integer overflow in mhop hem cleanup (Danila Chernetsov)
- RDMA/erdma: initialize ret for empty receive WR lists (Ruoyu Wang)
- RDMA/irdma: Prevent rereg_mr for non-mem regions (Jacob Moroni) [Orabug: 39860329] {CVE-2026-68419}
- RDMA/umem: Add pinned revocable dmabuf import interface (Jacob Moroni)
- RDMA/cma: Fix hardware address comparison length in netevent callback (Or Gerlitz)
- firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() (Unnathi Chalicheemala) [Orabug: 39868501] {CVE-2026-68444}
- btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() (Filipe Manana) [Orabug: 39860334] {CVE-2026-68422}
- btrfs: reject free space cache with more entries than pages (Xiang Mei) [Orabug: 39837106] {CVE-2026-64567}
- mtd: nand: mtk-ecc: stop on ECC idle timeouts (Pengpeng Hou)
- mtd: mtdswap: remove debugfs stats file on teardown (Pengpeng Hou)
- IB/mad: Drop unmatched RMPP responses before reassembly (Michael Bommarito) [Orabug: 39860339] {CVE-2026-68425}
- arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234 (Sumit Gupta)
- soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE (Harshal Dev)
- Input: ims-pcu - fix logic error in packet reset (Dmitry Torokhov)
- Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() (Seungjin Bae)
- xprtrdma: Clear receive-side ownership pointers on release (Chuck Lever)
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Mikko Perttunen)
- gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings (Mikko Perttunen) [Orabug: 39860347] {CVE-2026-68427}
- dmaengine: sh: rz-dmac: Move interrupt request after everything is set up (Claudiu Beznea)
- can: isotp: serialize TX state transitions under so->rx_lock (Oliver Hartkopp) [Orabug: 39885144] {CVE-2026-72124}
- can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER (Oliver Hartkopp) [Orabug: 39885147] {CVE-2026-72125}
- can: bcm: track a single source interface for ANYDEV timeout/throttle ops (Oliver Hartkopp) [Orabug: 39885107] {CVE-2026-72115}
- can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() (Oliver Hartkopp) [Orabug: 39885115] {CVE-2026-72117}
- can: bcm: fix stale rx/tx ops after device removal (Oliver Hartkopp) [Orabug: 39885111] {CVE-2026-72116}
- can: bcm: add missing device refcount for CAN filter removal (Oliver Hartkopp) [Orabug: 39885099] {CVE-2026-72113}
- can: bcm: validate frame length in bcm_rx_setup() for RTR replies (Oliver Hartkopp) [Orabug: 39885103] {CVE-2026-72114}
- can: bcm: extend bcm_tx_lock usage for data and timer updates (Oliver Hartkopp) [Orabug: 39885123] {CVE-2026-72119}
- can: bcm: fix CAN frame rx/tx statistics (Oliver Hartkopp) [Orabug: 39885119] {CVE-2026-72118}
- can: bcm: add locking when updating filter and timer values (Oliver Hartkopp) [Orabug: 39885132] {CVE-2026-72121}
- KVM: x86/mmu: Fix use-after-free on vendor module reload (Phil Rosenthal) [Orabug: 39860351] {CVE-2026-68428}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Hyunwoo Kim) [Orabug: 39830594] {CVE-2026-64562}
- KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN (Venkatesh Srinivas)
- seqlock: Allow UBSAN_ALIGNMENT to fail optimizing (Heiko Carstens)
- seqlock: Allow KASAN to fail optimizing (Peter Zijlstra)
- seqlock: Cure some more scoped_seqlock() optimization fails (Peter Zijlstra)
- fs/proc/task_mmu: fix make_uffd_wp_huge_pte() prot-update race (Kiryl Shutsemau) [Orabug: 39885310] {CVE-2026-72175}
- drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker (Ryosuke Yasuoka)
- netfilter: nf_tables: revert commit_mutex usage in reset path (Brian Witte) [Orabug: 39451770] {CVE-2026-45901}
- netfilter: nft_quota: use atomic64_xchg for reset (Brian Witte)
- netfilter: nft_counter: serialize reset with spinlock (Brian Witte) [Orabug: 39451756] {CVE-2026-45897}
- selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs (Daniel Borkmann)
- bpf: Fix ld_{abs,ind} failure path analysis in subprogs (Daniel Borkmann) [Orabug: 39622050] {CVE-2026-53090}
- net: airoha: Move airoha_eth driver in a dedicated folder (Lorenzo Bianconi)
- platform/x86/intel-uncore-freq: Fix current_freq_khz after CPU hotplug (Guixiong Wei)
-
Tue Aug 18 2026 Sherry Yang <sherry.yang@oracle.com> [6.12.0-207.100.1.el10uek]
- x86/bugs: Enable IBPB flush on BPF JIT allocation (Pawan Gupta) [Orabug: 39786491] {CVE-2026-64507}
- sched/fair: Disable affine wakeups at NUMA domain levels on Exadata (Daniel Jordan) [Orabug: 39810704]
- block: flip iter directions in blk_rq_integrity_map_user() (Caleb Sander) [Orabug: 39836233]
- x86/alternatives: Guard struct alt_instr kABI layout (Saeed Mirzamohammadi) [Orabug: 39860416]