-
Sat Nov 01 2025 Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.348.3.1.el8uek]
- i40e: add validation for ring_len param (Lukasz Czapnik) [Orabug: 38604168] {CVE-2025-39973}
- i40e: increase max descriptors for XL710 (Justin Bronder) [Orabug: 38604168] {CVE-2025-39973}
-
Fri Sep 26 2025 Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.348.3.el8uek]
- hugetlbfs: take read_lock on i_mmap for PMD sharing (Waiman Long) [Orabug: 38459576]
- kallsyms: add module_kallsyms_on_each_symbol_locked (Julian Pidancet) [Orabug: 38418686]
- kallsyms: export module_kallsyms_on_each_symbol (Julian Pidancet) [Orabug: 38418686]
-
Thu Sep 18 2025 Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.348.2.el8uek]
- uek-rpm: Move ifb module to nano modules (Harshit Mogalapalli) [Orabug: 38443798]
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310007,38453918] {CVE-2025-38499}
- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta) [Orabug: 38424094]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta) [Orabug: 38424094]
- x86/vmscape: Enable the mitigation (Pawan Gupta) [Orabug: 38424094]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta) [Orabug: 38424094]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta) [Orabug: 38424094]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta) [Orabug: 38424094]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta) [Orabug: 38424094]
-
Fri Sep 05 2025 Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.348.1.el8uek]
- LTS tag: v5.4.298 (Sherry Yang)
- Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" (Imre Deak)
- net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- Revert "drm/amdgpu: fix incorrect vm flags to map bo" (Alex Deucher) [Orabug: 38343661]
- HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [Orabug: 38440228] {CVE-2025-39808}
- HID: wacom: Add a new Art Pen 2 (Ping Cheng)
- HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [Orabug: 38440310] {CVE-2025-39824}
- efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [Orabug: 38440277] {CVE-2025-39817}
- sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [Orabug: 38440251] {CVE-2025-39812}
- net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts (Rohan G Thomas)
- net/mlx5e: Set local Xoff after FW update (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon port speed set (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon MTU set (Alexei Lazar)
- net: dlink: fix multicast stats being counted incorrectly (Moon Yeounsu)
- atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [Orabug: 38440347] {CVE-2025-39828}
- net/atm: remove the atmdev_ops {get, set}sockopt methods (Christoph Hellwig)
- Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced (Luiz Augusto von Dentz)
- powerpc/kvm: Fix ifdef to remove build warning (Madhavan Srinivasan)
- net: ipv4: fix regression in local-broadcast routes (Oscar Maes) [Orabug: 38343661]
- vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() (Nikolay Kuratov)
- scsi: core: sysfs: Correct sysfs attributes access rights (Damien Le Moal)
- ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [Orabug: 38440259] {CVE-2025-39813}
- pinctrl: STMFX: add missing HAS_IOMEM dependency (Randy Dunlap)
- LTS tag: v5.4.297 (Sherry Yang)
- alloc_fdtable(): change calling conventions. (Al Viro)
- s390/hypfs: Enable limited access during lockdown (Peter Oberparleiter)
- s390/hypfs: Avoid unnecessary ioctl registration in debugfs (Peter Oberparleiter)
- ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation (Takashi Iwai)
- net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate (William Liu)
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (William Liu) [Orabug: 38423457] {CVE-2025-39766}
- ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc (Jason Xing)
- ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add (Heminhong)
- ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [Orabug: 38343661]
- scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [Orabug: 38401514] {CVE-2025-39676}
- usb: xhci: Fix slot_id resource race conflict (Weitao Wang)
- nfs: fix UAF in direct writes (Josef Bacik) [Orabug: 36596831] {CVE-2024-26958}
- NFS: Fix up commit deadlocks (Trond Myklebust)
- cifs: Fix UAF in cifs_demultiplex_thread() (Zhang Xiaoxu) [Orabug: 36983927] {CVE-2023-52572}
- Bluetooth: fix use-after-free in device_for_each_child() (Dmitry Antipov) [Orabug: 37433654] {CVE-2024-53237}
- act_mirred: use the backlog for nested calls to mirred ingress (Davide Caratti)
- net/sched: act_mirred: better wording on protection against excessive stack growth (Davide Caratti)
- net/sched: act_mirred: refactor the handle of xmit (Wenxu)
- selftests: forwarding: tc_actions.sh: add matchall mirror test (Jiri Pirko)
- net: sched: don't expose action qstats to skb_tc_reinsert() (Vlad Buslov)
- net: sched: extract qstats update code into functions (Vlad Buslov)
- net: sched: extract bstats update code into function (Vlad Buslov)
- net: sched: extract common action counters update code into function (Vlad Buslov)
- mm: perform the mapping_map_writable() check after call_mmap() (Lorenzo Stoakes)
- mm: update memfd seal write check to include F_SEAL_WRITE (Lorenzo Stoakes)
- mm: drop the assumption that VM_SHARED always implies writable (Lorenzo Stoakes)
- codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Cong Wang) [Orabug: 37908492] {CVE-2025-37798}
- sch_qfq: make qfq_qlen_notify() idempotent (Cong Wang)
- sch_hfsc: make hfsc_qlen_notify() idempotent (Cong Wang) [Orabug: 38158396] {CVE-2025-38177}
- sch_drr: make drr_qlen_notify() idempotent (Cong Wang)
- btrfs: populate otime when logging an inode item (Qu Wenruo)
- media: venus: hfi: explicitly release IRQ during teardown (Jorge Ramirez-Ortiz)
- f2fs: fix to avoid out-of-boundary access in dnode page (Chao Yu) [Orabug: 38375870] {CVE-2025-38677}
- media: venus: protect against spurious interrupts during probe (Jorge Ramirez-Ortiz) [Orabug: 38401659] {CVE-2025-39709}
- media: qcom: camss: cleanup media device allocated resource on error path (Vladimir Zapolskiy)
- media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. (Ricardo Ribalda)
- drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS (Imre Deak)
- pwm: mediatek: Fix duty and period setting (Uwe Kleine-König)
- pwm: mediatek: Handle hardware enable and clock enable separately (Uwe Kleine-König)
- pwm: mediatek: Implement .apply() callback (Uwe Kleine-König)
- media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [Orabug: 38401677] {CVE-2025-39713}
- media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() (Sakari Ailus)
- media: v4l2-ctrls: always copy the controls on completion (Hans Verkuil)
- ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig (Damien Le Moal)
- soc: qcom: mdt_loader: Ensure we don't read past the ELF header (Bjorn Andersson) [Orabug: 38423524] {CVE-2025-39787}
- rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 (Meagan Lloyd)
- usb: musb: omap2430: fix device leak at unbind (Johan Hovold)
- NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug: 38429211] {CVE-2025-39798}
- NFS: Fix up handling of outstanding layoutcommit in nfs_update_inode() (Trond Myklebust)
- NFSv4: Fix nfs4_bitmap_copy_adjust() (Trond Myklebust)
- usb: typec: fusb302: cache PD RX state (Sebastian Reichel)
- cdc-acm: fix race between initial clearing halt and open (Oliver Neukum)
- USB: cdc-acm: do not log successful probe on later errors (Johan Hovold)
- mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock (Breno Leitao) [Orabug: 38423261] {CVE-2025-39736}
- mm/kmemleak: turn kmemleak_lock and object->lock to raw_spinlock_t (He Zhe)
- ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (Geoffrey D. Bennett)
- x86/fpu: Delay instruction pointer fixup until after warning (Dave Hansen)
- mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery (Andy Shevchenko)
- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395081] {CVE-2025-38724}
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324271] {CVE-2025-38539}
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: avoid warm port reset during USB3 disconnect (Mathias Nyman)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- iio: hid-sensor-prox: Fix incorrect OFFSET calculation (Zhang Lixu)
- f2fs: fix to do sanity check on ino and xnid (Chao Yu) [Orabug: 38180774] {CVE-2025-38347}
- mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n (Harry Yoo)
- mm/zsmalloc.c: convert to use kmem_cache_zalloc in cache_alloc_zspage() (Miaohe Lin)
- drm/sched: Remove optimization that causes hang when killing dependent jobs (Lin Cao)
- ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351930] {CVE-2025-38664}
- net: usbnet: Fix the wrong netif_carrier_on() call (Ammar Faizi)
- net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (John Ernberg)
- PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (Lukas Wunner)
- ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value (Li Zhong)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott) [Orabug: 38254285] {CVE-2025-38481}
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott) [Orabug: 38254272] {CVE-2025-38478}
- kbuild: Add KBUILD_CPPFLAGS to as-option invocation (Nathan Chancellor)
- kbuild: add $(CLANG_FLAGS) to KBUILD_CPPFLAGS (Masahiro Yamada)
- kbuild: Add CLANG_FLAGS to as-instr (Nathan Chancellor)
- mips: Include KBUILD_CPPFLAGS in CHECKFLAGS invocation (Nathan Chancellor)
- kbuild: Update assembler calls to use proper flags and language target (Nick Desaulniers)
- ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS (Nathan Chancellor)
- usb: dwc3: Ignore late xferNotReady event to prevent halt timeout (Kuen-Han Tsai)
- USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles (Zenm Chen)
- usb: storage: realtek_cr: Use correct byte order for bcs->Residue (Thorsten Blum)
- USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera (Mael Guerin)
- usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive (Miao Li)
- iio: proximity: isl29501: fix buffered read on big-endian systems (David Lechner)
- ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [Orabug: 38401581] {CVE-2025-39689}
- fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() (Xu Yilun)
- use uniform permission checks for all mount propagation changes (Al Viro)
- move_mount: allow to add a mount into an existing group (Pavel Tikhomirov)
- fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [Orabug: 38401587] {CVE-2025-39691}
- drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 (Timur Kristóf)
- memstick: Fix deadlock by moving removing flag earlier (Jiayi Li)
- media: venus: Add a check for packet size after reading from shared memory (Vedang Nagar) [Orabug: 38401666] {CVE-2025-39710}
- media: ov2659: Fix memory leaks in ov2659_probe() (Zhang Shurong)
- media: usbtv: Lock resolution while streaming (Ludwig Disterhof) [Orabug: 38401684] {CVE-2025-39714}
- media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (Haoxiang Li)
- media: gspca: Add bounds checking to firmware parser (Dan Carpenter)
- soc/tegra: pmc: Ensure power-domains are in a known state (Jonathan Hunter)
- jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [Orabug: 38423509] {CVE-2025-39782}
- PCI: endpoint: Fix configfs group removal on driver teardown (Damien Le Moal)
- PCI: endpoint: Fix configfs group list head handling (Damien Le Moal) [Orabug: 38423515] {CVE-2025-39783}
- mtd: rawnand: fsmc: Add missing check after DMA map (Thomas Fourier)
- pwm: imx-tpm: Reset counter if CMOD is 0 (Laurentiu Mihalcea)
- wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (Nathan Chancellor)
- zynq_fpga: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- ata: libata-scsi: Fix ata_to_sense_error() status handling (Damien Le Moal)
- ext4: fix reserved gdt blocks handling in fsmap (Ojaswin Mujoo)
- ext4: fix fsmap end of range reporting with bigalloc (Ojaswin Mujoo)
- ext4: check fast symlink for ea_inode correctly (Andreas Dilger)
- vt: defkeymap: Map keycodes above 127 to K_HOLE (Myrrh Periwinkle)
- vt: keyboard: Don't process Unicode characters in K_OFF mode (Myrrh Periwinkle)
- usb: dwc3: meson-g12a: fix device leaks at unbind (Johan Hovold)
- usb: gadget: udc: renesas_usb3: fix device leak at unbind (Johan Hovold)
- usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (Nathan Chancellor)
- m68k: Fix lost column on framebuffer debug console (Finn Thain)
- cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (Dan Carpenter)
- serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [Orabug: 38401729] {CVE-2025-39724}
- media: uvcvideo: Do not mark valid metadata as invalid (Ricardo Ribalda)
- media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394816] {CVE-2025-38680}
- mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() (Waiman Long) [Orabug: 38423265] {CVE-2025-39737}
- parisc: Makefile: fix a typo in palo.conf (Randy Dunlap)
- btrfs: fix log tree replay failure due to file with 0 links and extents (Filipe Manana)
- thunderbolt: Fix copy+paste error in match_service_id() (Eric Biggers)
- comedi: fix race between polling and detaching (Ian Abbott) [Orabug: 38394854] {CVE-2025-38687}
- misc: rtsx: usb: Ensure mmc child device is active when card is present (Ricky Wu)
- drm/amdgpu: fix incorrect vm flags to map bo (Jack Xiao)
- scsi: lpfc: Remove redundant assignment to avoid memory leak (Jiasheng Jiang)
- rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe (Meagan Lloyd)
- pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394867] {CVE-2025-38691}
- pNFS: Handle RPC size limit for layoutcommits (Sergey Bashirov)
- pNFS: Fix disk addr range check in block/scsi layout (Sergey Bashirov)
- pNFS: Fix stripe mapping in block/scsi layout (Sergey Bashirov)
- net: phy: smsc: add proper reset flags for LAN8710A (Csaba Buday)
- ipmi: Fix strcpy source and destination the same (Corey Minyard)
- kconfig: lxdialog: fix 'space' to (de)select options (Yann E. MORIN)
- kconfig: gconf: fix potential memory leak in renderer_edited() (Masahiro Yamada)
- kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() (Masahiro Yamada)
- ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Breno Leitao)
- scsi: aacraid: Stop using PCI_IRQ_AFFINITY (John Garry)
- scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (Ranjan Kumar)
- kconfig: nconf: Ensure null termination where strncpy is used (Shankari Anand)
- kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c (Suchit Karunakaran)
- i3c: don't fail if GETHDRCAP is unsupported (Wolfram Sang)
- PCI: pnv_php: Work around switches with broken presence detection (Timothy Pearson)
- i3c: add missing include to internal header (Wolfram Sang)
- media: uvcvideo: Fix bandwidth issue for Alcor camera (Chenchangcheng)
- media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394880] {CVE-2025-38693}
- media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394887] {CVE-2025-38694}
- media: usb: hdpvr: disable zero-length read messages (Wolfram Sang)
- media: tc358743: Increase FIFO trigger level to 374 (Dave Stevenson)
- media: tc358743: Return an appropriate colorspace from tc358743_set_fmt (Dave Stevenson)
- media: tc358743: Check I2C succeeded during probe (Dave Stevenson)
- pinctrl: stm32: Manage irq affinity settings (Cheick Traore)
- scsi: mpt3sas: Correctly handle ATA device errors (Damien Le Moal)
- scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug: 38394894] {CVE-2025-38695}
- RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423286] {CVE-2025-39742}
- MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh)
- jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte) [Orabug: 38394912] {CVE-2025-38697}
- jfs: Regular file corruption check (Edward Adam Davis) [Orabug: 38394918] {CVE-2025-38698}
- jfs: truncate good inode pages when hard link is 0 (Lizhi Xu) [Orabug: 38423294] {CVE-2025-39743}
- scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394925] {CVE-2025-38699}
- MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} (Shiji Yang)
- watchdog: dw_wdt: Fix default timeout (Sebastian Reichel)
- fs/orangefs: use snprintf() instead of sprintf() (Amir Mohammad Jahangirzad)
- scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated (Showrya M N) [Orabug: 38394931] {CVE-2025-38700}
- ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394937] {CVE-2025-38701}
- cifs: Fix calling CIFSFindFirst() for root path without msearch (Pali Rohár)
- vhost: fail early when __vhost_add_used() fails (Jason Wang)
- net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 (Álvaro Fernández Rojas)
- uapi: in6: restore visibility of most IPv6 socket options (Jakub Kicinski)
- net: ncsi: Fix buffer overflow in fetching version id (Hari Kalavakunta)
- net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 (Álvaro Fernández Rojas)
- net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs (Gal Pressman)
- wifi: iwlegacy: Check rate_idx range after addition (Stanislaw Gruszka)
- netmem: fix skb_frag_address_safe with unreadable skbs (Mina Almasry)
- wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. (Thomas Fourier)
- wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect (Anjaneyulu)
- wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() (Rand Deeb)
- net: fec: allow disable coalescing (Jonas Rebmann)
- (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer (Thomas Fourier)
- s390/stp: Remove udelay from stp_sync_clock() (Sven Schnelle)
- wifi: iwlwifi: mvm: fix scan request validation (Avraham Stern)
- net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() (Alok Tiwari)
- net: ipv4: fix incorrect MTU in broadcast routes (Oscar Maes)
- wifi: cfg80211: Fix interface type validation (Ilan Peer)
- rcu: Protect ->defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423341] {CVE-2025-39749}
- net: ag71xx: Add missing check after DMA map (Thomas Fourier)
- et131x: Add missing check after DMA map (Thomas Fourier)
- be2net: Use correct byte order and format string for TCP seq and ack_seq (Alok Tiwari)
- s390/time: Use monotonic clock in get_cycles() (Sven Schnelle)
- wifi: cfg80211: reject HTC bit for management frames (Johannes Berg)
- ktest.pl: Prevent recursion of default variable options (Steven Rostedt)
- ASoC: codecs: rt5640: Retry DEVICE_ID verification (Xinxin Wan)
- ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros (Cristian Ciocaltea)
- ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun) [Orabug: 38423359] {CVE-2025-39751}
- platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches (Kees Cook)
- pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() (Gautham R. Shenoy)
- usb: core: usb_submit_urb: downgrade type check (Oliver Neukum)
- ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 (Alok Tiwari)
- ASoC: hdac_hdmi: Rate limit logging on connection and disconnection (Mark Brown)
- mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() (Ulf Hansson)
- ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (Breno Leitao)
- ACPI: processor: fix acpi_object initialization (Sebastian Ott)
- PM: sleep: console: Fix the black screen issue (Tuhaowen)
- thermal: sysfs: Return ENODATA instead of EAGAIN for reads (Hsin-Te Yuan)
- PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() (Rafael J. Wysocki)
- selftests: tracing: Use mutex_unlock for testing glob filter (Masami Hiramatsu)
- ARM: tegra: Use I/O memcpy to write to IRAM (Aaron Kling) [Orabug: 38429180] {CVE-2025-39794}
- gpio: tps65912: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed (Kuninori Morimoto)
- ARM: rockchip: fix kernel hang during smp initialization (Alexander Kochetkov) [Orabug: 38423372] {CVE-2025-39752}
- cpufreq: Exit governor when failed to start old governor (Lifeng Zheng)
- usb: xhci: Avoid showing errors during surprise removal (Mario Limonciello)
- usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command (Jay Chen)
- usb: xhci: Avoid showing warnings for dying controller (Mario Limonciello)
- selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t (Cynthia Huang)
- usb: xhci: print xhci->xhc_state when queue_command failed (Su Hui)
- securityfs: don't pin dentries twice, once is enough... (Al Viro)
- hfs: fix not erasing deleted b-tree node issue (Viacheslav Dubeyko)
- drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394995] {CVE-2025-38708}
- udf: Verify partition map count (Jan Kara)
- arm64: Handle KCOV __init vs inline mismatches (Kees Cook)
- hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko) [Orabug: 38395027] {CVE-2025-38713}
- hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko) [Orabug: 38395033] {CVE-2025-38714}
- hfs: fix slab-out-of-bounds in hfs_bnode_read() (Viacheslav Dubeyko) [Orabug: 38395039] {CVE-2025-38715}
- sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395059] {CVE-2025-38718}
- netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395068] {CVE-2025-38721}
- udp: also consider secpath when evaluating ipsec use for checksumming (Sabrina Dubroca)
- ACPI: processor: perflib: Move problematic pr->performance check (Rafael J. Wysocki)
- ACPI: processor: perflib: Fix initial _PPC limit application (Jiayi Li)
- Documentation: ACPI: Fix parent device references (Andy Shevchenko)
- fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423397] {CVE-2025-39756}
- sunvdc: Balance device refcount in vdc_port_mpgroup_check (Ma Ke)
- NFSD: detect mismatch of file handle and delegation stateid in OPEN op (Dai Ngo)
- net: dpaa: fix device leak when querying time stamp info (Johan Hovold)
- net: gianfar: fix device leak when querying time stamp info (Johan Hovold)
- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38401319] {CVE-2025-38727}
- ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423407] {CVE-2025-39757}
- ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395101] {CVE-2025-38729}
- io_uring: don't use int for ABI (Pavel Begunkov)
- usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue) [Orabug: 38334898] {CVE-2025-38555}
- MIPS: mm: tlb-r4k: Uniquify TLB entries on init (Jiaxun Yang)
- USB: serial: option: add Foxconn T99W709 (Slark Xiao)
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351771,38453914] {CVE-2025-38618}
- net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351764] {CVE-2025-38617}
- perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334948] {CVE-2025-38563}
- perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334959] {CVE-2025-38565}
- perf/core: Don't leak AUX buffer refcount on allocation failure (Thomas Gleixner)
- pptp: fix pptp_xmit() error path (Eric Dumazet)
- smb: client: let recv_done() cleanup before notifying the callers. (Stefan Metzmacher)
- benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334976] {CVE-2025-38569}
- net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351786] {CVE-2025-38622}
- ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334988] {CVE-2025-38572}
- pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335004] {CVE-2025-38574}
- netpoll: prevent hanging NAPI when netcons gets enabled (Jakub Kicinski)
- NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401745] {CVE-2025-39730}
- pci/hotplug/pnv-php: Wrap warnings in macro (Frederic Barrat)
- pci/hotplug/pnv-php: Improve error msg on power state change failure (Frederic Barrat)
- usb: chipidea: udc: fix sleeping function called from invalid context (Peter Chen)
- f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu) [Orabug: 38351895] {CVE-2025-38652}
- f2fs: fix to avoid panic in f2fs_evict_inode (Chao Yu) [Orabug: 38335025] {CVE-2025-38577}
- f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu) [Orabug: 38335033] {CVE-2025-38578}
- rtc: pcf8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: hym8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: ds1307: fix incorrect maximum clock rate handling (Brian Masney)
- module: Restore the moduleparam prefix length check (Petr Pavlu)
- bpf: Check flow_dissector ctx accesses are aligned (Paul Chaignon)
- mtd: rawnand: atmel: set pmecc data setup time (Balamanikandan Gunasundar)
- mtd: rawnand: atmel: Fix dma_mapping_error() address (Thomas Fourier)
- jfs: fix metapage reference count leak in dbAllocCtl (Zheng Yu)
- fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (Chenyuan Yang) [Orabug: 38351831] {CVE-2025-38630}
- crypto: qat - fix seq_file position update in adf_ring_next() (Giovanni Cabiddu)
- dmaengine: nbpfaxi: Add missing check after DMA map (Thomas Fourier)
- dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (Thomas Fourier)
- fs/orangefs: Allow 2 more characters in do_c_string() (Dan Carpenter)
- soundwire: stream: restore params when prepare ports fail (Bard Liao)
- crypto: img-hash - Fix dma_unmap_sg() nents value (Thomas Fourier)
- hwrng: mtk - handle devm_pm_runtime_enable errors (Ovidiu Panait)
- watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (Dan Carpenter)
- scsi: isci: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: mvsas: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: sunxi-ng: v3s: Fix de clock definition (Paul Kocialkowski)
- perf tests bp_account: Fix leaked file descriptor (Leo Yan)
- crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong) [Orabug: 38335042] {CVE-2025-38581}
- pinctrl: sunxi: Fix memory leak on krealloc failure (Yuan Chen)
- power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (Charles Han)
- clk: davinci: Add NULL check in davinci_lpsc_clk_register() (Henry Martin) [Orabug: 38351846] {CVE-2025-38635}
- mtd: fix possible integer overflow in erase_xfer() (Ivan Stepchenko)
- crypto: marvell/cesa - Fix engine load inaccuracy (Herbert Xu)
- PCI: rockchip-host: Fix "Unexpected Completion" log message (Hans Zhang)
- vrf: Drop existing dst reference in vrf_ip6_input_dst (Stanislav Fomichev)
- selftests: rtnetlink.sh: remove esp4_offload after test (Xiumei Mu)
- netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351854] {CVE-2025-38639}
- can: kvaser_usb: Assign netdev.dev_port based on device channel index (Jimmy Assarsson)
- can: kvaser_pciefd: Store device channel index (Jimmy Assarsson)
- wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (Gokul Sivakumar)
- Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Remi Pommarel)
- mwl8k: Add missing check after DMA map (Thomas Fourier)
- wifi: rtl8xxxu: Fix RX skb size for aggregation disabled (Martin Kaistra)
- net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug: 38331466] {CVE-2025-38553}
- arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX (Johan Korsnes)
- drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (Fedor Pchelkin)
- m68k: Don't unregister boot console needlessly (Finn Thain)
- tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range (Xin Guo)
- iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335110] {CVE-2025-38602}
- wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (Xiu Jianfeng)
- wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335120] {CVE-2025-38604}
- caif: reduce stack size, again (Arnd Bergmann)
- bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure (Yuan Chen)
- bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335131] {CVE-2025-38608}
- staging: nvec: Fix incorrect null termination of battery manufacturer (Alok Tiwari)
- samples: mei: Fix building on musl libc (Brahmajit Das)
- cpufreq: Init policy->rwsem before it may be possibly used (Lifeng Zheng)
- ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface (Annette Kobou)
- usb: early: xhci-dbc: Fix early_ioremap leak (Lucas De Marchi)
- Revert "vmci: Prevent the dispatching of uninitialized payloads" (Greg Kroah-Hartman)
- pps: fix poll support (Denis Osterland-Heim)
- vmci: Prevent the dispatching of uninitialized payloads (Lizhi Xu)
- staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal) [Orabug: 38335153] {CVE-2025-38612}
- ARM: dts: vfxxx: Correctly use two tuples for timer address (Krzysztof Kozlowski)
- hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li) [Orabug: 38351890] {CVE-2025-38650}
- ASoC: Intel: fix SND_SOC_SOF dependencies (Arnd Bergmann)
- ethernet: intel: fix building with large NR_CPUS (Arnd Bergmann)
- usb: phy: mxs: disconnect line when USB charger is attached (Xu Yang)
- usb: chipidea: add USB PHY event (Xu Yang)
- usb: chipidea: introduce CI_HDRC_CONTROLLER_VBUS_EVENT glue layer use (Peter Chen)
- usb: chipidea: udc: protect usb interrupt enable (Li Jun)
- usb: chipidea: udc: add new API ci_hdrc_gadget_connect (Peter Chen)
- ALSA: hda: Add missing NVIDIA HDA codec IDs (Daniel Dadap)
- comedi: comedi_test: Fix possible deletion of uninitialized timers (Ian Abbott)
- nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi) [Orabug: 38351921] {CVE-2025-38663}
- i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351994] {CVE-2025-38671}
- net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei)
- net: appletalk: Fix use-after-free in AARP proxy probe (Kito Xu) [Orabug: 38351969] {CVE-2025-38666}
- net: appletalk: fix kerneldoc warnings (Andrew Lunn)
- RDMA/core: Rate limit GID cache warning messages (Maor Gottlieb)
- regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati) [Orabug: 38351978] {CVE-2025-38668}
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- net_sched: sch_sfq: reject invalid perturb period (Eric Dumazet) [Orabug: 38158477] {CVE-2025-38193}
- power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition (Zheng Wang)
- power: supply: bq24190_charger: using pm_runtime_resume_and_get instead of pm_runtime_get_sync (Minghao Chi)
- power: supply: bq24190_charger: Fix runtime PM imbalance on error (Dinghao Liu)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253834] {CVE-2025-38375}
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254214] {CVE-2025-38468}
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254225] {CVE-2025-38470}
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254241] {CVE-2025-38473}
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254249] {CVE-2025-38474}
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254266] {CVE-2025-38477}
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott) [Orabug: 38254278] {CVE-2025-38480}
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254294] {CVE-2025-38482}
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254301] {CVE-2025-38483}
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324231] {CVE-2025-38529}
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324238] {CVE-2025-38530}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter) [Orabug: 38324264] {CVE-2025-38538}
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254340,38453904] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254348,38453908] {CVE-2025-38495}
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254358] {CVE-2025-38497}
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- LTS tag: v5.4.296 (Sherry Yang)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID (Hans de Goede)
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324280] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254090] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu) [Orabug: 38324290] {CVE-2025-38542}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254109] {CVE-2025-38445}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324161] {CVE-2025-38513}
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- Input: xpad - add VID for Turtle Beach controllers (Vicki Pfau)
- Input: xpad - add support for Amazon Game Controller (Matt Reynolds)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Tigran Mkrtchyan)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254118] {CVE-2025-38448}
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324180] {CVE-2025-38515}
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324186] {CVE-2025-38516}
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells) [Orabug: 38324172] {CVE-2025-38514}
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254147] {CVE-2025-38457}
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254153] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254161] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324309] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254167] {CVE-2025-38460}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254181] {CVE-2025-38464}
- netlink: Fix wraparounds of sk->sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254188] {CVE-2025-38465}
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- proc: Clear the pieces of proc_inode that proc_evict_inode cares about (Eric W. Biederman)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254203] {CVE-2025-38467}
- staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() (Nathan Chancellor)
- media: uvcvideo: Rollback non processed entities on error (Ricardo Ribalda)
- media: uvcvideo: Send control events for partial succeeds (Ricardo Ribalda)
- media: uvcvideo: Return the number of processed controls (Ricardo Ribalda)
- ACPI: PAD: fix crash in exit_round_robin() (Seiji Nishikawa) [Orabug: 37206006] {CVE-2024-49935}
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38401436] {CVE-2025-38404}
- Logitech C-270 even more broken (Oliver Neukum)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253842] {CVE-2025-38377}
- net: rose: Fix fall-through warnings for Clang (Gustavo A R Silva)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253887] {CVE-2025-38389}
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- spi: spi-fsl-dspi: Fix interrupt-less DMA mode taking an XSPI code path (Vladimir Oltean)
- spi: spi-fsl-dspi: Rename fifo_{read,write} and {tx,cmd}_fifo_write (Vladimir Oltean)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad)
- RDMA/core: Create and destroy counters in the ib_core (Leon Romanovsky)
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal) [Orabug: 38253821] {CVE-2025-38371}
- mtk-sd: reset host->mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253928] {CVE-2025-38401}
- mmc: mediatek: use data instead of mrq parameter from msdc_{un}prepare_data() (Yue Hu)
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253907] {CVE-2025-38395}
- regulator: gpio: Add input_supply support in gpio_regulator_config (Jerome Neanne)
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253875] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253946] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253923] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253881] {CVE-2025-38387}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253894] {CVE-2025-38391}
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253937] {CVE-2025-38403}
- btrfs: don't abort filesystem when attempting to snapshot deleted subvolume (Omar Sandoval) [Orabug: 36530119] {CVE-2024-26644}
- arm64: Restrict pagetable teardown to avoid false warning (Dev Jain)
- s390: Add '-std=gnu11' to decompressor and purgatory CFLAGS (Nathan Chancellor)
- drm/bridge: cdns-dsi: Check return value when getting default PHY config (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix connecting to next bridge (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix the clock variable for mode_valid() (Aradhya Bhatia)
- drm/tegra: Assign plane type before registration (Thierry Reding)
- HID: wacom: fix kobject reference count leak (Qasim Ijaz)
- HID: wacom: fix memory leak on sysfs attribute creation failure (Qasim Ijaz)
- HID: wacom: fix memory leak on kobject creation failure (Qasim Ijaz)
- dm-raid: fix variable in journal device check (Heinz Mauelshagen)
- Bluetooth: L2CAP: Fix L2CAP MTU negotiation (Frédéric Danis)
- atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). (Kuniyuki Iwashima) [Orabug: 38175045] {CVE-2025-38245}
- net: enetc: Correct endianness handling in _enetc_rd_reg64 (Simon Horman)
- um: ubd: Add missing error check in start_io_thread() (Tiwei Bie)
- vsock/uapi: fix linux/vm_sockets.h userspace compilation errors (Stefano Garzarella)
- wifi: mac80211: fix beacon interval calculation overflow (Lachlan Hodges)
- attach_recursive_mnt(): do not lock the covering tree when sliding something under it (Al Viro)
- ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() (Youngjun Lee) [Orabug: 38175065] {CVE-2025-38249}
- i2c: robotfuzz-osif: disable zero-length read messages (Wolfram Sang)
- i2c: tiny-usb: disable zero-length read messages (Wolfram Sang)
- RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Shin'Ichiro Kawasaki) [Orabug: 38158592] {CVE-2025-38211}
- RDMA/core: Use refcount_t instead of atomic_t on refcount of iwcm_id_private (Weihang Li)
- media: vivid: Change the siize of the composing (Denis Arefev) [Orabug: 38158681] {CVE-2025-38226}
- media: omap3isp: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: cxusb: no longer judge rbuf when the write fails (Edward Adam Davis) [Orabug: 38158692] {CVE-2025-38229}
- media: cxusb: use dev_dbg() rather than hand-rolled debug (Sean Young)
- jfs: validate AG parameters in dbMount() to prevent crashes (Vasiliy Kovalev) [Orabug: 38158701] {CVE-2025-38230}
- fs/jfs: consolidate sanity checking in dbMount (Dave Kleikamp)
- ASoC: meson: meson-card-utils: use of_property_present() for DT parsing (Martin Blumenstingl)
- of: Add of_property_present() helper (Rob Herring)
- of: property: define of_property_read_u{8,16,32,64}_array() unconditionally (Michael Walle)
- kbuild: hdrcheck: fix cross build with clang (Arnd Bergmann)
- kbuild: add --target to correctly cross-compile UAPI headers with Clang (Masahiro Yamada)
- bpfilter: match bit size of bpfilter_umh to that of the kernel (Masahiro Yamada)
- kbuild: use -MMD instead of -MD to exclude system headers from dependency (Masahiro Yamada)
- VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify (Ma Wupeng) [Orabug: 38152869] {CVE-2025-38102}
- VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF (George Kennedy)
- ovl: Check for NULL d_inode() in ovl_dentry_upper() (Kees Cook)
- ceph: fix possible integer overflow in ceph_zero_objects() (Dmitry Kandybka)
- ALSA: hda: Ignore unsol events for cards being shut down (Cezary Rojewski)
- usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode (Jos Wang)
- usb: cdc-wdm: avoid setting WDM_READ for ZLP-s (Robert Hodaszi)
- usb: Add checks for snprintf() calls in usb_alloc_dev() (Andy Shevchenko)
- tty: serial: uartlite: register uart driver in init (Jakub Lewalski) [Orabug: 38175114] {CVE-2025-38262}
- usb: potential integer overflow in usbg_make_tpg() (Chen Yufeng)
- iio: pressure: zpa2326: Use aligned_s64 for the timestamp (Jonathan Cameron)
- md/md-bitmap: fix dm-raid max_write_behind setting (Yu Kuai)
- dmaengine: xilinx_dma: Set dma_device directions (Thomas Gessler)
- mfd: max14577: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- mailbox: Not protect module_put with spin_lock_irqsave (Peng Fan)
- cifs: Fix cifs_query_path_info() for Windows NT servers (Pali Rohár)
-
Wed Sep 03 2025 Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.347.6.el8uek]
- net_sched: sch_sfq: move the limit validation (Octavian Purdila) [Orabug: 38377926,38394593] {CVE-2025-37752}
- net_sched: sch_sfq: use a temporary work area for validating configuration (Octavian Purdila) [Orabug: 38377926]
- net_sched: sch_sfq: don't allow 1 packet limit (Octavian Purdila) [Orabug: 38377926] {CVE-2024-57996}
- net_sched: sch_sfq: handle bigger packets (Eric Dumazet) [Orabug: 38377926]
- net_sched: sch_sfq: annotate data-races around q->perturb_period (Eric Dumazet) [Orabug: 38377926]
-
Thu Aug 28 2025 Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.347.5.el8uek]
- squashfs: fix memory leak in squashfs_fill_super (Phillip Lougher) [Orabug: 38343661]
- netfilter: nf_tables: adjust lockdep assertions handling (Fedor Pchelkin)
- Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" (Helge Deller) [Orabug: 38343661]
- ASoC: ops: dynamically allocate struct snd_ctl_elem_value (Arnd Bergmann)
-
Thu Aug 21 2025 Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.347.4.el8uek]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38319938,38440302] {CVE-2025-39823}
- KVM: APIC: add helper func to remove duplicate code in kvm_pv_send_ipi (Miaohe Lin) [Orabug: 38319938]
- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169303]
-
Thu Aug 07 2025 Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.347.3.el8uek]
- mm: make page_mapped_in_vma() hugetlb walk aware (Jane Chu) [Orabug: 38146326]
- mm/rmap: Fix handling of hugetlbfs pages in page_vma_mapped_walk (Zhenwei Pi) [Orabug: 38146326]
-
Thu Jul 31 2025 Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.347.2.el8uek]
- rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38236847]
- kexec: Improve & fix crash_exclude_mem_range() to handle overlapping ranges (Lianbo Jiang) [Orabug: 38134902]
- module: correctly exit module_kallsyms_on_each_symbol when fn() != 0 (Jon Mediero) [Orabug: 37820709]
- module: potential uninitialized return in module_kallsyms_on_each_symbol() (Dan Carpenter) [Orabug: 37820709]
- module: use RCU to synchronize find_module (Christoph Hellwig) [Orabug: 37820709]
- kallsyms: refactor {,module_}kallsyms_on_each_symbol (Christoph Hellwig) [Orabug: 37820709]
-
Thu Jul 31 2025 Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.347.1.el8uek]
- LTS tag: v5.4.295 (Alok Tiwari)
- scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops (Kees Cook)
- arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (Tengda Wu) [Orabug: 38180596] {CVE-2025-38320}
- perf: Fix sample vs do_exit() (Peter Zijlstra) [Orabug: 38254030] {CVE-2025-38424}
- s390/pci: Fix __pcilg_mio_inuser() inline assembly (Heiko Carstens)
- rtc: test: Fix invalid format specifier. (David Gow)
- jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (Jeongjun Park) [Orabug: 38180707] {CVE-2025-38337}
- mm/huge_memory: fix dereferencing invalid pmd migration entry (Gavin Guo) [Orabug: 37976985] {CVE-2025-37958}
- rtc: Make rtc_time64_to_tm() support dates before 1970 (Alexandre Mergnat)
- rtc: Improve performance of rtc_time64_to_tm(). Add tests. (Cassio Neri)
- xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (Dan Aloni) [Orabug: 37101886] {CVE-2022-48773}
- posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [Orabug: 38223087] {CVE-2025-38352}
- ARM: dts: am335x-bone-common: Increase MDIO reset deassert delay to 50ms (Geert Uytterhoeven)
- ARM: dts: am335x-bone-common: Increase MDIO reset deassert time (Colin Foster)
- ARM: dts: am335x-bone-common: Add GPIO PHY reset on revision C3 board (Shengyu Qu)
- net: atm: fix /proc/net/atm/lec handling (Eric Dumazet) [Orabug: 38158407] {CVE-2025-38180}
- net: atm: add lec_mutex (Eric Dumazet) [Orabug: 38180612] {CVE-2025-38323}
- calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). (Kuniyuki Iwashima) [Orabug: 38158413] {CVE-2025-38181}
- tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (Haixia Qu) [Orabug: 38158425] {CVE-2025-38184}
- tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior (Neal Cardwell)
- atm: atmtcp: Free invalid length skb in atmtcp_c_send(). (Kuniyuki Iwashima) [Orabug: 38158434] {CVE-2025-38185}
- mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (Kuniyuki Iwashima) [Orabug: 38180618] {CVE-2025-38324}
- wifi: carl9170: do not ping device which has failed to load firmware (Dmitry Antipov) [Orabug: 38254011] {CVE-2025-38420}
- aoe: clean device rq_list in aoedev_downdev() (Justin Sanders) [Orabug: 38180629] {CVE-2025-38326}
- hwmon: (occ) fix unaligned accesses (Arnd Bergmann)
- drm/nouveau/bl: increase buffer size to avoid truncate warning (Jacob Keller)
- erofs: remove unused trace event erofs_destroy_inode (Gao Xiang)
- ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged (Jonathan Lane)
- ALSA: hda/intel: Add Thinkpad E15 to PM deny list (Takashi Iwai)
- Input: sparcspkr - avoid unannotated fall-through (Yuli Wang)
- HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (Terry Junge) [Orabug: 38152878] {CVE-2025-38103}
- atm: Revert atm_account_tx() if copy_from_iter_full() fails. (Kuniyuki Iwashima) [Orabug: 38158458] {CVE-2025-38190}
- selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len (Stephen Smalley)
- scsi: s390: zfcp: Ensure synchronous unit_add (Peter Oberparleiter)
- scsi: storvsc: Increase the timeouts to storvsc_timeout (Dexuan Cui)
- jffs2: check jffs2_prealloc_raw_node_refs() result in few other places (Fedor Pchelkin) [Orabug: 38180636] {CVE-2025-38328}
- jffs2: check that raw node were preallocated before writing summary (Artem Sadovnikov) [Orabug: 38158484] {CVE-2025-38194}
- drivers/rapidio/rio_cm.c: prevent possible heap overwrite (Andrew Morton) [Orabug: 38137454] {CVE-2025-38090}
- powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery (Narayana Murty N)
- platform/x86: dell_rbu: Stop overwriting data buffer (Stuart Hayes)
- platform: Add Surface platform directory (Maximilian Luz)
- Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first" (Alexander Sverdlin)
- tee: Prevent size calculation wraparound on 32-bit kernels (Jann Horn)
- ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY (Sukrut Bellary)
- bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value (Laurentiu Tudor)
- watchdog: da9052_wdt: respect TWDMIN (Marcus Folkesson)
- i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Kyungwook Boo) [Orabug: 38158518] {CVE-2025-38200}
- sock: Correct error checking condition for (assign|release)_proto_idx() (Zijun Hu)
- scsi: lpfc: Use memcpy() for BIOS version (Daniel Wagner) [Orabug: 38180668] {CVE-2025-38332}
- vxlan: Do not treat dst cache initialization errors as fatal (Ido Schimmel)
- clk: rockchip: rk3036: mark ddrphy as critical (Heiko Stuebner)
- wifi: mac80211: do not offer a mesh path if forwarding is disabled (Benjamin Berg)
- net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info (Jason Xing)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() (Gabor Juhos)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction() (Gabor Juhos)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction() (Gabor Juhos)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name() (Gabor Juhos)
- ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT (Sebastian Andrzej Siewior)
- tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows (Eric Dumazet)
- tcp: always seek for minimal rtt in tcp_rcv_rtt_update() (Eric Dumazet)
- net: dlink: add synchronization for stats update (Moon Yeounsu)
- sctp: Do not wake readers in __sctp_write_space() (Petr Malat)
- emulex/benet: correct command version selection in be_cmd_get_stats() (Alok Tiwari)
- i2c: designware: Invoke runtime suspend on quick slave re-registration (Tan En De)
- net: macb: Check return value of dma_set_mask_and_coherent() (Sergio Perez Gonzalez)
- cpufreq: Force sync policy boost with global boost on sysfs update (Viresh Kumar)
- nios2: force update_mmu_cache on spurious tlb-permission--related pagefaults (Simon Schuster)
- media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() (Xu Wang) [Orabug: 38175014] {CVE-2025-38237}
- media: tc358743: ignore video while HPD is low (Hans Verkuil)
- drm/amdkfd: Set SDMA_RLCx_IB_CNTL/SWITCH_INSIDE_IB (Amber Lin)
- jfs: Fix null-ptr-deref in jfs_ioc_trim (Dylan Wolff) [Orabug: 38158546] {CVE-2025-38203}
- drm/amdgpu/gfx9: fix CSIB handling (Alex Deucher)
- drm/amdgpu/gfx8: fix CSIB handling (Alex Deucher)
- jfs: fix array-index-out-of-bounds read in add_missing_indices (Aditya Dutt) [Orabug: 38158553] {CVE-2025-38204}
- drm/amdgpu/gfx7: fix CSIB handling (Alex Deucher)
- drm/amdgpu/gfx10: fix CSIB handling (Alex Deucher)
- drm/msm/a6xx: Increase HFI response timeout (Akhil P Oommen)
- drm/amd/display: Add NULL pointer checks in dm_force_atomic_commit() (Srinivasan Shanmugam)
- media: uapi: v4l: Fix V4L2_TYPE_IS_OUTPUT condition (Nas Chung)
- drm/msm/hdmi: add runtime PM calls to DDC transfer function (Dmitry Baryshkov)
- drm/bridge: analogix_dp: Add irq flag IRQF_NO_AUTOEN instead of calling disable_irq() (Damon Ding)
- sunrpc: update nextcheck time when adding new cache entries (Long Li)
- drm/amdgpu/gfx6: fix CSIB handling (Alex Deucher)
- ACPI: battery: negate current when discharging (Peter Marheine)
- PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() (Charan Teja Kalla)
- power: supply: bq27xxx: Retrieve again when busy (Jerry Lv)
- ACPICA: fix acpi parse and parseext cache leaks (Seunghun Han) [Orabug: 38180748] {CVE-2025-38344}
- ACPICA: Avoid sequence overread in call to strncmp() (Ahmed Salem)
- ACPICA: fix acpi operand cache leak in dswstate.c (Seunghun Han) [Orabug: 38180756] {CVE-2025-38345}
- iio: adc: ad7606_spi: fix reg write value mask (David Lechner)
- PCI: Fix lock symmetry in pci_slot_unlock() (Ilpo Järvinen)
- PCI: Add ACS quirk for Loongson PCIe (Huacai Chen)
- uio_hv_generic: Use correct size for interrupt and monitor pages (Long Li)
- regulator: max14577: Add error check for max14577_read_reg() (Xu Wang)
- mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS (Khem Raj)
- staging: iio: ad5933: Correct settling cycles encoding per datasheet (Gabriel)
- net: ch9200: fix uninitialised access during mii_nway_restart (Qasim Ijaz) [Orabug: 38132189] {CVE-2025-38086}
- ftrace: Fix UAF when lookup kallsym after ftrace disabled (Ye Bin) [Orabug: 38180768] {CVE-2025-38346}
- dm-mirror: fix a tiny race condition (Mikulas Patocka)
- mtd: nand: sunxi: Add randomizer configuration before randomizer enable (Xu Wang)
- mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk (Xu Wang)
- mm: fix ratelimit_pages update error in dirty_ratio_handler() (Jinliang Zheng)
- ipc: fix to protect IPCS lookups using RCU (Jeongjun Park) [Orabug: 38158598] {CVE-2025-38212}
- parisc: fix building with gcc-15 (Arnd Bergmann)
- vgacon: Add check for vc_origin address range in vgacon_scroll() (Gong, Ruiqi)
- fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [Orabug: 38158615] {CVE-2025-38214}
- EDAC/altera: Use correct write width with the INTTEST register (Niravkumar L Rabara)
- NFC: nci: uart: Set tty->disc_data only in success path (Krzysztof Kozlowski) [Orabug: 38253992] {CVE-2025-38416}
- f2fs: prevent kernel warning due to negative i_nlink from corrupted image (Jaegeuk Kim) [Orabug: 38158649] {CVE-2025-38219}
- Input: ims-pcu - check record size in ims_pcu_flash_firmware() (Dan Carpenter) [Orabug: 38254054] {CVE-2025-38428}
- ext4: fix calculation of credits for extent tree modification (Jan Kara)
- ext4: inline: fix len overflow in ext4_prepare_inline_data (Thadeu Lima de Souza Cascardo) [Orabug: 38158662] {CVE-2025-38222}
- bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device (Ioana Ciornei)
- ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 (Tasos Sahanidis) [Orabug: 38180697] {CVE-2025-38336}
- ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap() (Ross Stutterheim)
- media: v4l2-dev: fix error handling in __video_register_device() (Ma Ke)
- media: gspca: Add error handling for stv06xx_read_sensor() (Xu Wang)
- wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723 (Mingcong Bai)
- nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request (Neil Brown) [Orabug: 38254062] {CVE-2025-38430}
- wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() (Christian Lamparter) [Orabug: 38180783] {CVE-2025-38348}
- gfs2: move msleep to sleepable context (Alexander Aring)
- configfs: Do not override creating attribute file failure in populate_attrs() (Zijun Hu)
- net: usb: aqc111: debug info before sanitation (Oliver Neukum)
- calipso: unlock rcu before returning -EAFNOSUPPORT (Eric Dumazet)
- xen/arm: call uaccess_ttbr0_enable for dm_op hypercall (Stefano Stabellini)
- usb: Flush altsetting 0 endpoints before reinitializating them after reset. (Mathias Nyman)
- fs/filesystems: Fix potential unsigned integer underflow in fs_name() (Zijun Hu)
- net/mdiobus: Fix potential out-of-bounds read/write access (Jakub Raczynski)
- drm/amd/display: Do not add '-mhard-float' to dcn2{1,0}_resource.o for clang (Nathan Chancellor)
- drm/amd/display: Do not add '-mhard-float' to dml_ccflags for clang (Nathan Chancellor)
- MIPS: Move '-Wa,-msoft-float' check from as-option to cc-option (Nathan Chancellor)
- x86/boot/compressed: prefer cc-option for CFLAGS additions (Nick Desaulniers)
- net: mdio: C22 is now optional, EOPNOTSUPP if not provided (Andrew Lunn)
- net_sched: tbf: fix a race in tbf_change() (Eric Dumazet)
- net_sched: red: fix a race in __red_change() (Eric Dumazet) [Orabug: 38152899] {CVE-2025-38108}
- net_sched: prio: fix a race in prio_tune() (Eric Dumazet) [Orabug: 38105335] {CVE-2025-38083}
- net/mlx5: Fix return value when searching for existing flow group (Patrisious Haddad)
- net/mlx5: Wait for inactive autogroups (Paul Blakey)
- i40e: retry VFLR handling if there is ongoing VF reset (Robert Malz)
- i40e: return false from i40e_reset_vf if reset is in progress (Robert Malz)
- net_sched: sch_sfq: fix a potential crash on gso_skb handling (Eric Dumazet) [Orabug: 38152923] {CVE-2025-38115}
- scsi: iscsi: Fix incorrect error path labels for flashnode operations (Alok Tiwari)
- NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes (Chuck Lever) [Orabug: 36954169] {CVE-2022-48829}
- NFSD: Fix ia_size underflow (Chuck Lever) [Orabug: 36954164] {CVE-2022-48828}
- Input: synaptics-rmi - fix crash with unsupported versions of F34 (Dmitry Torokhov)
- Input: synaptics-rmi4 - convert to use sysfs_emit() APIs (Zhang Songyi)
- pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id() (Dan Carpenter)
- do_change_type(): refuse to operate on unmounted/not ours mounts (Al Viro) [Orabug: 38256450] {CVE-2025-38498}
- ice: create new Tx scheduler nodes for new queues only (Michal Kubiak)
- Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION (Luiz Augusto von Dentz)
- net/mlx4_en: Prevent potential integer overflow calculating Hz (Dan Carpenter)
- vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl() (Nicolas Pitre)
- serial: Fix potential null-ptr-deref in mlb_usio_probe() (Henry Martin) [Orabug: 38153012] {CVE-2025-38135}
- usb: renesas_usbhs: Reorder clock handling and power management in probe (Lad Prabhakar) [Orabug: 38153017] {CVE-2025-38136}
- rtc: Fix offset calculation for .start_secs < 0 (Alexandre Mergnat)
- rtc: sh: assign correct interrupts with DT (Wolfram Sang)
- perf record: Fix incorrect --user-regs comments (Dapeng Mi)
- perf tests switch-tracking: Fix timestamp comparison (Leo Yan)
- mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE (Alexey Gladkov)
- mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove() (Christophe Jaillet)
- rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() (Dan Carpenter)
- perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3 (Adrian Hunter)
- perf ui browser hists: Set actions->thread before calling do_zoom_thread() (Arnaldo Carvalho de Melo)
- fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (Sergey Shtylyov) [Orabug: 38180566] {CVE-2025-38312}
- soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() (Henry Martin) [Orabug: 38153060] {CVE-2025-38145}
- soc: aspeed: lpc: Fix impossible judgment condition (Su Hui)
- arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou (Quentin Schulz)
- ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device (Dmitry Baryshkov)
- bus: fsl-mc: fix double-free on mc_dev (Ioana Ciornei) [Orabug: 38180573] {CVE-2025-38313}
- nilfs2: do not propagate ENOENT error from nilfs_btree_propagate() (Ryusuke Konishi)
- nilfs2: add pointer check for nilfs_direct_propagate() (Xu Wang)
- Squashfs: check return result of sb_min_blocksize (Phillip Lougher) [Orabug: 38253985] {CVE-2025-38415}
- ARM: dts: at91: at91sam9263: fix NAND chip selects (Wolfram Sang)
- ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select (Wolfram Sang)
- f2fs: fix to correct check conditions in f2fs_cross_rename (Zhiguo Niu)
- f2fs: use d_inode(dentry) cleanup dentry->d_inode (Zhiguo Niu)
- calipso: Don't call calipso functions for AF_INET sk. (Kuniyuki Iwashima) [Orabug: 38153070] {CVE-2025-38147}
- net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy (Thangaraj Samynathan)
- net: usb: aqc111: fix error handling of usbnet read calls (Nikita Zhandarovich) [Orabug: 38153090] {CVE-2025-38153}
- netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy (Florian Westphal)
- wifi: ath9k_htc: Abort software beacon handling if disabled (Toke Høiland-Jørgensen) [Orabug: 38153110] {CVE-2025-38157}
- bpf: Fix WARN() in get_bpf_raw_tp_regs (Tao Chen) [Orabug: 38180489] {CVE-2025-38285}
- pinctrl: at91: Fix possible out-of-boundary access (Andy Shevchenko) [Orabug: 38180495] {CVE-2025-38286}
- ktls, sockmap: Fix missing uncharge operation (Jiayuan Chen)
- netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it (Huajian Yang)
- f2fs: clean up w/ fscrypt_is_bounce_page() (Chao Yu)
- RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h (Junxian Huang)
- wifi: rtw88: do not ignore hardware read error during DPK (Dmitry Antipov)
- net: ncsi: Fix GCPS 64-bit member variables (Hari Kalavakunta)
- f2fs: fix to do sanity check on sbi->total_valid_block_count (Chao Yu) [Orabug: 38153150] {CVE-2025-38163}
- drm/tegra: rgb: Fix the unbound reference count (Biju Das)
- drm/vkms: Adjust vkms_state->active_planes allocation type (Kees Cook)
- drm: rcar-du: Fix memory leak in rcar_du_vsps_init() (Biju Das)
- selftests/seccomp: fix syscall_restart test for arm compat (Neill Kapron)
- firmware: psci: Fix refcount leak in psci_dt_init (Miaoqian Lin)
- m68k: mac: Fix macintosh_config for Mac II (Finn Thain)
- drm/vmwgfx: Add seqno waiter for sync_files (Ian Forbes)
- spi: sh-msiof: Fix maximum DMA transfer size (Geert Uytterhoeven)
- ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions" (Armin Wolf)
- x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (Jiaqing Zhao)
- PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks() (Zijun Hu)
- EDAC/skx_common: Fix general protection fault (Qiuxu Zhuo) [Orabug: 38180525] {CVE-2025-38298}
- crypto: marvell/cesa - Avoid empty transfer descriptor (Herbert Xu)
- crypto: marvell/cesa - Handle zero-length skcipher requests (Herbert Xu) [Orabug: 38153190] {CVE-2025-38173}
- x86/cpu: Sanitize CPUID(0x80000000) output (Ahmed S. Darwish)
- perf/core: Fix broken throttling when max_samples_per_tick=1 (Qing Wang)
- gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher)
- netfilter: nft_socket: fix sk refcount leaks (Florian Westphal) [Orabug: 37116555] {CVE-2024-46855}
- thunderbolt: Do not double dequeue a configuration request (Sergey Senozhatsky) [Orabug: 38158384] {CVE-2025-38174}
- usb: usbtmc: Fix timeout value in get_stb (Dave Penkler)
- usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device (Hongyu Xie)
- usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE (Jiayi Li)
- pinctrl: armada-37xx: set GPIO output value before setting direction (Gabor Juhos)
- pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs > 31 (Gabor Juhos)