-
Mon Dec 01 2025 Jack Vogel <jack.vogel@oracle.com> [6.12.0-106.55.4.1.el9uek]
- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso) [Orabug: 38712798] {CVE-2025-38678}
-
Tue Nov 11 2025 Jack Vogel <jack.vogel@oracle.com> [6.12.0-106.55.4.el9uek]
- ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (Mateusz Polchlopek) [Orabug: 37844696] {CVE-2025-22117}
-
Tue Nov 04 2025 Jack Vogel <jack.vogel@oracle.com> [6.12.0-106.55.3.el9uek]
- uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu) [Orabug: 38594966]
- Revert "mptcp: disable by default" (Harshvardhan Jha) [Orabug: 38277777]
-
Tue Oct 28 2025 Jack Vogel <jack.vogel@oracle.com> [6.12.0-106.55.2.el9uek]
- LTS version: v6.12.55 (Jack Vogel)
- dmaengine: Add missing cleanup on module unload (Guenter Roeck)
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Rutland)
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
- mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592024] {CVE-2025-40040}
- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601817] {CVE-2025-40087}
- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (Devarsh Thakkar)
- mptcp: reset blackhole on success with non-loopback ifaces (Matthieu Baerts)
- mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). (Kuniyuki Iwashima)
- mptcp: Call dst_release() in mptcp_active_enable(). (Kuniyuki Iwashima)
- net: Add locking to protect skb->dev access in ip_output (Sharath Chandra Vurukala)
- ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (Eric Dumazet)
- net: dst: add four helpers to annotate data-races around dst->dev (Eric Dumazet)
- tcp: cache RTAX_QUICKACK metric in a hot cache line (Eric Dumazet)
- tcp: convert to dev_net_rcu() (Eric Dumazet)
- ixgbevf: fix mailbox API compatibility by negotiating supported features (Jedrzej Jagielski) [Orabug: 38601914] {CVE-2025-40104}
- ixgbevf: fix getting link speed data for E610 devices (Jedrzej Jagielski)
- vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601921] {CVE-2025-40105}
- d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier (Al Viro)
- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
- x86/resctrl: Refactor resctrl_arch_rmid_read() (Babu Moger)
- md: fix mssing blktrace bio split events (Yu Kuai)
- padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
- xfs: use deferred intent items for reaping crosslinked blocks (Darrick J. Wong)
- wifi: rtw89: avoid possible TX wait initialization race (Fedor Pchelkin)
- NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
- NFSD: Implement large extent array support in pNFS (Sergey Bashirov)
- NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
- NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
- nfsd: Drop dprintk in blocklayout xdr functions (Sergey Bashirov)
- nfsd: Use correct error code when decoding extents (Sergey Bashirov)
- iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
- iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
- PM: runtime: Add new devm functions (Csókás Bence)
- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (Devarsh Thakkar)
- phy: cdns-dphy: Store hs_clk_rate and return it (Tomi Valkeinen)
- xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
- xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
- nvme/tcp: handle tls partially sent records in write_space() (Wilfred Mallawa)
- selftests: arg_parsing: Ensure data is flushed to disk before reading. (Xing Guo)
- ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails (Li Qiang)
- HID: multitouch: fix name of Stylus input devices (Thadeu Lima de Souza Cascardo)
- HID: hid-input: only ignore 0 battery events for digitizers (Dmitry Torokhov)
- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597092] {CVE-2025-40085}
- selftests/bpf: make arg_parsing.c more robust to crashes (Andrii Nakryiko)
- accel/qaic: Synchronize access to DBC request queue head & tail pointer (Pranjal Ramajor Asha Kanojiya)
- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (Youssef Samir)
- accel/qaic: Fix bootlog initialization ordering (Jeffrey Hugo)
- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
- sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
- drm/rockchip: vop2: use correct destination rectangle height check (Alok Tiwari)
- drm/draw: fix color truncation in drm_draw_fill24 (Francesco Valla)
- drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
- drm/amdgpu: fix handling of harvesting for ip_discovery firmware (Alex Deucher)
- drm/amdgpu: add support for cyan skillfish without IP discovery (Alex Deucher)
- drm/amdgpu: add ip offset support for cyan skillfish (Alex Deucher)
- drm/i915/guc: Skip communication warning on reset in progress (Zhanjun Dong)
- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (Cristian Ciocaltea)
- ASoC: nau8821: Generalize helper to clear IRQ status (Cristian Ciocaltea)
- ASoC: nau8821: Cancel jdet_work before handling jack ejection (Cristian Ciocaltea)
- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (Christophe Leroy)
- drm/bridge: lt9211: Drop check for last nibble of version register (Marek Vasut)
- riscv: kprobes: Fix probe address validation (Fabian Vogt)
- nvme-multipath: Skip nr_active increments in RETRY disposition (Amit Chaudhary)
- drm/panthor: Ensure MCU is disabled on suspend (Ketil Johnsen)
- net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset (I Viswanath)
- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
- netdevsim: set the carrier when the device goes up (Breno Leitao)
- tls: don't rely on tx_work during send() (Sabrina Dubroca)
- tls: wait for pending async decryptions if tls_strp_msg_hold fails (Sabrina Dubroca)
- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
- tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
- tls: trim encrypted message to match the plaintext on short splice (Sabrina Dubroca)
- tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
- ksmbd: fix recursive locking in RPC handle list access (Marios Makassikis)
- tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
- amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
- net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov)
- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
- doc: fix seg6_flowlabel path (Nicolas Dichtel)
- net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
- can: m_can: fix CAN state in system PM (Marc Kleine-Budde)
- can: m_can: call deinit/init callback when going into suspend/resume (Sean Nyekjaer)
- can: m_can: add deinit callback (Sean Nyekjaer)
- can: m_can: m_can_chip_config(): bring up interface in correct state (Marc Kleine-Budde)
- can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active (Marc Kleine-Budde)
- can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
- dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
- HID: multitouch: fix sticky fingers (Benjamin Tissoires)
- Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" (Jens Axboe)
- cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
- usb: gadget: f_rndis: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ecm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
- usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
- drm/exynos: exynos7_drm_decon: remove ctx->suspended (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
- media: nxp: imx8-isi: m2m: Fix streaming cleanup on release (Guoniu Zhou)
- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (Laurent Pinchart)
- drm/msm/a6xx: Fix PDC sleep sequence (Akhil P Oommen)
- cdx: Fix device node reference leak in cdx_msi_domain_init (Miaoqian Lin)
- irqdomain: cdx: Switch to of_fwnode_handle() (Jiri Slaby)
- drm/amd: Check whether secure display TA loaded successfully (Mario Limonciello)
- perf/core: Fix MMAP2 event device with backing files (Adrian Hunter)
- perf/core: Fix MMAP event path names with backing files (Adrian Hunter)
- perf/core: Fix address filter match with backing files (Adrian Hunter)
- drm/amdgpu: fix gfx12 mes packet status return check (Jonathan Kim)
- drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Tvrtko Ursulin) [Orabug: 38601869] {CVE-2025-40096}
- cifs: parse_dfs_referrals: prevent oob on malformed input (Eugene Korenevsky) [Orabug: 38601876] {CVE-2025-40099}
- can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
- can: gs_usb: gs_make_candev(): populate net_device->dev_port (Celeste Liu)
- btrfs: do not assert we found block group item when creating free space tree (Filipe Manana) [Orabug: 38601884] {CVE-2025-40100}
- btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (Miquel Sabaté Solà) [Orabug: 38601892] {CVE-2025-40101}
- btrfs: fix incorrect readahead expansion length (Boris Burkov)
- btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl (Miquel Sabaté Solà)
- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
- ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey)
- ext4: wait for ongoing I/O to complete before freeing blocks (Zhang Yi)
- jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
- f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
- r8152: add error handling in rtl8152_driver_init (Yi Cong)
- slab: reset slab->obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL (Hao Ge)
- smb: client: Fix refcount leak for cifs_sb_tlink (Shuhao Fu) [Orabug: 38601903] {CVE-2025-40103}
- rust: cfi: only 64-bit arm and x86 support CFI_CLANG (Conor Dooley)
- drm/xe/guc: Check GuC running state before deregistering exec queue (Shuicheng Lin)
- LTS version: v6.12.54 (Jack Vogel)
- nfsd: decouple the xprtsec policy check from check_nfsd_access() (Scott Mayhew)
- mount: handle NULL values in mnt_ns_release() (Christian Brauner)
- ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA (Kai Vehmanen)
- nfsd: fix access checking for NLM under XPRTSEC policies (Olga Kornievskaia)
- nfsd: fix __fh_verify for localio (Olga Kornievskaia)
- perf test stat: Avoid hybrid assumption when virtualized (Ian Rogers)
- sched/fair: Block delayed tasks on throttled hierarchy during dequeue (K Prateek Nayak)
- writeback: Avoid excessively long inode switching times (Jan Kara)
- writeback: Avoid softlockup when switching many inodes (Jan Kara)
- cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
- fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
- pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17)
- minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
- copy_file_range: limit size if in compat mode (Miklos Szeredi)
- irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume (Lucas Zampieri)
- irqchip/sifive-plic: Make use of __assign_bit() (Hongbo Li)
- s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG (Ilya Leoshkevich)
- s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL (Ilya Leoshkevich)
- s390/bpf: Describe the frame using a struct instead of constants (Ilya Leoshkevich)
- s390/bpf: Centralize frame offset calculations (Ilya Leoshkevich)
- mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage (Lance Yang)
- ipmi: Fix handling of messages with provided receive message pointer (Guenter Roeck)
- ipmi: Rework user message limit handling (Corey Minyard)
- mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
- ACPI: property: Do not pass NULL handles to acpi_attach_data() (Rafael J. Wysocki)
- ACPI: property: Add code comments explaining what is going on (Rafael J. Wysocki)
- ACPI: property: Disregard references in data-only subnode lists (Rafael J. Wysocki)
- ACPI: battery: Add synchronization between interface updates (Rafael J. Wysocki)
- ACPI: battery: Check for error code from devm_mutex_init() call (Andy Shevchenko)
- ACPI: battery: initialize mutexes through devm_ APIs (Thomas Weißschuh)
- ACPI: battery: allocate driver data through devm_ APIs (Thomas Weißschuh)
- nfsd: unregister with rpcbind when deleting a transport (Olga Kornievskaia)
- nfsd: don't use sv_nrthreads in connection limiting calculations. (Neil Brown)
- nfsd: refine and rename NFSD_MAY_LOCK (Neil Brown)
- NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock() (Chuck Lever)
- nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT (Pali Rohár)
- x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (Sean Christopherson)
- x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() (Kirill A. Shutemov)
- arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
- statmount: don't call path_put() under namespace semaphore (Christian Brauner)
- cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency (Rafael J. Wysocki)
- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
- ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples (Kai Vehmanen)
- ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams (Peter Ujfalusi)
- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (Shin'Ichiro Kawasaki)
- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (Wang Jiang)
- mm/ksm: fix incorrect KSM counter handling in mm_struct during fork (Donet Tom)
- tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592031] {CVE-2025-40042}
- Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher)
- Squashfs: add additional inode sanity checking (Phillip Lougher)
- media: mc: Clear minor number before put device (Edward Adam Davis)
- selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled (Lance Yang)
- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
- ext4: free orphan info with kvfree (Jan Kara)
- ACPICA: Allow to skip Global Lock initialization (Huacai Chen)
- ext4: validate ea_ino and size in check_xattrs (Deepanshu Kartikey)
- ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag)
- ext4: fix an off-by-one issue during moving extents (Zhang Yi)
- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (Theodore Ts'O)
- ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
- ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
- ext4: verify orphan file size is not too big (Jan Kara)
- ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() (Baokun Li)
- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
- mm/damon/lru_sort: use param_ctx for damon_attrs staging (Seongjae Park)
- mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (Seongjae Park)
- mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 (Li Rongqing)
- mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
- mm/thp: fix MTE tag mismatch when replacing zero-filled subpages (Lance Yang)
- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (Nick Morrow)
- wifi: mt76: mt7925u: Add VID/PID for Netgear A9000 (Nick Morrow)
- wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
- slab: mark slab->obj_exts allocation failures unconditionally (Suren Baghdasaryan)
- slab: prevent warnings when slab obj_exts vector allocation fails (Suren Baghdasaryan)
- s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR (Heiko Carstens)
- s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request (Jaehoon Kim)
- s390/dasd: enforce dma_alignment to ensure proper buffer validation (Jaehoon Kim)
- selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
- x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
- x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
- x86/fred: Remove ENDBR64 from FRED entry points (Xin Li)
- spi: cadence-quadspi: Fix cqspi_setup_flash() (Santhosh Kumar K)
- spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
- spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
- PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
- PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
- PCI: rcar-gen4: Fix PHY initialization (Marek Vasut)
- PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
- PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
- PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
- PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
- PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
- PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle)
- PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
- PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: xilinx-nwl: Fix ECAM programming (Jani Nurminen)
- rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
- rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
- rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
- memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
- mmc: mmc_spi: multiple block read remove read crc ack (Rex Chen)
- mmc: core: SPI mode remove cmd7 (Rex Chen)
- mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
- xsk: Harden userspace-supplied xdp_desc validation (Alexander Lobakin)
- xtensa: simdisk: add input size check in proc_write_simdisk (Miaoqian Lin)
- sparc: fix error handling in scan_one_device() (Ma Ke)
- sparc64: fix hugetlb for sun4u (Anthony Yznaga)
- sctp: Fix MAC comparison to be constant-time (Eric Biggers)
- scsi: sd: Fix build warning in sd_revalidate_disk() (Abinash Lalotra)
- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
- sched/deadline: Fix race in push_dl_task() (Harshit Agarwal)
- Revert "ipmi: fix msg stack when IPMI is disconnected" (Corey Minyard)
- pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
- powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
- powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
- power: supply: max77976_charger: fix constant current reporting (Dzmitry Sankouski)
- pinctrl: samsung: Drop unused S3C24xx driver data (Krzysztof Kozlowski)
- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
- parisc: Remove spurious if statement from raw_copy_from_user() (John David Anglin)
- parisc: don't reference obsolete termio struct for TC* constants (Sam James)
- openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
- of: unittest: Fix device reference count leak in of_unittest_pci_node_verify (Ma Ke)
- loop: fix backing file reference leak on validation error (Li Chen)
- lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
- KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
- kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths (Oleg Nesterov)
- iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
- iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
- init: handle bootloader identifier in kernel parameters (Huacai Chen)
- iio: xilinx-ams: Unmask interrupts after updating alarms (Sean Anderson)
- iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK (Sean Anderson)
- iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
- iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
- iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
- iio/adc/pac1934: fix channel disable configuration (Aleksandar Gerasimovski)
- fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong)
- fuse: fix possibly missing fuse_copy_finish() call in fuse_notify() (Miklos Szeredi)
- fs: quota: create dedicated workqueue for quota_release_work (Shashank A P)
- fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
- fbdev: Fix logic error in "offb" name match (Finn Thain)
- eventpoll: Replace rwlock with spinlock (Nam Cao)
- crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
- crypto: aspeed - Fix dma_unmap_sg() direction (Thomas Fourier)
- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki)
- copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) (Simon Schuster)
- clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk (Abel Vesa)
- bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
- bus: mhi: ep: Fix chained transfer handling in read path (Sumit Kumar)
- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento)
- blk-crypto: fix missing blktrace bio split events (Yu Kuai)
- drm/amd/display: Enable Dynamic DTBCLK Switch (Fangzhi Zuo)
- drm/xe/uapi: loosen used tracking restriction (Matthew Auld)
- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
- drm/rcar-du: dsi: Fix 1/2/3 lane support (Marek Vasut)
- drm/panthor: Fix memory leak in panthor_ioctl_group_create() (Jann Horn)
- media: lirc: Fix error handling in lirc_register() (Ma Ke)
- media: ti: j721e-csi2rx: Fix source subdev link creation (Jai Luthra)
- media: ti: j721e-csi2rx: Use devm_of_platform_populate (Jai Luthra)
- media: vivid: fix disappearing <Vendor Command With ID> messages (Hans Verkuil)
- media: venus: firmware: Use correct reset sequence for IRIS2 (Stephan Gerhold)
- media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
- media: pci: mg4b: fix uninitialized iio scan data (David Lechner)
- media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
- media: mc: Fix MUST_CONNECT handling for pads with no links (Laurent Pinchart)
- media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
- media: cx18: Add missing check after DMA map (Thomas Fourier)
- media: cec: extron-da-hd-4k-plus: drop external-module make commands (Randy Dunlap)
- firmware: meson_sm: fix device leak at probe (Johan Hovold)
- xen/events: Update virq_to_irq on migration (Jason Andryuk)
- xen/events: Return -EEXIST for bound VIRQs (Jason Andryuk)
- xen/manage: Fix suspend error path (Lukas Wunner)
- xen/events: Cleanup find_virq() return codes (Jason Andryuk)
- dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required (Michael Riesch)
- perf/arm-cmn: Fix CMN S3 DTM offset (Robin Murphy)
- ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
- ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) (Alexander Sverdlin)
- arm64: kprobes: call set_memory_rox() for kprobe page (Yang Shi)
- arm64: dts: ti: k3-am62a-main: Fix main padcfg length (Vibhore Vardhan)
- arm64: dts: qcom: x1e80100-pmics: Disable pm8010 by default (Aleksandrs Vinarskis)
- arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
- arm64: dts: qcom: msm8939: Add missing MDSS reset (Stephan Gerhold)
- arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
- ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
- ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
- ACPI: property: Fix buffer properties extraction for subnodes (Rafael J. Wysocki)
- s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections (Nathan Chancellor)
- s390: vmlinux.lds.S: Reorder sections (Alexey Gladkov)
- bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
- gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
- cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points (Pali Rohár)
- smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara)
- cifs: Fix copy_to_iter return value check (Wangfushuai)
- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581453] {CVE-2025-40019}
- selftests: netfilter: query conntrack state to check for port clash resolution (Florian Westphal)
- bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
- netfilter: nft_objref: validate objref and objrefmap expressions (Fernando Fernandez Mancera)
- drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
- drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
- mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() (Jason-JH Lin)
- mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend() (Sakari Ailus)
- mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend() (Sakari Ailus)
- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann)
- mailbox: zynqmp-ipi: Fix SGI cleanup on unbind (Harini T)
- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (Harini T)
- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
- tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() (Eric Dumazet)
- perf python: split Clang options when invoking Popen (Leo Yan)
- tools build: Align warning options with perf (Leo Yan)
- net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
- ice: ice_adapter: release xa entry on adapter allocation failure (Xu Wang)
- net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (Duoming Zhou)
- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima)
- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov)
- drm/vmwgfx: Fix copy-paste typo in validation (Ian Forbes)
- drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes)
- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin)
- s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
- drm/xe/hw_engine_group: Fix double write lock release in error path (Shuicheng Lin)
- net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
- ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel (Peter Ujfalusi)
- LoongArch: Init acpi_gbl_use_global_lock to false (Huacai Chen)
- LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference (Tiezhu Yang)
- ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (Peter Ujfalusi)
- scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557652] {CVE-2025-40001}
- cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
- clk: tegra: do not overallocate memory for bpmp clocks (Fedor Pchelkin)
- clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
- clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (Chen-Yu Tsai)
- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (AngeloGioacchino Del Regno)
- perf evsel: Ensure the fallback message is always written to (Ian Rogers)
- perf tools: Add fallback for exclude_guest (Namhyung Kim)
- perf test: Add a test for default perf stat command (James Clark)
- perf test: Don't leak workload gopipe in PERF_RECORD_* (Ian Rogers)
- perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
- perf test shell lbr: Avoid failures with perf event paranoia (Ian Rogers)
- perf test: Update sysfs path for core PMU caps (Namhyung Kim)
- perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches (Ilkka Koskinen)
- perf arm_spe: Correct memory level for remote access (Leo Yan)
- perf arm_spe: Correct setting remote access (Leo Yan)
- rtc: optee: fix memory leak on driver removal (Clément Le Goffic)
- rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
- perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
- clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() (Yuan Chen)
- clk: at91: peripheral: fix return value (Brian Masney)
- clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() (Dan Carpenter)
- libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
- perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
- perf test trace_btf_enum: Skip if permissions are insufficient (Ian Rogers)
- perf disasm: Avoid undefined behavior in incrementing NULL (Ian Rogers)
- asm-generic/io.h: Skip trace helpers if rwmmio events are disabled (Varad Gautam)
- media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() (Tomi Valkeinen)
- iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (Sean Christopherson)
- dma-mapping: fix direction in dma_alloc direction traces (Petr Tesarik)
- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (Toke Høiland-Jørgensen)
- clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
- listmount: don't call path_put() under namespace semaphore (Christian Brauner)
- rseq: Protect event mask against membarrier IPI (Thomas Gleixner)
- arm64: map [_text, _stext) virtual address range non-executable+read-only (Omar Sandoval)
- fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
- fs: always return zero on success from replace_fd() (Thomas Weißschuh)
- LTS version: v6.12.53 (Jack Vogel)
- usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
- arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode (Konrad Dybcio)
- usb: typec: tipd: Clear interrupts first (Sven Peter)
- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel)
- net/9p: Fix buffer overflow in USB transport layer (Dominique Martinet)
- bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
- pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591979] {CVE-2025-40030}
- tee: fix register_shm_helper() (Jens Wiklander) [Orabug: 38591986] {CVE-2025-40031}
- remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (Zhen Ni)
- sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu)
- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38591999] {CVE-2025-40035}
- Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
- misc: fastrpc: Skip reference for DMA handles (Ling Xu)
- misc: fastrpc: fix possible map leak in fastrpc_put_args (Ling Xu)
- misc: fastrpc: Fix fastrpc_map_lookup operation (Ling Xu)
- misc: fastrpc: Save actual DMA size in fastrpc_map structure (Ling Xu)
- nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
- mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi)
- fbdev: simplefb: Fix use after free in simplefb_detach_genpds() (Janne Grunau) [Orabug: 38592013] {CVE-2025-40037}
- KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (Sean Christopherson) [Orabug: 38592015] {CVE-2025-40038}
- ext4: fix checks for orphan inodes (Jan Kara)
- ksmbd: add max ip connections parameter (Namjae Jeon)
- ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
- ksmbd: Fix race condition in RPC handle list access (Yunseong Kim)
- LoongArch: Automatically disable kaslr if boot from kexec_file (Youling Tang)
- dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing)
- dm: fix queue start/stop imbalance under suspend/load/resume races (Zheng Qixing)
- mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
- mfd: rz-mtu3: Fix MTU5 NFCR register offset (Cosmin Tanislav)
- net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
- fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592045] {CVE-2025-40044}
- ASoC: codecs: wcd937x: make stub functions inline (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: set the comp soundwire port correctly (Srinivas Kandagatla)
- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (Ranjani Sridharan)
- ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
- io_uring/waitid: always prune wait queue entry in io_waitid_wait() (Jens Axboe) [Orabug: 38592063] {CVE-2025-40047}
- uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592065] {CVE-2025-40048}
- Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592075] {CVE-2025-40049}
- bpf: Reject negative offsets for ALU ops (Yazhou Tang)
- vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592084] {CVE-2025-40051}
- Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (Jakub Kicinski) [Orabug: 38545203]
- smb: client: fix crypto buffers in non-linear memory (Enzo Matsumiya) [Orabug: 38592090] {CVE-2025-40052}
- net/mlx5: fw reset, add reset timeout work (Moshe Shemesh)
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Shay Drory)
- net/mlx5: Stop polling for command response if interface goes down (Moshe Shemesh)
- net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592094] {CVE-2025-40053}
- net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
- nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
- idpf: fix mismatched free function for dma_alloc_coherent (Alok Tiwari)
- PCI: j721e: Fix incorrect error message in probe() (Alok Tiwari)
- mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands (Erick Karanja)
- drivers/base/node: fix double free in register_one_node() (Donet Tom)
- ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592108] {CVE-2025-40055}
- hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
- KEYS: X.509: Fix Basic Constraints CA flag parsing (Fan Wu)
- Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements (Luiz Augusto von Dentz)
- Bluetooth: ISO: don't leak skb in ISO_CONT RX (Pauli Virtanen)
- Bluetooth: ISO: free rx_skb if not consumed (Pauli Virtanen)
- Bluetooth: ISO: Fix possible UAF on iso_conn_free (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
- vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592116] {CVE-2025-40056}
- ptp: Add a upper bound on max_vclocks (I Viswanath) [Orabug: 38592122] {CVE-2025-40057}
- net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath)
- RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
- iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu) [Orabug: 38592128] {CVE-2025-40058}
- PCI: rcar-gen4: Fix inverted break condition in PHY initialization (Marek Vasut)
- PCI: rcar-gen4: Assure reset occurs before DBI access (Marek Vasut)
- PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion (Marek Vasut)
- usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar)
- netfilter: nfnetlink: reset nlh pointer during batch replay (Fernando Fernandez Mancera)
- ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581443] {CVE-2025-40018}
- NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
- coresight: Fix incorrect handling for return value of devm_kzalloc (Lin Yujun)
- coresight: tpda: fix the logic to setup the element size (Jie Gan)
- coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
- coresight: etm4x: Support atclk (Leo Yan)
- coresight: catu: Support atclk (Leo Yan)
- coresight: tmc: Support atclk (Leo Yan)
- coresight-etm4x: Conditionally access register TRCEXTINSELR (Yuanfang Zhang)
- dm vdo: return error on corrupted metadata in start_restoring_volume functions (Ivan Abramov)
- remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
- PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() (Nagarjuna Kristam)
- wifi: rtw89: avoid circular locking dependency in ser_state_run() (Fedor Pchelkin)
- RDMA/rxe: Fix race in do_task() when draining (Gui-Dong Han) [Orabug: 38592139] {CVE-2025-40061}
- crypto: hisilicon/qm - set NULL to qm->debug.qm_diff_regs (Chenghai Huang)
- vfio/pds: replace bitmap_free with vfree (Zilin Guan)
- sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
- ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback (Richard Fitzgerald)
- wifi: mac80211: fix Rx packet handling when pubsta information is not available (Aditya Kumar Singh)
- iommu/vt-d: debugfs: Fix legacy mode page table dump logic (Vineeth Pillai)
- wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
- wifi: ath12k: fix wrong logging ID used for CE (Baochen Qiang)
- Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
- IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
- RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
- Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
- f2fs: fix zero-sized extent for precache extents (Zijie Wang)
- HID: hidraw: tighten ioctl command parsing (Benjamin Tissoires)
- scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() (Rong Qianfeng)
- scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
- scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
- ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
- ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT (Sebastian Andrzej Siewior)
- f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() (Chao Yu)
- f2fs: fix to truncate first page in error path of f2fs_truncate() (Chao Yu)
- f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() (Chao Yu)
- wifi: mt76: mt7915: fix mt7981 pre-calibration (Zhi-Jun You)
- wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE (Lorenzo Bianconi)
- wifi: mt76: mt7996: Fix RX packets configuration for primary WED device (Lorenzo Bianconi)
- wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
- RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
- drivers/base/node: handle error properly in register_one_node() (Donet Tom)
- watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
- ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable (Zhang Tengfei)
- netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
- iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
- iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() (Hans de Goede)
- fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist (Moon Hee Lee)
- fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
- drm/msm/dpu: fix incorrect type for ret (Rong Qianfeng)
- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
- idpf: fix Rx descriptor ready check barrier in splitq (Alexander Lobakin)
- wifi: iwlwifi: Remove redundant header files (Liao Yuanhong)
- pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592168] {CVE-2025-40070}
- misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
- tty: n_gsm: Don't block input queue by waiting MSC (Seppo Takalo) [Orabug: 38592173] {CVE-2025-40071}
- usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
- usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
- drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
- tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
- PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation (Alok Tiwari)
- wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
- drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) (Timur Kristóf)
- drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) (Timur Kristóf)
- drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) (Timur Kristóf)
- drm/amd/pm: Adjust si_upload_smc_data register programming (v3) (Timur Kristóf)
- drm/amd/pm: Fix si_upload_smc_data (v3) (Timur Kristóf)
- drm/amd/pm: Disable ULV even if unsupported (v3) (Timur Kristóf)
- drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
- coresight: Only register perf symlink for sinks with alloc_buffer (Yuanfang Zhang)
- inet: ping: check sock_net() in ping_get_port() and ping_lookup() (Eric Dumazet)
- crypto: hisilicon/qm - check whether the input function and PF are on the same device (Zhushuai Yin)
- crypto: hisilicon - re-enable address prefetch after device resuming (Chenghai Huang)
- crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations (Chenghai Huang)
- media: st-delta: avoid excessive stack usage (Arnd Bergmann)
- ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
- PCI/ACPI: Fix pci_acpi_preserve_config() memory leak (Nirmoy Das)
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Or Har-Toov)
- media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
- crypto: octeontx2 - Call strscpy() with correct size argument (Thorsten Blum)
- scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel)
- hwrng: nomadik - add ARM_AMBA dependency (Arnd Bergmann)
- crypto: keembay - Add missing check after sg_nents_for_len() (Thomas Fourier)
- drm/amd/display: Remove redundant semicolons (Liao Yuanhong)
- serial: max310x: Add error checking in probe() (Dan Carpenter)
- usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls (Komal Bajaj)
- usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
- phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 (Jonas Karlman)
- media: zoran: Remove zoran_fh structure (Jacopo Mondi)
- drm/bridge: it6505: select REGMAP_I2C (Chia-I Wu)
- f2fs: fix condition in __allow_reserved_blocks() (Chao Yu)
- drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
- drm/panel: novatek-nt35560: Fix invalid return value (Brigham Campbell)
- bpf: Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann)
- libbpf: Fix error when st-prefix_ops and ops from differ btf (D. Wythe)
- i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
- i2c: designware: Fix clock issue when PM is disabled (Kunihiko Hayashi)
- i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
- thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
- thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
- hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems (Vadim Pasternak)
- once: fix race by moving DO_ONCE to separate section (Qi Xi)
- bpf: Mark kfuncs as __noclone (Andrea Righi)
- spi: fix return code when spi device has too many chipselects (Jonas Gorski)
- tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
- smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
- bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() (Hengqi Chen)
- bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592203] {CVE-2025-40078}
- selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
- i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
- i3c: master: svc: Use manual response for IBI events (Stanley Chu)
- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner)
- riscv, bpf: Sign extend struct ops return values properly (Hengqi Chen)
- ACPICA: Fix largest possible resource descriptor index (Dmitry Antipov)
- pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Make code comment in .free() more useful (Uwe Kleine-König)
- pwm: tiehrpwm: Don't drop runtime PM reference in .free() (Uwe Kleine-König)
- arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value (AngeloGioacchino Del Regno)
- mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() (Bean Huo)
- arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model (Chen-Yu Tsai)
- cpuidle: qcom-spm: fix device and OF node leaks at probe (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure (Johan Hovold)
- firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
- PM / devfreq: rockchip-dfi: double count on RK3588 (Nicolas Frattaroli)
- nbd: restrict sockets to TCP and UDP (Eric Dumazet) [Orabug: 38592211] {CVE-2025-40080}
- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 (Guoqing Jiang)
- selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO (Thomas Weißschuh)
- selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper (Thomas Weißschuh)
- null_blk: Fix the description of the cache_size module argument (Genjian Zhang)
- pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
- power: supply: cw2015: Fix a alignment coding style issue (Andy Yan)
- PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() (Dan Carpenter)
- ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property (Jihed Chaibi)
- ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS (Jihed Chaibi)
- ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax (Jihed Chaibi)
- vdso: Add struct __kernel_old_timeval forward declaration to gettime.h (Thomas Weißschuh)
- PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
- block: use int to store blk_stack_limits() return value (Rong Qianfeng)
- leds: leds-lp55xx: Use correct address for memory programming (Andrei Lalaev)
- selftests/nolibc: fix EXPECT_NZ macro (Benjamin Berg)
- regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
- arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map (Janne Grunau)
- ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
- blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan)
- pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
- soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
- ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
- arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid (Joy Zou)
- arm64: dts: imx93-kontron: Fix USB port assignment (Frieder Schrempf)
- arm64: dts: imx93-kontron: Fix GPIO for panel regulator (Annette Kobou)
- firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver (Junnan Wu)
- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
- leds: flash: leds-qcom-flash: Update torch current clamp setting (Fenglin Wu)
- ARM: dts: renesas: porter: Fix CAN pin group (Geert Uytterhoeven)
- libbpf: Fix reuse of DEVMAP (Yureka Lilian)
- bpf: Remove migrate_disable in kprobe_multi_link_prog_run (Tao Chen)
- bpf/selftests: Fix test_tcpnotify_user (Matt Bobrowski)
- regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
- arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 (Biju Das)
- pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() (Lad Prabhakar)
- btrfs: return any hit error from extent_writepage_io() (Qu Wenruo)
- lsm: CONFIG_LSM can depend on CONFIG_SECURITY (Randy Dunlap)
- x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
- EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo)
- smb: server: fix IRD/ORD negotiation with the client (Stefan Metzmacher)
- perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592219] {CVE-2025-40081}
- coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
- uprobes: uprobe_warn should use passed task (Jeremy Linton)
- powerpc/603: Really copy kernel PGD entries into all PGDIRs (Christophe Leroy)
- powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler (Christophe Leroy)
- gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote (Andreas Gruenbacher)
- selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
- seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast (Johannes Nixdorf)
- init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD (Geert Uytterhoeven)
- filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
- LTS version: v6.12.52 (Jack Vogel)
- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591957] {CVE-2025-40026}
- net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591963] {CVE-2025-40027}
- crypto: rng - Ensure set_ent is always present (Herbert Xu)
- driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
- staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
- staging: axis-fifo: fix TX handling on copy_from_user() failure (Ovidiu Panait)
- staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
- serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
- binder: fix double-free in dbitmap (Carlos Llamas)
- nvmem: layouts: fix automatic module loading (Michael Walle)
- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jeongjun Park)
- ALSA: usb-audio: Kill timer properly at removal (Takashi Iwai) [Orabug: 38152882] {CVE-2025-38105}
- drm/amdgpu: Enable MES lr_compute_wa by default (Mario Limonciello)
- drm/amd/include : Update MES v12 API for fence update (Shaoyun Liu)
- drm/amd/include : MES v11 and v12 API header update (Shaoyun Liu)
- drm/amd : Update MES API header file for v11 & v12 (Shaoyun Liu)
- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- can: rcar_canfd: Fix controller mode setting (Duy Nguyen)
- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (Chen Yufeng)
- netfs: Prevent duplicate unlocking (Lizhi Xu)
- btrfs: ref-verify: handle damaged extent root tree (David Sterba)
- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (Jack Yu)
- platform/x86/amd/pmf: Support new ACPI ID AMDI0108 (Shyam Sundar S K)
- perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (April Grimoire)
- dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
- ASoC: amd: acp: Adjust pdm gain value (Venkata Prasad Potturu)
- rust: block: fix `srctree/` links (Miguel Ojeda)
- wifi: rtl8xxxu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (Zenm Chen)
- USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
- wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (Fedor Pchelkin)
-
Tue Oct 21 2025 Jack Vogel <jack.vogel@oracle.com> [6.12.0-106.51.1.el9uek]
- KVM: x86: Advertise SRSO_USER_KERNEL_NO to userspace (Harshit Mogalapalli) [Orabug: 38478491]
- KVM: SVM: Set/clear SRSO's BP_SPEC_REDUCE on 0 <=> 1 VM count transitions (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: KVM: Add support for SRSO_MSR_FIX (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: Add SRSO_USER_KERNEL_NO support (Harshit Mogalapalli) [Orabug: 38478491]
- x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit (Harshit Mogalapalli) [Orabug: 38478491]
- Revert "x86/bugs: Adjust SRSO mitigation to new features" (Harshit Mogalapalli) [Orabug: 38478491]
- uek-rpm: add "bpf" to CONFIG_LSM as overheads are reduced (Alan Maguire) [Orabug: 38519747]
- uek-rpm: Enable CONFIG_COMPAT_32BIT_TIME for x86 container kernel (Boris Ostrovsky) [Orabug: 38540664]
-
Tue Oct 14 2025 Jack Vogel <jack.vogel@oracle.com> [6.12.0-105.51.5.el9uek]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad) [Orabug: 38226124]
- arm64: Utilize for_each_cpu_wrap for reference lookup (Beata Michalska) [Orabug: 38454705]
- arm64: Update AMU-based freq scale factor on entering idle (Beata Michalska) [Orabug: 38454705]
- arm64: Provide an AMU-based version of arch_freq_get_on_cpu (Beata Michalska) [Orabug: 38454705]
- cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (Beata Michalska) [Orabug: 38454705]
- cpufreq: Allow arch_freq_get_on_cpu to return an error (Beata Michalska) [Orabug: 38454705]
- arch_topology: init capacity_freq_ref to 0 (Ionela Voinescu) [Orabug: 38454705]
- ACPI/HMAT: Move HMAT messages to pr_debug() (Dan Williams) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: monitor all ports by default (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: enable NVLINK-C2C port filtering (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: fix sysfs path in the kernel doc (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: remove unsupported SCF events (Besar Wicaksono) [Orabug: 38454705]
- cppc_cpufreq: Remove HiSilicon CPPC workaround (Jie Zhan) [Orabug: 38454705]
- Revert "sched/fair: Bump sd->max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury) [Orabug: 38498945]
- uek-rpm/config-aarch64: Enable configs for Grace platform support (Vijay Kumar) [Orabug: 38526374]
- LTS version: v6.12.51 (Jack Vogel)
- ASoC: qcom: audioreach: fix potential null pointer dereference (Srinivas Kandagatla)
- wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() (Matvey Kovalev) [Orabug: 38548020] {CVE-2025-39991}
- mm: swap: check for stable address space before operating on the VMA (Charan Teja Kalla) [Orabug: 38548022] {CVE-2025-39992}
- media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Thadeu Lima de Souza Cascardo) [Orabug: 38560507] {CVE-2025-40016}
- media: rc: fix races with imon_disconnect() (Larshin Sergey) [Orabug: 38548025] {CVE-2025-39993}
- media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou) [Orabug: 38548035] {CVE-2025-39994}
- media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou) [Orabug: 38548049] {CVE-2025-39996}
- scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran) [Orabug: 38548057] {CVE-2025-39998}
- gcc-plugins: Remove TODO_verify_il for GCC >= 16 (Kees Cook)
- crypto: sha256 - fix crash at kexec (Breno Leitao)
- LTS version v6.12.50 (Jack Vogel)
- drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)
- Revert "usb: xhci: remove option to change a default ring's TRB cycle bit" (Niklas Neronin)
- iommufd: Fix race during abort for file descriptors (Jason Gunthorpe) [Orabug: 38547906] {CVE-2025-39966}
- fbcon: Fix OOB access in font allocation (Thomas Zimmermann)
- fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda) [Orabug: 38547910] {CVE-2025-39967}
- mm/hugetlb: fix folio is still mapped when deleted (Tu Jinjiang) [Orabug: 38560479] {CVE-2025-40006}
- kmsan: fix out-of-bounds access to shadow memory (Eric Biggers)
- gpiolib: Extend software-node support to support secondary software-nodes (Hans de Goede)
- fs/proc/task_mmu: check p->vec_buf for NULL (Jakub Acs) [Orabug: 38560489] {CVE-2025-40009}
- afs: Fix potential null pointer dereference in afs_put_server (Zhen Ni)
- drm/ast: Use msleep instead of mdelay for edid read (Nirmoy Das)
- arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports (Josua Mayer)
- arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes (Josua Mayer)
- ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address (Nobuhiro Iwamatsu)
- tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu) [Orabug: 38581468] {CVE-2025-40021}
- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers) [Orabug: 38581493] {CVE-2025-40022}
- i40e: improve VF MAC filters accounting (Lukasz Czapnik)
- i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)
- i40e: add max boundary check for VF filters (Lukasz Czapnik) [Orabug: 38547921] {CVE-2025-39968}
- i40e: fix validation of VF state in get resources (Lukasz Czapnik) [Orabug: 38547927] {CVE-2025-39969}
- i40e: fix input validation logic for action_meta (Lukasz Czapnik) [Orabug: 38547931] {CVE-2025-39970}
- i40e: fix idx validation in config queues msg (Lukasz Czapnik) [Orabug: 38547936] {CVE-2025-39971}
- i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik) [Orabug: 38547944] {CVE-2025-39972}
- i40e: add validation for ring_len param (Lukasz Czapnik) [Orabug: 38547949,38572941] {CVE-2025-39973}
- HID: asus: add support for missing PX series fn keys (Amit Chaudhari)
- smb: client: fix wrong index reference in smb2_compound_op() (Sang-Heon Jeon) [Orabug: 38547957] {CVE-2025-39975}
- platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() (Daniel Lee)
- drm/panthor: Defer scheduler entitiy destruction to queue release (Adrián Larumbe)
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior) [Orabug: 38547961,38572943] {CVE-2025-39977}
- drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita) [Orabug: 38560494] {CVE-2025-40011}
- mm: folio_may_be_lru_cached() unless folio_test_large() (Hugh Dickins)
- mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch" (Hugh Dickins)
- mm/gup: local lru_add_drain() to avoid lru_add_drain_all() (Hugh Dickins)
- octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (Dan Carpenter)
- net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir Oltean)
- net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)
- selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)
- nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel) [Orabug: 38547970] {CVE-2025-39980}
- net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS (Jason Baron)
- bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)
- vhost: Take a reference on the task in struct vhost_task. (Sebastian Andrzej Siewior) [Orabug: 38581476] {CVE-2025-40024}
- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (Luiz Augusto von Dentz) [Orabug: 38547981] {CVE-2025-39982}
- Bluetooth: hci_sync: Fix hci_resume_advertising_sync (Luiz Augusto von Dentz)
- ethernet: rvu-af: Remove slash from the driver name (Petr Malat)
- net/smc: fix warning in smc_rx_splice() when calling get_page() (Sidraya Jayagond)
- net: tun: Update napi->skb after XDP process (Wang Liang) [Orabug: 38547984] {CVE-2025-39984}
- can: peak_usb: fix shift-out-of-bounds issue (Stephane Grosjean) [Orabug: 38581460] {CVE-2025-40020}
- can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [Orabug: 38572946] {CVE-2025-39965}
- bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)
- can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)
- wifi: virt_wifi: Fix page fault on connect (James Guan)
- btrfs: don't allow adding block device of less than 1 MB (Mark Harmstone)
- bpf: Check the helper function is valid in get_helper_proto (Jiri Olsa) [Orabug: 38548011] {CVE-2025-39990}
- smb: server: use disable_work_sync in transport_rdma.c (Stefan Metzmacher)
- smb: server: don't use delayed_work for post_recv_credits_work (Stefan Metzmacher)
- cpufreq: Initialize cpufreq-based invariance before subsys (Christian Loehle)
- ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients (Jihed Chaibi)
- arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)
- firmware: imx: Add stub functions for SCMI MISC API (Peng Fan)
- HID: amd_sfh: Add sync across amd sfh work functions (Basavaraj Natikar)
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)
- net: sfp: add quirk for FLYPRO copper SFP+ module (Aleksander Jan Bajkowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on more devices (Qaqland)
- ALSA: usb-audio: move mixer_quirks' min_mute into common quirk (Cryolitia Pukngae)
- ALSA: usb-audio: Add DSD support for Comtrue USB Audio device (Noble Yang)
- i2c: designware: Add quirk for Intel Xe (Krogerus Heikki)
- mmc: sdhci-cadence: add Mobileye eyeQ support (Benoît Monin)
- net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Chris Morgan)
- net: fec: rename struct fec_devinfo fec_imx6x_info -> fec_imx6sx_info (Marc Kleine-Budde)
- usb: core: Add 0x prefix to quirks debug output (Jiayi Li)
- ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)
- ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA (Stefan Binding)
- ALSA: usb-audio: Convert comma to semicolon (Chen Ni)
- ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)
- ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix code alignment in mixer_quirks (Cristian Ciocaltea)
- firewire: core: fix overlooked update of subsystem ABI version (Takashi Sakamoto)
- scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE (Alok Tiwari)
-
Tue Oct 07 2025 Jack Vogel <jack.vogel@oracle.com> [6.12.0-105.49.4.el9uek]
- fs/dax: don't disassociate zero page entries (Alistair Popple) [Orabug: 36859857]
- device/dax: properly refcount device dax pages when mapping (Alistair Popple) [Orabug: 36859857]
- fs/dax: properly refcount fs dax pages (Alistair Popple) [Orabug: 36859857]
- fs/dax: Fix "don't skip locked entries when scanning entries" (Alistair Popple) [Orabug: 36859857]
- mm: decline to manipulate the refcount on a slab page (Matthew Wilcox) [Orabug: 36859857]
- dcssblk: mark DAX broken, remove FS_DAX_LIMITED support (Dan Williams) [Orabug: 36859857]
- mm/gup: don't allow FOLL_LONGTERM pinning of FS DAX pages (Alistair Popple) [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pmd() (Alistair Popple) [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pud() (Alistair Popple) [Orabug: 36859857]
- mm/rmap: add support for PUD sized mappings to rmap (Alistair Popple) [Orabug: 36859857]
- mm/memory: add vmf_insert_page_mkwrite() (Alistair Popple) [Orabug: 36859857]
- mm/memory: enhance insert_page_into_pte_locked() to create writable mappings (Alistair Popple) [Orabug: 36859857]
- mm: allow compound zone device pages (Alistair Popple) [Orabug: 36859857]
- mm/mm_init: move p2pdma page refcount initialisation to p2pdma (Alistair Popple) [Orabug: 36859857]
- mm/gup: remove redundant check for PCI P2PDMA page (Alistair Popple) [Orabug: 36859857]
- fs/dax: remove PAGE_MAPPING_DAX_SHARED mapping flag (Alistair Popple) [Orabug: 36859857]
- dax: use folios more widely within DAX (Matthew Wilcox) [Orabug: 36859857]
- dax: remove access to page->index (Matthew Wilcox) [Orabug: 36859857]
- fs/dax: ensure all pages are idle prior to filesystem unmount (Alistair Popple) [Orabug: 36859857]
- fs/dax: always remove DAX page-cache entries when breaking layouts (Alistair Popple) [Orabug: 36859857]
- mm: optimize invalidation of shadow entries (Shakeel Butt) [Orabug: 36859857]
- mm: optimize truncation of shadow entries (Shakeel Butt) [Orabug: 36859857]
- fs/dax: create a common implementation to break DAX layouts (Alistair Popple) [Orabug: 36859857]
- fs/dax: refactor wait for dax idle page (Alistair Popple) [Orabug: 36859857]
- fs/dax: don't skip locked entries when scanning entries (Alistair Popple) [Orabug: 36859857]
- fs/dax: return unmapped busy pages from dax_layout_busy_page_range() (Alistair Popple) [Orabug: 36859857]
- uek: kabi: Update check-kabi to support namespace checks (Saeed Mirzamohammadi) [Orabug: 38459242]
-
Wed Oct 01 2025 Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> [6.12.0-105.49.3.el9uek]
- uek-rpm: Disable module xe build on 64k (Sherry Yang) [Orabug: 38490598]
-
Tue Sep 30 2025 Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> [6.12.0-105.49.2.el9uek]
- io_uring: Hide kabi magic from user space (Sherry Yang) [Orabug: 38463157]
- LTS version: v6.12.49 (Harshit Mogalapalli)
- minmax.h: remove some #defines that are only expanded once (David Laight)
- minmax.h: simplify the variants of clamp() (David Laight)
- minmax.h: move all the clamp() definitions after the min/max() ones (David Laight)
- minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() (David Laight)
- minmax.h: reduce the #define expansion of min(), max() and clamp() (David Laight)
- minmax.h: update some comments (David Laight)
- minmax.h: add whitespace around operators and after commas (David Laight)
- rtc: pcf2127: fix SPI command byte for PCF2131 backport (Bruno Thomsen)
- xhci: dbc: Fix full DbC transfer ring after several reconnects (Mathias Nyman)
- xhci: dbc: decouple endpoint allocation from initialization (Mathias Nyman)
- usb: xhci: remove option to change a default ring's TRB cycle bit (Niklas Neronin)
- usb: xhci: introduce macro for ring segment list iteration (Niklas Neronin)
- mptcp: pm: nl: announce deny-join-id0 flag (Matthieu Baerts)
- mm/gup: check ref_count instead of lru before migration (Hugh Dickins)
- mm: add folio_expected_ref_count() for reference count calculation (Shivank Garg)
- vmxnet3: unregister xdp rxq info in the reset path (Sankararaman Jayaraman) [Orabug: 37844478] {CVE-2025-22106}
- platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk (Antheas Kapenekakis)
- platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on ASUS ROG Z13 (Antheas Kapenekakis)
- io_uring: fix incorrect io_kiocb reference in io_link_skb (Yang Xiuwei) [Orabug: 38526426,38572947] {CVE-2025-39963}
- smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path (Stefan Metzmacher) [Orabug: 38503782] {CVE-2025-39929}
- crypto: af_alg - Set merge to zero early in af_alg_sendmsg (Herbert Xu) [Orabug: 38503788] {CVE-2025-39931}
- smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) (Stefan Metzmacher) [Orabug: 38503796] {CVE-2025-39932}
- smb: client: fix filename matching of deferred files (Paulo Alcantara)
- drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue() (Dan Carpenter)
- drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path (Qi Xi)
- drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ (Loic Poulain)
- drm/xe/tile: Release kobject for the failure path (Shuicheng Lin)
- ASoC: Intel: catpt: Expose correct bit depth to userspace (Amadeusz Sławiński)
- ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message (Colin Ian King)
- ASoC: wm8974: Correct PLL rate rounding (Charles Keepax)
- ASoC: wm8940: Correct typo in control name (Charles Keepax)
- ASoC: wm8940: Correct PLL rate rounding (Charles Keepax)
- io_uring/kbuf: drop WARN_ON_ONCE() from incremental length check (Jens Axboe)
- io_uring/msg_ring: kill alloc_cache for io_kiocb allocations (Jens Axboe)
- io_uring: include dying ring in task_work "should cancel" state (Jens Axboe)
- io_uring: backport io_should_terminate_tw() (Jens Axboe)
- io_uring/cmd: let cmds to know about dying task (Pavel Begunkov)
- ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx (Praful Adiga)
- selftests: mptcp: avoid spurious errors on TCP disconnect (Matthieu Baerts)
- selftests: mptcp: connect: catch IO errors on listen side (Matthieu Baerts)
- mptcp: propagate shutdown to subflows when possible (Matthieu Baerts)
- net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer (Hans de Goede)
- drm/amd/display: Allow RX6xxx & RX7700 to invoke amdgpu_irq_get/put (Ivan Lipski)
- mmc: mvsdio: Fix dma_unmap_sg() nents value (Thomas Fourier)
- ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S (Mohammad Rafi Shaik)
- ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed (Krzysztof Kozlowski)
- ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface (Mohammad Rafi Shaik)
- btrfs: tree-checker: fix the incorrect inode ref size check (Qu Wenruo)
- iommu/amd/pgtbl: Fix possible race while increase page table level (Vasant Hegde) [Orabug: 38526415] {CVE-2025-39961}
- iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() (Eugene Koira)
- LoongArch: Check the return value when creating kobj (Tao Cui)
- LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled (Huacai Chen)
- LoongArch: vDSO: Check kcalloc() result in init_vdso() (Guangshuo Li)
- LoongArch: Fix unreliable stack for live patching (Tiezhu Yang)
- objtool/LoongArch: Mark special atomic instruction as INSN_BUG type (Tiezhu Yang)
- objtool/LoongArch: Mark types based on break immediate code (Tiezhu Yang)
- LoongArch: Update help info of ARCH_STRICT_ALIGN (Tiezhu Yang)
- mm: revert "mm: vmscan.c: fix OOM on swap stress test" (Hugh Dickins)
- gup: optimize longterm pin_user_pages() for large folio (Li Zhe)
- dm-stripe: fix a possible integer overflow (Mikulas Patocka) [Orabug: 38503824] {CVE-2025-39940}
- dm-raid: don't set io_min and io_opt for raid1 (Mikulas Patocka)
- power: supply: bq27xxx: restrict no-battery detection to bq27000 (H. Nikolaus Schaller)
- power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery (H. Nikolaus Schaller)
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu) [Orabug: 38537467,38572948] {CVE-2025-39964}
- nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* (Nathan Chancellor)
- ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size (Stefan Metzmacher)
- ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer (Namjae Jeon)
- perf/x86/intel: Fix crash in icl_update_topdown_event() (Kan Liang) [Orabug: 38180828] {CVE-2025-38322}
- octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (Duoming Zhou)
- cnic: Fix use-after-free bugs in cnic_delete_task (Duoming Zhou) [Orabug: 38503847] {CVE-2025-39945}
- net: liquidio: fix overflow in octeon_init_instr_queue() (Alexey Nepomnyashih)
- Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" (Tariq Toukan)
- tls: make sure to abort the stream if headers are bogus (Jakub Kicinski) [Orabug: 38503856,38572944] {CVE-2025-39946}
- tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Kuniyuki Iwashima) [Orabug: 38526385] {CVE-2025-39955}
- octeon_ep: fix VF MAC address lifecycle handling (Sathesh Edara)
- bonding: don't set oif to bond dev when getting NS target destination (Hangbin Liu)
- net/mlx5e: Harden uplink netdev access against device unbind (Jianbo Liu) [Orabug: 38503862] {CVE-2025-39947}
- igc: don't fail igc_probe() on LED setup error (Kohei Enju) [Orabug: 38526394] {CVE-2025-39956}
- i40e: remove redundant memory barrier when cleaning Tx descs (Maciej Fijalkowski)
- ice: fix Rx page leak on multi-buffer frames (Jacob Keller) [Orabug: 38503866] {CVE-2025-39948}
- ice: store max_frame and rx_buf_len only in ice_rx_ring (Jacob Keller)
- net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure (Moon Yeounsu)
- selftests: mptcp: sockopt: fix error messages (Geliang Tang)
- mptcp: tfo: record 'deny join id0' info (Matthieu Baerts)
- selftests: mptcp: userspace pm: validate deny-join-id0 flag (Matthieu Baerts)
- mptcp: set remote_deny_join_id0 on SYN recv (Matthieu Baerts)
- bonding: set random address only when slaves already exist (Hangbin Liu)
- qed: Don't collect too many protection override GRC elements (Jamie Bainbridge) [Orabug: 38503868] {CVE-2025-39949}
- net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR (Anderson Nascimento)
- dpaa2-switch: fix buffer pool seeding for control traffic (Ioana Ciornei)
- um: Fix FD copy size in os_rcv_fd_msg() (Tiwei Bie)
- um: virtio_uml: Fix use-after-free after put_device in probe (Miaoqian Lin)
- btrfs: fix invalid extref key setup when replaying dentry (Filipe Manana)
- cgroup: split cgroup_destroy_wq into 3 workqueues (Chen Ridong) [Orabug: 38503889] {CVE-2025-39953}
- pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch (Geert Uytterhoeven)
- wifi: mac80211: fix incorrect type for ret (Liao Yuanhong)
- wifi: mac80211: increase scan_ies_len for S1G (Lachlan Hodges) [Orabug: 38526397] {CVE-2025-39957}
- ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported (Takashi Sakamoto)
- nvme: fix PI insert on write (Christoph Hellwig)
- wifi: wilc1000: avoid buffer overflow in WID string configuration (Ajay Singh)
- LTS version: v6.12.48 (Harshit Mogalapalli)
- x86: disable image size check for test builds (Guenter Roeck)
- netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [Orabug: 38492667] {CVE-2025-39867}
- drm/amdgpu: fix a memory leak in fence cleanup when unloading (Alex Deucher)
- drm/i915/power: fix size for for_each_set_bit() in abox iteration (Jani Nikula)
- net: mdiobus: release reset_gpio in mdiobus_unregister_device() (Csaba Buday)
- x86/cpu/topology: Always try cpu_parse_topology_ext() on AMD/Hygon (K Prateek Nayak)
- phy: ti-pipe3: fix device leak at unbind (Johan Hovold)
- phy: ti: omap-usb2: fix device leak at unbind (Johan Hovold)
- phy: tegra: xusb: fix device and OF node leak at probe (Johan Hovold)
- dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate (Miaoqian Lin)
- dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees (Stephan Gerhold) [Orabug: 38494820] {CVE-2025-39923}
- usb: gadget: midi2: Fix MIDI2 IN EP max packet size (Takashi Iwai)
- usb: gadget: midi2: Fix missing UMP group attributes initialization (Takashi Iwai)
- usb: typec: tcpm: properly deliver cable vdms to altmode drivers (Rd Babiera)
- USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels (Alan Stern)
- xhci: fix memory leak regression when freeing xhci vdev devices depth first (Mathias Nyman)
- RISC-V: Remove unnecessary include from compat.h (Palmer Dabbelt)
- regulator: sy7636a: fix lifecycle of power good gpio (Andreas Kemnade)
- dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (Anders Roxell)
- dmaengine: idxd: Fix double free in idxd_setup_wqs() (Dan Carpenter) [Orabug: 38461885] {CVE-2025-39870}
- dmaengine: idxd: Fix refcount underflow on module unload (Yi Sun)
- dmaengine: idxd: Remove improper idxd_free (Yi Sun) [Orabug: 38461887] {CVE-2025-39871}
- phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties (Pengyu Luo)
- hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr (Hangbin Liu)
- hsr: use rtnl lock when iterating over ports (Hangbin Liu)
- net: hsr: Add VLAN CTAG filter support (Murali Karicheri)
- netfilter: nf_tables: restart set lookup on base_seq change (Florian Westphal)
- netfilter: nf_tables: make nft_set_do_lookup available unconditionally (Florian Westphal)
- netfilter: nf_tables: place base_seq in struct net (Florian Westphal)
- netfilter: nf_tables: Reintroduce shortened deletion notifications (Phil Sutter)
- netfilter: nft_set_rbtree: continue traversal if element is inactive (Florian Westphal)
- netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal)
- netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal)
- netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal)
- netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal)
- netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal)
- can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB (Anssi Hannula)
- can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails (Tetsuo Handa)
- can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed (Tetsuo Handa)
- drm/amd/display: use udelay rather than fsleep (Alex Deucher)
- i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (Michal Schmidt) [Orabug: 38494785] {CVE-2025-39911}
- igb: fix link test skipping when interface is admin down (Kohei Enju)
- docs: networking: can: change bcm_msg_head frames member to support flexible array (Alex Tran)
- tunnels: reset the GSO metadata before reusing the skb (Antoine Tenart)
- net: bridge: Bounce invalid boolopts (Petr Machata)
- genetlink: fix genl_bind() invoking bind() after -EPERM (Alok Tiwari) [Orabug: 38494831] {CVE-2025-39926}
- net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (Stefan Wahren)
- drm/panthor: validate group queue count (Chia-I Wu)
- Disable SLUB_TINY for build testing (Linus Torvalds)
- USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- USB: serial: option: add Telit Cinterion FN990A w/audio compositions (Fabio Porcedda)
- dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks (Krzysztof Kozlowski)
- serial: sc16is7xx: fix bug in flow control levels init (Hugo Villeneuve)
- tty: hvc_console: Call hvc_kick in hvc_write unconditionally (Fabian Vogt)
- Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" (Paolo Abeni)
- Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: iqs7222 - avoid enabling unused interrupts (Jeff Labundy)
- hrtimers: Unconditionally update target CPU base after offline timer migration (Xiongfeng Wang)
- btrfs: fix corruption reading compressed range when block size is smaller than page size (Qu Wenruo)
- btrfs: use readahead_expand() on compressed extents (Boris Burkov)
- mtd: spinand: winbond: Fix oob_layout for W25N01JW (Santhosh Kumar K)
- mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Jeongjun Park)
- mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() (Quanmin Yan)
- mm/damon/sysfs: fix use-after-free in state_show() (Stanislav Fort) [Orabug: 38461827] {CVE-2025-39877}
- ceph: fix race condition where r_parent becomes stale before sending message (Alex Markuze)
- ceph: fix race condition validating r_parent before applying state (Alex Markuze) [Orabug: 38494833] {CVE-2025-39927}
- libceph: fix invalid accesses to ceph_connection_v1_info (Ilya Dryomov) [Orabug: 38461835] {CVE-2025-39880}
- kernfs: Fix UAF in polling when open file is released (Chen Ridong) [Orabug: 38461841,38500629,38572951] {CVE-2025-39881}
- netlink: specs: mptcp: fix if-idx attribute type (Matthieu Baerts)
- netlink: specs: mptcp: replace underscores with dashes in names (Jakub Kicinski)
- netlink: specs: mptcp: clearly mention attributes (Matthieu Baerts)
- netlink: specs: mptcp: add missing 'server-side' attr (Matthieu Baerts)
- drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (David Rosca)
- drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time (David Rosca)
- drm/xe: Attempt to bring bos back to VRAM after eviction (Thomas Hellström)
- drm/mediatek: fix potential OF node use-after-free (Johan Hovold)
- mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() (Quanmin Yan)
- mm/damon/core: set quota->charged_from to jiffies at first charge window (Sang-Heon Jeon)
- mm/memory-failure: fix redundant updates for already poisoned pages (Kyle Meyer)
- mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Miaohe Lin) [Orabug: 38461846] {CVE-2025-39883}
- mm/khugepaged: fix the address passed to notifier on testing young (Wei Yang)
- fuse: prevent overflow in copy_file_range return value (Miklos Szeredi)
- fuse: check if copy_file_range() returns larger than requested size (Miklos Szeredi)
- fuse: do not allow mapping a non-regular backing file (Amir Goldstein)
- mtd: rawnand: stm32_fmc2: fix ECC overwrite (Christophe Kerello)
- mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer (Christophe Kerello)
- mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing (Alexander Sverdlin)
- net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups (Oleksij Rempel)
- i2c: i801: Hide Intel Birch Stream SoC TCO WDT (Chiasheng Lee)
- btrfs: fix subvolume deletion lockup caused by inodes xarray race (Omar Sandoval) [Orabug: 38461854] {CVE-2025-39884}
- btrfs: fix squota compressed stats leak (Boris Burkov)
- ocfs2: fix recursive semaphore deadlock in fiemap call (Mark Tinguely) [Orabug: 38461857] {CVE-2025-39885}
- mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN (Krister Johansen)
- compiler-clang.h: define __SANITIZE_*__ macros only when undefined (Nathan Chancellor)
- EDAC/altera: Delete an inappropriate dma_free_coherent() call (Salah Triki)
- proc: fix type confusion in pde_set_flags() (Zijie Wang)
- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. (Kuniyuki Iwashima) [Orabug: 38494795] {CVE-2025-39913}
- bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() (Peilin Ye) [Orabug: 38461865] {CVE-2025-39886}
- bpf: Allow fall back to interpreter for programs with stack size <= 512 (Kafai Wan)
- bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (Daniel Borkmann) [Orabug: 38494805] {CVE-2025-39917}
- s390/cpum_cf: Deny all sampling events by counter PMU (Thomas Richter)
- s390/pai: Deny all events not handled by this PMU (Thomas Richter)
- tracing: Silence warning when chunk allocation fails in trace_pid_write (Pu Lehui) [Orabug: 38494800] {CVE-2025-39914}
- NFSv4/flexfiles: Fix layout merge mirror check. (Jonathan Curley)
- NFS: nfs_invalidate_folio() must observe the offset and size arguments (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and copy range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and clone range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and fallocate() (Trond Myklebust)
- NFS: Serialise O_DIRECT i/o and truncate() (Trond Myklebust)
- fs/nfs/io: make nfs_start_io_*() killable (Max Kellermann)
- ftrace/samples: Fix function size computation (Vladimir Riabchun)
- nfs/localio: restore creds before releasing pageio data (Scott Mayhew)
- nfs/localio: add direct IO enablement with sync and async IO support (Mike Snitzer)
- nfs/localio: remove extra indirect nfs_to call to check {read,write}_iter (Mike Snitzer)
- tracing: Fix tracing_marker may trigger page fault during preempt_disable (Luo Gengkun)
- NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server (Trond Myklebust)
- NFSv4: Clear NFS_CAP_OPEN_XOR and NFS_CAP_DELEGTIME if not supported (Trond Myklebust)
- NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set (Trond Myklebust)
- trace/fgraph: Fix error handling (Guenter Roeck)
- NFSv4: Don't clear capabilities that won't be reset (Trond Myklebust)
- SUNRPC: call xs_sock_process_cmsg for all cmsg (Justin Worrell)
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Tigran Mkrtchyan)
- drm/amdgpu: Add back JPEG to video caps for carrizo and newer (David Rosca)
- ALSA: hda/realtek: Fix built-in mic assignment on ASUS VivoBook X515UA (Takashi Iwai)
- Revert "drm/amd/display: Optimize cursor position updates" (Aurabindo Pillai)
- drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed (Srinivasan Shanmugam)
- drm/i915/pmu: Fix zero delta busyness issue (Umesh Nerlige Ramappa)
- ext4: introduce linear search for dentries (Theodore Ts'O)
- Revert "udmabuf: fix vmap_udmabuf error page set" (Huan Yang)
- nvme-pci: skip nvme_write_sq_db on empty rqlist (Maurizio Lombardi)
- dma-debug: fix physical address calculation for struct dma_debug_entry (Fedor Pchelkin)
- dma-mapping: fix swapped dir/flags arguments to trace_dma_alloc_sgt_err (Sean Anderson)
- mm: introduce and use {pgd,p4d}_populate_kernel() (Harry Yoo)
- net/mlx5: HWS, change error flow on matcher disconnect (Yevgeny Kliteynik)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- dma-debug: don't enforce dma mapping check on noncoherent allocations (Baochen Qiang)
- dma-mapping: trace more error paths (Sean Anderson)
- dma-mapping: use trace_dma_alloc for dma_alloc* instead of using trace_dma_map (Sean Anderson)
- dma-mapping: trace dma_alloc/free direction (Sean Anderson)
- dma-debug: store a phys_addr_t in struct dma_debug_entry (Christoph Hellwig)
- fhandle: use more consistent rules for decoding file handle from userns (Amir Goldstein)
- LTS version: v6.12.47 (Harshit Mogalapalli)
- LTS version: v6.12.46 (Harshit Mogalapalli)
- dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- md/raid1: fix data lost for writemostly rdev (Yu Kuai)
- riscv, bpf: use lw when reading int cpu in bpf_get_smp_processor_id (Radim Krčmář)
- riscv, bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG (Radim Krčmář)
- riscv: use lw when reading int cpu in asm_per_cpu (Radim Krčmář)
- riscv: use lw when reading int cpu in new_vmalloc_check (Radim Krčmář)
- riscv: Only allow LTO with CMODEL_MEDANY (Nathan Chancellor)
- ACPI: RISC-V: Fix FFH_CPPC_CSR error handling (Anup Patel)
- md: prevent incorrect update of resync/recovery offset (Li Nan)
- tools: gpio: remove the include directory on make clean (Zhang Jiao)
- drm/amd/amdgpu: Fix missing error return on kzalloc failure (Colin Ian King)
- perf bpf-utils: Harden get_bpf_prog_info_linear (Ian Rogers)
- perf bpf-utils: Constify bpil_array_desc (Ian Rogers)
- perf bpf-event: Fix use-after-free in synthesis (Ian Rogers)
- drm/bridge: ti-sn65dsi86: fix REFCLK setting (Michael Walle)
- spi: spi-fsl-lpspi: Clear status register after disabling the module (Larisa Grigore)
- spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort (Larisa Grigore)
- spi: spi-fsl-lpspi: Set correct chip-select polarity bit (Larisa Grigore)
- spi: spi-fsl-lpspi: Fix transmissions when using CONT (Larisa Grigore)
- scsi: sr: Reinstate rotational media flag (Ming Lei)
- block: add a queue_limits_commit_update_frozen helper (Christoph Hellwig)
- hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM (Vadim Pasternak)
- platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID (David Arcari)
- platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk (Antheas Kapenekakis)
- pcmcia: Add error handling for add_interval() in do_validate_mem() (Xu Wang)
- pcmcia: omap: Add missing check for platform_get_resource (Chen Ni)
- Revert "drm/amdgpu: Avoid extra evict-restore process." (Alex Deucher)
- ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY (Aaron Erhardt)
- ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model (Takashi Iwai)
- rust: support Rust >= 1.91.0 target spec (Miguel Ojeda)
- dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold (Nícolas F R A Prado)
- mm: fix accounting of memmap pages (Sumanth Korikkar)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- nouveau: fix disabling the nonstall irq due to storm code (Dave Airlie)
- mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Li Qiong) [Orabug: 38494758] {CVE-2025-39902}
- mm, slab: cleanup slab_bug() parameters (Vlastimil Babka)
- mm: slub: call WARN() when detecting a slab corruption (Hyesoo Yu)
- mm: slub: Print the broken data before restoring them (Hyesoo Yu)
- md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb (Su Yue) [Orabug: 37844677] {CVE-2025-22124}
- net: fix NULL pointer dereference in l3mdev_l3_rcv (Wang Liang) [Orabug: 37844462] {CVE-2025-22103}
- wifi: ath11k: update channel list in worker when wait flag is set (Wen Gong)
- wifi: ath11k: update channel list in reg notifier instead reg worker (Wen Gong) [Orabug: 37844571] {CVE-2025-23133}
- ext4: avoid journaling sb update on error if journal is destroying (Ojaswin Mujoo) [Orabug: 37844503] {CVE-2025-22113}
- ext4: define ext4_journal_destroy wrapper (Ojaswin Mujoo)
- md/raid1,raid10: strip REQ_NOWAIT from member bios (Zheng Qixing)
- md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT (Yu Kuai)
- md/raid1,raid10: don't ignore IO flags (Yu Kuai) [Orabug: 37844529] {CVE-2025-22125}
- net: dsa: b53: do not enable EEE on bcm63xx (Jonas Gorski) [Orabug: 38180448] {CVE-2025-38272}
- net: dsa: b53/bcm_sf2: implement .support_eee() method (Russell King)
- net: dsa: provide implementation of .support_eee() (Russell King)
- net: dsa: add hook to determine whether EEE is supported (Russell King)
- fs/fhandle.c: fix a race in call of has_locked_children() (Al Viro) [Orabug: 38180547] {CVE-2025-38306}
- microchip: lan865x: Fix LAN8651 autoloading (Stefan Wahren)
- microchip: lan865x: Fix module autoloading (Stefan Wahren)
- net: pcs: rzn1-miic: Correct MODCTRL register offset (Lad Prabhakar)
- e1000e: fix heap overflow in e1000_set_eeprom (Vitaly Lifshits) [Orabug: 38494738] {CVE-2025-39898}
- cifs: prevent NULL pointer dereference in UTF16 conversion (Makar Semyonov) [Orabug: 38456730] {CVE-2025-39838}
- batman-adv: fix OOB read/write in network-coding decode (Stanislav Fort)
- scsi: lpfc: Fix buffer free/clear order in deferred receive path (John Evans) [Orabug: 38456752] {CVE-2025-39841}
- platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG (Ivan Lipski)
- drm/amdgpu: drop hw access in non-DC audio fini (Alex Deucher)
- net: ethernet: oa_tc6: Handle failure of spi_setup (Stefan Wahren)
- wifi: mt76: mt7925: fix the wrong bss cleanup for SAP (Ming Yen Hsieh)
- wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() (Nathan Chancellor)
- wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete (Ming Yen Hsieh)
- wifi: mwifiex: Initialize the chan_stats array to zero (Rong Qianfeng) [Orabug: 38494721] {CVE-2025-39891}
- soc: qcom: mdt_loader: Deal with zero e_shentsize (Bjorn Andersson)
- of_numa: fix uninitialized memory nodes causing kernel panic (Yin Tirui) [Orabug: 38494765] {CVE-2025-39903}
- ocfs2: prevent release journal inode after journal shutdown (Edward Adam Davis) [Orabug: 38456756] {CVE-2025-39842}
- kasan: fix GCC mem-intrinsic prefix with sw tags (Ada Couprie Diaz)
- sched: Fix sched_numa_find_nth_cpu() if mask offline (Christian Loehle) [Orabug: 38494732] {CVE-2025-39895}
- mm: slub: avoid wake up kswapd in set_track_prepare (Yangshiguang) [Orabug: 38456759] {CVE-2025-39843}
- mm: fix possible deadlock in kmemleak (Gu Bowen)
- mm: move page table sync declarations to linux/pgtable.h (Harry Yoo) [Orabug: 38456762] {CVE-2025-39844}
- mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE (Sasha Levin) [Orabug: 38494745] {CVE-2025-39899}
- x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Harry Yoo) [Orabug: 38456765] {CVE-2025-39845}
- io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (Jens Axboe) [Orabug: 38254135] {CVE-2025-38453}
- pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() (Ma Ke)
- ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (Miaoqian Lin)
- accel/ivpu: Prevent recovery work from being queued during device removal (Karol Wachowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on some devices (Cryolitia Pukngae)
- phy: mscc: Stop taking ts_lock for tx_queue and use its own lock (Horatiu Vultur)
- selftest: net: Fix weird setsockopt() in bind_bhash.c. (Kuniyuki Iwashima)
- ppp: fix memory leak in pad_compress_skb (Qingfang Deng) [Orabug: 38456779] {CVE-2025-39847}
- net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (Abin Joseph)
- net: atm: fix memory leak in atm_register_sysfs when device_register fail (Wang Liang)
- ax25: properly unshare skbs in ax25_kiss_rcv() (Eric Dumazet)
- mctp: return -ENOPROTOOPT for unknown getsockopt options (Alok Tiwari)
- net/smc: Remove validation of reserved bits in CLC Decline message (Mahanta Jambigi)
- ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() (Dan Carpenter)
- net: thunder_bgx: decrement cleanup index before use (Rosen Penev)
- net: thunder_bgx: add a missing of_node_put (Rosen Penev)
- wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (Dan Carpenter) [Orabug: 38456796] {CVE-2025-39849}
- wifi: libertas: cap SSID len in lbs_associate() (Dan Carpenter)
- wifi: cw1200: cap SSID length in cw1200_do_join() (Dan Carpenter)
- vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (Ido Schimmel) [Orabug: 38456798] {CVE-2025-39850}
- vxlan: Rename FDB Tx lookup function (Ido Schimmel)
- vxlan: Add RCU read-side critical sections in the Tx path (Ido Schimmel)
- vxlan: Avoid unnecessary updates to FDB 'used' time (Ido Schimmel)
- vxlan: Refresh FDB 'updated' time upon 'NTF_USE' (Ido Schimmel)
- net: vxlan: rename SKB_DROP_REASON_VXLAN_NO_REMOTE (Radu Rendec)
- net: vxlan: use kfree_skb_reason() in vxlan_mdb_xmit() (Menglong Dong)
- net: vxlan: use kfree_skb_reason() in vxlan_xmit() (Menglong Dong)
- net: vxlan: make vxlan_set_mac() return drop reasons (Menglong Dong)
- vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (Ido Schimmel) [Orabug: 38456803] {CVE-2025-39851}
- net: vxlan: make vxlan_snoop() return drop reasons (Menglong Dong)
- net: vxlan: add skb drop reasons to vxlan_rcv() (Menglong Dong)
- net: tunnel: add pskb_inet_may_pull_reason() helper (Menglong Dong)
- net: skb: add pskb_network_may_pull_reason() helper (Menglong Dong)
- net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets (Felix Fietkau)
- net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 (Christoph Paasch) [Orabug: 38456808] {CVE-2025-39852}
- wifi: ath11k: fix group data packet drops during rekey (Rameshkumar Sundaram)
- ixgbe: fix incorrect map used in eee linkmode (Alok Tiwari) [Orabug: 38494817] {CVE-2025-39922}
- i40e: Fix potential invalid access when MAC list is empty (Zhen Ni) [Orabug: 38456812] {CVE-2025-39853}
- i40e: remove read access to debugfs files (Jacob Keller) [Orabug: 38494752] {CVE-2025-39901}
- idpf: set mac type when adding and removing MAC filters (Emil Tantilov)
- ice: fix NULL access of tx->in_use in ice_ll_ts_intr (Jacob Keller) [Orabug: 38456820] {CVE-2025-39854}
- net: mctp: mctp_fraq_queue should take ownership of passed skb (Jeremy Kerr)
- net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (Liu Jian)
- macsec: read MACSEC_SA_ATTR_PN with nla_get_uint (Sabrina Dubroca)
- net: macb: Fix tx_ptr_lock locking (Sean Anderson)
- icmp: fix icmp_ndo_send address translation for reply direction (Fabian Bläse)
- bnxt_en: fix incorrect page count in RX aggr ring log (Alok Tiwari)
- selftests: drv-net: csum: fix interface name for remote host (Jakub Kicinski)
- mISDN: Fix memory leak in dsp_hwec_enable() (Miaoqian Lin)
- xirc2ps_cs: fix register access when enabling FullDuplex (Alok Tiwari)
- net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (Eric Dumazet) [Orabug: 38494749] {CVE-2025-39900}
- netfilter: nft_flowtable.sh: re-run with random mtu sizes (Florian Westphal)
- Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (Kuniyuki Iwashima) [Orabug: 38456832] {CVE-2025-39860}
- Bluetooth: vhci: Prevent use-after-free by removing debugfs files early (Ivan Pravdin) [Orabug: 38456841] {CVE-2025-39861}
- wifi: iwlwifi: uefi: check DSM item validity (Johannes Berg)
- netfilter: conntrack: helper: Replace -EEXIST by -EBUSY (Phil Sutter)
- netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (Wang Liang) [Orabug: 38494729] {CVE-2025-39894}
- wifi: mt76: fix linked list corruption (Felix Fietkau) [Orabug: 38494807] {CVE-2025-39918}
- wifi: mt76: free pending offchannel tx frames on wcid cleanup (Felix Fietkau)
- wifi: mt76: prevent non-offchannel mgmt tx during scan/roc (Felix Fietkau)
- wifi: mt76: mt7925: fix locking in mt7925_change_vif_links() (Harshit Mogalapalli)
- wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work (Duoming Zhou) [Orabug: 38456848] {CVE-2025-39863}
- wifi: cfg80211: fix use-after-free in cmp_bss() (Dmitry Antipov) [Orabug: 38456857] {CVE-2025-39864}
- mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up (Sai Krishna Potthuri)
- mmc: sdhci-of-arasan: Support for emmc hardware reset (Paul Alvin)
- LoongArch: vDSO: Remove -nostdlib complier flag (Guan Wentao)
- LoongArch: vDSO: Remove --hash-style=sysv (Xi Ruoyao)
- net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FE990A name (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FN990A name (Fabio Porcedda)
- HID: core: Harden s32ton() against conversion to 0 bits (Alan Stern) [Orabug: 38334902] {CVE-2025-38556}
- HID: stop exporting hid_snto32() (Dmitry Torokhov)
- HID: simplify snto32() (Dmitry Torokhov)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC (Marek Vasut)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- arm64: dts: imx8mp-tqma8mpql: fix LDO5 power off (Markus Niebel)
- tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" (Sungbae Yoo)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro (Peter Robinson)
- tee: fix memory leak in tee_dyn_shm_alloc_helper (Pei Xiao)
- tee: fix NULL pointer dereference in tee_shm_put (Pei Xiao) [Orabug: 38456864] {CVE-2025-39865}
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue) [Orabug: 38456869,38500632,38572953] {CVE-2025-39866}
- btrfs: zoned: skip ZONE FINISH of conventional zones (Johannes Thumshirn)
- Bluetooth: hci_sync: Avoid adding default advertising on startup (Yang Li)
- cpupower: Fix a bug where the -t option of the set subcommand was not working. (Shinji Nomoto)
- drm/amd/display: Don't warn when missing DCE encoder caps (Timur Kristóf)
- cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN (Lubomir Rintel)
- LoongArch: Save LBT before FPU in setup_sigcontext() (Huacai Chen)
- btrfs: avoid load/store tearing races when checking if an inode was logged (Filipe Manana)
- btrfs: fix race between setting last_dir_index_offset and inode logging (Filipe Manana)
- btrfs: fix race between logging inode and checking if it was logged before (Filipe Manana)
- bpf: Fix oob access in cgroup local storage (Daniel Borkmann) [Orabug: 38324116] {CVE-2025-38502}
- bpf: Move cgroup iterator helpers to bpf.h (Daniel Borkmann)
- bpf: Move bpf map owner out of common struct (Daniel Borkmann)
- bpf: Add cookie object to bpf maps (Daniel Borkmann)
- LTS version: v6.12.45 (Harshit Mogalapalli)
- thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their sizes to driver data (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Change lvts commands array to static const (Mason-Cw Chang)
- Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" (Imre Deak)
- PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up (Niklas Cassel)
- PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS (Niklas Cassel)
- net: rose: fix a typo in rose_clear_routes() (Eric Dumazet)
- drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode (Yang Wang)
- drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv (Ma Ke)
- drm/nouveau: fix error path in nvkm_gsp_fwsec_v2 (Timur Tabi)
- drm/nouveau/disp: Always accept linear modifier (James Jones)
- drm/xe/vm: Clear the scratch_pt pointer on error (Thomas Hellström)
- xfs: do not propagate ENODATA disk errors into xattr code (Eric Sandeen) [Orabug: 38440384] {CVE-2025-39835}
- smb3 client: fix return code mapping of remap_file_range (Steve French)
- net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- fs/smb: Fix inconsistent refcnt update (Shuhao Fu) [Orabug: 38440283] {CVE-2025-39819}
- dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted (Shanker Donthineni)
- blk-zoned: Fix a lockdep complaint about recursive locking (Bart Van Assche)
- HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [Orabug: 38440226] {CVE-2025-39808}
- HID: wacom: Add a new Art Pen 2 (Ping Cheng)
- HID: logitech: Add ids for G PRO 2 LIGHTSPEED (Matt Coffin)
- HID: quirks: add support for Legion Go dual dinput modes (Antheas Kapenekakis)
- HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (Qasim Ijaz) [Orabug: 38440221] {CVE-2025-39806}
- HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [Orabug: 38440308] {CVE-2025-39824}
- x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON (K Prateek Nayak)
- x86/microcode/AMD: Handle the case of no BIOS microcode (Borislav Petkov)
- RISC-V: KVM: fix stack overrun when loading vlenb (Radim Krčmář)
- net: macb: Disable clocks once (Neil Mandir)
- efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [Orabug: 38440275] {CVE-2025-39817}
- fbnic: Move phylink resume out of service_task and into open/close (Alexander Duyck)
- l2tp: do not use sock_hold() in pppol2tp_session_get_sock() (Eric Dumazet)
- sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [Orabug: 38440248] {CVE-2025-39812}
- net: rose: include node references in rose_neigh refcount (Takamitsu Iwai)
- net: rose: convert 'use' field to refcount_t (Takamitsu Iwai)
- net: rose: split remove and free operations in rose_remove_neigh() (Takamitsu Iwai)
- net: hv_netvsc: fix loss of early receive events from host during channel open. (Dipayaan Roy)
- hv_netvsc: Link queues to NAPIs (Joe Damato)
- net: stmmac: Set CIC bit only for TX queues with COE (Rohan G Thomas)
- net: stmmac: xgmac: Correct supported speed modes (Rohan G Thomas)
- net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts (Rohan G Thomas)
- net/mlx5e: Set local Xoff after FW update (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon port speed set (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon MTU set (Alexei Lazar)
- net/mlx5: Nack sync reset when SFs are present (Moshe Shemesh)
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 38440365] {CVE-2025-39832}
- net/mlx5: Reload auxiliary drivers on fw_activate (Moshe Shemesh)
- bnxt_en: Fix stats context reservation logic (Michael Chan)
- bnxt_en: Adjust TX rings if reservation is less than requested (Michael Chan)
- bnxt_en: Fix memory corruption when FW resources change during ifdown (Sreekanth Reddy) [Orabug: 38440239] {CVE-2025-39810}
- phy: mscc: Fix when PTP clock is register and unregister (Horatiu Vultur)
- drm/xe: Don't trigger rebind on initial dma-buf validation (Matthew Brost)
- drm/xe/xe_sync: avoid race during ufence signaling (Kempczynski Zbigniew)
- efi: stmm: Fix incorrect buffer allocation method (Jan Kiszka)
- net: dlink: fix multicast stats being counted incorrectly (Moon Yeounsu)
- dt-bindings: display/msm: qcom,mdp5: drop lut clock (Dmitry Baryshkov)
- ice: fix incorrect counter for buffer allocation failures (Michal Kubiak)
- ice: use fixed adapter index for E825C embedded devices (Jacob Keller)
- ice: don't leave device non-functional if Tx scheduler config fails (Jacob Keller)
- drm/nouveau: remove unused memory target test (Timur Tabi)
- drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr (Timur Tabi)
- atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [Orabug: 38440344] {CVE-2025-39828}
- Bluetooth: hci_sync: fix set_local_name race condition (Pavel Shpakovskiy)
- Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced (Luiz Augusto von Dentz)
- Bluetooth: hci_event: Mark connection as closed during suspend disconnect (Ludovico de Nittis)
- Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success (Ludovico de Nittis)
- net: macb: fix unregister_netdev call order in macb_remove() (Luoguangfei) [Orabug: 38440218] {CVE-2025-39805}
- HID: input: report battery status changes immediately (José Expósito)
- HID: input: rename hidinput_set_battery_charge_status() (José Expósito)
- powerpc/kvm: Fix ifdef to remove build warning (Madhavan Srinivasan)
- drm/msm: update the high bitfield of certain DSI registers (Ayushi Makhija)
- drm/msm/kms: move snapshot init earlier in KMS init (Dmitry Baryshkov)
- of: reserved_mem: Restructure call site for dma_contiguous_early_fixup() (Oreoluwa Babatunde)
- drm/msm: Defer fd_install in SUBMIT ioctl (Rob Clark)
- vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() (Nikolay Kuratov)
- ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list (Werner Sembach)
- erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC (Junli Liu)
- ASoC: codecs: tx-macro: correct tx_macro_component_drv name (Alexey Klimov)
- smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [Orabug: 38440315] {CVE-2025-39825}
- smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara)
- scsi: core: sysfs: Correct sysfs attributes access rights (Damien Le Moal)
- ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [Orabug: 38440257] {CVE-2025-39813}
- of: dynamic: Fix use after free in of_changeset_add_prop_helper() (Dan Carpenter)
- mips: lantiq: xway: sysctrl: rename the etop node (Aleksander Jan Bajkowski)
- mips: dts: lantiq: danube: add missing burst length property (Aleksander Jan Bajkowski)
- pinctrl: STMFX: add missing HAS_IOMEM dependency (Randy Dunlap)
- of: dynamic: Fix memleak when of_pci_add_properties() failed (Lizhi Hou)
- trace/fgraph: Fix the warning caused by missing unregister notifier (Ye Weihua) [Orabug: 38440352] {CVE-2025-39829}
- rtla: Check pkg-config install (Tao Chen)
- tools/latency-collector: Check pkg-config install (Tao Chen)
- LTS version: v6.12.44 (Harshit Mogalapalli)
- alloc_fdtable(): change calling conventions. (Al Viro)
- netfilter: nf_reject: don't leak dst refcount for loopback packets (Florian Westphal) [Orabug: 38401479] {CVE-2025-38732}
- s390/hypfs: Enable limited access during lockdown (Peter Oberparleiter)
- s390/hypfs: Avoid unnecessary ioctl registration in debugfs (Peter Oberparleiter)
- ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation (Takashi Iwai)
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Armen Ratner)
- net/mlx5e: Query FW for buffer ownership (Alexei Lazar)
- net/mlx5: Add IFC bits and enums for buf_ownership (Oren Sidi)
- net/mlx5: Relocate function declarations from port.h to mlx5_core.h (Shahar Shitrit)
- net/mlx5: Base ECVF devlink port attrs from 0 (Daniel Jurgens)
- Octeontx2-af: Skip overlap check for SPI field (Hariprasad Kelam)
- bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU (Hangbin Liu)
- bonding: update LACP activity flag after setting lacp_active (Hangbin Liu)
- ALSA: timer: fix ida_free call while not allocated (Dewei Meng) [Orabug: 38423453] {CVE-2025-39765}
- net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate (William Liu)
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (William Liu) [Orabug: 38423455] {CVE-2025-39766}
- net: dsa: microchip: Fix KSZ9477 HSR port setup issue (Tristram Ha)
- ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc (Jason Xing)
- s390/mm: Do not map lowcore with identity mapping (Heiko Carstens)
- LoongArch: Optimize module load time by optimizing PLT/GOT counting (Kanglong Wang)
- microchip: lan865x: fix missing Timer Increment config for Rev.B0/B1 (Parthiban Veerasooran)
- microchip: lan865x: fix missing netif_start_queue() call on device open (Parthiban Veerasooran)
- net/smc: fix UAF on smcsk after smc_listen_out() (D. Wythe)
- gve: prevent ethtool ops after shutdown (Jordan Rhee) [Orabug: 38401491] {CVE-2025-38735}
- phy: mscc: Fix timestamping for vsc8584 (Horatiu Vultur)
- cifs: Fix oops due to uninitialised variable (David Howells) [Orabug: 38401496] {CVE-2025-38737}
- net: ti: icssg-prueth: Fix HSR and switch offload Enablement during firwmare reload. (Md Danish Anwar)
- ppp: fix race conditions in ppp_fill_forward_path (Qingfang Deng) [Orabug: 38401498] {CVE-2025-39673}
- net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path (Qingfang Deng)
- ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add (Heminhong)
- net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (Jakub Ramaseuski) [Orabug: 38423463] {CVE-2025-39770}
- drm/amd/display: Don't print errors for nonexistent connectors (Timur Kristóf)
- drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() (Chenyuan Yang) [Orabug: 38401506] {CVE-2025-39675}
- drm/hisilicon/hibmc: fix the hibmc loaded failed bug (Baihan Li) [Orabug: 38423472] {CVE-2025-39772}
- drm/hisilicon/hibmc: fix the i2c device resource leak when vdac init failed (Baihan Li)
- drm/hisilicon/hibmc: refactored struct hibmc_drm_private (Baihan Li)
- rust: alloc: fix `rusttest` by providing `Cmalloc::aligned_layout` too (Miguel Ojeda)
- mlxsw: spectrum: Forward packets with an IPv4 link-local source IP (Ido Schimmel)
- iommu/amd: Avoid stack buffer overflow from kernel cmdline (Kees Cook) [Orabug: 38360924] {CVE-2025-38676}
- scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [Orabug: 38401511] {CVE-2025-39676}
- rtase: Fix Rx descriptor CRC error bit definition (Justin Lai)
- net: bridge: fix soft lockup in br_multicast_query_expired() (Wang Liang) [Orabug: 38423477] {CVE-2025-39773}
- net: xilinx: axienet: Fix RX skb ring management in DMAengine mode (Suraj Gupta)
- RDMA/hns: Fix dip entries leak on devices newer than hip09 (Junxian Huang)
- RDMA/bnxt_re: Fix to initialize the PBL array (Anantha Prabhu)
- RDMA/bnxt_re: Fix a possible memory leak in the driver (Kalesh Ap)
- RDMA/bnxt_re: Fix to remove workload check in SRQ limit path (Kashyap Desai)
- RDMA/bnxt_re: Fix to do SRQ armena by default (Kashyap Desai)
- RDMA/hns: Fix querying wrong SCC context for DIP algorithm (Wenglianfa)
- RDMA/erdma: Fix ignored return value of init_kernel_qp (Boshi Yu)
- rust: alloc: replace aligned_size() with Kmalloc::aligned_layout() (Danilo Krummrich)
- iosys-map: Fix undefined behavior in iosys_map_clear() (Gote, Nitin R)
- drm/tests: Fix drm_test_fb_xrgb8888_to_xrgb2101010() on big-endian (José Expósito)
- drm/tests: Do not use drm_fb_blit() in format-helper tests (Thomas Zimmermann)
- drm/format-helper: Add generic conversion to 32-bit formats (Thomas Zimmermann)
- drm/format-helper: Move helpers for pixel conversion to header file (Thomas Zimmermann)
- drm/format-helper: Add conversion from XRGB8888 to BGR888 (Kerem Karabay)
- drm/panic: Move drawing functions to drm_draw (Jocelyn Falempe)
- drm/tests: Fix endian warning (José Expósito)
- cgroup/cpuset: Fix a partition error with CPU hotplug (Waiman Long)
- cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key (Waiman Long)
- drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor(). (Fanhua Li) [Orabug: 38401536] {CVE-2025-39679}
- spi: spi-fsl-lpspi: Clamp too high speed_hz (Stefan Wahren)
- x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (Tianxiang Peng) [Orabug: 38401540] {CVE-2025-39681}
- iio: imu: inv_icm42600: change invalid data error to -EBUSY (Jean-Baptiste Maneyrol)
- iio: imu: inv_icm42600: Convert to uXX and sXX integer types (Andy Shevchenko)
- iio: imu: inv_icm42600: use = { } instead of memset() (David Lechner)
- iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 (Jonathan Cameron)
- powerpc/boot: Fix build with gcc 15 (Michal Suchanek)
- ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp() (Neil Brown)
- drm/i915/icl+/tc: Cache the max lane count value (Imre Deak)
- compiler: remove __ADDRESSABLE_ASM{_STR,}() again (Jan Beulich)
- drm/i915/icl+/tc: Convert AUX powered WARN to a debug message (Imre Deak)
- tracing: Limit access to parser->buffer when trace_get_user failed (Pu Lehui) [Orabug: 38401545] {CVE-2025-39683}
- tracing: Remove unneeded goto out logic (Steven Rostedt)
- iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() (David Lechner)
- iio: light: as73211: Ensure buffer holes are zeroed (Jonathan Cameron)
- iio: light: Use aligned_s64 instead of open coding alignment. (Jonathan Cameron)
- usb: dwc3: pci: add support for the Intel Wildcat Lake (Krogerus Heikki)
- usb: dwc3: Remove WARN_ON for device endpoint command timeouts (Selvarasu Ganesan)
- usb: dwc3: Ignore late xferNotReady event to prevent halt timeout (Kuen-Han Tsai)
- usb: xhci: Fix slot_id resource race conflict (Weitao Wang)
- usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean (Amit Sunil Dhamne)
- usb: typec: maxim_contaminant: disable low power mode when reading comparator values (Amit Sunil Dhamne)
- USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles (Zenm Chen)
- usb: storage: realtek_cr: Use correct byte order for bcs->Residue (Thorsten Blum)
- USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera (Mael Guerin)
- usb: renesas-xhci: Fix External ROM access timeouts (Marek Vasut)
- usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test (Xu Yang)
- comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() (Ian Abbott)
- comedi: pcl726: Prevent invalid irq number (Edward Adam Davis)
- comedi: Make insn_rw_emulate_bits() do insn->n samples (Ian Abbott)
- usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive (Miao Li)
- cdx: Fix off-by-one error in cdx_rpmsg_probe() (Thorsten Blum)
- kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq() (Sebastian Andrzej Siewior)
- most: core: Drop device reference after usage in get_channel() (Miaoqian Lin)
- iio: proximity: isl29501: fix buffered read on big-endian systems (David Lechner)
- iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() (Salah Triki)
- ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [Orabug: 38401577] {CVE-2025-39689}
- fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() (Xu Yilun)
- mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1 (Judith Mendez)
- drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS (Imre Deak)
- cpuidle: governors: menu: Avoid selecting states with too much latency (Rafael J. Wysocki)
- cpuidle: menu: Remove iowait influence (Christian Loehle)
- use uniform permission checks for all mount propagation changes (Al Viro)
- fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [Orabug: 38401585] {CVE-2025-39691}
- smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() (Stefan Metzmacher)
- debugfs: fix mount options not being applied (Charalampos Mitrodimas)
- arm64: dts: ti: k3-am62*: Move eMMC pinmux to top level board file (Judith Mendez)
- arm64: dts: ti: k3-am6*: Remove disable-wp for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am62*: Add non-removable flag for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am6*: Add boot phase flag to support MMC boot (Judith Mendez)
- btrfs: subpage: keep TOWRITE tag until folio is cleaned (Naohiro Aota) [Orabug: 38423491] {CVE-2025-39779}
- ext4: preserve SB_I_VERSION on remount (Baokun Li)
- scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems (Ranjan Kumar)
- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (Ranjan Kumar)
- iio: adc: ad7173: fix setting ODR in probe (David Lechner)
- PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining (Geraldo Nascimento)
- PCI: rockchip: Use standard PCIe definitions (Geraldo Nascimento)
- PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features (Richard Zhu)
- PCI: imx6: Add i.MX8Q PCIe Endpoint (EP) support (Frank Li)
- Mark xe driver as BROKEN if kernel page size is not 4kB (Simon Richter)
- mptcp: disable add_addr retransmission when timeout is 0 (Geliang Tang)
- mptcp: remove duplicate sk_reset_timer call (Geliang Tang)
- soc: qcom: mdt_loader: Fix error return values in mdt_header_valid() (Dan Carpenter)
- scsi: core: Fix command pass through retry regression (Mike Christie)
- drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. (Timur Kristóf)
- drm/amd/display: Fix Xorg desktop unresponsive on Replay panel (Tom Chung)
- drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 (Timur Kristóf)
- drm/amd/display: Don't overclock DCE 6 by 15% (Timur Kristóf)
- drm/amd/display: Avoid a NULL pointer dereference (Mario Limonciello) [Orabug: 38401594] {CVE-2025-39693}
- drm/amdgpu/swm14: Update power limit logic (Alex Deucher)
- accel/habanalabs/gaudi2: Use kvfree() for memory allocated with kvcalloc() (Thorsten Blum)
- kvm: retry nx_huge_page_recovery_thread creation (Keith Busch)
- platform/x86/intel-uncore-freq: Check write blocked for ELC (Srinivas Pandruvada)
- s390/sclp: Fix SCCB present check (Peter Oberparleiter)
- RDMA/rxe: Flush delayed SKBs while releasing RXE resources (Zhu Yanjun) [Orabug: 38401605] {CVE-2025-39695}
- ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 (Evgeniy Harchenko)
- mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn (Tu Jinjiang)
- mm/debug_vm_pgtable: clear page table entries at destroy_args() (Herton Ronaldo Krzesinski)
- NFS: Fix a race when updating an existing write (Trond Myklebust) [Orabug: 38401608] {CVE-2025-39697}
- mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency (Victor Shih)
- mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER (Victor Shih)
- memstick: Fix deadlock by moving removing flag earlier (Jiayi Li)
- mmc: sdhci-pci-gli: Add a new function to simplify the code (Victor Shih)
- iommu/arm-smmu-v3: Fix smmu_domain->nr_ats_masters decrement (Nicolin Chen)
- iov_iter: iterate_folioq: fix handling of offset >= folio size (Dominique Martinet)
- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe) [Orabug: 38401614,38500621,38572958] {CVE-2025-39698}
- sched_ext: initialize built-in idle state before ops.init() (Andrea Righi)
- ata: libata-scsi: Return aborted command when missing sense and result TF (Damien Le Moal)
- io_uring/net: commit partial buffers on retry (Jens Axboe) [Orabug: 38395103] {CVE-2025-38730}
- netfs: Fix unbuffered write error handling (David Howells) [Orabug: 38401724] {CVE-2025-39723}
- btrfs: send: make fs_path_len() inline and constify its argument (Filipe Manana)
- btrfs: send: use fallocate for hole punching with send stream v2 (Filipe Manana)
- btrfs: send: avoid path allocation for the current inode when issuing commands (Filipe Manana)
- btrfs: send: keep the current inode's path cached (Filipe Manana)
- btrfs: send: add and use helper to rename current inode when processing refs (Filipe Manana)
- btrfs: send: only use boolean variables at process_recorded_refs() (Filipe Manana)
- btrfs: send: factor out common logic when sending xattrs (Filipe Manana)
- xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags (Christoph Hellwig)
- btrfs: zoned: requeue to unused block group list if zone finish failed (Naohiro Aota)
- btrfs: codify pattern for adding block_group to bg_list (Boris Burkov)
- btrfs: explicitly ref count block_group on new_bgs list (Boris Burkov)
- btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() (Filipe Manana) [Orabug: 38434999] {CVE-2025-39800}
- btrfs: always abort transaction on failure to add block group to free space tree (Filipe Manana)
- btrfs: move transaction aborts to the error site in add_block_group_free_space() (David Sterba)
- btrfs: qgroup: fix race between quota disable and quota rescan ioctl (Filipe Manana) [Orabug: 38423413] {CVE-2025-39759}
- btrfs: qgroup: drop unused parameter fs_info from __del_qgroup_rb() (David Sterba)
- usb: typec: fusb302: cache PD RX state (Sebastian Reichel)
- USB: typec: Use str_enable_disable-like helpers (Krzysztof Kozlowski)
- x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero (Tom Lendacky)
- mm/damon/ops-common: ignore migration request to invalid nodes (Seongjae Park) [Orabug: 38401618] {CVE-2025-39700}
- selftests: mptcp: pm: check flush doesn't reset limits (Matthieu Baerts)
- mptcp: pm: kernel: flush: do not reset ADD_ADDR limit (Matthieu Baerts)
- mptcp: drop skb if MPTCP skb extension allocation fails (Christoph Paasch)
- ACPI: pfr_update: Fix the driver update version check (Chen Yu)
- ipv6: sr: Fix MAC comparison to be constant-time (Eric Biggers)
- sched/ext: Fix invalid task state transitions on class switch (Andrea Righi) [Orabug: 38423494] {CVE-2025-39780}
- net, hsr: reject HSR frame if skb can't hold tag (Jakub Acs) [Orabug: 38401631] {CVE-2025-39703}
- LoongArch: KVM: Make function kvm_own_lbt() robust (Bibo Mao)
- drm/amd/display: Don't overwrite dce60_clk_mgr (Timur Kristóf)
- drm/amd/display: fix a Null pointer dereference vulnerability (Siyang Liu) [Orabug: 38401635] {CVE-2025-39705}
- drm/amd/display: Add primary plane to commits for correct VRR handling (Michel Dänzer)
- drm/amdkfd: Destroy KFD debugfs after destroy KFD wq (Amber Lin) [Orabug: 38401643] {CVE-2025-39706}
- drm/amdgpu: update mmhub 4.1.0 client id mappings (Alex Deucher)
- drm/amdgpu: update mmhub 3.0.1 client id mappings (Alex Deucher)
- drm/amdgpu: Update external revid for GC v9.5.0 (Lijo Lazar)
- drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram() (Nathan Chancellor)
- drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities (Peter Shkenev) [Orabug: 38401649] {CVE-2025-39707}
- drm/amdgpu: Avoid extra evict-restore process. (Gang Ba)
- drm/amd: Restore cached power limit during resume (Mario Limonciello)
- media: venus: venc: Clamp param smaller than 1fps and bigger than 240 (Ricardo Ribalda)
- media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. (Ricardo Ribalda)
- media: venus: protect against spurious interrupts during probe (Jorge Ramirez-Ortiz)
- media: venus: hfi: explicitly release IRQ during teardown (Jorge Ramirez-Ortiz)
- media: venus: Fix MSM8998 frequency table (Konrad Dybcio)
- media: venus: Add a check for packet size after reading from shared memory (Vedang Nagar)
- media: qcom: camss: cleanup media device allocated resource on error path (Vladimir Zapolskiy)
- media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls (Hans de Goede)
- media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval (Mathis Foerst)
- media: ov2659: Fix memory leaks in ov2659_probe() (Zhang Shurong)
- media: pisp_be: Fix pm_runtime underrun in probe (Jacopo Mondi)
- media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [Orabug: 38401675] {CVE-2025-39713}
- media: usbtv: Lock resolution while streaming (Ludwig Disterhof) [Orabug: 38401682] {CVE-2025-39714}
- media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() (Sakari Ailus)
- media: verisilicon: Fix AV1 decoder clock frequency (Nicolas Dufresne)
- media: vivid: fix wrong pixel_array control size (Hans Verkuil)
- media: ipu6: isys: Use correct pads for xlate_streams() (Sakari Ailus)
- media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (Haoxiang Li)
- media: hi556: correct the test pattern configuration (Bingbu Cao)
- media: gspca: Add bounds checking to firmware parser (Dan Carpenter)
- parisc: Update comments in make_insert_tlb (John David Anglin)
- parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() (John David Anglin)
- parisc: Revise gateway LWS calls to probe user read access (John David Anglin)
- parisc: Revise __get_user() to probe user read access (John David Anglin)
- parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c (John David Anglin)
- parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers (Randy Dunlap)
- parisc: Drop WARN_ON_ONCE() from flush_cache_vmap (John David Anglin)
- parisc: Define and use set_pte_at() (John David Anglin)
- parisc: Check region is readable by user in raw_copy_from_user() (John David Anglin)
- soc/tegra: pmc: Ensure power-domains are in a known state (Jonathan Hunter)
- kbuild: userprogs: use correct linker when mixing clang and GNU ld (Thomas Weißschuh)
- jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [Orabug: 38423507] {CVE-2025-39782}
- f2fs: fix to avoid out-of-boundary access in dnode page (Chao Yu)
- ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in resume context (Muhammad Usama Anjum)
- amdgpu/amdgpu_discovery: increase timeout limit for IFWI init (Xaver Hugl)
- phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence (Kathiravan Thirumoorthy)
- vhost/vsock: Avoid allocating arbitrarily-sized SKBs (Will Deacon)
- vsock/virtio: Validate length in packet header before skb_put() (Will Deacon) [Orabug: 38401705] {CVE-2025-39718}
- PCI: imx6: Delay link start until configfs 'start' written (Richard Zhu)
- PCI: imx6: Remove apps_reset toggling from imx_pcie_{assert/deassert}_core_reset (Richard Zhu)
- PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features (Richard Zhu)
- PCI: endpoint: Fix configfs group removal on driver teardown (Damien Le Moal)
- PCI: endpoint: Fix configfs group list head handling (Damien Le Moal)
- PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- readahead: fix return value of page_cache_next_miss() when no hole is found (Chi Zhiling)
- mtd: rawnand: renesas: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: fsmc: Add missing check after DMA map (Thomas Fourier)
- mtd: spinand: propagate spinand_wait() errors from spinand_write_page() (Gabor Juhos)
- mtd: spi-nor: Fix spi_nor_try_unlock_all() (Michael Walle)
- hwmon: (gsc-hwmon) fix fan pwm setpoint show functions (Tim Harvey)
- pwm: mediatek: Fix duty and period setting (Uwe Kleine-König)
- pwm: mediatek: Handle hardware enable and clock enable separately (Uwe Kleine-König)
- pwm: imx-tpm: Reset counter if CMOD is 0 (Laurentiu Mihalcea)
- wifi: ath11k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath11k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath11k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath12k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (Nathan Chancellor)
- iio: adc: ad_sigma_delta: change to buffer predisable (David Lechner)
- iio: imu: bno055: fix OOB access of hw_xlate array (David Lechner)
- zynq_fpga: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- soc: qcom: mdt_loader: Ensure we don't read past the ELF header (Bjorn Andersson) [Orabug: 38423522] {CVE-2025-39787}
- ata: libata-scsi: Fix CDL control (Igor Pylypiv)
- scsi: ufs: ufs-pci: Fix default runtime and system PM levels (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers (Archana Patni)
- ata: libata-scsi: Fix ata_to_sense_error() status handling (Damien Le Moal)
- scsi: mpi3mr: Fix race between config read submit and interrupt completion (Ranjan Kumar)
- scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (André Draszik)
- scsi: dt-bindings: mediatek,ufs: Add ufs-disable-mcq flag for UFS host (Macpaul Lin)
- dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints (Krzysztof Kozlowski)
- dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints (Krzysztof Kozlowski)
- apparmor: Fix 8-byte alignment for initial dfa blob streams (Helge Deller)
- arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses (Emanuele Ghidoli)
- arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 (Hong Guan)
- arm64: dts: exynos: gs101: ufs: add dma-coherent property (Peter Griffin)
- arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default (Alexander Sverdlin)
- arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support (Judith Mendez)
- btrfs: fix printing of mount info messages for NODATACOW/NODATASUM (Kyoji Ogasawara)
- btrfs: restore mount option info messages during mount (Kyoji Ogasawara)
- btrfs: fix incorrect log message for nobarrier mount option (Kyoji Ogasawara)
- btrfs: zoned: fix write time activation failure for metadata block group (Naohiro Aota)
- ext4: fix hole length calculation overflow in non-extent inodes (Zhang Yi)
- ext4: use kmalloc_array() for array space allocation (Liao Yuanhong)
- ext4: don't try to clear the orphan_present feature block device is r/o (Theodore Ts'O)
- ext4: fix reserved gdt blocks handling in fsmap (Ojaswin Mujoo)
- ext4: fix fsmap end of range reporting with bigalloc (Ojaswin Mujoo)
- ext4: check fast symlink for ea_inode correctly (Andreas Dilger)
- tracing: fprobe-event: Sanitize wildcard for fprobe event name (Masami Hiramatsu)
- ksmbd: fix refcount leak causing resource not released (Ziyan Xu)
- crypto: octeontx2 - Fix address alignment on CN10KB and CN10KA-B0 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment on CN10K A0/A1 and OcteonTX2 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment issue on ucode loading (Bharat Bhushan)
- crypto: qat - flush misc workqueue during device shutdown (Giovanni Cabiddu) [Orabug: 38401716] {CVE-2025-39721}
- crypto: caam - Prevent crash on suspend with iMX8QM / iMX8ULP (John Ernberg)
- crypto: qat - lower priority for skcipher and aead algorithms (Giovanni Cabiddu)
- lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap (Eric Biggers)
- vt: defkeymap: Map keycodes above 127 to K_HOLE (Myrrh Periwinkle)
- vt: keyboard: Don't process Unicode characters in K_OFF mode (Myrrh Periwinkle)
- bus: mhi: host: Detect events pointing to unexpected TREs (Youssef Samir) [Orabug: 38423538] {CVE-2025-39790}
- bus: mhi: host: Fix endianness of BHI vector table (Alexander Wilhelm)
- usb: dwc3: imx8mp: fix device leak at unbind (Johan Hovold)
- usb: dwc3: meson-g12a: fix device leaks at unbind (Johan Hovold)
- usb: musb: omap2430: fix device leak at unbind (Johan Hovold)
- usb: gadget: udc: renesas_usb3: fix device leak at unbind (Johan Hovold)
- usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (Nathan Chancellor)
- m68k: Fix lost column on framebuffer debug console (Finn Thain)
- dm: Check for forbidden splitting of zone write operations (Damien Le Moal)
- dm: dm-crypt: Do not partially accept write BIOs with zoned targets (Damien Le Moal) [Orabug: 38423543] {CVE-2025-39791}
- PM: runtime: Take active children into account in pm_runtime_get_if_in_use() (Rafael J. Wysocki)
- platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() (Tzung-Bi Shih)
- cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (Dan Carpenter)
- ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig (Damien Le Moal)
- serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [Orabug: 38401726] {CVE-2025-39724}
-
Tue Sep 23 2025 Sherry Yang <sherry.yang@oracle.com> [6.12.0-105.43.1.el9uek]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38019851]
- net/rds: Enforce sibling ToS lanes are not UP when auto reaping a conn (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: replace rds_conn_addr_list with reentrant code (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Auto-reap dropped conn via sysctl net.rds.conn_reap_after_drop_secs (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Enable tracing for rds_conn_reap() (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Disallow user conn reap via sysctl net.rds.conn_user_reap_enable (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Add sockopt member all_tos to reset/reap all conns for src-dst (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Reap rds_rdma connections via sockopt RDS_CONN_REAP (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: tracepoints for rds_conn_kref_get and put (Sharath Srinivasan) [Orabug: 38343388]
- net/rds: Add krefs to struct rds_connection (Sharath Srinivasan) [Orabug: 38343388]
- net/mlx5: HWS, fix bad parameter in CQ creation (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5e: Support RX xfrm state selector's UPSPEC for packet offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add pass flow group for IPSec RX status table (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add num_reserved_entries param for ipsec_ft_create() (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Skip IPSec RX policy check for crypto offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Move IPSec policy check after decryption (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Change the destination of IPSec RX SA miss rule (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add helper function to update IPSec default destination (Jianbo Liu) [Orabug: 38431789]
- net/mlx5: fs, add counter object to flow destination (Moshe Shemesh) [Orabug: 38431789]
- net/mlx5: DR, moved all the SWS code into a separate directory (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5: hw counters: Remove mlx5_fc_create_ex (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Don't maintain a counter count (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Drop unneeded cacheline alignment (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Replace IDR+lists with xarray (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Use kvmalloc for bulk query buffer (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Make fc_stats & fc_pool private (Cosmin Ratiu) [Orabug: 38431789]
- uek: kabi: cleanup x86_64 kabi list for duplicate entries. (Yifei Liu) [Orabug: 38448304]
- KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active (Maciej S. Szmigiero) [Orabug: 38459433]