-
Tue Oct 14 2025 Jack Vogel <jack.vogel@oracle.com> [6.12.0-105.51.5.el9uek]
- RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad) [Orabug: 38226124]
- arm64: Utilize for_each_cpu_wrap for reference lookup (Beata Michalska) [Orabug: 38454705]
- arm64: Update AMU-based freq scale factor on entering idle (Beata Michalska) [Orabug: 38454705]
- arm64: Provide an AMU-based version of arch_freq_get_on_cpu (Beata Michalska) [Orabug: 38454705]
- cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry (Beata Michalska) [Orabug: 38454705]
- cpufreq: Allow arch_freq_get_on_cpu to return an error (Beata Michalska) [Orabug: 38454705]
- arch_topology: init capacity_freq_ref to 0 (Ionela Voinescu) [Orabug: 38454705]
- ACPI/HMAT: Move HMAT messages to pr_debug() (Dan Williams) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: monitor all ports by default (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: enable NVLINK-C2C port filtering (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: fix sysfs path in the kernel doc (Besar Wicaksono) [Orabug: 38454705]
- perf: arm_cspmu: nvidia: remove unsupported SCF events (Besar Wicaksono) [Orabug: 38454705]
- cppc_cpufreq: Remove HiSilicon CPPC workaround (Jie Zhan) [Orabug: 38454705]
- Revert "sched/fair: Bump sd->max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury) [Orabug: 38498945]
- uek-rpm/config-aarch64: Enable configs for Grace platform support (Vijay Kumar) [Orabug: 38526374]
- LTS version: v6.12.51 (Jack Vogel)
- ASoC: qcom: audioreach: fix potential null pointer dereference (Srinivas Kandagatla)
- wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() (Matvey Kovalev)
- mm: swap: check for stable address space before operating on the VMA (Charan Teja Kalla)
- media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID (Thadeu Lima de Souza Cascardo)
- media: rc: fix races with imon_disconnect() (Larshin Sergey)
- media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou)
- media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou)
- scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran)
- gcc-plugins: Remove TODO_verify_il for GCC >= 16 (Kees Cook)
- crypto: sha256 - fix crash at kexec (Breno Leitao)
- LTS version v6.12.50 (Jack Vogel)
- drm/i915/backlight: Return immediately when scale() finds invalid parameters (Guenter Roeck)
- Revert "usb: xhci: remove option to change a default ring's TRB cycle bit" (Niklas Neronin)
- iommufd: Fix race during abort for file descriptors (Jason Gunthorpe)
- fbcon: Fix OOB access in font allocation (Thomas Zimmermann)
- fbcon: fix integer overflow in fbcon_do_set_font (Samasth Norway Ananda)
- mm/hugetlb: fix folio is still mapped when deleted (Jinjiang Tu)
- kmsan: fix out-of-bounds access to shadow memory (Eric Biggers)
- gpiolib: Extend software-node support to support secondary software-nodes (Hans de Goede)
- fs/proc/task_mmu: check p->vec_buf for NULL (Jakub Acs)
- afs: Fix potential null pointer dereference in afs_put_server (Zhen Ni)
- drm/ast: Use msleep instead of mdelay for edid read (Nirmoy Das)
- arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports (Josua Mayer)
- arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes (Josua Mayer)
- ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address (Nobuhiro Iwamatsu)
- tracing: dynevent: Add a missing lockdown check on dynevent (Masami Hiramatsu (Google))
- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers)
- i40e: improve VF MAC filters accounting (Lukasz Czapnik)
- i40e: add mask to apply valid bits for itr_idx (Lukasz Czapnik)
- i40e: add max boundary check for VF filters (Lukasz Czapnik)
- i40e: fix validation of VF state in get resources (Lukasz Czapnik)
- i40e: fix input validation logic for action_meta (Lukasz Czapnik)
- i40e: fix idx validation in config queues msg (Lukasz Czapnik)
- i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik)
- i40e: add validation for ring_len param (Lukasz Czapnik)
- HID: asus: add support for missing PX series fn keys (Amit Chaudhari)
- smb: client: fix wrong index reference in smb2_compound_op() (Sang-Heon Jeon)
- platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() (Daniel Lee)
- drm/panthor: Defer scheduler entitiy destruction to queue release (Adrián Larumbe)
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior)
- drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita)
- mm: folio_may_be_lru_cached() unless folio_test_large() (Hugh Dickins)
- mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch" (Hugh Dickins)
- mm/gup: local lru_add_drain() to avoid lru_add_drain_all() (Hugh Dickins)
- octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (Dan Carpenter)
- net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port (Vladimir Oltean)
- net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() (Vladimir Oltean)
- selftests: fib_nexthops: Fix creation of non-FDB nexthops (Ido Schimmel)
- nexthop: Forbid FDB status change while nexthop is in a group (Ido Schimmel)
- net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS (Jason Baron)
- bnxt_en: correct offset handling for IPv6 destination address (Alok Tiwari)
- vhost: Take a reference on the task in struct vhost_task. (Sebastian Andrzej Siewior)
- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix hci_resume_advertising_sync (Luiz Augusto von Dentz)
- ethernet: rvu-af: Remove slash from the driver name (Petr Malat)
- net/smc: fix warning in smc_rx_splice() when calling get_page() (Sidraya Jayagond)
- net: tun: Update napi->skb after XDP process (Wang Liang)
- can: peak_usb: fix shift-out-of-bounds issue (Stéphane Grosjean)
- can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: hi311x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow (Vincent Mailhol)
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca)
- bpf: Reject bpf_timer for PREEMPT_RT (Leon Hwang)
- can: rcar_can: rcar_can_resume(): fix s2ram with PSCI (Geert Uytterhoeven)
- wifi: virt_wifi: Fix page fault on connect (James Guan)
- btrfs: don't allow adding block device of less than 1 MB (Mark Harmstone)
- bpf: Check the helper function is valid in get_helper_proto (Jiri Olsa)
- smb: server: use disable_work_sync in transport_rdma.c (Stefan Metzmacher)
- smb: server: don't use delayed_work for post_recv_credits_work (Stefan Metzmacher)
- cpufreq: Initialize cpufreq-based invariance before subsys (Christian Loehle)
- ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients (Jihed Chaibi)
- arm64: dts: imx8mp: Correct thermal sensor index (Peng Fan)
- firmware: imx: Add stub functions for SCMI MISC API (Peng Fan)
- HID: amd_sfh: Add sync across amd sfh work functions (Basavaraj Natikar)
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Or Har-Toov)
- net: sfp: add quirk for FLYPRO copper SFP+ module (Aleksander Jan Bajkowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on more devices (qaqland)
- ALSA: usb-audio: move mixer_quirks' min_mute into common quirk (Cryolitia PukNgae)
- ALSA: usb-audio: Add DSD support for Comtrue USB Audio device (noble.yang)
- i2c: designware: Add quirk for Intel Xe (Heikki Krogerus)
- mmc: sdhci-cadence: add Mobileye eyeQ support (Benoît Monin)
- net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Chris Morgan)
- net: fec: rename struct fec_devinfo fec_imx6x_info -> fec_imx6sx_info (Marc Kleine-Budde)
- usb: core: Add 0x prefix to quirks debug output (Jiayi Li)
- ALSA: usb-audio: Fix build with CONFIG_INPUT=n (Takashi Iwai)
- ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA (Stefan Binding)
- ALSA: usb-audio: Convert comma to semicolon (Chen Ni)
- ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 (Cristian Ciocaltea)
- ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Simplify NULL comparison in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Avoid multiple assignments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix block comments in mixer_quirks (Cristian Ciocaltea)
- ALSA: usb-audio: Fix code alignment in mixer_quirks (Cristian Ciocaltea)
- firewire: core: fix overlooked update of subsystem ABI version (Takashi Sakamoto)
- scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE (Alok Tiwari)
-
Tue Oct 07 2025 Jack Vogel <jack.vogel@oracle.com> [6.12.0-105.49.4.el9uek]
- fs/dax: don't disassociate zero page entries (Alistair Popple) [Orabug: 36859857]
- device/dax: properly refcount device dax pages when mapping (Alistair Popple) [Orabug: 36859857]
- fs/dax: properly refcount fs dax pages (Alistair Popple) [Orabug: 36859857]
- fs/dax: Fix "don't skip locked entries when scanning entries" (Alistair Popple) [Orabug: 36859857]
- mm: decline to manipulate the refcount on a slab page (Matthew Wilcox (Oracle)) [Orabug: 36859857]
- dcssblk: mark DAX broken, remove FS_DAX_LIMITED support (Dan Williams) [Orabug: 36859857]
- mm/gup: don't allow FOLL_LONGTERM pinning of FS DAX pages (Alistair Popple) [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pmd() (Alistair Popple) [Orabug: 36859857]
- mm/huge_memory: add vmf_insert_folio_pud() (Alistair Popple) [Orabug: 36859857]
- mm/rmap: add support for PUD sized mappings to rmap (Alistair Popple) [Orabug: 36859857]
- mm/memory: add vmf_insert_page_mkwrite() (Alistair Popple) [Orabug: 36859857]
- mm/memory: enhance insert_page_into_pte_locked() to create writable mappings (Alistair Popple) [Orabug: 36859857]
- mm: allow compound zone device pages (Alistair Popple) [Orabug: 36859857]
- mm/mm_init: move p2pdma page refcount initialisation to p2pdma (Alistair Popple) [Orabug: 36859857]
- mm/gup: remove redundant check for PCI P2PDMA page (Alistair Popple) [Orabug: 36859857]
- fs/dax: remove PAGE_MAPPING_DAX_SHARED mapping flag (Alistair Popple) [Orabug: 36859857]
- dax: use folios more widely within DAX (Matthew Wilcox (Oracle)) [Orabug: 36859857]
- dax: remove access to page->index (Matthew Wilcox (Oracle)) [Orabug: 36859857]
- fs/dax: ensure all pages are idle prior to filesystem unmount (Alistair Popple) [Orabug: 36859857]
- fs/dax: always remove DAX page-cache entries when breaking layouts (Alistair Popple) [Orabug: 36859857]
- mm: optimize invalidation of shadow entries (Shakeel Butt) [Orabug: 36859857]
- mm: optimize truncation of shadow entries (Shakeel Butt) [Orabug: 36859857]
- fs/dax: create a common implementation to break DAX layouts (Alistair Popple) [Orabug: 36859857]
- fs/dax: refactor wait for dax idle page (Alistair Popple) [Orabug: 36859857]
- fs/dax: don't skip locked entries when scanning entries (Alistair Popple) [Orabug: 36859857]
- fs/dax: return unmapped busy pages from dax_layout_busy_page_range() (Alistair Popple) [Orabug: 36859857]
- uek: kabi: Update check-kabi to support namespace checks (Saeed Mirzamohammadi) [Orabug: 38459242]
-
Wed Oct 01 2025 Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> [6.12.0-105.49.3.el9uek]
- uek-rpm: Disable module xe build on 64k (Sherry Yang) [Orabug: 38490598]
-
Tue Sep 30 2025 Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> [6.12.0-105.49.2.el9uek]
- io_uring: Hide kabi magic from user space (Sherry Yang) [Orabug: 38463157]
- LTS version: v6.12.49 (Harshit Mogalapalli)
- minmax.h: remove some #defines that are only expanded once (David Laight)
- minmax.h: simplify the variants of clamp() (David Laight)
- minmax.h: move all the clamp() definitions after the min/max() ones (David Laight)
- minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() (David Laight)
- minmax.h: reduce the #define expansion of min(), max() and clamp() (David Laight)
- minmax.h: update some comments (David Laight)
- minmax.h: add whitespace around operators and after commas (David Laight)
- rtc: pcf2127: fix SPI command byte for PCF2131 backport (Bruno Thomsen)
- xhci: dbc: Fix full DbC transfer ring after several reconnects (Mathias Nyman)
- xhci: dbc: decouple endpoint allocation from initialization (Mathias Nyman)
- usb: xhci: remove option to change a default ring's TRB cycle bit (Niklas Neronin)
- usb: xhci: introduce macro for ring segment list iteration (Niklas Neronin)
- mptcp: pm: nl: announce deny-join-id0 flag (Matthieu Baerts)
- mm/gup: check ref_count instead of lru before migration (Hugh Dickins)
- mm: add folio_expected_ref_count() for reference count calculation (Shivank Garg)
- vmxnet3: unregister xdp rxq info in the reset path (Sankararaman Jayaraman) [Orabug: 37844478] {CVE-2025-22106}
- platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk (Antheas Kapenekakis)
- platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on ASUS ROG Z13 (Antheas Kapenekakis)
- io_uring: fix incorrect io_kiocb reference in io_link_skb (Yang Xiuwei)
- smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path (Stefan Metzmacher) [Orabug: 38503782] {CVE-2025-39929}
- crypto: af_alg - Set merge to zero early in af_alg_sendmsg (Herbert Xu) [Orabug: 38503788] {CVE-2025-39931}
- smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) (Stefan Metzmacher) [Orabug: 38503796] {CVE-2025-39932}
- smb: client: fix filename matching of deferred files (Paulo Alcantara)
- drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue() (Dan Carpenter)
- drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path (Qi Xi)
- drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ (Loic Poulain)
- drm/xe/tile: Release kobject for the failure path (Shuicheng Lin)
- ASoC: Intel: catpt: Expose correct bit depth to userspace (Amadeusz Sławiński)
- ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message (Colin Ian King)
- ASoC: wm8974: Correct PLL rate rounding (Charles Keepax)
- ASoC: wm8940: Correct typo in control name (Charles Keepax)
- ASoC: wm8940: Correct PLL rate rounding (Charles Keepax)
- io_uring/kbuf: drop WARN_ON_ONCE() from incremental length check (Jens Axboe)
- io_uring/msg_ring: kill alloc_cache for io_kiocb allocations (Jens Axboe)
- io_uring: include dying ring in task_work "should cancel" state (Jens Axboe)
- io_uring: backport io_should_terminate_tw() (Jens Axboe)
- io_uring/cmd: let cmds to know about dying task (Pavel Begunkov)
- ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx (Praful Adiga)
- selftests: mptcp: avoid spurious errors on TCP disconnect (Matthieu Baerts)
- selftests: mptcp: connect: catch IO errors on listen side (Matthieu Baerts)
- mptcp: propagate shutdown to subflows when possible (Matthieu Baerts)
- net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer (Hans de Goede)
- drm/amd/display: Allow RX6xxx & RX7700 to invoke amdgpu_irq_get/put (Ivan Lipski)
- mmc: mvsdio: Fix dma_unmap_sg() nents value (Thomas Fourier)
- ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S (Mohammad Rafi Shaik)
- ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed (Krzysztof Kozlowski)
- ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface (Mohammad Rafi Shaik)
- btrfs: tree-checker: fix the incorrect inode ref size check (Qu Wenruo)
- iommu/amd/pgtbl: Fix possible race while increase page table level (Vasant Hegde)
- iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() (Eugene Koira)
- LoongArch: Check the return value when creating kobj (Tao Cui)
- LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled (Huacai Chen)
- LoongArch: vDSO: Check kcalloc() result in init_vdso() (Guangshuo Li)
- LoongArch: Fix unreliable stack for live patching (Tiezhu Yang)
- objtool/LoongArch: Mark special atomic instruction as INSN_BUG type (Tiezhu Yang)
- objtool/LoongArch: Mark types based on break immediate code (Tiezhu Yang)
- LoongArch: Update help info of ARCH_STRICT_ALIGN (Tiezhu Yang)
- mm: revert "mm: vmscan.c: fix OOM on swap stress test" (Hugh Dickins)
- gup: optimize longterm pin_user_pages() for large folio (Li Zhe)
- dm-stripe: fix a possible integer overflow (Mikulas Patocka) [Orabug: 38503824] {CVE-2025-39940}
- dm-raid: don't set io_min and io_opt for raid1 (Mikulas Patocka)
- power: supply: bq27xxx: restrict no-battery detection to bq27000 (H. Nikolaus Schaller)
- power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery (H. Nikolaus Schaller)
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu)
- nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* (Nathan Chancellor)
- ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size (Stefan Metzmacher)
- ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer (Namjae Jeon)
- perf/x86/intel: Fix crash in icl_update_topdown_event() (Kan Liang) [Orabug: 38180828] {CVE-2025-38322}
- octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (Duoming Zhou)
- cnic: Fix use-after-free bugs in cnic_delete_task (Duoming Zhou) [Orabug: 38503847] {CVE-2025-39945}
- net: liquidio: fix overflow in octeon_init_instr_queue() (Alexey Nepomnyashih)
- Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" (Tariq Toukan)
- tls: make sure to abort the stream if headers are bogus (Jakub Kicinski) [Orabug: 38503856] {CVE-2025-39946}
- tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Kuniyuki Iwashima)
- octeon_ep: fix VF MAC address lifecycle handling (Sathesh Edara)
- bonding: don't set oif to bond dev when getting NS target destination (Hangbin Liu)
- net/mlx5e: Harden uplink netdev access against device unbind (Jianbo Liu) [Orabug: 38503862] {CVE-2025-39947}
- igc: don't fail igc_probe() on LED setup error (Kohei Enju)
- i40e: remove redundant memory barrier when cleaning Tx descs (Maciej Fijalkowski)
- ice: fix Rx page leak on multi-buffer frames (Jacob Keller) [Orabug: 38503866] {CVE-2025-39948}
- ice: store max_frame and rx_buf_len only in ice_rx_ring (Jacob Keller)
- net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure (Moon Yeounsu)
- selftests: mptcp: sockopt: fix error messages (Geliang Tang)
- mptcp: tfo: record 'deny join id0' info (Matthieu Baerts)
- selftests: mptcp: userspace pm: validate deny-join-id0 flag (Matthieu Baerts)
- mptcp: set remote_deny_join_id0 on SYN recv (Matthieu Baerts)
- bonding: set random address only when slaves already exist (Hangbin Liu)
- qed: Don't collect too many protection override GRC elements (Jamie Bainbridge) [Orabug: 38503868] {CVE-2025-39949}
- net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR (Anderson Nascimento)
- dpaa2-switch: fix buffer pool seeding for control traffic (Ioana Ciornei)
- um: Fix FD copy size in os_rcv_fd_msg() (Tiwei Bie)
- um: virtio_uml: Fix use-after-free after put_device in probe (Miaoqian Lin)
- btrfs: fix invalid extref key setup when replaying dentry (Filipe Manana)
- cgroup: split cgroup_destroy_wq into 3 workqueues (Chen Ridong) [Orabug: 38503889] {CVE-2025-39953}
- pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch (Geert Uytterhoeven)
- wifi: mac80211: fix incorrect type for ret (Liao Yuanhong)
- wifi: mac80211: increase scan_ies_len for S1G (Lachlan Hodges)
- ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported (Takashi Sakamoto)
- nvme: fix PI insert on write (Christoph Hellwig)
- wifi: wilc1000: avoid buffer overflow in WID string configuration (Ajay Singh)
- LTS version: v6.12.48 (Harshit Mogalapalli)
- x86: disable image size check for test builds (Guenter Roeck)
- netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [Orabug: 38492667] {CVE-2025-39867}
- drm/amdgpu: fix a memory leak in fence cleanup when unloading (Alex Deucher)
- drm/i915/power: fix size for for_each_set_bit() in abox iteration (Jani Nikula)
- net: mdiobus: release reset_gpio in mdiobus_unregister_device() (Csaba Buday)
- x86/cpu/topology: Always try cpu_parse_topology_ext() on AMD/Hygon (K Prateek Nayak)
- phy: ti-pipe3: fix device leak at unbind (Johan Hovold)
- phy: ti: omap-usb2: fix device leak at unbind (Johan Hovold)
- phy: tegra: xusb: fix device and OF node leak at probe (Johan Hovold)
- dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate (Miaoqian Lin)
- dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees (Stephan Gerhold) [Orabug: 38494820] {CVE-2025-39923}
- usb: gadget: midi2: Fix MIDI2 IN EP max packet size (Takashi Iwai)
- usb: gadget: midi2: Fix missing UMP group attributes initialization (Takashi Iwai)
- usb: typec: tcpm: properly deliver cable vdms to altmode drivers (Rd Babiera)
- USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels (Alan Stern)
- xhci: fix memory leak regression when freeing xhci vdev devices depth first (Mathias Nyman)
- RISC-V: Remove unnecessary include from compat.h (Palmer Dabbelt)
- regulator: sy7636a: fix lifecycle of power good gpio (Andreas Kemnade)
- dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (Anders Roxell)
- dmaengine: idxd: Fix double free in idxd_setup_wqs() (Dan Carpenter) [Orabug: 38461885] {CVE-2025-39870}
- dmaengine: idxd: Fix refcount underflow on module unload (Yi Sun)
- dmaengine: idxd: Remove improper idxd_free (Yi Sun) [Orabug: 38461887] {CVE-2025-39871}
- phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties (Pengyu Luo)
- hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr (Hangbin Liu)
- hsr: use rtnl lock when iterating over ports (Hangbin Liu)
- net: hsr: Add VLAN CTAG filter support (Murali Karicheri)
- netfilter: nf_tables: restart set lookup on base_seq change (Florian Westphal)
- netfilter: nf_tables: make nft_set_do_lookup available unconditionally (Florian Westphal)
- netfilter: nf_tables: place base_seq in struct net (Florian Westphal)
- netfilter: nf_tables: Reintroduce shortened deletion notifications (Phil Sutter)
- netfilter: nft_set_rbtree: continue traversal if element is inactive (Florian Westphal)
- netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal)
- netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal)
- netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal)
- netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal)
- netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal)
- can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB (Anssi Hannula)
- can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails (Tetsuo Handa)
- can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed (Tetsuo Handa)
- drm/amd/display: use udelay rather than fsleep (Alex Deucher)
- i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (Michal Schmidt) [Orabug: 38494785] {CVE-2025-39911}
- igb: fix link test skipping when interface is admin down (Kohei Enju)
- docs: networking: can: change bcm_msg_head frames member to support flexible array (Alex Tran)
- tunnels: reset the GSO metadata before reusing the skb (Antoine Tenart)
- net: bridge: Bounce invalid boolopts (Petr Machata)
- genetlink: fix genl_bind() invoking bind() after -EPERM (Alok Tiwari) [Orabug: 38494831] {CVE-2025-39926}
- net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (Stefan Wahren)
- drm/panthor: validate group queue count (Chia-I Wu)
- Disable SLUB_TINY for build testing (Linus Torvalds)
- USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- USB: serial: option: add Telit Cinterion FN990A w/audio compositions (Fabio Porcedda)
- dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks (Krzysztof Kozlowski)
- serial: sc16is7xx: fix bug in flow control levels init (Hugo Villeneuve)
- tty: hvc_console: Call hvc_kick in hvc_write unconditionally (Fabian Vogt)
- Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" (Paolo Abeni)
- Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table (Christoffer Sandberg)
- Input: iqs7222 - avoid enabling unused interrupts (Jeff Labundy)
- hrtimers: Unconditionally update target CPU base after offline timer migration (Xiongfeng Wang)
- btrfs: fix corruption reading compressed range when block size is smaller than page size (Qu Wenruo)
- btrfs: use readahead_expand() on compressed extents (Boris Burkov)
- mtd: spinand: winbond: Fix oob_layout for W25N01JW (Santhosh Kumar K)
- mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Jeongjun Park)
- mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() (Quanmin Yan)
- mm/damon/sysfs: fix use-after-free in state_show() (Stanislav Fort) [Orabug: 38461827] {CVE-2025-39877}
- ceph: fix race condition where r_parent becomes stale before sending message (Alex Markuze)
- ceph: fix race condition validating r_parent before applying state (Alex Markuze) [Orabug: 38494833] {CVE-2025-39927}
- libceph: fix invalid accesses to ceph_connection_v1_info (Ilya Dryomov) [Orabug: 38461835] {CVE-2025-39880}
- kernfs: Fix UAF in polling when open file is released (Chen Ridong) [Orabug: 38461841] {CVE-2025-39881}
- netlink: specs: mptcp: fix if-idx attribute type (Matthieu Baerts)
- netlink: specs: mptcp: replace underscores with dashes in names (Jakub Kicinski)
- netlink: specs: mptcp: clearly mention attributes (Matthieu Baerts)
- netlink: specs: mptcp: add missing 'server-side' attr (Matthieu Baerts)
- drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (David Rosca)
- drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time (David Rosca)
- drm/xe: Attempt to bring bos back to VRAM after eviction (Thomas Hellström)
- drm/mediatek: fix potential OF node use-after-free (Johan Hovold)
- mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() (Quanmin Yan)
- mm/damon/core: set quota->charged_from to jiffies at first charge window (Sang-Heon Jeon)
- mm/memory-failure: fix redundant updates for already poisoned pages (Kyle Meyer)
- mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Miaohe Lin) [Orabug: 38461846] {CVE-2025-39883}
- mm/khugepaged: fix the address passed to notifier on testing young (Wei Yang)
- fuse: prevent overflow in copy_file_range return value (Miklos Szeredi)
- fuse: check if copy_file_range() returns larger than requested size (Miklos Szeredi)
- fuse: do not allow mapping a non-regular backing file (Amir Goldstein)
- mtd: rawnand: stm32_fmc2: fix ECC overwrite (Christophe Kerello)
- mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer (Christophe Kerello)
- mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing (Alexander Sverdlin)
- net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups (Oleksij Rempel)
- i2c: i801: Hide Intel Birch Stream SoC TCO WDT (Chiasheng Lee)
- btrfs: fix subvolume deletion lockup caused by inodes xarray race (Omar Sandoval) [Orabug: 38461854] {CVE-2025-39884}
- btrfs: fix squota compressed stats leak (Boris Burkov)
- ocfs2: fix recursive semaphore deadlock in fiemap call (Mark Tinguely) [Orabug: 38461857] {CVE-2025-39885}
- mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN (Krister Johansen)
- compiler-clang.h: define __SANITIZE_*__ macros only when undefined (Nathan Chancellor)
- EDAC/altera: Delete an inappropriate dma_free_coherent() call (Salah Triki)
- proc: fix type confusion in pde_set_flags() (Zijie Wang)
- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. (Kuniyuki Iwashima) [Orabug: 38494795] {CVE-2025-39913}
- bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() (Peilin Ye) [Orabug: 38461865] {CVE-2025-39886}
- bpf: Allow fall back to interpreter for programs with stack size <= 512 (Kafai Wan)
- bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (Daniel Borkmann) [Orabug: 38494805] {CVE-2025-39917}
- s390/cpum_cf: Deny all sampling events by counter PMU (Thomas Richter)
- s390/pai: Deny all events not handled by this PMU (Thomas Richter)
- tracing: Silence warning when chunk allocation fails in trace_pid_write (Pu Lehui) [Orabug: 38494800] {CVE-2025-39914}
- NFSv4/flexfiles: Fix layout merge mirror check. (Jonathan Curley)
- NFS: nfs_invalidate_folio() must observe the offset and size arguments (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and copy range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and clone range (Trond Myklebust)
- NFSv4.2: Serialise O_DIRECT i/o and fallocate() (Trond Myklebust)
- NFS: Serialise O_DIRECT i/o and truncate() (Trond Myklebust)
- fs/nfs/io: make nfs_start_io_*() killable (Max Kellermann)
- ftrace/samples: Fix function size computation (Vladimir Riabchun)
- nfs/localio: restore creds before releasing pageio data (Scott Mayhew)
- nfs/localio: add direct IO enablement with sync and async IO support (Mike Snitzer)
- nfs/localio: remove extra indirect nfs_to call to check {read,write}_iter (Mike Snitzer)
- tracing: Fix tracing_marker may trigger page fault during preempt_disable (Luo Gengkun)
- NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server (Trond Myklebust)
- NFSv4: Clear NFS_CAP_OPEN_XOR and NFS_CAP_DELEGTIME if not supported (Trond Myklebust)
- NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set (Trond Myklebust)
- trace/fgraph: Fix error handling (Guenter Roeck)
- NFSv4: Don't clear capabilities that won't be reset (Trond Myklebust)
- SUNRPC: call xs_sock_process_cmsg for all cmsg (Justin Worrell)
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read (Tigran Mkrtchyan)
- drm/amdgpu: Add back JPEG to video caps for carrizo and newer (David Rosca)
- ALSA: hda/realtek: Fix built-in mic assignment on ASUS VivoBook X515UA (Takashi Iwai)
- Revert "drm/amd/display: Optimize cursor position updates" (Aurabindo Pillai)
- drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed (Srinivasan Shanmugam)
- drm/i915/pmu: Fix zero delta busyness issue (Umesh Nerlige Ramappa)
- ext4: introduce linear search for dentries (Theodore Ts'O)
- Revert "udmabuf: fix vmap_udmabuf error page set" (Huan Yang)
- nvme-pci: skip nvme_write_sq_db on empty rqlist (Maurizio Lombardi)
- dma-debug: fix physical address calculation for struct dma_debug_entry (Fedor Pchelkin)
- dma-mapping: fix swapped dir/flags arguments to trace_dma_alloc_sgt_err (Sean Anderson)
- mm: introduce and use {pgd,p4d}_populate_kernel() (Harry Yoo)
- net/mlx5: HWS, change error flow on matcher disconnect (Yevgeny Kliteynik)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- dma-debug: don't enforce dma mapping check on noncoherent allocations (Baochen Qiang)
- dma-mapping: trace more error paths (Sean Anderson)
- dma-mapping: use trace_dma_alloc for dma_alloc* instead of using trace_dma_map (Sean Anderson)
- dma-mapping: trace dma_alloc/free direction (Sean Anderson)
- dma-debug: store a phys_addr_t in struct dma_debug_entry (Christoph Hellwig)
- fhandle: use more consistent rules for decoding file handle from userns (Amir Goldstein)
- LTS version: v6.12.47 (Harshit Mogalapalli)
- LTS version: v6.12.46 (Harshit Mogalapalli)
- dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- md/raid1: fix data lost for writemostly rdev (Yu Kuai)
- riscv, bpf: use lw when reading int cpu in bpf_get_smp_processor_id (Radim Krčmář)
- riscv, bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG (Radim Krčmář)
- riscv: use lw when reading int cpu in asm_per_cpu (Radim Krčmář)
- riscv: use lw when reading int cpu in new_vmalloc_check (Radim Krčmář)
- riscv: Only allow LTO with CMODEL_MEDANY (Nathan Chancellor)
- ACPI: RISC-V: Fix FFH_CPPC_CSR error handling (Anup Patel)
- md: prevent incorrect update of resync/recovery offset (Li Nan)
- tools: gpio: remove the include directory on make clean (Zhang Jiao)
- drm/amd/amdgpu: Fix missing error return on kzalloc failure (Colin Ian King)
- perf bpf-utils: Harden get_bpf_prog_info_linear (Ian Rogers)
- perf bpf-utils: Constify bpil_array_desc (Ian Rogers)
- perf bpf-event: Fix use-after-free in synthesis (Ian Rogers)
- drm/bridge: ti-sn65dsi86: fix REFCLK setting (Michael Walle)
- spi: spi-fsl-lpspi: Clear status register after disabling the module (Larisa Grigore)
- spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort (Larisa Grigore)
- spi: spi-fsl-lpspi: Set correct chip-select polarity bit (Larisa Grigore)
- spi: spi-fsl-lpspi: Fix transmissions when using CONT (Larisa Grigore)
- scsi: sr: Reinstate rotational media flag (Ming Lei)
- block: add a queue_limits_commit_update_frozen helper (Christoph Hellwig)
- hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM (Vadim Pasternak)
- platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID (David Arcari)
- platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk (Antheas Kapenekakis)
- pcmcia: Add error handling for add_interval() in do_validate_mem() (Xu Wang)
- pcmcia: omap: Add missing check for platform_get_resource (Chen Ni)
- Revert "drm/amdgpu: Avoid extra evict-restore process." (Alex Deucher)
- ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY (Aaron Erhardt)
- ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model (Takashi Iwai)
- rust: support Rust >= 1.91.0 target spec (Miguel Ojeda)
- dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() (Qiu-Ji Chen)
- thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold (Nícolas F R A Prado)
- mm: fix accounting of memmap pages (Sumanth Korikkar)
- kunit: kasan_test: disable fortify string checker on kasan_strings() test (Levi Yun)
- nouveau: fix disabling the nonstall irq due to storm code (Dave Airlie)
- mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Li Qiong) [Orabug: 38494758] {CVE-2025-39902}
- mm, slab: cleanup slab_bug() parameters (Vlastimil Babka)
- mm: slub: call WARN() when detecting a slab corruption (Hyesoo Yu)
- mm: slub: Print the broken data before restoring them (Hyesoo Yu)
- md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb (Su Yue) [Orabug: 37844677] {CVE-2025-22124}
- net: fix NULL pointer dereference in l3mdev_l3_rcv (Wang Liang) [Orabug: 37844462] {CVE-2025-22103}
- wifi: ath11k: update channel list in worker when wait flag is set (Wen Gong)
- wifi: ath11k: update channel list in reg notifier instead reg worker (Wen Gong) [Orabug: 37844571] {CVE-2025-23133}
- ext4: avoid journaling sb update on error if journal is destroying (Ojaswin Mujoo) [Orabug: 37844503] {CVE-2025-22113}
- ext4: define ext4_journal_destroy wrapper (Ojaswin Mujoo)
- md/raid1,raid10: strip REQ_NOWAIT from member bios (Zheng Qixing)
- md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT (Yu Kuai)
- md/raid1,raid10: don't ignore IO flags (Yu Kuai)
- net: dsa: b53: do not enable EEE on bcm63xx (Jonas Gorski) [Orabug: 38180448] {CVE-2025-38272}
- net: dsa: b53/bcm_sf2: implement .support_eee() method (Russell King)
- net: dsa: provide implementation of .support_eee() (Russell King)
- net: dsa: add hook to determine whether EEE is supported (Russell King)
- fs/fhandle.c: fix a race in call of has_locked_children() (Al Viro) [Orabug: 38180547] {CVE-2025-38306}
- microchip: lan865x: Fix LAN8651 autoloading (Stefan Wahren)
- microchip: lan865x: Fix module autoloading (Stefan Wahren)
- net: pcs: rzn1-miic: Correct MODCTRL register offset (Lad Prabhakar)
- e1000e: fix heap overflow in e1000_set_eeprom (Vitaly Lifshits) [Orabug: 38494738] {CVE-2025-39898}
- cifs: prevent NULL pointer dereference in UTF16 conversion (Makar Semyonov) [Orabug: 38456730] {CVE-2025-39838}
- batman-adv: fix OOB read/write in network-coding decode (Stanislav Fort)
- scsi: lpfc: Fix buffer free/clear order in deferred receive path (John Evans) [Orabug: 38456752] {CVE-2025-39841}
- platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG (Ivan Lipski)
- drm/amdgpu: drop hw access in non-DC audio fini (Alex Deucher)
- net: ethernet: oa_tc6: Handle failure of spi_setup (Stefan Wahren)
- wifi: mt76: mt7925: fix the wrong bss cleanup for SAP (Ming Yen Hsieh)
- wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() (Nathan Chancellor)
- wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete (Ming Yen Hsieh)
- wifi: mwifiex: Initialize the chan_stats array to zero (Rong Qianfeng) [Orabug: 38494721] {CVE-2025-39891}
- soc: qcom: mdt_loader: Deal with zero e_shentsize (Bjorn Andersson)
- of_numa: fix uninitialized memory nodes causing kernel panic (Yin Tirui) [Orabug: 38494765] {CVE-2025-39903}
- ocfs2: prevent release journal inode after journal shutdown (Edward Adam Davis) [Orabug: 38456756] {CVE-2025-39842}
- kasan: fix GCC mem-intrinsic prefix with sw tags (Ada Couprie Diaz)
- sched: Fix sched_numa_find_nth_cpu() if mask offline (Christian Loehle) [Orabug: 38494732] {CVE-2025-39895}
- mm: slub: avoid wake up kswapd in set_track_prepare (Yangshiguang) [Orabug: 38456759] {CVE-2025-39843}
- mm: fix possible deadlock in kmemleak (Gu Bowen)
- mm: move page table sync declarations to linux/pgtable.h (Harry Yoo) [Orabug: 38456762] {CVE-2025-39844}
- mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE (Sasha Levin) [Orabug: 38494745] {CVE-2025-39899}
- x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Harry Yoo) [Orabug: 38456765] {CVE-2025-39845}
- io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (Jens Axboe) [Orabug: 38254135] {CVE-2025-38453}
- pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() (Ma Ke)
- ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (Miaoqian Lin)
- accel/ivpu: Prevent recovery work from being queued during device removal (Karol Wachowski)
- ALSA: usb-audio: Add mute TLV for playback volumes on some devices (Cryolitia Pukngae)
- phy: mscc: Stop taking ts_lock for tx_queue and use its own lock (Horatiu Vultur)
- selftest: net: Fix weird setsockopt() in bind_bhash.c. (Kuniyuki Iwashima)
- ppp: fix memory leak in pad_compress_skb (Qingfang Deng) [Orabug: 38456779] {CVE-2025-39847}
- net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (Abin Joseph)
- net: atm: fix memory leak in atm_register_sysfs when device_register fail (Wang Liang)
- ax25: properly unshare skbs in ax25_kiss_rcv() (Eric Dumazet)
- mctp: return -ENOPROTOOPT for unknown getsockopt options (Alok Tiwari)
- net/smc: Remove validation of reserved bits in CLC Decline message (Mahanta Jambigi)
- ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() (Dan Carpenter)
- net: thunder_bgx: decrement cleanup index before use (Rosen Penev)
- net: thunder_bgx: add a missing of_node_put (Rosen Penev)
- wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (Dan Carpenter) [Orabug: 38456796] {CVE-2025-39849}
- wifi: libertas: cap SSID len in lbs_associate() (Dan Carpenter)
- wifi: cw1200: cap SSID length in cw1200_do_join() (Dan Carpenter)
- vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (Ido Schimmel) [Orabug: 38456798] {CVE-2025-39850}
- vxlan: Rename FDB Tx lookup function (Ido Schimmel)
- vxlan: Add RCU read-side critical sections in the Tx path (Ido Schimmel)
- vxlan: Avoid unnecessary updates to FDB 'used' time (Ido Schimmel)
- vxlan: Refresh FDB 'updated' time upon 'NTF_USE' (Ido Schimmel)
- net: vxlan: rename SKB_DROP_REASON_VXLAN_NO_REMOTE (Radu Rendec)
- net: vxlan: use kfree_skb_reason() in vxlan_mdb_xmit() (Menglong Dong)
- net: vxlan: use kfree_skb_reason() in vxlan_xmit() (Menglong Dong)
- net: vxlan: make vxlan_set_mac() return drop reasons (Menglong Dong)
- vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (Ido Schimmel) [Orabug: 38456803] {CVE-2025-39851}
- net: vxlan: make vxlan_snoop() return drop reasons (Menglong Dong)
- net: vxlan: add skb drop reasons to vxlan_rcv() (Menglong Dong)
- net: tunnel: add pskb_inet_may_pull_reason() helper (Menglong Dong)
- net: skb: add pskb_network_may_pull_reason() helper (Menglong Dong)
- net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets (Felix Fietkau)
- net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 (Christoph Paasch) [Orabug: 38456808] {CVE-2025-39852}
- wifi: ath11k: fix group data packet drops during rekey (Rameshkumar Sundaram)
- ixgbe: fix incorrect map used in eee linkmode (Alok Tiwari) [Orabug: 38494817] {CVE-2025-39922}
- i40e: Fix potential invalid access when MAC list is empty (Zhen Ni) [Orabug: 38456812] {CVE-2025-39853}
- i40e: remove read access to debugfs files (Jacob Keller) [Orabug: 38494752] {CVE-2025-39901}
- idpf: set mac type when adding and removing MAC filters (Emil Tantilov)
- ice: fix NULL access of tx->in_use in ice_ll_ts_intr (Jacob Keller) [Orabug: 38456820] {CVE-2025-39854}
- net: mctp: mctp_fraq_queue should take ownership of passed skb (Jeremy Kerr)
- net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() (Liu Jian)
- macsec: read MACSEC_SA_ATTR_PN with nla_get_uint (Sabrina Dubroca)
- net: macb: Fix tx_ptr_lock locking (Sean Anderson)
- icmp: fix icmp_ndo_send address translation for reply direction (Fabian Bläse)
- bnxt_en: fix incorrect page count in RX aggr ring log (Alok Tiwari)
- selftests: drv-net: csum: fix interface name for remote host (Jakub Kicinski)
- mISDN: Fix memory leak in dsp_hwec_enable() (Miaoqian Lin)
- xirc2ps_cs: fix register access when enabling FullDuplex (Alok Tiwari)
- net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (Eric Dumazet) [Orabug: 38494749] {CVE-2025-39900}
- netfilter: nft_flowtable.sh: re-run with random mtu sizes (Florian Westphal)
- Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (Kuniyuki Iwashima) [Orabug: 38456832] {CVE-2025-39860}
- Bluetooth: vhci: Prevent use-after-free by removing debugfs files early (Ivan Pravdin) [Orabug: 38456841] {CVE-2025-39861}
- wifi: iwlwifi: uefi: check DSM item validity (Johannes Berg)
- netfilter: conntrack: helper: Replace -EEXIST by -EBUSY (Phil Sutter)
- netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (Wang Liang) [Orabug: 38494729] {CVE-2025-39894}
- wifi: mt76: fix linked list corruption (Felix Fietkau) [Orabug: 38494807] {CVE-2025-39918}
- wifi: mt76: free pending offchannel tx frames on wcid cleanup (Felix Fietkau)
- wifi: mt76: prevent non-offchannel mgmt tx during scan/roc (Felix Fietkau)
- wifi: mt76: mt7925: fix locking in mt7925_change_vif_links() (Harshit Mogalapalli)
- wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work (Duoming Zhou) [Orabug: 38456848] {CVE-2025-39863}
- wifi: cfg80211: fix use-after-free in cmp_bss() (Dmitry Antipov) [Orabug: 38456857] {CVE-2025-39864}
- mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up (Sai Krishna Potthuri)
- mmc: sdhci-of-arasan: Support for emmc hardware reset (Paul Alvin)
- LoongArch: vDSO: Remove -nostdlib complier flag (Guan Wentao)
- LoongArch: vDSO: Remove --hash-style=sysv (Xi Ruoyao)
- net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FE990A name (Fabio Porcedda)
- net: usb: qmi_wwan: fix Telit Cinterion FN990A name (Fabio Porcedda)
- HID: core: Harden s32ton() against conversion to 0 bits (Alan Stern) [Orabug: 38334902] {CVE-2025-38556}
- HID: stop exporting hid_snto32() (Dmitry Torokhov)
- HID: simplify snto32() (Dmitry Torokhov)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC (Marek Vasut)
- arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM (Marek Vasut)
- arm64: dts: imx8mp-tqma8mpql: fix LDO5 power off (Markus Niebel)
- tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" (Sungbae Yoo)
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro (Peter Robinson)
- tee: fix memory leak in tee_dyn_shm_alloc_helper (Pei Xiao)
- tee: fix NULL pointer dereference in tee_shm_put (Pei Xiao) [Orabug: 38456864] {CVE-2025-39865}
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue) [Orabug: 38456869] {CVE-2025-39866}
- btrfs: zoned: skip ZONE FINISH of conventional zones (Johannes Thumshirn)
- Bluetooth: hci_sync: Avoid adding default advertising on startup (Yang Li)
- cpupower: Fix a bug where the -t option of the set subcommand was not working. (Shinji Nomoto)
- drm/amd/display: Don't warn when missing DCE encoder caps (Timur Kristóf)
- cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN (Lubomir Rintel)
- LoongArch: Save LBT before FPU in setup_sigcontext() (Huacai Chen)
- btrfs: avoid load/store tearing races when checking if an inode was logged (Filipe Manana)
- btrfs: fix race between setting last_dir_index_offset and inode logging (Filipe Manana)
- btrfs: fix race between logging inode and checking if it was logged before (Filipe Manana)
- bpf: Fix oob access in cgroup local storage (Daniel Borkmann) [Orabug: 38324116] {CVE-2025-38502}
- bpf: Move cgroup iterator helpers to bpf.h (Daniel Borkmann)
- bpf: Move bpf map owner out of common struct (Daniel Borkmann)
- bpf: Add cookie object to bpf maps (Daniel Borkmann)
- LTS version: v6.12.45 (Harshit Mogalapalli)
- thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their sizes to driver data (Mason-Cw Chang)
- thermal/drivers/mediatek/lvts_thermal: Change lvts commands array to static const (Mason-Cw Chang)
- Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" (Imre Deak)
- PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up (Niklas Cassel)
- PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS (Niklas Cassel)
- net: rose: fix a typo in rose_clear_routes() (Eric Dumazet)
- drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode (Yang Wang)
- drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv (Ma Ke)
- drm/nouveau: fix error path in nvkm_gsp_fwsec_v2 (Timur Tabi)
- drm/nouveau/disp: Always accept linear modifier (James Jones)
- drm/xe/vm: Clear the scratch_pt pointer on error (Thomas Hellström)
- xfs: do not propagate ENODATA disk errors into xattr code (Eric Sandeen) [Orabug: 38440384] {CVE-2025-39835}
- smb3 client: fix return code mapping of remap_file_range (Steve French)
- net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
- fs/smb: Fix inconsistent refcnt update (Shuhao Fu) [Orabug: 38440283] {CVE-2025-39819}
- dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted (Shanker Donthineni)
- blk-zoned: Fix a lockdep complaint about recursive locking (Bart Van Assche)
- HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [Orabug: 38440226] {CVE-2025-39808}
- HID: wacom: Add a new Art Pen 2 (Ping Cheng)
- HID: logitech: Add ids for G PRO 2 LIGHTSPEED (Matt Coffin)
- HID: quirks: add support for Legion Go dual dinput modes (Antheas Kapenekakis)
- HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (Qasim Ijaz) [Orabug: 38440221] {CVE-2025-39806}
- HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [Orabug: 38440308] {CVE-2025-39824}
- x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON (K Prateek Nayak)
- x86/microcode/AMD: Handle the case of no BIOS microcode (Borislav Petkov)
- RISC-V: KVM: fix stack overrun when loading vlenb (Radim Krčmář)
- net: macb: Disable clocks once (Neil Mandir)
- efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [Orabug: 38440275] {CVE-2025-39817}
- fbnic: Move phylink resume out of service_task and into open/close (Alexander Duyck)
- l2tp: do not use sock_hold() in pppol2tp_session_get_sock() (Eric Dumazet)
- sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [Orabug: 38440248] {CVE-2025-39812}
- net: rose: include node references in rose_neigh refcount (Takamitsu Iwai)
- net: rose: convert 'use' field to refcount_t (Takamitsu Iwai)
- net: rose: split remove and free operations in rose_remove_neigh() (Takamitsu Iwai)
- net: hv_netvsc: fix loss of early receive events from host during channel open. (Dipayaan Roy)
- hv_netvsc: Link queues to NAPIs (Joe Damato)
- net: stmmac: Set CIC bit only for TX queues with COE (Rohan G Thomas)
- net: stmmac: xgmac: Correct supported speed modes (Rohan G Thomas)
- net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts (Rohan G Thomas)
- net/mlx5e: Set local Xoff after FW update (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon port speed set (Alexei Lazar)
- net/mlx5e: Update and set Xon/Xoff upon MTU set (Alexei Lazar)
- net/mlx5: Nack sync reset when SFs are present (Moshe Shemesh)
- net/mlx5: Fix lockdep assertion on sync reset unload event (Moshe Shemesh) [Orabug: 38440365] {CVE-2025-39832}
- net/mlx5: Reload auxiliary drivers on fw_activate (Moshe Shemesh)
- bnxt_en: Fix stats context reservation logic (Michael Chan)
- bnxt_en: Adjust TX rings if reservation is less than requested (Michael Chan)
- bnxt_en: Fix memory corruption when FW resources change during ifdown (Sreekanth Reddy) [Orabug: 38440239] {CVE-2025-39810}
- phy: mscc: Fix when PTP clock is register and unregister (Horatiu Vultur)
- drm/xe: Don't trigger rebind on initial dma-buf validation (Matthew Brost)
- drm/xe/xe_sync: avoid race during ufence signaling (Kempczynski Zbigniew)
- efi: stmm: Fix incorrect buffer allocation method (Jan Kiszka)
- net: dlink: fix multicast stats being counted incorrectly (Moon Yeounsu)
- dt-bindings: display/msm: qcom,mdp5: drop lut clock (Dmitry Baryshkov)
- ice: fix incorrect counter for buffer allocation failures (Michal Kubiak)
- ice: use fixed adapter index for E825C embedded devices (Jacob Keller)
- ice: don't leave device non-functional if Tx scheduler config fails (Jacob Keller)
- drm/nouveau: remove unused memory target test (Timur Tabi)
- drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr (Timur Tabi)
- atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [Orabug: 38440344] {CVE-2025-39828}
- Bluetooth: hci_sync: fix set_local_name race condition (Pavel Shpakovskiy)
- Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced (Luiz Augusto von Dentz)
- Bluetooth: hci_event: Mark connection as closed during suspend disconnect (Ludovico de Nittis)
- Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success (Ludovico de Nittis)
- net: macb: fix unregister_netdev call order in macb_remove() (Luoguangfei) [Orabug: 38440218] {CVE-2025-39805}
- HID: input: report battery status changes immediately (José Expósito)
- HID: input: rename hidinput_set_battery_charge_status() (José Expósito)
- powerpc/kvm: Fix ifdef to remove build warning (Madhavan Srinivasan)
- drm/msm: update the high bitfield of certain DSI registers (Ayushi Makhija)
- drm/msm/kms: move snapshot init earlier in KMS init (Dmitry Baryshkov)
- of: reserved_mem: Restructure call site for dma_contiguous_early_fixup() (Oreoluwa Babatunde)
- drm/msm: Defer fd_install in SUBMIT ioctl (Rob Clark)
- vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() (Nikolay Kuratov)
- ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list (Werner Sembach)
- erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC (Junli Liu)
- ASoC: codecs: tx-macro: correct tx_macro_component_drv name (Alexey Klimov)
- smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [Orabug: 38440315] {CVE-2025-39825}
- smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara)
- scsi: core: sysfs: Correct sysfs attributes access rights (Damien Le Moal)
- ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [Orabug: 38440257] {CVE-2025-39813}
- of: dynamic: Fix use after free in of_changeset_add_prop_helper() (Dan Carpenter)
- mips: lantiq: xway: sysctrl: rename the etop node (Aleksander Jan Bajkowski)
- mips: dts: lantiq: danube: add missing burst length property (Aleksander Jan Bajkowski)
- pinctrl: STMFX: add missing HAS_IOMEM dependency (Randy Dunlap)
- of: dynamic: Fix memleak when of_pci_add_properties() failed (Lizhi Hou)
- trace/fgraph: Fix the warning caused by missing unregister notifier (Ye Weihua) [Orabug: 38440352] {CVE-2025-39829}
- rtla: Check pkg-config install (Tao Chen)
- tools/latency-collector: Check pkg-config install (Tao Chen)
- LTS version: v6.12.44 (Harshit Mogalapalli)
- alloc_fdtable(): change calling conventions. (Al Viro)
- netfilter: nf_reject: don't leak dst refcount for loopback packets (Florian Westphal) [Orabug: 38401479] {CVE-2025-38732}
- s390/hypfs: Enable limited access during lockdown (Peter Oberparleiter)
- s390/hypfs: Avoid unnecessary ioctl registration in debugfs (Peter Oberparleiter)
- ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation (Takashi Iwai)
- net/mlx5e: Preserve shared buffer capacity during headroom updates (Armen Ratner)
- net/mlx5e: Query FW for buffer ownership (Alexei Lazar)
- net/mlx5: Add IFC bits and enums for buf_ownership (Oren Sidi)
- net/mlx5: Relocate function declarations from port.h to mlx5_core.h (Shahar Shitrit)
- net/mlx5: Base ECVF devlink port attrs from 0 (Daniel Jurgens)
- Octeontx2-af: Skip overlap check for SPI field (Hariprasad Kelam)
- bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU (Hangbin Liu)
- bonding: update LACP activity flag after setting lacp_active (Hangbin Liu)
- ALSA: timer: fix ida_free call while not allocated (Dewei Meng) [Orabug: 38423453] {CVE-2025-39765}
- net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate (William Liu)
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (William Liu) [Orabug: 38423455] {CVE-2025-39766}
- net: dsa: microchip: Fix KSZ9477 HSR port setup issue (Tristram Ha)
- ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc (Jason Xing)
- s390/mm: Do not map lowcore with identity mapping (Heiko Carstens)
- LoongArch: Optimize module load time by optimizing PLT/GOT counting (Kanglong Wang)
- microchip: lan865x: fix missing Timer Increment config for Rev.B0/B1 (Parthiban Veerasooran)
- microchip: lan865x: fix missing netif_start_queue() call on device open (Parthiban Veerasooran)
- net/smc: fix UAF on smcsk after smc_listen_out() (D. Wythe)
- gve: prevent ethtool ops after shutdown (Jordan Rhee) [Orabug: 38401491] {CVE-2025-38735}
- phy: mscc: Fix timestamping for vsc8584 (Horatiu Vultur)
- cifs: Fix oops due to uninitialised variable (David Howells) [Orabug: 38401496] {CVE-2025-38737}
- net: ti: icssg-prueth: Fix HSR and switch offload Enablement during firwmare reload. (Md Danish Anwar)
- ppp: fix race conditions in ppp_fill_forward_path (Qingfang Deng) [Orabug: 38401498] {CVE-2025-39673}
- net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path (Qingfang Deng)
- ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add (Heminhong)
- net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM (Jakub Ramaseuski) [Orabug: 38423463] {CVE-2025-39770}
- drm/amd/display: Don't print errors for nonexistent connectors (Timur Kristóf)
- drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() (Chenyuan Yang) [Orabug: 38401506] {CVE-2025-39675}
- drm/hisilicon/hibmc: fix the hibmc loaded failed bug (Baihan Li) [Orabug: 38423472] {CVE-2025-39772}
- drm/hisilicon/hibmc: fix the i2c device resource leak when vdac init failed (Baihan Li)
- drm/hisilicon/hibmc: refactored struct hibmc_drm_private (Baihan Li)
- rust: alloc: fix `rusttest` by providing `Cmalloc::aligned_layout` too (Miguel Ojeda)
- mlxsw: spectrum: Forward packets with an IPv4 link-local source IP (Ido Schimmel)
- iommu/amd: Avoid stack buffer overflow from kernel cmdline (Kees Cook) [Orabug: 38360924] {CVE-2025-38676}
- scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [Orabug: 38401511] {CVE-2025-39676}
- rtase: Fix Rx descriptor CRC error bit definition (Justin Lai)
- net: bridge: fix soft lockup in br_multicast_query_expired() (Wang Liang) [Orabug: 38423477] {CVE-2025-39773}
- net: xilinx: axienet: Fix RX skb ring management in DMAengine mode (Suraj Gupta)
- RDMA/hns: Fix dip entries leak on devices newer than hip09 (Junxian Huang)
- RDMA/bnxt_re: Fix to initialize the PBL array (Anantha Prabhu)
- RDMA/bnxt_re: Fix a possible memory leak in the driver (Kalesh Ap)
- RDMA/bnxt_re: Fix to remove workload check in SRQ limit path (Kashyap Desai)
- RDMA/bnxt_re: Fix to do SRQ armena by default (Kashyap Desai)
- RDMA/hns: Fix querying wrong SCC context for DIP algorithm (Wenglianfa)
- RDMA/erdma: Fix ignored return value of init_kernel_qp (Boshi Yu)
- rust: alloc: replace aligned_size() with Kmalloc::aligned_layout() (Danilo Krummrich)
- iosys-map: Fix undefined behavior in iosys_map_clear() (Gote, Nitin R)
- drm/tests: Fix drm_test_fb_xrgb8888_to_xrgb2101010() on big-endian (José Expósito)
- drm/tests: Do not use drm_fb_blit() in format-helper tests (Thomas Zimmermann)
- drm/format-helper: Add generic conversion to 32-bit formats (Thomas Zimmermann)
- drm/format-helper: Move helpers for pixel conversion to header file (Thomas Zimmermann)
- drm/format-helper: Add conversion from XRGB8888 to BGR888 (Kerem Karabay)
- drm/panic: Move drawing functions to drm_draw (Jocelyn Falempe)
- drm/tests: Fix endian warning (José Expósito)
- cgroup/cpuset: Fix a partition error with CPU hotplug (Waiman Long)
- cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key (Waiman Long)
- drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor(). (Fanhua Li) [Orabug: 38401536] {CVE-2025-39679}
- spi: spi-fsl-lpspi: Clamp too high speed_hz (Stefan Wahren)
- x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (Tianxiang Peng) [Orabug: 38401540] {CVE-2025-39681}
- iio: imu: inv_icm42600: change invalid data error to -EBUSY (Jean-Baptiste Maneyrol)
- iio: imu: inv_icm42600: Convert to uXX and sXX integer types (Andy Shevchenko)
- iio: imu: inv_icm42600: use = { } instead of memset() (David Lechner)
- iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 (Jonathan Cameron)
- powerpc/boot: Fix build with gcc 15 (Michal Suchanek)
- ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp() (Neil Brown)
- drm/i915/icl+/tc: Cache the max lane count value (Imre Deak)
- compiler: remove __ADDRESSABLE_ASM{_STR,}() again (Jan Beulich)
- drm/i915/icl+/tc: Convert AUX powered WARN to a debug message (Imre Deak)
- tracing: Limit access to parser->buffer when trace_get_user failed (Pu Lehui) [Orabug: 38401545] {CVE-2025-39683}
- tracing: Remove unneeded goto out logic (Steven Rostedt)
- iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() (David Lechner)
- iio: light: as73211: Ensure buffer holes are zeroed (Jonathan Cameron)
- iio: light: Use aligned_s64 instead of open coding alignment. (Jonathan Cameron)
- usb: dwc3: pci: add support for the Intel Wildcat Lake (Krogerus Heikki)
- usb: dwc3: Remove WARN_ON for device endpoint command timeouts (Selvarasu Ganesan)
- usb: dwc3: Ignore late xferNotReady event to prevent halt timeout (Kuen-Han Tsai)
- usb: xhci: Fix slot_id resource race conflict (Weitao Wang)
- usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean (Amit Sunil Dhamne)
- usb: typec: maxim_contaminant: disable low power mode when reading comparator values (Amit Sunil Dhamne)
- USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles (Zenm Chen)
- usb: storage: realtek_cr: Use correct byte order for bcs->Residue (Thorsten Blum)
- USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera (Mael Guerin)
- usb: renesas-xhci: Fix External ROM access timeouts (Marek Vasut)
- usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test (Xu Yang)
- comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() (Ian Abbott)
- comedi: pcl726: Prevent invalid irq number (Edward Adam Davis)
- comedi: Make insn_rw_emulate_bits() do insn->n samples (Ian Abbott)
- usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive (Miao Li)
- cdx: Fix off-by-one error in cdx_rpmsg_probe() (Thorsten Blum)
- kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq() (Sebastian Andrzej Siewior)
- most: core: Drop device reference after usage in get_channel() (Miaoqian Lin)
- iio: proximity: isl29501: fix buffered read on big-endian systems (David Lechner)
- iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() (Salah Triki)
- ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [Orabug: 38401577] {CVE-2025-39689}
- fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() (Xu Yilun)
- mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1 (Judith Mendez)
- drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS (Imre Deak)
- cpuidle: governors: menu: Avoid selecting states with too much latency (Rafael J. Wysocki)
- cpuidle: menu: Remove iowait influence (Christian Loehle)
- use uniform permission checks for all mount propagation changes (Al Viro)
- fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [Orabug: 38401585] {CVE-2025-39691}
- smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() (Stefan Metzmacher)
- debugfs: fix mount options not being applied (Charalampos Mitrodimas)
- arm64: dts: ti: k3-am62*: Move eMMC pinmux to top level board file (Judith Mendez)
- arm64: dts: ti: k3-am6*: Remove disable-wp for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am62*: Add non-removable flag for eMMC (Judith Mendez)
- arm64: dts: ti: k3-am6*: Add boot phase flag to support MMC boot (Judith Mendez)
- btrfs: subpage: keep TOWRITE tag until folio is cleaned (Naohiro Aota) [Orabug: 38423491] {CVE-2025-39779}
- ext4: preserve SB_I_VERSION on remount (Baokun Li)
- scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems (Ranjan Kumar)
- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (Ranjan Kumar)
- iio: adc: ad7173: fix setting ODR in probe (David Lechner)
- PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining (Geraldo Nascimento)
- PCI: rockchip: Use standard PCIe definitions (Geraldo Nascimento)
- PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features (Richard Zhu)
- PCI: imx6: Add i.MX8Q PCIe Endpoint (EP) support (Frank Li)
- Mark xe driver as BROKEN if kernel page size is not 4kB (Simon Richter)
- mptcp: disable add_addr retransmission when timeout is 0 (Geliang Tang)
- mptcp: remove duplicate sk_reset_timer call (Geliang Tang)
- soc: qcom: mdt_loader: Fix error return values in mdt_header_valid() (Dan Carpenter)
- scsi: core: Fix command pass through retry regression (Mike Christie)
- drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs (Timur Kristóf)
- drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. (Timur Kristóf)
- drm/amd/display: Fix Xorg desktop unresponsive on Replay panel (Tom Chung)
- drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 (Timur Kristóf)
- drm/amd/display: Don't overclock DCE 6 by 15% (Timur Kristóf)
- drm/amd/display: Avoid a NULL pointer dereference (Mario Limonciello) [Orabug: 38401594] {CVE-2025-39693}
- drm/amdgpu/swm14: Update power limit logic (Alex Deucher)
- accel/habanalabs/gaudi2: Use kvfree() for memory allocated with kvcalloc() (Thorsten Blum)
- kvm: retry nx_huge_page_recovery_thread creation (Keith Busch)
- platform/x86/intel-uncore-freq: Check write blocked for ELC (Srinivas Pandruvada)
- s390/sclp: Fix SCCB present check (Peter Oberparleiter)
- RDMA/rxe: Flush delayed SKBs while releasing RXE resources (Zhu Yanjun) [Orabug: 38401605] {CVE-2025-39695}
- ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 (Evgeniy Harchenko)
- mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn (Tu Jinjiang)
- mm/debug_vm_pgtable: clear page table entries at destroy_args() (Herton Ronaldo Krzesinski)
- NFS: Fix a race when updating an existing write (Trond Myklebust) [Orabug: 38401608] {CVE-2025-39697}
- mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency (Victor Shih)
- mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER (Victor Shih)
- memstick: Fix deadlock by moving removing flag earlier (Jiayi Li)
- mmc: sdhci-pci-gli: Add a new function to simplify the code (Victor Shih)
- iommu/arm-smmu-v3: Fix smmu_domain->nr_ats_masters decrement (Nicolin Chen)
- iov_iter: iterate_folioq: fix handling of offset >= folio size (Dominique Martinet)
- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe) [Orabug: 38401614] {CVE-2025-39698}
- sched_ext: initialize built-in idle state before ops.init() (Andrea Righi)
- ata: libata-scsi: Return aborted command when missing sense and result TF (Damien Le Moal)
- io_uring/net: commit partial buffers on retry (Jens Axboe) [Orabug: 38395103] {CVE-2025-38730}
- netfs: Fix unbuffered write error handling (David Howells) [Orabug: 38401724] {CVE-2025-39723}
- btrfs: send: make fs_path_len() inline and constify its argument (Filipe Manana)
- btrfs: send: use fallocate for hole punching with send stream v2 (Filipe Manana)
- btrfs: send: avoid path allocation for the current inode when issuing commands (Filipe Manana)
- btrfs: send: keep the current inode's path cached (Filipe Manana)
- btrfs: send: add and use helper to rename current inode when processing refs (Filipe Manana)
- btrfs: send: only use boolean variables at process_recorded_refs() (Filipe Manana)
- btrfs: send: factor out common logic when sending xattrs (Filipe Manana)
- xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags (Christoph Hellwig)
- btrfs: zoned: requeue to unused block group list if zone finish failed (Naohiro Aota)
- btrfs: codify pattern for adding block_group to bg_list (Boris Burkov)
- btrfs: explicitly ref count block_group on new_bgs list (Boris Burkov)
- btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() (Filipe Manana) [Orabug: 38434999] {CVE-2025-39800}
- btrfs: always abort transaction on failure to add block group to free space tree (Filipe Manana)
- btrfs: move transaction aborts to the error site in add_block_group_free_space() (David Sterba)
- btrfs: qgroup: fix race between quota disable and quota rescan ioctl (Filipe Manana) [Orabug: 38423413] {CVE-2025-39759}
- btrfs: qgroup: drop unused parameter fs_info from __del_qgroup_rb() (David Sterba)
- usb: typec: fusb302: cache PD RX state (Sebastian Reichel)
- USB: typec: Use str_enable_disable-like helpers (Krzysztof Kozlowski)
- x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero (Tom Lendacky)
- mm/damon/ops-common: ignore migration request to invalid nodes (Seongjae Park) [Orabug: 38401618] {CVE-2025-39700}
- selftests: mptcp: pm: check flush doesn't reset limits (Matthieu Baerts)
- mptcp: pm: kernel: flush: do not reset ADD_ADDR limit (Matthieu Baerts)
- mptcp: drop skb if MPTCP skb extension allocation fails (Christoph Paasch)
- ACPI: pfr_update: Fix the driver update version check (Chen Yu)
- ipv6: sr: Fix MAC comparison to be constant-time (Eric Biggers)
- sched/ext: Fix invalid task state transitions on class switch (Andrea Righi) [Orabug: 38423494] {CVE-2025-39780}
- net, hsr: reject HSR frame if skb can't hold tag (Jakub Acs)
- LoongArch: KVM: Make function kvm_own_lbt() robust (Bibo Mao)
- drm/amd/display: Don't overwrite dce60_clk_mgr (Timur Kristóf)
- drm/amd/display: fix a Null pointer dereference vulnerability (Siyang Liu) [Orabug: 38401635] {CVE-2025-39705}
- drm/amd/display: Add primary plane to commits for correct VRR handling (Michel Dänzer)
- drm/amdkfd: Destroy KFD debugfs after destroy KFD wq (Amber Lin) [Orabug: 38401643] {CVE-2025-39706}
- drm/amdgpu: update mmhub 4.1.0 client id mappings (Alex Deucher)
- drm/amdgpu: update mmhub 3.0.1 client id mappings (Alex Deucher)
- drm/amdgpu: Update external revid for GC v9.5.0 (Lijo Lazar)
- drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram() (Nathan Chancellor)
- drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities (Peter Shkenev) [Orabug: 38401649] {CVE-2025-39707}
- drm/amdgpu: Avoid extra evict-restore process. (Gang Ba)
- drm/amd: Restore cached power limit during resume (Mario Limonciello)
- media: venus: venc: Clamp param smaller than 1fps and bigger than 240 (Ricardo Ribalda)
- media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. (Ricardo Ribalda)
- media: venus: protect against spurious interrupts during probe (Jorge Ramirez-Ortiz)
- media: venus: hfi: explicitly release IRQ during teardown (Jorge Ramirez-Ortiz)
- media: venus: Fix MSM8998 frequency table (Konrad Dybcio)
- media: venus: Add a check for packet size after reading from shared memory (Vedang Nagar)
- media: qcom: camss: cleanup media device allocated resource on error path (Vladimir Zapolskiy)
- media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls (Hans de Goede)
- media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval (Mathis Foerst)
- media: ov2659: Fix memory leaks in ov2659_probe() (Zhang Shurong)
- media: pisp_be: Fix pm_runtime underrun in probe (Jacopo Mondi)
- media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [Orabug: 38401675] {CVE-2025-39713}
- media: usbtv: Lock resolution while streaming (Ludwig Disterhof) [Orabug: 38401682] {CVE-2025-39714}
- media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() (Sakari Ailus)
- media: verisilicon: Fix AV1 decoder clock frequency (Nicolas Dufresne)
- media: vivid: fix wrong pixel_array control size (Hans Verkuil)
- media: ipu6: isys: Use correct pads for xlate_streams() (Sakari Ailus)
- media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (Haoxiang Li)
- media: hi556: correct the test pattern configuration (Bingbu Cao)
- media: gspca: Add bounds checking to firmware parser (Dan Carpenter)
- parisc: Update comments in make_insert_tlb (John David Anglin)
- parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() (John David Anglin)
- parisc: Revise gateway LWS calls to probe user read access (John David Anglin)
- parisc: Revise __get_user() to probe user read access (John David Anglin)
- parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c (John David Anglin)
- parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers (Randy Dunlap)
- parisc: Drop WARN_ON_ONCE() from flush_cache_vmap (John David Anglin)
- parisc: Define and use set_pte_at() (John David Anglin)
- parisc: Check region is readable by user in raw_copy_from_user() (John David Anglin)
- soc/tegra: pmc: Ensure power-domains are in a known state (Jonathan Hunter)
- kbuild: userprogs: use correct linker when mixing clang and GNU ld (Thomas Weißschuh)
- jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [Orabug: 38423507] {CVE-2025-39782}
- f2fs: fix to avoid out-of-boundary access in dnode page (Chao Yu)
- ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in resume context (Muhammad Usama Anjum)
- amdgpu/amdgpu_discovery: increase timeout limit for IFWI init (Xaver Hugl)
- phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence (Kathiravan Thirumoorthy)
- vhost/vsock: Avoid allocating arbitrarily-sized SKBs (Will Deacon)
- vsock/virtio: Validate length in packet header before skb_put() (Will Deacon) [Orabug: 38401705] {CVE-2025-39718}
- PCI: imx6: Delay link start until configfs 'start' written (Richard Zhu)
- PCI: imx6: Remove apps_reset toggling from imx_pcie_{assert/deassert}_core_reset (Richard Zhu)
- PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features (Richard Zhu)
- PCI: endpoint: Fix configfs group removal on driver teardown (Damien Le Moal)
- PCI: endpoint: Fix configfs group list head handling (Damien Le Moal)
- PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge (Lukas Wunner)
- readahead: fix return value of page_cache_next_miss() when no hole is found (Chi Zhiling)
- mtd: rawnand: renesas: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: fsmc: Add missing check after DMA map (Thomas Fourier)
- mtd: spinand: propagate spinand_wait() errors from spinand_write_page() (Gabor Juhos)
- mtd: spi-nor: Fix spi_nor_try_unlock_all() (Michael Walle)
- hwmon: (gsc-hwmon) fix fan pwm setpoint show functions (Tim Harvey)
- pwm: mediatek: Fix duty and period setting (Uwe Kleine-König)
- pwm: mediatek: Handle hardware enable and clock enable separately (Uwe Kleine-König)
- pwm: imx-tpm: Reset counter if CMOD is 0 (Laurentiu Mihalcea)
- wifi: ath11k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath11k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath11k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption when ring is full (Johan Hovold)
- wifi: ath12k: fix source ring-buffer corruption (Johan Hovold)
- wifi: ath12k: fix dest ring-buffer corruption (Johan Hovold)
- wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (Nathan Chancellor)
- iio: adc: ad_sigma_delta: change to buffer predisable (David Lechner)
- iio: imu: bno055: fix OOB access of hw_xlate array (David Lechner)
- zynq_fpga: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- soc: qcom: mdt_loader: Ensure we don't read past the ELF header (Bjorn Andersson) [Orabug: 38423524]
- ata: libata-scsi: Fix CDL control (Igor Pylypiv)
- scsi: ufs: ufs-pci: Fix default runtime and system PM levels (Adrian Hunter)
- scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers (Archana Patni)
- ata: libata-scsi: Fix ata_to_sense_error() status handling (Damien Le Moal)
- scsi: mpi3mr: Fix race between config read submit and interrupt completion (Ranjan Kumar)
- scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (André Draszik)
- scsi: dt-bindings: mediatek,ufs: Add ufs-disable-mcq flag for UFS host (Macpaul Lin)
- dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints (Krzysztof Kozlowski)
- dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints (Krzysztof Kozlowski)
- apparmor: Fix 8-byte alignment for initial dfa blob streams (Helge Deller)
- arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses (Emanuele Ghidoli)
- arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 (Hong Guan)
- arm64: dts: exynos: gs101: ufs: add dma-coherent property (Peter Griffin)
- arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default (Alexander Sverdlin)
- arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support (Judith Mendez)
- btrfs: fix printing of mount info messages for NODATACOW/NODATASUM (Kyoji Ogasawara)
- btrfs: restore mount option info messages during mount (Kyoji Ogasawara)
- btrfs: fix incorrect log message for nobarrier mount option (Kyoji Ogasawara)
- btrfs: zoned: fix write time activation failure for metadata block group (Naohiro Aota)
- ext4: fix hole length calculation overflow in non-extent inodes (Zhang Yi)
- ext4: use kmalloc_array() for array space allocation (Liao Yuanhong)
- ext4: don't try to clear the orphan_present feature block device is r/o (Theodore Ts'O)
- ext4: fix reserved gdt blocks handling in fsmap (Ojaswin Mujoo)
- ext4: fix fsmap end of range reporting with bigalloc (Ojaswin Mujoo)
- ext4: check fast symlink for ea_inode correctly (Andreas Dilger)
- tracing: fprobe-event: Sanitize wildcard for fprobe event name (Masami Hiramatsu)
- ksmbd: fix refcount leak causing resource not released (Ziyan Xu)
- crypto: octeontx2 - Fix address alignment on CN10KB and CN10KA-B0 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment on CN10K A0/A1 and OcteonTX2 (Bharat Bhushan)
- crypto: octeontx2 - Fix address alignment issue on ucode loading (Bharat Bhushan)
- crypto: qat - flush misc workqueue during device shutdown (Giovanni Cabiddu) [Orabug: 38401716] {CVE-2025-39721}
- crypto: caam - Prevent crash on suspend with iMX8QM / iMX8ULP (John Ernberg)
- crypto: qat - lower priority for skcipher and aead algorithms (Giovanni Cabiddu)
- lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap (Eric Biggers)
- vt: defkeymap: Map keycodes above 127 to K_HOLE (Myrrh Periwinkle)
- vt: keyboard: Don't process Unicode characters in K_OFF mode (Myrrh Periwinkle)
- bus: mhi: host: Detect events pointing to unexpected TREs (Youssef Samir) [Orabug: 38423538] {CVE-2025-39790}
- bus: mhi: host: Fix endianness of BHI vector table (Alexander Wilhelm)
- usb: dwc3: imx8mp: fix device leak at unbind (Johan Hovold)
- usb: dwc3: meson-g12a: fix device leaks at unbind (Johan Hovold)
- usb: musb: omap2430: fix device leak at unbind (Johan Hovold)
- usb: gadget: udc: renesas_usb3: fix device leak at unbind (Johan Hovold)
- usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (Nathan Chancellor)
- m68k: Fix lost column on framebuffer debug console (Finn Thain)
- dm: Check for forbidden splitting of zone write operations (Damien Le Moal)
- dm: dm-crypt: Do not partially accept write BIOs with zoned targets (Damien Le Moal) [Orabug: 38423543] {CVE-2025-39791}
- PM: runtime: Take active children into account in pm_runtime_get_if_in_use() (Rafael J. Wysocki)
- platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() (Tzung-Bi Shih)
- cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (Dan Carpenter)
- ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig (Damien Le Moal)
- serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [Orabug: 38401726] {CVE-2025-39724}
-
Tue Sep 23 2025 Sherry Yang <sherry.yang@oracle.com> [6.12.0-105.43.1.el9uek]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38019851]
- net/rds: Enforce sibling ToS lanes are not UP when auto reaping a conn (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: replace rds_conn_addr_list with reentrant code (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Auto-reap dropped conn via sysctl net.rds.conn_reap_after_drop_secs (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Enable tracing for rds_conn_reap() (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Disallow user conn reap via sysctl net.rds.conn_user_reap_enable (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Add sockopt member all_tos to reset/reap all conns for src-dst (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: Reap rds_rdma connections via sockopt RDS_CONN_REAP (Sharath Srinivasan) [Orabug: 38343379]
- net/rds: tracepoints for rds_conn_kref_get and put (Sharath Srinivasan) [Orabug: 38343388]
- net/rds: Add krefs to struct rds_connection (Sharath Srinivasan) [Orabug: 38343388]
- net/mlx5: HWS, fix bad parameter in CQ creation (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5e: Support RX xfrm state selector's UPSPEC for packet offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add pass flow group for IPSec RX status table (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add num_reserved_entries param for ipsec_ft_create() (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Skip IPSec RX policy check for crypto offload (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Move IPSec policy check after decryption (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Change the destination of IPSec RX SA miss rule (Jianbo Liu) [Orabug: 38431789]
- net/mlx5e: Add helper function to update IPSec default destination (Jianbo Liu) [Orabug: 38431789]
- net/mlx5: fs, add counter object to flow destination (Moshe Shemesh) [Orabug: 38431789]
- net/mlx5: DR, moved all the SWS code into a separate directory (Yevgeny Kliteynik) [Orabug: 38431789]
- net/mlx5: hw counters: Remove mlx5_fc_create_ex (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Don't maintain a counter count (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Drop unneeded cacheline alignment (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Replace IDR+lists with xarray (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Use kvmalloc for bulk query buffer (Cosmin Ratiu) [Orabug: 38431789]
- net/mlx5: hw counters: Make fc_stats & fc_pool private (Cosmin Ratiu) [Orabug: 38431789]
- uek: kabi: cleanup x86_64 kabi list for duplicate entries. (Yifei Liu) [Orabug: 38448304]
- KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active (Maciej S. Szmigiero) [Orabug: 38459433]
-
Wed Sep 17 2025 Sherry Yang <sherry.yang@oracle.com> [6.12.0-104.43.4.el9uek]
- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski) [Orabug: 38401543,38453832] {CVE-2025-39682}
-
Tue Sep 16 2025 Sherry Yang <sherry.yang@oracle.com> [6.12.0-104.43.3.el9uek]
- squashfs: fix memory leak in squashfs_fill_super (Phillip Lougher) [Orabug: 38343659]
- drm/mediatek: Add error handling for old state CRTC in atomic_disable (Jason-JH Lin) [Orabug: 38343659]
- net: ipv4: fix regression in local-broadcast routes (Oscar Maes) [Orabug: 38343659]
- net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization (Yuichiro Tsuji) [Orabug: 38401777] {CVE-2025-38736}
- ksmbd: extend the connection limiting mechanism to support IPv6 (Namjae Jeon) [Orabug: 38343659]
- ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [Orabug: 38343659]
- Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" (Helge Deller) [Orabug: 38343659]
- Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() (Sergey Shtylyov) [Orabug: 38343659]
- Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established (Pauli Virtanen) [Orabug: 38343659]
- Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF (Yang Li) [Orabug: 38343659]
- Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown (Jiande Lu) [Orabug: 38343659]
- Bluetooth: hci_sync: Fix scan state after PA Sync has been established (Luiz Augusto von Dentz) [Orabug: 38343659]
- igc: fix disabling L1.2 PCI-E link substate on I226 on init (Valdikss) [Orabug: 38343659]
- drm/amdgpu/discovery: fix fw based ip discovery (Alex Deucher) [Orabug: 38343659]
- Revert "drm/amdgpu: fix incorrect vm flags to map bo" (Alex Deucher) [Orabug: 38343659]
- Revert "can: ti_hecc: fix -Woverflow compiler warning" (Greg Kroah-Hartman) [Orabug: 38343659]
- proc: fix missing pde_set_flags() for net proc files (Zijie Wang) [Orabug: 38343659]
- perf symbol-minimal: Fix ehdr reading in filename__read_build_id (Ian Rogers) [Orabug: 38343659]
- vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER (Namhyung Kim) [Orabug: 38343659]
- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enable the mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf) [Orabug: 38424089]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf) [Orabug: 38424089]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta) [Orabug: 38424089]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta) [Orabug: 38424089]
- uek-rpm: Move ifb module to modules-core (Harshit Mogalapalli) [Orabug: 38435397]
-
Tue Sep 09 2025 Jack Vogel <jack.vogel@oracle.com> [6.12.0-104.43.2.el9uek]
- vhost-scsi: Fix check for inline_sg_cnt exceeding preallocated limit (Alok Tiwari) [Orabug: 38324321]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38327135]
- uek-rpm: Add broken-out hsmp platform drivers (Dave Kleikamp) [Orabug: 38332412]
- crypto: ccp - Add support for PCI device 0x17D8 (John Allen) [Orabug: 38332412]
- x86/CPU/AMD: Add X86_FEATURE_ZEN6 (Yazen Ghannam) [Orabug: 38332412]
- x86/cpufeatures: Free up unused feature bits (Sohil Mehta) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make amd_hsmp and hsmp_acpi as mutually exclusive drivers (Suma Hegde) [Orabug: 38332412]
- x86/amd_node, platform/x86/amd/hsmp: Have HSMP use SMN through AMD_NODE (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Use defines for SMN register offsets (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Remove dependency on AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Update __amd_smn_rw() error paths (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Move SMN access code to a new amd_node driver (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb, hwmon: (k10temp): Simplify amd_pci_dev_to_node_id() (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb: Simplify function 3 search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Use topology info to get AMD node count (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify root device search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify function 4 search (Yazen Ghannam) [Orabug: 38332412]
- x86: Start moving AMD node functionality out of AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Clean up early_is_amd_nb() (Yazen Ghannam) [Orabug: 38332412]
- platform/x86/amd/hsmp: mark hsmp_msg_desc_table[] as maybe_unused (Arnd Bergmann) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make hsmp_pdev static instead of global (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use dev_groups in the driver structure (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use name space while exporting module symbols (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create separate ACPI, plat and common drivers (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Change generic plat_dev name to hsmp_pdev (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move ACPI code to acpi.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move platform device specific code to plat.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move structure and macros to header file (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Convert amd_hsmp_rdwr() to a function pointer (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create wrapper function init_acpi() (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create hsmp/ directory (Suma Hegde) [Orabug: 38332412]
-
Wed Aug 27 2025 Jack Vogel <jack.vogel@oracle.com> [6.12.0-104.43.1.el9uek]
- net/rds: Add support for RDS_CMSG_TOS (Gerd Rausch) [Orabug: 37899646]
- net/rds: Add support RDS_FEATURE ELF notes (Gerd Rausch) [Orabug: 38063326]
- nvme: revert the cross-controller atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: fix atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
- nvme: refactor the atomic write unit detection (Christoph Hellwig) [Orabug: 38318975]
- ACPI: APEI: EINJ: fix potential NULL dereference in __einj_error_inject() (Charles Han) [Orabug: 38343326]
- ACPI: APEI: EINJ: Check if user asked for EINJV2 injection (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix trigger actions (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix check and iounmap of uninitialized pointer p (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix less than zero comparison on a size_t variable (Colin Ian King) [Orabug: 38343326]
- ACPI: APEI: EINJ: prevent memory corruption in error_type_set() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Clean up on error in einj_probe() (Dan Carpenter) [Orabug: 38343326]
- ACPI: APEI: EINJ: Update the documentation for EINJv2 support (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable EINJv2 error injections (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Create debugfs files to enter device id and syndrome (Tony Luck) [Orabug: 38343326]
- ACPI: APEI: EINJ: Discover EINJv2 parameters (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Add einjv2 extension struct (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Enable the discovery of EINJv2 capabilities (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Fix kernel test sparse warnings (Zaid Alali) [Orabug: 38343326]
- ACPI: APEI: EINJ: Remove redundant calls to einj_get_available_error_type() (Zaid Alali) [Orabug: 38343326]
- ACPICA: Logfile: Changes for version 20241212 (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix warnings from PR #295 merge (Saket Dumbre) [Orabug: 38343326]
- ACPICA: Fix typo in comments for SRAT structures (Adam Lackorzynski) [Orabug: 38343326]
- ACPICA: actbl1: Add EINJv2 get error type action (Zaid Alali) [Orabug: 38343326]
- ACPICA: actbl1: Update values to hex to follow ACPI specs (Zaid Alali) [Orabug: 38343326]
- ACPICA: New release 20240927 (Saket Dumbre) [Orabug: 38343326]
- perf vendor events arm64: AmpereOne/AmpereOneX: Mark LD_RETIRED impacted by errata (Ilkka Koskinen) [Orabug: 38343326]
- tracepoint: Print the function symbol when tracepoint_debug is set (Huang Shijie) [Orabug: 38343326]
- firmware: smccc: Support optional Arm SMCCC SOC_ID name (Paul Benoit) [Orabug: 38343326]
- LTS version: v6.12.43 (Jack Vogel)
- ACPI: Return -ENODEV from acpi_parse_spcr() when SPCR support is disabled (Li Chen)
- dm: split write BIOs on zone boundaries when zone append is not emulated (Shin'Ichiro Kawasaki)
- rcu: Fix racy re-initialization of irq_work causing hangs (Frederic Weisbecker)
- drm/amd/display: Allow DCN301 to clear update flags (Ivan Lipski)
- firmware: arm_scmi: Convert to SYSTEM_SLEEP_PM_OPS (Arnd Bergmann)
- io_uring/rw: cast rw->flags assignment to rwf_t (Jens Axboe)
- ata: libata-sata: Add link_power_management_supported sysfs attribute (Damien Le Moal)
- rust: workaround `rustdoc` target modifiers bug (Miguel Ojeda)
- rust: kbuild: clean output before running `rustdoc` (Miguel Ojeda)
- arm64: dts: ti: k3-j722s-evm: Fix USB gpio-hog level for Type-C (Siddharth Vadapalli)
- arm64: dts: ti: k3-j722s-evm: Fix USB2.0_MUX_SEL to select Type-C (Hrushikesh Salunke)
- PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (Lukas Wunner)
- PCI: Allow PCI bridges to go to D3Hot on all non-x86 (Manivannan Sadhasivam)
- PCI: Store all PCIe Supported Link Speeds (Ilpo Järvinen)
- smb: client: fix netns refcount leak after net_passive changes (Wang Zhaolong)
- net: better track kernel sockets lifetime (Eric Dumazet) [Orabug: 37766278] {CVE-2025-21884}
- net: Add net_passive_inc() and net_passive_dec(). (Kuniyuki Iwashima)
- mfd: cros_ec: Separate charge-control probing from USB-PD (Thomas Weißschuh)
- HID: apple: avoid setting up battery timer for devices without battery (Aditya Garg)
- tools/hv: fcopy: Fix irregularities with size of ring buffer (Naman Jain)
- wifi: mac80211: check basic rates validity in sta_link_apply_parameters (Mikhail Lobanov)
- HID: magicmouse: avoid setting up battery timer when not needed (Aditya Garg)
- RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages (Pedro Falcato)
- tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros (Willy Tarreau)
- media: v4l2: Add support for NV12M tiled variants to v4l2_format_info() (Marek Szyprowski)
- media: uvcvideo: Do not mark valid metadata as invalid (Ricardo Ribalda)
- media: venus: Fix OOB read due to missing payload bound check (Vedang Nagar)
- media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394814] {CVE-2025-38680}
- mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock (Breno Leitao)
- mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() (Waiman Long)
- mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() (Anshuman Khandual)
- mm, slab: restore NUMA policy support for large kmalloc (Vlastimil Babka)
- parisc: Makefile: fix a typo in palo.conf (Randy Dunlap)
- hv_netvsc: Fix panic during namespace deletion with VF (Haiyang Zhang) [Orabug: 38394829] {CVE-2025-38683}
- net/sched: ets: use old 'nbands' while purging unused classes (Davide Caratti) [Orabug: 38394835] {CVE-2025-38684}
- fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (Sravan Kumar Gundu) [Orabug: 38394842] {CVE-2025-38685}
- userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry (Suren Baghdasaryan) [Orabug: 38394850] {CVE-2025-38686}
- xfs: fix scrub trace with null pointer in quotacheck (Andrey Albershteyn)
- btrfs: do not allow relocation of partially dropped subvolumes (Qu Wenruo) [Orabug: 38423270] {CVE-2025-39738}
- btrfs: fix iteration bug in __qgroup_excl_accounting() (Boris Burkov)
- btrfs: zoned: do not select metadata BG as finish target (Naohiro Aota)
- btrfs: error on missing block group when unaccounting log tree extent buffers (Filipe Manana)
- btrfs: fix log tree replay failure due to file with 0 links and extents (Filipe Manana)
- btrfs: clear dirty status from extent buffer on error at insert_new_root() (Filipe Manana)
- btrfs: don't skip remaining extrefs if dir not found during log replay (Filipe Manana)
- btrfs: qgroup: fix qgroup create ioctl returning success after quotas disabled (Filipe Manana)
- btrfs: populate otime when logging an inode item (Qu Wenruo)
- btrfs: fix ssd_spread overallocation (Boris Burkov)
- btrfs: don't ignore inode missing when replaying log tree (Filipe Manana)
- btrfs: qgroup: set quota enabled bit if quota disable fails flushing reservations (Filipe Manana)
- btrfs: zoned: do not remove unwritten non-data block group (Naohiro Aota)
- btrfs: abort transaction during log replay if walk_log_tree() failed (Filipe Manana)
- btrfs: zoned: use filesystem size not disk size for reclaim decision (Johannes Thumshirn)
- cdc-acm: fix race between initial clearing halt and open (Oliver Neukum)
- thunderbolt: Fix copy+paste error in match_service_id() (Eric Biggers)
- comedi: fix race between polling and detaching (Ian Abbott)
- usb: typec: ucsi: Update power_supply on power role change (Myrrh Periwinkle)
- misc: rtsx: usb: Ensure mmc child device is active when card is present (Ricky Wu)
- usb: core: config: Prevent OOB read in SS endpoint companion parsing (Xinyu Liu) [Orabug: 38423419] {CVE-2025-39760}
- ext4: initialize superblock fields in the kballoc-test.c kunit tests (Zhang Yi)
- ext4: fix largest free orders lists corruption on mb_optimize_scan switch (Baokun Li)
- ext4: fix zombie groups in average fragment size lists (Baokun Li)
- iommufd: Prevent ALIGN() overflow (Jason Gunthorpe) [Orabug: 38394859] {CVE-2025-38688}
- iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range (Nicolin Chen)
- iommu/arm-smmu-qcom: Add SM6115 MDSS compatible (Alexey Klimov) [Orabug: 38423279] {CVE-2025-39739}
- iommu/vt-d: Optimize iotlb_sync_map for non-caching/non-RWBF modes (Lu Baolu)
- cifs: reset iface weights when we cannot find a candidate (Shyam Prasad N)
- clk: qcom: gcc-ipq8074: fix broken freq table for nss_port6_tx_clk_src (Christian Marangi)
- dm: Always split write BIOs to zoned device limits (Damien Le Moal) [Orabug: 38429172] {CVE-2025-39792}
- block: Introduce bio_needs_zone_write_plugging() (Damien Le Moal)
- mm/damon/core: commit damos->target_nid (Bijan Tabatabai)
- drm/amdgpu: fix incorrect vm flags to map bo (Jack Xiao)
- drm/amdgpu: fix vram reservation issue (Yipeng Chai)
- cifs: Fix collect_sample() to handle any iterator type (David Howells)
- ASoC: fsl_sai: replace regmap_write with regmap_update_bits (Shengjiu Wang)
- scsi: lpfc: Remove redundant assignment to avoid memory leak (Jiasheng Jiang)
- rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe (Meagan Lloyd)
- pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394864] {CVE-2025-38691}
- pNFS: Handle RPC size limit for layoutcommits (Sergey Bashirov)
- pNFS: Fix disk addr range check in block/scsi layout (Sergey Bashirov)
- pNFS: Fix stripe mapping in block/scsi layout (Sergey Bashirov)
- block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (John Garry) [Orabug: 38429189] {CVE-2025-39795}
- ASoC: Intel: avs: Fix uninitialized pointer error in probe() (Cezary Rojewski)
- net: phy: smsc: add proper reset flags for LAN8710A (Csaba Buday)
- ALSA: hda/realtek: add LG gram 16Z90R-A to alc269 fixup table (Thomas Croft)
- lib/sbitmap: convert shallow_depth from one word to the whole sbitmap (Yu Kuai)
- smb: client: don't call init_waitqueue_head(&info->conn_wait) twice in _smbd_get_connection (Stefan Metzmacher)
- tools/power turbostat: Handle cap_get_proc() ENOSYS (Calvin Owens)
- tools/power turbostat: Fix build with musl (Calvin Owens)
- tools/power turbostat: Handle non-root legacy-uncore sysfs permissions (Len Brown)
- ipmi: Fix strcpy source and destination the same (Corey Minyard)
- kconfig: lxdialog: fix 'space' to (de)select options (Yann E. MORIN)
- kconfig: gconf: fix potential memory leak in renderer_edited() (Masahiro Yamada)
- kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() (Masahiro Yamada)
- ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Breno Leitao)
- vfio/mlx5: fix possible overflow in tracking max message size (Artem Sadovnikov)
- scsi: aacraid: Stop using PCI_IRQ_AFFINITY (John Garry)
- scsi: target: core: Generate correct identifiers for PR OUT transport IDs (Maurizio Lombardi)
- scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (Ranjan Kumar)
- kconfig: nconf: Ensure null termination where strncpy is used (Shankari Anand)
- vfio/type1: conditional rescheduling while pinning (Keith Busch)
- kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c (Suchit Karunakaran)
- printk: nbcon: Allow reacquire during panic (John Ogness)
- f2fs: check the generic conditions first (Jaegeuk Kim)
- exfat: add cluster chain loop check for dir (Yuezhang Mo) [Orabug: 38394871] {CVE-2025-38692}
- i2c: Force DLL0945 touchpad i2c freq to 100khz (Fangzhong Zhou)
- apparmor: fix x_table_lookup when stacking is not the first entry (John Johansen)
- apparmor: use the condition in AA_BUG_FMT even with debug disabled (Mateusz Guzik)
- dm-table: fix checking for rq stackable devices (Benjamin Marzinski)
- dm-mpath: don't print the "loaded" message if registering fails (Mikulas Patocka)
- i3c: master: Initialize ret in i3c_i2c_notifier_call() (Jorge Marques)
- i3c: don't fail if GETHDRCAP is unsupported (Wolfram Sang)
- apparmor: shift ouid when mediating hard links in userns (Gabriel Totev)
- rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 (Meagan Lloyd)
- i3c: add missing include to internal header (Wolfram Sang)
- module: Prevent silent truncation of module name in delete_module(2) (Petr Pavlu)
- md: dm-zoned-target: Initialize return variable r to avoid uninitialized use (Purva Yeshi)
- soundwire: Move handle_nested_irq outside of sdw_dev_lock (Charles Keepax)
- soundwire: amd: cancel pending slave status handling workqueue during remove sequence (Vijendar Mukunda)
- soundwire: amd: serialize amd manager resume sequence during pm_prepare (Vijendar Mukunda)
- clk: renesas: rzg2l: Postpone updating priv->clks[] (Claudiu Beznea)
- crypto: ccp - Add missing bootloader info reg for pspv6 (Mario Limonciello)
- crypto: octeontx2 - add timeout for load_fvc completion poll (Bharat Bhushan)
- media: uvcvideo: Fix bandwidth issue for Alcor camera (Chenchangcheng)
- media: uvcvideo: Add quirk for HP Webcam HD 2300 (Ricardo Ribalda)
- media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394878] {CVE-2025-38693}
- media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394885] {CVE-2025-38694}
- media: usb: hdpvr: disable zero-length read messages (Wolfram Sang)
- media: tc358743: Increase FIFO trigger level to 374 (Dave Stevenson)
- media: tc358743: Return an appropriate colorspace from tc358743_set_fmt (Dave Stevenson)
- media: tc358743: Check I2C succeeded during probe (Dave Stevenson)
- pinctrl: stm32: Manage irq affinity settings (Cheick Traore)
- scsi: mpi3mr: Correctly handle ATA device errors (Damien Le Moal)
- scsi: mpt3sas: Correctly handle ATA device errors (Damien Le Moal)
- power: supply: qcom_battmgr: Add lithium-polymer entry (Abel Vesa)
- scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug: 38394892] {CVE-2025-38695}
- scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk (Justin Tee)
- RDMA/core: reduce stack using in nldev_stat_get_doit() (Arnd Bergmann)
- RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423284] {CVE-2025-39742}
- dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs (Amelie Delaunay)
- leds: leds-lp50xx: Handle reg to get correct multi_index (Johan Adolfsson)
- media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control (Niklas Söderlund)
- media: ipu-bridge: Add _HID for OV5670 (Daniel Scally)
- clk: thead: Mark essential bus clocks as CLK_IGNORE_UNUSED (Michal Wilczynski)
- MIPS: lantiq: falcon: sysctrl: fix request memory check logic (Shiji Yang)
- MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh)
- crypto: jitter - fix intermediary handling (Markus Theil)
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (Kalesh Ap)
- media: hi556: Fix reset GPIO timings (Hans de Goede)
- jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte)
- jfs: Regular file corruption check (Edward Adam Davis)
- jfs: truncate good inode pages when hard link is 0 (Lizhi Xu)
- scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394922] {CVE-2025-38699}
- watchdog: iTCO_wdt: Report error if timeout configuration fails (Ziyan Fu)
- MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} (Shiji Yang)
- clk: qcom: ipq5018: keep XO clock always on (George Moussalem)
- hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state (Florin Leotescu)
- watchdog: dw_wdt: Fix default timeout (Sebastian Reichel)
- fs/orangefs: use snprintf() instead of sprintf() (Amir Mohammad Jahangirzad)
- scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated (Showrya M N) [Orabug: 38394929] {CVE-2025-38700}
- phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal (Geraldo Nascimento)
- mfd: axp20x: Set explicit ID for AXP313 regulator (Chen-Yu Tsai)
- clk: tegra: periph: Fix error handling and resolve unsigned compare warning (Pei Xiao)
- ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394935] {CVE-2025-38701}
- crypto: hisilicon/hpre - fix dma unmap sequence (Zhiqi Song)
- fbdev: fix potential buffer overflow in do_register_framebuffer() (Yongzhen Zhang) [Orabug: 38394942] {CVE-2025-38702}
- cifs: Fix calling CIFSFindFirst() for root path without msearch (Pali Rohár)
- watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition (Aaron Plattner)
- drm/amd/display: Disable dsc_power_gate for dcn314 by default (Roman Li)
- drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported (Mario Limonciello)
- drm/amd/display: Only finalize atomic_obj if it was initialized (Mario Limonciello)
- vhost: fail early when __vhost_add_used() fails (Jason Wang)
- vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page (Will Deacon)
- net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 (Álvaro Fernández Rojas)
- rcu: Fix rcu_read_unlock() deadloop due to IRQ work (Joel Fernandes) [Orabug: 38423299] {CVE-2025-39744}
- drm/ttm: Respect the shrinker core free target (Tvrtko Ursulin)
- drm/amd/display: Avoid trying AUX transactions on disconnected ports (Wayne Lin)
- drm/amd/display: Update DMCUB loading sequence for DCN3.5 (Nicholas Kazlauskas)
- selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size (Yonghong Song)
- selftests/bpf: Fix ringbuf/ringbuf_write test failure with arm64 64KB page size (Yonghong Song)
- bpf: Make reg_not_null() true for CONST_PTR_TO_MAP (Ihor Solodrai)
- uapi: in6: restore visibility of most IPv6 socket options (Jakub Kicinski)
- drm/ttm: Should to return the evict error (Emily Deng)
- drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range (Lad Prabhakar)
- net: ncsi: Fix buffer overflow in fetching version id (Hari Kalavakunta)
- drm/xe: Make dma-fences compliant with the safe access rules (Tvrtko Ursulin)
- ionic: clean dbpage in de-init (Shannon Nelson)
- wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() (Thomas Fourier)
- wifi: rtw89: scan abort when assign/unassign_vif (Chih-Kang Chang)
- ptp: Use ratelimite for freerun error message (Breno Leitao)
- bpftool: Fix JSON writer resource leak in version command (Yuan Chen)
- net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent DIS_LEARNING access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 (Álvaro Fernández Rojas)
- net: dsa: b53: ensure BCM5325 PHYs are enabled (Álvaro Fernández Rojas)
- gve: Return error for unknown admin queue command (Alok Tiwari)
- net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs (Gal Pressman)
- net: vlan: Make is_vlan_dev() a stub when VLAN is not configured (Gal Pressman)
- drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual (Mario Limonciello)
- dpaa_eth: don't use fixed_phy_change_carrier (Heiner Kallweit)
- wifi: iwlegacy: Check rate_idx range after addition (Stanislaw Gruszka)
- arm64: stacktrace: Check kretprobe_find_ret_addr() return value (Mark Rutland)
- netmem: fix skb_frag_address_safe with unreadable skbs (Mina Almasry)
- powerpc: floppy: Add missing checks after DMA map (Thomas Fourier)
- wifi: ath12k: Decrement TID on RX peer frag setup error handling (Karthikeyan Kathirvel)
- wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 (Raj Kumar Bhagat)
- wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. (Thomas Fourier)
- wifi: mac80211: update radar_required in channel context after channel switch (Ramya Gnanasekar)
- drm/amd/display: Initialize mode_select to 0 (Alex Hung)
- drm/amd/display: Fix 'failed to blank crtc!' (Wen Chen)
- wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect (Anjaneyulu)
- wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() (Rand Deeb)
- lib: packing: Include necessary headers (Nathan Lynch)
- wifi: ath12k: Fix station association with MBSSID Non-TX BSS (Hari Chandrakanthan)
- wifi: ath12k: Add memset and update default rate value in wmi tx completion (Sarika Sharma)
- wifi: ath10k: shutdown driver when hardware is unreliable (Kang Yang) [Orabug: 38423316] {CVE-2025-39746}
- drm/amd/display: Separate set_gsl from set_gsl_source_select (Ilya Bakoulin)
- net: fec: allow disable coalescing (Jonas Rebmann)
- net: ieee8021q: fix insufficient table-size assertion (Rubenkelevra)
- ACPI: Suppress misleading SPCR console message when SPCR table is absent (Li Chen)
- net: atlantic: add set_power to fw_ops for atl2 to fix wol (Eric Work)
- xfrm: Duplicate SPI Handling (Aakash Kumar S) [Orabug: 38429199] {CVE-2025-39797}
- net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() (Jianrong Zhang)
- net: thunderbolt: Enable end-to-end flow control also in transmit (Jianrong Zhang)
- drm/xe/xe_query: Use separate iterator while filling GT list (Matt Roper)
- kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace (Mark Brown)
- wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch (David Bauer)
- wifi: rtw89: Fix rtw89_mac_power_switch() for USB (Bitterblue Smith)
- drm/imagination: Clear runtime PM errors while resetting the GPU (Alessio Belle)
- perf/arm: Add missing .suppress_bind_attrs (Robin Murphy)
- drm/msm: Add error handling for krealloc in metadata setup (Yuan Chen) [Orabug: 38423323] {CVE-2025-39747}
- drm/msm: use trylock for debugfs (Rob Clark)
- wifi: mac80211: fix rx link assignment for non-MLO stations (Hari Chandrakanthan)
- rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access (Zqiang) [Orabug: 38394958] {CVE-2025-38704}
- ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in __ipv6_dev_mc_inc(). (Kuniyuki Iwashima)
- (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer (Thomas Fourier)
- s390/early: Copy last breaking event address to pt_regs (Heiko Carstens)
- wifi: mac80211: avoid weird state in error path (Miri Korenblit)
- wifi: mac80211: don't complete management TX on SAE commit (Johannes Berg)
- sched/fair: Bump sd->max_newidle_lb_cost when newidle balance fails (Chris Mason)
- net: phy: bcm54811: PHY initialization (Kamil Horák)
- s390/stp: Remove udelay from stp_sync_clock() (Sven Schnelle)
- wifi: iwlwifi: mvm: fix scan request validation (Avraham Stern)
- um: Re-evaluate thread flags repeatedly (Thomas Weißschuh)
- wifi: iwlwifi: mvm: set gtk id also in older FWs (Miri Korenblit)
- bpf: Forget ranges when refining tnum after JSET (Paul Chaignon) [Orabug: 38423330] {CVE-2025-39748}
- sched/deadline: Fix accounting after global limits change (Juri Lelli)
- perf/cxlpmu: Remove unintended newline from IRQ name format string (Alok Tiwari)
- net: phy: micrel: Add ksz9131_resume() (Biju Das)
- net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() (Alok Tiwari)
- net: ipv4: fix incorrect MTU in broadcast routes (Oscar Maes)
- wifi: mac80211: don't unreserve never reserved chanctx (Johannes Berg)
- wifi: cfg80211: Fix interface type validation (Ilan Peer)
- net: mctp: Prevent duplicate binds (Matt Johnston)
- can: ti_hecc: fix -Woverflow compiler warning (Vincent Mailhol)
- drm/amd/display: limit clear_update_flags to dcn32 and above (Charlene Liu)
- rcu: Protect ->defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423339] {CVE-2025-39749}
- drm/amd/pm: fix null pointer access (Umio Yasuno) [Orabug: 38394967] {CVE-2025-38705}
- arm64: Mark kernel as tainted on SAE and SError panic (Breno Leitao)
- net: pcs: xpcs: mask readl() return value to 16 bits (Jack Ping Chng)
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Leon Romanovsky)
- net: ag71xx: Add missing check after DMA map (Thomas Fourier)
- et131x: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB (Bitterblue Smith)
- wifi: rtw89: wow: Add Basic Rate IE to probe request in scheduled scan mode (Chin-Yen Lee)
- idpf: preserve coalescing settings across resets (Ahmed Zaki)
- libbpf: Verify that arena map exists when adding arena relocations (Eduard Zingerman)
- be2net: Use correct byte order and format string for TCP seq and ack_seq (Alok Tiwari)
- s390/time: Use monotonic clock in get_cycles() (Sven Schnelle)
- wifi: cfg80211: reject HTC bit for management frames (Johannes Berg)
- ktest.pl: Prevent recursion of default variable options (Steven Rostedt)
- wifi: ath12k: Correct tid cleanup when tid setup fails (Sarika Sharma)
- net: usb: cdc-ncm: check for filtering capability (Oliver Neukum)
- wifi: iwlwifi: mvm: avoid outdated reorder buffer head_sn (Avraham Stern)
- xen/netfront: Fix TX response spurious interrupts (Anthoine Bourgeois)
- Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() (Zijun Hu)
- Bluetooth: btusb: Add new VID/PID 0489/e14e for MT7925 (En-Wei Wu)
- powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 (Steven Rostedt)
- selftests: netfilter: Enable CONFIG_INET_SCTP_DIAG (Sebastian Andrzej Siewior)
- netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal)
- ASoC: qcom: use drvdata instead of component to keep id (Srinivas Kandagatla)
- ASoC: codecs: rt5640: Retry DEVICE_ID verification (Xinxin Wan)
- iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement (Jonathan Santos)
- ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros (Cristian Ciocaltea)
- ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop (Christophe Leroy)
- ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun) [Orabug: 38423356] {CVE-2025-39751}
- platform/chrome: cros_ec_typec: Defer probe on missing EC parent (Tomasz Michalec)
- platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches (Kees Cook)
- soc: qcom: mdt_loader: Actually use the e_phoff (Bjorn Andersson)
- imx8m-blk-ctrl: set ISI panic write hurry level (Krzysztof Hałasa)
- pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() (Gautham R. Shenoy)
- usb: core: usb_submit_urb: downgrade type check (Oliver Neukum)
- usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present (Tomasz Michalec)
- ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (Peter Ujfalusi) [Orabug: 38394976] {CVE-2025-38706}
- tty: serial: fix print format specifiers (Joseph Tilahun)
- ASoC: SOF: topology: Parse the dapm_widget_tokens in case of DSPless mode (Peter Ujfalusi)
- ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 (Alok Tiwari)
- ASoC: hdac_hdmi: Rate limit logging on connection and disconnection (Mark Brown)
- x86/bugs: Avoid warning when overriding return thunk (Pawan Gupta)
- ALSA: hda: Disable jack polling at shutdown (Takashi Iwai)
- ALSA: hda: Handle the jack polling always via a work (Takashi Iwai)
- platform/chrome: cros_ec_sensorhub: Retries when a sensor is not ready (Gwendal Grignou)
- mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() (Ulf Hansson)
- mei: bus: Check for still connected devices in mei_cl_bus_dev_release() (Hans de Goede)
- char: misc: Fix improper and inaccurate error code returned by misc_init() (Zijun Hu)
- reset: brcmstb: Enable reset drivers for ARCH_BCM2835 (Peter Robinson)
- pps: clients: gpio: fix interrupt handling order in remove path (Eliav Farber)
- selftests: vDSO: vdso_test_getrandom: Always print TAP header (Thomas Weißschuh)
- ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (Breno Leitao)
- mmc: sdhci-msm: Ensure SD card power isn't ON when card removed (Sarthak Garg)
- ACPI: processor: fix acpi_object initialization (Sebastian Ott)
- PM: sleep: console: Fix the black screen issue (Tuhaowen)
- thermal: sysfs: Return ENODATA instead of EAGAIN for reads (Hsin-Te Yuan)
- PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() (Rafael J. Wysocki)
- firmware: tegra: Fix IVC dependency problems (Thierry Reding)
- firmware: arm_scmi: power_control: Ensure SCMI_SYSPOWER_IDLE is set early during resume (Peng Fan)
- ACPI: PRM: Reduce unnecessary printing to avoid user confusion (Zhu Qiyu)
- selftests: tracing: Use mutex_unlock for testing glob filter (Masami Hiramatsu)
- tools/build: Fix s390(x) cross-compilation with clang (Thomas Weißschuh)
- ARM: tegra: Use I/O memcpy to write to IRAM (Aaron Kling)
- gpio: tps65912: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- iio: adc: ad_sigma_delta: don't overallocate scan buffer (David Lechner)
- tools/nolibc: define time_t in terms of __kernel_old_time_t (Thomas Weißschuh)
- thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required (David Collins)
- ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed (Kuninori Morimoto)
- EDAC/synopsys: Clear the ECC counters on init (Shubhrajyoti Datta)
- PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() (Lifeng Zheng)
- ARM: rockchip: fix kernel hang during smp initialization (Alexander Kochetkov)
- cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode (Li Rongqing)
- cpufreq: Exit governor when failed to start old governor (Lifeng Zheng)
- gpio: wcd934x: check the return value of regmap_update_bits() (Bartosz Golaszewski)
- pmdomain: ti: Select PM_GENERIC_DOMAINS (Guillaume La Roque)
- usb: typec: tcpm/tcpci_maxim: fix irq wake usage (André Draszik)
- remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU (Hiago De Franco)
- ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered (Shuai Xue) [Orabug: 38423437] {CVE-2025-39763}
- soc: qcom: rpmh-rsc: Add RSC version 4 support (Maulik Shah)
- usb: xhci: Avoid showing errors during surprise removal (Mario Limonciello)
- usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command (Jay Chen)
- usb: xhci: Avoid showing warnings for dying controller (Mario Limonciello)
- usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default (Benson Leung)
- selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t (Cynthia Huang)
- cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag (Prashant Malani)
- platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list (Mario Limonciello)
- usb: xhci: print xhci->xhc_state when queue_command failed (Su Hui)
- tracefs: Add d_delete to remove negative dentries (Steven Rostedt)
- securityfs: don't pin dentries twice, once is enough... (Al Viro)
- fix locking in efi_secret_unlink() (Al Viro)
- ext2: Handle fiemap on empty files to prevent EINVAL (Wei Gao)
- pidfs: raise SB_I_NODEV and SB_I_NOEXEC (Christian Brauner)
- fs/ntfs3: correctly create symlink for relative path (Rong Zhang)
- fs/ntfs3: Add sanity check for file name (Lizhi Xu)
- ata: libata-sata: Disallow changing LPM state if not supported (Damien Le Moal)
- ata: ahci: Disable DIPM if host lacks support (Damien Le Moal)
- ata: ahci: Disallow LPM policy control if not supported (Damien Le Moal)
- better lockdep annotations for simple_recursive_removal() (Al Viro)
- hfs: fix not erasing deleted b-tree node issue (Viacheslav Dubeyko)
- drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394993] {CVE-2025-38708}
- udf: Verify partition map count (Jan Kara)
- loop: Avoid updating block size under exclusive owner (Jan Kara) [Orabug: 38394999] {CVE-2025-38709}
- gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (Andrew Price) [Orabug: 38423379] {CVE-2025-39753}
- gfs2: Validate i_depth for exhash directories (Andrew Price) [Orabug: 38395006] {CVE-2025-38710}
- nvme-tcp: log TLS handshake failures at error level (Maurizio Lombardi)
- nvme-pci: try function level reset on init failure (Keith Busch)
- smb/server: avoid deadlock when linking with ReplaceIfExists (Neil Brown)
- firmware: arm_ffa: Change initcall level of ffa_init() to rootfs_initcall (Levi Yun)
- arm64: Handle KCOV __init vs inline mismatches (Kees Cook)
- hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa)
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko)
- hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko)
- hfs: fix slab-out-of-bounds in hfs_bnode_read() (Viacheslav Dubeyko)
- hfs: fix general protection fault in hfs_find_init() (Viacheslav Dubeyko)
- net: kcm: Fix race condition in kcm_unattach() (Sven Stegemann)
- tls: handle data disappearing from under the TLS ULP (Jakub Kicinski) [Orabug: 38351758] {CVE-2025-38616}
- ptp: prevent possible ABBA deadlock in ptp_clock_freerun() (Jeongjun Park)
- cpuidle: governors: menu: Avoid using invalid recent intervals data (Rafael J. Wysocki)
- intel_idle: Allow loading ACPI tables for any family (Len Brown)
- sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395056] {CVE-2025-38718}
- net: ti: icss-iep: Fix incorrect type for return value in extts_enable() (Alok Tiwari)
- net: ti: icssg-prueth: Fix emac link speed handling (Md Danish Anwar)
- netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395065] {CVE-2025-38721}
- udp: also consider secpath when evaluating ipsec use for checksumming (Sabrina Dubroca)
- mm/smaps: fix race between smaps_hugetlb_range and migration (Tu Jinjiang) [Orabug: 38423389] {CVE-2025-39754}
- habanalabs: fix UAF in export_dmabuf() (Al Viro)
- KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest (Maxim Levitsky)
- KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs (Maxim Levitsky)
- KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter (Maxim Levitsky)
- KVM: VMX: Extract checking of guest's DEBUGCTL into helper (Sean Christopherson)
- KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported (Sean Christopherson)
- KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag (Sean Christopherson)
- KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (Sean Christopherson)
- smb: client: don't wait for info->send_pending == 0 on error (Stefan Metzmacher)
- smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() (Stefan Metzmacher)
- mm/memory-tier: fix abstract distance calculation overflow (Li Zhijian)
- ACPI: processor: perflib: Move problematic pr->performance check (Rafael J. Wysocki)
- ACPI: processor: perflib: Fix initial _PPC limit application (Jiayi Li)
- Documentation: ACPI: Fix parent device references (Andy Shevchenko)
- eventpoll: Fix semi-unbounded recursion (Jann Horn) [Orabug: 38335160] {CVE-2025-38614}
- fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423395] {CVE-2025-39756}
- fscrypt: Don't use problematic non-inline crypto engines (Eric Biggers)
- clk: samsung: gs101: fix alternate mout_hsi0_usb20_ref parent clock (André Draszik)
- clk: samsung: gs101: fix CLK_DOUT_CMU_G3D_BUSD (André Draszik)
- clk: samsung: exynos850: fix a comment (André Draszik)
- sunvdc: Balance device refcount in vdc_port_mpgroup_check (Ma Ke)
- LoongArch: Avoid in-place string operation on FDT content (Yao Zi)
- LoongArch: Make relocate_new_kernel_size be a .quad value (Huacai Chen)
- LoongArch: Don't use %pK through printk() in unwinder (Thomas Weißschuh)
- LoongArch: BPF: Fix jump offset calculation in tailcall (Haoran Jiang)
- PCI: Extend isolated function probing to LoongArch (Huacai Chen)
- NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug: 38429209] {CVE-2025-39798}
- NFSD: detect mismatch of file handle and delegation stateid in OPEN op (Dai Ngo)
- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395079] {CVE-2025-38724}
- net: usb: asix_devices: add phy_mask for ax88772 mdio bus (Xu Yang) [Orabug: 38395087] {CVE-2025-38725}
- net: dpaa: fix device leak when querying time stamp info (Johan Hovold)
- net: ti: icss-iep: fix device and OF node leaks at probe (Johan Hovold)
- net: mtk_eth_soc: fix device leak at probe (Johan Hovold)
- net: enetc: fix device and OF node leak at probe (Johan Hovold)
- net: gianfar: fix device leak when querying time stamp info (Johan Hovold)
- net: ftgmac100: fix potential NULL pointer access in ftgmac100_phy_disconnect (Heiner Kallweit)
- net: phy: micrel: fix KSZ8081/KSZ8091 cable test (Florian Larysch)
- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38395123] {CVE-2025-38727}
- Revert "leds: trigger: netdev: Configure LED blink interval for HW offload" (Daniel Golle)
- leds: flash: leds-qcom-flash: Fix registry access after re-bind (Krzysztof Kozlowski)
- gpio: mlxbf3: use platform_get_irq_optional() (David Thompson)
- Revert "gpio: mlxbf3: only get IRQ for device instance 0" (David Thompson)
- gpio: mlxbf2: use platform_get_irq_optional() (David Thompson)
- gpio: virtio: Fix config space reading. (Harald Mommer)
- smb: client: remove redundant lstrp update in negotiate protocol (Wang Zhaolong)
- smb3: fix for slab out of bounds on mount to ksmbd (Steve French) [Orabug: 38395093] {CVE-2025-38728}
- ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks (Christopher Eby)
- ALSA: hda/realtek: Fix headset mic on HONOR BRB-X (Vasiliy Kovalev)
- ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423405] {CVE-2025-39757}
- ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395099] {CVE-2025-38729}
- io_uring: don't use int for ABI (Pavel Begunkov)
- LTS version: v6.12.42 (Jack Vogel)
- usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue)
- USB: gadget: f_hid: Fix memory leak in hidg_bind error path (Yuhao Jiang)
- HID: apple: validate feature-report field count to prevent NULL pointer dereference (Qasim Ijaz) [Orabug: 38334911] {CVE-2025-38557}
- media: ti: j721e-csi2rx: fix list_del corruption (Julien Massot)
- perf/arm-ni: Set initial IRQ affinity (Robin Murphy)
- mm: swap: fix potential buffer overflow in setup_clusters() (Kemeng Shi) [Orabug: 38401739] {CVE-2025-39727}
- mm: swap: correctly use maxpages in swapon syscall to avoid potential deadloop (Kemeng Shi)
- mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery (Andy Shevchenko)
- MIPS: mm: tlb-r4k: Uniquify TLB entries on init (Jiaxun Yang)
- s390/mm: Remove possible false-positive warning in pte_free_defer() (Gerald Schaefer)
- x86/fpu: Delay instruction pointer fixup until after warning (Dave Hansen)
- platform/x86/intel/pmt: fix a crashlog NULL pointer access (Michael J. Ruhl) [Orabug: 38334915] {CVE-2025-38559}
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-d1xxx (MB 8A26) (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-s0xxx (Edip Hazuri)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r1xxx (Edip Hazuri)
- ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (Geoffrey D. Bennett)
- ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() (Thorsten Blum)
- x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky) [Orabug: 38334918,38453836] {CVE-2025-38560}
- net: usbnet: Fix the wrong netif_carrier_on() call (Ammar Faizi)
- net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (John Ernberg)
- Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano (Zenm Chen)
- PCI/ASPM: Fix L1SS saving (Ilpo Järvinen)
- PCI/ASPM: Save parent L1SS config in pci_save_aspm_l1ss_state() (Jian-Hong Pan)
- USB: serial: option: add Foxconn T99W709 (Slark Xiao)
- smb: server: Fix extension string in ksmbd_extract_shortname() (Thorsten Blum)
- ksmbd: limit repeated connections from clients with the same IP (Namjae Jeon)
- ksmbd: fix corrupted mtime and ctime in smb2_open (Namjae Jeon)
- ksmbd: fix Preauh_HashValue race condition (Namjae Jeon)
- ksmbd: fix null pointer dereference error in generate_encryptionkey (Namjae Jeon)
- drm/i915/ddi: only call shutdown hooks for valid encoders (Jani Nikula)
- drm/i915/display: add intel_encoder_is_hdmi() (Jani Nikula)
- drm/i915/ddi: gracefully handle errors from intel_ddi_init_hdmi_connector() (Jani Nikula)
- drm/i915/hdmi: add error handling in g4x_hdmi_init() (Jani Nikula)
- drm/i915/hdmi: propagate errors from intel_hdmi_init_connector() (Jani Nikula)
- drm/i915/ddi: change intel_ddi_init_{dp, hdmi}_connector() return type (Jani Nikula)
- selftests/bpf: Fix build error with llvm 19 (Alexei Starovoitov)
- selftests/bpf: Add a test for arena range tree algorithm (Alexei Starovoitov)
- ice/ptp: fix crosstimestamp reporting (Anton Nadezhdin)
- Revert "bcache: remove heap-related macros and switch to generic min_heap" (Kuan-Wei Chiu)
- accel/ivpu: Fix reset_engine debugfs file logic (Andrzej Kacprowski)
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351769,38453833] {CVE-2025-38618}
- net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351762] {CVE-2025-38617}
- selftests/perf_events: Add a mmap() correctness test (Lorenzo Stoakes)
- perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334946] {CVE-2025-38563}
- perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334955] {CVE-2025-38565}
- perf/core: Don't leak AUX buffer refcount on allocation failure (Thomas Gleixner)
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia) [Orabug: 38334966,38453835] {CVE-2025-38566}
- smb: client: return an error if rdma_connect does not return within 5 seconds (Stefan Metzmacher)
- pptp: fix pptp_xmit() error path (Eric Dumazet)
- nvmet: exit debugfs after discovery subsystem exits (Mohamed Khalfella)
- smb: client: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: client: let recv_done() cleanup before notifying the callers. (Stefan Metzmacher)
- smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: client: remove separate empty_packet_queue (Stefan Metzmacher)
- smb: server: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
- smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection (Stefan Metzmacher)
- smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
- smb: server: remove separate empty_recvmsg_queue (Stefan Metzmacher)
- ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() (Takashi Iwai)
- irqchip: Build IMX_MU_MSI only on ARM (Arnd Bergmann)
- eth: fbnic: remove the debugging trick of super high page bias (Jakub Kicinski)
- s390/mm: Allocate page table with PAGE_SIZE granularity (Sumanth Korikkar)
- net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (Maher Azz) [Orabug: 38334972] {CVE-2025-38568}
- benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334974] {CVE-2025-38569}
- x86/irq: Plug vector setup race (Thomas Gleixner)
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [Orabug: 38334980,38453834] {CVE-2025-38571}
- net/sched: taprio: enforce minimum value for picos_per_byte (Takamitsu Iwai)
- net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351784] {CVE-2025-38622}
- net: mdio: mdio-bcm-unimac: Correct rate fallback logic (Florian Fainelli)
- ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334986] {CVE-2025-38572}
- net/mlx5: Correctly set gso_segs when LRO is used (Christoph Paasch)
- spi: cs42l43: Property entry should be a null-terminated array (Simon Trimmer)
- ASoC: tas2781: Fix the wrong step for TLV on tas2781 (Baojun Xu)
- block: ensure discard_granularity is zero when discard is not supported (Christoph Hellwig)
- block: Fix default IO priority if there is no IO context (Guenter Roeck)
- netlink: specs: ethtool: fix module EEPROM input/output arguments (Jakub Kicinski)
- s390/ap: Unmask SLCF bit in card and queue ap functions sysfs (Harald Freudenberger)
- nvmet: initialize discovery subsys after debugfs is initialized (Mohamed Khalfella)
- pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335002] {CVE-2025-38574}
- net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() (Luca Weiss)
- phy: mscc: Fix parsing of unicast frames (Horatiu Vultur)
- netpoll: prevent hanging NAPI when netcons gets enabled (Jakub Kicinski)
- md/md-cluster: handle REMOVE message earlier (Heming Zhao)
- NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY (Benjamin Coddington)
- NFSv4.2: another fix for listxattr (Olga Kornievskaia)
- NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401743] {CVE-2025-39730}
- NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() (Trond Myklebust)
- sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() (Neil Brown)
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Tigran Mkrtchyan)
- PCI: pnv_php: Fix surprise plug detection and recovery (Timothy Pearson)
- powerpc/eeh: Make EEH driver device hotplug safe (Timothy Pearson)
- powerpc/eeh: Export eeh_unfreeze_pe() (Timothy Pearson)
- PCI: pnv_php: Work around switches with broken presence detection (Timothy Pearson)
- PCI: pnv_php: Clean up allocated IRQs on unplug (Timothy Pearson)
- kconfig: qconf: fix ConfigList::updateListAllforAll() (Masahiro Yamada)
- scsi: sd: Make sd shutdown issue START STOP UNIT appropriately (Salomon Dushimirimana)
- scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume (Seunghui Lee)
- scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" (Li Lingfeng)
- scsi: mpt3sas: Fix a fw_event memory leak (Tomas Henzl)
- vfio/pci: Separate SR-IOV VF dev_set (Alex Williamson)
- vfio/pds: Fix missing detach_ioas op (Brett Creeley) [Orabug: 38351809] {CVE-2025-38625}
- vfio: Prevent open_count decrement to negative (Jacob Pan)
- vfio: Fix unbalanced vfio_df_close call in no-iommu mode (Jacob Pan)
- i2c: muxes: mule: Fix an error handling path in mule_i2c_mux_probe() (Christophe Jaillet)
- exfat: fdatasync flag should be same like generic_write_sync() (Zhengxu Zhang)
- f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode (Chao Yu)
- f2fs: fix to calculate dirty data during has_not_enough_free_secs() (Chao Yu)
- f2fs: fix to update upper_p in __get_secs_required() correctly (Chao Yu)
- f2fs: vm_unmap_ram() may be called from an invalid context (Jan Prusakowski)
- f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu)
- f2fs: fix to avoid panic in f2fs_evict_inode (Chao Yu)
- f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu)
- f2fs: doc: fix wrong quota mount option description (Chao Yu)
- f2fs: fix to check upper boundary for gc_no_zoned_gc_percent (Chao Yu)
- f2fs: fix to check upper boundary for gc_valid_thresh_ratio (Chao Yu)
- f2fs: fix to check upper boundary for value of gc_boost_zoned_gc_percent (Yohan Joung)
- f2fs: fix KMSAN uninit-value in extent_info usage (Abinash Singh)
- f2fs: fix bio memleak when committing super block (Sheng Yong)
- f2fs: turn off one_time when forcibly set to foreground GC (Daeho Jeong)
- rtc: rv3028: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: pcf85063: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: nct3018y: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: hym8563: fix incorrect maximum clock rate handling (Brian Masney)
- rtc: ds1307: fix incorrect maximum clock rate handling (Brian Masney)
- ucount: fix atomic_long_inc_below() argument type (Uros Bizjak)
- module: Restore the moduleparam prefix length check (Petr Pavlu)
- apparmor: Fix unaligned memory accesses in KUnit test (Helge Deller)
- apparmor: fix loop detection used in conflicting attachment resolution (Ryan Lee)
- apparmor: ensure WB_HISTORY_SIZE value is a power of 2 (Ryan Lee)
- bpf: Check netfilter ctx accesses are aligned (Paul Chaignon)
- bpf: Check flow_dissector ctx accesses are aligned (Paul Chaignon)
- vhost: Reintroduce kthread API and add mode selection (Cindy Lu)
- vdpa: Fix IDR memory leak in VDUSE module exit (Anders Roxell)
- vdpa/mlx5: Fix release of uninitialized resources on error path (Dragos Tatulea) [Orabug: 38351825] {CVE-2025-38628}
- vdpa/mlx5: Fix needs_teardown flag calculation (Dragos Tatulea)
- perf record: Cache build-ID of hit DSOs only (Namhyung Kim)
- selftests: ALSA: fix memory leak in utimer test (Yuli Wang)
- drm/xe/vf: Disable CSC support on VF (Lukasz Laguna)
- mtd: rawnand: atmel: set pmecc data setup time (Balamanikandan Gunasundar)
- mtd: rawnand: rockchip: Add missing check after DMA map (Thomas Fourier)
- mtd: rawnand: atmel: Fix dma_mapping_error() address (Thomas Fourier)
- jfs: fix metapage reference count leak in dbAllocCtl (Zheng Yu)
- fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (Chenyuan Yang)
- crypto: qat - fix seq_file position update in adf_ring_next() (Giovanni Cabiddu)
- crypto: qat - fix DMA direction for compression on GEN2 devices (Giovanni Cabiddu)
- perf tools: Remove libtraceevent in .gitignore (Chen Pei)
- sh: Do not use hyphen in exported variable name (Ben Hutchings)
- ASoC: fsl_xcvr: get channel status data when PHY is not exists (Shengjiu Wang)
- dmaengine: nbpfaxi: Add missing check after DMA map (Thomas Fourier)
- dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (Thomas Fourier)
- fs/orangefs: Allow 2 more characters in do_c_string() (Dan Carpenter)
- remoteproc: xlnx: Disable unsupported features (Tanmay Shah)
- clk: imx95-blk-ctl: Fix synchronous abort (Laurentiu Palcu)
- PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute (Manivannan Sadhasivam)
- soundwire: stream: restore params when prepare ports fail (Bard Liao)
- crypto: qat - disable ZUC-256 capability for QAT GEN5 (Bairavi Alagappan)
- crypto: img-hash - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: keembay - Fix dma_unmap_sg() nents value (Thomas Fourier)
- hwrng: mtk - handle devm_pm_runtime_enable errors (Ovidiu Panait)
- clk: at91: sam9x7: update pll clk ranges (Varshini Rajendran)
- ext4: Make sure BH_New bit is cleared in ->write_end handler (Jan Kara)
- watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (Dan Carpenter)
- scsi: isci: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: mvsas: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: elx: efct: Fix dma_unmap_sg() nents value (Thomas Fourier)
- scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: sunxi-ng: v3s: Fix de clock definition (Paul Kocialkowski)
- clk: thead: th1520-ap: Correctly refer the parent of osc_12m (Yao Zi)
- RDMA/mana_ib: Fix DSCP value in modify QP (Shiraz Saleem)
- perf tests bp_account: Fix leaked file descriptor (Leo Yan)
- pinmux: fix race causing mux_owner NULL with active mux_usecount (Mukesh Ojha) [Orabug: 38351837] {CVE-2025-38632}
- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (Zijie Wang) [Orabug: 38351898] {CVE-2025-38653}
- kernel: trace: preemptirq_delay_test: use offstack cpu mask (Arnd Bergmann)
- RDMA/hns: Fix -Wframe-larger-than issue (Junxian Huang)
- RDMA/hns: Drop GFP_NOWARN (Junxian Huang)
- RDMA/hns: Fix accessing uninitialized resources (Junxian Huang)
- RDMA/hns: Get message length of ack_req from FW (Junxian Huang)
- crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong)
- crypto: inside-secure - Fix `dma_unmap_sg()` nents value (Thomas Fourier)
- crypto: ccp - Fix locking on alloc failure handling (Alexey Kardashevskiy)
- RDMA/hns: Fix HW configurations not cleared in error flow (Wenglianfa)
- RDMA/hns: Fix double destruction of rsv_qp (Wenglianfa)
- perf sched: Fix memory leaks in 'perf sched latency' (Namhyung Kim)
- perf sched: Use RC_CHK_EQUAL() to compare pointers (Namhyung Kim)
- perf sched: Fix memory leaks for evsel->priv in timehist (Namhyung Kim)
- perf sched: Fix memory leaks in 'perf sched map' (Namhyung Kim)
- perf sched: Free thread->priv using priv_destructor (Namhyung Kim)
- perf sched: Make sure it frees the usage string (Namhyung Kim)
- mtd: spi-nor: spansion: Fixup params->set_4byte_addr_mode for SEMPER (Takahiro Kuwano)
- perf dso: Add missed dso__put to dso__load_kcore (Ian Rogers)
- perf tools: Fix use-after-free in help_unknown_cmd() (Namhyung Kim)
- Fix dma_unmap_sg() nents value (Thomas Fourier)
- clk: clk-axi-clkgen: fix fpfd_max frequency for zynq (Nuno Sa)
- fanotify: sanitize handle_type values when reporting fid (Amir Goldstein)
- phy: qualcomm: phy-qcom-eusb2-repeater: Don't zero-out registers (Luca Weiss)
- dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning (Krzysztof Kozlowski)
- pinctrl: berlin: fix memory leak in berlin_pinctrl_build_state() (Yuan Chen)
- pinctrl: sunxi: Fix memory leak on krealloc failure (Yuan Chen)
- PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails (Jerome Brunet)
- crypto: arm/aes-neonbs - work around gcc-15 warning (Arnd Bergmann)
- power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (Charles Han)
- power: supply: cpcap-charger: Fix null check for power_supply_get_by_name (Charles Han)
- clk: xilinx: vcu: unregister pll_post only if registered correctly (Rohit Visavalia)
- media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check (James Cowgill)
- clk: davinci: Add NULL check in davinci_lpsc_clk_register() (Henry Martin)
- mtd: fix possible integer overflow in erase_xfer() (Ivan Stepchenko)
- crypto: qat - fix state restore for banks with exceptions (Svyatoslav Pankratov)
- crypto: qat - allow enabling VFs in the absence of IOMMU (Ahsan Atta)
- crypto: marvell/cesa - Fix engine load inaccuracy (Herbert Xu)
- crypto: qat - use unmanaged allocation for dc_data (Suman Kumar Chakraborty)
- crypto: sun8i-ce - fix nents passed to dma_unmap_sg() (Ovidiu Panait)
- clk: renesas: rzv2h: Fix missing CLK_SET_RATE_PARENT flag for ddiv clocks (Lad Prabhakar)
- PCI: rockchip-host: Fix "Unexpected Completion" log message (Hans Zhang)
- fortify: Fix incorrect reporting of read buffer size (Kees Cook)
- staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (Kees Cook)
- bpf, arm64: Fix fp initialization for exception boundary (Puranjay Mohan) [Orabug: 38335064] {CVE-2025-38586}
- bpf/preload: Don't select USERMODE_DRIVER (Thomas Weißschuh)
- ipv6: annotate data-races around rt->fib6_nsiblings (Eric Dumazet)
- ipv6: fix possible infinite loop in fib6_info_uses_dev() (Eric Dumazet) [Orabug: 38335068] {CVE-2025-38587}
- ipv6: prevent infinite loop in rt6_nlmsg_size() (Eric Dumazet) [Orabug: 38335071] {CVE-2025-38588}
- vrf: Drop existing dst reference in vrf_ip6_input_dst (Stanislav Fomichev)
- selftests: rtnetlink.sh: remove esp4_offload after test (Xiumei Mu)
- stmmac: xsk: fix negative overflow of budget in zerocopy mode (Jason Xing)
- net: dsa: microchip: Fix wrong rx drop MIB counter for KSZ8863 (Tristram Ha)
- net/mlx5e: Remove skb secpath if xfrm state is not found (Jianbo Liu) [Orabug: 38335076] {CVE-2025-38590}
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Alexei Lazar)
- netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351852] {CVE-2025-38639}
- can: kvaser_usb: Assign netdev.dev_port based on device channel index (Jimmy Assarsson)
- can: kvaser_pciefd: Store device channel index (Jimmy Assarsson)
- can: peak_usb: fix USB FD devices potential malfunction (Stephane Grosjean)
- selftests: drv-net: Fix remote command checking in require_cmd() (Gal Pressman)
- tools/rv: Do not skip idle in trace (Gabriele Monaco)
- bpf: Disable migration in nf_hook_run_bpf(). (Kuniyuki Iwashima) [Orabug: 38351858] {CVE-2025-38640}
- Bluetooth: hci_event: Mask data status from LE ext adv reports (Chris Down)
- Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' (Arseniy Krasnov) [Orabug: 38335086] {CVE-2025-38593}
- memcg_slabinfo: Fix use of PG_slab (Matthew Wilcox)
- kcsan: test: Initialize dummy variable (Marco Elver)
- ring-buffer: Remove ring_buffer_read_prepare_sync() (Steven Rostedt)
- wifi: nl80211: Set num_sub_specs before looping through sub_specs (Kees Cook)
- wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() (Kees Cook)
- wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (Gokul Sivakumar)
- wifi: ath12k: fix endianness handling while accessing wmi service bit (Tamizh Chelvam Raja)
- Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Remi Pommarel)
- wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() (Remi Pommarel)
- wifi: mac80211: Don't call fq_flow_idx() for management frames (Alexander Wetzel)
- wifi: mac80211: Do not schedule stopped TXQs (Alexander Wetzel)
- wifi: plfxlc: Fix error handling in usb driver probe (Murad Masimov)
- wifi: mac80211: reject TDLS operations when station is not associated (Moon Hee Lee) [Orabug: 38351870] {CVE-2025-38644}
- rcu: Fix delayed execution of hurry callbacks (Tze-Nan Wu)
- iommu/amd: Fix geometry.aperture_end for V2 tables (Jason Gunthorpe)
- drm/amdgpu/gfx10: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset (Alex Deucher)
- drm/amdgpu/gfx9: fix kiq locking in KCQ reset (Alex Deucher)
- wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() (Baochen Qiang) [Orabug: 38401750] {CVE-2025-39732}
- mwl8k: Add missing check after DMA map (Thomas Fourier)
- wifi: rtw88: Fix macid assigned to TDLS station (Bitterblue Smith)
- wifi: rtl8xxxu: Fix RX skb size for aggregation disabled (Martin Kaistra)
- tcp: call tcp_measure_rcv_mss() for ooo packets (Eric Dumazet)
- xen/gntdev: remove struct gntdev_copy_batch from stack (Juergen Gross)
- xen: fix UAF in dmabuf_exp_from_pages() (Al Viro)
- RDMA/mlx5: Fix UMR modifying of mkey page size (Edward Srouji)
- net_sched: act_ctinfo: use atomic64_t for three counters (Eric Dumazet)
- net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug: 38331464] {CVE-2025-38553}
- iommu/amd: Enable PASID and ATS capabilities in the correct order (Easwar Hariharan)
- um: rtc: Avoid shadowing err in uml_rtc_start() (Tiwei Bie)
- arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX (Johan Korsnes)
- netfilter: nf_tables: adjust lockdep assertions handling (Fedor Pchelkin)
- netfilter: nf_tables: Drop dead code from fill_*_info routines (Phil Sutter)
- fbcon: Fix outdated registered_fb reference in comment (Shixiong Ou)
- drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (Fedor Pchelkin)
- refscale: Check that nreaders and loops multiplication doesn't overflow (Artem Sadovnikov)
- m68k: Don't unregister boot console needlessly (Finn Thain)
- drm/msm/dpu: Fill in min_prefill_lines for SC8180X (Konrad Dybcio)
- bpf: Ensure RCU lock is held around bpf_prog_ksym_find (Kumar Kartikeya Dwivedi)
- kselftest/arm64: Fix check for setting new VLs in sve-ptrace (Mark Brown)
- net: dst: annotate data-races around dst->output (Eric Dumazet)
- net: dst: annotate data-races around dst->input (Eric Dumazet)
- net/mlx5: Check device memory pointer before usage (Stav Aviram) [Orabug: 38351876] {CVE-2025-38645}
- tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range (Xin Guo)
- wifi: ath11k: clear initialized flag for deinit-ed srng lists (Sergey Senozhatsky) [Orabug: 38335104] {CVE-2025-38601}
- iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335108] {CVE-2025-38602}
- wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (Xiu Jianfeng)
- wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335117] {CVE-2025-38604}
- wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band (Zong-Zhe Yang)
- caif: reduce stack size, again (Arnd Bergmann)
- powerpc/pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add (Haren Myneni)
- bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure (Yuan Chen)
- drm/amdgpu: Remove nbiov7.9 replay count reporting (Lijo Lazar)
- drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel (Ian Forbes)
- net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain (Petr Machata)
- selftests/bpf: Fix unintentional switch case fall through (Mykyta Yatsenko)
- selftests/bpf: fix signedness bug in redir_partial() (Wangfushuai)
- bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335129] {CVE-2025-38608}
- bpf, sockmap: Fix psock incorrectly pointing to sk (Jiayuan Chen)
- drm/panthor: Add missing explicit padding in drm_panthor_gpu_info (Boris Brezillon)
- drm/panfrost: Fix panfrost device variable name in devfreq (Adrián Larumbe)
- drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed (Andy Yan)
- selftests/tracing: Fix false failure of subsystem event test (Steven Rostedt)
- staging: nvec: Fix incorrect null termination of battery manufacturer (Alok Tiwari)
- bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640 (Slark Xiao)
- interconnect: qcom: sc8180x: specify num_nodes (Dmitry Baryshkov)
- interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg (Dmitry Baryshkov)
- soc: qcom: pmic_glink: fix OF node leak (Johan Hovold)
- samples: mei: Fix building on musl libc (Brahmajit Das)
- staging: greybus: gbphy: fix up const issue with the match callback (Greg Kroah-Hartman)
- cpufreq: Init policy->rwsem before it may be possibly used (Lifeng Zheng)
- cpufreq: Initialize cpufreq-based frequency-invariance later (Lifeng Zheng)
- cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode (Rafael J. Wysocki)
- PM / devfreq: Fix a index typo in trans_stat (Chanwoo Choi)
- PM / devfreq: Check governor before using governor->name (Lifeng Zheng) [Orabug: 38335133] {CVE-2025-38609}
- arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed (Adam Ford)
- ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface (Annette Kobou)
- selftests: breakpoints: use suspend_stats to reliably check suspend success (Moon Hee Lee)
- arm64: dts: st: fix timer used for ticks (Patrick Delaunay)
- soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS (Sumit Gupta)
- arm: dts: ti: omap: Fixup pinheader typo (Albin Törnqvist)
- usb: early: xhci-dbc: Fix early_ioremap leak (Lucas De Marchi)
- powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() (Sivan Zohar-Kotzer)
- Revert "vmci: Prevent the dispatching of uninitialized payloads" (Greg Kroah-Hartman)
- selftests: vDSO: chacha: Correctly skip test if necessary (Thomas Weißschuh)
- pps: fix poll support (Denis Osterland-Heim)
- vmci: Prevent the dispatching of uninitialized payloads (Lizhi Xu)
- staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal)
- spi: stm32: Check for cfg availability in stm32_spi_probe (Clément Le Goffic)
- mei: vsc: Unset the event callback on remove and probe errors (Hans de Goede)
- mei: vsc: Event notifier fixes (Hans de Goede)
- mei: vsc: Destroy mutex after freeing the IRQ (Hans de Goede)
- usb: typec: ucsi: yoga-c630: fix error and remove paths (Dmitry Baryshkov)
- firmware: arm_scmi: Fix up turbo frequencies selection (Sibi Sankar)
- cpufreq: armada-8k: make both cpu masks static (Arnd Bergmann)
- arm64: dts: ti: k3-am62p-j722s: fix pinctrl-single size (Michael Walle)
- arm64: dts: ti: k3-am642-phyboard-electra: Fix PRU-ICSSG Ethernet ports (Wadim Egorov)
- usb: misc: apple-mfi-fastcharge: Make power supply names unique (Charalampos Mitrodimas)
- usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() (Seungjin Bae)
- ARM: dts: vfxxx: Correctly use two tuples for timer address (Krzysztof Kozlowski)
- arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely (André Apitzsch)
- arm64: dts: qcom: sa8775p: Correct the interrupt for remoteproc (Lijuan Gao)
- arm64: dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes (Will Deacon)
- arm64: dts: qcom: sc7180: Expand IMEM region (Konrad Dybcio)
- arm64: dts: qcom: sdm845: Expand IMEM region (Konrad Dybcio)
- soc: qcom: QMI encoding/decoding for big endian (Alexander Wilhelm)
- selftests: Fix errno checking in syscall_user_dispatch test (Dmitry Vyukov)
- arm64: dts: freescale: imx93-tqma9352: Limit BUCK2 to 600mV (Alexander Stein)
- ASoC: mediatek: use reserved memory or enable buffer pre-allocation (Chen-Yu Tsai)
- ASoC: ops: dynamically allocate struct snd_ctl_elem_value (Arnd Bergmann)
- ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask() (Kuninori Morimoto)
- io_uring: fix breakage in EXPERT menu (Randy Dunlap)
- gfs2: No more self recovery (Andreas Gruenbacher) [Orabug: 38351907] {CVE-2025-38659}
- Revert "fs/ntfs3: Replace inode_trylock with inode_lock" (Konstantin Komarov)
- hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li)
- hfs: make splice write available again (Yangtao Li)
- hfsplus: make splice write available again (Yangtao Li)
- ublk: use vmalloc for ublk_device's __queues (Caleb Sander)
- fs/ntfs3: cancle set bad inode after removing name fails (Edward Adam Davis)
- fs_context: fix parameter name in infofc() macro (Rubenkelevra)
- parse_longname(): strrchr() expects NUL-terminated string (Al Viro) [Orabug: 38351912] {CVE-2025-38660}
- audit,module: restore audit logging in load failure case (Richard Guy Briggs)
- ASoC: amd: yc: add DMI quirk for ASUS M6501RM (Alexandru Andries)
- ASoC: Intel: fix SND_SOC_SOF dependencies (Arnd Bergmann)
- ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX (Richard Fitzgerald)
- ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx (Adam Queler)
- ethernet: intel: fix building with large NR_CPUS (Arnd Bergmann)
- LTS version: v6.12.41 (Jack Vogel)
- mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma (Liu Shixin)
- KVM: x86: Free vCPUs before freeing VM state (Sean Christopherson)
- Revert "drm/xe/forcewake: Add a helper xe_force_wake_ref_has_domain()" (Tomita Moeko)
- Revert "drm/xe/devcoredump: Update handling of xe_force_wake_get return" (Tomita Moeko)
- Revert "drm/xe/tests/mocs: Update xe_force_wake_get() return handling" (Tomita Moeko)
- Revert "drm/xe/gt: Update handling of xe_force_wake_get return" (Tomita Moeko)
- drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x (Ville Syrjälä)
- ALSA: hda: Add missing NVIDIA HDA codec IDs (Daniel Dadap)
- ALSA: hda/tegra: Add Tegra264 support (Mohan Kumar)
- Drivers: hv: Make the sysfs node size for the ring buffer dynamic (Naman Jain)
- ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS (Nathan Chancellor)
- iio: hid-sensor-prox: Fix incorrect OFFSET calculation (Zhang Lixu)
- iio: hid-sensor-prox: Restore lost scale assignments (Zhang Lixu)
- wifi: mt76: mt7925: adjust rm BSS flow to prevent next connection failure (Ming Yen Hsieh)
- Revert "wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO" (Sean Wang)
- arm64: dts: qcom: x1-crd: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
- x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap() (Roman Kisel)
- KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (Manuel Andreas) [Orabug: 38217316] {CVE-2025-38351}
- KVM: x86: model canonical checks more precisely (Maxim Levitsky)
- KVM: x86: Add X86EMUL_F_MSR and X86EMUL_F_DT_LOAD to aid canonical checks (Maxim Levitsky)
- KVM: x86: Route non-canonical checks in emulator through emulate_ops (Maxim Levitsky)
- KVM: x86: drop x86.h include from cpuid.h (Maxim Levitsky)
- ext4: fix out of bounds punch offset (Zhang Yi) [Orabug: 38369646] {CVE-2025-38221}
- ext4: correct the error handle in ext4_fallocate() (Zhang Yi)
- ext4: fix incorrect punch max_end (Zhang Yi)
- ext4: move out common parts into ext4_fallocate() (Zhang Yi)
- ext4: move out inode_lock into ext4_fallocate() (Zhang Yi)
- ext4: factor out ext4_do_fallocate() (Zhang Yi)
- ext4: refactor ext4_insert_range() (Zhang Yi)
- ext4: refactor ext4_collapse_range() (Zhang Yi)
- ext4: refactor ext4_zero_range() (Zhang Yi)
- ext4: refactor ext4_punch_hole() (Zhang Yi)
- ext4: don't explicit update times in ext4_fallocate() (Zhang Yi)
- erofs: fix large fragment handling (Gao Xiang)
- erofs: clean up header parsing for ztailpacking and fragments (Gao Xiang)
- erofs: simplify tail inline pcluster handling (Gao Xiang)
- erofs: use Z_EROFS_LCLUSTER_TYPE_MAX to simplify switches (Hongzhen Luo)
- erofs: refine z_erofs_get_extent_compressedlen() (Gao Xiang)
- erofs: simplify z_erofs_load_compact_lcluster() (Gao Xiang)
- arm64: dts: qcom: x1e78100-t14s: mark l12b and l15b always-on (Johan Hovold)
- mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() (Md Sadre Alam)
- crypto: powerpc/poly1305 - add depends on BROKEN for now (Eric Biggers)
- comedi: comedi_test: Fix possible deletion of uninitialized timers (Ian Abbott)
- jfs: reject on-disk inodes of an unsupported type (Dmitry Antipov)
- x86/bugs: Fix use of possibly uninit value in amd_check_tsa_microcode() (Michael Zhivich)
- spi: cadence-quadspi: fix cleanup of rx_chan on failure paths (Khairul Anuar Romli)
- usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach (Rd Babiera)
- usb: typec: tcpm: allow switching to mode accessory to mux properly (Michael Grzeschik)
- usb: typec: tcpm: allow to use sink in accessory mode (Michael Grzeschik)
- selftests/bpf: Add tests with stack ptr register in conditional jmp (Yonghong Song)
- rust: give Clippy the minimum supported Rust version (Miguel Ojeda)
- mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n (Harry Yoo)
- mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list (Tu Jinjiang) [Orabug: 38401778] {CVE-2025-39725}
- selftests: mptcp: connect: also cover checksum (Matthieu Baerts)
- selftests: mptcp: connect: also cover alt modes (Matthieu Baerts)
- resource: fix false warning in __request_region() (Akinobu Mita)
- nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi)
- kasan: use vmalloc_dump_obj() for vmalloc error reports (Marco Elver)
- ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351928] {CVE-2025-38664}
- gve: Fix stuck TX queue for DQ queue format (Praveen Kaligineedi)
- e1000e: ignore uninitialized checksum word on tgp (Jacek Kowalski)
- e1000e: disregard NVM checksum on tgp when valid checksum bit is not set (Jacek Kowalski)
- dpaa2-switch: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- dpaa2-eth: Fix device reference count leak in MAC endpoint handling (Ma Ke)
- arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() (Ada Couprie Diaz) [Orabug: 38351989] {CVE-2025-38670}
- ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa0xxx (Edip Hazuri)
- ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx (Dawid Rezler)
- sprintf.h requires stdarg.h (Stephen Rothwell)
- bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() (Ma Ke)
- i2c: virtio: Avoid hang by using interruptible completion wait (Viresh Kumar)
- i2c: tegra: Fix reset error handling with ACPI (Akhil R)
- i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351992] {CVE-2025-38671}
- timekeeping: Zero initialize system_counterval when querying time from phc drivers (Markus Blöchl)
- ARM: 9450/1: Fix allowing linker DCE with binutils < 2.36 (Nathan Chancellor)
- mm/ksm: fix -Wsometimes-uninitialized from clang-21 in advisor_mode_show() (Nathan Chancellor)
- drm/sched: Remove optimization that causes hang when killing dependent jobs (Lin Cao)
- drm/amdgpu: Reset the clear flag in buddy during resume (Arunpravin Paneer Selvam)
- platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots (Rongrong)
- platform/x86: ideapad-laptop: Fix FnLock not remembered among boots (Rongrong)
- net: hns3: default enable tx bounce buffer when smmu enabled (Jijie Shao)
- net: hns3: fixed vf get max channels bug (Jian Shen)
- net: hns3: disable interrupt when ptp init failed (Yonglong Liu)
- net: hns3: fix concurrent setting vlan filter issue (Jian Shen)
- s390/ism: fix concurrency management in ism_cmd() (Halil Pasic)
- selftests: drv-net: wait for iperf client to stop sending (Nimrod Oren)
- ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop (Sharan Kumar M)
- drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe() (Douglas Anderson)
- can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (Marc Kleine-Budde) [Orabug: 38351934] {CVE-2025-38665}
- net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei)
- net: appletalk: Fix use-after-free in AARP proxy probe (Kito Xu)
- i40e: When removing VF MAC filters, only check PF-set MAC (Jamie Bainbridge)
- i40e: report VF tx_dropped with tx_errors instead of tx_discards (Dennis Chen)
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Shahar Shitrit)
- net/mlx5: Fix memory leak in cmd_exec() (Chiara Meiohas)
- net: ti: icssg-prueth: Fix buffer allocation for ICSSG (Himanshu Mittal)
- ASoC: mediatek: mt8365-dai-i2s: pass correct size to mt8365_dai_set_priv (Guoqing Jiang)
- xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger) [Orabug: 38310014,38453837] {CVE-2025-38500}
- xfrm: Set transport header to fix UDP GRO handling (Tobias Brunner)
- xfrm: state: use a consistent pcpu_id in xfrm_state_find (Sabrina Dubroca)
- xfrm: state: initialize state_ptrs earlier in xfrm_state_find (Sabrina Dubroca) [Orabug: 38352014] {CVE-2025-38675}
- staging: vchiq_arm: Make vchiq_shutdown never fail (Stefan Wahren)
- platform/x86: Fix initialization order for firmware_attributes_class (Torsten Hilbrich)
- x86/hyperv: Fix usage of cpu_online_mask to get valid cpu (Nuno Das Neves)
- tools/hv: fcopy: Fix incorrect file path conversion (Yasumasa Suenaga)
- platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Validate event/enable input (Shravan Kumar Ramani)
- platform/mellanox: mlxbf-pmc: Remove newline char from event name input (Shravan Kumar Ramani)
- regmap: fix potential memory leak of regmap_bus (Abdun Nihaal)
- iio: adc: ad7949: use spi_is_bpw_supported() (David Lechner)
- interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node (Xilin Wu)
- RDMA/core: Rate limit GID cache warning messages (Maor Gottlieb)
- platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo UX8406CA (Rahul Chandra)
- regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati) [Orabug: 38351976] {CVE-2025-38668}
- virtio_ring: Fix error reporting in virtqueue_resize (Laurent Vivier)
- virtio_net: Enforce minimum TX ring size for reliability (Laurent Vivier)
- Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT (Fabrice Gasnier) [Orabug: 38180691] {CVE-2025-38335}
- x86/traps: Initialize DR7 by writing its architectural reset value (Xin Li)
-
Wed Aug 20 2025 Jack Vogel <jack.vogel@oracle.com> [6.12.0-103.40.4.el9uek]
- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898,38440300] {CVE-2025-39823}