[meta-yocto-bsp][PATCH 06/07] yocto-bsps: update to v6.18.31

[bruce.ashfield@gmail.com]

From: Bruce Ashfield <bruce.ashfield@gmail.com>

Updating linux-yocto/6.18 to the latest korg -stable release that comprises
the following commits:

    52386a7b1beb Linux 6.18.32
    271cd5429513 drm/amdgpu/vcn4: Avoid overflow on msg bound check
    016b64a0313e drm/amdgpu/vcn3: Avoid overflow on msg bound check
    e9edf9893cf2 vsock/virtio: fix accept queue count leak on transport mismatch
    52da6a74ca3d vsock/virtio: fix empty payload in tap skb for non-linear buffers
    a534e1f985b6 vsock/virtio: fix length and offset in tap skb for split packets
    2602f7bb5818 vsock: fix buffer size clamping order
    8be786053797 batman-adv: tp_meter: fix tp_num leak on kmalloc failure
    5e9dfc07d061 tracing/fprobe: Remove fprobe from hash in failure path
    a2181464a4a7 tracing/fprobe: Unregister fprobe even if memory allocation fails
    d83e51202fec tracing: fprobe: optimization for entry only case
    52277410cbed tracing: fprobe: use rhltable for fprobe_ip_table
    5d12e0ab009a btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak
    dfd05a16b5c9 btrfs: fix double free in create_space_info_sub_group() error path
    a4b5c5d2f8c5 btrfs: remove fs_info argument from btrfs_sysfs_add_space_info_type()
    d784865ce48f usb: dwc3: Move GUID programming after PHY initialization
    476ee6389120 usb: dwc3: Add dwc pointer to dwc3_readl/writel
    e63942da5e96 usb: dwc3: Remove of dep->regs
    ce9aaa3af445 sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters
    30cf8e05d635 sched/ext: Implement cgroup_set_idle() callback
    dc34f8d8240f Bluetooth: hci_conn: fix potential UAF in create_big_sync
    c0a8dca8d556 spi: zynq-qspi: fix controller deregistration
    ed822a569645 spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled()
    33e5ce64b817 spi: tegra114: fix controller deregistration
    65eafad7a600 spi: tegra20-sflash: fix controller deregistration
    fafa9a4e831b spi: uniphier: fix controller deregistration
    b0a97cb0b9ba spi: uniphier: Simplify clock handling with devm_clk_get_enabled()
    6542e180fa6e pseries/papr-hvpipe: Fix race with interrupt handler
    09c15bbbed53 papr-hvpipe: convert papr_hvpipe_dev_create_handle() to FD_PREPARE()
    24d2912962d0 EDAC/versalnet: Fix device name memory leak
    d281f3ac0d00 block: fix zone write plug removal
    7105d9f1387d fbcon: Avoid OOB font access if console rotation fails
    1817dd0c350f fbcon: Rename struct fbcon_ops to struct fbcon_par
    f0d3bb6f5125 drm/amdgpu: rework how we handle TLB fences
    13e9ea445191 Revert "drm/amdgpu: don't attach the tlb fence for SI"
    576b73b24656 drm/amdgpu: Fix validating flush_gpu_tlb_pasid()
    fd78e63459ab drm/amdgpu: validate the flush_gpu_tlb_pasid()
    a9591e4083cc mm/damon/core: disallow time-quota setting zero esz
    377c3d5dc952 usb: typec: tcpm: reset internal port states on soft reset AMS
    d893804e9e3b mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values
    4697ed7be9b9 mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values
    679e65ae721c mm/damon/core: implement damon_kdamond_pid()
    20048f0b38cd LoongArch: KVM: Compile switch.S directly into the kernel
    f49a00180dfc io_uring/zcrx: warn on freelist violations
    1a516d19100e io_uring/zcrx: use guards for locking
    0baf4b659cdc batman-adv: bla: put backbone reference on failed claim hash insert
    b65365d2b1e6 batman-adv: bla: only purge non-released claims
    00155f336a5e batman-adv: bla: prevent use-after-free when deleting claims
    09dc0d1a1222 batman-adv: stop caching unowned originator pointers in BAT IV
    03660dab86f9 batman-adv: stop tp_meter sessions during mesh teardown
    e1e2194cc725 batman-adv: reject new tp_meter sessions during teardown
    bf872db54f91 batman-adv: fix integer overflow on buff_pos
    c9dadb31f360 sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL
    cd39452498e2 arm64: dts: ti: k3-am62a7-sk: Fix pin name in comment from M19 to N22
    3eb7d0e2d4a0 arm64: dts: qcom: lemans: Correct QUP interrupt numbers
    f8f546883e87 drm/amdgpu/pm: align Hawaii mclk workaround with radeon
    6fed6e9f1062 drm/amdgpu/pm: add missing revision check for CI
    0b91ea46bb68 drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission
    6fbd52d210c1 drm/amdkfd: Make all TLB-flushes heavy-weight
    46bc180e6ede drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds
    73af14be7645 drm/bridge: tda998x: Use __be32 for audio port OF property pointer
    71614ab2a683 drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ
    f6dbec5bee72 drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds
    ed21d6e4ce03 drm/exynos: remove bridge when component_add fails
    b17175d0a375 drm/amdgpu: zero-initialize GART table on allocation
    264ee64cf867 drm/radeon: add missing revision check for CI
    672464dd5323 drm: Set old handle to NULL before prime swap in change_handle
    87f9b1528e1f drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise
    fa449b88706e drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked()
    0afa8b1ef582 drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import()
    cd38e1503e67 drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked()
    f9ad21b90162 drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure
    2b5ba326f9d0 drm/udl: Increase GET_URB_TIMEOUT
    db9530a9873a drm/amdkfd: validate SVM ioctl nattr against buffer size
    a7735b491a2d drm/appletbdrm: Use kvzalloc for big allocations
    1a17ea9861e8 drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()
    158def957199 drm/amd/display: Change dither policy for 10 bpc output back to dithering
    638e48ee39d0 drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg
    63b51e8a9d54 drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg
    b3d1a0a45c4a drm/amdgpu/vce: Prevent partial address patches
    a6d5563ba1f0 drm/amdgpu/vcn4: Prevent OOB reads when parsing IB
    fec8b11b55e5 drm/amdgpu: Add bounds checking to ib_{get,set}_value
    44d5a450c04d drm/amdkfd: Add upper bound check for num_of_nodes
    de137adccf7a drm/amd/pm: fix incorrect FeatureCtrlMask setting on smu v14.0.x
    f34eda3ff33d drm/amdgpu: gate VM CPU HDP flush on reset lock
    2795d325bb5c drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count.
    77d0b5d11387 drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure
    48fb2213e2c2 drm/i915/psr: Init variable to avoid early exit from et alignment loop
    132b8d51f0ff drm/msm: always recover the gpu
    c5b5a0e418b1 drm/imx: parallel-display: Prefer bus format set via legacy "interface-pix-fmt" DT property
    c57c861956b8 drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata()
    e9ae6590405d spi: cadence: fix clock imbalance on probe failure
    6ac380a0071d spi: cadence: fix unclocked access on unbind
    59701f07b19e spi: cadence: fix controller deregistration
    6c3e413919a1 spi: mpc52xx: fix use-after-free on unbind
    28f28a0f4e32 spi: mpc52xx: fix controller deregistration
    336d9ad7560b spi: mpc52xx: fix use-after-free on registration failure
    07dc76d31be4 spi: orion: fix clock imbalance on registration failure
    b809b8d2a114 spi: orion: fix runtime pm leak on unbind
    ec7a4cff8355 spi: orion: fix controller deregistration
    5c03d52ee6ce spi: mxic: fix controller deregistration
    2a2973cb3682 spi: imx: fix runtime pm leak on probe deferral
    6a405d594207 spi: mpfs: fix controller deregistration
    b2bdbe293012 spi: img-spfi: fix controller deregistration
    4b0fe572a8ea spi: slave-mt27xx: fix controller deregistration
    0df72db5a13c spi: sh-msiof: fix controller deregistration
    aee76c1dd189 spi: rspi: fix controller deregistration
    229cc70e4e90 spi: sprd: fix controller deregistration
    cdbf6baefff0 spi: pic32-sqi: fix controller deregistration
    82a95eca235b spi: cavium-thunderx: fix controller deregistration
    e84a84209b3f spi: npcm-pspi: fix controller deregistration
    ee2100d08094 spi: coldfire-qspi: fix controller deregistration
    047f939c602c spi: bcmbca-hsspi: fix controller deregistration
    ca3195c7b883 spi: fsl: fix controller deregistration
    d78c5ca1563c spi: sh-hspi: fix controller deregistration
    4422fc2411cb spi: ch341: fix devres lifetime
    af4f58c18c4c spi: pl022: fix controller deregistration
    cc8a904cbe6d spi: mtk-nor: fix controller deregistration
    894d761a3a85 spi: pic32: fix controller deregistration
    4ed7de898bbb spi: omap2-mcspi: fix controller deregistration
    09ceedcebc77 spi: fsl-espi: fix controller deregistration
    b99939bccae9 spi: s3c64xx: fix controller deregistration
    c74ba7340010 spi: dln2: fix controller deregistration
    724520793a2e spi: mt65xx: fix controller deregistration
    cc525debdfc8 spi: mxs: fix controller deregistration
    22ee38cbf536 media: qcom: camss: Add missing clocks for VFE lite on sa8775p
    696ac7c49c27 media: iris: Fix dma_free_attrs() size in iris_hfi_queues_init()
    095c51bc86d3 media: venus: fix QCOM_MDT_LOADER dependency
    e56a25247860 media: qcom: iris: increase H265D_MAX_SLICE to fix H.265 decoding on SC7280
    9d6217429cd4 media: qcom: camss: Fix csid IRQ offset for sa8775p
    8744fd0835dd media: qcom: camss: Fix csid clock configuration for sa8775p
    dd24998a4a40 media: iris: Fix use-after-free in iris_release_internal_buffers()
    1920b4602ec9 media: iris: fix QCOM_MDT_LOADER dependency
    d172bb82f70c media: omap3isp: drop the use count of v4l2 pipeline
    cedfde9f45b1 media: i2c: ov08d10: fix runtime PM handling in probe
    d9e678e8c633 media: i2c: ov08d10: fix image vertical start setting
    ea91dee38b4e media: staging: imx: request mbus_config in csi_start
    731d7ab8dfa2 media: i2c: imx412: Assert reset GPIO during probe
    34fe9c3c594e media: dib8000: avoid division by 0 in dib8000_set_dds()
    def939175ab8 media: pci: zoran: fix potential memory leak in zoran_probe()
    84d781069294 arm64: dts: broadcom: bcm2712-d-rpi-5-b: update uart10 interrupt
    65d7b2aecdfe arm64: dts: broadcom: bcm2712-d-rpi-5-b: add fixes for pinctrl/pinctrl_aon
    5167575b79e2 vsock/virtio: fix MSG_PEEK ignoring skb offset when calculating bytes to copy
    75c38af4d919 platform/x86: hp-wmi: Ignore backlight and FnLock events
    45890a035e2b spi: aspeed-smc: fix controller deregistration
    07938829cc11 spi: amlogic-spisg: fix controller deregistration
    6047dc542fa4 media: saa7164: add ioremap return checks and cleanups
    d6f56e66e8f4 spi: at91-usart: fix controller deregistration
    5d707cf9c138 spi: qup: fix controller deregistration
    4eccd83f228f spi: meson-spicc: fix controller deregistration
    6ca3eaa82812 spi: lantiq-ssc: fix controller deregistration
    184dcecc9521 regulator: bd9571mwv: fix OF node reference imbalance
    037bcca27835 regulator: s2dos05: fix OF node reference imbalance
    890a8bcef309 regulator: act8945a: fix OF node reference imbalance
    41ef27dcaa12 media: i2c: imx283: Fix hang when going from large to small resolution
    f43e30646fc9 media: intel/ipu6: fix error pointer dereference
    21fade52ab9f media: videobuf2: Set vma_flags in vb2_dma_sg_mmap
    dd681c102b4b regulator: rk808: fix OF node reference imbalance
    e7374c142169 regulator: bq257xx: fix OF node reference imbalance
    6c5d4c819d92 media: i2c: imx283: Enter full standby when stopping streaming
    ecd0c501bd63 media: rc: streamzap: Error handling in probe
    63a960b39de9 media: rc: xbox_remote: heed DMA restrictions
    a8ada5b76115 regulator: max77650: fix OF node reference imbalance
    8993d307cf2c spi: st-ssc4: fix controller deregistration
    2d51cfca8482 regulator: mt6357: fix OF node reference imbalance
    c7848b67ef10 staging: media: atomisp: Disallow all private IOCTLs
    af2dc8b8460c arm64: dts: lx2160a-cex7/lx2162a-sr-som: fix usd-cd & gpio pinmux
    72972aba49df spi: atmel: fix controller deregistration
    c66a6f226a5f spi: bcm63xx: fix controller deregistration
    7fbb3b4bef02 drm/gpusvm: Force unmapping on error in drm_gpusvm_get_pages
    ea28b33e1b15 media: chips-media: wave5: add missing spinlock protection for handle_dynamic_resolution_change()
    d71fc6874fce media: chips-media: wave5: add missing spinlock protection for send_eos_event()
    b40ec65e0926 media: chips-media: wave5: fix a potential memory leak in wave5_vdi_init()
    6261d5fd172b media: dt-bindings: rockchip,vdec: Mark reg-names required for RK35{76,88}
    361e66fb431d media: dt-bindings: rockchip,vdec: Add alternative reg-names order for RK35{76,88}
    791598484fd5 media: i2c: ov8856: free control handler on error in ov8856_init_controls()
    b6e5c80cc2b2 media: renesas: vin: Fix RAW8 (again)
    bfb2081ba00a media: renesas: vsp1: Fix NULL pointer deref on module unload
    4d6e8496486d media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0
    0ac9ec121d89 drm/msm/hdmi: Fix wrong CTRL1 register used in writing info frames
    06d99af8db11 media: uvcvideo: Enable VB2_DMABUF for metadata stream
    80d8cc29d3b6 HID: pidff: Fix integer overflow in pidff_rescale
    5c0830323689 HID: appletb-kbd: run inactivity autodim from workqueues
    59a79938ca55 HID: appletb-kbd: fix UAF in inactivity-timer cleanup path
    7812694752a5 HID: playstation: Clamp num_touch_reports
    6c1de6e6aa8c Linux 6.18.31
    2a93a4fac7b6 ptrace: slightly saner 'get_dumpable()' logic
    52dc660c85db Linux 6.18.30
    1aa60fea7f63 ksmbd: validate inherited ACE SID length
    28f5ed477eef x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache
    a0e560d15ff1 rust: pin-init: fix incorrect accessor reference lifetime
    4af2e62cbcda net: stmmac: Prevent NULL deref when RX memory exhausted
    9d1774b33e10 net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY()
    5cffe3c13689 crypto: caam - guard HMAC key hex dumps in hash_digest_key
    ef63ef44e86c printk: add print_hex_dump_devel()
    c9ce18e6bb2c erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap()
    24da4cc6bf27 erofs: tidy up z_erofs_lz4_handle_overlap()
    d309d3308de6 hfsplus: fix held lock freed on hfsplus_fill_super()
    a42090445096 hfsplus: fix uninit-value by validating catalog record size
    23b814ec96a8 firmware: exynos-acpm: Drop fake 'const' on handle pointer
    bbcef208c5da mm, swap: speed up hibernation allocation and writeout
    4d7b42941c9b crypto: qat - fix firmware loading failure for GEN6 devices
    fb6616806f3d crypto: qat - fix indentation of macros in qat_hal.c
    afece4e3f2cd mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs
    f597ab044bea mmc: core: Add quirk for incorrect manufacturing date
    ebad72308271 mmc: core: Adjust MDT beyond 2025
    b0f4711b426a octeon_ep_vf: add NULL check for napi_build_skb()
    1869da3efe70 hwmon: (powerz) Avoid cacheline sharing for DMA buffer
    609936df7ce1 dma-mapping: add __dma_from_device_group_begin()/end()
    25c2b77bc463 fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info
    1de2db19a602 mm/damon/core: disallow non-power of two min_region_sz on damon_start()
    d18099f19e53 bpf: Fix use-after-free in arena_vm_close on fork
    737adda64f51 io_uring/tw: serialize ctx->retry_llist with ->uring_lock
    2563d7880c4d io_uring/kbuf: support min length left for incremental buffers
    23900db3787a LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup
    aaaf41aee5ac LoongArch: KVM: Use kvm_set_pte() in kvm_flush_pte()
    3d44ed6dd219 LoongArch: KVM: Move unconditional delay into timer clear scenery
    b715ceb72ed9 LoongArch: KVM: Fix HW timer interrupt lost when inject interrupt by software
    1c32824fbdec LoongArch: KVM: Fix "unreliable stack" for kvm_exc_entry
    e50d8573534f LoongArch: KVM: Cap KVM_CAP_NR_VCPUS by KVM_CAP_MAX_VCPUS
    9e1aed63a555 LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang()
    7d3c27b54253 KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu()
    931c9c777e35 KVM: arm64: Fix FEAT_Debugv8p9 to check DebugVer, not PMUVer
    7e9f5f62f8d1 KVM: arm64: Fix FEAT_SPE_FnE to use PMSIDR_EL1.FnE, not PMSVer
    81e7907fe542 KVM: arm64: Fix initialisation order in __pkvm_init_finalise()
    7b99369b2c7a KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value
    837db0777792 KVM: arm64: Wake-up from WFI when iqrchip is in userspace
    8be551f538dc f2fs: fix fsck inconsistency caused by FGGC of node block
    03806ec9c4cd f2fs: fix inline data not being written to disk in writeback path
    4bdc05b2032b f2fs: refactor f2fs_move_node_folio function
    8d269aae6f73 f2fs: fix uninitialized kobject put in f2fs_init_sysfs()
    b0e4395870eb f2fs: fix node_cnt race between extent node destroy and writeback
    d438a9fb20d0 f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks()
    f37012cc7c27 f2fs: fix incorrect file address mapping when inline inode is unwritten
    bedb710b63ae f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage
    63c2d2ad40d1 f2fs: fix fiemap boundary handling when read extent cache is incomplete
    060029ed542e f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode()
    464747eae483 mptcp: pm: ADD_ADDR rtx: return early if no retrans
    107e956ce544 mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker
    b74ad2019865 mptcp: pm: ADD_ADDR rtx: free sk if last
    acd3d3562315 mptcp: pm: ADD_ADDR rtx: always decrease sk refcount
    2ad56e434199 mptcp: pm: ADD_ADDR rtx: fix potential data-race
    cffc6fc446a2 mptcp: pm: ADD_ADDR rtx: allow ID 0
    07c2f3c29a8a mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0
    6f5ba49da8b1 mptcp: pm: prio: skip closed subflows
    8a005fe451c7 mptcp: fix scheduling with atomic in timestamp sockopt
    e6ad28d9d5bf mptcp: fix rx timestamp corruption on fastopen
    e083d1d8bbec mptcp: sockopt: increase seq in mptcp_setsockopt_all_sf
    c7362eef3b70 mptcp: sockopt: set timestamp flags on subflow socket, not msk
    e74f33c8a2c7 mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure
    fa26c8deed61 mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure
    4f269fc3c73a mptcp: fastclose msk when linger time is 0
    2146145d6dd6 selftests: mptcp: pm: restrict 'unknown' check to pm_nl_ctl
    2efd6bd0e9b1 selftests: mptcp: check output: catch cmd errors
    a8f4a82e5629 sched_ext: idle: Recheck prev_cpu after narrowing allowed mask
    0c63333ff97b RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path
    006a3a5f7534 RDMA/rxe: Reject unknown opcodes before ICRC processing
    105bf79a23b8 RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads
    8832626a4834 RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp()
    b087913ae882 RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()
    e01b8c9286c4 RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq()
    1e2a44875b6a RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()
    012796f9541f RDMA/mana: Validate rx_hash_key_len
    9ef65af26b2a RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()
    bb9cb36eaefa RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss()
    ab64c63b460b RDMA/mana: Fix error unwind in mana_ib_create_qp_rss()
    d886bcdcd00d RDMA/ionic: Fix typo in format string
    61df14f306f1 RDMA/ionic: bound node_desc sysfs read with %.64s
    44905248dd87 perf/x86/intel: Always reprogram ACR events to prevent stale masks
    2546fb8c9acc powerpc/xive: fix kmemleak caused by incorrect chip_data lookup
    4b6886ca8114 power: supply: max17042: avoid overflow when determining health
    1bf238ead7cc PCI/ASPM: Fix pci_clear_and_set_config_dword() usage
    24582f5044bf PCI/AER: Stop ruling out unbound devices as error source
    70a5d28dd273 PCI/AER: Clear only error bits in PCIe Device Status
    185d51ec3a54 PCI: Update saved_config_space upon resource assignment
    eafd6f5372d2 mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock
    cb825c22c002 mm/damon/stat: detect and use fresh enabled value
    bb1703949dca KVM: x86: Do IRR scan in __kvm_apic_update_irr even if PIR is empty
    d6f4e217d663 KVM: x86: check for nEPT/nNPT in slow flush hypercalls
    c688f3ed73d3 smb: client: validate dacloffset before building DACL pointers
    be1ef9512a3f smb: client: use kzalloc to zero-initialize security descriptor buffer
    b8c8a704f0bc smb/client: fix out-of-bounds read in symlink_data()
    512d33bc8ea4 smb/client: fix out-of-bounds read in smb2_compound_op()
    45dcc815fc55 scsi: mpt3sas: Limit NVMe request size to 2 MiB
    cf90a96b7a2d s390/debug: Reject zero-length input before trimming a newline
    e3eee7ea5ec5 s390/debug: Reject zero-length input in debug_input_flush_fn()
    bd62c0f61bc7 riscv: kvm: fix vector context allocation leak
    1912f7879850 RDMA/hns: Fix unlocked call to hns_roce_qp_remove()
    ac4bf66686bb psp: strip variable-length PSP header in psp_dev_rcv()
    51a7dd9cbae9 pmdomain: core: Fix detach procedure for virtual devices in genpd
    3df75fff46b1 openvswitch: vport: fix self-deadlock on release of tunnel ports
    781f47d64143 nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free
    67e1aaf93b49 nvmet-tcp: fix race between ICReq handling and queue teardown
    c77c82935c0a nvme-apple: drop invalid put of admin queue reference count
    913d556e4bd1 md/raid10: fix divide-by-zero in setup_geo() with zero far_copies
    b7df9fbd4869 libceph: Fix slab-out-of-bounds access in auth message processing
    7cdf18608302 lib/scatterlist: fix temp buffer in extract_user_to_sg()
    8fbba6829057 lib/scatterlist: fix length calculations in extract_kvec_to_sg
    8637dfb4c1d8 lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl()
    cbb032fc7432 iommu/arm-smmu-v3: Add a missing dma_wmb() for hitless STE update
    3ea9ce757bd3 iommu/vt-d: Block PASID attachment to nested domain with dirty tracking
    0d96652adc8f iommufd: Fix return value of iommufd_fault_fops_write()
    afbafeddf23d isofs: validate block number from NFS file handle in isofs_export_iget
    e69da8eeab74 isofs: validate Rock Ridge CE continuation extent against volume size
    1919acc5876c dm-verity-fec: correctly reject too-small hash devices
    9a484c8149b2 dm-verity-fec: correctly reject too-small FEC devices
    52b109f1b875 eventfs: Hold eventfs_mutex and SRCU when remount walks events
    5af6a879e915 dm: fix a buffer overflow in ioctl processing
    cb7c6a89e5d8 dm: don't report warning when doing deferred remove
    85311a585a26 dm-thin: fix metadata refcount underflow
    fb388eb58c1b btrfs: fix missing last_unlink_trans update when removing a directory
    9a060970fd7b btrfs: fix double free in create_space_info() error path
    48102d889090 ASoC: qcom: q6apm: remove child devices when apm is removed
    7cab9f2ad51c ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens
    6d43355a5b9e ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop
    4e550b59315d ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error
    846fcce3a6bb ASoC: fsl_easrc: fix comment typo
    3a5287c47b13 ASoC: ES8389: convert to devm_clk_get_optional() to get clock
    65aabf889668 ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table
    54a44bbead39 cpuidle: powerpc: avoid double clear when breaking snooze
    a0780aeea166 clk: microchip: mpfs-ccc: fix out of bounds access during output registration
    9eccdb76ad5e clk: imx: imx8-acm: fix flags for acm clocks
    b528c7ffdc3e tracing/probes: Limit size of event probe to 3K
    d50ef3553acb spi: topcliff-pch: fix use-after-free on unbind
    b3bdc7a8dd44 spi: topcliff-pch: fix controller deregistration
    4b16c06da763 thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp
    3933dfb360e0 thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata
    eb295d2b6e70 thermal: core: Free thermal zone ID later during removal
    1873eb81c65d udf: reject descriptors with oversized CRC length
    b1040af58771 tracefs: Fix default permissions not being applied on initial mount
    998f43196d73 spi: microchip-core-qspi: control built-in cs manually
    ec9d0ddbde60 spi: microchip-core-qspi: don't attempt to transmit during emulated read-only dual/quad operations
    d945d71bbad5 spi: microchip-core-qspi: fix controller deregistration
    121d1f253aed ice: fix double free in ice_sf_eth_activate() error path
    c1f261863e65 ibmveth: Disable GSO for packets with small MSS
    4f82f046f913 hv_sock: Return -EIO for malformed/short packets
    317e434e26af hv_sock: Report EOF instead of -EIO for FIN
    d1b9424f7393 hv_sock: fix ARM64 support
    cb028f72fb3b hv: Select CONFIG_SYSFB only for CONFIG_HYPERV_VMBUS
    5b958822126d gpio: of: clear OF_POPULATED on hog nodes in remove path
    bbf63275d4a5 extcon: ptn5150: handle pending IRQ events during system resume
    196efa8b254b cifs: change_conf needs to be called for session setup
    064f2e49199c cifs: abort open_cached_dir if we don't request leases
    281a0014f46f block: only read from sqe on initial invocation of blkdev_uring_cmd()
    f17d52107532 block: add pgmap check to biovec_phys_mergeable
    cb27e43c0511 pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy()
    8aacf87718b9 arm64/fpsimd: ptrace: zero target's fpsimd_state, not the tracer's
    c34c41446acf af_unix: Reject SIOCATMARK on non-stream sockets
    aa4d6fee0449 hwmon: (corsair-psu) Close HID device on probe errors
    370d4deba194 clk: rk808: fix OF node reference imbalance
    13a0f0204d54 hwmon: (ltc2992) Fix u32 overflow in power read path
    357ef14bfde2 hwmon: (ltc2992) Clamp threshold writes to hardware range
    22b365ba1af3 x86/efi: Fix graceful fault handling after FPU softirq changes
    c9b620425fd0 parisc: Fix IRQ leak in LASI driver
    23ae72e8c2f1 platform/chrome: cros_ec_typec: Init mutex in Thunderbolt registration
    2b56d7903ab8 net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler
    14ef6fd18db2 net/rds: handle zerocopy send cleanup before the message is queued
    3d47d62c1348 netpoll: pass buffer size to egress_dev() to avoid MAC truncation
    1bca036fe360 net: libwx: use request_irq for VF misc interrupt
    e70cfb40c3a9 ip6_gre: Use cached t->net in ip6erspan_changelink().
    33c5bb50b9c4 net: libwx: fix VF illegal register access
    62951b49754a pseries/papr-hvpipe: Fix the usage of copy_to_user()
    2b1335edaac5 pseries/papr-hvpipe: Fix & simplify error handling in papr_hvpipe_init()
    0479b6e9f999 pseries/papr-hvpipe: Prevent kernel stack memory leak to userspace
    0ff2b713f406 sound: ua101: fix division by zero at probe
    aab56b95bee3 perf/x86/intel: Improve validation and configuration of ACR masks
    4bf22a0afb27 mptcp: pm: ADD_ADDR rtx: skip inactive subflows
    fbe0e6197225 net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo
    52070a91956f LoongArch: Fix SYM_SIGFUNC_START definition for 32BIT
    8f75597dfc67 mm/hugetlb_cma: round up per_node before logging it
    10c252577ccd arm64: signal: Preserve POR_EL0 if poe_context is missing
    34bdcfb496b2 mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show()
    83b131a214f1 KVM: arm64: Fix kvm_vcpu_initialized() macro parameter
    7baa02b0ae9d fanotify: fix false positive on permission events
    d71240d2609b staging: vme_user: fix root device leak on init failure
    1b66f16a571a spi: s3c64xx: fix NULL-deref on driver unbind
    4f0dd529990d spi: zynqmp-gqspi: fix controller deregistration
    93f83b3a50ef spi: sun6i: fix controller deregistration
    9df7d2530412 spi: ti-qspi: fix controller deregistration
    9aea3d4f23ca spi: sun4i: fix controller deregistration
    40db1bd1ffc6 spi: syncuacer: fix controller deregistration
    ca488ac3b083 rust: allow `clippy::collapsible_if` globally
    16a7e845c3a0 rust: allow `clippy::collapsible_match` globally
    4ea3b2e469fc rust: drm: gem: clean up GEM state in init failure case
    32bd343803d4 Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb()
    1810e42ff671 Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()
    741e6024e315 Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb()
    77981a507aa0 Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt
    624fb79dadc1 Bluetooth: btmtk: validate WMT event SKB length before struct access
    3485c7236c59 Bluetooth: virtio_bt: validate rx pkt_type header length
    b40cdd1b1370 Bluetooth: virtio_bt: clamp rx length before skb_put
    53ad20efd20a LoongArch: KVM: Fix missing EMULATE_FAIL in kvm_emu_mmio_read()
    05b63fbddfca selinux: prune /sys/fs/selinux/user
    058a5e705424 selinux: prune /sys/fs/selinux/disable
    52a5d9608da5 selinux: prune /sys/fs/selinux/checkreqprot
    e5c12a115ed5 selinux: shrink critical section in sel_write_load()
    71e68e863a7e selinux: don't reserve xattr slot when we won't fill it
    d350fef4bc24 selinux: use sk blob accessor in socket permission helpers
    e3e722ea88e0 selinux: fix avdcache auditing
    7db99a09b3bc xfrm: ah: account for ESN high bits in async callbacks
    9d5047782f9b ipv6: xfrm6: release dst on error in xfrm6_rcv_encap()
    4980162de555 xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete
    0fe995ac77a8 xfrm: provide message size for XFRM_MSG_MAPPING
    c73fdf2e911d x86/efi: Restore IRQ state in EFI page fault handler
    ef49059fce11 powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o
    9ef79d48f137 ALSA: seq: Fix UMP group 16 filtering
    878c19dd4fbe ALSA: core: Serialize deferred fasync state checks
    d761428f6cc7 ALSA: firewire-tascam: Do not drop unread control events
    d829caccb426 ALSA: hda/realtek: Fix speaker silence after S3 resume on Xiaomi Mi Laptop Pro 15
    ac3e9b55b7da ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger
    f8ad9ef77156 ALSA: hda: cs35l56: Propagate ASP TX source control errors
    0c1c186f8f48 usb: typec: tcpm: fix debug accessory mode detection for sink ports
    2a71e01b2cf9 usb: ulpi: fix memory leak on ulpi_register() error paths
    6ef872d157f4 USB: serial: option: add Telit Cinterion LE910Cx compositions
    52a0cf7cde26 USB: omap_udc: DMA: Don't enable burst 4 mode
    411f2f7274e3 ALSA: usb-audio: Fix UAC3 cluster descriptor size check
    be09b47ed867 ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3()
    00e095dc5787 ALSA: usb-audio: midi2: Restart output URBs on resume
    762a6ccf391d usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl
    8247f52d8221 usb: usblp: fix heap leak in IEEE 1284 device ID via short response
    658d2e46c2e9 wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task
    d7029879bafd wifi: b43: enforce bounds check on firmware key index in b43_rx()
    9e28654f79f4 wifi: mac80211: remove station if connection prep fails
    e9f1081bc775 wifi: ath5k: do not access array OOB
    7577a4b8a10f wifi: mac80211: use safe list iteration in radar detect work
    4f9a4ae8d2c1 wifi: rsi: fix kthread lifetime race between self-exit and external-stop
    e131562d6f2b wifi: mac80211: drop stray 'static' from fast-RX rx_result
    9d1bc1558029 wifi: b43legacy: enforce bounds check on firmware key index in RX path
    6d55948a62ab wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work
    0aa63d33742b wifi: mt76: mt7921: fix a potential clc buffer length underflow
    6fc7c8b414ce wifi: mt76: mt7925: fix incorrect length field in txpower command
    5860ab3ddeaa wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr
    6f49f94f3b11 exit: prevent preemption of oopsing TASK_DEAD task
    8d09618840b9 net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked
    33fe95663d10 net: stmmac: Disable EEE RX clock stop when VLAN is enabled
    53e821fd9bae KVM: SVM: check validity of VMCB controls when returning from SMM
    edd446ee7cd3 net: af_key: zero aligned sockaddr tail in PF_KEY exports
    9dea2aeabc86 smb: client/smbdirect: fix MR registration for coalesced SG lists
    ff9e4d5e9bba mptcp: sync the msk->sndbuf at accept() time
    0d00b9015069 flow_dissector: do not dissect PPPoE PFC frames
    6200f41d6fcf ceph: fix num_ops off-by-one when crypto allocation fails
    738ec97b1855 KVM: x86: Fix shadow paging use-after-free due to unexpected GFN
    ccee9833e33b ksmbd: rewrite stop_sessions() with restartable iteration
    21a316f27095 spi: rockchip: fix controller deregistration
    8c4339dbab49 wifi: mt76: mt7925: fix incorrect TLV length in CLC command
    0f0c0c1397a4 ASoC: SOF: Don't allow pointer operations on unconfigured streams
    9a2d03d324b2 iommufd: Fix a race with concurrent allocation and unmap
    2c5b8eeea006 tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func()
    540fa6a86b91 ACPI: video: force native backlight on HP OMEN 16 (8A44)
    70446f52251f ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug
    42f83350394a ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO
    7f0a53c2b94c ACPI: scan: Use acpi_dev_put() in object add error paths
    da9b065cedfd fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free
    bc13fce9eeec ipmi:si: Return state to normal if message allocation fails
    42432b579a59 ipmi: Check event message buffer response for bad data
    3d37d2165df9 ipmi: Add limits to event and receive message requests
    00d91bfdce50 scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()
    d31a849ff501 Linux 6.18.29
    3eae0f4f9f72 rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
---
 meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.18.bbappend | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.18.bbappend b/meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.18.bbappend
index 2debe53..c0ca3ae 100644
--- a/meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.18.bbappend
+++ b/meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.18.bbappend
@@ -8,4 +8,4 @@ KMACHINE:genericx86 ?= "common-pc"
 KMACHINE:genericx86-64 ?= "common-pc-64"
 
 KBRANCH:genericarm64 ?= "v6.18/standard/genericarm64"
-SRCREV_machine:genericarm64 ?= "5cd75b0b5da06045acdd0c66e50656ab82cb880f"
+SRCREV_machine:genericarm64 ?= "3acde948b7470a96df7e730a2119ffaee380d6b1"
-- 
2.43.0