* [PATCH 0/6] linux-yocto: cosolidated pull request
@ 2026-09-17 5:13 bruce.ashfield
2026-09-17 5:13 ` [meta][PATCH 01/06] linux-yocto/6.18: update to v6.18.50 bruce.ashfield
` (6 more replies)
0 siblings, 7 replies; 13+ messages in thread
From: bruce.ashfield @ 2026-09-17 5:13 UTC (permalink / raw)
To: richard.purdie; +Cc: openembedded-core
From: Bruce Ashfield <bruce.ashfield@gmail.com>
Richard,
Here's the pending stable updates, one of which I think I sent before, but I'm
resening it to be complete.
We also have a fix for the autobuilder issue. I wasn't able to reproduce the
problem here, but this is a temporary fix until upstream merges something.
It didn't break my existing use case, so let's try it on the AB.
I went back to a unified patch series for this one, just to keep us on our
toes.
Bruce
openembedded-core (4):
linux-yocto/6.18: update to v6.18.50
linux-yocto/6.18: update to v6.18.52
linux-yocto/7.2: update to v7.2.6
linux-yocto/7.2: drm/client: avoid spurious vblank-timeout
meta-yocto (2):
yocto-bsps: update to v6.18.50
yocto-bsps: update to v6.18.52
openembedded-core:
meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb | 6 +++---
meta/recipes-kernel/linux/linux-yocto-rt_7.2.bb | 6 +++---
meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb | 6 +++---
meta/recipes-kernel/linux/linux-yocto-tiny_7.2.bb | 6 +++---
meta/recipes-kernel/linux/linux-yocto_6.18.bb | 24 ++++++++++++------------
meta/recipes-kernel/linux/linux-yocto_7.2.bb | 24 ++++++++++++------------
6 files changed, 36 insertions(+), 36 deletions(-)
meta-yocto:
meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.18.bbappend | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--
2.43.0
^ permalink raw reply [flat|nested] 13+ messages in thread
* [meta][PATCH 01/06] linux-yocto/6.18: update to v6.18.50
2026-09-17 5:13 [PATCH 0/6] linux-yocto: cosolidated pull request bruce.ashfield
@ 2026-09-17 5:13 ` bruce.ashfield
2026-09-17 5:13 ` [meta][PATCH 02/06] linux-yocto/6.18: update to v6.18.52 bruce.ashfield
` (5 subsequent siblings)
6 siblings, 0 replies; 13+ messages in thread
From: bruce.ashfield @ 2026-09-17 5:13 UTC (permalink / raw)
To: richard.purdie; +Cc: openembedded-core
From: Bruce Ashfield <bruce.ashfield@gmail.com>
Updating linux-yocto/6.18 to the latest korg -stable release that comprises
the following commits:
7cfc41f8e80f1 Linux 6.18.50
8e30f5427f345 mm/rmap: use huge_ptep_get() in try_to_unmap_one()
381a0a524e967 mm: avoid unnecessary use of is_swap_pmd()
6a259dd313043 platform/chrome: sensorhub: Fix dropped timestamp events and log spam
e91d66e5ff661 selftests/mm: fix on-fault-limit false failure under sudo-rs
2d6150e5e6aa6 udf: Fix i_lenExtents truncation on 32-bit kernels
b7eff3f621ef2 timer: Keep debugobjects state consistent in migrate_timer_list()
fecf1e3777526 timekeeping: Check the return value of tk_get_aux_ts64 in __do_adjtimex()
6067c39c2cec1 taskstats: fix cpumask parsing cutting off the last character
ed64aa505875a smack: fix cred UAF in smack_file_send_sigiotask()
a246da20c8e4a signal: avoid shared siginfo namespace rewrites
236c8ecaafc63 sticon/parisc: Detect default STI graphics card for console output
e8527de7fea19 sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[]
cde2d927c29e8 tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout
c3c7e87c76b42 zloop: truncate finished zones to zone capacity
f49e55b1c8fe1 xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc()
ae0c79a852704 w1: ds28e17: reject an oversize length on an I2C block read
165a330a68b5f vsock/virtio: flush works in dependency order
03b81f015dbb2 wifi: mt76: mt7996: validate default EEPROM firmware size
01f2e0da8548f wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames
304470333b7f5 wifi: mt76: mt7925: cancel mlo_pm_work on stop
5fdaf7016d768 wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy
4506e229b2e46 wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex
34a505071d1ff wifi: rtw88: pci: fix resource leak on failed NAPI setup
7364713f0931e wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb()
dc8b0be0ec4d9 wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars()
0c0b374e12d52 wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids
97a1af5ac131b wifi: rtl818x: initialize eeprom_93cx6 struct to zero
b1bbeb8970eeb wifi: mwifiex: Detach sync cmd buffer on interrupted wait
7c257a295e05c crypto: sun8i-ss - Remove crypto_rng interface
8e4f9110aba31 crypto: sun8i-ce - Remove crypto_rng interface
620acb1e8037b wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop
84ba017a1e1ea wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start()
261d7c7610b4b wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control()
7ef23317f9976 i3c: renesas: Reconfigure the DATBAS register on re-attach
9382fcf3a8c44 i3c: renesas: Clean DATBAS register on detach
0093f9fc102ba i3c: renesas: Check that the transfer is valid before accessing it
5697d779577e2 i3c: master: svc: bound IBI payload to the requested max_payload_len
94fb9786d67a8 i3c: master: Fix info leak and UAF in device unregister path
a15a1b95de980 i3c: master: adi: initialize the lock before enabling interrupts
1894fc7a3bab9 dm-pcache: fix use-after-free and invalid seg operations in kset_replay()
10acf740c3adb dm-pcache: fix implicit u8 truncation of gc_percent in message handler
83e3116283ed2 dm-pcache: only hand out initialized cache segments
663ee2f3824a5 dm-pcache: detect a cycle in the last-kset chain during replay
2cd9776fe3f2d dm-pcache: clamp the tail kset read to the segment data region
ffd9a214a94f9 dm-pcache: bound the persisted tail-position offset
91b93fe5cf4d6 dm-pcache: validate on-media seg_num against the cache device size
d8caf96040a06 dm-pcache: validate kset key_num and intra-segment bounds
ab5dcde6fa96b dm-pcache: validate geometry fields from on-disk cache_info
296efdc110b10 dm-switch: use WRITE_ONCE() in switch_region_table_write()
74210fa072960 dm-stats: fix a crash if allocation of per-cpu data fails
c860cd3f40382 arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map()
edf30d65e3ac5 net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry
44dc702be9a9e rust: rust_is_available: warn for `bindgen` < 0.72.1 && libclang >= 22
b5fe67111e63a ovpn: run deferred work on a module-owned workqueue
50f4a793c4ff2 ring-buffer: Fix subbuf resize race with ring buffer readers
22fe01a2e2f7c ALSA: hda/realtek: Fix Lenovo Yoga Slim 7 14AKP10 quirk ordering
37c3210c491ac ALSA: hda/realtek: Enable micmute LED on HP EliteBook 6 G1a p/n: AD3Q9ET#UUG
8acb66d0513de ALSA: hda/realtek: Add quirk for TongFang XxAF5xxx
40ee4224e2fe2 ALSA: virmidi: Check card index validity at probe
7555e83d7738e ALSA: serial-u16550: Check card index validity at probe
d7ef7890e3e35 ALSA: portman2x4: Check card index validity at probe
7ef9ad82d95dd ALSA: pcxhr: initialize mutexes before requesting threaded IRQ
a4e774eeb61ae ALSA: mts64: Check card index validity at probe
cc4215cc2a4b2 ALSA: mpu401: Check card index validity at probe
13d61a920435d ALSA: hda/ext: preserve PPLCCTL bits when clearing reset
7df3194bdb747 ALSA: bcd2000: clear the URB pointers on disconnect
7b3f985584936 ALSA: aloop: Check card index validity at probe
2a6f6fba3bd31 ALSA: 6fire: bound the MIDI event length from the device
94ca4f040ba48 mfd: sm501: Fix potential memory leaks during remove
5e7fe9c6c8c31 mfd: cgbc: Fix teardown ordering in cgbc_remove()
efe0ed4c0f4e8 hwrng: stm32 - Fix runtime PM cleanup on registration failure
cfa186a0857a0 seg6: reset IP6CB after IPv6 decapsulation
288f997067084 net: skbuff: don't touch shared zerocopy state in skb_tx_error()
34ab62c959f5f net: fix spurious TX timeout after dev_activate()
af0ee8f04bea2 net: cap advertised IP tunnel headroom
5bd8b764a610b net/smc: unregister the connection before draining the rx tasklet
313f79149eb33 net/smc: stop killed, freed and out_of_sync sharing a byte
c52a998a223e7 net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link()
0761e49aa78c2 net/smc: fix use-after-free in smc_rx_pipe_buf_release()
d89dc1bd8845c net/smc: fix socket refcount leak in smc_switch_conns()
f950e1b1f0aad net/smc: do not dereference an unset send buffer on the SMC-D teardown path
486c699a8cde8 net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages
b893152a886bb net: ntb_netdev: Count packets dropped on RX refill failure
4fac86e976975 net: ntb_netdev: Avoid double-accounting netif_rx() drops
dfab7171cd391 net: ntb_netdev: Fix TX busy and drop handling
6b6bbc6c878d6 NTB: ntb_transport: Reject oversized TX buffers
894e136b432da NTB: ntb_transport: Fail TX enqueue when the QP link is down
0c4aabc904490 NTB: ntb_transport: Recycle TX entries before client callbacks
f01e6a35c440b net: thunderbolt: Mark the connection down when bringing it up fails
61ff3c353e5d2 net: thunderbolt: Release the Rx HopID that was handed out on mismatch
67a82e6f886be net: ravb: serialize PTP clock teardown
8d4d06d6e2b50 net: ravb: avoid dereferencing an invalid PTP clock
b6b533f83461c net: phylink: correctly validate returned PCS in phylink_inband_caps
0860af127aa79 net: openvswitch: fix nf_connlabels leak in ovs_ct_init
ac73e3af571da net: openvswitch: fix flow mask use-after-free on flow deletion
9c340473f4822 net: l2tp: do not propagate multicast notification errors
62da38b4b3a0d net: ipa: fix stalled modem TX queue after runtime resume
42a33e679ea05 net: ibm: emac: mal: fix NAPI locking
f71087e7c63aa net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO
e098d9cc88596 net: tun: bound receive headroom
32785d75e60df net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition
486577db80789 slip: fix use-after-free in sl_sync()
15d1f3c0dbe7a xdp: fix zero-copy frame layout
8e3763f1ccac3 net/iucv: filter frames in afiucv_hs_rcv() by ingress device
99692252b348c ipmi:msghandler: Cancel work cleanly on an error
53af3a8bae0a9 ipmi: si: Fix NULL pointer dereference after failed registration
d46c97eddcbc5 ipmi: Remove all sysfs files on registration failure
5719431ca2b5f ipmi: ipmb: validate write message length
db8147c5d5ad2 interconnect: Fix use after free in icc_get() and of_icc_get_by_index()
417e02f7b6051 io_uring/query: cap user size passed to copy_struct_to_user
0c12a798078bc platform/x86: hp-bioscfg: warn on element type mismatch instead of failing
a38127df99ae8 platform/x86: hp-bioscfg: pass validated element count to package parsers
95d2f9b5189d0 platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed
b15b334fbc3c0 platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer()
e3c1c5d1c9230 platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password
0f9aad0842488 platform/x86: hp-bioscfg: fix heap OOB read on empty password write
7cd8fe01aba30 platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store()
dea1a41160e70 platform/x86: hp-bioscfg: bound ordered-list parsing by the package count
0cd1530f84e1c platform/x86: hp-bioscfg: advance elem past consumed array elements
0a14d35ef529a platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS
bc9aa5fe21c39 platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails
8178f59d76570 platform/x86/amd/pmc: Propagate SMU errors and validate S2D address
98d91d5b6a988 platform/x86/amd/pmc: Restore msg_port on amd_stb_s2d_init() error paths
5eaf7faa99578 platform/chrome: sensorhub: Bound the EC-reported sensor number
56dc46094973d platform/x86: think-lmi: Fix current password length check
9c28adde051fe platform/x86: think-lmi: Free system certificate signatures
89a076948ed61 platform/x86: think-lmi: Fix certificate thumbprint sysfs output
d7cd3e4d76034 platform/x86: lenovo/ymc: Only match lower byte in WMI lid switch query response
e1b3f89673bd1 platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path
e07a42bb9c909 platform/x86: ISST: Return error during profile addition
62840acc3044f platform/x86: ISST: Validate parameter for frequency and priority
93268bc3cd84f platform/x86: ISST: Validate parameter for core power state
5b032e1dda486 platform/x86: ISST: Validate logical CPU id and clos id
b14db79d02bd3 platform/x86: ISST: Use PP level enable mask
92c5fffa63ad9 platform/x86: ISST: Just allow 2 bits for SST feature enable
c280fcd53b938 platform/x86: ISST: Add a NULL check for sst_inst[]
2550f89589caa mmc: via-sdmmc: stop card-detect handling on probe failure
f7ff3027ef004 mmc: via-sdmmc: cancel card-detect work on remove
82e707eff9e3b platform/x86: ISST: Validate socket ID in clos_assoc ioctl
1889a9156553f platform/x86: ISST: Validate level in perf mask ioctls
22222f92b0a51 platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer
cab2895729516 iommufd: Fix UAF in selftest IOPF reporting
4c33d00ad9a91 iommufd: Release current IOAS on xa_store() failure
436189ee4bb2c iommufd: Avoid locking internal accesses during unmap
45705a6bfdb28 iommu/vt-d: Force requesting ACS when tboot is enabled
364279b5623f7 iommu/vt-d: Fix no_iommu to disable platform opt-in
f80f3acb69164 iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add
2235eafda9b3d iommu/arm-smmu-v3: Manage teardown with devm
d903d99ffd22b iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field
968e9a1f71140 iommu/sva: Set handle->dev before the SVA handle is visible
f532401be9312 iommu/msm: Unwind probe state on registration failure
cfc5c1b2caa17 iommu/amd: Put PCI device after handling PPR faults
238e1f7a1463f PCI/proc: Warn on writes to kernel-exclusive config space regions
c2d4174f49245 PCI/proc: Use file_ns_capable() when checking config space read access
301288f85679a PCI/proc: Avoid spurious runtime PM wakeup on config space accesses
b30713111325e PCI/MSI: Enable memory decoding before restoring MSI-X messages
0e59a232aaa04 PCI/ASPM: Avoid L0s for Realtek RTS525A
39c4dc79d77f8 PCI/AER: Fix mapping of errors to agent & layer
4f887d8ed75f8 PCI/AER: Emit TLP Log only for unmasked errors
6beadccc432cf PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses
7f4db64f0ba7b PCI/sysfs: Fix read byte order in pci_read_legacy_io()
43cf455dd5a9b PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608]
4b575052ea654 PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts()
01c2f0c66bd1f PCI: plda: Fix use-after-free of event IRQs during teardown
5d4bc470330a6 PCI: meson: Fix GPIO state while requesting PERST#
1ad6994853853 PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk
6053d6eacbfd2 PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip
ceafb262475ac s390/dasd: Propagate partial completion length across ERP recovery
6452c13646af7 s390/dasd: Guard sysfs discipline callbacks against unallocated private data
52b331c99baac s390/dasd: Do not complete a failed ESE read as successful
dcce7a06ea690 s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks
aad7247bd35ad power: supply: max17040: synchronize work cancellation on suspend
17d43f64b17e4 power: supply: max17040: drop incorrect I2C functionality check
13fb0477da9b4 power: supply: max17040: propagate register read errors
39b60d615dfa1 power: supply: ucs1002: fix use-after-free on remove
a4460e89d4088 power: supply: twl4030_charger: cancel workers via devm
1b9978433c61a power: supply: rt9455: quiesce delayed work before teardown
ee053561e21ce power: supply: qcom_battmgr: terminate the strings from firmware
06618447029c6 power: supply: qcom_battmgr: fix use-after-free
b3aa1e9509e1b power: supply: lp8788-charger: fix use-after-free on remove
ab6b1ad710bed power: supply: lp8727: fix use-after-free in lp8727_release_irq()
4b1f2be1e1b74 power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS
78be8b7403ff7 power: supply: cros_usbpd-charger: bound the EC-reported port count
86e4fa65368f3 power: supply: charger-manager: register regulators before exposing sysfs
238320ad029a3 power: supply: bq25890: Fix power_supply reference leak
9e1aba34df9a8 power: supply: bq256xx: drain usb_work before freeing the charger
f495808cdd6d9 power: supply: bq24257: fix use-after-free on remove
d02a5794c3dee sctp: fix stream->outcnt underflow on duplicate RECONF responses
7ad8933bca97b sctp: distinguish sequence zero from wildcard in reconf lookup
25419f516ea84 sctp: fix NULL deref on untransmitted RECONF completion
1035bdef1efb9 sctp: drop a chunk if its transport was removed
fa306a40e716c sctp: stop processing a packet once its association is deleted
8a02ad98798fd nvme-tcp: reject a read that transferred too few bytes
3b3d27670c0c8 nvme-tcp: fix host memory disclosure on R2T for a read command
6a01b58263108 nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone
0d4f317b07d6c nvme-pci: disable controller on admin queue IRQ setup failure
67551d8430df9 nvme: zero the discard fallback page
1e456cc2744ee nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path
d662f7fc04fde lockd: fix NULL dereference on lockowner allocation failure
41f0a6d31615f lockd: pin next file across nlm_inspect_file lock-drop
3088e41292fec ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user()
6aeff1636b398 i2c: mxs: fix DMA channel leak on probe error
8d2c120d2d5bf hwmon: (max6621) fix temperature clamp range
9b38d9a2e46a2 hwmon: (max6621) fix negative temperature offset and crit readings
68c59343ad1a7 ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC
f2a1a83487c6c arm64: proton-pack: Restore the nospectre_bhb command-line option
e7c9b1d433b05 arm64: compat: Fix decrementing LDM/STM alignment emulation
15d1feeae07d0 ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion
e41a59fc056f6 openvswitch: only skb_tx_error() a packet we are about to drop
d64a75369cd0f openrisc: fix arbitrary kernel memory access via or1k_atomic syscall
c0c165487a2ea ocfs2: fix readdir position truncation on 32-bit kernels
0608018a71f24 ocfs2: cluster: fix o2hb_dependent_users leak on pin failure
251e38f5af7b2 ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item
ce035f208d68b ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin()
0761d2c949442 ocfs2: validate rl_used against rl_count in refcount block validator
50c4cc9183e11 ocfs2: validate lengths in dlm_mig_lockres_handler
de10cd3b062a5 ocfs2: bound namelen in dlm_migrate_request_handler
71f07b7f90b31 ocfs2: always run deallocs on copy-on-write completion
116d14f29a052 orangefs: skip leading spaces before parsing client debug masks
f796f38a324e8 orangefs: fix double-free of trailer_buf on readdir copy failure
bc6fdd425fdeb PM: sleep: Unblock runtime PM when device prepare fails
6fcb0b745a0b8 ring-buffer: Hold cpu_buffer::lock when resizing a subbuf
8c1ecdcdea738 ring-buffer: Free cpu_buffer::free_page with subbuf_order
2dc510957fe8f ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page()
1c3036a818005 regulator: qcom-refgen: correct the regulator type to CURRENT
20e5fbb8c1a4c regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata
95342d26f9c6b regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer
71d5c41ac583d RDMA/uverbs: Add UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR
4f8bb11dd2ff3 RDMA/ucma: Lock the handler in ucma_write_cm_event()
28ac2dd416482 RDMA/ucma: Lock the handler in ucma_set_ib_path()
a38cd610b24f7 RDMA/ionic: Cap eq_count to the eth driver's interrupt vector budget
85f438382a865 RDMA/cxgb4: Cancel reg_work before freeing device on remove
2a952fb1b20d8 qede: Fix NULL pointer dereference in TPA fragment processing
3f5677d2f8173 ptp: vmclock: prevent read-only mappings from becoming writable
c7e32814a6bf2 remoteproc: scp: Fix device reference leak on failed lookup
37797d5013c9e riscv: unaligned: stop using kthread for check_vector_unaligned_access()
8f392916a3540 riscv: acpi: Handle LPI architectural context loss flags
5343399ed7242 arm64: dts: rockchip: Fix rk3588s-roc-pc audio description
8fc4bafabc065 arm64: dts: rockchip: Fix rk3399-roc-pc-plus analog audio
650d2d5c0df7e arm64: dts: rockchip: fix emmc reset polarity on px30-cobra
5512c23231206 arm64: dts: rockchip: fix eMMC reset polarity on PX30 Ringneck
fe455c13bf01e arm64: dts: rockchip: fix eMMC reset polarity on PP-1516
b6b3e4d5973bd arm64: dts: qcom: x1-dell-thena: mark l12b and l15b always-on
6bb9469c34fff arm64: dts: qcom: sm6115-pro1x: Correct touchscreen GPIO flags
ff23eb4823d82 Revert "arm64: dts: rockchip: Further describe the WiFi for the Pinephone Pro"
eb57632f9418f rpmsg: glink: smem: order FIFO read after availability check
e7143c3f4e5c0 scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()
2a8dd9fd12f3f media: staging/ipu7: fix async notifier UAF on probe error path
7f6956b6dcd66 staging: media: tegra-video: vi: fix probe failure on skipped last port
656d047dc0c29 staging: media: tegra-video: fix of_node_put() on VIP parse errors
5be6d02837d41 wifi: mt76: mt7925: cancel pending mlo_pm_work
e1330d719c047 wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets
b95c33a4e7438 udf: reject VAT indexes equal to the entry count
f84ec84d8d4bc svcrdma: Validate Read chunk positions before reconstruction
a798714b58041 svcrdma: Reject Write/Reply chunks with segcount 0
1949dd1576f7a svcrdma: Reject inline replies that overflow the pull-up buffer
3cf372cec7ab2 svcrdma: Reject connection when transport allocation fails
5aabe070c00e5 svcrdma: Fix unmatched rn_unregister on failed accept
a1c954ca4977a svcrdma: Fix pcl_for_each_segment for empty chunks
a46b35f213c24 svcrdma: Fix offset arithmetic in read_chunk_range
1de391e8b94e3 SUNRPC: wait for in-flight client TLS handshake callback
1f9856af065b6 SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field
7a1d0501cbb96 SUNRPC: reject duplicate CREDS_VALUE options
edeefb111d618 sunrpc: init gssp_lock before publishing proc entry
ebcbd2523a852 SUNRPC: harden gss_unwrap_resp_priv length checks
806584a4b67a7 SUNRPC: harden gss_krb5_unwrap_v2 against short tokens
fa46b6aa7a698 SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat
e769fcde3cc73 sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir
08bc49e054126 sunrpc: defer rq_argp and rq_resp free until after RCU grace period
bd1ef2cfb44d7 SUNRPC: Check svc pool percpu counter allocation
2e861ce2aaa46 SUNRPC: always drain cache_cleaner before destroying a cache_detail
39981133df21c SUNRPC: Restore NUMA_NO_NODE for svc thread allocations in global mode
9d04d64ad1924 sunrpc: route to a populated pool in svc_pool_for_cpu()
de942dd8c2c83 SUNRPC: svcauth_gss: enforce krb5 token minimum length
e0778464049b0 SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry
ad0cce80d4af2 SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow
f1b7b2c7ffa97 phy: fsl-imx8mq-usb: fix typec switch leak on probe error path
704ecd010d4a9 params: fix charp corruption on allocation failure
ff110e85837d7 nouveau/gem: reserve the bo in the info ioctl around the vma lookup
04ab51d4e369a module/kallsyms: fix nextval for data symbol lookup
51887ccd88791 mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction
d82b90a38c2ca mpls: reload header after pskb_may_pull()
50d0aa7d25ba4 module: validate string table section types
3b097416b4cff md: do overflow check for sb->bblog_shift in super_1_load()
0efabe6229dc6 md/raid10: fix still_degraded being inverted in raid10_sync_request()
121d35014e497 mailbox: qcom-ipcc: fix duplicate channel allocation across holes
09e649117c54b libnvdimm/labels: Prevent integer overflow in __nd_label_validate()
627ce4902df1d landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation
a602cd128d17a ipv6: use RCU iterator to dump route exceptions
63f50e9f90d02 ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv()
b8282668d8fa7 ip6_gre: fix hardware header length for NBMA tunnels
b36dfd6e8cff0 ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()
a8af6fbac895f ip: orphan prefetched skbs before multicast forwarding
31e4be21dacee ipip: fix skb leak in collect_md mode when metadata_dst allocation fails
f9182a85991a0 jbd2: check need_resched() when skipping busy checkpoint buffers
71c6b872c7464 jbd2: bound shrinker scans by examined checkpoint buffers
30e8cb8598aa4 kasan: fix cache shrink race with CPU hotplug
15deb4e33f474 Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request
657054159d83a Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative
94d548fc264a2 Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative
1bad0896cbc06 Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection
d0b28e9655f4b Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb
68e7a31abc88b Bluetooth: hci_conn: re-enable advertising only for peripheral role
946d76db77ee5 Bluetooth: RFCOMM: serialize security confirmation handling
49fd7116f76b8 Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready
ec3992e38f777 Bluetooth: hci_uart: Fix false success return in hci_uart_setup()
62100186f1771 Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative
1ed5982c53699 Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378
c674c504bfdd0 cxl/pmem: Format the nvdimm serial number as unsigned decimal
14d52c15d5d99 cxl/features: bound fwctl command payload to the input buffer
2924b2e365148 cpufreq: schedutil: Fix rate limit overflow
a807a9ef87ad0 coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior
ac4a5eb8b002a dm array: reject an array block whose value size is not the caller's
b33f76d33aaea dm array: validate array block headers on read
644140527ae49 dm raid1: reserve space for NUL-terminator in build_constructor_string()
36ff918637e35 dm-era: fix shadowed superblock leak on take-snap failure
49694a363f7ec dm-io: report non-retryable errors separatedly
9493ac67623d4 dm-io: clone the source bio instead of copying its biovec
272fcb4ba6fab bpf: Harden bloom filter sizing and indexing on 32-bit kernels
c9189693db47a buffer: avoid tail commit walk for uptodate folios
dbfecc8a6631c bpf: Disable preemption in __bpf_get_stack
6886642414f59 bpf, x86: Fix per-CPU address resolution into an extended register
49dcefa83c8ab bnxt_en: Write doorbell when linearizing skb fails
4d36e38e48340 bnx2x: fix double free in bnx2x_init_firmware() error path
c21fa79301d7d Bluetooth: eir: Fix OOB read in eir_get_service_data()
f609eac02d110 Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728
bce588b4ca081 Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU
aa7b93fe98ba7 Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU
ce76ca5fb2794 block: set QUEUE_FLAG_DYING unconditionally in blk_mark_disk_dead()
84858671842ae auxdisplay: charlcd: cancel backlight work on registration failure
c2e3dccd68706 ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes
fdc0a5e2cbace ARM: 9477/1: Disable broken eBPF JIT on the Risc PC
87d07aa5d38b6 alpha: marvel: Fix lock ordering in init_io7_irqs()
9e1eefc01912c alpha: marvel: Fix irq_set_status_flags to use correct IRQ number
2fd984c44e3e4 alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write()
6d4ed2fd022bc ACPI: pfr_update: fix stack buffer overflow in query_capability()
452eb28e03015 ACPI: APEI: GHES: fix ARM section length accounting after header
b7476b29b6961 ACPI: APEI: Fix ERST timeout unit conversion
c735dbce7ad03 acpi/apei/ghes: Use raw_spinlock_t for CXL CPER work locks
9ad8821573a36 accel/rocket: Fix error path handling in rocket_job_run()
3043230296653 accel/rocket: initialize job domain before cleanup paths
c1a5bf1b6e1d5 accel/rocket: fix NULL dereference and integer overflow in rocket_job_push()
a3c65af20cceb hugetlb: only adjust reservation during unmapping if mapcount is 0
4e019e5e247bf hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device
137c61a6cfd96 fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration
0c3f4544ff387 forcedeth: fix off-by-one when saving/restoring non-PCI config space
466a8af0dee2c fbdev: uvesafb: unregister connector callback on init failure
3bcab9b21f71d fbdev: ssd1307fb: defer I2C transfers from damage callbacks
3c1b5809615c3 fbdev: pvr2fb: correct user pointer annotation and sentinel initializer
76818e81cfcae fbdev: omapfb: panel-dsi-cm: initialize lock before registering display
2f66f8ceefc25 fat: restore original value when fat_ent_write failed
66aa9a9e6481b fanotify: fix use-after-free of file range info
92895a14329cc efivarfs: Rate limit statfs() handler
ce568f6e025df ecryptfs: show filename encryption options
9319706316a8e ecryptfs: release message context on send failure
b31da1ecf1392 ecryptfs: reject too-small tag 70 packets
14cb36a500a5a ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet
e5d254e654f23 ecryptfs: pass packet set buffer size to parser
0d9636ecba34b ecryptfs: hold msg ctx list lock when cleaning daemon queue
c1bc956a615d0 ecryptfs: fix tag 11 packet exact-fit size check
98b890563424a eCryptfs: bound the packet-length peek to the user buffer
7ccb94901f38a fs/ntfs3: bound page_lcns[] index by the log record
376ee45659a4b fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()
2d94ffc9d7b5b fs/ntfs3: validate dirty page table on log replay
5333e18e6b425 eventfs: Initialize ei->children and ei->list in init_ei()
b2301bdb4b3ed HID: intel-thc-hid: intel-quickspi: fix autosuspend cleanup during teardown
99f3e197920df HID: intel-thc-hid: intel-quicki2c: fix autosuspend cleanup during teardown
72706b44b6656 HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer
6fcefe71aeb52 HID: intel-thc-hid: intel-quickspi: validate report size before copy
127de5919820f HID: mcp2221: validate report size in mcp2221_raw_event()
c99ba6c234d4d HID: mcp2221: stop device IO before hid_hw_stop
01d9874e84d3a HID: universal-pidff: stop the device when force-feedback init fails
114a58640aaf3 HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind
f3f37b937a6ea HID: sensor: custom: Fix field sysfs group cleanup on failure
da00eac19feef HID: roccat: free buffered reports when destroying device
471f4a939c66d HID: picolcd: clamp eeprom debugfs read to bytes actually received
79465a30050da HID: corsair-void: Check size of status and firmware events before reading them
e78973fe3ef59 HID: apple: preserve keyboard backlight across T2 resume
846f0709559b9 smb: client: harden DFS cache against invalid target hints
17a1922ada873 smb: client: fix copy-paste error in WSL EA length accounting for $LXDEV
1f824f61d1df5 smb: client: fix ALIGN() overflow in symlink_data() error context loop
9ab46a13798a6 smb: client: clear ce->tgthint in free_tgts()
8b9b10fe5b8b4 cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC
c2a0dcb5a7a15 cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0
4f18c9e7ee464 cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size()
636a99bab36ba audit: avoid dropping live tree ref on fsnotify rule autoremove
25128202a8df5 btrfs: do not overwrite NODATASUM flag when removing NODATACOW flag
f42efd634c0ae btrfs: fix extent map leak in NOCOW direct I/O write
8a64baeb5bbb7 btrfs: drop recovered reloc root refs on recovery failure
ec32015a955c5 ceph: fix leaked inode reference on writeback abort at umount
37d6edb2f03b2 ceph: do not repeat ceph_trim_dentries() if no progress possible
1dd356310b166 ceph: bound xattr value length in __build_xattrs()
58c2d3e954c13 ceph: bound num_export_targets array for mds info v2/v3
c37db86d2b5e9 ceph: bound MDSCapAuth path and fs_name decode in handle_session()
06fb5e623cdc2 ceph: bound copied dentry name length in NFS export get_name
4d298880f82c4 ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode
fe46746087b5b ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock
00562ccd4e88d libceph: reject buckets with mismatched CRUSH ids
2571b35883268 libceph: validate OSD extent maps before cursor advance
b413ec5b23e34 NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup
4804c58f73a80 NFSD: Prevent lock owner use-after-free during client teardown
b56d2c5f01cdd nfsd: revoke copy-notify stateids before dropping their reference
dbc11a12aa545 nfsd: reject reclaim LOCK after RECLAIM_COMPLETE
ad02d095439f8 nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE
54e02f5e32c52 nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops
4ae5d7490ae6a nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd()
b57bd8cb739cb nfsd: initialize DRC hash table before registering shrinker
a4d7fedcaaf33 nfsd: initialize copy-notify stateid before publishing it
763c0bad87236 nfsd: hold rcu across localio cmpxchg retry
b3bff820d068e nfsd: gate nfs3 setacl by argp->mask
f951b22dbeec4 nfsd: gate nfs2 setacl by argp->mask
41ebca28e17f8 nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo
0380129b1373c nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget
4106d7a6aaf1e nfsd: fix version mismatch loops in nfsd_acl_init_request()
9b4e5e9ba5ae1 nfsd: fix stale s2s_cp_stateids IDR entry for async COPY
2ebbf4e3e9cf5 nfsd: fix reply size estimate for GET_DIR_DELEGATION
cf081015a0d1b nfsd: fix refcount leak in nfsd_file_lru_add on insertion failure
3c5119b799a7f nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs
424d5c95108a4 nfsd: fix nfsd_file leak on inter-server COPY setup failure
360e1b9e3f316 nfsd: fix netlink dumpit error handling for rpc_status_get
65c79d9bb3717 nfsd: fix FL_SLEEP being set unconditionally for all LOCK types
c1ae0f973bcba nfsd: fix dentry ref leak on V4ROOT export filehandle lookup
a631a26a8777b nfsd: fix cpntf publish race in nfs4_init_cp_state
607a56fea772c nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke
00843074d9b84 nfsd: drop the stateid, not the stateowner, on seqid_op replay retry
72d40b103bb03 nfsd: don't free session slots that are still in use
6703199f4d7e7 nfsd: defer vfree of compound ops to fix rpc_status UAF
631b7d5dbbba8 nfsd: defer setting NFSD4_CALLBACK_RUNNING in deleg_reaper
e879148867bd4 nfsd: clear opcnt on compound arg release to prevent OOB read
b137930ee52e3 nfsd: clear CALLBACK_RUNNING on failed delegation recall queue
b42dc26a14b4a nfsd: check client ownership when cancelling a copy-notify stateid
311f7d9266309 nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref
1aea0482b98ec nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry
bff024551a713 nfsd: add filehandle match check to nfsd4_delegreturn()
533964d420d38 nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()
895a485cd3758 nfsd: validate symlink target length in NFSv4 CREATE
2aca70c18c5f5 nfsd: validate sockaddr length per family in listener_set
7e7b93da7fa2e nfsd: validate nseconds in TIME_DELEG decode paths
7ff8d6363cfff nfsd: size fh_verify server sockaddr slot by xpt_locallen
1e4795766719f nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations
8277d4a11ae2c nfsd: sample writeback error cursor before async COPY loop
fc83f30731dd2 nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types
591134e059e34 nfsd: Reset write verifier when async COPY writeback fails
467d56fd3ff57 nfsd: release path refs on follow_down() error
f164eb52b6f3c nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown
dc803d46a8b90 pNFS: Fix EBUSY check in pnfs_layout_need_return
36e3f13bf0728 NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path
59baf45a06435 nfsd: guard nfsd_serv deref in nfsd_file_net_dispose
7ef182a8fe9c1 NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check
4ed8d2317aef2 NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock
75d13317f163a NFSD: Fix off-by-one in DRC bucket pruning limit
e547b06234f88 NFSD: Encode only the status in NFS-ACL v2 GETACL error replies
d8352da196349 NFSD: check truncate permission under inode lock
f3adf16435173 NFS: fix delegation_hash_table leak when nfs4_server_common_setup() fails
5215e734bf7cb NFS/localio: fix ref leak on nfs_uuid_add_file failure
344ae0e232d4f zsmalloc: account for handle size in class lookup
923578d0f0d07 zram: validate deflate params
a1dc246f98bb9 ubifs: fix out-of-bounds read in signature length check
14afe18655c09 phy: rockchip-samsung-dcphy: fix out-of-range max_register
e892f05f1f790 PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io()
9253cfc5a85be of: fix out-of-bounds read in of_alias_scan() stem parser
448636c745a3f nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation
8c14472431e27 media: vicodec: fix out-of-bounds write in FWHT encoder
0c260d3f97e52 media: cec: stm32: prevent out-of-bounds write on RX overflow
7d658da725ea8 lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()
9f43499ce6458 HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature
827ec385458ad fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write
34e88f5361464 usb: gadget: f_fs: Prevent deadlock during ep0 read loop
9897b7da8c0ad usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()
dbe2762ae8e54 usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init()
6bcd9ee6ad698 usb: gadget: f_tcm: fix deadlock in usbg_make_tpg()
a15c2acd30834 usb: gadget: midi2: remove default configfs groups on teardown
64005cf3e897e usb: gadget: snps_udc_plat: clean up PHY on probe deferral
4e747c864a885 usb: gadget: u_audio: Fix use-after-free on sound card disconnect
14fa29f3be066 usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion
ebb840d982a61 usb: typec: thunderbolt: Disable work before freeing tbt on remove
d793bd8422e78 usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive()
12414bbd3e3f3 USB: phy: fsl-usb: fix missing static keywords
51a311eb97e91 usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed
448e95c0f3eaa usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition
316abfe39dce7 usb: dwc2: gadget: Exit partial power down state when changing USB pull-up
78f5c6e6aef9a staging: greybus: hid: fix SET_REPORT return value
28b932202fcdb serial: imx: serialize imx_uart_ports[] lifetime
aad08b5f67d2a Revert "media: v4l2-dev: fix error handling in __video_register_device()"
e6e925cc1f806 rapidio: mport_cdev: fix use-after-free in dma_req_free()
c3d4be91c6fce powerpc/powermac: fix OF node refcount
29e634a18957a misc: nsm: bound the device-reported response length
ba69d892ff4e4 device property: fix infinite loop in fwnode_for_each_child_node()
4cd24873ab9fd cdx: Fix double free when sysfs file creation fails
b1a49c22de01f tracing: Fix use-after-free with same-name named triggers
ddbe921ed16a0 tracing: Fix use-after-free in trace_pipe read on sub-buffer order change
cdb6fb6cf1a7a tracing: Fix logged instance name on creation failure
adadf4192f700 tracing: Fix crash passing ERR_PTR to kthread_stop()
25a0758cf6bdb tracing/user_events: Clear copied tracing state before fork duplication
b503a61d5d392 hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start()
9b51dcb4f2305 x86/tdx: Fix zero-extension for 32-bit port I/O
c4a2215487081 x86/tdx: Fix off-by-one in port I/O handling
b9ae969e6f1e3 x86/locking: Use sfence for wmb() if SSE is available
08b4cdef3c2ef x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg()
968eea4659420 tools/compiler: match glibc 2.42 definition of __attribute_const__
d4bf3a74e2bae mm: vmscan: fix node reclaim ignoring swappiness parameter
461d23368f296 mm: page_alloc: fix non-movable reclaim storm in defrag_mode
d435ba3c21a02 mm: page_alloc: move capture_control to the page allocator
0df04778ea14a mm: page_alloc: __GFP_FS lockdep annotation for direct compaction
b3d4b65085ef5 mm: mempolicy: fix automatic numa balancing for shmem
5d866086d5f8d mm: memcontrol: update state_local when flushing NMI stats
95d87030cae77 mm: memcg: stop reclaim when a limit update is superseded
680b93894ddf6 mm: memcg-v1: fix memsw and TCP failcnt accounting
d0943afb5ed8b mm: memcg-v1: fix wrong linux-mm list address in deprecation warnings
295f5a61d3aea mm: compaction: support non-movable compaction for pageblock requests
ef765a2e4f579 mm/zswap: fix global shrinker when memory cgroup is disabled
3fd5023998630 mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec()
895cd4ecbb2e0 mm/pagewalk: fix stale walk->action escaping walk_pmd_range()
45489d4f95802 mm/mm_init: deferred_grow_zone(): fix out-of-range first_deferred_pfn
5dc0daff0341c mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()
3fc8044251de2 mm/kmemleak: avoid soft lockup when scanning task stacks
2cfa9ae90813b mm/gup: fix always draining LRU caches in collect_longterm_unpinnable_folios()
d423737dca23f mm, swap: ratelimit bad swap entry reports
f2c14f4d427d1 include/linux/list.h: mark list_add and __list_add as __always_inline
28069434aef66 apparmor: fix out-of-bounds write when null terminating a label vec
587a6a92b93ec apparmor: fix cred UAF caused by begin_current_label_crit_section()
753c978f2400f KEYS: trusted: Fix TPM teardown ordering
0a10989de6103 rust: kernel: list: fix incorrect pop_back example comment
138722d631acf rust: bug: skip arch-specific asm in `testlib` builds
2bf5e8f7c9bf4 timers/itimer: Zero-init old itimerval before copy to userspace
e6da8a0f39769 powerpc/pseries/iommu: switch to Default DMA window during kdump
c03114634d342 fs: fix user path of nested backing files
bf38be01d43c4 clocksource/drivers/timer-sun4i: Advertise a real minimum delta
d53c29a89a15e clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path
312f85fdd029b alpha: don't leak hardware-fabricated FP exception bits to user space
c25b2aa077d5b rust: time: fix as_micros_ceil() rounding near i64::MAX
7d00a3ff6244f alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally
4628e40c9ca79 drm/amd/display: Prune per-tile Timing from Apple Studio Display Primary Tile
7d860bed13369 drm/amd/display: hide Apple Studio Display secondary tile
c6b915f0df311 drm/amd/display: Refactor amdgpu_dm_connector_detect (v2)
a1fa3d1197cc2 drm/amd/display: Skip PHY SSC reduction on some 8K panels
d5c9d19b0ff2f netfs: Fix missing locking around retry adding new subreqs
ce493f9261cd3 platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmi_dev_evaluate_int()
2ab18de5ebb11 drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths
24ebaf6676ae4 nsfs: tighten permission checks for handle opening
ea150ffa9fc9f bpf: Fix incorrect pruning due to atomic fetch precision tracking
5d562153b4719 ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS
a8bbb2a60513b fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free
5fc3d921512d3 wifi: ath11k: fix memory leaks in beacon template setup
8527ac1bce87a wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req()
c79ef3342632e perf/x86/intel/uncore: Fix die ID init and look up bugs
1c732c6b94f0f Linux 6.18.49
5f08c45bdcfd2 usb: usbfs: fix use-after-free of usb_device in usbdev_release()
22edb67861272 wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb
b4cb8081cf80f USB: c67x00: fix use-after-free in c67x00_add_iso_urb()
683df50fff0f5 USB: serial: spcp8x5: drop broken carrier detect support
2ef5560387f2c USB: serial: option: fix slab OOB read in interrupt URB callback
6d3e202670b81 ALSA: usb-audio: Complete cleanup after system-resume errors
91919b3b99ab7 ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()
7eb02825b3684 usb: core: Strengthen error handling in hub_hub_status()
d80b946804674 usb: core: Add lock to usb_wakeup_notification()
935eeba276012 KVM: s390: vsie: zero stale crypto bits
545a6b9c91e2b crypto: qce - Remove unsafe/deprecated algorithms
182f16a20d329 crypto: mxs-dcp - fix source scatterlist length access
2f65718b9c109 crypto: qce - fix CCM AAD buffer underallocation
731a5b6fb4c17 crypto: krb5 - use kfree_sensitive() for derived key buffers
302ecd1106065 crypto: atmel-tdes - use scatterlist length before DMA mapping
4c00183209420 crypto: qcom-rng - Allow zero as a random number
14d9ee8286460 crypto: qcom-rng - Remove crypto_rng interface
070b73019a534 crypto: qcom-rng - Enable clock in hwrng case
5545de5050cbc crypto: virtio - bound the akcipher result length
e90bc78125cd7 kunit: irq: Continue increasing hrtimer interval for longer
34f3c35dd13a3 mm/swap: reject swapon() on filesystem-level encrypted files
6fa88d11983c6 netfilter: nf_tables: don't queue packet path object notifications
07ee91e6b7b0a netfilter: nft_set_pipapo_avx2: add missing vzeroupper
a8820c8a77183 vxlan: keep the last remote linked during FDB flush
916ec741e65af batman-adv: reject unrepresentable multicast TVLV offsets
3e4476e58343f ipv6: seg6: clear IPv4 control block on IPIP decapsulation
c069f29da7232 net: bridge: mcast: fix use-after-free of a master VLAN's multicast context
50229d334558a xfrm: bound nat keepalive state collection
cf67361e78dca xfrm: fix xfrm_state_construct() auth-trunc leak
6733ae71268a2 xfrm: ah6: validate routing header segments_left
5c86c895d1cac xfrm: avoid lock inversion in nat keepalive work
328e40aa774b4 xfrm: drop ESP-in-TCP packets with no ingress device
24efebecf415b xfrm: espintcp: fix UAF during close
73fde8fe4469f net/tcp-ao: fix use-after-free of current_key on reconnect to another peer
70051a57786d5 tcp: fix AO info use-after-free in tcp_ao_connect_init()
4527747760239 net/tcp: fix TCP-AO key deletion in VRFs
b5d1534db32af x86/CPU/AMD: Carve out a Zen5 models range
3d950e98f74af gtp: serialize PDP context updates
fadbc1ed2a872 tls: device: fix out-of-bounds write in tls_append_frag()
0b0a668febb62 KVM: SEV: Wire up kvm_x86_ops.gmem_xxx() if and only if CONFIG_KVM_AMD_SEV=y
9a45e7b0b140a KVM: SEV: Mark vCPU RUNNABLE after AP_CREATE, even if VMSA is unusable
a3d45c2d645c6 KVM: SEV: Extract loading of guest-provided VMSA to a separate helper
2de20fea62043 KVM: SEV: Track the GPA of the guest-controlled VMSA used for SNP guests
dd1638c95163d KVM: SEV: Drop FOLL_WRITE for encrypted region registration
85aa61fedcb4e usb: gadget: f_tcm: keep port count until LUN teardown completes
3f6face69034f usb: usbtest: disable dynamic ID support
776e85fda752f fuse: fix invalidate lock leak on open O_TRUNC DAX failure
1758730d9eaa3 fuse: fix invalidate lock leak on setattr writeback failure
0f127d522dbcb xhci: dbgtty: Fix unregister on tty_alloc_driver() failure
0d0faf3cc44c4 xhci: dbgtty: Fix unregister on tty_register_driver() failure
45dbddc389c59 usb: xhci: Handle USB3 port events when there is one roothub
56f20a406cc3b usb: xhci: Handle bogus TRB pointers in Missed Service Error events
9786c42df8efb accessibility: speakup: unregister tty ldisc on later init failures
8ec7271e05df7 fpga: dfl: fme: add error handling
6106fb7962a00 ksmbd: harden file lifetime during session teardown
a8e1f970f9040 HID: ft260: fix stack-use-after-return write in I2C read race
30c37ac21a458 HID: ft260: validate i2c input report length
8b5debb6252cd HID: asus: fix missing hid_is_usb() check
d0754db7883c8 HID: asus: simplify RGB init sequence
70589b0c005db HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event()
e22f4494cc948 io_uring: defer eventfd signaling when queued from a wakeup handler
0bcec5dda029c io_uring/rsrc: improve regbuf iov validation
e973a371d35a2 io_uring: simplify IORING_SETUP_DEFER_TASKRUN && !SQPOLL check
2b7c6b90ce801 io_uring/futex: only mark private futex waits as inflight
b61ebb2826ca1 powerpc/hv-gpci: fix preempt count leak in sysfs show paths
f2192741bdfc7 veth: fix OOB txq access in veth_poll() with asymmetric queue counts
34aef83af724a selinux: switch two allocations to use kzalloc_objs()
caacbfb367210 ASoC: nau8821: Cancel pending work before suspend
0599aa23734c4 riscv: Fix register corruption from uninitialized cregs on error
85dc711f742b1 bpf: Fix use-after-free in offloaded map/prog info fill
13d20517bee1c ASoC: nau8821: Cancel delayed work on component remove
9ebaeeb6c2d42 selinux: require a class's permission values to cover its permission count
dfc59a062c386 selinux: reject a permission value exceeding the class permission count
42c5747a9f839 selinux: more strict policy parsing
4ac3cc8a14db6 selinux: use u16 for security classes
71ecdc1ba07fd Revert "selinux: reject a permission value exceeding the class permission count"
64561afb42d83 nvme-tcp: fix usage of page_frag_cache
c0a9bd5fca0b5 KVM: x86/mmu: Check write tracking in all address spaces
8be5f23ae9490 drm/xe/guc_ads: use uncached mapping for UM queue BO
a65b52f6cdc92 drm/xe/guc_ads: allocate UM queues in VRAM on dGFX
af2d3f6f29b07 drm/xe/guc_ads: allocate UM queues in a separate BO
bdf5deccfbf9f RDMA/rxe: Fix OOB in free_rd_atomic_resources()
ffa4f0be69656 RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
---
.../linux/linux-yocto-rt_6.18.bb | 6 ++---
.../linux/linux-yocto-tiny_6.18.bb | 6 ++---
meta/recipes-kernel/linux/linux-yocto_6.18.bb | 24 +++++++++----------
3 files changed, 18 insertions(+), 18 deletions(-)
diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb b/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb
index 55f3fe8907..d4ca18a7b2 100644
--- a/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb
@@ -15,13 +15,13 @@ python () {
raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it")
}
-SRCREV_machine ?= "c82ff0cbda2a00b9073e06c9fe4ba550c9056d45"
-SRCREV_meta ?= "c8484925c85ec1e6510c75d9e1b36e01d6e2e904"
+SRCREV_machine ?= "ed7481e8a1df4a3417915acd6bef5a72d6fa71bb"
+SRCREV_meta ?= "bf8faf1b184fcf6c555ee951f501e76f88eccf35"
SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine;protocol=https \
git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.18;destsuffix=${KMETA};protocol=https"
-LINUX_VERSION ?= "6.18.48"
+LINUX_VERSION ?= "6.18.50"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb
index 3b1342d677..56a3d18ee5 100644
--- a/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb
@@ -9,7 +9,7 @@ require recipes-kernel/linux/linux-yocto.inc
include recipes-kernel/linux/cve-exclusion.inc
include recipes-kernel/linux/cve-exclusion_6.18.inc
-LINUX_VERSION ?= "6.18.48"
+LINUX_VERSION ?= "6.18.50"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}"
@@ -18,8 +18,8 @@ DEPENDS += "openssl-native util-linux-native"
KMETA = "kernel-meta"
KCONF_BSP_AUDIT_LEVEL = "2"
-SRCREV_machine ?= "ad9d5e451874e64e4e51093f3c9c6ca4426d3b0a"
-SRCREV_meta ?= "c8484925c85ec1e6510c75d9e1b36e01d6e2e904"
+SRCREV_machine ?= "aba8c69040fd3d5763477a733b4696a79c0514e1"
+SRCREV_meta ?= "bf8faf1b184fcf6c555ee951f501e76f88eccf35"
PV = "${LINUX_VERSION}+git"
diff --git a/meta/recipes-kernel/linux/linux-yocto_6.18.bb b/meta/recipes-kernel/linux/linux-yocto_6.18.bb
index 8030143479..719c1fa51a 100644
--- a/meta/recipes-kernel/linux/linux-yocto_6.18.bb
+++ b/meta/recipes-kernel/linux/linux-yocto_6.18.bb
@@ -17,25 +17,25 @@ KBRANCH:qemux86-64 ?= "v6.18/standard/base"
KBRANCH:qemuloongarch64 ?= "v6.18/standard/base"
KBRANCH:qemumips64 ?= "v6.18/standard/mti-malta"
-SRCREV_machine:qemuarm ?= "0f778c0a178fdc50063c212b5320b1f082f83f1a"
-SRCREV_machine:qemuarm64 ?= "ad9d5e451874e64e4e51093f3c9c6ca4426d3b0a"
-SRCREV_machine:qemuloongarch64 ?= "ad9d5e451874e64e4e51093f3c9c6ca4426d3b0a"
+SRCREV_machine:qemuarm ?= "dbe5ee845060d0b8ddf934a2e3d96627fdb1bd81"
+SRCREV_machine:qemuarm64 ?= "aba8c69040fd3d5763477a733b4696a79c0514e1"
+SRCREV_machine:qemuloongarch64 ?= "aba8c69040fd3d5763477a733b4696a79c0514e1"
SRCREV_machine:qemumips ?= "62ea92a539f58803a222be98b81118403074206e"
-SRCREV_machine:qemuppc ?= "ad9d5e451874e64e4e51093f3c9c6ca4426d3b0a"
-SRCREV_machine:qemuriscv64 ?= "ad9d5e451874e64e4e51093f3c9c6ca4426d3b0a"
-SRCREV_machine:qemuriscv32 ?= "ad9d5e451874e64e4e51093f3c9c6ca4426d3b0a"
-SRCREV_machine:qemux86 ?= "ad9d5e451874e64e4e51093f3c9c6ca4426d3b0a"
-SRCREV_machine:qemux86-64 ?= "ad9d5e451874e64e4e51093f3c9c6ca4426d3b0a"
+SRCREV_machine:qemuppc ?= "aba8c69040fd3d5763477a733b4696a79c0514e1"
+SRCREV_machine:qemuriscv64 ?= "aba8c69040fd3d5763477a733b4696a79c0514e1"
+SRCREV_machine:qemuriscv32 ?= "aba8c69040fd3d5763477a733b4696a79c0514e1"
+SRCREV_machine:qemux86 ?= "aba8c69040fd3d5763477a733b4696a79c0514e1"
+SRCREV_machine:qemux86-64 ?= "aba8c69040fd3d5763477a733b4696a79c0514e1"
SRCREV_machine:qemumips64 ?= "9fb4ff0187c85426f21fd40d4c61b742800f65c4"
-SRCREV_machine ?= "ad9d5e451874e64e4e51093f3c9c6ca4426d3b0a"
-SRCREV_meta ?= "c8484925c85ec1e6510c75d9e1b36e01d6e2e904"
+SRCREV_machine ?= "aba8c69040fd3d5763477a733b4696a79c0514e1"
+SRCREV_meta ?= "bf8faf1b184fcf6c555ee951f501e76f88eccf35"
# set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll
# get the <version>/base branch, which is pure upstream -stable, and the same
# meta SRCREV as the linux-yocto-standard builds. Select your version using the
# normal PREFERRED_VERSION settings.
BBCLASSEXTEND = "devupstream:target"
-SRCREV_machine:class-devupstream ?= "5bbb9c9f8f808710e2123f2b30f0d61d7d698f52"
+SRCREV_machine:class-devupstream ?= "7cfc41f8e80f11ffa8382ed1a505154ceffb79c7"
PN:class-devupstream = "linux-yocto-upstream"
KBRANCH:class-devupstream = "v6.18/base"
@@ -43,7 +43,7 @@ SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;name=machine;branch=${KBRA
git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.18;destsuffix=${KMETA};protocol=https"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
-LINUX_VERSION ?= "6.18.48"
+LINUX_VERSION ?= "6.18.50"
PV = "${LINUX_VERSION}+git"
--
2.43.0
^ permalink raw reply related [flat|nested] 13+ messages in thread
* [meta][PATCH 02/06] linux-yocto/6.18: update to v6.18.52
2026-09-17 5:13 [PATCH 0/6] linux-yocto: cosolidated pull request bruce.ashfield
2026-09-17 5:13 ` [meta][PATCH 01/06] linux-yocto/6.18: update to v6.18.50 bruce.ashfield
@ 2026-09-17 5:13 ` bruce.ashfield
2026-09-17 5:13 ` [meta][PATCH 03/06] linux-yocto/7.2: update to v7.2.6 bruce.ashfield
` (4 subsequent siblings)
6 siblings, 0 replies; 13+ messages in thread
From: bruce.ashfield @ 2026-09-17 5:13 UTC (permalink / raw)
To: richard.purdie; +Cc: openembedded-core
From: Bruce Ashfield <bruce.ashfield@gmail.com>
Updating linux-yocto/6.18 to the latest korg -stable release that comprises
the following commits:
8f3741e6feb04 Linux 6.18.52
0d0c637410df6 wifi: mt76: fix airoha_npu dependency tracking
637e0ea73f690 staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction
7d4024037ee30 staging: rtl8723bs: os_dep: avoid NULL pointer dereference in rtw_cbuf_alloc
7bca33d6f6e00 pinctrl: airoha: an7583: add missed gpio22 pin group
9aa021b63ab73 ACPI: processor: Add cpuidle driver check in acpi_processor_register_idle_driver()
4ba887b2bacc8 ACPI: processor: idle: Remove redundant static variable and rename cstate check function
e1cfb85ab258c ACPI: processor: idle: Move max_cstate update out of the loop
fcc577939931a ACPI: processor: idle: Remove redundant cstate check in acpi_processor_power_init
8ddc1da773644 cpufreq/amd-pstate: Allow writes to dynamic_epp when state isn't modified
9c178eba1542a cpufreq/amd-pstate: Use "epp_default_dc" as default when dynamic_epp is disabled
bf897a1fa96cb cpufreq/amd-pstate: Add support for raw EPP writes
b461ae97f2e44 cpufreq/amd-pstate: Add static asserts for EPP indices
8f8db9af24b9a cpufreq/amd-pstate: Fix some whitespace issues
a3d24aed0a3e7 io_uring/waitid: fix KCSAN warning on io_waitid->head
934ffdd1cdef2 io_uring/waitid: use io_waitid_remove_wq() consistently
798283cd0fe7b net/sched: fq: clamp quantum and initial_quantum in change path
9289c94fcfe04 Bluetooth: btmtk: hide unused btmtk_mt6639_devs[] array
2151b2bcf6fce tcp: reject non zerocopy devmem tx
384907f29dd1e ipmr: Add __rcu to netns_ipv4.mrt.
7708973e268c4 ipmr: Call ipmr_fib_lookup() under RCU.
5029156b99bd9 erofs: fix EFSCORRUPTED on multi-algorithm images in z_erofs_map_sanity_check()
a295f239dee45 erofs: relax sanity check for tail pclusters due to ztailpacking
bf8601feeb469 block: fix merging data-less bios
43a4c2afcb5ab blk-mq-dma: always initialize dma state
f54f709bfb5e4 block: save page offset gaps in cloned bio
0268313b5de3e integrity: Eliminate weak definition of arch_get_secureboot()
60aee9cbb82e0 apparmor: fix kernel-doc comments for inview
caf1e44e672b5 pinctrl: airoha: an7581: fix incorrect led mapping in phy4_led1 pin function
0ca274a45eaea pinctrl: airoha: Fix AIROHA_PINCTRL_CONFS_DRIVE_E2 in an7583_pinctrl_match_data
2e7c3c433fd79 pinctrl: airoha: an7583: add missed gpio32 pin group
46bae3189cf5c pinctrl: airoha: an7583: fix misprint in gpio19 pinconf
591424f9f5d51 pinctrl: airoha: an7583: fix incorrect led mapping in phy4_led1 pin function
cf2e698957b65 pinctrl: airoha: an7583: fix gpio21 pin group
6d0bcb2153128 pinctrl: airoha: an7583: fix phy1_led1 pin function
5331bf0d5ca05 pinctrl: airoha: an7583: remove undefined groups from pcm_spi pin function
fc00a596268a0 phy: renesas: rcar-gen3-usb2: add regulator dependency
e97bd4417010c perf annotate: Fix build with NO_SLANG=1
fe44ae31ca78a wifi: nl80211: fix UHR capability validation
3ca32b70e825f wifi: mt76: npu: Add missing rx_token_size initialization
b0af766d64bc2 wifi: mt76: restrict NPU/PPE active checks to MMIO devices
15a9acc5e6553 s390/kexec: Disable stack protector in s390_reset_system()
adf8f940e450d selftests: vDSO: getrandom: Fix path to s390 chacha implementation
dffea40a832bb cpufreq/amd-pstate: Fix setting EPP in performance mode
3b4b39f8bfb9b cpufreq/amd-pstate: Add POWER_SUPPLY select for dynamic EPP
c6584e98b60ee cpufreq/amd-pstate: Grab "amd_pstate_driver_lock" when toggling dynamic_epp
eee67e91751e0 cpufreq/amd-pstate: Return -ENOMEM on failure to allocate profile_name
c9d79e27eaefb cpufreq/amd-pstate: Reorder notifier unregistration and floor perf reset
70c8c8b50d80f cpufreq/amd-pstate: handle missing policy in dynamic EPP callbacks
be5d0964da97f usb: ucsi: huawei_gaokun: move typec_altmode off stack
65d97c3d9060f serial: 8250: Ignore flow control on suspend/resume with no_console_suspend
a79848859b1a8 platform/x86: lg-laptop: Check ACPI_COMPANION() against NULL
bd8946ddbe9a3 perf tests kvm: Avoid leaving perf.data.guest file around
3641a3aed2ecc tracing: Move d_max_latency out of CONFIG_FSNOTIFY protection
3e3fb150abad9 mtd: rawnand: pl353: Fix debug prints
9988c1c9e0d1c dm-integrity: fix buffer overflow with keyed discard
e54be9aa503a0 net/sched: sch_htb: limit htb_classify inner-class filter hops
b8f08a94b2a4a tcp: fix corruption of urgent data on multi-segment retransmit
ff7f77a234f7b usb: atm: usbatm: fix invalid ci_range initialization
1f9639caeece7 net: fec: only stop PTP if it was initialized
ddbc5dc5a2e29 slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()
1a5c26e586481 net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup
2ea42936416b2 net: stmmac: restore NET_IP_ALIGN in the RX DMA offset
6257ec22f6173 net: stmmac: selftests: Account for the UC filter list for filtering tests
f09abff67d1f2 net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering
edce4b5a76dd7 net: stmmac: dwmac4: Account for the primary MAC address for UC filtering
f64902e8ae1fa net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering
57f598f312f91 net: stmmac: selftests: Check multiple MMC counters
66cfb39635529 net: airoha: npu: fix missing streaming DMA mask
99036078abd96 selftests/arm64: Fix MTE prctl TAP plan
d3bb129dad152 selftests/arm64: Treat KSM merge_across_nodes as optional
1c6940784c556 selftests/arm64: Print missing MTE TAP headers
2f0c97b1a32fb ALSA: control: Don't add invalid kcontrols to LED layer
67dd5a6c449b4 netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited()
3b1066a859dbb netfilter: xt_HL: add pr_fmt and checkentry validation
d5497644329d3 netfilter: nf_tables: move hardware offload step after building the chain blob
0e5ed3b98d1d8 virtio-net: Ensure that TCP packets don't overflow gso_segs
023f06c98e031 drm/xe/xe_gt_idle: Add CCS to the powergating info print
c826e980f2767 net: stmmac: selftests: Pass the IP proto mask in the TC selftest
30be8c9d598f3 net: wangxun: use BIT_ULL() to prevent shift overflow on 32-bit archs
84180988a455f net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure
557599edb522a net: ethernet: sun4i-emac: Fix IRQ error handling
626614df9080d samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify
8de8e5476be39 samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-modify
6d1c6f228854a libceph: validate banner payload length
792bfe803228c ceph: revalidate ki_pos for O_APPEND writes after cap acquisition
33b3dc47202d0 ceph: Fix ERR_PTR(0) in ceph_mkdir()
10a36512c21f8 ASoC: dapm: Fix off-by-one check on the second enum channel
5449f715f24e8 apparmor: policy_int make sure list heads are initialized before fail path
59fba1d249dce apparmor: Replace sprintf/strcpy with scnprintf/strscpy in aa_policy_init
d48197cbd5d34 crypto: acomp - allocate async request context when cloning
fdc992f4bc45f tpm: st33zp24: Validate locality read result
14feaa498c20c tpm: st33zp24: Return zero on status read failure
96bc345a3f175 net/sched: sch_teql: restore skb->dev on the slave failure path
aeb8196ecb951 net/sched: sfq: clamp quantum to avoid signed overflow soft lockup
99770b5d8e0e1 net/sched: hhf: clamp quantum before hhf_change() to avoid overflow
044fa2498bbc2 net/sched: fq_pie: clamp default quantum to avoid signed overflow
7ca8a8717a9fe net/sched: sch_codel: clamp default mtu to avoid disabling CoDel
dfb4b61db8869 net/sched: fq_codel: clamp default quantum and mtu
f6b3e3848a5fc net/sched: fq: add overflow bounds to quantum and initial quantum
76c847e80d2b6 net: fix a resource leak in copy_net_ns() error handling path
d1c084d4e9f03 net: core: check skb_frags_readable before uncloning in skb_copy_ubufs
1719865b20b22 net/sched: act_skbmod: fix length calculations and avoid invalid header warnings
3e07d284ef085 selftests/proc: make proc-maps-race work with READ_IMPLIES_EXEC
4e70c064213ef maple_tree: fix argument name in header
64ae85a3a29de maple_tree: catch race in mas_alloc_cyclic()
005343e0c3294 selftests/mm: skip COW tmpfile cases when fallocate() is unsupported
3d1b2d84b4909 cifs: fix clearing stats for fastest execution of each smb2 command
b003d5b4e46ca octeontx2-pf: fix NULL deref of af_xdp_zc_qidx on rep setup
bf2b8130723ef net/rds: use wq_has_sleeper() in rds_cong_map_updated()
d218ea7df6eba net/sched: act_ife: Only operate on Ethernet frames
936e33035d54d net/sched: add qstats_cpu_drop_inc() helper
ab8e0164c0fee net: enetc: restore RX ring congestion mode after ring reconfiguration
276e747373170 octeontx2-af: Fix TL3/TL2 link config ENA clearing
7abe769e72c79 net: qualcomm: rmnet: restore skb->dev on deaggregated frames
42a139332ce81 octeontx2-vf: fix workqueue and netdev race in probe/remove
537e11a1700f6 octeontx2-af: fix NULL deref in NIX TM tree debugfs read path
7677eb2cbf2cc gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free
53a5b262d706b xsk: honor XDP_TX_METADATA in zero-copy path
5b913e87af4b2 xsk: align TX metadata layout across ABIs
aeee917a4878a Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop
a644b8df94966 Bluetooth: btnxpuart: Validate the FW dump header length
7b37556d7d801 Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path
566da1197d340 Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX
3818502f2f69d Bluetooth: btmtk: Do not discard the subsystem reset timeout
f3465a143c87c Bluetooth: btmtk: Do not report success when subsys reset fails
9fc4fd78bc650 Bluetooth: btmtk: Fix short read errors in btmtk_usb_reg_read()
5a2cb90e23587 Bluetooth: btmtk: Add MT6639 (MT7927) Bluetooth support
61d5ddbd524c7 Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan
c3f63610bceaa Bluetooth: mgmt: fix 'hdev->discovery.uuids' NULL dereference
87276dc15b559 Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN
00a73ce437e27 arm64: process: Fix context switching MTE store-only tag check
4a888ccb33d0c arm64: ptdump: Make note_page_flush() range aware
f365f36bbb5ac erofs: Fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS default logic
f30c8905abdae scsi: qla2xxx: Fix an loop timeout test
aa17842bbccae Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition
ff422b8597c28 syscore: Pass context data to callbacks
f7914ff92e4aa net_sched: sch_fq: fix pacing delay underflow with pacing offload
9c5d7bdb29ef1 net: page_pool: Remove zone/policy GFP flags when allocating XArray entries
b9838b655b708 net: libwx: fix concurrent bitmap overwrite in PTP setup
a13a63558e5c8 net: txgbe: fix MISC interrupt unmasking in non-MSI-X mode and device shutdown
38fa06f9ccccc net: wangxun: introduce WX_STATE_DOWN to serialize device shutdown state
6bf50b58f40d0 net: wangxun: schedule hardware stats update in watchdog
b1d311224479e net: wangxun: replace busy-wait reset flag with kernel mutex
71adad90236b1 net: txgbe: support RSC offload
80fd6d42f07ce net: txgbe: support RX desc merge mode
51fe3fe0ffec0 ptp: netc: fix period truncation and potential divide-by-zero in PEROUT
430afa27beb92 bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check
001ff5d8e68aa bnxt_en: Fix call to hardware monitoring event handler
012bebc861106 rtc: pcf85363: Add error checking to regmap calls in probe()
27f640cd92eeb NFSv4/pnfs: key the data server cache on the NFS version
3815b894b922e NFSv4.2: fix LAYOUTSTATS send buffer exhaustion
0879ea157acc1 net/smc: free pending qentry in smc_llc_flow_stop() before memset
0fb9a51376607 net/smc: free stashed qentry before overwrite in REQ_ADD_LINK to ADD_LINK transition
8b2d8c70b969b net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue
220cfdb17ff6a net: tcp: block mixing readable and unreadable frags
857681f6835d5 inetpeer: randomize RB-tree node comparison using SipHash
c7f9740f7a1b2 ip6mr: plug drop_reason to ip6mr_cache_report()
38778f6abdbda ipmr: Free mr_table after RCU grace period.
65f87de5f3c3b net: change sock_queue_rcv_skb_reason() to return a drop_reason
84264cb4e541f ipmr: Remove RTNL in ipmr_rules_init() and ipmr_net_init().
53eefb9db0b27 ipmr: Convert ipmr_net_exit_batch() to ->exit_rtnl().
b30f0801b9187 ipmr: Move unregister_netdevice_many() out of ipmr_free_table().
4012a0656797d ipmr: Move unregister_netdevice_many() out of mroute_clean_tables().
4be733a450c86 net: qlcnic: validate unified ROM sections before loading
bf87e4c1e58a0 net: add missing ref_tracker_dir_exit() to net_passive_dec()
f30cf8fd98722 ipv6: avoid divide by zero in rt6_multipath_rebalance
b8f32b0804b4b netdevsim: update queue NAPI association on queue reset
9d7b6916d5f85 net: ipa: balance runtime PM reference on remove error
5a66873d04b0f forcedeth: stop the tx_timeout register dump past the requested window
bcf88c039af86 net/mlx5: E-Switch, preserve max tx speed on vport state modification
38354e591e3ef net/mlx5: Move vport DOWN state check out of mlx5_query_vport_max_tx_speed()
55d18f3ead831 net/mlx5: Skip disabled vports when setting max TX speed
6f4adc05c788d RDMA/mlx5: Implement query_port_speed callback
9137881591f22 IB/core: Add query_port_speed verb
0864bab42677c IB/core: Add helper to convert port attributes to data rate
361dfb9322fdc net/mlx5: Add support for querying bond speed
70cd46d12d7cc net/mlx5: Handle port and vport speed change events in MPESW
e59b430283455 net/mlx5: E-Switch, use state lock for vport state changes
99300ea5c4365 net/mlx5: Propagate LAG effective max_tx_speed to vports
409dc14183ad1 net/mlx5: Add max_tx_speed and its CAP bit to IFC
4d3fb6977248d net/mlx5: E-Switch, support eswitch inactive mode
ed246bad28d4e net/mlx5: MPFS, add support for dynamic enable/disable
01677786ed4f0 devlink: Introduce switchdev_inactive eswitch mode
ec750e1f82385 net: thunderbolt: Count delivered packets in rx_packets and rx_bytes
ac2201b484822 net/sched: add get_fill_size callbacks for actions missing them
c0444d7499f11 net: bridge: Reject descending VLAN tunnel ranges
214fb79b0379c xsk: fix NULL pointer dereference in __xsk_rcv()
4585691b28614 xsk: avoid double checking against rx queue being full
5f02599590a4e irqchip/irq-realtek-rtl: Use readl_be()/writel_be() instead of readl()/writel()
5aa7bbe0bac89 irqchip/irq-realtek-rtl: Add mask for interrupt handling
2aa9fcf31f387 irqchip/irq-realtek-rtl: Add interrupt data structure
421615e833d73 irqchip/irq-realtek-rtl: Split out parent setup code
f7d818afcc225 irqchip/irq-realtek-rtl: Add multicore support
a9be529935266 irqchip/irq-realtek-rtl: Add/simplify register helpers
94834742ef195 smb: server: remove unused DES crypto header
72a3e6e0c8248 smb: server: Remove obsolete "select CRYPTO_LIB_DES" from Kconfig file
392c985c6b03d ALSA: mtpav: shut down output timer before card teardown
bfce0f324efaa spi: amlogic-spisg: Make sure clk_init_data is fully initialized
4d99a477e61fc RDMA/ucma: Allow path records to exactly fit the output buffer
b15782627b656 ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup
735384a9dd599 ALSA: core: Add scoped cleanup helper for card references
dca93566f0e20 irqchip/gic-v5: Use logical cpu 0 irs_data for dynamic IST allocation
265fdce1efb1b irqchip/gic-v5: Fix gicv5_init_common() error paths
76ed544059cae irqchip/gic-v5: Check for NULL LPI domain on domain teardown
099772e948cc7 irqchip/gic-v5: Synchronize CPU interface disable
8f7980033e9f7 clk: visconti: Make sure clk_init_data is fully initialized
58c368552f830 clk: ti: Make sure clk_init_data is fully initialized
41c2ccf0d740e prctl: fix PR_SET_MM_AUXV losing the forced AT_NULL terminator
589f8d44c9dca lib/interval_tree: fix allocation warning messages
5a8f18a7d3691 rtc: gamecube: check return value of devm_rtc_register_device()
fdc4b500071a2 i2c: ocores: Disable clock on failed resume
38c6831fefde0 irqchip/renesas-rzg2l: Fix loss of interrupt
367dbc320b27d rtc: zynqmp: Return optional clock lookup errors
dbaca07f78a82 cifs: remove dead size-update blocks in cifs_setattr_unix/nounix
442c5f1358ced smb: client: fix request buffer leak in smb2_new_read_req()
6fd823a8872dc rtc: spacemit: handle regmap_test_bits() error return
08a59c28c2bdb rtc: pcf8563: fix clock provider leak on unbind
28701b74c22d2 virtio: rtc: time out alarm requests
6ca752850de3b vdpa/mlx5: fix wrong list iterated in add_direct_chain error path
4d059e7af5e92 virtio_pci: fix wrong queue index for admin vq in intx path
4f723111a852b vhost/net: fix clear_user start address in VHOST_GET_FEATURES_ARRAY
6dd28e32f4d81 virtio_balloon: quiesce balloon work before device shutdown
808b1751540dd virtio_balloon: factor out virtballoon_quiesce()
0d7b20057d4fd virtio: add virtio_device_shutdown() helper
68b726b3a01fb vdpa_sim: fix cleanup after worker creation failure
8b3edaa10a303 virtio_balloon: disable indirect descriptors
5fe03b5257095 net: add missing ref_tracker_dir_exit() to alloc_netdev_mqs()
4f80425ad5a06 bonding: initialize err for empty target lists
795e7b3a356e8 mlxbf-bootctl: fix the build error with FIELD_PREP()
2c09cadec116e platform/x86/amd/hsmp: Reject negative power cap writes in hwmon
ace1ba5fca0ab platform/x86: hp-bioscfg: fix password encoding bounds check
4d35c6d698085 vsock: use sock_error() to consume sk_err after a failed connect
36e5fa009f98a vsock: don't check the listener's sk_err in vsock_accept()
06c95182234ae vsock: avoid timeout for non-blocking accept() with empty backlog
df8f661b4f329 platform/x86: dell-wmi-sysman: Fix instance ID bounds
3e8fe6503d0c1 net/smc: hash socket only after full initialisation in smc_sk_init()
6ea95c886d703 8139cp: fix Rx and Tx not being disabled in cp_suspend
3e6b705bc162f vxlan: mdb: Fix use-after-free in vxlan_mdb_flush()
5f22943cd2c84 ALSA: hda: Fix connection list comparison in proc output
a5129155ca9fb fuse: check for NULL root inode in fuse_fill_super_submount
5559dd7888d2c soc: qcom: ubwc: Fix missing include
aab1880058ac7 fs/ntfs3: validate ef->size covers the record's name and value
74a83aa05f730 fs/ntfs3: fix out-of-bounds read in read_log_rec_buf()
389bd349ddbcf cuse: wait for pending RCU callbacks on module exit
fdb9cd16f8b6e net: bridge: vlan: fix inverted default vlan notification
a34d2e0bfb74a tls: fix RX desync on overlapping skbs
f3b6834c13edd net: dsa: mv88e6xxx: Fix PCS link check on CMODE read error
daebc7064a1b4 vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes
4aed450adaee3 ipvs: fix integer overflow in ftp helper port/address parsing
448f505e19241 f2fs: fix to avoid pinfile fragment on fragment:{block, segment} mode
32ee27946f097 f2fs: cleanup w/ f2fs_need_rand_{blk, seg, seg_blk}
dd5d8f4a9c67f f2fs:Fix incomplete search range in f2fs_get_victim when f2fs_need_rand_seg is enabled
65702339b3e9f net: hsr: free learned nodes on device setup failure
54bc96aeee050 pppox: drain queued packets on channel handoff
fb511bf117edd net: dsa: b53: fix error propagation from b53_fdb_dump()
292846223eadd net: kcm: Hold RCU read lock while running BPF parser
31fbed0b409a6 ionic: fix completion descriptor access with 2x desc size
3ec0225b9d750 ptp: netc: skip PEROUT disable if channel is not enabled
00f1000a644e8 drm/xe: tests: fix error message in xe_migrate_sanity_test()
e794cdc5c369c hinic3: Fix skb linearization mismatch and drop skb when skb_checksum_help() failed
c0f208d8a5726 octeontx2-af: initialize lmac_bmap in rvu_mcs_set_lmac_bmap()
ea7b35dcc9430 bpf, xdp: move offload check into dev_xdp_install()
9e5e2ccc51dfc clk: ti: mux: resolve parent clocks by DT index, not by name
9d4843f105125 clk: devres: fix cleanup in devm_clk_get_optional_enabled_with_rate()
4c067f5ffb469 nfs: fix ENXIO on O_CREAT open of existing symlink over NFSv3
d148a652d52fd NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease()
163c16e01f53f NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers
1e1c36b206c65 pnfs/blocklayout: Fix device leaks on parse failure
3f2387e8bfbc4 NFSv4: remove callback IDR entry on client allocation failure
4c59aca79da0e nfs: refactor pNFS functions using clear_and_wake_up_bit
8179b8a1d636b nfs: replace atomic bitops sequence with clear_and_wake_up_bit helper
b967a595fb735 smb/server: fix session leak in ksmbd_session_register()
a4a307d149327 ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size
a21597b5730bc ksmbd: disconnect on SMB3 decryption failure
2bdbe00454200 bpf: Reject negative optlen in cgroup getsockopt hook
be98f92fc2446 m68k: nfcon: Do not call console_is_registered() in nfcon_device()
fe91c3f64a738 bpf: Disallow bpf_{g,s}etsockopt() in cgroup UNIX getname hooks
64eec7314e289 erofs: fix unused pcluster_pools for higher page sizes
7cf561843ed0a lwt_bpf: Restore reserved headroom after xmit program
a3d6e590268ee erofs: guard on-disk algorithm IDs against Z_EROFS_COMPRESSION_MAX
ddb7ea4fd99bf erofs: fix interlaced ztailpacking pclusters
7f10dc9a7a496 erofs: error out obviously illegal extents in advance
169f6633d2a35 erofs: clean up encoded map flags
892048f595505 smb/server: preserve error status in smb2_handle_negotiate()
b2d78c199dfd9 smb/server: fix invalid pointer dereference in ksmbd_stop_durable_scavenger()
8461f27902727 smb/server: fix null-ptr-deref in ksmbd_ipc_tree_connect_request()
a41a98ee16ae0 ksmbd: free preauth sessions on connection teardown
9f37719d6be82 ksmbd: do not advertise unimplemented CA support
0aa8f94bfd4d8 ksmbd: validate ipc response length before dereferencing its fields
7a98c3b903b10 smb: server: fix leak of ksmbd_ipc_login_request_ext() returned buffer
84c2d8e807ac4 ksmbd: Do not skip lock checks for single-byte ranges
db141a5ebcb04 hwmon: (emc1403) Drop hysteresis for low limit temperature
c38cc41bb9dc2 hwmon: (emc1403) Rely on subsystem locking
86c1617b7d4b0 hwmon: (coretemp) Fix core_data leak on CPUs without PTS
00cce5e457cb6 apparmor: fix deadlock in complain-mode change_hat
4609e0e0be709 block: mtip32xx: synchronize ioctls with device removal
7e3e5273fc9ec ublk: reject non-power-of-2 zone sizes in SET_PARAMS
32456a8599557 null_blk: serialize configfs attribute updates with device setup
65cae82fd3c39 null_blk: serialize configfs attribute stores with the lock
3e35ad503386a null_blk: reject per-device queue resize for shared tag set
b2437d37fcc31 null_blk: free zones array on device power-off
2b59484ac1e64 null_blk: free global tag_set on init error path
d761be1b8f2bb null_blk: register configfs subsystem after creating default devices
c7dea90c9b4ef null_blk: use DEFINE_MUTEX for the file-scope mutex
cbc24bce70dfd mailbox: riscv-sbi-mpxy: validate RPMI notification lengths
1bd910aae6abd mailbox: pcc: Fix command timeout due to missed interrupt
d255b6575650b mailbox: rockchip: disable pclk on probe failure and unbind
413b0b94d6d06 mailbox: qcom-cpucp: handle NULL data in send_data callback
8b8de6400c869 mailbox: qcom-cpucp: fix PREEMPT_RT self-deadlock in IRQ handler
eb05c19dfb36d perf dso: Replace assert with runtime check in dso__read_symbol()
ac09bbbde1d49 perf dso: Guard against cache underflow on short reads in dso_cache__memcpy()
d3eaeabc08ae9 perf dso: Use stored fd error instead of stale errno in file_read() and file_size()
dd9560c7b46e2 perf dso: Guard close() against invalid fd in dso__decompress_kmodule_path()
b40859b325772 perf dso: Guard against errno==0 when dso__get_filename() returns NULL
b8f8642178656 sched_ext/scx_flatcg: Fix cvtime true-up on slice expiry
9d634e8f9e20a crypto: lskcipher - propagate errors from unaligned crypt
8c9b0a3a6d27f crypto: hisilicon/sec2 - fix CCM algorithm long packet failure
efcfda20b7b7f selftests/sched_ext: Fix flaky ddsp failure tests on busy systems
6b019f0daa613 bpf: Fix pending_pos walk on 32-bit ring position wrap
15512c6b5dea7 ACPI: scan: fix bus ID cleanup on device_add() failures
04a43c321e106 ring-buffer: Remove trace_buffer::cpus
801ae90f8ce09 riscv, bpf: Fix missing sign-ext for signed 1-byte and 2-byte kfunc args
5a19c3fccc7e3 selftests/bpf: Use ping_command() for IPv6 pings in lwt_ip_encap
17a4dd3b0e6da selftests/bpf: Add tests to verify the fix of encapsulating VxLAN in lwt
54bff7c8e410a HID: multitouch: reclassify HTIX5288 to WIN_8_FORCE_MULTI_INPUT_NSMU
d2f41287b51a3 ASoC: SOF: validate topology volume range before allocation
e30214289e623 tracing: Have trace_event_update_all() only handle module that is loading
324cc98b71f0d HID: haptic: don't write an uninitialized value to unhandled usages
a561012868ae3 ALSA: core: Fix use-after-free in snd_card_do_free()
ce9a619c432b9 fs/ntfs3: reject out-of-range evcn in mi_enum_attr()
dc6d85de7e265 fs/ntfs3: fix integer overflow in MFT cluster validation
863e10c4508cf bpf, arm64: Fix stack-passed arguments for indirect trampolines
424a9fc4876cc net: page_pool: fix UAF in __page_pool_release_netmem_dma on xa_cmpxchg race
e44b3b35bb153 scsi: ufs: core: Set task state before io_schedule_timeout()
2dbdd025b2281 scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers
b6273cd8dc55f selftests/bpf: Fix for veristat file/prog filters processing
d0a3729d464fc Squashfs: check block offset is not negative
f8747d81aa6d3 ocfs2: fix circular locking dependency in ocfs2_init_acl()
e35fa6eb4d2a3 ocfs2: validate DIO orphan slot during inode read
c6c908f9b4edf ocfs2: validate orphan slot during inode read
508907eb8ea4a bpftool: Fix double close in map dump
b000458cab958 x86/pkeys: Fix pkey_alloc() return value when pkeys are not supported
0ef3f5629051f selftests/cgroup: Preserve CPU hotplug write errors
210c193a9ef13 ALSA: seq: midi: Serialize input teardown with event_input
5c94ea1e64d3b ALSA: seq: midi: Optimize event_input locking with RCU
1f6d28c428cae clocksource/drivers/armada: Unwind timer clock on init failure
fa0901c1c5551 clocksource/drivers/clps711x: Do not unmap clocksource MMIO
5d83f3faa3fb7 s390/debug: Fix deadlock during unregister
e0cb87f438854 xenbus: Unregister reboot notifier on init failure
ac7b10121140a power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address
b3827f2e7b609 power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address
2f890ba8521f7 power: supply: bq27xxx: bq27520g4: fix REG_TTES address
7d181b48da3ff power: supply: bd99954: Drop bad register fields
3ab6f4eccbbf5 PCI/ASPM: Disable/restore ASPM on every function for multi-function devices
a3040b9e90eb4 spi: img-spfi: don't disable runtime PM on DMA deferred probe
41849630000ec selftests/bpf: vmtest.sh: Preserve command quoting when running in the VM
5e41939ae4929 selftests: harness: Mark test fixture objects __maybe_unused
d97cb1421c944 selftests: harness: Restore order of test functions
e17ba89f8b78f kunit: tool: fix _list_tests filtering wrong variable when list has TAP prefix
afc211a293999 perf build: Remove leftover feature tests for removed cxx and clang support
1e94e67483e01 super: fix dying superblock warning messages
c01652db11c29 PCI/ASPM: Use pcie_capability_clear_and_set_word() for ASPM disable/restore
d6037e42aa4dd firewire: core: fix memory leak in error path of build_tree()
4679bf3517cec firewire: core: validate parent port count before allocating nodes in build_tree()
861e6dd1f5939 firewire: core: consolidate port counting in build_tree()
6d2eba5cdb815 firewire: core: add KUnit tests for failure of tree building
d7d075f17d612 firewire: core: add KUnit tests for successful tree building
b5d3c30d03dbc firewire: core: add KUnit test skeleton for node tree
3216ff97d329a UBI: fix two issues in the ubi.mtd MODULE_PARM_DESC
8b30628dfc2b2 ASoC: xilinx: formatter_pcm: fix stream_data leak on open error
e065960366b55 mtd: ubi: Release device reference on busy detach
e3f7e58189bc2 ubi: Fix rollback for explicit UBI device numbers
e6d77e2ea55f1 UBI: fastmap: Pass to_be_tortured when reusing old fastmap PEBs
34b180031021f UBI: Preserve torture flag when rescheduling failed erasures
e06806a8f4cf2 ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready
efc40977e7104 ASoC: pxa: Use devm_clk_get_optional() for extclk clock
99c554f193478 idpf: add missing cpu_to_le32 in idpf_tx_splitq_build_flow_desc
f06d77436aab6 ice: acquire NVM lock around each flash read
42ff18e407e9c ice: refactor to use helpers
c0fcef8e24a8b ice: clear the default forwarding VSI rule when releasing a VSI
f5071e3ad4ca3 ice: fall back to SBQ when LL PHY timer interface times out
544e40805dbb6 RDMA/cma: Fix WARNING in res_to_rt
046425412529d RDMA/cxgb4: Free debugfs on registration failure
3c9c9b56fbaff dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal
b1e8d40663997 ALSA: seq: Don't leak the extension cell pointer in the bounce payload
4f0483bbcdacc nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing
9cfe74542b544 nfc: digital: Do not dump a NULL response in command completion
7a8e0a7aef807 nfc: pn533: hold a reference to the request skb during send_frame
749a9048bf51a nfc: llcp: bound SNL TLV parsing to the skb and add length checks
ba4c776af3dc2 nfc: nci: fix double completion race in nci_data_exchange_complete
156e65bd29307 nfc: llcp: read llcp_sock->local under the socket lock in getsockopt
8bf228fa02b1e nfc: llcp: avoid userspace overflow on invalid optlen
4b59f93cf4baa nvme: reject passthrough of driver-managed Set Features
736b7c6adc7a6 nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()
1fb1236312ee1 nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns()
a2cf452ba7109 nvme-apple: Drop the PRP null check chicken bit
311e4e21ffd41 nvme-apple: Require page aligned buffers on the admin queue
5ee7e381b1bc8 nvme: Add a quirk for page aligned admin queue buffers
25c76e0c07f2a nvme: expose active quirks in sysfs
95e93ee7053b8 nvme: remove virtual boundary for sgl capable devices
85571e5a37ff2 block: accumulate memory segment gaps per bio
897184def60c9 nvme-apple: Never set the opcode in the NVMMU TCB
751e8e18be0a4 nvme-apple: Don't set a DMA direction for commands without a data transfer
215d1682f0bae nvme-apple: Destroy the admin queue on removal
c38a818632679 nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()
cb30449ee9a9c nvme: Add the DHCHAP maximum HD IDs
a3453d50130cb s390/irqflags: Add out-of-line definitions of arch_local_irq_*() for KMSAN
af20646a329e6 s390: Drop unnecessary CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT
283d2d61c4a3b integrity: Make arch_ima_get_secureboot integrity-wide
d408d69f92b8c arm64: bti: Disable in-kernel BTI with recent versions of Clang
bc34d10432303 ASoC: qcom: q6apm: keep the graph start count in sync with the DSP
79c05936be12c spi: sprd-adi: Fix probe succeeding without registering the controller
b68d3a7a14585 phy: qcom: qmp-combo: Drop qmp_v4_calibrate_dp_phy
b499e89a828ed phy: qualcomm: qmp-combo: Add DP offsets and settings for Glymur platforms
becb8b30d9da6 phy: qualcomm: qmp-combo: Update QMP PHY with Glymur settings
e1ce0661c0ce8 phy: qualcomm: Update the QMP clamp register for V6
aa615671f486a phy: qcom-qmp-combo: Use regulator_bulk_data with init_load_uA for regulator setup
660b56537e180 phy: qcom: qmp-combo: Correct pre-emphasis table for QMP v4 DP PHYs
31b8b620a8aa1 phy: renesas: rcar-gen3-usb2: Ignore missing VBUS regulator
832022bb2ba5a rust: uapi: replace direct asm-generic/ioctl.h include with linux/ioctl.h
218c36fdd5c63 iommu/amd: Fix incorrect device ID in invalid PASID error message
7d1099b86356d apparmor: fix unconfined user namespace restriction forced stack
07485821b20b2 apparmor: change fn_label_build() call to not return NULL
ab64b1584a905 apparmor: split xxx_in_ns into its two separate semantic use cases
c7f53d35455d1 powerpc/configs: enable CONFIG_RAS to fix EDAC support
569eb11f09908 amt: Don't support cross-netns setup.
6033cc02fe27d selftests/sched_ext: Check skeleton open failure in exit test
f1872cddf12ab cgroup/cpuset: Use WRITE_ONCE() for shared prs_err updates
474da0e00d0c9 cgroup/cpuset: Fail if isolated and nohz_full don't leave any housekeeping
4fd62a9418ab9 cgroup/cpuset: Rename update_unbound_workqueue_cpumask() to update_isolation_cpumasks()
c25b6b28a35f9 nvme-pci: release descriptor pools on probe failure
9e489dc3fbbf4 nvmet: propagate percpu_ref_init() failure in nvmet_ns_enable()
33f07f8fbb9cb nvmet: fix Reservation Register Replace for unregistered host with IEKEY
da652cb17f9fa sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE
cda4aacfb0bbf SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6
7d0554350d884 hwmon: (cros_ec) Synchronize EC access from the thermal device callbacks
13ad7a04b97a6 hwmon: (cros_ec) Store the hwmon device in cros_ec_hwmon_priv
49390d9d8eaf0 hwmon: (cros_ec) Register the thermal devices after the hwmon ones
786409d4dcd1b hwmon: Support guard() and scoped_guard for subsystem locks
1a010fcc0f1b0 hwmon: (cros_ec) Add support for temperature thresholds
14ec266275419 hwmon: (cros_ec) Move temperature channel params to a macro
6fa77dea178e7 hwmon: (cros_ec) Split up supported features in the documentation
28e9bcb654f19 arm64: Disable KCSAN instrumentation in delay.o
0f7f363cc6ceb xdrgen: Fix opaque and string encoders for unbounded members
97c12f3e24e7d xdrgen: Do not declare union XDR functions in the definitions header
184a3e5bbc01b xdrgen: Address some checkpatch whitespace complaints
221a025fb6aa6 m68k: Fix backtraces for non-running tasks
0fdc6aaea2965 hwrng: imx-rngc - Disable clock on registration failure
5067a5fbbd025 crypto: qat - remove dead ADF_HEX code
0c68bf6b4842e crypto: qat - use 2-arg strscpy where destination size is known
a803141597d61 iommu/vt-d: Flush context cache with correct SID when tearing down aliases
d0e978ced7429 iommu/vt-d: Tear down scalable-mode context on probe failure
3c88cfedc7768 iommu/vt-d: Clear Present bit before tearing down copied context entry
686bd59429ffe iommu/vt-d: Fix UCTP context table slot when copying root entries
e3c53e9173a47 iommu/dma: Restore locking around msi_page_list
7508654e409ed fbdev: clps711x-fb: Remove unreachable unregister_framebuffer() call
33e54e3e0b2ca fbdev: kyro: Validate overlay viewport coordinates
656e580c19ca1 fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device()
656e43f7afabb perf synthetic-events: Fix divide by zero in perf_event__synthesize_threads
e0b01aedf85f8 perf python: Fix memory leak in pyrf__metrics_cb
9eebbaf7a33be perf python: Validate CPU and thread maps in pyrf_evsel__open
ce4c4c03ef5bd perf python: Handle Py_None for thread and cpu maps
2fef75555c0aa perf python: Check counts_values size in set_values
aba46bc65e083 perf test: Fix skiplist leak in cmd_test
02ffce64f7ad6 perf test: Support dynamic test suites with setup callback and private data
122c64347d9a4 perf synthetic-events: Fix uninitialized pthread_join
a9ee5e8eae20d perf stat: Fix evsel_list leak in cmd_stat
b567e25ffda7b ARM: dts: helios4: add SATA regulator supplies
37dac96549d91 ARM: dts: helios4: add vcc-supply to GPIO expander
5934c1c867070 ARM: dts: helios4: add vcc-supply to EEPROM
19ebf0422fe91 arm64: dts: turris-mox: fix usb3 phys
c2178137a7893 i3c: renesas: Don't register devices when ENTDAA times out
8ca083c0fe2c2 i3c: renesas: Follow a unified pattern for transfer and command initialization
4e2b33373a0f3 i3c: renesas: Return immediately if there is no transfer
a052ad5edccf5 bpf: Fix mmap_lock leak in irq_work path
cc1c1c70d203a bpf: Avoid faultable build ID reads under mm locks
b25ce833d8f12 bpf: Factor out stack_map build ID helpers
c1d79bb9c4662 riscv: cpufeature: Clarify ISA spec version for canonical order
bbe2fd6d77df6 net/sched: cls_api: fix teardown of an adopted proto on insert-race loss
457ee7219c9ee iio: light: gp2ap002: re-enable irq if runtime suspend fails
0fc740c25c9ab iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes
1ab7ef7ccfb86 iio: light: opt4060: Fix pointer type passed to div_u64_rem()
1ab3da12061d7 bpf, cgroup: Fix storage null-ptr-deref after replacing prog
7c2658023d839 Bluetooth: MSFT: validate evt_prefix_len against the response length
7efd7fb4c9c77 Bluetooth: btmtksdio: fix usage_count leak when autosuspend_delay is negative
e1fc9c5878f03 Bluetooth: btmtk: add MT7902 SDIO support
534d3efd59b3c Bluetooth: btmtk: add MT7902 MCU support
c00556fbe75eb mmc: sdio: add MediaTek MT7902 SDIO device ID
e0cd7b34dc6b5 Bluetooth: MGMT: free the HCI command when it is cancelled
05438d338a875 Bluetooth: MGMT: free the mesh send cancel command when it is cancelled
9c3b6c1413bd0 Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths
c1fe3c74a89a7 Bluetooth: hci_conn: fix the SCO setup context lifetime
2f907608cbcfc Bluetooth: btintel: Fix diagnostics event detection
be1e3df2c49c9 Bluetooth: virtio_bt: avoid OOB read of build info string
244d029900814 pinctrl: airoha: fix edge-triggered interrupts handling
c7596135e7e9a pinctrl: airoha: fix IRQ mask/unmask code
fda7350f257e5 pinctrl: airoha: add missed IRQ resource helpers
9ea692247ee24 pinctrl: airoha: fix getting gpiochip/pinctrl pointers in the IRQ handling code
f3b8fe04dbfe3 pinctrl: airoha: add missed get_direction() function for gpio_chip
7d2b3f8a996d1 pinctrl: airoha: an7583: fix spi group pins
38a2a4d6c7ac7 pinctrl: airoha: an7583: fix muxing of non-gpio default pins
2313f262999c7 pinctrl: airoha: an7581: fix mux/conf of pcie_reset pins
2ad2147082592 pinctrl: airoha: fix pwm pin function for an7581 and an7583
cfe4350fdcb53 pinctrl: airoha: convert PWM GPIO to macro
fa27ddca66022 pinctrl: airoha: an7583: fix I2C0_SDA_PD register bit order
cbde1169bdd2c pinctrl: airoha: an7581: fix pinconf of i2c_scl/i2c_sda pins
75ceddfa7df7e pinctrl: airoha: fix mdio bitfield names
4bf51df55d7bd pinctrl: airoha: add support for Airoha AN7583 PINs
74c2c5b459b42 pinctrl: airoha: convert PHY LED GPIO to macro
e6edde29990af btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data()
b0059242735ea btrfs: avoid GFP_ATOMIC allocations in qgroup free paths
f44616db1dbce btrfs: use aligned range for locking in extent_fiemap()
92484ad014f2e btrfs: zoned: don't clobber the extent buffer when zeroing it out
12b6d1a1715cb btrfs: retry verity reads for not-uptodate Merkle folios
58ce50b1802a4 btrfs: always wait for ordered extents to avoid OE races
76b7c505c74f4 btrfs: merge setting ret and return ret
8a34b30bd1bfc btrfs: make btrfs_repair_io_failure() handle bs > ps cases without large folios
a9701dd06e82c btrfs: defrag: fix deadlock between defrag and delalloc space reservation
34f67cfb15fa5 scsi: sd: Fix sd_done() sense handling condition
8bd807995dd5d perf trace-event: Fix integer truncation in do_read() and skip()
14470bc005ec6 Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices
4ea16cbcc58e3 Bluetooth: btusb: Record matched usb_device_id into btusb_data
5ca4aa51ab378 Bluetooth: btusb: refactor endpoint lookup
dc849d11a7d2b Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855()
4ea53de3e47fa Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event
1403beab27c64 sched/fair: Check CPU capacity before comparing group types during load balance
ce065b76c89cb sched/fair: Also gate overloaded status update for SD_ASYM_CPUCAPACITY
cab5015ee3f25 perf/x86/intel/pt: Fix stop/start with no update
b53e430f8eab8 perf/x86/intel/pt: Use bitwise access for PERF_HES_STOPPED
ad9d3402f4b05 perf/x86/intel/pt: Factor out pt_config_enable()
54eb9b2d18f8b ACPI: video: Release PCI device reference after lookup
679b862781010 regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling
053ec85cb9f26 bpf, arm64: Fix exception table metadata for arena load-acquire
415257c38a3fc bpf, x86: Fix exception table metadata for arena load-acquire
5f13a844d0c9b bpf, riscv: Add and use bpf_atomic_is_load_acq() helper
c4c8de3bf48d3 bpf: Reject load-acquire from pointers requiring fault protection
57b72442c1672 perf: arm_pmuv3: Zero initialize hw_id branch stack field
f61f65fc81dcd coresight: Refactor etm4_config_timestamp_event()
9e804dbe28b74 coresight: etm4x: fix leaked trace id
1ade9a335c69f coresight: etm4x: fix underflow for usage of (nrseqstate - 1)
9241edfb84a0d coresight: Change syncfreq to be a u8
a29d753e9d83b coresight: etm4x: fix wrong check of etm4x_sspcicrn_present()
f9cdb5bb8efbf md/raid1: don't set array_frozen in raid1_takeover()
c55aa6c17f019 md/md-llbitmap: stop daemon timer rearm on destroy
930cc4f1af5a1 md/md-llbitmap: prevent create failure bitmap UAF
d81822fd5fa81 md: avoid stale clone I/O accounting timestamps
73881ff7a7591 md: wait for behind writes before destroying bitmap
02c10581866d0 md/raid5: round bitmap stripes with sector division
d2c069ddaec79 phy: qcom: qmp-pcie: Add pcs_lane1 offset to V5 offsets
5547fd950d6bf phy: qcom: qmp-usb: Fix possible NULL-deref on early runtime suspend
61749681e4a36 phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend
52ad86ea5f98d phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend
f67686d826755 phy: qcom: sgmii-eth: vote for both voltage rails with correct current loads
12d35c6572622 phy: qcom-sgmii-eth: relax order of .power_on() vs .set_mode*()
a834458ecaadb soc: fsl: qe: check platform_driver_register() in qe_ic_of_init()
dfe848cadfde4 hugetlbfs: release subpool on fill_super failure
2177c04ca0684 pinctrl: rockchip: Reset the pin count when recalculating SoC data
6eaa632d0ed7b firmware_loader: do not queue completed sysfs fallback requests
067504c00fe17 scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path
8d752f1bb73fa drm/amdgpu/gfx6: Use PFP on the compute queues too
375adae128dd0 drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets
1a1ea9738c41d perf trace-event: Fix buffer overflow in read_string()
b8ae06ccde3ff phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table
1489b694b1f32 phy: sunplus: fix error handling in sp_uphy_init()
bf7fefbc26e29 phy: renesas: phy-rcar-gen3-usb2: Fix devm action registration for disabled VBUS regulator
b464367d7397b phy: renesas: rcar-gen3-usb2: Add regulator for OTG VBUS control
733d3c1f3f513 phy: renesas: rcar-gen3-usb2: Factor out VBUS control logic
66ef9160e878a arm64: dts: ti: k3-am64: Fix MDIO clock reference for ICSSG0 node
7c4c228b0cc3e ext4: fix spurious message about orphan cleanup on RO fs
d2d543f9313fa drm/amdgpu/gfx6: Fixup emit_cntxcntl()
037d9babf6c6b leds: gpio: Clear error pointers for skipped LEDs
b75f84c010274 mfd: macsmc: Fix key count endianness annotation
f59ccd8eeaa09 mfd: iqs62x: Reject zero-length firmware records
8ae4d0ff3e357 mfd: rave-sp: validate received frame payload lengths
519e7de2c4c7b arm64: hibernate: Restore DAIF state on error
012823494e20c arm64: hibernate: mask DAIF before restoring hibernated kernel
73979c96a3b8f wifi: mac80211: skip default WMM setup for AP_VLAN links
48b5a520b80a7 RDMA/erdma: restrict the driver to little-endian systems
b2709aad7599f module/dups: Fix use-after-free in kmod_dup_req lifetime handling
ef7c354f7377f module/dups: Inform duplicate requests about the result directly
11fa3f7ffd4f7 module: use strscpy() to copy module names in stats and dup tracking
ba7e83ce0b340 module: replace use of system_wq with system_dfl_wq
de603f01d9ccf RDMA/siw: Fix use-after-free in siw_accept()
6c506fee5a5f2 IB/isert: post the full-feature receive buffers after session registration
a6c19af05c170 IB/isert: delay the final Login Response until the session is registered
aaa66e60c0e21 cpufreq: imx6q: fix out-of-bounds write when probed more than once
e2d2612e63e29 cpufreq: imx6q: fix devres accumulation across driver rebind
db0a49f0a37d4 rust: cpufreq: Fix temporary write in Registration::bios_limit_callback
2973978781908 rust: cpufreq: Add CPUFREQ_TABLE_END as last table entry in TableBuilder::to_table
b43a2518c3eca drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz
46510c3e496b6 drm/sun4i: dw-hdmi: Drop TCON TOP port reference
17a588752ddf8 drm/sun4i: tcon: Drop remote endpoint reference
65bc02fec98e4 drm/sun4i: crtc: Propagate layer initialization error
50806c951a68c drm/sun4i: hdmi: Don't leak sync polarity bits into packet control
1ca06d47ac40b drm/sun4i: tcon: Drop TCON TOP device reference
425a414f9b5de drm/sun4i: tcon: Set output mux for DSI and LVDS
6ec54d801440e drm/sun4i: vi scaler: Fix coefficient selection
46a5fe1a43574 clk: rockchip: rk3576: fix source muxes for SPI0..SPI4
aee687a2fb369 ocfs2: synchronize heartbeat callbacks with o2net teardown
ba32c7d6129db perf libbfd: Fix memory leaks and NULL fclose in BPF disassembly
59cc63d244d93 perf bpf: Add PROG_TAGS to required arrays in __bpf_event__print_bpf_prog_info()
c473f3aa721e8 perf libbfd: Validate BPF prog info arrays before pointer cast
c71f9a56520b4 ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults
314f1a6762b5d ARM: 9481/2: breakpoint: CFI breakpoints only on demand
dc2272c00d7c0 RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ
ec987c0654651 RDMA/erdma: Hold QP references for AE and CM processing
1fc9c1933959d RDMA/erdma: Hold CQ references when processing EQ events
56ea0a1f9f93d kbuild: fix modules.builtin(.modinfo) targets in the top-level Makefile
933076eb1d3d6 modpost: prevent leak when early return no suffix .o in read_symbols()
0fde935ae0ea9 scripts/tags.sh: Prevent binary files appearing in cscope.files
804378ff0d62c intel_idle: Avoid using deep idle states during initialization
56450feb6f485 intel_idle: Add cmdline option to adjust C-states table
33a5d2f00cac3 intel_idle: Initialize sysfs after cpuidle driver initialization
6ee7b00888498 bpf: Check load-acquire src ptr type before the load
cb0671ffce488 arm64: dts: qcom: sar2130p: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
af38023bc47dc arm64: dts: qcom: sm7225-fairphone-fp4: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
f068388689bea arm64: dts: qcom: qcs8550-aim300: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
e70a165b79419 arm64: dts: qcom: sc8280xp-blackrock: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
2fa866714f227 selftests/mm: fix ternary operator precedence in ksm_tests
5cd78a904275a selftests/mm: fix ksm NUMA merge test for systems with memoryless NUMA nodes
335b75cfed44b selftests/mm: ksm_tests: use kselftest framework
86ead17630110 bpf, cgroup: Fix invalid storage access after __cgroup_bpf_attach failed
6fd220604f06c remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()
5a5ed571032e9 remoteproc: use rsc_table_for_each_entry() in rproc_handle_resources()
a356d08d7151a remoteproc: Move resource table data structure to its own header
90361f45ffe85 arm64: dts: qcom: agatti: Add missing CX power domain to DISPCC
9063b30faae8c drm/omap: dsi: Do not copy isr table
d1cfbccccad7d riscv: dts: sophgo: cv180x: Allow the DMA multiplexer to set channel number for DMA controller
571ea4263d69d fat: release buffer head after rebuilding parent
44a37264b2691 rapidio: clear mport->net when rio_add_net() fails
9df662fcac6fe pps-gpio: remove dead capture_clear code
599d4c92aa0b4 pps: pps-gpio: split IRQ handler into hardirq timestamper + threaded handler
e31ff723811ee pps: don't try to wait for negative timeouts in PPS_FETCH
f637a83115b32 lib/string: fix memchr_inv() for large ranges
8abb2b7c60d2b ocfs2/cluster: keep heartbeat local node stable
b55e7e61c5c19 ublk: check for ublk_unmap_io() returning 0
0121c84adb6a4 ublk: check import_ubuf() return value
b4e971c80e64f block/kyber-iosched: flush per-cpu latency buckets over possible CPUs
7c25949cee2f0 block/blk-iocost: collect per-cpu latency stats over possible CPUs
55bda3de92f8c block/blk-stat: drain per-cpu callback stats over possible CPUs
3d8c3da95c75a blk-cgroup: skip dying blkg in blkcg_activate_policy()
ac34e655dffa7 blk-cgroup: fix race between policy activation and blkg destruction
c4487e4d5309d phonet: pep: do not write beyond optlen in getsockopt
f16c2c3932ce7 net: stmmac: Skip PHY attach if custom PCS is in use
c65d67b08bab4 iio: light: tsl2583: return zero in write_raw() on success
7a6a9bc87c6ee iio: light: isl29028: return zero in write_raw() on success
1e628f7ce4bc2 iio: light: tsl2772: fix ALS calibscale readback
6c98ec4447d2c perf arm-spe: Reject zero nr_cpu in metadata to prevent division by zero
9a857be21e2f3 perf intel-bts: Fix off-by-one in auxtrace_info minimum size check
b3a42fd1a0cd1 perf intel-pt: Fix off-by-one in auxtrace_info minimum size check
59910f142da84 perf auxtrace: Fix queue grow overflow and old array leak
003de0cf0810c perf thread-stack: Fix heap buffer overflow on branch stack wrap copy
5db6e27ad43d2 HID: lg4ff: validate report length before fixed offsets
bef8426d7138c HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure
f694ea0ead544 HID: steam: Reject short reads
78c39dd5cc4ae HID: steam: Improve logging and other cleanup
a0fbd9437d7dc HID: steam: Add support for sensor events on the Steam Controller (2015)
041e63bd2f73c HID: steam: Rename some constants that got renamed upstream
d73725bf86120 HID: steam: Refactor and clean up report parsing
17e532415518a HID: i2c-hid: Fix "(null)" output when reading report descriptor fails
01eeb601a1626 HID: synchronize input before cleaning up a failed probe
e5b6af32ecdd8 HID: i2c-hid: Refactor _DSM helper and add i2c-hid-acpi-prp0001 driver
d7f2ec073a05a misc: pci_endpoint_test: Check SUCCESS bit for doorbell status
5c58ea19a909e dm-integrity: replace forgeable discard filler with a keyed sector marker
4f6bd79bb7e55 tty: clear cdev pointer after cdev_add() failure
5b77848423f4a serial: amba-pl011: keep console clock enabled for atomic writes
5ac19e4e26e99 serial: amba-pl011: unprepare console clock on unregister
ea7fd4e8e8b87 MIPS: ptrace: Fix syscall skipping via PTRACE_SYSCALL
6bdbc2b4df1f5 soc: fsl: qe: implement get_direction()
0f3d1d7ab5d2f soc: fsl: qe: properly scan GPIO nodes at startup
90d953002cf0b powerpc/irq: Fix missing r2 clobber in PCREL inline assembly
5fa92c6466fa2 powerpc/smp: add NULL guard for cause_ipi in smp_muxed_ipi_message_pass
b59a47e20040a pinctrl: spacemit: validate pins in pinconf callbacks
41eba3b3ef86f pinctrl: eswin: Fix Handling of PIN_CONFIG_PERSIST_STATE
2d98a3b89394f firmware: coreboot: Validate table bounds
d0a19a59580a2 firmware: google: Add bounds checks in coreboot_table_populate()
7a22cbc6c6bdd wifi: cfg80211: stop PMSR before P2P and NAN teardown
0a0c03e4b7c63 wifi: cfg80211: Add an API to configure local NAN schedule
84263694c8d1f wifi: nl80211: split out UHR operation information
e182bf30a38c3 wifi: nl80211: refactor nl80211_parse_chandef
6481459f78be3 wifi: cfg80211: add support to handle incumbent signal detected event from mac80211/driver
335c515932a59 wifi: cfg80211: add initial UHR support
be90aa8bf1775 wifi: ieee80211: add some initial UHR definitions
66722acd740be wifi: nl80211: Add support for EPP peer indication
93b4c9130461c wifi: cfg80211: include S1G_NO_PRIMARY flag when sending channel
e7bc5ab93acd1 wifi: mac80211: disconnect on CSA to channel 0
7c3d762bc15c5 wifi: mac80211: skip unused probe response countdown offsets
979ad5269bdf0 wifi: zd1211rw: reject secondary interfaces to prevent conflicts
26e6123a93dca wifi: mac80211: send TWT teardown to peer after setup TX failure
97dd2f6560ce3 perf/cxlpmu: Fix 64-bit write to 32-bit HDM filter register
9ba040f4fec87 iommu/arm-smmu-v3: Convert to use atomic poll timeout
2a08fd5a082e1 kselftest/arm64: Don't write to P0 in irritator on SME only systems
ee46a1714d3a9 kselftest/arm64: fp-ptrace: Fix checks for inactive SVE and SSVE regsets
695e976e25a11 arm64/fpsimd: ptrace: Fix inactive SVE and SSVE regsets
a2ff70c44fe8e arm64: smp: Fix IPI teardown for GICv5 flow
80818e72aec4d wifi: mt76: mt7996: remove beacon_int_min_gcd from ADHOC interface combinations
7039825a7479d wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump
637bb99cc766a wifi: mt76: mt7996: fix out-of-bounds link array access in mt7996_tx()
13f6a9c786022 wifi: mt76: reject out-of-range link ids in mt76_vif_link()
81ccb9faf3c43 wifi: mt76: mt7925: Fix EHT Beamformee SS subfields to meet 802.11be minimum
0ead464cb43ef wifi: mt76: mt7925: advertise EHT 320MHz capabilities for 6GHz band
c59c8b962c4d8 wifi: mt76: fix queue assignment for disassoc packets
292bc52d8420a wifi: mt76: mt7915: report RX chain signal for all RX paths
4dee6aca79295 wifi: mt76: mt7915: fix chainmask handling for non-dbdc phys on band 1
76144da3c6184 wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed
d4326105ee28d wifi: mt76: mt7996: fix reg addr remap when addr is 0
ed5cc46a3c8f4 wifi: mt76: mt7915: release hif2 reference on probe IRQ failure
a7fd3bae8e11a wifi: mt76: mt7915: fix ext PHY use-after-free on register error path
249cbaa187355 wifi: mt76: mt7915: fix double hif2 init on the non-WED path
51c6d1f665401 wifi: mt76: mt7996: fix MIB TX aggregation counter registers for mt7990
2b10eb3636d0c wifi: mt76: mt7996: free vif links after clearing wcid entries on full reset
f3d8cf8c09e3b wifi: mt76: mt7996: wake MCU waiters before aborting scan in L1 SER
2cc7d32b42dab wifi: mt76: mt7996: skip key upload when adding an offchannel link
6bce0f1280c94 wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement
40f3bfbbb222b bpf, x86: Fix trampoline stack size for 128-bit arguments
f6202ed975070 perf machine: Check snprintf truncation for guest kallsyms path
eaa350a2ec347 perf machine: Free scandir entries in guest kernel map creation
9054ad50ffe27 perf machine: Reset errno before strtol in guest kernel map creation
c0b06d47ac329 perf machine: Don't abort guest map creation on first inaccessible dir
b3b3175103acf perf machine: Check snprintf truncation in machines__findnew()
15159fc5441bc perf machine: Guard against NULL strlist in machines__findnew()
e3a2ed4c0e8e0 perf machine: Fix NULL parent dereference in fork event processing
28bb9ea64c0c5 perf machine: Fix fd leak on bounds check in maps__set_modules_path_dir()
0b950aa7ec95e regulator: core: use system_freezable_wq for init complete work
2e2d63f68211e ASoC: tas2783-sdw: drop stale regcache on uninitialized re-attach
5589af278c504 ASoC: codecs: tas2783-sdw: Propagate regcache_sync() errors
551f3e27486bc ASoC: tas2783: Use new SoundWire enumeration helper
0b5c09512f21b soundwire: Add a helper function to wait for device initialisation
f5bb3471c9f46 wifi: ath11k: fix leak in ath11k_service_ready_ext_event()
83bc4eab83ae5 drm/msm/dsi: Drop dev_pm_opp_set_rate(0)
e0d1d1253ea2a drm/msm/dp: Drop dev_pm_opp_set_rate(0)
be73b1984086f drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0)
81d21396fea2d perf: arm_spe: Make wakeup range check overflow safe
ad1d83816b845 drm/msm/dp: do not reject wide-bus modes while a YUV420 mode is active
6572b5a74ab1c drm/msm/dp: reject YUV420-only modes without VSC SDP support
08827aa40f0ee drm/msm: don't tear down KMS twice when KMS init fails
64976f3b34b07 ACPI: processor: Unregister cpufreq notifier on init failure
6cffb59ee50ea ACPI: processor: idle: Optimize ACPI idle driver registration
efc57983a1d46 wifi: mt76: only consume the WO drop bit on WED v2 devices
19f108fee1470 wifi: mt76: mt7996: add missing rdd_idx check when enabling background radar
b93d0f07ed040 wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields
92dc45686b9f1 wifi: mt76: mt7996: don't leak MLD group index on remap alloc failure
45d8896e4cfff wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV
906ad486ba5c4 wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER
507eddb8175a6 wifi: mt76: mt7915: unwind state on add_interface failure
d0bb2189ade61 wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config
1c7ad1236bc6f wifi: mt76: check txfree done event on the WED hw path
31faa92cd5074 wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie
7ac05ed3a50e5 wifi: mt76: fix RXDMAD_C buffer recycling race
576683faa9381 wifi: mt76: fix uninitialised RXDMAD_C descriptor info
423be355be5ae wifi: mt76: fix stranded frames in mt76_txq_schedule_pending
471586e88861d wifi: mt76: mt7915: write RX header translation bit to the correct register
522101cbbb3bc wifi: mt76: mt7996: don't report a zero TX bitrate
6ce78d04c7ea4 wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss
b4a41a47a67c7 wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear
bf59177bab17b wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset
0f53ece876e1f wifi: mt76: mt7996: validate RX band_idx before dereferencing phys[]
310edc8f3f56b wifi: mt76: assign link_id when sending probe request during scan
fc7fae55255cc wifi: mt76: fix non-AQL packet accounting for MLO stations
5183b9f092fc0 wifi: mt76: mt7996: fix MLD ID in MAC TXD and HIF TXP
990ec9215ebe1 wifi: mt76: mt7996: fix out-of-bounds array access during hardware restart
25b765aa9a61f wifi: mt76: mt7996: set specific BSSINFO and STAREC commands after channel switch
5c350e3b6065f wifi: mt76: mt7996: support fixed rate for link station
62aea1d45b524 wifi: mt76: fix RX data queuing of RRO 3.0
97a77dc0abd90 wifi: mt76: mt7996: fix capability of EHT-MCS 15 in MRU
674e0ad0ae15f wifi: mt76: mt7996: fix EAPOL source BSS for non-MLD stations
ddf6a17d8e3d0 wifi: mt76: mt792x: Fix memory leak in SDIO TX path
52c7bcf067861 wifi: mt76: mt7925: fix msg len mismatch between driver and firmware
383bb0511dfe6 wifi: mt76: mt7925: update clc before setting sar power table
670b3dc4e3713 wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash
0015b56dff60f wifi: mt76: always enable RRO queues for non-MT7992 chipset
6e9207ac476ca wifi: mt76: Introduce the NPU generic layer
c0dbce50c8961 wifi: mt76: Move Q_READ/Q_WRITE definitions in dma.h
50c896af50e02 wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986
17d6b89e09eac wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length
0340bd33b4e21 wifi: mt76: connac: add MT7991A (0x7991) to is_mt7996()
1991d605a45f6 fanotify: report full event length for FIONREAD
6248eb1833ff0 misc: sgi-gru: remove interrupt-context page-table walks
e6e4cbc9e8fdd misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe()
2a1c16c4700cd powerpc/crash: Fix possible memory leak in update_crash_elfcorehdr()
7969b571ae940 powerpc/44x: Set GPIO chip parent
687d42d9eea41 powerpc: implement get_direction() in cpm2
e7c69c6695d84 locking/lockdep: Fix NULL pointer dereference in __lock_set_class()
37f11973c3eb7 md/raid1: create serial pool adding rdev to array with serialize_policy=1
71da948d249a5 fs: annotate inode timestamp accessors
039e490e3ac47 i3c: master: adi: add OF module alias for autoloading
9eaac0cb4ca94 i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices
35e0103177826 swiotlb: Preserve allocation virtual address for dynamic pools
fb0b39287ba89 iommu/dma: Check atomic pool allocation result directly
28fdea874f68c md: scope memalloc_noio to allocation critical sections
c510626bbacb1 md: skip redundant raid_disks update when value is unchanged
9f16747fc3b23 md: remove unused mddev argument from export_rdev
6763fb409a0b4 md/bitmap: resume array on backlog_store() error path
85ece0386c4fe clk: qcom: Return expected ENOMEM error on dynamic allocation failure
64abdd6961290 clk: qcom: gpucc-qcm2290: Park RCG's clk source at XO during disable
af7a6d6ec36a1 lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone
85cf991c881e7 bpf: Fix potential UAF when reading bpf link info
bda86e9f31b9a bpf: Fix potential UAF in bpf_netns_link_update_prog
d5266b4c5c771 power: supply: sc2731_charger: cancel work on remove
f312c5d17f2a7 power: supply: isp1704_charger: cancel work on remove
1a35eda51a501 arm64: dts: qcom: qcs6490-rb3gen2: Fix the PCIe iommu-map entries
e1c65abeb6aaf arm64: dts: qcom: lemans: Fix the PCIe iommu-map entries
03a85ccf857ac arm64: dts: qcom: lemans: Move PCIe devices into soc node
76e14b0e86567 arm64: dts: qcom: sa8775p: Add reg and clocks for QoS configuration
8d7411cc0bd95 arm64: dts: qcom: lemans: add QCrypto node
610d253bef458 arm64: dts: qcom: lemans: add refgen regulator and use it for DSI
ca29c5c0cc615 arm64: dts: qcom: lemans: move USB PHYs to a proper place
349752c7ab6be arm64: dts: qcom: talos: Fix the PCIe iommu-map entries
fc2980ea69202 arm64: dts: qcom: sm8750: Fix the PCIe iommu-map entries
f418e83ac1abe arm64: dts: qcom: sm8650: Fix the PCIe iommu-map entries
e8a7928da474e arm64: dts: qcom: sm8550: Fix the PCIe iommu-map entries
dbcbbb2033736 arm64: dts: qcom: sm8450: Fix the PCIe iommu-map entries
793dbaa91c3bf arm64: dts: qcom: sm8350: Fix the PCIe iommu-map entries
c8fd2cabd0b7c arm64: dts: qcom: sm8250: Fix the PCIe iommu-map entries
152e82a60d70e arm64: dts: qcom: sm8150: Fix the PCIe iommu-map entries
a98b8bb0ca25f arm64: dts: qcom: sdm845: Fix the PCIe iommu-map entries
8dfc4641001fb arm64: dts: qcom: sc8180x: Fix the PCIe iommu-map entries
54176af35d989 arm64: dts: qcom: sar2130p: Fix the PCIe iommu-map entries
d2b404826bf93 arm64: dts: qcom: kodiak: Fix the PCIe iommu-map entries
f063039d2e439 arm64: dts: qcom: sm8250-xiaomi-elish: correct the board ID
d29c5a88d5703 block: fix dio leak on metadata mapping error
642828f274eb7 block: add a bio_endio_status helper
8b1817b36ca5c block: don't set BIO_QUIET for BLK_STS_AGAIN
2b239a920a992 blk-crypto: use on-stack skcipher requests for fallback en/decryption
196a8f954ae6d blk-crypto: optimize bio splitting in blk_crypto_fallback_encrypt_bio
30439432f3f2e blk-crypto: submit the encrypted bio in blk_crypto_fallback_bio_prep
f57adb5beca6b firmware: qcom: scm: Fix tzmem state on probe retry
1da025b5ceb45 firmware: qcom: scm: Fix reserved memory cleanup on probe failure
1d753df5899ec firmware: qcom: scm: Fix NULL dereference in IRQ handler before __scm is published
d72c76684a4a9 firmware: qcom: scm: instrument SMC call path with tracepoints
347efe779f55f firmware: qcom: scm: add trace events for the SMC call interface
889ca992d9c4e firmware: qcom_scm: Support multiple waitq contexts
3d028e241c2aa firmware: qcom_scm: Add API to get waitqueue IRQ info
81af527ead79c arm64: dts: qcom: sc8280xp-crd: Fix the pin index for misc_3p3_reg_en
5793229726e25 clk: qcom: gcc-qcm2290: don't park QUP RCGs upon registration
939c917d037a5 arm64: dts: qcom: qcs404: Fix DTBS Check errors in usb controller nodes
4ea052255a4a6 arm64: dts: qcom: sdm632-motorola-ocean: Fix LED default trigger property
d098dd6ec09b8 arm64: dts: qcom: msm8976-longcheer-l9360: Fix accidental node override
9346a92337075 arm64: dts: qcom: msm8998: Don't pull-up I2C pins by default in sleep
179713adff1bd rcu: Mark accesses to ->rcu_urgent_qs and ->rcu_need_heavy_qs
badab2078d459 md/raid10: consistently fail atomic writes that require splitting
75185e2b214e8 wifi: ath11k: fix stride mismatch in mac_phy_caps_parse()
b9a5d12cbdeb8 wifi: ath12k: fix stride mismatch in mac_phy_caps_parse()
ec6edba35aa7b Revert "serial: 8250: Clear CON_PRINTBUFFER on port re-registration"
d44a02724576c selftests/zram: fix kernel_gte() for POSIX sh
e5ac7ab78467b md: recheck spare changes before starting sync
47b61029f146f tools/nolibc/powerpc: mark ctr and xer as clobbered by system call
a2fbef8a6318b fanotify: stop permission watchdog when timeout is zero
9d65cb2142533 md/raid5: protect lockless recovery_offset accesses during reshape
455b56209f961 md/raid5-ppl: fix use-after-free in ppl_do_flush()
dcd3d87cfc148 md/raid5: protect bitmap batch counters aka seq_flush/seq_write consistency
4fb17a7c437f1 bus: mhi: host: Fix controller cleanup on EDL sysfs failure
21ce330f921a5 bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET
a89818977338b wifi: rtlwifi: pci: fix error path in rtl_pci_probe()
e2cbe14361d7c platform/chrome: cros_ec_debugfs: Unregister panic notifier
b95664e3f82da platform/chrome: cros_ec_debugfs: Clean up console log on probe failure
e7768f3dae9f2 media: qcom: iris: handle runtime PM resume failure in core deinit
c1a48452cc16e media: qcom: iris: Fix bitmask test in iris_allow_cmd()
794f6d4c4ddef drm/msm: remove objects from evit list after pinning them
b3624eecb65a2 PCI: starfive: Fix unchecked pm_runtime_get_sync() in probe
257a0a59598f5 PCI: starfive: Fix Runtime PM handling and teardown ordering
aa8226f873c91 wifi: ath12k: validate TLV length in process_tpc_stats()
0364926fb4bfb wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event()
3b544072185c3 spi: davinci: switch to managed controller allocation
bd764baf82bb4 nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request
c345d9d0b3eef IB/isert: reject login PDUs declaring more data than was received
cf36fa5357a2f IB/isert: reject PDUs declaring more data than was received
429b75000c6a9 media: staging/ipu7: fix async notifier leak on init error
a2e37d1ab773b RDMA/cxgb4: free STAG index when TPT entry write fails
b1fe9a1bd0012 RDMA/mlx5: Send cong param changes to the resolved port mdev
4599311e78e88 RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs
75424c5a6620b scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches.
3904fb0ee741e nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch
842397fdfd2e6 nilfs2: prevent out-of-bounds read in super root block parsing
1fc6df85b4954 nilfs2: fix infinite loop in nilfs_clean_segments()
49a7d62d64f79 clk: rockchip: Fix the fractional part denominator on RK3588/RK3576 PLLs
666071b3128ac clk: mediatek: mt8135: Fix inverted gate control for devapc_ck
1158a9adc7dce clk/x86: pmc_atom: add kasprintf return value check
b8b81c6c89f0c clk: palmas: Manage external-control prepare with devm
d35e45e5bad4f clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path
ac6f7740655d8 clk: mediatek: Refactor pllfh registration to pass device
c945468a6df72 clk: mediatek: Pass device to clk_hw_register for PLLs
b7cd043b8412e clk: mediatek: Refactor pll registration to pass device
03e070e517204 clk: tegra: tegra124-emc: put EMC node on register failure
75653b0408d52 arm64: dts: allwinner: sun50i-a64-pinephone: Fix mpu6050 mount matrix
730e71d747051 wifi: mac80211: fix per-STA profile length in cross-link CSA parsing
da7805f0211af RDMA/efa: Fix PBL chunk length computation
5f1933163327c RDMA/rxe: Fix UAF in ODP init error-handling path
1d2271d7df523 iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path
9b37afb2d34d9 iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID
735698e81f798 iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs
2f627118b6686 iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs
bcb82407633c3 iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF (de)init
792f720fc23fe iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized
aad605a450611 fs/ntfs3: reject restart table growth beyond U16_MAX entries
7a7d30b1cb890 staging: rtl8723bs: use kfree_sensitive() for key material
6b2e70e9d52c0 firmware: qcom_scm: Introduce PAS context allocator helper function
f15cde1129840 remoteproc: Prevent crash handling to race with rproc_del()
df92f0e142edb remoteproc: core: Attach rproc asynchronously in rproc_add() path via schedule_work()
d6bf603246c90 remoteproc: Allow shutdown of crashed processors
a098f5894fcb4 remoteproc: core: Drop redundant initialization of 'ret' in rproc_shutdown()
8b93b783db329 cpufreq/amd-pstate: Set min_limit_freq based on bios_min_perf
9b95f10e1688c cpufreq/amd-pstate: Add comment explaining nominal_perf usage for performance policy
172f24df0dab4 w1: ds2482: Fix signedness bug in ds2482_w1_triplet()
ef5cc4a8c088d spi: oc-tiny: switch to managed controller allocation
67e2ffe98d710 clk: mediatek: mt6735: Unregister PLLs on probe failure
106e1a3b2b345 isofs: release zisofs block pointer buffer head
c39eb307b4976 powercap: intel_rapl_tpmi: Handle PMU registration failure during probe
bf32f103a325a thermal/drivers/qcom-spmi-adc-tm5: Drop IIO_VAL_INT check in adc_tm5_get_temp
686a92cc9f19b thermal/drivers/airoha: Fix copy paste error for sen internal
a06b2e6b8f508 thermal/drivers/airoha: Fix copy paste error on clamp_t low temp
5b6cfc6d7ff09 RDMA/mlx5: Fix integer overflow of user QP buffer size
9c9c64abed530 crypto: keembay - publish OF module alias for OCS AES/SM4
7efb51a5893b2 crypto: keembay - Initialize completion before requesting IRQ
cc92af8cc0e4d scsi: ufs: debugfs: Reserve space for a string terminator
15d4fc8f5f108 power: supply: sbs-battery: Use a per-device serial number buffer
e505092cb200d arm64: RSI: fix field-spanning write warning in attestation token init
386600507b23f tools/build: Allow versioning of all LLVM tools defined in Makefile.include
7f6d898179ca4 pinctrl: mediatek: free EINT resources on unbind
f54b96e8aadbf cxl/region: Fix use-after-free in find_pos_and_ways() error path
b804df9aa2942 selftests/bpf: Fix memory leak on subtest_states reallocation
b7983cd5ba2c7 selftests/bpf: Fix incorrect error checking for pthread_create
c78a9289084a7 ARM: lpc32xx: only run SoC init on LPC32xx hardware
85a33c910edc3 bpf: Fix CFI mismatch in task work callback
4f7e0be664af7 arm64: dts: rockchip: Fix rk3566-bigtreetech-cb2 touchscreen property
9ca64fd7a2fde arm64: dts: rockchip: Fix Gru WLAN sideband interrupt
053220e061c7d arm64: dts: rockchip: Add missing hclk for RK3588 eDP1
f5b4bc09c42f2 arm64: dts: rockchip: Add missing hclk for RK3588 eDP0
d65261e0902b4 drm/panthor: return PTR_ERR() from devm_drm_dev_alloc()
64bb6000bfbdf fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init
e70d48fcf8382 netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet
2e199e3ede9c1 drm/tve200: add OF module alias for autoloading
d9e01c333cebc perf cap: Remove used_root parameter and simplify capability checks
a73a88bc4f452 leds: pca9532: Fix phantom device registration on missing hardware
f1e8c4d48583d PM: hibernate: Fix memory leak in snapshot_write_next() error path
ce7d205c26466 RDMA/erdma: complete object teardown when the destroy command fails
02deb637e9659 xfrm: Fix skb double-free in xfrm_dev_direct_output()
78da16d23496f perf cs-etm: Avoid truncating AUX buffer sizes to int
f78fba8549204 perf cs-etm: Flush thread stacks after decoder reset
25be36738f5fc riscv: dts: spacemit: k1: Split gmac_clk_ref into independent pinctrl groups
fe9d15fb66d5e riscv: dts: spacemit: Add OrangePi R2S board device tree
9933e5f1f61ec riscv: dts: spacemit: add MusePi Pro board device tree
a76b20b1f0309 firmware: arm_scmi: Unrequest devices if driver registration fails
456856a349064 firmware: arm_scmi: Roll back partial protocol table registration
406d5ead1bcb0 cpufreq/amd-pstate: Toggle auto_sel in active mode on shared memory systems
821b41f6e3e4f cpufreq/amd-pstate: Fix EPP return type and handle errors during initialization
95ad5fd298bcd cpufreq/amd-pstate: Add support for platform profile class
471d6659925aa cpufreq/amd-pstate: Add dynamic energy performance preference
0b99dd4201c25 amd-pstate: Make certain freq_attrs conditionally visible
ea49944836140 cpufreq/amd-pstate: Use sysfs_match_string() for epp
baf5a7fd3f3e2 cpufreq: amd-pstate-ut: Skip tests when amd-pstate driver is not active
937f09ce104c1 ARM: dts: allwinner: a10: Fix PMU interrupt
3933884bc3102 ext4: check dir entry fits before reading the hash trailer in ext4_search_dir()
1399f102d8a18 ext4: fix buffer_head leak in ext4_init_orphan_info
0afbfe019c881 RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap
72a5e45f606ec wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx()
95d1bd1db9e9d wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx()
ccca0f7d9e906 wifi: ath11k: Correctly copy the hint BSSID in WMI scan request
8f86a58ab9412 wifi: ath12k: Correctly copy the hint BSSID in WMI scan request
0c9eac0d1fb47 wifi: ath12k: allocate HOST_DDR and BDF regions after Q6 RO region
e69fd62e8117e wifi: ath12k: refactor QMI memory assignment
42bc932e05093 wifi: ath12k: switch to name-based reserved memory lookup
abda58f4529d7 wifi: ath6kl: avoid buffer overreads in WMI event handlers
64d445d40e5ea ext4: validate readdir offset before accessing dirent
bd8d74bd46d09 ext4: use fsdata to track inline data write state and fix race
4e4e3eec50624 ext4: drain in-flight DIO before buffered write fallback
aa0042630b1f7 ext4: clear stale xarray tags on folios skipped during writeback
d7b025d3fdf3c thermal: intel: int3400: clean up ODVP on probe failures
466358635a2e4 iommu/arm-smmu-v3: Declare eats_s1chk and eats_trans as host-endian u64
267fb3771ddf6 iommu/qcom: Fix inverted fault report check in qcom_iommu_fault()
0812b282703a7 iommu/qcom: Remove sysfs device on probe failure path
8aabe0fba0148 iommu/amd: Fix undefined behavior in devid_write debugfs function
c3d4ef1c0ca69 firmware: arm_scmi: Fix requested device removal race
66d65f36d3975 RDMA/core: Fix potential use after free in ib_dealloc_pd_user()
8b22722f45a29 RDMA/core: Fix potential use after free in uverbs_free_dmah()
9abea37942534 RDMA/core: Fix potential use after free in ib_free_cq()
8c013e3a8d827 RDMA/core: Fix potential use after free in counter_release()
bedd7dee72588 RDMA/core: Fix potential use after free in ib_destroy_srq_user()
197c262dbf94c RDMA/core: Fix potential use after free in ib_destroy_cq_user()
038cf231b7099 RDMA/core: Fix use after free in ib_query_qp()
c538cd121be77 RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations
a07cba1296aaa RDMA/nldev: Fix locking when accessing mr->pd
b7091e0e2ebab RDMA/restrack: Fix typos in the comments
4aaa2ab816c71 RDMA/mana_ib: drain QP references after partial table insertion
a60c36d8d17f1 RDMA/erdma: Fix CEQ tasklet use-after-free on removal
53446b921cdd6 PCI: j721e: Fix incorrect max_lanes for J7200
8c24bda66dd1c RDMA/srpt: Pass the mapped task attribute to target_init_cmd()
e42cede6f9017 bpf: Mark bpf_refcount field as unique
28d5f20ed022a bpf: Preserve unique-field state across nested structs
dfdce1f20a7e5 bpf: Fix offset warn check for bpf_res_spin_lock
2d2616b4f3728 virt: arm-cca-guest: use migrate_disable() for attestation token requests
662f242863fd8 ACPI: battery: Adjust charging status validation check
26d9496c82658 bpf, riscv: Fix extable handling for arena load_acquire
34b1bb33a0257 riscv, bpf: Fix kernel stack corruption in tailcall with CFI
5cadc66b534fe riscv, bpf: Fix memory leak in bpf_jit_free
e991c317d4a00 libbpf: Search /lib64 and /lib in resolve_full_path()
1534c4bff3aac bpf: Zero queue and stack outputs on lock failure
5af710a4f3e39 platform/x86: acer-wmi: reject missing gaming WMI results
7ace189b9ea79 ext4: skip extra isize expansion during mount to prevent deadlock
6702c7da86d8c ext4: fix out-of-bounds read in ext4_read_inline_dir()
e4223231b6860 ext4: fix circular lock dependency in ext4_ext_migrate
3eee4c21931dc ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root
4d8ecaa332c16 ACPI: processor: validate MADT IOAPIC entry bounds
87735eb21d7e5 ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer
0bfa897e3e1a6 RDMA/nldev: validate dynamic counter attribute length
6eb1f1414bf70 irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc()
93290f29be8f9 selftests/bpf: Silence array bounds warning in global_map_resize
03cf3a1d950f4 selftests/bpf: Check malloc result with ASSERT_NEQ in test_sha256
86ce84cf93d2c x86/bugs: Don't use cpu-type matching in cpu_vuln_blacklist
1654875005c7b arm64: dts: imx8-ss-audio: Fix LPCG clock indices for ASRC0
18b1deba71546 kcsan: avoid unintended access checking in NMIs
af073bd245180 RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters
13cb7160e5b79 RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[]
3416db552eb37 RDMA/hfi1: Propagate sdma_txinit_ahg() errors
e166856d4ef2d arm64: dts: amlogic: meson-axg-s400: enable mipi_pcie_analog_dphy for PCIe
0da7e87b3044d arm64: dts: amlogic: meson-axg: Add missing nand_rb0 pin to nand_all_pins
624ddc40f2185 phy: starfive: Fix runtime PM cleanup in JH7110 DPHY RX probe
41cacaa222b0d phy: starfive: Fix runtime PM cleanup in JH7110 DPHY TX probe
8fec16898f184 ASoC: meson: Keep link pointers valid on realloc failure
20b92646ee030 dmaengine: dw-edma: Clear stale requests on termination
fe0ffa0190e86 dmaengine: dw-edma: Serialize channel state checks
0c3294066c36d dmaengine: dw-edma: Serialize abort state updates
be87d86537de7 dmaengine: dw-edma: Terminate all descriptors without callbacks
a968dffa5ab3c bpf: Reject arena frees below the arena base
122ad34f72583 drm/msm/a6xx: Fix RBBM_CLOCK_CNTL3_TP0 value in a730_hwcg
333246218efd5 driver core: soc: Unregister bus on early device registration failure
df5466412b362 software node: Fix software_node_get_reference_args() with index -1
13a234359ca8d perf ui hists: Fix uninitialized stack memory free on pstack allocation failure
398aca2f90122 mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition()
5c349c533e72a mtd: mtdswap: Avoid freeing registered blktrans device twice
b63058bd5e1be mtd: intel-dg: Fix runtime PM error path in probe
31f3f496da280 mtd: intel-dg: wake card on operations
533d0c5feef85 vfio/pci: clear vdev->msi_perm after freeing it on init failure
21d576fc7e298 char: xilinx_hwicap: unregister class on init errors
1a3258e105f71 ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove
29df4ee11433c ppdev: prevent overflow when setting port timeout
e4a7ace58941e cacheinfo: don't propagate DT/ACPI error when arch supplies info (arm64)
98bb638f583db misc: lan966x_pci: depopulate children on populate failure
c7ff7a70f405a misc: ad525x_dpot: use driver core groups for sysfs files
c8b85cad0fa49 misc: rtsx: add missing write register handling
a45d6dd3c11e9 misc: bcm-vk: Use acquire/release for msgq_inited
5310334762c3f speakup: keyhelp: guard letter_offsets possible out-of-range indexing
8688fe2941d54 accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status()
16695e9059d80 uio: Fix stale info pointer in failed registration path
1e805a7f4fe01 gpib: Move stuck SRQ update under lock
6c9f6a3b9fdd3 staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths
28ebc34373f04 staging: rtl8723bs: remove multiple blank lines in core/
368f19a5ed15f staging: rtl8723bs: replace rtw_zmalloc() with kzalloc()
aa89cd88ae034 staging: rtl8723bs: expand multiple assignment into separate statements
87ccaea185696 staging: rtl8723bs: fix operator and type cast spacing
d8664fa56c46b staging: rtl8723bs: use standard offsetof in cfg80211 operations
11b3765fcb71d staging: rtl8723bs: Fix operator spacing in rtw_security.c
8da8fd3df9fc1 UDF symlink pathComponent header OOB read
f42e35e9a7e69 tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64
2ed25c9d4400c usb: gadget: f_uac1_legacy: remove broken string configfs attributes
772f29206544f ACPI: processor: idle: Expand _LPI package sanity checks
19ae79f185bc5 crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping
d43e1bbfd4345 drm/msm: Only fini scheduler after successful init
6c472fde2c809 drm/msm: Fix task_struct reference leak in recover_worker
133c9aa5b896c drm/msm/a6xx: Fix A621 GPUCC register list for state capture
15d9b29c7da18 drm/msm/a6xx: Rebase GMU register offsets
8bc35465c51be drm/msm/a6xx: Fix A663 GPUCC register list for state capture
e36284257eeca drm/msm: Recover HW before retire hung submit
8298883bb3edb drm/msm/a6xx: Fix stale rpmh votes after suspend
9ad7a6ccc7b83 gpu: host1x: Avoid stack over-read in debug output helpers
9211efca5c657 gpu: host1x: Fix offset calculation in trace_write_gather
6b7d5abf3e374 wifi: iwlwifi: mei: pass correct argument to function
f26f72c244882 wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments
242125bbf19a2 wifi: iwlwifi: mei: check SAP message length before reading it
c9d8641aea01c wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser
8d8a526f3ec65 wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs
f20b182ff2d44 spi: geni-qcom: Fix sticky ret causing wrong return value on invalid proto
badb810da2b09 soc: renesas: r8a78000: Drop duplicate "default ARCH_RENESAS"
d9f25cc138c74 clk: qcom: gcc-glymur: Enable runtime PM
563a1fcf551cd perf jevents: Add more components to the metric sorting order
0b5f752d635c5 arm64: dts: qcom: sm8250: correct frequencies in the Iris OPP table
c795f18678de6 arm64: dts: qcom: sm8250: sort out Iris power domains
4e59a0b78e048 arm64: qcom: ipq5018: Add GEPHY RX and TX clocks
c9fed0c7056c5 arm64: dts: qcom: ipq5018: Correct CMN PLL reference clock rate
5d0fc8094678f arm64: dts: qcom: sc8280xp-x13s: Fix the drive-strength of mclk pin
188344787dacb arm64: dts: qcom: msm8996-xiaomi-gemini: Fix up ti,drv2604 enable GPIO
591b6fac9df3f x86/mm/pat: Take cpa_lock around large-page collapse
57c567e0e8aa7 drm/bridge: tc358767: clamp the reported AUX read size to the request
b6b68da41b270 perf: evsel: Fix error handling in tp_format lookup
4bc18263ef7ac remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdev
b44f085fb484d cpufreq: schedutil: Fix self-contradictory comment in sugov_iowait_apply()
c23a708a71afc cpufreq: intel_pstate: Fix setting minimum P-state at init time
ce51fcf0d2385 drm/amd/display: Remove unused-but-set variable hubp from
8ee385305e890 drm/amd/display: Fix DM I2C teardown race
5323ed5a7bb25 media: ipu6: Do not free aux device pdata after init
2c29cd408ef86 media: bcm2835-unicam: Fix asc leaked in error/remove path
96baeead354ab media: i2c: rdacm21: Fix missing media_entity_cleanup()
9acc996cb2e84 irqchip/renesas-irqc: Fix generic interrupt chip leak on remove
f6f6bdf1708ac PCI: xgene: Drop unnecessary OF node reference
9c001b7dd4d6c cpufreq: spear: Fix an IS_ERR() vs NULL bug in spear1340_set_cpu_rate()
6a37acecc7c29 dax: read holder_ops once in dax_holder_notify_failure()
91be086330c3f libnvdimm/labels: Bound the on-media label size before the shift
25b472c156364 tools/sched_ext: scx_qmap: Fix stale API name in comment
85e5eeb651a13 regulator: adp5055: Fix error code in adp5055_of_parse_cb()
b8abbd5c2928f cxl/features: Clamp Get Feature output size to the remaining buffer
1281dc84c8157 cxl/features: Reject Set Features output buffer smaller than the header
3f02031a0a53d cxl/features: Reject Get Feature count larger than the output buffer
c656427440ea6 firmware: arm_scmi: Fix transport device teardown lookup
3b0b02134ab90 firmware: arm_scmi: Unwind P2A receiver mailbox setup failure
717b8e972a667 firmware: arm_scmi: Unwind TX receiver mailbox setup failure
a54dc23e8bd22 firmware: arm_scmi: Drop handle on protocol bind failures
8197bc6acc517 firmware: arm_scmi: Protect device request lookup with RCU
71c1f8ced3cc0 firmware: arm_scmi: Use channel ID for transport teardown
e66756313d1b4 firmware: arm_scmi: Reject out of range DT protocol IDs
54e5a4f7d83db firmware: arm_scmi: Avoid IDR updates while cleaning channels
d7c60c0fe2bd4 firmware: arm_scmi: Free transport channel on IDR failure
d33b2b68bce6d firmware: arm_scmi: Clean up channels on setup failure
2aac23bc0a79a firmware: arm_scmi: Quiesce notifications before teardown
f5e528f631425 firmware: arm_scmi: Unregister device notifier before IDR teardown
1bea027f7ef6f firmware: arm_scmi: Publish channel state before callbacks
b967c097d1b6a x86/entry/fred: Encode frame pointer on entry
2bb2a778a4873 wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate
e31985c67ba00 hfsplus: validate thread record before delete key rebuild
5b894d01117b2 cxl/port: Restart port enumeration when a sibling adds the dport first
7a14b995931f1 cxl/pci: Honor -EPROBE_DEFER from component register setup
6ad491cef1a81 cxl/mbox: Break poison list loop on an empty payload
485bf44090491 cxl/memdev: Fix firmware upload exact-fit handling
a97eef0d6e2fe iommufd: Simplify iommufd_device_remove_vdev()
ecad679e2b92c rpmsg: glink: fix deadlock in endpoint destroy during driver detach
dd2b56f44be49 rpmsg: glink: remove duplicate code for rpmsg device remove
c7f41c7f7d68f perf record: Fix multiple PERF_RECORD_COMPRESSED2 records per push
f476567a3a965 perf record: Return the written size from process_comp_header()
8b771b43710f7 perf zstd: Fix compression error path in zstd_compress_stream_to_records()
ae69f936e8ffe fs/resctrl: Prevent use-after-free in rdtgroup_kn_put()
65e55f34fb2d6 media: v4l2-async: Unregister sub-device if asc_list is empty
f0b084c999606 iommufd/selftest: Avoid selftest dirty bitmap size wrap
cd616aa0449a7 isofs: fix out-of-bounds page array access on empty zisofs block
81ff877e458e0 ASoC: apple: mca: increase SERDES reset delay
1b769e5d5c33c RDMA/hfi1: Initialize debugfs after probe completes
a913960dd85dc RDMA/hfi1: Stop flushing the global IB workqueue
e32f985ea38aa RDMA/hfi1: Create workqueues before device initialization
460aaad5044d5 RDMA/hfi1: Remove redundant PCI device ID validation
149a14ec70887 RDMA/hfi1: Free RX data on late probe failure
fd4d3ad5f244a RDMA/hfi1: Preserve unit 0 on allocation failure
186df50ce26fb misc: rtsx_usb: avoid USB I/O in runtime autosuspend
1c1c2df09daac pmdomain: bcm: bcm2835: handle genpd provider registration errors
36cbb7249819a ALSA: hpi: Check transport errors during HPI6000 adapter initialization
0f679e0523ddf xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full
b0f7343a002f9 crash_dump: release keyring reference at the correct time
c115b908e3508 hwrng: ks-sa - Fix runtime PM cleanup on registration failure
4a52a2fb96d10 crypto: ccp - Fix memory leak in SEV INIT_EX path
634e56b4f9913 Revert "drm/msm: dsi: fix PLL init in bonded mode"
287f458ca2251 drm/msm/dp: add missing drm_edid_connector_update() before add_modes on cached EDID
399713f1f0eac RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state
8dc5ffcb8efcc RDMA/ipoib: Drain RCU callbacks during module teardown
7babc25d8dd5b RDMA/mlx5: Drain RCU callbacks during module teardown
9d998297fdaf4 RDMA/core: Wait for RCU callbacks before unloading ib_core
0e5c6bf4a04c8 iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE
dbe8894db922c wifi: rtw89: 8852a: fix RSSI report when average beacon RSSI is not ready
6e4b73b6b743d wifi: rtw89: phy: support per PHY RX statistics
0bae3ec6a16a9 wifi: rtw89: mlo: rearrange MLSR link decision flow
e0abd0b1e2f56 wifi: rtw89: debug: add parser to diagnose along DIAG_MAC fw element
84cb2ae9c0123 wifi: rtw89: fw: parse firmware element of DIAG_MAC
f345b7d23c6f0 wifi: rtw89: pci: add to read PCI configuration space from common code
0cfc9348a045d bpf: Require a BPF cpumask for bpf_cpumask_populate()
abe7ac019ad99 tools/sched_ext: Strip compatibility macros for cgroup and dispatch APIs
9257ece49ae72 clk: qcom: camcc-sc8280xp: unregister CAMCC_GDSC_CLK
086ac3881a8c2 bus: qcom-ebi2: use managed resources for clocks and children
03991f9a561ce soc: qcom: rpmh-rsc: manage PM notifiers with devres
dae798b950388 perf metricgroup: Fix metric expression copy leaks
846ce4d3fda94 drm/panel: samsung-s6d16d0: Power off on prepare failure
39b000d393dea usb: typec: ucsi: gaokun: unwind notifier on UCSI register failure
7f2d926a464bb usb: ucsi: huawei_gaokun: support mode switching
6b0d4519bcf09 usb: renesas_usbhs: Fix power-off ordering on unbind
f0cfba808e632 usb: mtu3: allow system suspend during active gadget connection
7fea5a310e3b2 platform/surface: acpi-notify: Check ACPI companion before use
71ba8b6e28f7a platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL
7e795801295c8 usb: fix UAF when probe runs concurrent to dyn ID removal
ff6e88e29965b usb: gadget: aspeed_udc: check endpoint DMA allocation
aed958c4f784a usb: ljca: bound bank_num in ljca_enumerate_gpio()
afbf39c0f2297 usb: gadget: configfs: fix out-of-bounds read of qw_sign
5fd8baacc7dc4 usb: gadget: f_fs: Fix fence cleanup in ffs_dmabuf_transfer() error paths
c02d030747c46 serial: qcom-geni: do not advance stale DMA completions
783961be18f5c serial: ma35d1: Fix OF node reference leaks in console init
4e2a433822524 serial: 8250: Clear CON_PRINTBUFFER on port re-registration
45c64f2c09b2d serial: 8250: Add support for console flow control
71d8fcbb767b8 serial: 8250: Set cons_flow on port registration
7416aefeeb822 serial: Replace driver usage of UPF_CONS_FLOW
b897b1f791f34 serial: core: Add dedicated uart_port field for console flow
ed07324ed4871 spi: qcom-geni: Fix missing error check on pm_runtime_get_sync()
4c59f0e5ee0df perf capstone: Fix kernel map reference count leak
45181de1077c0 selftests/sched_ext: Fix bpf_link leak on early return in prog_run
892bb4715265f hwspinlock: propagate errno when registering single lock
7420aac8b1f7e remoteproc: qcom_q6v5_adsp: Fix reference leak for device node
9a85e2d35e542 platform/x86: lg-laptop: Fix LED resource handling
c5c3e0036a7ae platform/x86: lg-laptop: Convert ACPI driver to a platform one
f7f83b0826738 platform/x86: lg-laptop: Drop debug-only ACPI notify handler
6ff6af62f042b platform/x86: dell-wmi-base: Fix resource leak on module load failure
9f860050c3d17 platform/x86: dell-privacy: Fix race condition
c9729ced165d6 ACPI: RISC-V: Fix riscv_acpi_add_prt_dep() loop handling
4cdcf4e19ed31 ACPI: RISC-V: Check acpi_get_handle() status in riscv_acpi_add_prt_dep()
7857f19b5219c ACPI: RISC-V: Fix riscv_acpi_irq_get_dep() loop termination
fbf9bb81b2153 printk: Fix possible console use-after-free
b84065e9a8307 printk: Introduce console_flush_one_record
d095438ac3320 leds: st1202: Validate LED reg property against channel count
4efb94335d70f leds: st1202: Disable channel when brightness is set to zero
9666b92fe2383 leds: st1202: Fix brightness having no effect while pattern mode is active
2176b43f70da0 leds: st1202: Set all pattern PWM slots to full after clearing pattern
48a05db611027 leds: st1202: Fix spurious pattern sequence start in setup
45dee22d52fd9 leds: st1202: Fix pattern duration prescaler and pattern_clear skip marker
b8136daec6308 leds: st1202: Stop pattern sequence before reprogramming
e774c612b7f8e leds: pca9532: Fix inverted GPIO output polarity
fb43400a3a0f3 iommu/amd: Fix false positive in SB IOAPIC IVRS validation
21750cb34ca87 iommu/amd: Add support for Hygon family 18h model 4h IOAPIC
1fe5653706500 iommu/amd: Prevent SB IOAPIC from overriding IVRS validation errors
3df590e85e1a2 iommu/msm: Return -ENOMEM on memory allocation failure in probe
9fb04596eb957 bpf: Fix security_bpf_map_create error handling
e7eda48c34679 iommu/mediatek-v1: Fix off-by-one in MT2701_LARB_NR_MAX
5587e7871ce99 bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation
86d54cf069fc5 bpf: Fix use-after-free on mm_struct in bpf_find_vma()
ca71ee2f6c28c efi: fix stale reference to efi_recover_from_page_fault()
2892f3f44bf86 bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux
78cae066f029a perf dso: Fix kallsyms DSO detection with fallback logic
e69d90bfae1aa perf vendor events amd: Reintroduce deprecated Zen 5 core events
71e3023c5dddf bpftool: Check EVP_Digest when computing excl_prog_hash
11afe1912140f udf: Mark LVID buffer as uptodate before marking it dirty
6648c47091837 usb: gadget: r8a66597: avoid double free of ep0_req in probe error path
1f44d001620fd usb: typec: ucsi: unregister debugfs entries on teardown
35bf61798e7d4 thermal/drivers/rcar: Fix error checking in probe()
593fda71983b9 staging: media: ipu7: fix pm_runtime refcount leak in ipu7_resume()
fb9fab1a4d635 staging: media: ipu7: fix pm_runtime refcount leak in ipu7_init_fw_code_region_by_sys()
947056a91d232 perf data convert json: Fix trace_seq memory leak in process_sample_event()
4b759af64a214 clk: qcom: gcc-qcs8300: Use retention for USB power domains
a2e4ebada6840 clk: qcom: gcc-qcs8300: Use retention for PCIe power domains
448f948c9767c arm64: dts: qcom: sc8180x-lenovo-flex-5g: Describe the display power net
3a624b08d7736 arm64: dts: qcom: sc8180x-lenovo-flex-5g: Rename regulator nodes
25026bef5183c arm64: dts: qcom: sc8180x-primus: Describe the display power net
76208cf896aab arm64: dts: qcom: sc8180x-primus: Rename regulator nodes
badb18b11215b arm64: dts: qcom: sc8280xp-arcata: Fix top USB-C DP alt mode
f60f495858379 clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister()
f8fe8cb89d3a8 clk: qcom: gdsc: propagate gdsc_enable() failure for ALWAYS_ON domains
e97f24ad63b83 clk: qcom: gdsc: propagate gdsc_check_status() errors from gdsc_poll_status
27b68ba9af9dd arm64: dts: qcom: Add #{address,size}-cells to Chromium-based /firmware
05a95478f9603 timekeeping: Account for monotonicity adjustment in ntp_error
0fcf7857ae110 y2038: uapi: Use 64-bit __kernel_old_timespec::tv_nsec on x32
db667d2970c75 time/namespace: Validate nanosecond field in proc_timens_set_offset()
ecd622375e6d5 timens: Simplify some calls to put_time_ns()
453812e92c760 timens: Add a __free() wrapper for put_time_ns()
b19176ff94a01 vdso/timens: Move functions to new file
6e4b520553836 x86/tsx: Make tsx_ctrl_state static
e165c01653920 timers/migration: Fix memory leak in tmigr_setup_groups() error path
ed7472619e614 timekeeping: Unwind aux clock sysfs children on failure
4222494df71bd clocksource: Unregister subsystem on device registration failure
f84b1c25712ab selftests: timers: leap-a-day: Fix -w option and update usage comment
d76656e421466 irqchip/gic-v3-its: Fix its node leak in gic_acpi_parse_madt_its()
68de28e0a098a irqchip/gic-v3-its: Fix memleak in its_probe_one()
8da5dc215ebc9 selftests/lsm: Fix memory leak in attr_lsm_count
4d6923a9912da selftests/bpf: Fix memory leak in msg_alloc_iov
58dc854c302a1 selftests/bpf: Fix memory leak in msg_alloc_iov error path
3201c4e882847 ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer()
737c928ff5092 staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()
89f9f433271fa staging: octeon: add missing napi_disable in cvm_oct_rx_shutdown
ab63b49bad0da staging: octeon: replace pr_warn with dev_warn in fill and rx paths
b62bc652590fe staging: octeon: ethernet-mem: replace pr_warn with dev_warn in free functions
269d16a78a5be staging: octeon: fix free_irq dev_id mismatch in cvm_oct_rx_shutdown
2c0c9956596e4 staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown
bcd95498f0cfe staging: fbtft: Use sysfs_emit_at() to print to sysfs file
c9191f2e2f35f greybus: audio: bound the topology section sizes against the fetched size
c458311637182 staging: sm750fb: Add missing Kconfig dependency
af65ceb437971 staging: sm750fb: gate dualview dataflow using g_dualview
311a2e65e42af staging: greybus: audio: correct sscanf() return value check
e7fccad2c8e6e wifi: mac80211_hwsim: avoid NULL skb in stop queue drain
2496d9829ab5e bus: qcom-ebi2: Fix clock leak on probe failure
e6edd7339153c bus: qcom-ebi2: Simplify with scoped for each OF child loop
3cf9e40432c5d clk: qcom: gcc-glymur: Move EVA clocks to critical clock list
7be3c0bae7c58 arm64: dts: qcom: hamoa: Fix clocks for HSPHYs
62b399c4e9856 arm64: dts: qcom: sm7225-fairphone-fp4: Fix address in fb node name
a81fad1ff1047 arm64: dts: qcom: sc8280xp-blackrock: switch to uefi rtc offset
e5965ae3f7c91 cgroup/cpuset: Make nr_deadline_tasks an atomic_t
3a1b23f9ede95 PM: sleep: Fix off-by-one in wakelocks number limit check
0f297bc93bbfd bus: ti-sysc: Fix /chosen node reference leak
ca795fc1d8a1a nvmet-rdma: fix response resource leak on queue teardown
0fed8c64266c2 nvmet-rdma: factor out response resource cleanup
e5a79244a3c52 nvme-apple: Use acquire/release for queue enabled state
7117f27eb3bfb arm64: dts: qcom: sm8750: wire UFS to ice instance
07974c267f603 RDMA/irdma: Add refcounting to user ring MRs
2ed1164153e92 RDMA/irdma: Add irdma_cq fields to track pbl allocations
e11379ca6e90b RDMA/irdma: Add a refcount to track user ring MR associations
8fb2c3106a911 RDMA/irdma: Deduplicate the irdma_del_memlist logic
5bbb726d27ff6 crypto: keembay - Fix AEAD unregister count in error path
e7d8ddd471d28 crypto: rk3288 - fail ahash requests on HASH idle timeout
62219775a07ce hwrng: xilinx-trng - propagate timeout before any data is read
91ded4742fcde crypto: sa2ul - stop probe if context pool creation fails
f4d347fb1309b crypto: atmel-sha204a - fix heap info leak on I2C transfer failure
e64d6f1aae8c8 crypto: atmel-ecc - reject hardware ECDH without a public key
9af019e213ada crypto: qat - clear AES key schedule from stack
6b19f343ae8ad crypto: qat - cancel work on re-enable SR-IOV timeout
cf293c9c7424d hwrng: core - fix rng list on registration error
48b8b438d2342 perf vendor events amd: Update Zen 5 core events
0f456e4eca61a perf/x86/amd/uncore: Add group validation
c6466466185c1 perf cs-etm: Fix thread leaks on trace queue init failure
47b3686dd841a tools/nolibc: mark arg1 operand in __nolibc_syscall0() as write-only
e3aa0446e37d1 fanotify: initialize permission event watchdog state
f2a01deff7d0d wifi: rtw89: fix HE extended capability length check
8f68dd7e4b2f9 wifi: rtw89: check return values in rtw89_ops_start_ap()
74f26d1fa61b2 wifi: rtw89: update format of addr cam H2C command
19052c700bff0 wifi: rtw89: fill addr cam H2C command by struct
847a5ba0ac75f platform/chrome: sensorhub: Fix memory overread in ring handler
e4e2d06623d32 selftests/rseq: Replace glibc-specific __GNUC_PREREQ with portable check
a776afa894245 csky: Fix a4/a5 restoration in syscall trace path
5ac21c880dcd6 iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure
69f73ad463b2e soundwire: qcom: Fix port exhaustion check in stream_alloc_ports
a13974410cee7 dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe
32f69e6c95b59 dmaengine: zynqmp_dma: fix race between runtime PM and device removal
ec927657524be dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers
e429184ed58d6 dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure
bc3b5e6519b8d mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug
d3498c7b587b7 mm: name the anonymous MMOP enum as enum mmop
420d65038c344 mm: change type of state in struct memory_block
fff12ff7b3c47 mm: convert memory block states (MEM_*) macros to enum
d5f2f741a9001 bpf,lsm: Drop bpf_prog_free from sleepable_lsm_hooks
01c5ad41cf4db selftests/bpf: Mask socket type flags in mptcpify prog
d51a838da7a79 selftests/bpf: Systematically add SO_REUSEADDR in start_server_addr
5e9f698298355 bpf: Copy per-CPU map value padding in copy_map_value_long()
e5f6d43168b2e tools/bpf/bpftool: Reset vmlinux BTF after struct_ops commands
82a43463ab091 tools/bpf/bpftool: Reset vmlinux BTF after map commands
46d27e56dbd63 drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup
8a3db9f593b64 drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup
68ce4f8223b78 regulator: tps6594: Fix device node reference leaks in multiphase loop
506a6aca57c78 perf tests: Fix flakiness in branch stack sampling tests
7980e2a92a76a perf test: Fixes for check branch stack sampling
82c0378d4569b perf tests: Fix flakiness in BPF counters test on hybrid systems
da65eac26fb1f perf test: Fix perf stat --bpf-counters on hybrid machines
0eec12a34b949 perf tests: Fix flakiness in trace record and replay test
81877759d7161 perf tests: Add robust record retry helper and use subsecond workloads
2ab5938f8427c perf test kvm: Add some basic perf kvm test coverage
f597922c6e521 perf tests: Skip metrics validation if system-wide recording lacks permission
98e165f28d9b4 perf test: Do not skip when some metrics tests succeeded
79ddb9f98a8ae perf test all metrics: Fully ignore Default metric failures
2f1b696dbbb26 perf test metrics: Update all metrics for possibly failing default metrics
97660f007672a perf test: Truncate test description to fit terminal width
de9c6dc47601f perf test: Truncate printed test descriptions dynamically to avoid terminal wrapping
17e39d310b884 perf test: Add -j/--junit option for JUnit XML test reports
bdd10298be150 perf test: Fix subtest status alignment for multi-digit indexes
68a81a1eb8d3c perf test: Add summary reporting
456e1e7ce2092 perf test: Show snippet failure output for verbose=1
a3d0aad7e44a1 perf test: Refactor parallel poll loop to drain all pipes simultaneously
1acc1bedf4e69 perf test: Drain pipe after child finishes to avoid losing output
a2590ff90dca6 wifi: ath12k: correct monitor destination ring size
5d80268945dfe media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define
6ee86a39a2ff6 media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define
9be10543297f0 riscv: kexec_file: Fix crashk_low_res not exclude bug
68ea6dd23b732 pinctrl: bcm2835: Don't remove an unregistered GPIO chip
d623e292c6a4c perf/x86/intel/uncore: Keep PCI PMUs working when MMIO/MSR setup fails
18fdd0978ec3d sched/fair: Fix overflow in update_tg_cfs_runnable()
912e7263488e1 mm/mm_init: fix incorrect node_spanned_pages
e2a7cee341986 drm/lima: call drm_mm_init() with a valid allocation range
d46160ed28478 clk: imx: scu: drop redundant init.ops variable assignment
79927acbd4594 arm64: dts: imx93-kontron: set memory node to 0x80000000/1GiB
6b82e11ed1833 ARM: imx: fix device_node refcount leaks in imx7_src_init()
cfec229dbe9ab ARM: imx: fix device_node refcount leak in imx_src_init()
9326fd5972eaa clk: hisilicon: reset: Use devm_kzalloc to initialize hisi_reset_controller
e921cc73fae68 ASoC: fsl_audmix: rework runtime PM handling in probe
1e8fddab6cbe5 ASoC: rt700-sdw: always drain jack work on remove
61cae8df14219 clk: stm32: add missing bitfield.h header
c77bf8b2ca740 clk: nuvoton: ma35d1: fix ma35d1_clk_pll_determine_rate logic
4c7503f14f25b clk: nuvoton: ma35d1: fix PLL_CTL1_FRAC bit field width and fractional calc
e165e15e1a9c8 clk: nuvoton: ma35d1: fix ignored div_u64 return values in PLL freq calculation
5e273be0a987a clk: moxart: remove unused variables, fix refcount leak
fe3e4196a57a9 clk: versaclock7: Fix APLL clock leak on probe failure
4ffaaef885fcc cxl/pci: Remove incorrect mbox.valid check in cxl_pci_type3_init_mailbox()
31d4841eca7c4 cxl/mbox: Clamp mailbox output allocation to the payload size
5b616612511eb media: cec-pin: Fix event FIFO ordering
f1fac4561cda1 soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap()
635914c60da26 HID: roccat: bound device-supplied profile index
dc32c7423b346 HID: nintendo: Fix imu_timestamp_us double increment per report
544ebb25bd58f HID: core: quiesce input in hid_hw_stop() to prevent use-after-free
97093398e75a7 selftests: proc: include fcntl.h in proc-pidns
e4728288473a5 platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count
f633cc23dbcc4 x86/cfi: Use symmetric SYM_START and SYM_END in __CFI_TYPE()
71ddadef3b912 sched_ext/scx_flatcg: Fix cvtime_delta race and add hweight scaling to bypass charging
9c73cf53361f2 smack: restrict smackfs/{direct,mapped} values to 0-255
01d32783bbe01 smack: deduplicate smackfs/{direct,mapped} file_operations
845525bfb547a smack: simplify write handlers of sysfs entries
c2ab27c2e1159 smack: fix incorrect task context in smack_msg_queue_msgrcv
04e674840f7e1 drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure
97b8580a112cc drm/bridge: cdns-dsi: Return an error pointer on allocation failure
4614b7cfaf813 drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format
e4c3fb6999a49 drm/rockchip: vop2: Add RK3576 to the RG swap special case
3a8aa74859dd7 drm/v3d: Clear queue->active_job when v3d_fence_create() fails
7d65d9651f104 drm/bridge: display-connector: trigger initial HPD event for DP
826426c26b243 drm/bridge: display-connector: don't autoenable HPD IRQ
396a193867c6e drm/rockchip: analogix_dp: Fix OF node reference leak via auto cleanup
55fda5c2887a2 drm/rockchip: analogix_dp: Enable hclk for RK3588
b4eb01616c0da drm/rockchip: vop2: Wait for layer cfg done before switching LAYERSEL_REGDONE_SEL
e97f4b4efc1ab drm/rockchip: vop2: Fix wrong wait target in layer cfg done check
362e005b816ee drm/rockchip: dw_dp: Release core resources
fe000d791c608 drm/rockchip: dw_dp: Add missing newline in dev_err_probe() message
82861bdcafda0 drm/rockchip: dw_dp: Simplify error handling
435de4476dd87 drm/bridge: synopsys: dw-dp: Set pixel mode by platform data
b2bec2d4a769d drm/bridge: synopsys: dw-dp: Support unregistering the AUX channel
5afa737da00e5 drm: lcdif: Wait for vblank before disabling DMA
fa633af222c82 drm: Remove unused header in drm_dumb_buffers.c
2a0423c648a6d Smack: Fix error in capability bypass
31507f01ba6d6 KVM: x86: Check EFER validity on KVM_SET_SREGS*
d975b36e56876 KVM: x86: Move the bulk of register specific code from x86.c to regs.c
10ddef36d1cc0 KVM: x86: Rename __{g,s}et_sregs2() => kvm_vcpu_ioctl_x86_{g,s}et_sregs2()
8c03b907b0955 KVM: x86: Extract REGS and SREGS runtime sync code to helpers
9b046de62b809 KVM: s390: Zero initialize data structures for inject_pfault_token
310df38690e9f KVM: x86: Disallow EFER.LME and EFER.LMA if long mode is not supported
5453b85c7ebb6 KVM: arm64: Remove VM-wide VNCR mapping counter
fd33e8abbcad1 media: dt-bindings: nxp,imx8-isi: Drop fsl,blk-ctrl requirement for i.MX8ULP
5cbd8761d001c KVM: arm64: Handle VNCR TLB invalidation race with vcpu_put() VNCR unmapping
892fb48d9dc77 KVM: arm64: nv: Fully update VNCR fixmap state in kvm_translate_vncr()
8195cf3f4a82e dm-pcache: validate the persisted dirty_tail chain at load
3d5a87cb909c1 dm-pcache: bound the logical key offset from persistent memory
01a700e9278da dm-pcache: reject a kset that overruns its segment
9693980cd7d2f wifi: rtw89: pci: add .shutdown callback to stop rfkill polling on reboot
9e8dd2a7a8ccb usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers()
d1856e87ee562 usb: cdnsp: fix wakeup from S3 after controller context loss
3776b82c8099e tracing/probes: Fix anon_stack check for unnamed bitfields in btf_find_struct_member
240558d6e6caf staging: sm750fb: fix mono image source stride mismatch in lynxfb_ops_imageblit()
e5daaf27b14db platform/x86: hp-wmi: Add support for OMEN MAX 16-ak0xxx (8DD6)
1b5c3f11ba548 platform/x86/amd/pmc: Fix msg_port restoration in amd_stb_debugfs_open_v2()
bf87d1ec3bc23 perf/x86/intel: Remove anythread_deprecated bit from perf_capabilities
cbb25069fd2e7 mm: fix incorrect vm_flags usage when checking allowable orders for tmpfs
853043cb12947 mm/secretmem: properly account locked pages
8e3adebbdd20f mm/mremap: reset unfaulted VMA page offset for MREMAP_DONTUNMAP
effe3cc6d4fdd mm/huge_memory: transfer the pmd dirty bit to the folio on zap
4f3145db05fed i3c: master: Fix use-after-free of master->this
d0cc00957292e i3c: master: Do not treat master device as a duplicate target
83fd7eca5ab0d ftrace: Take trace_array reference before accessing its ftrace_ops
3ae455597e3ea clk: qcom: Fix test_ctl_hi field for DEFAULT_EVO PLLs
45962da5821d0 accel/amdxdna: return early from a zero-length flush
be072a5d5e35f nvdimm: virtio_pmem: refcount requests for token lifetime
4fbee1039c460 io_uring/waitid: avoid siginfo copy during ring teardown
7549d2d113d4a nvdimm: virtio_pmem: use READ_ONCE()/WRITE_ONCE() for wait flags
0879697520abd io_uring/waitid: honor task_work cancellation
8c6bc1974311a nvdimm: virtio_pmem: always wake -ENOSPC waiters
63e1a529bb89b io_uring: add wrapper type for io_req_tw_func_t arg
c5e2e145bc5e3 nvdimm: virtio_pmem: stop allocating child flush bio
0860017371131 io_uring: only call io_should_terminate_tw() once for ctx
d0f37d77b9b4b tracing: Take trace_array reference when opening options file
23a02ff3464b2 i2c: qcom-cci: fix autosuspend cleanup
844839aa89e79 futex: Provide rt_mutex_.*_schedule() equivalents for futex scheduling
770a90c212722 nvdimm: pmem: keep PREFLUSH before data writes
15d10440b7968 io_uring/waitid: have io_waitid_complete() remove wait queue entry
76648677aa6ef tracing: Make printk_trace global for tracing system
538ef70da5229 i2c: qcom-cci: Remove overcautious disable_irq() calls
884e8484c5fe8 futex: Optimize futex hash bucket access patterns
5f00df2a88ab4 udf: Fix data loss when converting inline inodes to out of line
e4cb2bbe73089 tracing/probes: Fix BTF kflag check for anonymous struct member access
4420cc71841b5 staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()
6ba2bacc2dd3e ring-buffer: Allow splice reads on static buffers
f5eed5182d664 platform/x86: ISST: Validate max level for set feature
08dab7065f936 platform/x86: int1092: Fix potential memory leak in sar_probe()
929cb3b9dc818 perf: Fix use-after-free when perf mmap() revival races with the last munmap()
2050d900f9adb PCI: Allow per function PCI slots to fix slot reset on s390
7fad53ae2052a nvme: skip the zoned limits update if the zone info query failed
6906fb70af2de net/mlx5e: do not HW-GRO coalesce small frames
558bfaea4926c mtd: rawnand: pl353: Make sure we use the monolithic helpers for raw accesses
824348676a50f misc: fastrpc: don't publish fd before copy_to_user() succeeds
f3d97800b03cd iio: light: apds9306: fix PM reference leak in apds9306_read_data()
b25232f66e8cd i3c: master: Fix recursive locking during device registration
e9e52437120fb ALSA: FCP: do not copy out an uninitialised init response
5881506012f39 nvdimm: preserve flush callback -ENOMEM
545daf1133323 io_uring: unify task_work cancelation checks
400607f57f11d tracing: Clean up use of trace_create_maxlat_file()
871019760cd42 i2c: qcom-cci: Do not check return value of cci_init()
54bc09b41bf3a compiler_types: Move lock checking attributes to compiler-context-analysis.h
9e5abb5e2ade0 wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy
84d983e550c75 udf: Move udf_map_block() up
7d73adba5c851 tracing/probes: ignore id update from btf_type_skip_modifiers
956cb6c72ae5c staging: rtl8723bs: fix spacing around operators
cca153095a185 ring-buffer: Show persistent buffer dropped events in trace_pipe file
803208a50b042 PM: runtime: Wrapper macros for ACQUIRE()/ACQUIRE_ERR()
0d4fb4f15e550 platform/x86: ISST: Check for admin capability for write commands
e94b156e5cad0 platform/x86: intel_sar: Check ACPI_HANDLE() against NULL
b07bcdca18fb9 perf/core: Fix deadlock in perf_mmap() failure path
1d7be6ff21edc PCI: Introduce PCI_SLOT_PLACEHOLDER constant for slot_nr placeholder value
b8adb1ffa263c nvme: fold nvme_config_discard() into nvme_update_disk_info()
2158e178dfc85 net/mlx5e: SHAMPO, Always calculate page size
285f7f3a651c7 mtd: rawnand: pl353: Add message about ECC mode
7ef12e1dd06e4 i3c: master: Fix device_register() error path
69d57dbadb27f dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds
9d89ffd9101c8 ALSA: usb-audio: Relax __free() variable declarations
37ac5eb981f42 batman-adv: fix TX priority extraction for BATADV_FORW_MCAST
a1a0959b2da03 mm/damon/sysfs: read ops_id only once in damon_sysfs_apply_inputs()
8bcfa58c4277b batman-adv: bla: avoid CRC corruption due to parallel claim add
a5e4d6cb4f684 batman-adv: dat: atomically update mac addresses
463743d1d5ef2 drm/amd/display: Scale custom brightness curve from full range
7e56deae5a796 drm/amd/display: Fix backlight max_brightness to match exported range
54a97ef102523 net/mlx5e: xsk: Fix unlocked writing to ICOSQ
f6388029ea9e2 Linux 6.18.51
d83a9de7cecd4 ksmbd: zero pipe read compound padding
75640976cf474 cifs: add fscache_resize_cookie() to cifs_setsize()
d73f79d1a2c26 mm/hugetlb_vmemmap: fix incorrect vmemmap restore in rollback
15803e2276067 pidfs: protect PIDFD_GET_* ioctls() via ifdef
ed7380f4621f6 mm/huge_memory: use folio's memcg inside __folio_split()
80656031dfcd4 migrate: replace RMP_ flags with TTU_ flags
e4307837d92ca mm/huge_memory: replace can_split_folio() with direct refcount calculation
f07c94cd3cc20 mm/huge_memory: change folio_split_supported() to folio_check_splittable()
305f9b6eb8a06 mm: thp: use folio_batch to handle THP splitting in deferred_split_scan()
0a4a3d7202640 mm: thp: introduce folio_split_queue_lock and its variants
d913a85cc5f7a mm/damon/core: initialize damos->last_applied
05bdb7b867bef mm/damon/core-kunit: handle region split failure in filter_out()
7d4ecfb507f33 mm/damon/sysfs: read addr_unit only once in damon_sysfs_apply_inputs()
cd6d7f45abc82 mm/damon/core: skip aging from repeated aggressive merging
081ee85b43096 mm/damon/ops-common: use nr_accesses moving sum for quota score
cf94a9043f4a6 mm/damon/paddr: drop last same folio access check reuse optimization
11e4859ec0d8b mm/damon/vaddr: drop last same folio access check optimization
4c7275444ac65 mm/damon/tests/core-kunit: catch test failure in test_merge_regions_of()
05dc22d5c4fac iommu/arm-smmu-v3: Add HAFT support for SVA
c660c017dec1f power: supply: ab8500_fg: fix use-after-free on remove
68916940332d1 power: supply: ab8500_fg: Remove redundant dev_err()/dev_err_probe()
62fb3124bf740 Docs/ABI/damon: fix typo in intervals_goal sysfs path
1811bd8792ee1 mm/hugetlb_vmemmap: fix __hugetlb_vmemmap_optimize_folios()
dba93b8cceb00 hugetlb: remove VMEMMAP_SYNCHRONIZE_RCU
e4d1300b457e2 mm: rework compound_head() for power-of-2 sizeof(struct page)
5cec3e60e9f2d zram: set default primary compressor in zram_destroy_comps()
fb0e9ecffae59 zram: fix the issue that the write - back limits might overflow
9a78de3befad6 zram: read slot block idx under slot lock
fcd467124b19f zram: drop wb_limit_lock
d1743ec2dd2c8 zram: take write lock in wb limit store handlers
e7dbcb7a561a2 zram: fix out-of-bounds access in read_block_state()
878edb39ecf48 zram: fixup read_block_state()
83dd59ac1c345 NFSD: Prevent client use-after-free during close_lru reaping
cd489b0358737 NFSD: Prevent client use-after-free during blocked-lock reaping
7f1abc50ce253 NFSD: Consolidate the revocation-path client unpin
3be89e8039a85 smb: client: reject a tree connect response whose byte count is too small
b7e74bccf5887 cifs: Do some preparation prior to organising the function declarations
672cf86aa6aa0 smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()
9eed72e9534b1 smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2
31307a05ed827 cifs: SMB1 split: Separate out SMB1 decls into smb1proto.h
6493277a52b24 cifs: SMB1 split: Create smb1proto.h for SMB1 declarations
e7779c9f7e7f9 cifs: Remove dead function prototypes
b10015807e4c6 smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions
a3e8b98c823d5 cifs: Scripted clean up fs/smb/client/smb2proto.h
72796c2ec6e90 cifs: Scripted clean up fs/smb/client/fs_context.h
4fb5a561866c4 cifs: Scripted clean up fs/smb/client/fscache.h
1537c6c675104 cifs: Scripted clean up fs/smb/client/cifs_unicode.h
549bd9868e9d7 NFSD: Prevent client use-after-free during admin state revocation
3c0a53ee0b442 NFSD: Prevent client use-after-free during delegation revoke
969b1fefb07d1 nfsd: convert global state_lock to per-net deleg_lock
6d6b9f6a75c37 nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache
9031493ef7369 nfsd: fix UAF in async copy cancel and shutdown
ba0ee9e04b7a0 nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net
f9cec313efb2f nfsd: fix clock domain mismatch in clients_still_reclaiming()
03c512f22d3fb nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage
ccc069d5c47cd nfsd: move struct nfsd_genl_rqstp to nfsctl.c
430ed49a16cf9 nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create()
380d138a6b086 net: advertise TCP MSS from the configured MTU, not the learned PMTU
cfb44c6028e6f tcp: clamp route advmss to TCP_MIN_MSS
ea44679bc7d21 ipv4: use dst4_mtu() instead of dst_mtu()
a615a2c8c3062 ipv6: use dst6_mtu() instead of dst_mtu()
920dacce8734d inet: add dst4_mtu() and dst6_mtu() helpers
b650560c5ee21 ipv6: add some unlikely()/likely() clauses in ip6_output.c
a294168185fe8 ipv6: pass proto by value to ipv6_push_nfrag_opts() and ipv6_push_frag_opts()
194d0fb0ea472 fuse: copy request headers via a stack buffer for io-uring
b96b0d2c25d14 fuse-uring: use named constants for io-uring iovec indices
f12ebb0a3ed7d fuse-uring: refactor setting up copy state for payload copying
121fc8edf5832 fuse-uring: use enum types for header copying
c46805193fbef fuse-uring: refactor io-uring header copying from ring
6bb5347e9f8aa fuse-uring: refactor io-uring header copying to ring
8974575898cd7 fuse: fix missing barrier when checking io-uring readiness
f1c91222188be PCI: starfive: Fix resource leaks on error paths in host_init()
e5c1d10003b4d PCI: starfive: Use regulator APIs to control the 3v3 power supply of PCIe slots
0d72e78c9d38d lockd: fix swapped arguments in nlmsvc_match_ip()
fcfcba8fe17db ocfs2: validate directory-index entry counts when reading metadata
625e00fd25ef5 ocfs2: validate dx_root extent list fields during block read
a1dabe68fb537 ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page
a6f3b8dfbdf4f ASoC: codecs: aw88261: only check PLL and clock state at power-up
0ac722e964cdc ASoC: codecs: aw88261: reduce log spam
d013b7de4dccf remoteproc: qcom: pas: Guard dtb metadata release with dtb_pas_id check
d6eab9066be0f firmware: qcom_scm: Rename peripheral as pas_id
9d69422ddaa13 sched/core: Make core-sched flips wait for in-flight selections
fef4b8f17e1c5 sched: Rework prev_balance() to avoid stale prev references
c522333c35d48 sched: Add assert_balance_callbacks_empty helper
c97be9d5ab04c sched_ext: Fix inverted ops.core_sched_before() invocation
c4ade059aaeb5 scsi: fnic: Use GFP_ATOMIC for VLAN alloc under spinlock
c98197ee3cd28 RDMA/ionic: Embed counter driver data in rdma_counter allocation
27b7b0dacae79 sched_ext: Fix exit_task leak on fork failure during enable
1a3af2262cb38 svcrdma: Reject Read lists that exceed the page budget
59bcf1b38f898 svcrdma: Reject oversized Read segments at decode time
3c97b8e76ca2b rpcrdma: arm rn_done before publishing the notification
9f2f5d0999364 svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id
ee7f6e5600ae1 svcrdma: Release transport resources synchronously
3ff45361e9469 SUNRPC: fix gssx_dec_option_array error path bugs
5563db13c9528 cxl/mce: Make the MCE notifier per-region
513a9613f7a63 cxl/region: Add helper to check Soft Reserved containment by CXL regions
040cface98ffd dax/cxl, hmem: Initialize hmem early and defer dax_cxl binding
dfc86b0c2698e cxl/ras: Fix cxl_rch_get_aer_severity() wrong severity register
ccf481d73bce6 bpf: Disable preemption in bpf_get_stackid
b466ff95324f8 bpf: Use stack id functions instead of __bpf_get_stackid
73ebef25aec49 bpf: Factor stackid_new_bucket from __bpf_get_stackid
ba1e22a224c39 bpf: Factor stackid_fastpath function from __bpf_get_stackid
201a381bef3ac bpf: Factor stackid_init function from __bpf_get_stackid
7c19b94c625dc cpufreq: apple-soc: Fix OPP table cleanup
e989cede44392 ACPI: TAD: Add locking around AML evaluations
dd440f6a2e67f ACPI: TAD: Rearrange RT data validation checking
0a7a192862232 ACPI: x86/rtc-cmos: Use platform device for driver binding
ec2d81115485d ACPI: x86: cmos_rtc: Create a CMOS RTC platform device
f2e08c3f994c9 ACPI: CPPC: Reject desired_perf reads on _CPC revision 4+
7267557ce98cc erofs: skip sufficiently large global buffers when resizing
03c34309eb1bc HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes
1a503fbb116da HID: mcp2221: fix OOB write in mcp2221_raw_event()
3b4709e486490 HID: sony: clean up device list on probe failure
a15def9a6311e HID: sony: use guard() and scoped_guard()
d2dd2cced65bc cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem
85d239160dc1b smb/client: emulate small EOF-extending mode 0 fallocate ranges
41f4c99787398 smb/client: reduce fallocate zero buffer allocation
c2ae13662137c smb: move some definitions from common/smb2pdu.h into common/fscc.h
110747ff535e3 ceph: properly decrypt filenames in vmalloc() buffers
104a51265042b NFSD: Guard admin state-revocation walks with NFSD_NET_UP
0e763ab306a81 ceph: force a cap message when a deferred revoke can't be acked immediately
c040e139f1a62 ceph: cap delegated inode count in ceph_parse_deleg_inos()
8bd3523df1319 cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read
6f9b62687a383 cxl/pci: Move CXL driver's RCH error handling into core/ras_rch.c
153b5ecd29ed0 usb: gadget: f_fs: Fix Use-After-Free in AIO error path
f3d31484b3f26 USB: gadget: ffs: fix mm lifetime handling
06c76d3c389ff mm/page_alloc: don't spin_trylock() in NMI on UP
22bbde1960d1d x86/xen: fix init of balloon stats again
6f53c64a880ff xen/balloon: improve accuracy of initial balloon target for dom0
b4a6050bde9ec mm/slub: fix missing debugfs entries for caches created before sysfs init
d08ea0fd70386 mm/slab: move and refactor __kmem_cache_alias()
e7bd804e3c719 mm/rmap: use huge_ptep_get() in try_to_migrate_one()
54a58d6656dd4 mm/mglru: fix and remove redundant unevictable folio handling
d4812d21689f1 mm/mglru: use the common routine for dirty/writeback reactivation
09505232eced5 mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier
daeffb841bb96 mm/hugetlb: refactor code around vmemmap_walk
b662d7bcb5ecd mm/hugetlb: defer vmemmap population for bootmem hugepages
edc017be82664 rust: bug: prevent dead_code warning from warn_on!'s flags constant
cf24ce48d6022 pidfd: hold exec_update_lock around namespace ioctl
7aa9ab5321589 pidfs: simplify PIDFD_GET_<type>_NAMESPACE ioctls
2fa220bc0f845 ovl: fix double end_creating() on the casefold-mismatch path
1c4b90902c05c crypto: atmel-ecc - avoid stale fallback key after set_secret failure
5c1e763b713f0 crypto: atmel-ecc - clean up and improve ECDH comments
e39767b9a54d9 crypto: atmel-ecc - replace min_t with min
fc933a4a419ba crypto: iaa - unmap dst before software fallback on decompress
4fcbc9f4082ca crypto: iaa - fall back to software for multi-entry scatterlists
1517d1996b523 vlan: fix skb_under_panic and races when toggling HW VLAN offload
ed25ed29034dd net/packet: defer vmalloc TX_RING free until skbs finish
0f93090445294 fuse: fix race between interrupt and resend
f98640c27cde3 fuse: remove fm arg of args->end callback
952f7a6d392b8 fuse: split off fuse_args and related definitions into a separate header
a5bb215dbc34b fuse: publish io-uring queues with release semantics
c051f66b62169 usb: xhci: bail out of setup if the controller is inaccessible
f0ccc2d323d06 usb: xhci: simplify handling of Structural Parameters 1 values
46fb722a3bcf0 usb: xhci: use cached HCSPARAMS1 value
4e141571d0257 usb: xhci: implement USB Port Register Set struct
8dbc9c86c3186 usb: xhci: add USB Port Register Set struct
8b7ca0029e94b usb: xhci: add helper to read PORTSC register
a363197790a87 usb: xhci: add tracing for PORTSC register writes
78e8ee25a5e8f afs: Fix leak of ungot volume
c8279ae8df68c ksmbd: fix use-after-free in oplock break notification
e5e7a61fa9e82 drm/nouveau/gsp: fix vblank interrupts on GB20x
dc7c40ffaa1b6 drm/nouveau/disp: fix head state readback on GB20x
0e346b65a4130 drm/nouveau/disp: fix HDMI GCP AVMute register offsets on GB20x
ecb110991bc94 drm/nouveau/disp: fix HDMI vendor infoframes on GB20x
4739d519def72 drm/nouveau/disp: route GSP-RM display MMIO through nvkm_disp_func hooks
94d8195eb4185 drm/nouveau/disp: move the GSP HDMI GCP AVMute write to engine/disp
a046e789ab66e drm/nouveau/disp: move GSP head-timing ISR and vblank helpers to tu102.c
1101cbfe7f342 drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE
24c25b182d17d drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE
b7dc03e09313d drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op
4cf436de06ca9 drm/nouveau: Use write-combined maps for coherent
f3830fdd6930e drm/nouveau: unsubscribe the channel-kill event before the fence context
5ba4bcb3b96cd drm/nouveau/gsp: use per-version DP_CONFIG_STREAM params on r570 firmware
859d8b6c5b274 drm/sysfb: ofdrm: Fix is_avivo() constant comparison bug
ded6ad826fe0f drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation
6892f0a2f6b59 drm/sysfb: simpledrm: Improve stride validation
54e32ad5e0c74 drm/sysfb: simpledrm: Improve panel-size validation
8d65b8d1722d8 drm/sysfb: simpledrm: Improve framebuffer-size validation
fd3462acf6590 drm/amdkfd: Reject zero-sized AQL queue allocations after size halving
ebffa44e7a21e drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore
ae806a95b28fc drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram
da87bcad1f781 drm/amdkfd: Fix error path at svm_migrate_copy_to_ram
e230c546ed937 drm/amdkfd: Add TLB flush after MES queue eviction/suspension
2e4b909fab96c drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT
65e643703f150 drm/amdgpu: update the fw version for gfx12 userqueues
b7cb1b6696137 drm/amdgpu: update the fw version for gfx11 userqueues
8de8b4e11ce48 drm/amdgpu: Skip accessing psp rum time db for APUs
492dbf832964c drm/amdgpu: fix autosuspend cleanup during removal
812c406f75291 drm/amdgpu: Disable runtime PM for externally attached dGPUs
964de255497ff drm/amdgpu: clamp the isolation index for rings outside a partition
b3a7e0b69903e drm/amdgpu: check thunderbolt before switcheroo registration
66b1b30988633 drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used
acd2dd6ecd89e drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value
72a95df6bbc7d drm/gud: validate TV mode names before creating enum property
b86438a5c6b02 drm/gud: NUL-terminate TV mode names read from the device
7e28853c78c20 drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check
0b2615b8b54f5 drm/amd/display: validate plane degamma LUT size for private color prop
295d2bf42061d drm/amd/display: fix dc_lock leak on GPU reset error paths
ee28fafb50f58 drm/amd/display: avoid divide-by-zero in __is_lut_linear()
4ac7677221754 drm/hibmc: Use drm_atomic_helper_check_plane_state()
ed38f0be5b61d drm/hibmc: Fix list of formats on the primary plane
f5acd8f48cacc drm/nouveau/disp/r535: Add scanline position support + head state support
6f9bdbe713fdf drm/ssd130x: fix column and row end address in partial updates in ssd133x
6f776d0e43e04 drm/sun4i: fix refcount leak in sun4i_backend_init_sat()
63c70e292e6b4 drm/ssd130x: fix column and row end address in partial updates for ssd132x
18b3433f10ee9 drm/i915: Guard against NULL driver_data in i915_pci_probe()
79d09cfe90304 drm: fix race between partial drm_dev_register() failure and ioctl
0259846b15a66 drm/panel-edp: fix i2c adapter leak on probe failure
b51d8fb5e58c2 drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure
80c9528661c77 drm/panthor: fix firmware control interface bounds checks
5516f1acfd075 drm/panthor: harden firmware build-info bounds checks
ef41e8e4ae5b7 drm/xe/vram: report FLAT_CCS base misalignment
e184e46ca1ba6 drm/amdgpu: Fix init ordering in amdgpu_vram_mgr_init()
91ec55ddc097c f2fs: fix to zero post-EOF data when extending file size
a984446aa9d5b f2fs: fix to pass folio->index to f2fs_sanity_check_node_footer()
dde99df5a9d3b f2fs: fix valid block count leak on data block allocation failure
ab35ae07f2b5b f2fs: fix to clear dirty flag on folio in error path
c16cc4622e4b6 f2fs: fix to off-by-one issue in f2fs_zero_post_eof_page()
f6c49fae98f0f f2fs: fix i_size when pinned fallocate partially fails
161513f53e4ac f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages()
b8ae1228c1536 f2fs: fix to migrate all curseg types during free_segment_range
aefcec3bebdee f2fs: avoid NULL checkpoint thread access in sysfs
aefb4b0f465b6 f2fs: fix dentry folio leak in find_in_level
94917ffab3a94 f2fs: fix to avoid potential section-unaligned pinfile
3e61c3944b83c f2fs: return writeback error from collapse range
3b681229e9f8f f2fs: use the mount idmap for the owner check in f2fs_xattr_advise_set()
db504781ea9b0 f2fs: dirty directory inodes on mtime/ctime update
dc652b2fe916c f2fs: fix to avoid move_range and defragment on device_alias file
445e4a1e6025e f2fs: only redirty pinned folios in redirty_blocks
7f89e2775d5bb f2fs: reject overlapping move range after len expansion
95d5975c9d1c5 f2fs: return symlink writeback errors
ac4b019ac0784 scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started
4fe5790674097 scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak
0bdd0f7a1094a scsi: qla2xxx: Use coherent DMA buffer for D_Port diagnostics
776e4e8cbcf15 scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition
16c731c4f2961 scsi: qla2xxx: Drop vport reference under lock in report ID acquisition
17fb63c1d0fcd scsi: qla2xxx: Fix NVMe abort reference leak on repeated abort
5dd9bec8004ba scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry()
d7f7746ff031a scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read
9fa1d71233a82 scsi: qla2xxx: Avoid double completion in async IOCB timeout
10e9f05f7fd0a scsi: qla2xxx: Quiesce response IRQ before freeing request queue
31715d1e1cbf3 scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb()
e93aa3c5125d9 scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path
a194684853dce scsi: qla2xxx: Don't query firmware state while chip is down
7203d4aed8f44 scsi: qla2xxx: Fix FCE trace enable parsing in debugfs
e6cfb1ee18336 scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state()
8e7a26931b611 scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump
8286a9095fb59 scsi: qla2xxx: Fix cs84xx use-after-free on host teardown
8d11613711937 scsi: qla2xxx: Serialize flash version read in reset handler
7a448f5ed0b28 scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation
11834e5773e20 scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject
7b22b4cb88228 scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions()
5ecdb336df2a9 scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config()
67f0d5187c293 scsi: qla2xxx: Initialize NVMe abort_work once at submission
47272152a13d2 scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()
206df5ffa72dc scsi: qla2xxx: Fix Name Server logout detection on FWI2 adapters
94bfb61478bcb scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check
97ca58b0fb026 scsi: qla2xxx: Bound i2c->length in I2C bsg handlers
b157256c28086 scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers
dec5624a3f8cb media: chips-media: wave5: Set inst->std during default format initialization
a0506198a77b9 media: chips-media: wave5: Guard bit depth check with initial_info_obtained
ff98cd2b8b54c media: qcom: iris: use disable_irq() during power-off
ab6f088a44ef7 media: qcom: iris: fix state-change debug log printing stale value
f1c4f3885df1f media: zoran: Avoid freeing a registered video_device twice
dc005cb7ccb0c media: vimc: fix pixel format lookup in enum_framesizes
52fd9d80c0cea media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure
4a187d9443845 media: venus: fix payload size calculation in parse_raw_formats()
d031b5ecc4b39 media: venus: fix payload size returned by parse_caps() and parse_alloc_mode()
3ced388b79082 media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link
331f22dd63bf9 media: v4l2-ctrls: Allow unknown HDR10 white point and luminance
3345746e0957b media: v4l2-async: avoid deleting unlinked ASC entry on link error
7c62bd6535639 media: tda18250: fix possible integer overflow
4d2048466af9e media: saa7164: fix cleanup on resource allocation failure
342632a4d8ba3 media: s2255: check firmware size before reading trailing marker
68d664f1b4efe media: s2255: bound JPEG frame size before copying into the buffer
93e6ed88f5084 media: rzg2l-cru: Align bytesperline to hardware DMA stride requirement
26a2a985bbeee media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure
7443b16b6dd88 media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak
12b88016c199e media: rkvdec: Propagate platform_get_irq() errors
5b58d8c206f37 media: rc: sunxi-cir: Unregister rc device on probe failure
8281acf5d7049 media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks
9392375dd4c01 media: nxp: imx8-isi: Correct color map between V4L2 and ISI
2f9b2768d5ceb media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing
5026f927ef415 media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup
252850653569f media: platform: mtk-mdp3: Fix SCP device refcounting
96dafbae77f50 media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common
24aca88390388 media: iris: Enumerate cap->bus_info to differentiate between encoder and decoder
27b7997be552e media: intel/ipu6: fix async notifier cleanup leak on parse error
1d59c5254c33a media: imx355: Avoid calling imx355_power_off twice in error path
af81f35e4f429 media: i2c: ov7740: fix use-after-destroy in remove
90f9b421fc6d4 media: i2c: ov02a10: fix endpoint parsing use-after-free
4f8fd40b39bf7 media: i2c: imx415: Return test pattern write errors
1aa66bb3ba440 media: i2c: imx415: Release runtime PM reference on VBLANK error
312c68e9ed8a4 media: i2c: alvium: Fix: Correct name of register in alvium_set_ctrl_auto_exposure
0745a59945d92 media: go7007: defer the ALSA v4l2 put until card release
0782807552b6a media: em28xx: fix use-after-free of dev_next->devlist on disconnect
f9322ac9f8629 media: em28xx: defer audio-only extension registration
bf3f49273d5bf media: cx23885: cancel NetUP CI work before teardown
7087bef6510c7 media: cx231xx: reject geometry changes while the VBI queue is busy
cb1218da234ea media: cobalt: Avoid freeing ALSA private data twice
f78cf36cabf91 media: cedrus: fix memory leak in cedrus_init_ctrls()
5c62095acc2a9 media: cec: Serialize exclusive follower delivery
38c14532adb34 media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash
673611cc2ab97 media: cec: extron-da-hd-4k-plus: add sanity check
a3adb63b12193 media: cec: disable delayed work before freeing an interrupted transmit
695063fc57574 media: cec: core: Fix kmemleak due to missed rc_free_device() call
cb7a4cf63fa20 media: amphion: Remove obsolete frame_count check in venc_start_session
297fee023f46d media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref
347e9d2246b89 rust: drm: ioctl: fix unbounded lifetimes in ioctl handler arguments
76395109a051b LoongArch: Avoid preempt count underflow without probe
266ffc92e6859 LoongArch: Do not save/restore percpu base register in rethook trampoline
d692b825dc246 LoongArch: Do not select HAVE_RUST when KASAN is enabled
d3fd094c13c6d LoongArch: Fix acpi_package_ids[] array overflow
882b8912b7e92 LoongArch: BPF: Refactor jump offset calculation in tail call
462e6abc8293f LoongArch: BPF: Optimize redundant TCC loads in epilogue
ab275a23b4d9f LoongArch: Add DIRECT_MAP_PHYSMEM_END definition
4e4dbc341b158 LoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY
6b78786ee7260 LoongArch: KVM: Free init resources if kvm_init() fails
07c3037e45c94 LoongArch: KVM: Fix TOCTOU race on pv_features
b7fab314ade26 LoongArch: KVM: Fix PC double advance in kernel MMIO read fast path
566b1f08d9836 KVM: arm64: Correctly cap TLBI Range to the architural limit
3d4c26b16a04a KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save
2f1a571af300e KVM: arm64: vgic: Reset in_kernel on private IRQ allocation failure
de9b4e8f37ce6 KVM: arm64: vgic: Fix detection of MI on no pending LR
7631f95297560 KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables
72bce82c4171b KVM: arm64: Sign-extend VA for range-based TLBI invalidation
d8580e7aa189b KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry
ce447651a52ec KVM: arm64: Correctly handle end of VA space TLBI invalidation
be54a70067c7d KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation
6408605cbd509 KVM: arm64: Consider SCTLR_EL2.M when mapping the L1 VNCR page
150c43473dcf0 KVM: s390: Restore sigset on error path
5ed801685a8a3 KVM: s390: pv: Fix rc/rrc offset for PVM_DUMP
6ee52d3af2a1b KVM: s390: Fix memory corruption by not reinjecting CK machine checks
3904a3296e40d KVM: s390: Zero initialize irq in reinject_machine_check
cc710ee45395e KVM: s390: Take srcu when importing watchpoint data
b5acacfdb8966 KVM: s390: Free guest debug data on vcpu destroy
f55e4d415d953 KVM: s390: Fix old_data leak in guest debug error path
44bf3792c10f4 KVM: s390: Fix memory leak in guest debug handling
beb9c55af609c KVM: s390: Fix length check __import_wp_info()
39f7abd5927bf KVM: x86: Ensure runtime reads of disabled_quirks are resolved once
929fd2d87851a KVM: x86: Serialize writes to disabled_quirks using kvm->lock
3097582b73a8e KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock
41debfc98526c KVM: x86/mmu: Consume the locked rmap value in the lockless rmap walk
7b2721d66525f KVM: x86/mmu: Use split "zap all fast" helpers when invalidating memslot
0a25ee42e7d1a KVM: x86/mmu: Use CMPXCHG when clearing Accessed bit in TDP MMU
e29e9a9d81140 KVM: x86/mmu: Split kvm_mmu_zap_all_fast() into "front" and "back" halves
93b7f6eb76a13 KVM: x86/mmu: Fold kvm_mmu_zap_memslot() into kvm_arch_flush_shadow_memslot()
27bdeb5fd1904 KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU
c43563e7518e6 KVM: nVMX: Service local TLB flushes on failed nested VM-Enter
674a3244f07f3 KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit
d689dd4eae48d KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02
22dfcc22c95e9 KVM: nVMX: Always flush vpid02 on first use
5778dda871f15 KVM: PPC: Book3S HV: Validate arch_compat against host compatibility mode
c9f2c50bad37d iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask
b6cedf011bd95 iio: light: opt4001: Reject integration times with a non-zero seconds part
958d691403936 iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem()
4a9820aa8ef7e iio: light: opt4001: Fix power down clearing bits of the wrong register
6d00b4fec5bf2 iio: light: opt4060: Fix incorrect register name in threshold read error message
38f58a0249666 iio: light: opt4060: Reject integration times with a non-zero seconds part
fcddb4da54ab9 iio: ti-ads7138: Disable STATS_EN bit while reading conversion results
c0d491c243e70 iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register()
c2d6437663d7c iio: srf04: fix pm_runtime handling on probe error path
eef652190b00f iio: pressure: mpl115: Fix runtime PM cleanup
7ded5b76ec2df iio: pressure: dps310: fix NULL pointer dereference on ACPI probe
0614928a3eda3 iio: light: ltrf216a: fix runtime PM reference leak in error path
1ce47f00e9c00 iio: light: gp2ap002: Disable regulators on resume failure
9c1b74fdcffa4 iio: light: cm32181: return zero after writing calibscale
d2b32b71fa5bd iio: gyro: mpu3050: fix sign of raw angular velocity readings
08ac8d2976d57 iio: dac: m62332: Fix regulator reference count imbalance
bcc324f3033cd iio: dac: ad3552r-hs: fix scnprintf() buffer bound in data source show
2d386efb4c37a iio: chemical: sgp30: Handle IAQ thread creation failure
2071624c3d0f4 iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF
43bce901047e9 iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable
510497e31be4f iio: buffer: Tie IIO dma fence lock lifetime to the fence
06a9460b8b792 iio: buffer: Make IIO DMA fence release RCU-safe
f1f8f0e8e0af9 iio: buffer: Fix potential use-after-free in anonymous buffer release
8de90e0e0f6d9 iio: adc: pac1921: fix wrong channel used in trigger handler read
beec14368c943 iio: adc: max34408: add missing 'select REGMAP_I2C' to Kconfig
d2ed166c901e9 iio: adc: adi-axi-adc: add data size support for AD408X backend
e9627244ac0d7 ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get
4e580d84a638f ASoC: loongson: Fix error handling in ACPI property parsing
e11b056d69b8c AsoC: intel: sst: fix PCI device reference leak on probe failure
e8ea01a045708 ASoC: hdac_hda: Fix hlink refcount leak on component registration failure
0966b76a0e23c ASoC: fsl_easrc: Use div64_u64 for 64-by-64 division
5ca4bd7543524 ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure
5a4fe7a87841a ASoC: cs35l34: drain threaded IRQ before runtime suspend
6e369bc46663b ASoC: cs35l33: drain threaded IRQ before runtime suspend
eb5d39dd862f5 i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure
b2b87f2e0bb16 clk: qcom: gcc-mdm9607: Drop incorrect BIMC PLL and related clocks
4763197c6f344 clk: qcom: gcc-mdm9607: Fix halt_reg for gcc_apss_axi_clk
bd326b0c5b339 clk: qcom: gcc-mdm9607: Fix enable_reg for gcc_blsp1_sleep_clk
c67fc2fd71395 clk: qcom: gcc-mdm9607: Drop incorrect system_noc_bfdcd_clk_src
206a6e21a0cf4 clk: qcom: gcc-mdm9607: Drop incorrect apss_tcu_clk_src
526b0a71a4d91 clk: rockchip: rk3588: Don't change PLL rates when setting dclk_vop2_src
cc2941bc37351 clk: qcom: gcc-msm8939: Fix enable_reg for gcc_blsp1_sleep_clk
51b40cb17c216 clk: qcom: gcc-msm8916: Fix enable_reg for gcc_blsp1_sleep_clk
4582949b7badc clk: meson: align gxbb_32k_clk_sel number of parents with actual count
88fe6792be2b3 clk: mediatek: mt8196: Select REGMAP_MMIO for vlpckgen
05952e503cf65 clk: clocking-wizard: fix integer overflow in rate calculation
82f78c2b3af8f batman-adv: bla: prevent CRC corruptions after claim flush
871acdf97f64c batman-adv: bla: fix freeing of claims on meshif deletion
1cfa7d5f70d54 batman-adv: dat: avoid unaligned fault in IP extraction
c32e5e25c4120 batman-adv: mcast: linearize skbuff for packet generation
cedacfecf4b40 batman-adv: mcast: ensure unshared skb for multicast packets
e91d2cc7441d8 batman-adv: fix stale receive device on merged fragments
c8f86e375b39c mtd: rawnand: validate ONFI extended parameter page sections
4b282dc6a9e96 mtd: nand: realtek-ecc: add missing MODULE_DEVICE_TABLE()
d06f91a52af11 mtd: mtdoops: free page bitmap when the backing MTD is removed
18916f475057c mtd: afs: validate v2 image info bounds
e8bcb9d54429b s390/vfio-ap: Fix required lock not held during update of ap_matrix_mdev object
6d554f2571e6b s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap
69632952aca04 s390/vfio-ap: Fix NULL deref in status_show() during queue probe
647916988272f s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects
c45753c32d452 s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed
178ea7a1c2c3c s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL
f7d66afc34bc6 s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove
3c5f51f257e14 s390/vfio-ap: Fix stale do_remove flag across iterations in vfio_ap_mdev_cfg_remove
fc069d00a0dbe s390/vfio-ap: fix stale pqap_hook pointer on error in vfio_ap_mdev_set_kvm()
3b90d769b351a powerpc/crash: stop watchdogs before booting kdump kernel
36dcb8c2e3391 powerpc/pseries: Move H_WATCHDOG definitions to a common header
d2be3dd20e833 powerpc/pseries: Handle and log pseries-wdt registration failures
9c914b7a0bd18 powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population
da88a2a2119e4 powerpc/kexec_file: Prevent kexec range truncation
df45337587db2 powerpc/kexec_file: Fix null-ptr-def in extra size calculation
6ae9306c75981 parisc: Fix alignment of asm statements in head.S
3e2691eeee83a parisc: eisa: Fix infinite loop when parsing invalid IRQ value
6b1faf1f099f7 nvdimm/btt: reject an arena whose nfree is below the lane count
bdd929e60bc54 mm/hugetlb_cgroup: call page_counter_set_max() outside VM_BUG_ON()
631d8f39b33e7 mm/hugetlb: keep max_huge_pages when dissolving surplus folios
ae6a8b0c69901 mm/hugetlb: fix missing migratable flag on same-node hugetlb migration
8e287f463fc4f Revert "irqchip/mbigen: Fix mbigen node address layout"
6e96e2bb1065b pmdomain: airoha: fix unselectable AIROHA_CPU_PM_DOMAIN kconfig
cf1484d9a75de nvmet-tcp: reject unsolicited H2CData PDUs
dbc4acbdb3ca8 nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
7555ddd60af72 nvmet-auth: Synchronize timeout work during SQ teardown
d663944dbad81 nvme: add missing SRCU grace period in error path
b4af7999a9987 nvme-tcp: check the data direction of a C2HData PDU
7df913a7ced5d nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails
15d7a35a48928 nvme-fabrics: fix DHCHAP secret leak on parse failure
7ad2ea7c10044 ALSA: pcm: Fix race between non-atomic ops and trigger-start
89992bda7dfbb ALSA: harmony: initialize locks before requesting IRQ
1e67ad10373ea ALSA: rawmidi: Return the error from snd_rawmidi_input_params()
cd090af03f5df arm64: errata: pass REVIDR when matching target implementation CPUs
68cbd70795dd8 arm64: mm: Fix the lockless page-table walk in show_pte()
2b3b06cb709c4 i2c: mux: Fix channel node leak on adapter add failure
112b3d48084c8 i2c: core: fix debugfs UAF on adapter removal
954f30c8df0a0 i2c: qcom-geni: update frequency table to fix timing parameters
c643b6e7852e9 i2c: designware: Enable interrupt mask workaround for HJMC3001
19d65da9f7497 perf hisi-ptt: Fix PTT trace TLP header parsing
2421389840738 perf trace: Refactor augmented_raw_syscalls using bpf_for
f3a6663138496 perf trace: Factor out BPF loop body
3c492c8eba026 perf/x86/intel: Fix kernel address leakages in LBR stack
267f0a4fb9fe7 rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers
3a2b79eae5bef rtc: rzn1: Handle unset alarm weekday in rzn1_rtc_read_alarm
a4d6666a65d6f rtc: rzn1: Fix weekday underflow when alarm crosses month boundary
350cb7821b3d2 rtc: rzn1: Handle EPROBE_DEFER for optional pps interrupt
0a90e268cce70 memcg: make the v1 soft limit knob inert
801bcbdbfd595 memcg: bypass the reclaim and oom killer for dying tasks once oom_reaper is done
7269bd95d707e Input: aiptek - validate raw macro indices before updating state
d07e281f2a771 fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()
4d6ccd3883df6 fs/ntfs3: fix KMSAN uninit-value in ni_create_attr_list
0ceda28f371df mm/mempolicy: fix sleeping allocation in alloc_pages_bulk_weighted_interleave()
5da247e4d1e86 kprobes: Protect kprobe_blacklist with RCU
863f6726a5c02 irqchip/stm32mp-exti: Fix the unit of the hwspinlock timeout
f8a2f2a460231 ima: Check for ERR_PTR from dentry_path() in validate_hash_algo()
685c195fbd7d4 ata: ahci: work around lost interrupts on Marvell 88SE61xx
ca5bfea2045ef ceph: lock mutex in ceph_mds_check_access()
a24a146ae2cb5 bpf: Fix infinite loop in pcpu_freelist push with one possible CPU
bfb469f20aa9e block: flag zoned disks with GENHD_FL_NO_PART
634e2d23736d4 cpuidle: psci: Fix support for probe deferral by dropping the faux device
b519dfce1998c cpuidle: dt_idle_genpd: kfree() the original name allocation
fac202d73e7a6 dmaengine: dw-edma: Initialize IRQ data before requesting IRQs
8fd47ccbba86c dmaengine: dw-edma: Complete descriptors before pausing
3b313f7a00d14 dmaengine: dw-edma: Fix HDMA channel status register access
d382aaf5fed38 dmaengine: fsl-edma: tracing: no ptr dereference during log output
408ff2d5bf555 dma-direct: return struct page from dma_direct_alloc_from_pool()
36177beff2a9d dm: fix resume-vs-remove race
af1f32ccf8051 dm: fix race when loading and unloading a table
74ec08f7b81c2 HID: wacom: validate report length in wacom_intuos_pro2_bt_irq
f4cb9c4556dcb HID: rmi: fix OOB access with undersized RMI reports
c7f927aa8b550 HID: bpf: serialize device reference release in struct_ops destroy path
078adc03f6e60 ftrace: Synchronize the initialization of ftrace_ops
7d1559126d86b futex: Prevent rcuwait use-after-free during requeue PI
1cd41131bc4b8 mm/damon/core-kunit: check region count before testing in split_at()
382e58c24eabf mm/damon/sysfs: kobject_del() target (normal), context and kdamond dirs
368f84ec79104 mm/damon/sysfs: kobject_del() region and target (error) dirs
23c7b91895ff0 mm/damon/sysfs-schemes: kobject_del() scheme region dirs
20a40e7eb5ec3 mm/damon/sysfs-schemes: kobject_del() scheme quota goal dirs
e608e7bbe82cb mm/damon/sysfs-schemes: kobject_del() scheme filter dirs
8a1ebb241fc70 mm/damon/sysfs-schemes: kobject_del() scheme dirs
b9847d539b9c8 mm/damon/sysfs-schemes: kobject_del() scheme action destination dirs
cb55606449fd6 samples/damon/wsse: stop and free damon ctx when damon_call() fails
6179c7f47876d samples/damon/wsse: handle damon_start() failure
2446d3820cbaf samples/damon/prcl: stop and free damon ctx when damon_call() fails
9f370353bba7f samples/damon/prcl: handle damon_start() failure
3c07c57b89411 samples/damon/mtier: handle damon_stop() failure
f0808262a7616 samples/damon/mtier: handle damon_start() failure
71de5a082d2ca mm/damon/vaddr-kunit: check region count in three_regions test
dd817463c9b42 scsi: pm8001: Use rollback index when freeing MSI-X vectors
4bb34769ef44a scsi: megaraid_sas: Limit NVMe request size to the PRP chain frame
1624bff4c5118 scsi: target: iscsi: Reserve a terminator byte for the login payload
a38051fa2dded spi: Fix DMA mapping ownership on partial map failure
148a3f03aec89 spi: bcmbca-hsspi: disable clocks on resume failure
0acbfd61aee18 spi: bcm63xx: disable clock on resume failure
b782a7cb0a424 spi: bcm63xx-hsspi: disable clocks on resume failure
907752a7b64a6 soc: qcom: geni-se: Use HW PROG_RAM_DEPTH to validate firmware size
e373c1acdbcf8 ublk: clear VM_MAYWRITE on read-only ublk char device mmap
89f06342743ca userfaultfd: reset err to be 0 when move_pages_ptes succeeded
65c2029f3bbae thermal/drivers/qoriq: Disable clock on resume failure
ec2db87a0bbb8 thermal/drivers/imx: Disable clock on runtime resume failure
efaab8938fb92 xhci: fix lost bounce buffers on TDs spanning several ring segments
b041e3f35e0d2 staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()
ff61aa3289355 staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr()
d3a7fa61997db usb: gadget: fix null pointer dereference in usb_put_function_instance()
c29a83c1ff3f0 USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()
02ac76f27db23 usb: gadget: f_midi: initialize work in f_midi_alloc()
e89e30f0b5d30 usb: gadget: f_midi2: fix use-after-free in string attribute show path
9c3d5091e3568 usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs
33a81acd2d1d0 usb: typec: ucsi: displayport: Fix OOB altmode array index
6be5169e7615d usb: typec: tipd: Fix Thunderbolt altmode VDOs for cd321x
42828aeb40b4a usb: typec: tcpm: constrain TCPM_SOURCING_VBUS event handling
d4e00a1eb3917 usb: typec: qcom-pmic: cancel reset_work on stop
1e4f33f99bfb7 usb: typec: qcom-pmic-typec: drain cc_debounce_dwork if port_start() fails
c614d7c44ca7f usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop
7c4e2f964c65d usb: storage: realtek_cr: fix use-after-free on disconnect
0afe5c31612de usb: dwc3: clear forceRM when issuing EndTransfer
62a8b67960637 usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns()
1c67f2ba9c5f7 usb-storage: ene_ub6250: fix race between scan work and probe
7690a86b19327 media: usbtv: keep device alive while ALSA card exists
296a884cd6feb clk: qcom: gcc-mdm9607: Increase delay for USB PHY reset
9392a2c346762 ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output()
838455cc8bfe1 usb: image: mdc800: change kmalloc() to kzalloc()
4814f28c45f58 drm/amd/display: fix division by zero in get_estimated_bw()
12ee39c2b1d3c bpf: fix the return value of push_stack
c96477e0cabf5 drm/xe: Don't hand out the flat CCS storage as usable VRAM
a6b088bee95fd fsnotify: inotify: pass mark connector to fsnotify_recalc_mask()
0ec897493ff82 drm/amd: Drop calls to restore power limit and clock from smu_resume()
0b6680e306397 mfd: qnap-mcu: keep the reply buffer alive past a command timeout
617b48fc0baf0 objtool/rust: add one more `noreturn` Rust function
947400af98b9e fsnotify: Fix stale object mask after concurrent mark updates
459f33f828647 entry: Fix seccomp bypass after ptrace with TSYNC
b5a5d389eee65 mm/page_vma_mapped: use huge_ptep_get() for hugetlb
e15407c3a8a00 openvswitch: Fix CT limit teardown use-after-free
a13b1e80e5015 net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
---
.../linux/linux-yocto-rt_6.18.bb | 6 ++---
.../linux/linux-yocto-tiny_6.18.bb | 6 ++---
meta/recipes-kernel/linux/linux-yocto_6.18.bb | 24 +++++++++----------
3 files changed, 18 insertions(+), 18 deletions(-)
diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb b/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb
index d4ca18a7b2..31a0294070 100644
--- a/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb
@@ -15,13 +15,13 @@ python () {
raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it")
}
-SRCREV_machine ?= "ed7481e8a1df4a3417915acd6bef5a72d6fa71bb"
-SRCREV_meta ?= "bf8faf1b184fcf6c555ee951f501e76f88eccf35"
+SRCREV_machine ?= "c191bb993af1f71ef139504fcce530a9ba167a0d"
+SRCREV_meta ?= "9e9d8b1f9128b07d938b8b7d5921aeb3ddf907a1"
SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine;protocol=https \
git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.18;destsuffix=${KMETA};protocol=https"
-LINUX_VERSION ?= "6.18.50"
+LINUX_VERSION ?= "6.18.52"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb
index 56a3d18ee5..1b7575be0c 100644
--- a/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb
@@ -9,7 +9,7 @@ require recipes-kernel/linux/linux-yocto.inc
include recipes-kernel/linux/cve-exclusion.inc
include recipes-kernel/linux/cve-exclusion_6.18.inc
-LINUX_VERSION ?= "6.18.50"
+LINUX_VERSION ?= "6.18.52"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}"
@@ -18,8 +18,8 @@ DEPENDS += "openssl-native util-linux-native"
KMETA = "kernel-meta"
KCONF_BSP_AUDIT_LEVEL = "2"
-SRCREV_machine ?= "aba8c69040fd3d5763477a733b4696a79c0514e1"
-SRCREV_meta ?= "bf8faf1b184fcf6c555ee951f501e76f88eccf35"
+SRCREV_machine ?= "08edce0ecd6a36020447f51f11329b6641d3c0e2"
+SRCREV_meta ?= "9e9d8b1f9128b07d938b8b7d5921aeb3ddf907a1"
PV = "${LINUX_VERSION}+git"
diff --git a/meta/recipes-kernel/linux/linux-yocto_6.18.bb b/meta/recipes-kernel/linux/linux-yocto_6.18.bb
index 719c1fa51a..055a2d39dd 100644
--- a/meta/recipes-kernel/linux/linux-yocto_6.18.bb
+++ b/meta/recipes-kernel/linux/linux-yocto_6.18.bb
@@ -17,25 +17,25 @@ KBRANCH:qemux86-64 ?= "v6.18/standard/base"
KBRANCH:qemuloongarch64 ?= "v6.18/standard/base"
KBRANCH:qemumips64 ?= "v6.18/standard/mti-malta"
-SRCREV_machine:qemuarm ?= "dbe5ee845060d0b8ddf934a2e3d96627fdb1bd81"
-SRCREV_machine:qemuarm64 ?= "aba8c69040fd3d5763477a733b4696a79c0514e1"
-SRCREV_machine:qemuloongarch64 ?= "aba8c69040fd3d5763477a733b4696a79c0514e1"
+SRCREV_machine:qemuarm ?= "4932d76684b2bc2cbf8dc6e0e46ada17ad020c71"
+SRCREV_machine:qemuarm64 ?= "08edce0ecd6a36020447f51f11329b6641d3c0e2"
+SRCREV_machine:qemuloongarch64 ?= "08edce0ecd6a36020447f51f11329b6641d3c0e2"
SRCREV_machine:qemumips ?= "62ea92a539f58803a222be98b81118403074206e"
-SRCREV_machine:qemuppc ?= "aba8c69040fd3d5763477a733b4696a79c0514e1"
-SRCREV_machine:qemuriscv64 ?= "aba8c69040fd3d5763477a733b4696a79c0514e1"
-SRCREV_machine:qemuriscv32 ?= "aba8c69040fd3d5763477a733b4696a79c0514e1"
-SRCREV_machine:qemux86 ?= "aba8c69040fd3d5763477a733b4696a79c0514e1"
-SRCREV_machine:qemux86-64 ?= "aba8c69040fd3d5763477a733b4696a79c0514e1"
+SRCREV_machine:qemuppc ?= "08edce0ecd6a36020447f51f11329b6641d3c0e2"
+SRCREV_machine:qemuriscv64 ?= "08edce0ecd6a36020447f51f11329b6641d3c0e2"
+SRCREV_machine:qemuriscv32 ?= "08edce0ecd6a36020447f51f11329b6641d3c0e2"
+SRCREV_machine:qemux86 ?= "08edce0ecd6a36020447f51f11329b6641d3c0e2"
+SRCREV_machine:qemux86-64 ?= "08edce0ecd6a36020447f51f11329b6641d3c0e2"
SRCREV_machine:qemumips64 ?= "9fb4ff0187c85426f21fd40d4c61b742800f65c4"
-SRCREV_machine ?= "aba8c69040fd3d5763477a733b4696a79c0514e1"
-SRCREV_meta ?= "bf8faf1b184fcf6c555ee951f501e76f88eccf35"
+SRCREV_machine ?= "08edce0ecd6a36020447f51f11329b6641d3c0e2"
+SRCREV_meta ?= "9e9d8b1f9128b07d938b8b7d5921aeb3ddf907a1"
# set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll
# get the <version>/base branch, which is pure upstream -stable, and the same
# meta SRCREV as the linux-yocto-standard builds. Select your version using the
# normal PREFERRED_VERSION settings.
BBCLASSEXTEND = "devupstream:target"
-SRCREV_machine:class-devupstream ?= "7cfc41f8e80f11ffa8382ed1a505154ceffb79c7"
+SRCREV_machine:class-devupstream ?= "8f3741e6feb045da5b406df0a80b42a1adfb289b"
PN:class-devupstream = "linux-yocto-upstream"
KBRANCH:class-devupstream = "v6.18/base"
@@ -43,7 +43,7 @@ SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;name=machine;branch=${KBRA
git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.18;destsuffix=${KMETA};protocol=https"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
-LINUX_VERSION ?= "6.18.50"
+LINUX_VERSION ?= "6.18.52"
PV = "${LINUX_VERSION}+git"
--
2.43.0
^ permalink raw reply related [flat|nested] 13+ messages in thread
* [meta][PATCH 03/06] linux-yocto/7.2: update to v7.2.6
2026-09-17 5:13 [PATCH 0/6] linux-yocto: cosolidated pull request bruce.ashfield
2026-09-17 5:13 ` [meta][PATCH 01/06] linux-yocto/6.18: update to v6.18.50 bruce.ashfield
2026-09-17 5:13 ` [meta][PATCH 02/06] linux-yocto/6.18: update to v6.18.52 bruce.ashfield
@ 2026-09-17 5:13 ` bruce.ashfield
2026-09-17 14:05 ` [OE-core] " Antonin Godard
2026-09-17 5:13 ` [meta][PATCH 04/06] linux-yocto/7.2: drm/client: avoid spurious vblank-timeout warning bruce.ashfield
` (3 subsequent siblings)
6 siblings, 1 reply; 13+ messages in thread
From: bruce.ashfield @ 2026-09-17 5:13 UTC (permalink / raw)
To: richard.purdie; +Cc: openembedded-core
From: Bruce Ashfield <bruce.ashfield@gmail.com>
Updating linux-yocto/7.2 to the latest korg -stable release that comprises
the following commits:
500df175a7f9e Linux 7.2.6
61a8d06600c8c ksmbd: prevent out-of-bounds reads in share config responses
1f0085f15004d perf python: Add missed explicit dependencies
8f57985e30a28 perf ui hists: Fix dso_filter reference leak and exit zoom cleanup
078aca7b80513 perf hists browser: Increase MAX_OPTIONS to prevent stack buffer overflow
72e9387884554 net/sched: fq: clamp quantum and initial_quantum in change path
b04326c7927af tcp: reject non zerocopy devmem tx
2bfcedbf68cbd Revert "esp: do not unref managed frag pages in esp_ssg_unref()"
dd08a645195f4 dm-integrity: fix buffer overflow with keyed discard
872317e84fd01 net/sched: sch_htb: limit htb_classify inner-class filter hops
47eb90299e688 tcp: fix corruption of urgent data on multi-segment retransmit
7566770311515 usb: atm: usbatm: fix invalid ci_range initialization
5975009651c4e net: fec: only stop PTP if it was initialized
a540a49fcca59 slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()
16d21a27df3f5 net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup
a9d88c79746cf net: dsa: mxl862xx: enable assisted learning on CPU port
c0d3f9560cc89 net: stmmac: restore NET_IP_ALIGN in the RX DMA offset
b445030cca1f6 net: stmmac: drop gso_enabled_types and rely on netdev features
482b2542eeb82 net: stmmac: selftests: Don't test flow control for small rx fifos
5a106e59b0519 net: stmmac: selftests: Account for the UC filter list for filtering tests
d1fad6804be2a net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering
10cf85addedeb net: stmmac: dwmac4: Account for the primary MAC address for UC filtering
db57c2c4eaa52 net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering
756932d2c6a0b net: stmmac: selftests: Check multiple MMC counters
2bbd61823f227 drm/xe/sysctrl: Read mailbox phase bit from hardware
08f8c20feca96 drm/xe/xe_ras: Add support to get error counter value
da853f3304495 drm/xe/uapi: Add additional error components to xe drm_ras
1ffe1bd34b497 net: airoha: npu: fix missing streaming DMA mask
fc3ee01090856 selftests/arm64: Fix MTE prctl TAP plan
5791116f96d4f selftests/arm64: Treat KSM merge_across_nodes as optional
a327373156bb5 selftests/arm64: Print missing MTE TAP headers
18c08f84ca483 ALSA: control: Don't add invalid kcontrols to LED layer
1e7fb6801d9cc netfilter: nf_tables: skip double clone set expressions on element insert
0044a4b853728 netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited()
6a7d3b074cfbb netfilter: nf_tables: move hardware offload step after building the chain blob
75c271c48f483 virtio-net: Ensure that TCP packets don't overflow gso_segs
905d648e97ef3 drm/xe: Reject page faults from non-fault-mode scratch VMs
9cc86bf96cfc3 drm/xe/xe_gt_idle: Add CCS to the powergating info print
2f1fac18cbe80 drm/xe: Do not apply WA 14025883347 to media 3503
1b871710ae9f6 net: stmmac: selftests: Pass the IP proto mask in the TC selftest
dadcbaa98de3f net: wangxun: use BIT_ULL() to prevent shift overflow on 32-bit archs
a32c4a6dc96cc net: phy: air_en8811h: move LED GPIO configuration to config_init
94a913cd521c0 net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure
ff481b7ba651d net: ethernet: sun4i-emac: Fix IRQ error handling
2e658329d7749 ASoC: amd: acp-config: change quirks to cover all ASUS FA401EA variants
cf839636911d8 samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify
84b5c7670a867 samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-modify
c77633a959565 libceph: validate banner payload length
36138bde421a3 ceph: revalidate ki_pos for O_APPEND writes after cap acquisition
c5fd89f5e1273 ceph: Fix ERR_PTR(0) in ceph_mkdir()
55126ef66298e ASoC: dapm: Fix off-by-one check on the second enum channel
8968852e664f4 of/irq: Fix device node refcount leak in of_irq_get_affinity()
dd52ab1c5436b apparmor: policy_int make sure list heads are initialized before fail path
889fa17a0af09 crypto: acomp - allocate async request context when cloning
f0e06321c70e9 tpm: st33zp24: Validate locality read result
e6d7d9b665419 tpm: st33zp24: Return zero on status read failure
0cd7503794856 net/sched: sch_teql: restore skb->dev on the slave failure path
da16c31517cd2 net/sched: sfq: clamp quantum to avoid signed overflow soft lockup
2446644b0f6d0 net/sched: hhf: clamp quantum before hhf_change() to avoid overflow
bf97fd2163ad1 net/sched: fq_pie: clamp default quantum to avoid signed overflow
f2fe291fbf71c net/sched: sch_codel: clamp default mtu to avoid disabling CoDel
9f499e5827fdb net/sched: fq_codel: clamp default quantum and mtu
e35acd56f244d net/sched: fq: add overflow bounds to quantum and initial quantum
e69bde4eb566a net: fix a resource leak in copy_net_ns() error handling path
efb4cdd8d72bd net: core: check skb_frags_readable before uncloning in skb_copy_ubufs
62126464f3a61 net/sched: act_skbmod: fix length calculations and avoid invalid header warnings
0f0f3df2bde2e selftests/proc: make proc-maps-race work with READ_IMPLIES_EXEC
7efd495853aeb maple_tree: fix argument name in header
dfe9ee26a9ad0 maple_tree: catch race in mas_alloc_cyclic()
21aea0891c204 mm/memcontrol: avoid false sharing between vmstats and events
3b06d0cc81547 selftests/mm: fix read_file() return value check
8625208f464ef selftests/mm: skip COW tmpfile cases when fallocate() is unsupported
f6ec40d1e4f17 smb/client: preserve open info type across compound queries
a58270c1b3445 cifs: fix clearing stats for fastest execution of each smb2 command
a0fcbea79f034 octeontx2-af: fix cn20k mailbox lifetime on repeated rvu_mbox_init()
7e33c6bd049b5 octeontx2-pf: fix NULL deref of af_xdp_zc_qidx on rep setup
281f9fda2e06d net/rds: use wq_has_sleeper() in rds_cong_map_updated()
4f9827b314ee5 net: mana: Cap MSI-X vectors to the device MSI-X table size
138b0054021fd net/sched: act_ife: Only operate on Ethernet frames
a93b72eb2f5a8 net: enetc: restore RX ring congestion mode for ENETC v4
18ca1be8426aa net: enetc: remove invalid code from enetc4_pl_mac_link_up()
1039c56c4c99f net: enetc: improve MAFT entry management with bitmap tracking
d25a4a481cfbe net: enetc: convert ndo_set_rx_mode() to ndo_set_rx_mode_async()
c77effb3edb82 net: enetc: extract common helpers for MAC hash filter configuration
ccdc23869332a net: enetc: extract common helpers for MAC promiscuous mode setting
1a20660772b67 net: enetc: restore RX ring congestion mode after ring reconfiguration
b3235a8790a1a octeontx2-af: Fix TL3/TL2 link config ENA clearing
200460a0793dc net: qualcomm: rmnet: restore skb->dev on deaggregated frames
ef42c9e922dfa octeontx2-vf: fix workqueue and netdev race in probe/remove
2f460aa0211e9 octeontx2-af: fix out-of-bounds read setting MSI-X irq affinity
fdf7358e2688f octeontx2-af: fix NULL deref in NIX TM tree debugfs read path
8d85498016a5b gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free
bf9387488d639 xsk: honor XDP_TX_METADATA in zero-copy path
0e00ea9e97a39 xsk: align TX metadata layout across ABIs
2eafcf310f4e0 Bluetooth: do not leak an hci_conn when a second LE connect is rejected
3988cbb1be501 Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop
22d419db7f9a0 Bluetooth: btnxpuart: Validate the FW dump header length
94a71da6d6b37 Bluetooth: hci_sync: add conditional locking annotations
7b80d2701a684 Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path
d84bc309288b2 Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX
956b5a979b0df Bluetooth: btmtk: Do not discard the subsystem reset timeout
820e64cb52dbf Bluetooth: btmtk: Do not report success when subsys reset fails
32a7bc6e93be3 Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan
ee2135a14fb2a Bluetooth: mgmt: fix 'hdev->discovery.uuids' NULL dereference
c47339e169bf4 Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN
f49321c857851 Bluetooth: L2CAP: access chan->conn safely in get/setsockopt
a34fb2fa48fbf f2fs: use adjusted write range after f2fs_write_checks()
2f10bc3ff24c9 arm64: process: Fix context switching MTE store-only tag check
ae0cfa9772982 arm64: ptdump: Make note_page_flush() range aware
8f9a725d89711 fuse: Fix the condition to enable over-io-uring
f940f3d3fd0bb fuse: use release/acquire for fch->initialized
833963069adf8 fuse: invalidate the correct range after O_APPEND direct write
faef603939f26 erofs: Fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS default logic
31d299e7d5539 scsi: qla2xxx: Fix an loop timeout test
4c19c302cc577 Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition
55d87e888ca1f net/sched: sch_cake: fix autorate reconfiguration throttling
4384d152e10df net: hibmcge: fix page_pool DMA direction mismatch
2e5b1f6ee74aa net_sched: sch_fq: fix pacing delay underflow with pacing offload
72895242ee741 net: page_pool: Remove zone/policy GFP flags when allocating XArray entries
7d63522f9e590 net: libwx: fix concurrent bitmap overwrite in PTP setup
c6dfa6dc37d74 net: txgbe: fix MISC interrupt unmasking in non-MSI-X mode and device shutdown
648d196ccc03a net: sparx5: fix sleep in atomic context in MAC table access
9057547877624 net: microchip: vcap: use port number instead of netdev name for debugfs
18c68c8f3d3ff net/sched: account classifier filter allocations to memcg
08988d1941e18 ptp: netc: fix period truncation and potential divide-by-zero in PEROUT
98b4998733553 bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check
b17907ef665bc bnxt_en: Fix call to hardware monitoring event handler
1cd4b0a184db6 ASoC: fix unmet dependencies on PPC_BESTCOMM and SND_SOC_AC97_BUS
5d542be0c4921 rtc: pcf85363: Add error checking to regmap calls in probe()
bbc975cfb07a1 NFSv4/pnfs: key the data server cache on the NFS version
a973622da0c62 NFSv4.2: fix LAYOUTSTATS send buffer exhaustion
f31f3c042e024 NFSv4.1: zero referring call lists before decoding
ecc8bac11a101 vxlan: fix reading neigh ha
291c9e137b7c7 net: bridge: arp/nd proxy: fix reading neigh ha
5ff429dd6725f net/smc: free pending qentry in smc_llc_flow_stop() before memset
e25a602c45c76 net/smc: free stashed qentry before overwrite in REQ_ADD_LINK to ADD_LINK transition
b2479738ba765 powercap: intel_rapl: Sign-extend the PMU delta on counter wraparound
d98b92f3d5797 net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue
bc4e67c9399c7 net: tcp: block mixing readable and unreadable frags
7109bb63667a5 inetpeer: randomize RB-tree node comparison using SipHash
4a674afaae413 ip6mr: do not clone dst in ip6mr_cache_report()
684773c4d26f7 net: qlcnic: validate unified ROM sections before loading
35a6026eadcb8 net: add missing ref_tracker_dir_exit() to net_passive_dec()
f82b5dbb2fef6 ipv6: avoid divide by zero in rt6_multipath_rebalance
db038ac4dca0f netdevsim: update queue NAPI association on queue reset
f5d53818ba923 net: ipa: balance runtime PM reference on remove error
976e92931c28e forcedeth: stop the tx_timeout register dump past the requested window
d52c695b6980b net/mlx5: E-Switch, preserve max tx speed on vport state modification
8a9a3ccdc35e1 net/mlx5: Move vport DOWN state check out of mlx5_query_vport_max_tx_speed()
19dd112279167 net/mlx5: E-Switch, use state lock for vport state changes
21c0a41260e4b net: thunderbolt: Count delivered packets in rx_packets and rx_bytes
a5ce5b5aacd01 net/sched: add get_fill_size callbacks for actions missing them
434849b21ef56 net: bridge: Reject descending VLAN tunnel ranges
8341bd3ff126d xsk: fix NULL pointer dereference in __xsk_rcv()
e50df85ac835f irqchip/irq-realtek-rtl: Use readl_be()/writel_be() instead of readl()/writel()
12f903cfacb48 irqchip/irq-realtek-rtl: Add mask for interrupt handling
7dd58ec1bbd41 irqchip/irq-realtek-rtl: Add interrupt data structure
1f0b4680d3b5a irqchip/irq-realtek-rtl: Split out parent setup code
6c94e5f95258b smb: server: remove unused DES crypto header
93fb16a86d5db smb: server: Remove obsolete "select CRYPTO_LIB_DES" from Kconfig file
1e16e82581521 ALSA: mtpav: shut down output timer before card teardown
24d81b7299200 drm/xe: don't WARN on kernel job timeout when device already wedged
5969a3df8361a spi: amlogic-spisg: Make sure clk_init_data is fully initialized
e46ef54fe4d9c RDMA/ucma: Allow path records to exactly fit the output buffer
ea5a3c3071071 ntfs: validate usa_ofs before preserving the update sequence number
b42644e425fed ntfs: fix off-by-one page overflow in ntfs_decompress()
e52c8cd7e7544 sched/topology: Add a cpus_read_lock to rebuild_sched_domains()
24b399f51812d ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup
ae344ed82795b irqchip/gic-v5: Defer default SPI and LPI IAFFID programming
3958493a70ced irqchip/gic-v5: Use logical cpu 0 irs_data for dynamic IST allocation
7c10ec4987b78 irqchip/gic-v5: Release IRS iomem region on driver init failure
7b7201493383e irqchip/gic-v5: Fix gicv5_init_common() error paths
69f0c79f5b692 irqchip/gic-v5: Disable IRSes on probe failures
f43bdac1ae484 irqchip/gic-v5: Check for NULL LPI domain on domain teardown
6caeb878f809b irqchip/gic-v5: Check get_logical_index() return value in MADT IAFFID parsing
a7c0415209243 irqchip/gic-v5: Synchronize CPU interface disable
54937af6f4a0d irqchip/gic-v5: Clear per-CPU IRS data on teardown
69212cccf4f90 irqchip/ast2700-intc: Disable all interrupt merge banks on probe
5ecfa72e74c6e clk: visconti: Make sure clk_init_data is fully initialized
c1c6d311fa830 clk: ti: Make sure clk_init_data is fully initialized
6234b08fbc4b6 prctl: fix PR_SET_MM_AUXV losing the forced AT_NULL terminator
56ae1f0b08400 lib/interval_tree: fix allocation warning messages
63337be8f5c43 rtc: gamecube: check return value of devm_rtc_register_device()
c80e3c69cf197 i2c: ocores: Disable clock on failed resume
f2f0da1164861 irqchip/ast2700-intc: Avoid allocating in the irq_domain activate() callback
dbecbe23dc606 irqchip/renesas-rzg2l: Fix loss of interrupt
3f00d8a5e16c0 rtc: zynqmp: Return optional clock lookup errors
a24926c513037 cifs: remove dead size-update blocks in cifs_setattr_unix/nounix
7ec4098359b9a smb: client: set replay flag on the read send-error retry path
73f6bdb038048 smb: client: fix request buffer leak in smb2_new_read_req()
12f124ec61c74 smb/client: return EOPNOTSUPP for unsupported O_TMPFILE
9a4d2ef7e72b9 rtc: spacemit: handle regmap_test_bits() error return
6218c0533a722 rtc: pcf8563: fix clock provider leak on unbind
afbf69d1d691c virtio: rtc: time out alarm requests
c678d04ac9e5a vdpa/mlx5: fix wrong list iterated in add_direct_chain error path
89b4d033a4b53 virtio_pci: fix wrong queue index for admin vq in intx path
43a8e02dc826d vhost/net: fix clear_user start address in VHOST_GET_FEATURES_ARRAY
bdef50a8226fc virtio_balloon: quiesce balloon work before device shutdown
1ac4c32198b83 virtio_balloon: factor out virtballoon_quiesce()
fcbba617b38cb virtio: add virtio_device_shutdown() helper
ca6f3fa599cb7 vdpa_sim: fix cleanup after worker creation failure
2ee4d24c88c48 virtio_balloon: disable indirect descriptors
14dca701e72a1 ntfs: do not update ctime when setxattr fails
0400e0d50eb3b ntfs: serialize resident iomap reads with mrec_lock
9d1b68f3dd11a ntfs: convert iomap ops to ->iomap_next()
95dc8483f2d70 iomap: add ->iomap_next()
8a255824aa000 iomap: split iomap_iter() logic into iomap_iter_next()
95d7098561e51 ntfs: allow index root relocation
86f46508016bc ntfs: reject unprivileged writes to reserved $LX* xattrs
25a70f2ea77ef ntfs: respect per-file chmod mode over mount masks
6028b94f28d9a ntfs: apply Windows name checks only with windows_names
825dec5120933 ntfs: Fix index_root heap OOB write in ntfs_ir_to_ib()
950e2ecc7aec2 ntfs: fix kmap_local_page() usage in compress
825f4476ea60b ntfs: Remove references to page->__folio_index
20224191755b0 ntfs: Use zero_user_segment() in handle_bounds_compressed_page()
cfa877fdae270 ntfs: Remove use of __folio_index in handle_bounds_compressed_page()
c13cd1124ec8b ntfs: Inline zero_partial_compressed_page()
e366735ed2a8a ntfs: rewrite EA stream before updating metadata
62f39201c0ccd ntfs: remove empty EA attribute pair
98af5b4ae1385 ntfs: validate final EA attribute size
9fb0fed1b918d perf vendor events arm64: Fix Tegra410 Olympus event 0x0197
b3ba86c6c5996 perf vendor events arm64: fix swapped MetricGroup for Tegra410 L1 prefetcher metrics
4af8e0f7838d4 i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode
63ab05e8f9654 net: add missing ref_tracker_dir_exit() to alloc_netdev_mqs()
ba5429c8c43e5 bonding: initialize err for empty target lists
1058c4379959c mlxbf-bootctl: fix the build error with FIELD_PREP()
1b0a3d915320f platform/x86/amd/hsmp: Reject negative power cap writes in hwmon
8a7499b8fd344 platform/x86: hp-bioscfg: fix password encoding bounds check
0cc59397bbf94 vsock: use sock_error() to consume sk_err after a failed connect
491b368a0c6e5 vsock: don't check the listener's sk_err in vsock_accept()
cfcc833cb43b4 platform/x86: dell-wmi-sysman: Fix instance ID bounds
eddb191cc8d68 net/smc: hash socket only after full initialisation in smc_sk_init()
b4ce1c461a49a 8139cp: fix Rx and Tx not being disabled in cp_suspend
f26400b325bdc vxlan: mdb: Fix use-after-free in vxlan_mdb_flush()
44764dc4b9f9b ALSA: hda: Fix connection list comparison in proc output
509f4a09bae7f fuse: check for NULL root inode in fuse_fill_super_submount
710bbbbb66c7b soc: qcom: ubwc: Fix missing include
236d65ecf3777 fuse: reject a duplicate fd= mount option
c8a109c9e23a2 fs/ntfs3: validate ef->size covers the record's name and value
53e56f7aa1d0f fs/ntfs3: fix out-of-bounds read in read_log_rec_buf()
c40f3f24839f8 cuse: wait for pending RCU callbacks on module exit
0dffaa477c2d5 net: bridge: vlan: fix inverted default vlan notification
adb27c5665bd2 tls: fix RX desync on overlapping skbs
38ce7de7215ad net: dsa: mv88e6xxx: Fix PCS link check on CMODE read error
ad32e564c62eb vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes
b1908bff0faaa ipvs: fix integer overflow in ftp helper port/address parsing
454c59ef2dd0b netfilter: ctnetlink: do not expose expectation DEAD flag
6a31c661ba1e1 netfilter: ipset: remove need to allocate memory on delete operations
44ff26872e241 f2fs: fix to avoid pinfile fragment on fragment:{block, segment} mode
87abc928271cb f2fs: cleanup w/ f2fs_need_rand_{blk, seg, seg_blk}
8344c9233c8f7 virtio_net: Fix resize of the RX ring
49b01f2939abc net: hsr: free learned nodes on device setup failure
23fc79697224c pppox: drain queued packets on channel handoff
93462180871bb net: dsa: b53: fix error propagation from b53_fdb_dump()
f392affef3c9c net: kcm: Hold RCU read lock while running BPF parser
fdbf04e3e01a8 dpll: fix NULL deref in dpll_device_ops() during teardown race
122d0db84b11c ionic: fix completion descriptor access with 2x desc size
242d2d8bfc09f ionic: add missing dma_rmb() after the completion publish check
8ed5e2a3c306d ptp: netc: skip PEROUT disable if channel is not enabled
851f2f82483dd drm/xe: tests: fix error message in xe_migrate_sanity_test()
96c3959770386 hinic3: Fix skb linearization mismatch and drop skb when skb_checksum_help() failed
bcd89fdf033ba octeontx2-af: initialize lmac_bmap in rvu_mcs_set_lmac_bmap()
677b4c6e8c27c can: m_can: Use of_property_present() for wakeup-source
03022dd874070 bpf, xdp: move offload check into dev_xdp_install()
33bcf2dd2fd61 regulator: tps65185: wait for the IC to wake before the first I2C access
df9c1cd0c6e8a clk: ti: mux: resolve parent clocks by DT index, not by name
647157fecb42b clk: devres: fix cleanup in devm_clk_get_optional_enabled_with_rate()
7582a485870a9 nfs: fix ENXIO on O_CREAT open of existing symlink over NFSv3
d179ff22cd851 NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease()
436a214514e24 NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers
c9c67f7107f74 NFS: Fix delayed delegation return list handling
23e4162405c45 pnfs/blocklayout: Fix device leaks on parse failure
5891c03e15092 NFSv4: remove callback IDR entry on client allocation failure
a30e2a3353094 nfs: refactor pNFS functions using clear_and_wake_up_bit
2e8a725cdb645 nfs: replace atomic bitops sequence with clear_and_wake_up_bit helper
8e29e6c43f9de selftests/bpf: Retry stat generation in cgroup_iter_memcg
f075148f3eebb smb/server: fix session counter on session removal
f31178bb91cdb smb/server: update session counter under sessions table lock
46bb82a539020 smb/server: warn if ksmbd_proc_create() fails
c949ea4edccfc ksmbd: add procfs monitoring for active shares
55c677619084f smb/server: fix session leak in ksmbd_session_register()
8e4f75e979c1d ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size
ce92f3cc7ee48 ksmbd: handle encrypted compressed requests
6f04e11d500b8 ksmbd: decrypt requests from expired encrypted sessions
9d3ebd8216226 ksmbd: disconnect on SMB3 decryption failure
0875872718b98 ksmbd: scope session state changes to bound connections
b9f1aee32d385 ksmbd: fix encrypted request lookup on bound channels
3fc762f881c98 ksmbd: expire SMB sessions when Kerberos tickets expire
599dd43e4ba8b ksmbd: validate SMB2 write offsets
514a0b2bc9499 ksmbd: detach blocked lock requests before freeing
d09af9a35ff7b ksmbd: safely discard unregistered deferred locks
31a89af4f513d bpf: Reject negative optlen in cgroup getsockopt hook
d73441232f1f0 m68k: nfcon: Do not call console_is_registered() in nfcon_device()
daeb74f5f398e bpf: Disallow bpf_{g,s}etsockopt() in cgroup UNIX getname hooks
7b6b6bbbfd13e erofs: fix unused pcluster_pools for higher page sizes
179a5b2171573 lwt_bpf: Restore reserved headroom after xmit program
1bbdbf56d3586 objtool/klp: Fix vmlinux klp relocations for EXPORT_SYMBOL_FOR_MODULES()
0f8a4184c00ce erofs: guard on-disk algorithm IDs against Z_EROFS_COMPRESSION_MAX
451027c642e75 erofs: fix interlaced ztailpacking pclusters
a1d26dfb32919 ksmbd: defer publishing granted locks to prevent UAF/double-free race
a54df0ce7a985 ksmbd: recognize replayed SMB2 lock sequences
9e8faf91bb11e smb/server: preserve error status in smb2_handle_negotiate()
7d2cd9269b570 smb/server: call ksmbd_proc_cleanup() on module init failure
fb4ba2bdfc1de smb/server: abort initialization when proc setup fails
a2eb72b4d53bb smb/server: fix invalid pointer dereference in ksmbd_stop_durable_scavenger()
7065d3648b1a4 smb/server: fix null-ptr-deref in ksmbd_ipc_tree_connect_request()
5f97bac88bfb3 ksmbd: serialize oplock close with pending break ownership
c2b867861a48f ksmbd: add SMB3 request replay support
50be5e96c381a ksmbd: retain connection for pending notify work
a34f809167a46 ksmbd: defer CHANGE_NOTIFY completion instead of STATUS_NOT_IMPLEMENTED
bbeefd3e96645 ksmbd: add AAPL kAAPL_SERVER_QUERY create context support
8a765fb56ca76 ksmbd: fix durable handle v2 default timeout units (60 -> 60000)
ac5104f4bd9a9 ksmbd: support access-based directory enumeration
8e2ebc7767883 ksmbd: free preauth sessions on connection teardown
8084b5c719670 ksmbd: do not advertise unimplemented CA support
c494fcf8e89e3 ksmbd: validate ipc response length before dereferencing its fields
8ea83ef0c40ec smb: smbdirect: release pending child sockets outside the handler lock
c4de57fd85459 smb: smbdirect: avoid recursive listen.lock during cleanup
959813a3752b4 smb: smbdirect: destroy QP before mem pools on accept failure
8a953b1a47fff smb: smbdirect: free completion queues with ib_free_cq()
497c221bf6b2f ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user()
abb5146b2d819 smb: server: fix leak of ksmbd_ipc_login_request_ext() returned buffer
07a9e289ff7ed ksmbd: Do not skip lock checks for single-byte ranges
eb287c6e81ded bpf: Check pointer type for all atomic RMW paths
9cd837ed9efd8 hwmon: (emc1403) Drop hysteresis for low limit temperature
9b23a010a1e82 hwmon: (coretemp) Fix core_data leak on CPUs without PTS
072fb5aeec2ea apparmor: fix deadlock in complain-mode change_hat
c5a6c30e6ee7a selftests/mm: thuge-gen: fix test_shmget() for PAGE_SIZE check
b389dc35a5571 block: mtip32xx: synchronize ioctls with device removal
b9cc6cc74daf6 ublk: avoid teardown retry loop on xarray allocation failure
6220421b97296 ublk: reject non-power-of-2 zone sizes in SET_PARAMS
b9c16db833e3f blk-iocost: clear delay state when freeing policy data
02f1b90ab33ef blk-iolatency: clear delay state when freeing policy data
d3d35dd045a35 null_blk: serialize configfs attribute updates with device setup
c70994c2862b0 null_blk: serialize configfs attribute stores with the lock
baff300541a00 null_blk: reject per-device queue resize for shared tag set
0a3afab871241 null_blk: free zones array on device power-off
081cf37e8a0e0 null_blk: free global tag_set on init error path
cab9bf5f68f76 null_blk: register configfs subsystem after creating default devices
234117949da3b null_blk: use DEFINE_MUTEX for the file-scope mutex
c7bc5e7677bcd mailbox: riscv-sbi-mpxy: validate RPMI notification lengths
c362e993e3a55 mailbox: pcc: Fix command timeout due to missed interrupt
53281c3a89cf9 mailbox: rockchip: disable pclk on probe failure and unbind
b3d73e7440e0c mailbox: qcom-cpucp: handle NULL data in send_data callback
e40b3edeaf25c mailbox: qcom-cpucp: fix PREEMPT_RT self-deadlock in IRQ handler
f445e7be37ce1 perf dso: Replace assert with runtime check in dso__read_symbol()
94d82e7a95b51 perf dso: Guard against cache underflow on short reads in dso_cache__memcpy()
b3339e4bd7a13 perf dso: Use stored fd error instead of stale errno in file_read() and file_size()
2482a7b86a2bd perf dso: Guard close() against invalid fd in dso__decompress_kmodule_path()
bd98711ed867e perf dso: Guard against errno==0 when dso__get_filename() returns NULL
a0161780a0b89 sched_ext: Make SCHED_CLASS_EXT select GENERIC_ALLOCATOR
ed30a1892c630 sched_ext/scx_flatcg: Fix cvtime true-up on slice expiry
97bdcf58c0d6d sched_ext: Drop unlocked scx_rq_clock_invalidate() from scx_root_disable()
9e099588ee6aa crypto: lskcipher - propagate errors from unaligned crypt
ed9ab15652c24 crypto: hisilicon/sec2 - fix CCM algorithm long packet failure
9eb64cfc95542 selftests/sched_ext: Fix flaky ddsp failure tests on busy systems
69f5815a0910b bpf: Fix pending_pos walk on 32-bit ring position wrap
10158c8aa7bb9 selftests/bpf: Fix selftest build after filter.h update
c98a1abbda871 ACPI: scan: Use acpi_bus_get_primary_device()
c9d202d3b6c28 ACPI: platform: Use acpi_bus_get_primary_device()
5657859851abb ACPI: bus: Introduce acpi_bus_get_primary_device()
0b9053cd0955c ACPI: scan: fix bus ID cleanup on device_add() failures
6f21453927d0a ring-buffer: Remove trace_buffer::cpus
71dbd143be598 riscv, bpf: Fix missing sign-ext for signed 1-byte and 2-byte kfunc args
e62b867143ef8 bpf: Fix arm64 KASAN false positive after bpf_throw
a3e6a9bd5ee8a selftests/bpf: Use ping_command() for IPv6 pings in lwt_ip_encap
aa7200c77b8b6 HID: tmff: Use 64-bit arithmetic for force feedback scaling
351cdfcd097d0 HID: multitouch: reclassify HTIX5288 to WIN_8_FORCE_MULTI_INPUT_NSMU
72d0b77412aef ASoC: SOF: validate topology volume range before allocation
3c44b8673baba tracing: Have trace_event_update_all() only handle module that is loading
2d92c250815cb HID: haptic: don't write an uninitialized value to unhandled usages
7d9b5e86775fa ALSA: core: Fix use-after-free in snd_card_do_free()
2b9a0e57bfd36 fs/ntfs3: reject out-of-range evcn in mi_enum_attr()
169383d8914b8 fs/ntfs3: fix integer overflow in MFT cluster validation
fa4168538494c bpf, arm64: Fix stack-passed arguments for indirect trampolines
9b65b0253ad5a net: page_pool: fix UAF in __page_pool_release_netmem_dma on xa_cmpxchg race
c52f3c102687b scsi: ufs: core: Set task state before io_schedule_timeout()
e2cd23443d361 scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers
319324b5fbb29 selftests/bpf: Fix for veristat file/prog filters processing
e4afd90bc7bf3 Squashfs: check block offset is not negative
1222f7a3183b3 ocfs2: fix circular locking dependency in ocfs2_init_acl()
418e0ae42fa76 ocfs2: validate DIO orphan slot during inode read
3d7c4b7ce7b4b ocfs2: validate orphan slot during inode read
b262056695e89 bpftool: Fix double close in map dump
97bc6e3f5f9ac x86/pkeys: Fix pkey_alloc() return value when pkeys are not supported
404b2a460566b selftests/cgroup: Preserve CPU hotplug write errors
2c23fc91789df nvmet: fix max_qid race between configfs and controller allocation
282a3ef9e4b63 ALSA: seq: midi: Serialize input teardown with event_input
67461b9113e74 ALSA: seq: midi: Optimize event_input locking with RCU
63730818d3618 clocksource/drivers/armada: Unwind timer clock on init failure
7eb5764d25c4a clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type
e4764fa09a2e3 clocksource/drivers/clps711x: Do not unmap clocksource MMIO
54e1259b75d64 s390/debug: Fix deadlock during unregister
e9ba3132a9edc xenbus: Unregister reboot notifier on init failure
811fdac2d1bdf sched/isolation: Defer freeing of cpumask memblock memory to initcall
b33197aef2349 selftests/namespaces: Fix racy pipe handshake in timens and pidns_separate
65c3939656fd7 bpf: Fix UAF in bpf_trampoline_multi_attach_free on update failure
7edb0248f4ff5 selftests: drv-net: so_txtime: fix qdisc replace with handle
6dd217e218d47 power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address
17d2a9ef48d09 power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address
fd7aa80ecf69a power: supply: bq27xxx: bq27520g4: fix REG_TTES address
4492288889b97 power: supply: bd99954: Drop bad register fields
c18d09a1012bb power: supply: bd71828: Do not hide errors
513cdd61debdd power: supply: bd71828: Drop duplicate power-supply property
80091fbba3e92 power: supply: bd71828: Fix current direction
367b8a8860e75 power: supply: bd71815: Fix temperature reading
101cd6f729229 objtool/klp: Fix .kcfi_traps special section extraction
4e8a940c31539 objtool/klp: Fix vmlinux .klp.symid link error for .exitcall.exit symbols
01923107661a4 PCI/ASPM: Disable/restore ASPM on every function for multi-function devices
bcbcbd0370e67 spi: img-spfi: don't disable runtime PM on DMA deferred probe
6b6007e96d62a ASoC: spacemit: advertise only DMA-backed DAI streams
0a2129953aea8 selftests/bpf: vmtest.sh: Preserve command quoting when running in the VM
817ad6d29cbc8 selftests: harness: Mark test fixture objects __maybe_unused
44b702fceb4cf bpf, s390: Clear fetch destination on faulting arena atomic
84fac27c0ca3e bpf, arm64: Clear fetch destination on faulting arena atomic
5eb3ff6a3bf27 bpf, x86: Clear fetch destination on faulting arena atomic
6465c2c0f1e34 bpf: Derive the atomic load register in one place
840f727508152 bpf, riscv: Clear fetch destination on faulting arena atomic
82b97be6a478e kunit: tool: fix _list_tests filtering wrong variable when list has TAP prefix
7e2ee531560e0 drm/amd/pm: silence uninitialized variable warnings
e87e015f44f15 perf build: Remove leftover feature tests for removed cxx and clang support
20ed93f1fd576 backlight: ktd2801: Fix unmet dependency on GPIOLIB
d32a47e7cda71 backlight: aw99706: Validate all DT property values consistently
43ba7cdff6dd4 mfd: cs42l43: Fix regmap defaults ordering
829539c4a6505 arm64/efi: Avoid voluntary preemption with efi_mm installed
fdbdc5c016a81 iomap: iomap_bio_read_folio_range_sync is missing a call to bio_uninit
778f6a8070511 super: fix dying superblock warning messages
ef34de895dfd7 PCI/ASPM: Use pcie_capability_clear_and_set_word() for ASPM disable/restore
f024208da64d3 objtool/klp: Fix relocations for EXPORT_SYMBOL_FOR_MODULES() symbols
d4ae0baea6d68 objtool/klp: Don't match local symbols against exports
a8efbd6bd582a objtool/klp: Fix cross-module klp relocation section naming
6a990e74d4e84 firewire: core: fix memory leak in error path of build_tree()
727013e31478e firewire: core: validate parent port count before allocating nodes in build_tree()
3f3980920f021 firewire: core: consolidate port counting in build_tree()
75c00ce4049c9 firewire: core: add KUnit tests for failure of tree building
a41a7dd31c4ab firewire: core: add KUnit tests for successful tree building
0e86ed95eda9c firewire: core: add KUnit test skeleton for node tree
6d9c3ae59c7f7 UBI: fix two issues in the ubi.mtd MODULE_PARM_DESC
4e0ce77df7d98 ASoC: xilinx: formatter_pcm: fix stream_data leak on open error
851c5e9a829d5 mtd: ubi: Release device reference on busy detach
ec3fffb06a3f5 objtool/klp: Ignore replacement offset of empty x86 alternatives
ab0648f06367f objtool/klp: Fix size of empty special section entries
ba20c5bb872cd objtool/klp: Fix vmlinux .klp.symid link error for .no_trim_symbol symbols
87b3da4acb860 ubi: Fix rollback for explicit UBI device numbers
6424b9cde9edc bpf: Compare iterator types during state pruning
07697272bfacd UBI: fastmap: Pass to_be_tortured when reusing old fastmap PEBs
41033f8d870bf UBI: Preserve torture flag when rescheduling failed erasures
4302bc71ace16 ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready
c1829705803a5 ASoC: pxa: Use devm_clk_get_optional() for extclk clock
5eab61a483f4b idpf: add missing cpu_to_le32 in idpf_tx_splitq_build_flow_desc
57715e257c8a5 ice: acquire NVM lock around each flash read
dfa94b403e69a ice: clear the default forwarding VSI rule when releasing a VSI
dc0234c8c5730 ice: fall back to SBQ when LL PHY timer interface times out
64a2bd4cfc16c RDMA/cma: Fix WARNING in res_to_rt
ea41b5630fa3d RDMA/cxgb4: Free debugfs on registration failure
068122750ee8a dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal
99c91dca54a6c phy: rockchip: samsung-hdptx: Handle uncommitted PHY config changes
c4506784a95ce phy: rockchip: samsung-hdptx: Fix rate recalculation for 3.2GHz FRL
0a111684ed663 phy: rockchip: samsung-hdptx: Guard against clk rate integer underflow
877657310a66b phy: rockchip: samsung-hdptx: Prevent divide-by-zero when computing clk rate
b6823d7f95abc phy: rockchip: samsung-hdptx: Fix rate recalculation for high bpc
6e6e471eef1d5 ALSA: seq: Don't leak the extension cell pointer in the bounce payload
7d44b897bff84 nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing
3ea115646abfd nfc: digital: Do not dump a NULL response in command completion
3e7a093c177f9 nfc: pn533: hold a reference to the request skb during send_frame
eeb16fb24cfe6 nfc: llcp: bound SNL TLV parsing to the skb and add length checks
ee08414d78b85 nfc: nci: fix double completion race in nci_data_exchange_complete
d1b73962675cd nfc: llcp: read llcp_sock->local under the socket lock in getsockopt
bd6f1277b62bc nfc: llcp: avoid userspace overflow on invalid optlen
6d8926debeb9d hrtimer: Account nr_retries on recovered interrupt retries
ece3da898ef56 nvme: reject passthrough of driver-managed Set Features
b116e9dae433f nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()
0b4cf43f9ca71 nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns()
ad75556bde3ce nvme-apple: Drop the PRP null check chicken bit
e019219309813 nvme-apple: Require page aligned buffers on the admin queue
9650fd559f97f nvme: Add a quirk for page aligned admin queue buffers
03fd8591e90a5 nvme-apple: Never set the opcode in the NVMMU TCB
3bda132d063e6 nvme-apple: Don't set a DMA direction for commands without a data transfer
c11685ee4eedc nvme-apple: Destroy the admin queue on removal
7b81e4d2230e3 nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()
f6374ec9a3443 s390/irqflags: Add out-of-line definitions of arch_local_irq_*() for KMSAN
7954540e49ffb arm64: bti: Disable in-kernel BTI with recent versions of Clang
78ac8fc22b12f ASoC: qcom: q6apm: keep the graph start count in sync with the DSP
b5fb0376c773d spi: sprd-adi: Fix probe succeeding without registering the controller
49a61174186be arm64: entry: Avoid unnecessary local_irq_disable() on kernel exit
fdda85094b2f6 phy: qcom: qmp-combo: Drop qmp_v4_calibrate_dp_phy
8dda7211be1ea phy: qcom: qmp-combo: Correct pre-emphasis table for QMP v4 DP PHYs
8ecad7d61482f phy: renesas: rcar-gen3-usb2: Ignore missing VBUS regulator
2041b75c123fe rust: uapi: replace direct asm-generic/ioctl.h include with linux/ioctl.h
ddddf034ac0e7 iommu/amd: Fix incorrect device ID in invalid PASID error message
7da0bdf0610f6 apparmor: fix unconfined user namespace restriction forced stack
4b835e45a4bb3 powerpc/configs: enable CONFIG_RAS to fix EDAC support
db7c3ced1fe8f selftests: drv-net: so_txtime: only send test traffic to sch_etf
ab7891cab3f11 selftests: drv-net: Test queue stall upon reconfig
8dd136173106c PCI: ultrarisc: Get and enable DP1000 PCIe controller clocks
e1dc0af719a25 amt: Don't support cross-netns setup.
98518a8312dc1 pinctrl: rockchip: Decode drive strength in the get function
608816b886a22 selftests/sched_ext: Check skeleton open failure in exit test
972d037f00464 selftests/cgroup: Avoid awk -e in cpuset tests
3f3811bacd93f cgroup/cpuset: Use WRITE_ONCE() for shared prs_err updates
79fb405966edb nvme-pci: release descriptor pools on probe failure
cead174d42421 nvmet: propagate percpu_ref_init() failure in nvmet_ns_enable()
480f6b92c914b nvmet: fix Reservation Register Replace for unregistered host with IEKEY
92533e49fe3c4 NFS: Return a delegation the client fails to record
d8f0b83753809 sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE
eb476289c12cc SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6
3039101d61bbd hwmon: (pmbus/ltc4283) Add missing MODULE_DEVICE_TABLE for OF match table
bf3d173e1c410 hwmon: (cros_ec) Synchronize EC access from the thermal device callbacks
2a1828d693e61 hwmon: (cros_ec) Store the hwmon device in cros_ec_hwmon_priv
a098347049660 hwmon: (cros_ec) Register the thermal devices after the hwmon ones
08d4a5f731b33 arm64: Disable KCSAN instrumentation in delay.o
16fb33a8a323f xdrgen: Fix opaque and string encoders for unbounded members
621d4bba8f4c6 xdrgen: Add XDR width macros for short integer types
5585954164f50 xdrgen: Do not declare union XDR functions in the definitions header
af0f6fb2a2f93 xdrgen: Emit a blank line ahead of enum declarations
7ea29e2bffffc lockd: Regenerate NLMv4 XDR code
0a7908d48ea04 nfsd: add protocol support for CB_NOTIFY
7458727fd7cb7 NFSD: Release the export reference when reaping open stateids
af3fe52fd108f netfilter: nft_ct: move custom expectation support to helper
1e694ac22ef2c netfilter: nft_ct: support expectation creation for natted flows
026f7f91de39b m68k: Fix backtraces for non-running tasks
74669cc3483e9 media: amd: isp4: fix self-deadlock in isp4sd_pwron_and_init() error path
a1f8750668e55 media: amd: isp4: release partial allocations in isp4if_alloc_fw_gpumem()
8cd13087eb57d hwrng: imx-rngc - Disable clock on registration failure
7c7d3e51c2903 crypto: qat - remove dead ADF_HEX code
2a3c526c7554c crypto: qat - use 2-arg strscpy where destination size is known
5baddf100b3be iommu/vt-d: Flush context cache with correct SID when tearing down aliases
db5daf25f754c iommu/vt-d: Tear down scalable-mode context on probe failure
143cd37ce7652 iommu/vt-d: Fix iopf_refcount leak on RID domain replacement
6b822d18c33af iommu/vt-d: Clear Present bit before tearing down copied context entry
a45f0b5eaac6b iommu/vt-d: Fix UCTP context table slot when copying root entries
2af1e99ec14d2 iommu/dma: Restore locking around msi_page_list
9562653261393 fbdev: clps711x-fb: Remove unreachable unregister_framebuffer() call
7bf36dc23bcf3 fbdev: kyro: Validate overlay viewport coordinates
4b2c707bf5b1f fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device()
ef79a405f8399 apparmor: fix integer overflow in verify_tags() bounds check
b518c2468d91a perf synthetic-events: Fix divide by zero in perf_event__synthesize_threads
8340726a60aa6 perf python: Fix memory leak in pyrf__metrics_cb
31245887b0e0e perf python: Fix count_values memory leak in pyrf_evsel__read
9cd2a9a5fd744 perf python: Validate attribute setters in pyrf_evsel
a05972af8e9aa perf python: Validate CPU and thread maps in pyrf_evsel__open
1f8f4e482af32 perf python: Handle Py_None for thread and cpu maps
3d34725649fa6 perf python: Check counts_values size in set_values
41579b30c2fd7 perf test: Fix skiplist leak in cmd_test
7e0cf79cd2f9c perf synthetic-events: Fix uninitialized pthread_join
cf34a68e9adaa perf python: Fix memory leak in pyrf_evlist__get_pollfd
fbf8dc5170dae perf tools: Fix sb_evlist leaks in top and record
b0756b5be7298 perf stat: Fix evsel_list leak in cmd_stat
acf06e025eea4 perf script: Fix metric_evlist leak in script_find_metrics
a52414ecdbe6f ARM: dts: helios4: add SATA regulator supplies
e16bf98706185 ARM: dts: helios4: add vcc-supply to GPIO expander
8d976901462c1 ARM: dts: helios4: add vcc-supply to EEPROM
393d33d5d54c2 arm64: dts: turris-mox: fix usb3 phys
d1409d203251f i3c: renesas: Don't register devices when ENTDAA times out
869ecb1312921 i3c: renesas: Follow a unified pattern for transfer and command initialization
739eb8ac160db i3c: renesas: Return immediately if there is no transfer
051f2da26ce37 bpf: Fix mmap_lock leak in irq_work path
3f45d8358e01f riscv: cpufeature: Clarify ISA spec version for canonical order
dc8b33b819cb0 net/sched: cls_api: fix teardown of an adopted proto on insert-race loss
0ffd3e983069b iio: light: gp2ap002: re-enable irq if runtime suspend fails
470edb012b1d9 iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes
38c077c815901 iio: light: opt4060: Fix pointer type passed to div_u64_rem()
12feca1268315 bpf, cgroup: Fix storage null-ptr-deref after replacing prog
bf8f635531232 pinctrl: fix PINCTRL_GENERIC_MUX not always being selectable
63562cfaea8a6 Bluetooth: MSFT: validate evt_prefix_len against the response length
22624d43fd737 Bluetooth: btmtksdio: fix usage_count leak when autosuspend_delay is negative
481533b039851 Bluetooth: MGMT: free the HCI command when it is cancelled
fa46d428c014e Bluetooth: MGMT: free the mesh send cancel command when it is cancelled
bb5ca1cc7744c Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths
4d7b1c834d277 Bluetooth: hci_conn: fix the SCO setup context lifetime
f2b586d65f90c Bluetooth: btintel: Fix diagnostics event detection
b495a3a9b33bc Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind
84ea9c9987480 Bluetooth: virtio_bt: avoid OOB read of build info string
1499d5e7e2cf1 pinctrl: airoha: fix edge-triggered interrupts handling
afd4d7aabb01c pinctrl: airoha: fix IRQ mask/unmask code
2c968c11592b4 pinctrl: airoha: add missed IRQ resource helpers
eb2587a252784 pinctrl: airoha: fix getting gpiochip/pinctrl pointers in the IRQ handling code
f385f3d3248f0 pinctrl: airoha: add missed get_direction() function for gpio_chip
10e890b305e61 pinctrl: airoha: an7583: fix spi group pins
458b07ec42819 pinctrl: airoha: an7583: fix muxing of non-gpio default pins
3fe11ae08e8cd pinctrl: airoha: an7581: fix mux/conf of pcie_reset pins
ce7710c1151d7 pinctrl: airoha: an7583: fix I2C0_SDA_PD register bit order
229b61b5b2098 pinctrl: airoha: an7581: fix pinconf of i2c_scl/i2c_sda pins
dec9a98b444f4 pinctrl: airoha: fix mdio bitfield names
64c6f46708f17 perf sched: Handle missing trace samples in pipe mode
01bcff1241368 perf sched: Suppress latency table output when trace samples are missing
c4c136555ff90 btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data()
91ed75a0a0cb0 btrfs: use aligned range for locking in extent_fiemap()
98e3747587f9f btrfs: zoned: don't clobber the extent buffer when zeroing it out
e2de2989adb3e btrfs: zoned: flush active metadata block group at btree_writepages() start
81241f734f0f6 btrfs: retry verity reads for not-uptodate Merkle folios
e6045f6e8d869 btrfs: replace writeback inhibition xarray with a fixed inline buffer
d5602f96ff1e2 btrfs: check if root is readonly when setting posix acl
2073f3d97b0c5 btrfs: make sure EXTENT_BUFFER_READING is cleared under refs_lock
aaac9b352f7f5 btrfs: always wait for ordered extents to avoid OE races
ac916391e1c70 btrfs: defrag: fix deadlock between defrag and delalloc space reservation
8249dfe46337d btrfs: zoned: don't force read-only on transient -EAGAIN from reloc merge
6da989018eee3 scsi: sd: Fix sd_done() sense handling condition
5d7d1b8b525e5 scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails
748a14a0d41cf scsi: sd: Fix error handling in sd_probe() after large pool creation failure
56e547a31acee perf trace-event: Fix integer truncation in do_read() and skip()
077c42c5c04fb Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices
42deed40dd99f Bluetooth: btusb: Record matched usb_device_id into btusb_data
dce459875be52 Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855()
19f65ea34a539 Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event
35d534234e249 sched/fair: Check CPU capacity before comparing group types during load balance
1d3880877efe0 sched/fair: Also gate overloaded status update for SD_ASYM_CPUCAPACITY
304844b5545f4 perf/x86/intel/pt: Fix stop/start with no update
55a5bc0de3b4c perf/x86/intel/pt: Use bitwise access for PERF_HES_STOPPED
b7402b47cb08b perf/x86/intel/pt: Factor out pt_config_enable()
f0f512b8d9ee7 ACPI: video: Release PCI device reference after lookup
1b58cfd22ca04 thermal/drivers/spacemit: Validate clamped trip thresholds
ec320af6cc1ed ACPI: PCI: Avoid misleading _OSC messages for non-PCIe host bridges without _OSC
0afe0cf203a95 ASoC: tas675x: sort the register default table
d321dc10e4b02 regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling
b6fc0825df46a bpf, arm64: Fix exception table metadata for arena load-acquire
76b16abbc5ea1 bpf, x86: Fix exception table metadata for arena load-acquire
a7dad4c69e5f2 bpf, riscv: Add and use bpf_atomic_is_load_acq() helper
5f8ade6e9b793 bpf: Reject load-acquire from pointers requiring fault protection
7d199b6a0651a arm_mpam: Disable driver unbind to avoid UAF
a29044c9c8351 arm_mpam: Fix a NULL pointer dereference on unbinding after an error interrupt
988e11b69ef9d perf: arm_pmuv3: Zero initialize hw_id branch stack field
7e4f2702bbadb coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable
275466e3b95b2 coresight: etm4x: fix leaked trace id
5ac900f73ce1d coresight: etm4x: fix underflow for usage of (nrseqstate - 1)
8a0c540e0901d coresight: etm4x: fix wrong check of etm4x_sspcicrn_present()
b6ec4bf1ec444 md/raid1: don't set array_frozen in raid1_takeover()
bb7f92d58fca9 md/md-llbitmap: stop daemon timer rearm on destroy
2f0722435ce3a md/md-llbitmap: prevent create failure bitmap UAF
35b27002ae9c4 md: avoid stale clone I/O accounting timestamps
4224dccd325a9 md: wait for behind writes before destroying bitmap
ccbdc483eb041 md/raid5: round bitmap stripes with sector division
0fef3967ccb8e phy: qcom: qmp-pcie: Add pcs_lane1 offset to V5 offsets
03455404fb6cb phy: qcom: qmp-usb: Fix possible NULL-deref on early runtime suspend
b85bbec72fa81 phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend
0f9789d1b63e7 phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend
328cf94be9115 phy: qcom: sgmii-eth: vote for both voltage rails with correct current loads
fae5aba953686 soc: fsl: qe: check platform_driver_register() in qe_ic_of_init()
a22464c5df582 ext4: fix transaction overflow during writeback
c391af5743a44 ext4: teach ext4_meta_trans_blocks() about number of allocated extents
53f2e4d2b896e selftests/mm: unpoison pages in memory-failure teardown
dc2bd517ac0bc hugetlbfs: release subpool on fill_super failure
7bfae60ab7a53 pinctrl: rockchip: Restrict the RV1103B 2-bit drive type to bank 2
ab698d7710b47 pinctrl: rockchip: Reset the pin count when recalculating SoC data
1b10015957a63 pinctrl: tegra264: fix DAP2 DIN/DOUT pin assignment
fb4824880b0db firmware_loader: do not queue completed sysfs fallback requests
0e4b5f8cad67e scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path
39de65117fd9c PCI: cadence: Fix host/endpoint dependencies for cadence-plat driver
e399e9d7e291c drm/amdgpu/gfx6: Use PFP on the compute queues too
57a9b737e7939 drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets
36c99db9f364a perf trace-event: Fix buffer overflow in read_string()
ece5ad121b2ac phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table
5acdc4d5b58bd phy: sunplus: fix error handling in sp_uphy_init()
5374f3d53376d phy: renesas: rcar-gen2: Fix double of_node_put on phy creation failure
935f6e837a83b phy: renesas: phy-rcar-gen3-usb2: Fix devm action registration for disabled VBUS regulator
3f2828c4788ae arm64: dts: ti: k3-am64: Fix MDIO clock reference for ICSSG0 node
33145914688ed ALSA: hda: cix-ipbloq: Avoid build with 32bit archs
5826db2ddddb6 ext4: fix spurious message about orphan cleanup on RO fs
0fa116a17b69a drm/amd/display: Resize MST HDCP per-connector arrays to 32
6e26232294dbc drm/amdgpu/gfx6: Fixup emit_cntxcntl()
61b45f9be60cc leds: gpio: Clear error pointers for skipped LEDs
ad50c2c550ff2 mfd: macsmc: Fix key count endianness annotation
ad32c823abfb8 drm/amdgpu: read TRUNCATE_COORD_MODE on gfx12
7b5f4362c41ac drm/gfx12: Program DB_RING_CONTROL
e54c7a2bce63d mfd: iqs62x: Reject zero-length firmware records
f81bcb7e83be1 tools: Ensure tools copy of linux/filter.h exports the UAPI
15327f1eb9cc9 mfd: rave-sp: validate received frame payload lengths
77053624d0335 arm64: hibernate: Restore DAIF state on error
d736ace2c4916 arm64: hibernate: mask DAIF before restoring hibernated kernel
be919eed5e52a wifi: mac80211: skip default WMM setup for AP_VLAN links
8351d66344237 RDMA/erdma: restrict the driver to little-endian systems
cd2396fc9684d module/dups: Fix use-after-free in kmod_dup_req lifetime handling
2bdd4d5d2cae6 module/dups: Inform duplicate requests about the result directly
5ede61dc58fd3 module: use strscpy() to copy module names in stats and dup tracking
561651d6a1558 RDMA/siw: Fix use-after-free in siw_accept()
ad4492dcaf90a IB/isert: post the full-feature receive buffers after session registration
4397ea31e3b0d IB/isert: delay the final Login Response until the session is registered
545461671497c soundwire: cadence_master: add BRA_NumBytes[8] support
55516986a3d81 cpufreq: imx6q: fix out-of-bounds write when probed more than once
0f77d1a0a2505 cpufreq: imx6q: fix devres accumulation across driver rebind
35a125c9abbf7 rust: cpufreq: Fix temporary write in Registration::bios_limit_callback
04ac4e270e3d3 rust: cpufreq: Add CPUFREQ_TABLE_END as last table entry in TableBuilder::to_table
eadc95c99cbe8 drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz
e71206a8a1d97 drm/sun4i: Drop node references while building component list
d9fb87926522d drm/sun4i: dw-hdmi: Drop TCON TOP port reference
68e0643bb227a drm/sun4i: tcon: Drop remote endpoint reference
c0d3219ffd4c0 drm/sun4i: crtc: Propagate layer initialization error
ef396e92c50e5 drm/sun4i: hdmi: Don't leak sync polarity bits into packet control
ae08a67bca781 drm/sun4i: tcon: Drop TCON TOP device reference
eb1dc0e2c7acb drm/sun4i: tcon: Set output mux for DSI and LVDS
ac9f274dac952 drm/sun4i: tcon-top: Keep mixer routes distinct
a42daad53d09e drm/sun4i: vi scaler: Restore opaque alpha in video modes
f587b2606d710 drm/sun4i: vi scaler: Fix coefficient selection
4420c243e7892 drm/sun4i: Fix V3s YUV scanline size
4dd6b79f7099c perf c2c: Clean up registered formats on c2c_hists__init() and c2c_hists__reinit() failure
86f5cb2d1e612 perf c2c: Fix error masking, OOM, and unchecked caller errors in hpp_list__parse()
510b305f35aa6 clk: rockchip: rk3576: fix source muxes for SPI0..SPI4
976f1be72740c bpf: Fix sleepable check for tracing/lsm prog
f523359c4789b bpf: Clear buf on error in __bpf_get_task_stack
34cbcb333f30e bpf: Remove trace_in argument from __bpf_get_stack
27ed6cf4c0ac5 bpf: Factor callchain_finalize function from __bpf_get_stack
b61aacc66a1f6 bpf: Factor callchain_store function from __bpf_get_stack
b5a2907bdeced ocfs2: o2hb: quiesce negotiate handlers and timeout work
073f51e39bed3 ocfs2: synchronize heartbeat callbacks with o2net teardown
2e689bb5643cf perf libbfd: Fix memory leaks and NULL fclose in BPF disassembly
61fab78599058 perf bpf: Add PROG_TAGS to required arrays in __bpf_event__print_bpf_prog_info()
5161e7ef5b388 perf header: Use write lock when translating BPF prog info pointers
731edc4d0d01b perf libbfd: Validate BPF prog info arrays before pointer cast
8040663c1dfdf vfio/pci: Avoid mapping BARs for devices with non-mappable BARs
720408d98d9fb ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults
8d7cbc6df9632 ARM: 9484/1: enable interrupts when unhandled user faults are triggered
8de56782d6e5b ARM: 9483/1: select HAVE_POSIX_CPU_TIMERS_TASK_WORK
da64b150e4b7b ARM: 9481/2: breakpoint: CFI breakpoints only on demand
fa1b33fdab3e7 RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ
c92686867638c RDMA/erdma: Hold QP references for AE and CM processing
4545f355654d0 RDMA/erdma: Hold CQ references when processing EQ events
795f70fe748bd kbuild: fix modules.builtin(.modinfo) targets in the top-level Makefile
3c5adf387155a modpost: prevent leak when early return no suffix .o in read_symbols()
f3b6624d94210 scripts/tags.sh: Prevent binary files appearing in cscope.files
1b18270e3d881 intel_idle: Avoid using deep idle states during initialization
36fb592af353c xen/xenbus: check otherend_id only after it has been initialized
4fa8915f40f74 thermal: hwmon: Remove hwmon class device along with its parent
422a416041172 bpf: Check load-acquire src ptr type before the load
8fd17b394719a gpu: nova-core: correct FRTS vidmem offset calculation
018169883d483 gpu: nova-core: clean up FSP FRTS comments
b666585dfaf41 gpu: nova-core: factor out common FSP message header
c93fc0f7ba188 thunderbolt: stream: Fix possible short reads/writes
de9eac1099f10 thunderbolt: stream: Restore consumer if copying from iter fails
ede92f86b6c45 arm64: dts: qcom: talos-evk: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
7b08069029696 arm64: dts: qcom: sa8155p-adp: Fix swapped USB and UFS QMP PHY vdda-phy/vdda-pll supplies
458864b9ef1ca arm64: dts: qcom: eliza-mtp: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
c12cf2252ddee arm64: dts: qcom: lemans: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
4a65a0ffc748a arm64: dts: qcom: glymur: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
74d6524b34635 arm64: dts: qcom: kaanapali: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
eb262afc7231e arm64: dts: qcom: sar2130p: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
407b05cf21eac arm64: dts: qcom: sm8750: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
83db0e7a95f2f arm64: dts: qcom: sm8650: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
bfd0c3600b6ed arm64: dts: qcom: purwa: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
069f1a1523d02 arm64: dts: qcom: hamoa: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
8aad733a4bb88 arm64: dts: qcom: sc8180x: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
88ac1561a1ef2 arm64: dts: qcom: sc7280: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
a9783bec0db41 arm64: dts: qcom: sc7180: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
4cd993d91c8b7 arm64: dts: qcom: sm7225-fairphone-fp4: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
dfc8d77f80789 arm64: dts: qcom: qcs6490: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
221300448bd1d arm64: dts: qcom: qcm6490: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
93c1c78f9dc26 arm64: dts: qcom: qcs8550-aim300: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
85f59f34757bd arm64: dts: qcom: sm8550: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
64e223194230e arm64: dts: qcom: sm8450: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
d843ed6b412a6 arm64: dts: qcom: sm8350: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
d143fb29b0ca2 arm64: dts: qcom: sm8250: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
9063b2373ac8c arm64: dts: qcom: sm8150: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
1b3154a198b73 arm64: dts: qcom: sdm850: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
6071a3b06acef arm64: dts: qcom: sdm845: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
3db02fe87c95f arm64: dts: qcom: sa8540p: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
15ad83a26241e arm64: dts: qcom: sc8280xp-blackrock: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
8d951c93e4b19 selftests/mm: fix ternary operator precedence in ksm_tests
0df56ab44ecf0 selftests/mm: fix ksm NUMA merge test for systems with memoryless NUMA nodes
cd3c3baaa2564 selftests/mm: handle EINVAL when configuring gigantic hugepages
229ac37735167 selftests/mm: fix memleak in migration benchmark
2c2218560b6e2 bpf, cgroup: Fix invalid storage access after __cgroup_bpf_attach failed
6282d47b24b0c remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()
cd07aef510ac6 PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers
2fae17fd4fe3a PCI/sysfs: Return -EINVAL for unsupported I/O BAR mmap
fdfb3a1f5c06e ALSA: hda/realtek: ALC269 fixup for Yoga/Legion Mic noise
8d8d3d4a6483e arm64: dts: qcom: agatti: Add missing CX power domain to DISPCC
b681c740e6d64 block: handle nogenerate/noverify properly in fs-integrity
7ccd6b6448cdc block: lift BIP_CHECK_FLAGS to include/linux/bio-integrity.h
70af551b7fcdf block: remove bip_should_check
6e959e7691c64 ublk: clear auto buf reg before updating io->buf in batch commit
30810bdf273b4 drm/omap: dsi: Do not copy isr table
04e4d18e7fea9 riscv: dts: sophgo: cv180x: Allow the DMA multiplexer to set channel number for DMA controller
7ae71629357d0 bpf: Invalidate RCU pointers after final spin unlock
7565e44507634 fat: release buffer head after rebuilding parent
530a9d5ef831a rapidio: clear mport->net when rio_add_net() fails
0e7459abff46e ocfs2: do not use make_bad_inode() in ocfs2_read_inode_block_full()
9f4129b6905b7 ocfs2: validate external xattr entries when reading metadata
3fd45b24879fa ocfs2: validate inline xattrs during inode block validation
67201231eeccd pps-gpio: remove dead capture_clear code
77a6bdb97e02a pps: pps-gpio: split IRQ handler into hardirq timestamper + threaded handler
a31e768d2e4af pps: don't try to wait for negative timeouts in PPS_FETCH
13d0dfd5d5f35 lib/string: fix memchr_inv() for large ranges
70d7bb7a0be03 ocfs2/cluster: keep heartbeat local node stable
653d22269a8b8 ublk: validate auto buf reg before taking uring_cmd
af9a009ed4967 ublk: check for ublk_unmap_io() returning 0
5ac6019cb78e9 ublk: check import_ubuf() return value
b783da6e32c27 block/kyber-iosched: flush per-cpu latency buckets over possible CPUs
7a578afab9e93 block/blk-iocost: collect per-cpu latency stats over possible CPUs
29db15ba44936 block/blk-iolatency: account per-cpu latency stats over possible CPUs
834fbb747ced4 block/blk-stat: drain per-cpu callback stats over possible CPUs
d8c872901e645 blk-cgroup: skip dying blkg in blkcg_activate_policy()
2cf9f50a38c18 blk-cgroup: fix race between policy activation and blkg destruction
f97022fefe6eb phonet: pep: do not write beyond optlen in getsockopt
c20cf591d9231 net: stmmac: Skip PHY attach if custom PCS is in use
3ad0fd538503a iio: light: tsl2583: return zero in write_raw() on success
0649178f3cedb iio: light: isl29028: return zero in write_raw() on success
fe73809bc314f iio: light: tsl2772: fix ALS calibscale readback
b75ee915ab99f perf arm-spe: Reject zero nr_cpu in metadata to prevent division by zero
e258979168447 perf intel-bts: Fix off-by-one in auxtrace_info minimum size check
bbf8a944b007c perf intel-pt: Fix off-by-one in auxtrace_info minimum size check
68b37d885e886 perf auxtrace: Fix queue grow overflow and old array leak
d18a40a72b502 perf thread-stack: Fix heap buffer overflow on branch stack wrap copy
ef81d735d5796 HID: lg4ff: validate report length before fixed offsets
d10a68ac87683 HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure
b5fc0267ed840 HID: sony: add missing __packed to struct with static_assert()
93c5cc35bcd9f HID: steam: Reject short reads
dc766ca718ab5 HID: steam: Improve logging and other cleanup
fdc4ef7a4bfe7 HID: steam: Add support for sensor events on the Steam Controller (2015)
5181f83da9227 HID: steam: Rename some constants that got renamed upstream
de102444a5385 HID: steam: Refactor and clean up report parsing
7b5ae8d815f7a HID: i2c-hid: Fix "(null)" output when reading report descriptor fails
b85d1000eb884 HID: synchronize input before cleaning up a failed probe
4eff0ad8128b8 HID: i2c-hid: Refactor _DSM helper and add i2c-hid-acpi-prp0001 driver
13378c9ac0a1b HID: logitech-hidpp: Fix FF device cleanup on init failure
5c288cc441a2c HID: asus: fix a off-by-one in mcu_parse_version_string() validation
744b3f930c117 HID: asus: refactor the two workqueues and init sequence
b712b4135ce45 PCI: dwc: ep: Fix unmap potentially unmapping the wrong iATU
5aed69e20fd3d platform: arm64: qcom-hamoa-ec: reject incomplete responses
914704c7b318b PCI: dwc: ep: Flush cached MSI write before unmapping the iATU
79588f2c75494 misc: pci_endpoint_test: Check SUCCESS bit for doorbell status
6228722c27304 dm-integrity: replace forgeable discard filler with a keyed sector marker
5c5a795bf6248 tty: clear cdev pointer after cdev_add() failure
3dbf85ef40b63 tty: skip cdev_del() when no cdev is registered
06b376432974f serial: core: clear freed pointers on uart_register_driver() failure
c2aec15f78b2e serial: core: do fallible allocations before the console can be registered
2ad24c1d0b939 serial: amba-pl011: keep console clock enabled for atomic writes
0bcf3335dd3b4 serial: amba-pl011: unprepare console clock on unregister
10232a59e076a MIPS: ptrace: Fix syscall skipping via PTRACE_SYSCALL
6390b2a352fcf soc: fsl: qe: implement get_direction()
77159db9c6f1c soc: fsl: qe: properly scan GPIO nodes at startup
7b0093b638c8f powerpc/irq: Fix missing r2 clobber in PCREL inline assembly
066e5e9962dd4 powerpc64/bpf: Fix build break for arch_bpf_timed_may_goto
ce39762511209 powerpc64/bpf: Fix build break in bpf_jit_emit_func_call_rel()
19b54740e2e11 powerpc/syscall: Fix syscall skip handling for seccomp and ptrace
de2d453f6f71d powerpc/smp: add NULL guard for cause_ipi in smp_muxed_ipi_message_pass
c554a8d376d5a powerpc/xive: propagate IPI init errors to prevent use-after-free
e4c0451aa6154 powerpc/xive: add error return value to xive_smp_probe()
0a2be2ca7ad7b powerpc/xive: make xive IPI allocation NULL-safe
7e4b44abf682b pinctrl: spacemit: validate pins in pinconf callbacks
09f47abc95ee9 pinctrl: generic: free maps on pinctrl_generic_to_map() failure
9ab072a1469f1 pinctrl: eswin: Fix Handling of PIN_CONFIG_PERSIST_STATE
91a6f4283099c objtool/klp: Fix symbol resolution for duplicate data symbols
9f08c40740410 objtool/klp: Add .klp.symid for sympos disambiguation
20938e167757d objtool/klp: Fix false module dependencies caused by dead relocs
8844c2efd92ca objtool/klp: Normalize Module.symvers paths to module names
ce962f04312fa objtool/klp: Fix module name normalization for paths with dots
e82f260a74dea firmware: coreboot: Validate table bounds
af8087f16714f bpf: Fix mmap_lock deadlock on arena lock failure
db3439ad11ac5 wifi: cfg80211: stop PMSR before P2P and NAN teardown
eef374088450b wifi: mac80211: disconnect on CSA to channel 0
f26e1b1690455 wifi: brcmfmac: fix P2P action frame handling without device vif
5f00970da7da0 perf build: Fix a build error on 32-bit x86
cb04dd061d333 wifi: mac80211: skip unused probe response countdown offsets
ef65c02a5a1fa wifi: zd1211rw: reject secondary interfaces to prevent conflicts
4e0a67fbe3d9e wifi: nl80211: clean up color-change beacon data on errors
c8ae335c4823e wifi: mac80211: send TWT teardown to peer after setup TX failure
40120891f29d5 perf/cxlpmu: Fix 64-bit write to 32-bit HDM filter register
6a1e24977e503 iommu/arm-smmu-v3: Convert to use atomic poll timeout
88493d0d4c81e kselftest/arm64: Don't write to P0 in irritator on SME only systems
f433869f23841 arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry
b568c2097a690 kselftest/arm64: fp-ptrace: Fix checks for inactive SVE and SSVE regsets
b19c3fd8e2abb arm64/fpsimd: ptrace: Fix inactive SVE and SSVE regsets
bd89a1988f44d arm_mpam: Apply T241-MPAM-6 to 63-bit counters
6e61b07c34874 arm64: smp: Fix IPI teardown for GICv5 flow
0bd829443a50b wifi: mt76: mt7996: remove beacon_int_min_gcd from ADHOC interface combinations
045d1bfb72d26 wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump
c770e7da8cebd wifi: ath12k: fix encrypted EAPOL TX in encap offload mode
aff81505a84d2 wifi: mt76: mt7996: fix out-of-bounds link array access in mt7996_tx()
c1442c345ca8d wifi: mt76: reject out-of-range link ids in mt76_vif_link()
626dce25666a8 wifi: mt76: mt7925: Fix EHT Beamformee SS subfields to meet 802.11be minimum
fa496e89e01cf wifi: mt76: fix queue assignment for disassoc packets
c2dfb099ca941 wifi: mt76: mt7915: report RX chain signal for all RX paths
42082f42969a3 wifi: mt76: mt7915: fix chainmask handling for non-dbdc phys on band 1
2c488baccd973 wifi: mt76: mt7996: do not leave state behind after a failed WED attach
d566387df8306 wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed
865c798933a03 wifi: mt76: mt7996: fix reg addr remap when addr is 0
fb9c7b4c238b4 wifi: mt76: mt7915: release hif2 reference on probe IRQ failure
648f5f03ff50d wifi: mt76: mt7915: fix ext PHY use-after-free on register error path
29fbc5256c2d8 wifi: mt76: mt7915: fix double hif2 init on the non-WED path
9e02b1cfb163b wifi: mt76: mt7996: fix MIB TX aggregation counter registers for mt7990
60eb18612d216 wifi: mt76: set MT76_SCANNING when starting a hw scan
fc3762724a368 wifi: mt76: mt7996: clear stale link state on full reset
8826d7a5e2dd7 wifi: mt76: mt7996: free vif links after clearing wcid entries on full reset
bb507affe9e23 wifi: mt76: mt7996: wake MCU waiters before aborting scan in L1 SER
c667ec75881cb wifi: mt76: mt7996: skip key upload when adding an offchannel link
beaa42b875965 wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement
a6d7d7a253c55 bpf, x86: Fix trampoline stack size for 128-bit arguments
d36ac53fc83ba bpf: Reject >8 byte return values on return-reading trampoline paths
2b33064072c8c perf machine: Check snprintf truncation for guest kallsyms path
8cd0affed95c6 perf machine: Free scandir entries in guest kernel map creation
c2d36639d371c perf machine: Reset errno before strtol in guest kernel map creation
2edeb8a9f07b6 perf machine: Don't abort guest map creation on first inaccessible dir
f320fd080d036 perf machine: Check snprintf truncation in machines__findnew()
e67b5cb76c5b9 perf machine: Guard against NULL strlist in machines__findnew()
c760be5c9f1b7 perf machine: Fix NULL parent dereference in fork event processing
bb43829acdf47 perf machine: Fix fd leak on bounds check in maps__set_modules_path_dir()
201636c1cfd34 perf libdw: Fix outer-frame name resolution and spurious "(inlined)" tag
da56e16f42930 perf unwind-libdw: Fix unwinding of multi-threaded processes
cb8f0d60160be ASoC: SDCA: Add missing stub for sdca_fdl_free_state()
29dc2e24f6adb regulator: core: use system_freezable_wq for init complete work
cc6a0133c7495 arm64: tegra: Fix CMDQV interrupt type on Tegra264
3a50428864437 ARM: tegra: Fix OF node reference leaks in IRQ init
08331ff6fffad ASoC: tas2783-sdw: drop stale regcache on uninitialized re-attach
bfa756f3b8bf8 ASoC: codecs: tas2783-sdw: Propagate regcache_sync() errors
047a817147806 wifi: ath11k: fix leak in ath11k_service_ready_ext_event()
00008e6f544c2 drm/msm/dsi: Drop dev_pm_opp_set_rate(0)
e532b800728d7 drm/msm/dp: Drop dev_pm_opp_set_rate(0)
54b17a858b8be drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0)
8a3aee5143ea8 perf: arm_spe: Make wakeup range check overflow safe
2350896a36b58 drm/msm/dp: do not reject wide-bus modes while a YUV420 mode is active
c89d481a50de2 drm/msm/dp: reject YUV420-only modes without VSC SDP support
e2a99fa93b400 drm/msm: don't tear down KMS twice when KMS init fails
0f00f6848f6b6 drm/msm/dpu: Fix DMA SSPP REC block offsets on DPU v13
182cd086b31ea ACPI: processor: Unregister cpufreq notifier on init failure
1558c267b78b1 wifi: mt76: only consume the WO drop bit on WED v2 devices
4087cff2389c9 wifi: mt76: mt7996: add missing rdd_idx check when enabling background radar
2bcbbfaaa648d wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields
e1383c17fb5d1 wifi: mt76: report data NSS for STBC frames in RX rate decode
c4dc85481d389 wifi: mt76: cancel reset and rc work on device unregister
ea69a378d77ca wifi: mt76: mt7996: don't leak MLD group index on remap alloc failure
1a51aff0e048d wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV
01e3d5707522e wifi: mt76: fix ER-SU 106-tone RU check in RX rate decode
5f9c09e948cea wifi: mt76: decode the full VHT Rx STBC capability field
594c4b7f89f9e wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER
71bf9de2ab3fb wifi: mt76: mt7915: unwind state on add_interface failure
6ed0fba58bb12 wifi: mt76: fix out-of-bounds access in mmio copy helpers
93eaddfdd35aa wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config
e6a7cfe073191 wifi: mt76: fix HE DCM max-RU capability encoding
fd5a8b049a7e5 wifi: mt76: check txfree done event on the WED hw path
636ab58493fc2 wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie
a273dc3b86a7d wifi: mt76: fix RXDMAD_C buffer recycling race
a83bc76d17131 wifi: mt76: fix uninitialised RXDMAD_C descriptor info
0fd0bad6248dc wifi: mt76: fix stranded frames in mt76_txq_schedule_pending
a68447b884548 wifi: mt76: fix 4th chain ACK RSSI bitmask in sta_poll
93ce0dae8e770 wifi: mt76: mt7915: write RX header translation bit to the correct register
7b47f11d6ce0f wifi: mt76: mt7996: don't report a zero TX bitrate
ecfd1a07e78c3 wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss
a97b2b942d2f8 wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear
4b92027fd043a wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset
b1c5cf8903bec wifi: mt76: mt7996: validate RX band_idx before dereferencing phys[]
1584fd436132c wifi: mt76: assign link_id when sending probe request during scan
186c957ac3325 wifi: mt76: fix non-AQL packet accounting for MLO stations
0a951ff6704db wifi: mt76: mt7996: fix MLD ID in MAC TXD and HIF TXP
db4be207f3f6d wifi: mt76: fix RX data queuing of RRO 3.0
253b30a739ca1 wifi: mt76: mt7996: fix capability of EHT-MCS 15 in MRU
a142565452eef wifi: mt76: mt7996: fix non-MLD station num_sta leak
85a0d0bf97266 wifi: mt76: mt7996: fix EAPOL source BSS for non-MLD stations
6a342db7a6502 wifi: mt76: mt792x: Fix memory leak in SDIO TX path
27dbe86665dae wifi: mt76: mt7925: fix msg len mismatch between driver and firmware
5cfd3d6078d91 wifi: mt76: mt7925: update clc before setting sar power table
7b7060e262731 wifi: mt76: mt7927: set band index for sniffer mode
f544bcba4721e wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash
b250943f3f835 wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete
0c46d22c30a16 wifi: mt76: add init_wiphy callback
2691bf35cee6e wifi: mt76: mt7925: add NAN MCU helpers
2ca99492a7bf7 wifi: mt76: connac: add NAN connection type
d4029aab5be84 wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986
ef0190f1fafa7 wifi: mt76: mt792x: stop USB register access after bus hang
063169a2755ab wifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx()
6def491fe9c4e wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length
2e3549a038f10 wifi: mt76: connac: add MT7991A (0x7991) to is_mt7996()
3b052a39c4650 fanotify: report full event length for FIONREAD
ef81e4a1628ec misc: sgi-gru: remove interrupt-context page-table walks
961f4406a2dd3 misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe()
a1584c5f05cb6 powerpc/crash: Fix possible memory leak in update_crash_elfcorehdr()
2996d2a7cb92c powerpc/44x: Set GPIO chip parent
4e8bfb2a3b271 powerpc: implement get_direction() in cpm2
193fe50a497d4 dma-resv: Fix undefined symbol when CONFIG_DMA_SHARED_BUFFER is disabled
34470cc3a8e66 iomap: release the folio batch on iomap callback failures
20e9cbd3be1e3 dcache: keep shrink_dcache_for_umount() making progress on busy roots
9be10f49dfc2e locking/lockdep: Fix NULL pointer dereference in __lock_set_class()
1e202ab730014 pinctrl: qcom: shikra: Fix intr_target_width for summary interrupt routing
c02d675e81468 md/raid1: create serial pool adding rdev to array with serialize_policy=1
1f42e5898b45a fs: annotate inode timestamp accessors
dff41b56ab7b7 i3c: master: adi: add OF module alias for autoloading
618dd640ded6b i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices
c1f4d7763cdf1 swiotlb: Preserve allocation virtual address for dynamic pools
8c486293ddd0a iommu/dma: Check atomic pool allocation result directly
a58923756b0f8 md: scope memalloc_noio to allocation critical sections
cc543e769b97d md/bitmap: resume array on backlog_store() error path
af409d56bb38c clk: qcom: Return expected ENOMEM error on dynamic allocation failure
e13c99679b548 clk: qcom: gpucc-qcm2290: Park RCG's clk source at XO during disable
bb105eb8cce85 clk: qcom: gpucc-qcm2290: Keep the critical clocks always-on from probe
679df05c771ae clk: qcom: gpucc-qcm2290: Move to the latest common qcom_cc_probe() model
73d816a47fcc0 clk: qcom: gpucc-qcm2290: Drop pm_clk handling
308f3349e2fd6 clk: qcom: qcm2290: Update DISPCC and GPUCC GDSC *wait_val values
844e78f832279 clk: qcom: qcm2290: Add RETAIN_FF_ENABLE flag for DISPCC and GPUCC GDSCs
dfc8dea60be27 clk: qcom: qcm2290: Set POLL_CFG_GDSCR flag for DISPCC and GPUCC GDSCs
8b516ca0d040c clk: qcom: dispcc-qcm2290: Enable runtime PM support
a0e5c01eb1df8 clk: qcom: dispcc-qcm2290: Move to the latest common qcom_cc_probe() model
8bc5a909a6110 clk: qcom: negcc-nord: keep GPU2 CFG clock enabled via critical CBCR
b88c019e2cca9 clk: qcom: gcc-nord: mark PCIe link clocks as critical
9726f63fb9255 clk: qcom: negcc-nord: use clk_regmap_phy_mux for USB3 pipe clock srcs
c3683217826d7 clk: qcom: nord: use BRANCH_HALT_SKIP for PHY pipe clocks
948183bb89dc0 arm64: dts: qcom: eliza: Add fallback compatible for ADSP remoteproc
a2074f86fc965 lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone
65e7240d679fe platform/chrome: lightbar: Limit payload to max packet size
79347e42cfbc9 bpf: Fix potential UAF when reading bpf link info
923f559e95b89 bpf: Fix potential UAF in bpf_netns_link_update_prog
aab9d81a415c6 power: supply: sc2731_charger: cancel work on remove
ad4f4e6678ecd power: supply: isp1704_charger: cancel work on remove
3646c881b6adb arm64: dts: qcom: qcs6490-rb3gen2-industrial-mezzanine: Fix the PCIe iommu-map entries
65fded30a4479 arm64: dts: qcom: qcs6490-rb3gen2: Fix the PCIe iommu-map entries
d6c3c9c6cc382 arm64: dts: qcom: qcs6490-thundercomm-minipc-g1iot: Fix the PCIe iommu-map entries
efcf504642bae arm64: dts: qcom: qcs6490-radxa-dragon-q6a: Fix the PCIe iommu-map entries
a1e2a5239cfc5 arm64: dts: qcom: lemans-evk-ifp-mezzanine: Fix the PCIe iommu-map entries
e57c32625d30d arm64: dts: qcom: monaco-evk-ifp-mezzanine: Fix the PCIe iommu-map entries
d0da19edc7baf arm64: dts: qcom: monaco-monza-som: Fix the PCIe iommu-map entries
5ac48b3956ca9 arm64: dts: qcom: monaco: Fix the PCIe iommu-map entries
3047cfd5ebdce arm64: dts: qcom: lemans: Fix the PCIe iommu-map entries
eb16dcbce98bc arm64: dts: qcom: talos: Fix the PCIe iommu-map entries
604e55211af9b arm64: dts: qcom: sm8750: Fix the PCIe iommu-map entries
ff9c3c087b67a arm64: dts: qcom: sm8650: Fix the PCIe iommu-map entries
9eb128da8525a arm64: dts: qcom: sm8550: Fix the PCIe iommu-map entries
0ce01e1cd0c3b arm64: dts: qcom: sm8450: Fix the PCIe iommu-map entries
1d6e5c05018be arm64: dts: qcom: sm8350: Fix the PCIe iommu-map entries
8c8b4f2a352c1 arm64: dts: qcom: sm8250: Fix the PCIe iommu-map entries
dcdb31fb3e978 arm64: dts: qcom: sm8150: Fix the PCIe iommu-map entries
22a6fcd328ab1 arm64: dts: qcom: sdm845: Fix the PCIe iommu-map entries
04ae73e1f607a arm64: dts: qcom: sc8180x: Fix the PCIe iommu-map entries
bf3f0faa45144 arm64: dts: qcom: sar2130p: Fix the PCIe iommu-map entries
5f6cc86e9d609 arm64: dts: qcom: kodiak: Fix the PCIe iommu-map entries
36fb7eea71218 arm64: dts: qcom: kaanapali: Fix the PCIe iommu-map entries
9d0e427b1bbba arm64: dts: qcom: sm8250-xiaomi-elish: correct the board ID
58d595f2d695c arm64: dts: qcom: talos: Fix cpu6 1094.4MHz OPP frequency typo
030376932ffd9 arm64: dts: qcom: glymur: Fix PDC IRQ mapping
cbbaf0c870dde block: fix dio leak on metadata mapping error
6809ba75b8bb5 firmware: qcom: scm: Fix tzmem state on probe retry
6fab857eccfc6 firmware: qcom: scm: Fix reserved memory cleanup on probe failure
f312ef5026678 firmware: qcom: scm: Fix NULL dereference in IRQ handler before __scm is published
edad2969959f1 firmware: qcom: scm: instrument SMC call path with tracepoints
0e93bb22355ef firmware: qcom: scm: add trace events for the SMC call interface
cb3219dcb859b arm64: dts: qcom: sc8280xp-crd: Fix the pin index for misc_3p3_reg_en
a9e8aa66c5387 arm64: dts: qcom: glymur-crd: Add FocalTech ft3d81 touchscreen support
759308ce67e93 soc: qcom: pmic_glink_altmode: Define the TBT extradata properly
c9edf04712b5c clk: qcom: gcc-qcm2290: don't park QUP RCGs upon registration
cf8a53ea2a805 arm64: dts: qcom: qcs404: Fix DTBS Check errors in usb controller nodes
099702ece0620 arm64: dts: qcom: sdm632-motorola-ocean: Fix LED default trigger property
9f84fcd286907 arm64: dts: qcom: msm8976-longcheer-l9360: Fix accidental node override
85fc83107415d arm64: dts: qcom: msm8998: Don't pull-up I2C pins by default in sleep
4c31039af7423 rcu: Mark accesses to ->rcu_urgent_qs and ->rcu_need_heavy_qs
0a3709557f885 PCI: dwc: ep: Clear MSI iATU mapping in dw_pcie_ep_cleanup()
379913074bf47 md/raid10: consistently fail atomic writes that require splitting
110092e68836e md/raid1: restrict atomic write limits and handle runtime constraints
acff2713c3212 wifi: ath11k: fix stride mismatch in mac_phy_caps_parse()
26f8f87f0a556 wifi: ath12k: fix stride mismatch in mac_phy_caps_parse()
ba1ee854b681a Revert "serial: 8250: Clear CON_PRINTBUFFER on port re-registration"
cd2e268520948 selftests/zram: fix kernel_gte() for POSIX sh
81b39df5d7019 md: recheck spare changes before starting sync
9bb9504e2d8f3 md: remove REQ_NOWAIT support from raid1/10/456
f6215e3a65f19 tools/nolibc/powerpc: mark ctr and xer as clobbered by system call
86d4e8c527dee fanotify: stop permission watchdog when timeout is zero
0187a11e2d612 md/raid5: protect lockless recovery_offset accesses during reshape
bae1d77351139 net: airoha: fix ETS QoS stats counter underflow and cross-channel corruption
4b9a1b5203d4e md/raid5: fix lockless max_nr_stripes reads
fcf21df7d3c50 md/raid5-ppl: fix use-after-free in ppl_do_flush()
16b6e6243d81f md/raid5: protect bitmap batch counters aka seq_flush/seq_write consistency
4743959aa8d87 bus: mhi: host: Fix controller cleanup on EDL sysfs failure
84e713a8aa7fe bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET
1b68b6e529ce7 wifi: rtlwifi: pci: fix error path in rtl_pci_probe()
05c1081ae4503 platform/chrome: cros_ec_debugfs: Unregister panic notifier
e97d1fce7173f platform/chrome: cros_ec_debugfs: Clean up console log on probe failure
618781e47fb04 regulator: tps65185: handle gpiod_get_value_cansleep() error returns
08835d42ce640 s390/vdso: Pass --eh-frame-hdr to the linker
4d030d7d1af95 media: stm32: dcmi: fix some error handling bugs in probe()
cb83cfff8dff5 media: qcom: iris: handle runtime PM resume failure in core deinit
6bd10931ac2d4 media: qcom: iris: Remove duplicate HFI_PROP_OPB_ENABLE entry
a5e341a25de36 media: qcom: iris: Fix bitmask test in iris_allow_cmd()
8a61c211d0d52 drm/msm: remove objects from evit list after pinning them
29d6bbda42aa9 PCI: starfive: Fix unchecked pm_runtime_get_sync() in probe
dad14ba26c9a2 PCI: starfive: Fix Runtime PM handling and teardown ordering
7c7fad5607dc2 wifi: ath12k: validate TLV length in process_tpc_stats()
5de2b8c53714a wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event()
bf97c9d512385 wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event()
761cf9c63274a drm/panthor: Add vm_bind region with kbo range overlap check
1a7958ce58dc9 spi: davinci: switch to managed controller allocation
44ec34cd3cbea nvmet: reject out-of-range mdts values in configfs store
06352dae949c1 nvme-pci: return error when parsing a quirk string fails
be5eb47ee3fea nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request
9e136150ac55d nvmet: fix return status of RMI log page on allocation failure
48812c8103071 IB/isert: reject login PDUs declaring more data than was received
352dc85324b29 IB/isert: reject PDUs declaring more data than was received
c12cc56eb9fcd media: staging/ipu7: fix async notifier leak on init error
a64e2beb45017 RDMA/cxgb4: free STAG index when TPT entry write fails
5b96c5ba26a8f RDMA/mlx5: Send cong param changes to the resolved port mdev
c75ee076fa097 RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs
6b15fc9bc117f RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry()
254579a81e49a riscv: dts: spacemit: Make dtschema recognize the etherent PHY correctly on K3 com260 board
63ad1eb9dcebb riscv: dts: spacemit: Make dtschema recognize the etherent PHY correctly on K3 pico-itx board
fcf7e0500ea9a clk: spacemit: k3: fix missing /2 factor in i2s sysclk dividers
fcadc927cbff4 scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches.
f181155baf0c9 nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch
15c8559376416 nilfs2: prevent out-of-bounds read in super root block parsing
8cea0bc78ac64 nilfs2: fix infinite loop in nilfs_clean_segments()
44ea94a65fd27 clk: rockchip: Fractional PLL coefficient on RK3588/RK3576 is two's complement
554c752ebd460 clk: rockchip: Fix the fractional part denominator on RK3588/RK3576 PLLs
42a5661ff7e4c PCI: Fix UAF when probe runs concurrent to dyn ID removal
e0b62b59a0abf PCI: Fix dyn_id add TOCTOU
30f79038b676b PCI: Make pci_match_one_device() match on ID instead of device
8e25cfa697a91 clk: mediatek: mt8135: Fix inverted gate control for devapc_ck
6bc007ee691c3 clk/x86: pmc_atom: add kasprintf return value check
a3c031fd2c4c8 clk: palmas: Manage external-control prepare with devm
1183dc2450a26 clk: eswin: Zero-initialize stack-allocated clk_init_data
fea0b4fd891a2 clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path
8ed265c0b4720 clk: tegra: tegra124-emc: put EMC node on register failure
41e42bf05da99 arm64: dts: allwinner: sun50i-a64-pinephone: Fix mpu6050 mount matrix
0b56ad971fa02 wifi: mac80211: fix per-STA profile length in cross-link CSA parsing
ce30b9f6ace6f media: stm32: dcmi: fix error handling on MDMA pool alloc failure
1d4b590277347 RDMA/efa: Fix PBL chunk length computation
4cfb448705da3 RDMA/rxe: Fix UAF in ODP init error-handling path
417190bde0fda iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path
0b139ec4641c7 iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID
421f5ab135cd4 iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs
86197679b293f iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc()
a168254ff8db0 iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs
f3ef4abc271a1 iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF (de)init
b4535b403d6bf iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized
967a5ff8a614d fs/ntfs3: reject restart table growth beyond U16_MAX entries
e67992e9089be staging: rtl8723bs: use kfree_sensitive() for key material
c582b049fd021 arm64: dts: qcom: glymur: fix SoCCP memory mappings
0dc9e289bbb54 remoteproc: qcom: q6v5: Request shutdown if crash is triggered host-side
a8deb8980c636 remoteproc: qcom: pas: Add late attach support for subsystems
61862ed651b24 remoteproc: Prevent crash handling to race with rproc_del()
0ff49320a49ca remoteproc: core: Attach rproc asynchronously in rproc_add() path via schedule_work()
38e4018ac5cc1 remoteproc: Allow shutdown of crashed processors
b22af817f56d0 cpufreq/amd-pstate: Set min_limit_freq based on bios_min_perf
732fc96c1f872 perf annotate: Be robust to annotating without a thread
f173b0c5e6561 perf ui hists: In report UI ensure thread is set with reference counting
b5ea46ba8a953 gpu: nova-core: fix packed registry table size
973e3c9087f97 gpu: nova-core: build SetRegistry entries dynamically
4d6270bbb4e08 sched_ext: Abort directly from the hardlockup handler
30f4e6c8225ed sched_ext: Fix exit_cpu accuracy for lockup paths
7965965aa2828 w1: ds2482: Fix signedness bug in ds2482_w1_triplet()
1cd16c8d68f58 spi: oc-tiny: switch to managed controller allocation
7069684d4bc68 clk: mediatek: mt6735: Unregister PLLs on probe failure
1c90da6376e47 PCI/pwrctrl: tc9563: Power off only the external ports in tc9563_pwrctrl_disable_port()
972c771674e88 PCI/pwrctrl: tc9563: Fix parsing the integrated Ethernet MAC Endpoint node
3371d30a97a25 isofs: release zisofs block pointer buffer head
16a56afd56c49 powercap: intel_rapl_tpmi: Handle PMU registration failure during probe
74d2066418412 thermal/drivers/qcom-spmi-adc-tm5: Drop IIO_VAL_INT check in adc_tm5_get_temp
82d250eb2a04b thermal/drivers/airoha: Fix copy paste error for sen internal
bf7994d4d7f5e thermal/drivers/airoha: Fix copy paste error on clamp_t low temp
67332b75ca7ec ACPI: bus: Avoid confusing complaints regarding missing _OSC features
f917707f0de08 RDMA/mlx5: Fix integer overflow of user QP buffer size
093f290dd8790 crypto: keembay - publish OF module alias for OCS AES/SM4
5aae80dcec074 crypto: keembay - Initialize completion before requesting IRQ
2b3fb5693c25c scsi: ufs: debugfs: Reserve space for a string terminator
cfef700703d98 scsi: ufs: rpmb: Validate request frame length before parsing
4b62f73836f4d scsi: ufs: core: Validate connected lane counts
a769095d1d74e scsi: ufs: Avoid NULL CQE dereference when reporting invalid tags
66da25277256b scsi: ufs: core: Validate string descriptors
f7f970bc70529 power: supply: sbs-battery: Use a per-device serial number buffer
d29a8ee271da1 arm64: RSI: fix field-spanning write warning in attestation token init
df6bc642201d7 riscv: dts: spacemit: Fix phy id check for the phy on com260 board
a510644ce03e7 riscv: dts: spacemit: Fix phy id check for the phy on pico-itx board
9875c4587d651 tools/build: Allow versioning of all LLVM tools defined in Makefile.include
e06785cba7f86 pinctrl: mediatek: free EINT resources on unbind
b8fa1098ee9f6 pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip
908f3ea3f050b liveupdate: Remember FLB retrieve() status
217775362e805 liveupdate: Reference count outgoing FLB data
f2a3a52b82930 liveupdate: reject nonzero reserved value for SESSION_FINISH
dc59caae4d8f7 riscv: dts: spacemit: Add enough deassert time for the PHY on com260 board
bf26fb05720ba riscv: dts: spacemit: Add enough deassert time for the PHY on PICO ITX
56140bd357c5d riscv: dts: spacemit: improve RTL8211F PHY configuration on K3 Pico-ITX board
7c37d7cd2d0b5 power: reset: reboot-mode: Remove devres based allocations
8f7683ce37a53 cxl/region: Fix use-after-free in find_pos_and_ways() error path
c44c01167aed2 pinctrl: fix unmet dependencies from missing GPIOLIB
1a6e68cd61174 selftests/bpf: Fix memory leak on subtest_states reallocation
3d83554653bb2 selftests/bpf: Fix missing allocation null checks in test_progs.c
8d2b2adee3b94 selftests/bpf: Fix incorrect error checking for pthread_create
48a0209d8da0d bpf: Fix WARNING in bpf_tracing_link_release
5de0acc36e233 ARM: lpc32xx: only run SoC init on LPC32xx hardware
a2cbab47f44e9 bpf: Fix CFI mismatch in task work callback
843419e12402b arm64: dts: rockchip: Fix rk3566-bigtreetech-cb2 touchscreen property
94987478c83e0 arm64: dts: rockchip: Fix Gru WLAN sideband interrupt
331fd2c8cd1e2 arm64: dts: rockchip: Add missing hclk for RK3588 eDP1
d506e4a1b179f arm64: dts: rockchip: Add missing hclk for RK3588 eDP0
24f20986b253c exfat: fix valid_size extension over a shared writable mapping
8cb66c6579ab2 drm/panthor: return PTR_ERR() from devm_drm_dev_alloc()
72caafbc95c5d fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init
c408d416618eb netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet
fdb1a59dfc8cf drm/tve200: add OF module alias for autoloading
0b37120b0bb53 perf trace: Correct default cpumask formatting to hexadecimal
8edcf5385ca71 perf cap: Remove used_root parameter and simplify capability checks
aabd063d7987c ASoC: spacemit: rename clock inputs to match binding
5b856fd4a7632 clk: sunxi-ng: mux: fix determine helper rate propagation
4eda2111b111c leds: pca9532: Fix phantom device registration on missing hardware
c2b4cd53bc6f3 PM: hibernate: Fix memory leak in snapshot_write_next() error path
334145d683ad3 RDMA/erdma: complete object teardown when the destroy command fails
56a347950e661 xfrm: Fix skb double-free in xfrm_dev_direct_output()
9562da57ff483 perf cs-etm: Avoid truncating AUX buffer sizes to int
28bb9cb313477 perf cs-etm: Flush thread stacks after decoder reset
a8412fdcd0007 gpu: nova-core: correct RISC-V HALTED field
8f396ccaf128d riscv: dts: thead: th1520: remove pclk for I2C1
e8a504606b945 riscv: dts: spacemit: k1: Split gmac_clk_ref into independent pinctrl groups
da3066cee2c83 riscv: dts: spacemit: set console baud rate on K3 Pico-ITX board
24f57e7c75b7e bitmap: Properly initialise destination bitmap for scatter & gather test
4520d4a1db371 firmware: arm_scmi: Unrequest devices if driver registration fails
826413b858ea2 firmware: arm_scmi: Roll back partial protocol table registration
f4ade8d224756 cpufreq/amd-pstate: handle missing policy in dynamic EPP callbacks
54d63431854b5 cpufreq/amd-pstate: Toggle auto_sel in active mode on shared memory systems
f15b9aa413078 cpufreq/amd-pstate: Fix EPP return type and handle errors during initialization
ba6ce23d17db3 cpufreq: amd-pstate-ut: Skip tests when amd-pstate driver is not active
2f923ccc88715 ARM: dts: allwinner: a10: Fix PMU interrupt
09c7565ebdf64 ext4: skip tail block zeroing for inline data files
83663c0b73948 ext4: check dir entry fits before reading the hash trailer in ext4_search_dir()
e1e342d9a561c ext4: fix buffer_head leak in ext4_init_orphan_info
518df61b9b0a5 RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap
9ddbc95dac167 wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx()
9e6ec0977f0b9 wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx()
919c31763d65d wifi: ath12k: fix survey indexing across bands
0fd2c54d8a56a wifi: ath11k: Correctly copy the hint BSSID in WMI scan request
84f87c46cec51 wifi: ath12k: Correctly copy the hint BSSID in WMI scan request
8d66010645bc9 wifi: ath12k: allocate HOST_DDR and BDF regions after Q6 RO region
39520ff5cdfdf wifi: ath12k: refactor QMI memory assignment
c78e6912404ba wifi: ath12k: switch to name-based reserved memory lookup
2f3635213ecf5 wifi: ath6kl: avoid buffer overreads in WMI event handlers
f2dd3a8580dfd wifi: ath12k: fix ML-STA authentication timeout on QCC2072
850211b0ba6ce wifi: ath12k: advertise ieee_link_id in vdev start MLO params
1f77d0c58b6ab wifi: ath12k: Set IEEE80211_OFFLOAD_ENCAP_4ADDR after tx_encap_type vdev param
2d3cb65c4846f wifi: ath12k: Advertise multicast Ethernet encapsulation offload support
b4c7285779337 ext4: validate readdir offset before accessing dirent
439aedfd7ae86 ext4: use fsdata to track inline data write state and fix race
9fd3ffc3c51c9 ext4: drain in-flight DIO before buffered write fallback
43ae387c3ae6a ext4: clear stale xarray tags on folios skipped during writeback
7720fddd1fe34 ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find()
169772cd2147c thermal: intel: int3400: clean up ODVP on probe failures
b801158f81fe7 iommu/arm-smmu-v3: Declare eats_s1chk and eats_trans as host-endian u64
64e29e5099069 iommu/qcom: Fix inverted fault report check in qcom_iommu_fault()
e3e12b851953b iommu/qcom: Remove sysfs device on probe failure path
99d42aef089a0 iommu/amd: Fix undefined behavior in devid_write debugfs function
21d35c5f46e99 firmware: arm_scmi: Fix requested device removal race
c06f2856a1d7e RDMA/core: Fix potential use after free in ib_dealloc_pd_user()
bfc119a40c04b RDMA/core: Fix potential use after free in uverbs_free_dmah()
43403fe45379c RDMA/core: Fix potential use after free in ib_free_cq()
64c72390d8407 RDMA/core: Fix potential use after free in counter_release()
95c992c869df5 RDMA/core: Fix potential use after free in ib_destroy_srq_user()
8a72a6aad84b3 RDMA/core: Fix potential use after free in ib_destroy_cq_user()
001383248e5d7 RDMA/core: Fix use after free in ib_query_qp()
56024193f6d73 RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations
638b9a5364c14 RDMA/mana_ib: drain QP references after partial table insertion
61a25b8d333e1 RDMA/erdma: Fix CEQ tasklet use-after-free on removal
3ec5f37e14bcb PCI: j721e: Fix incorrect max_lanes for J7200
425addfb52c46 RDMA/srpt: Pass the mapped task attribute to target_init_cmd()
641f814965d73 bpf: Mark bpf_refcount field as unique
373a1e9366e71 bpf: Preserve unique-field state across nested structs
92356df4aa2b0 bpf: Fix offset warn check for bpf_res_spin_lock
a21001465264d virt: arm-cca-guest: use migrate_disable() for attestation token requests
2373496c0dac3 ACPI: battery: Adjust charging status validation check
08fe2eaa60918 bpf, riscv: Fix extable handling for arena load_acquire
a6e11a81da342 riscv, bpf: Fix kernel stack corruption in tailcall with CFI
2a3a29e900218 riscv, bpf: Fix memory leak in bpf_jit_free
4c39115eb6e30 libbpf: Search /lib64 and /lib in resolve_full_path()
0e94a2ca7905b selftests/bpf: Fix lsm_bdev dev_t encoding mismatch
912189169df3f selftests/bpf: Fix make install target
e2396b8a56207 bpf: Zero queue and stack outputs on lock failure
27a3be4e965bf platform/x86: acer-wmi: reject missing gaming WMI results
2fb8ff81659a5 ext4: skip extra isize expansion during mount to prevent deadlock
36bf17bb90cdf ext4: fix out-of-bounds read in ext4_read_inline_dir()
32f7ab52875ec ext4: fix circular lock dependency in ext4_ext_migrate
6e11ac626f9f9 ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root
355bee5f11acb ACPI: processor: validate MADT IOAPIC entry bounds
2267448f67874 ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer
c57e238b475e8 RDMA/nldev: validate dynamic counter attribute length
d324c4353f641 irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc()
bf18426dddbf3 samples: rust: debugfs: fix excessive stack use
5a9f8b7f11674 rust: device: make lifetime on `Core` and `CoreInternal` invariant
082435d51f286 selftests/bpf: Silence maybe-uninitialized compiler warning in libarena
555e689c46308 selftests/bpf: Silence array bounds warning in global_map_resize
0fb8a60765319 selftests/bpf: Check malloc result with ASSERT_NEQ in test_sha256
05e588ad77154 selftests/bpf: Check malloc result with ASSERT_NEQ in test_loader
af33d192af2fb x86/bugs: Don't use cpu-type matching in cpu_vuln_blacklist
b86e65df16da0 arm64: dts: imx8-ss-audio: Fix LPCG clock indices for ASRC0
cb6b14e24b992 kcsan: avoid unintended access checking in NMIs
bd02d644bd19a RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters
c5643ea4f040a RDMA/bnxt_re: Validate udata before executing commands
ee901a0f46515 RDMA/core: Add ib_no_udata_io() helper
5ec111ddc1f72 RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[]
ca99431820e8c RDMA/hfi1: Propagate sdma_txinit_ahg() errors
7e24fd5253fcf arm64: dts: amlogic: meson-axg-s400: enable mipi_pcie_analog_dphy for PCIe
a22abf6d48eeb arm64: dts: amlogic: meson-axg: Add missing nand_rb0 pin to nand_all_pins
0c52d48122a13 phy: starfive: Fix runtime PM cleanup in JH7110 DPHY RX probe
da666984ffda4 phy: starfive: Fix runtime PM cleanup in JH7110 DPHY TX probe
cdaa9cb77eb67 iio: dac: ad5686: missing NULL check on match data
5ed1b048527be ASoC: meson: Keep link pointers valid on realloc failure
2787034ea0163 dmaengine: dw-edma: Clear stale requests on termination
6fc436e1500c5 dmaengine: dw-edma: Serialize channel state checks
f71c94c1a6574 dmaengine: dw-edma: Serialize abort state updates
f3ec6702a1d21 dmaengine: dw-edma: Terminate all descriptors without callbacks
57cf929a33cb7 bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn
17da80d0c7b56 bpf: Disallow interpreter fallback for gotox insn
408b6d3bc19c4 bpf: Disallow interpreter fallback for arena-related insns
8a08635656037 bpf: Reject arena frees below the arena base
49882b4d5290d arm64: dts: qcom: glymur: Add CX power domain to GCC
9d7355c6040cf drm/msm/a6xx: Fix RBBM_CLOCK_CNTL3_TP0 value in a730_hwcg
50fb8b5857d5c driver core: soc: Unregister bus on early device registration failure
231bbc04c58f1 software node: Fix software_node_get_reference_args() with index -1
07fee585336ac drivers: base: Remove statistics group if encryption group not created
7244dd0f12629 drm/v3d: Associate BOs with every job that accesses them
89d4159768527 drm/v3d: Convert submit helpers to operate on struct v3d_submit
87bdadba51c57 drm/v3d: Make v3d_get_cpu_indirect_csd_params() a pure parser
d7c6dfcd286db drm/v3d: Introduce struct v3d_submit and convert CL/TFU/CSD ioctls
941522179e62f drm/v3d: Migrate BO reservation locking to DRM exec
cfb009ab26186 drm/v3d: Extract v3d_job_add_syncobjs() helper
a3e81f48c9e61 drm/v3d: Drop unused drm_encoder.h include from v3d_drv.h
02438d15b0f41 perf build: Fix compiler errors with old capstone
c91d07e966806 perf ui hists: Fix uninitialized stack memory free on pstack allocation failure
c645f6dd1af2e mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition()
37be7bc2c2d09 mtd: mtdswap: Avoid freeing registered blktrans device twice
529aeba63d448 mtd: intel-dg: Fix runtime PM error path in probe
b07d0469126c1 soc: ti: knav_qmss: Remove debugfs file on teardown
fda8fb7e81795 vfio/pci: clear vdev->msi_perm after freeing it on init failure
1d36a009c8ee1 vfio: selftests: Avoid VLAs
6fb4cd8ee68f6 char: xilinx_hwicap: unregister class on init errors
4a6518be31602 ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove
5c8927882b70b ppdev: prevent overflow when setting port timeout
1105f6e7b3922 cacheinfo: don't propagate DT/ACPI error when arch supplies info (arm64)
b044a6c443d55 misc: lan966x_pci: depopulate children on populate failure
ab2fe43041412 misc: ad525x_dpot: use driver core groups for sysfs files
3ac54631098a7 misc: rtsx: add missing write register handling
4984277bc43f8 misc: bcm-vk: Use acquire/release for msgq_inited
0b8177cca0c93 misc: pch_phub: Complete enum usage for device identification
c70f3be8be0d5 mei: lb: fix incorrect type in assignment
ca4489b3e5466 speakup: keyhelp: guard letter_offsets possible out-of-range indexing
d65abe969dcb7 accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status()
ec5bd6731183e uio: Fix stale info pointer in failed registration path
8bf5e01238c33 gpib: use 'static inline' instead of 'extern inline'
0a53e4bc076ee gpib: Move stuck SRQ update under lock
2750b16e85391 tlclk: if sscanf() fails, fall back to 0, not random value
c48e5aa015255 staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths
b21cb958292ee UDF symlink pathComponent header OOB read
56ad47bee6d37 tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64
977659adb341f usb: gadget: f_uac1_legacy: remove broken string configfs attributes
d0667c263362b ACPI: processor: idle: Expand _LPI package sanity checks
a88fae3508aa3 crypto: aspeed - Propagate platform_get_irq() errors
6ee726526f08a crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping
c5b52d79d6b2e wifi: rtw89: fw: use MAC source for IO offload delay command
a28a7d9b3bb11 scsi: ufs: core: Avoid possible memory reclaim deadlock in TX EQTR context
576312f027d15 bpf: Sync tail_call_reachable with callee state on entry
09b360eb6ce34 drm/msm: Only fini scheduler after successful init
d684f756d029d drm/msm: Fix task_struct reference leak in recover_worker
8fc6a356f498d drm/msm/a6xx: Fix IRQ storm during msm_recovery test
197912ffbb657 drm/msm/a6xx: Fix A621 GPUCC register list for state capture
9d52bfc956c77 drm/msm/a6xx: Fix A663 GPUCC register list for state capture
dc64cf9d71428 drm/msm: Recover HW before retire hung submit
51fcee9d4140b drm/msm/a6xx: Fix stale rpmh votes after suspend
105aaff286a15 drm/msm/adreno: fix use after free on error path in a6xx_gpu_init()
b00290d1dc23a gpu: host1x: Avoid stack over-read in debug output helpers
eb9f221498757 gpu: host1x: Fix offset calculation in trace_write_gather
a1c4229ebeb46 gpu: host1x: Avoid double device_add when clients already present
082b353c05b8e wifi: iwlwifi: mei: pass correct argument to function
bc7a7ad930708 wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments
f7f770d12e6e9 wifi: iwlwifi: mei: check SAP message length before reading it
2a77cb320e399 wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser
769e1910d41fd wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs
1d74ddb6da546 perf stat: Fix duplicate output with --for-each-cgroup
b3ce55b4a9da2 spi: geni-qcom: Fix sticky ret causing wrong return value on invalid proto
3296c42d1c3c1 drm/solomon: remove unneeded variables in blit functions
51a548f546519 soc: renesas: r8a78000: Drop duplicate "default ARCH_RENESAS"
fa8dc4d73314c clk: qcom: gcc-glymur: Enable runtime PM
64de7f5c2d5cd perf jevents: Add more components to the metric sorting order
789395e53ebf4 perf sched: Free subcommand string after perf sched stats
7a936fa41c55c perf sched: Fix memory leaks in perf sched stats report
cf3282cf46be6 perf sched: Add missing perf_session__delete()
c2d4db21ad2d5 arm64: dts: qcom: milos: Add reset for sdhc_2
c5d8ff2d2f055 arm64: dts: qcom: sm8250: correct frequencies in the Iris OPP table
9362c436aec0b arm64: dts: qcom: sm8250: sort out Iris power domains
6f73a043f8248 arm64: qcom: ipq5018: Add GEPHY RX and TX clocks
f9f86d8363a74 arm64: dts: qcom: ipq5018: Correct CMN PLL reference clock rate
1d857673a0769 arm64: dts: qcom: glymur-crd: merge duplicate &pmh0101_gpios node extensions
31901797093e0 arm64: dts: qcom: eliza: Enable first QUPv3 wrapper by default
be3f5db2d705b arm64: dts: qcom: sc8280xp-x13s: Fix the drive-strength of mclk pin
74689c170832f arm64: dts: qcom: msm8996-xiaomi-gemini: Fix up ti,drv2604 enable GPIO
fb97d1d6c2069 x86/mm/pat: Take cpa_lock around large-page collapse
9ff718df54737 drm/bridge: tc358767: clamp the reported AUX read size to the request
b375b66a47222 perf: evsel: Fix error handling in tp_format lookup
2907676ed67aa remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdev
688f621a8d9c4 remoteproc: qcom_q6v5_mss: Fix MDM9607 subsystem control instance ID
beab49fb74054 remoteproc: qcom_q6v5_mss: Make ssctl_id configurable per platform
73a9119d57e7a cpufreq: schedutil: Fix self-contradictory comment in sugov_iowait_apply()
b12839d2af893 cpufreq: intel_pstate: Fix setting minimum P-state at init time
ae56bcb41607d drm/amd/display: remove duplicate link_dp_panel_replay.h include
c71783a6ed19a drm/amd/display: fix wrong register field in dccg35_set_hdmistreamclk_src_new
7ccdcfbb8617c drm/amd/display: Remove unused-but-set variable hubp from
6970ec944567f drm/amd/display: Fix DM I2C teardown race
f0c4b7ca24d2e OPP: Fix cleanup ordering
7d102d1f06318 media: ipu6: Do not free aux device pdata after init
de9be39cefda1 media: bcm2835-unicam: Fix asc leaked in error/remove path
c4b00825780a4 media: platform: amd: fix unmet dependency for VIDEO_V4L2_SUBDEV_API
76511a617ae4b media: i2c: rdacm21: Fix missing media_entity_cleanup()
78cdd9438ad3b media: ti: vpe: Select V4L2_FWNODE for VIP
7c614f83301d4 irqchip/renesas-irqc: Fix generic interrupt chip leak on remove
f58abff399f72 PCI: keystone: Fix OF node reference leak in init
578ab48dc684c PCI: xgene: Drop unnecessary OF node reference
f9ed38e80443a cpufreq: spear: Fix an IS_ERR() vs NULL bug in spear1340_set_cpu_rate()
68682c9b7b8ca dax: fix holder_ops race in fs_put_dax()
eb412f80311fc dax: read holder_ops once in dax_holder_notify_failure()
c8c16c2de9114 dax/fsdev: fail probe on invalid pgmap offset
7b642bd3d3910 dax/fsdev: use __va(phys) for kaddr in direct_access
9b0f91dc9147a dax/fsdev: clear pgmap ops and owner on unbind
93c5509033e47 dax/fsdev: don't leave a dangling dev_dax->pgmap on probe failure
d298a0513aaf7 dax/fsdev: clear vmemmap_shift when binding static pgmap
58db9b927866b dax/fsdev: fix multi-range offset in memory_failure handler
154540d584ae1 dax: fix misleading comment about share/index union in dax_folio_reset_order()
6beaef33ee568 libnvdimm/labels: Bound the on-media label size before the shift
a8e3a0e8997de tools/sched_ext: scx_qmap: Fix stale API name in comment
92a4e01e2ef89 regulator: adp5055: Fix error code in adp5055_of_parse_cb()
ca95b15a0760e cxl/features: Clamp Get Feature output size to the remaining buffer
16b7c99eff030 cxl/features: Reject Set Features output buffer smaller than the header
329ea475581c6 cxl/features: Reject Get Feature count larger than the output buffer
4635953b4c1af firmware: arm_scmi: Fix transport device teardown lookup
c59b3393df134 firmware: arm_scmi: Fix SCMI device destroy lifetimes
3515aed7fe424 firmware: arm_scmi: Unwind P2A receiver mailbox setup failure
9958f55eace8b firmware: arm_scmi: Unwind TX receiver mailbox setup failure
45e54438f4fd8 firmware: arm_scmi: Fix OF node reference handling
3f4cf1edf7365 firmware: arm_scmi: Clear SystemPower flag on create failure
77d2985d1e80e firmware: arm_scmi: Drop handle on protocol bind failures
09d08581ead97 firmware: arm_scmi: Protect device request lookup with RCU
ad39c232ffac7 firmware: arm_scmi: Use channel ID for transport teardown
0b6e59eb885f9 firmware: arm_scmi: Reject out of range DT protocol IDs
bab26acebe55e firmware: arm_scmi: Avoid IDR updates while cleaning channels
fbaebd380caa4 firmware: arm_scmi: Free transport channel on IDR failure
43aad7687238d firmware: arm_scmi: Clean up channels on setup failure
5e30d3d16d1a9 firmware: arm_scmi: Quiesce notifications before teardown
74fcaa0a3f7ad firmware: arm_scmi: Unregister device notifier before IDR teardown
a1bc587568a4e firmware: arm_scmi: Publish channel state before callbacks
54be1b7c1eb80 x86/entry/fred: Encode frame pointer on entry
ccbd20f2168f5 wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate
3dfa1b8ccf7c3 wifi: ath12k: fix rx_mpdu_start layout for QCC2072
329b10ddc919b wifi: ath12k: fix MLO peer delete race
af405d216316d wifi: ath12k: fix dp_link_peer dangling references on AP vdev rollback
473ea7aa35615 hfsplus: validate thread record before delete key rebuild
8e0c487b0b1b5 cxl/port: Restart port enumeration when a sibling adds the dport first
7682b617db1f1 cxl/features: Serialize multi-part Get/Set Feature transfers
ada7aa90eb65d cxl/pci: Honor -EPROBE_DEFER from component register setup
e77594e0cea67 cxl/mbox: Break poison list loop on an empty payload
5354222bef789 cxl/memdev: Fix firmware upload exact-fit handling
dc0a119613617 cxl/test: Rework cxl_type2_mem_init() to use cxl_mock_platform_device_add()
455e817515ffc iommufd: Simplify iommufd_device_remove_vdev()
795113f9da49f arm64: dts: renesas: r9a09g047: Fix PCIe dma-ranges memory space code
531ff98bcec50 arm64: dts: renesas: r9a09g056: Fix PCIe dma-ranges memory space code
92425d1fdebc4 arm64: dts: renesas: rzt2h-n2h-evk: Remove unused MII/GMII pins
e559626bee8a6 rpmsg: glink: fix deadlock in endpoint destroy during driver detach
b86dbfe4583bf fs/resctrl: Fix UAF from worker threads when domains are removed
6bd8bfb85257b perf record: Fix multiple PERF_RECORD_COMPRESSED2 records per push
9f06abd2f64f5 perf record: Return the written size from process_comp_header()
4c593c62c1499 fs/resctrl: Prevent use-after-free in rdtgroup_kn_put()
5116fef23016e tools/sched_ext: scx_flatcg: Fix uninitialized stats on allocation failure
9fb74dce5c650 media: v4l2-async: Unregister sub-device if asc_list is empty
fb66f61a8e752 rust: drm: gpuvm: require Send + Sync for the driver's associated data
59c557d2474c3 iommufd/selftest: Avoid selftest dirty bitmap size wrap
9c6eace8d07e9 isofs: fix out-of-bounds page array access on empty zisofs block
4e0af1264a0ff ASoC: apple: mca: increase SERDES reset delay
6247fbddbcdf1 RDMA/hfi1: Initialize debugfs after probe completes
364be5873f2ab RDMA/hfi1: Stop flushing the global IB workqueue
83fe4e4f4fbf0 RDMA/hfi1: Free RX data on late probe failure
4204f5c0312ba RDMA/hfi1: Preserve unit 0 on allocation failure
b1e1b25723af4 RDMA/rvt: Return NULL after port allocation failure
0d85891822df0 misc: rtsx_usb: avoid USB I/O in runtime autosuspend
901951d0ed7a7 pmdomain: bcm: bcm2835: handle genpd provider registration errors
6514c99d2c7d5 ALSA: hpi: Check transport errors during HPI6000 adapter initialization
26b6b14c7a036 esp: do not unref managed frag pages in esp_ssg_unref()
5f35a29a5eed3 xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full
ed566979f99c5 crash_dump: release keyring reference at the correct time
30e78390af056 hwrng: ks-sa - Fix runtime PM cleanup on registration failure
e6d3c7eae75a4 crypto: ccp - Fix memory leak in SEV INIT_EX path
364f3841bc22c crypto: ccp - Fix possible deadlock in SEV init failure path
5de981b7db1f5 Revert "drm/msm: dsi: fix PLL init in bonded mode"
96379c2dec725 drm/msm/dp: add missing drm_edid_connector_update() before add_modes on cached EDID
0d37e2503efd1 RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state
24ce944721dcd RDMA/ipoib: Drain RCU callbacks during module teardown
4664368b9bd9d RDMA/mlx5: Drain RCU callbacks during module teardown
48b72fa0d209a RDMA/core: Wait for RCU callbacks before unloading ib_core
ea4a4237b161a iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE
13a472452dcd5 wifi: rtw89: 8852a: fix RSSI report when average beacon RSSI is not ready
280145253fd38 bpf: Mark tracing_multi trampolines as ftrace managed
b7e2a5c6519ad bpf: Require a BPF cpumask for bpf_cpumask_populate()
b425cc3913fb1 clk: qcom: camcc-sc8280xp: unregister CAMCC_GDSC_CLK
b7cd0d057e4fc bus: qcom-ebi2: use managed resources for clocks and children
f98700ea19755 soc: qcom: rpmh-rsc: manage PM notifiers with devres
a819fd4479c7f perf metricgroup: Fix metric expression copy leaks
ad44537175f7e clk: spacemit: k3: fix parent clock of UFS aclk
c4e364ecb8098 perf record: Fix teardown hang on system-wide multi-threaded sessions
c30c5ae811eea drm/panel: samsung-s6d16d0: Power off on prepare failure
a0ac59897309e usb: chipidea: imx: fix missing ret assignment for dev_err_probe
616dfbd3a0b48 usb: typec: ucsi: gaokun: unwind notifier on UCSI register failure
9ada6c7692c0c usb: renesas_usbhs: Fix power-off ordering on unbind
7a5b2e8ec85ac usb: mtu3: allow system suspend during active gadget connection
428a82d987fcd platform/surface: acpi-notify: Check ACPI companion before use
d25dd08268aea platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL
3308b8c5f5a28 platform/x86: asus-wmi: fix resource leaks on probe failure
e6a9c6b79b700 usb: fix UAF when probe runs concurrent to dyn ID removal
9e6f57107c188 usb: gadget: aspeed_udc: check endpoint DMA allocation
9c4bc8f7426aa usb: ljca: bound bank_num in ljca_enumerate_gpio()
969bf1c64b840 usb: typec: tcpm: fix EPR AVS APDO maximum voltage decoding
36315a330e067 usb: gadget: configfs: fix out-of-bounds read of qw_sign
58952c83dfe6e usb: gadget: f_fs: Fix fence cleanup in ffs_dmabuf_transfer() error paths
3819c6f255a37 usb: gadget: uac: validate rate list length before storing
59faa59c25a0a serial: qcom-geni: do not advance stale DMA completions
494bb296407fe serial: ma35d1: Fix OF node reference leaks in console init
606f769df00d8 serial: 8250: Clear CON_PRINTBUFFER on port re-registration
08182086dca4e media: platform: amd: use refcount_t instead of atomic_t
55bb98850f392 spi: qcom-geni: Fix missing error check on pm_runtime_get_sync()
7bfa711f311a5 platform/x86: asus-wireless: Fail probe when there is no ACPI match
73e2e363a9661 perf capstone: Fix kernel map reference count leak
01f6c6ff9ebfb selftests/sched_ext: Fix bpf_link leak on early return in prog_run
891aee54b39d2 hwspinlock: propagate errno when registering single lock
56a3846830ac9 bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max
bce6b48af3abf remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3
5aed51501447e remoteproc: qcom_q6v5_adsp: Fix reference leak for device node
f3614622dc41f bpf: Drop scalar id on sign-extending narrowing stack fills
acc1903222505 platform/x86: lg-laptop: Fix LED resource handling
392c19faec6bf platform/x86: dell-wmi-base: Fix handling of ultra performance key
f59cd5007055c platform/x86: dell-wmi-base: Fix resource leak on module load failure
ef59ff891adf9 platform/x86: dell-privacy: Fix race condition
3fd86a5d6facb ACPI: RISC-V: Fix riscv_acpi_add_prt_dep() loop handling
088c1c8592134 ACPI: RISC-V: Check acpi_get_handle() status in riscv_acpi_add_prt_dep()
b0f9c3418735b ACPI: RISC-V: Fix riscv_acpi_irq_get_dep() loop termination
8f194dee0c0d1 printk: Fix possible console use-after-free
a09efb1e256f0 leds: st1202: Validate LED reg property against channel count
f1a049284bcb7 leds: st1202: Disable channel when brightness is set to zero
6d711caa9f240 leds: st1202: Fix brightness having no effect while pattern mode is active
14bb601435c02 leds: st1202: Set all pattern PWM slots to full after clearing pattern
037359b67bb9c leds: st1202: Fix spurious pattern sequence start in setup
2e3900c92db27 leds: st1202: Fix pattern duration prescaler and pattern_clear skip marker
523902fc6f2e0 leds: st1202: Stop pattern sequence before reprogramming
e9d1f11c70498 leds: pca9532: Fix inverted GPIO output polarity
2c1795907ac5a arm64: dts: mediatek: tungsten-smarc: Remove unnecessary cells
585a58a6568d2 iommu/amd: Fix false positive in SB IOAPIC IVRS validation
5af7fdb7659b0 iommu/amd: Prevent SB IOAPIC from overriding IVRS validation errors
697c84154983e iommu/msm: Return -ENOMEM on memory allocation failure in probe
35ebd93daaec0 bpf: Fix security_bpf_map_create error handling
90f661bcfaf3a iommu/mediatek-v1: Fix off-by-one in MT2701_LARB_NR_MAX
21c6445366795 bpf: Reject programs with inlined helpers if JIT is not available
8467d5a2fb87e bpf: Introduce jit_required flag and remove bpf_prog_has_kfunc_call()
8f3f64faee335 bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation
2b2a903bee56d bpf: Fix use-after-free on mm_struct in bpf_find_vma()
cab81e3ad9485 efi: fix stale reference to efi_recover_from_page_fault()
86d11c594d60b bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux
8e29690f91286 perf dso: Fix kallsyms DSO detection with fallback logic
20740a2115723 perf vendor events amd: Reintroduce deprecated Zen 5 core events
7ff668cfc3960 drm/amdgpu/mes: Fix hung_queue_db_array loop limit for multi-XCC
272c97f9286d5 bpftool: Check EVP_Digest when computing excl_prog_hash
c4058355d2748 udf: Mark LVID buffer as uptodate before marking it dirty
6be64cca6527f usb: gadget: r8a66597: avoid double free of ep0_req in probe error path
62efee3515663 usb: typec: ucsi: unregister debugfs entries on teardown
d67607e774952 thermal/drivers/rcar: Fix error checking in probe()
437d6d15936db staging: media: ipu7: fix pm_runtime refcount leak in ipu7_resume()
acd23fc1af6f7 staging: media: ipu7: fix pm_runtime refcount leak in ipu7_init_fw_code_region_by_sys()
19d5566b84ca1 bpf: Reject writes through untrusted BTF pointers
1238e1c7e5d3d perf data convert json: Fix trace_seq memory leak in process_sample_event()
6993d1fdb9de2 perf record: fix poll storm when monitored threads exit
f7a1cf9f679da clk: qcom: gcc-qcs8300: Use retention for USB power domains
8dcdeb8e2337c clk: qcom: gcc-qcs8300: Use retention for PCIe power domains
6ccc420af8188 arm64: dts: qcom: sc8180x-lenovo-flex-5g: Describe the display power net
1d6f9c6e84523 arm64: dts: qcom: sc8180x-lenovo-flex-5g: Rename regulator nodes
c7e72d6d5126e arm64: dts: qcom: sc8180x-primus: Describe the display power net
c64326ede83c2 arm64: dts: qcom: sc8180x-primus: Rename regulator nodes
9ff0ec945a73f arm64: dts: qcom: sdm670-google: add lpi reserved gpios
488c42ff7f42f arm64: dts: qcom: sm6125-xiaomi-laurel-sprout: Fixup panel compatible
07bb368ae12b8 arm64: dts: qcom: sc8280xp-arcata: Fix top USB-C DP alt mode
40bd77fa2857c clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister()
fade2037ee2aa clk: qcom: gdsc: propagate gdsc_enable() failure for ALWAYS_ON domains
02533b6cf5f69 clk: qcom: gdsc: propagate gdsc_check_status() errors from gdsc_poll_status
609ebd03deee4 arm64: dts: qcom: Add #{address,size}-cells to Chromium-based /firmware
ac2f3219b3303 timekeeping: Account for monotonicity adjustment in ntp_error
ad25b583d5919 y2038: uapi: Use 64-bit __kernel_old_timespec::tv_nsec on x32
1f0c3c0c36c7a time/namespace: Validate nanosecond field in proc_timens_set_offset()
a36bf15ab84c5 timers/migration: Fix memory leak in tmigr_setup_groups() error path
7099de4de14af timekeeping: Unwind aux clock sysfs children on failure
2a4ffc16d3a78 clocksource: Unregister subsystem on device registration failure
d739c63bfa385 selftests: timers: leap-a-day: Fix -w option and update usage comment
dd32537936976 irqchip/gic-v3-its: Fix its node leak in gic_acpi_parse_madt_its()
de5d0190c97fe irqchip/gic-v3-its: Fix memleak in its_probe_one()
10f639168da59 selftests/lsm: Fix memory leak in attr_lsm_count
ab0c755ad5e7a selftests/bpf: Fix memory leak in msg_alloc_iov
88500a86ab79f s390/bpf: Replace ly instruction with llgf
e626a50d07d43 bpf: Reject MEM_ALLOC BTF accesses past object bounds
5280e0d3d6a5c selftests/bpf: Fix memory leak in msg_alloc_iov error path
0916005195488 selftests/bpf: libarena: Clean up allocation state before buddy tests
c812c2ff5507d ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer()
08d6d9800e2e1 kbuild: unset sub_make_done before calling kselftest build system
911190f0b9511 staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()
b2243ffaac14c staging: octeon: add missing napi_disable in cvm_oct_rx_shutdown
41a79bd9e5a74 staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown
b7fa32159dc51 staging: fbtft: Use sysfs_emit_at() to print to sysfs file
cfcc5a41a9664 greybus: audio: bound the topology section sizes against the fetched size
d13a82297796b staging: sm750fb: Add missing Kconfig dependency
dd5767bd42401 staging: sm750fb: gate dualview dataflow using g_dualview
fbf9e0f2d5369 staging: greybus: audio: correct sscanf() return value check
1c2a4ab6efa26 wifi: mac80211_hwsim: avoid NULL skb in stop queue drain
b2adb0e2f313e PCI: qcom: Skip PERST# GPIOs provided by downstream PCIe devices
c6eca03162e1c bus: qcom-ebi2: Fix clock leak on probe failure
f28e119378322 arm64: dts: qcom: sc8280xp: sort reserved memory regions
7a9ab46f1e2eb clk: qcom: gcc-glymur: Move EVA clocks to critical clock list
784d168036a4b arm64: dts: glymur-crd: Add reset GPIO to touchscreen node
368b8e4299650 arm64: dts: qcom: glymur-crd: Move common board nodes to shared DTSI
45f5512f13113 arm64: dts: qcom: glymur-crd: Add Embedded controller node
6f1ed14f6c5e1 arm64: dts: qcom: glymur: Fix gcc clock specifier for usb_mp_qmpphy nodes
144094da5b917 arm64: dts: qcom: glymur: Fix unit-address mismatch for spmi_bus2
da9ddc8ba43ca arm64: dts: qcom: hamoa: Fix clocks for HSPHYs
19c802bcaf764 arm64: dts: qcom: sm6125: Use 64 bit addressing
f78fcc42099fe arm64: dts: qcom: sm7225-fairphone-fp4: Fix address in fb node name
e7483891df45e arm64: dts: qcom: sc8280xp-blackrock: switch to uefi rtc offset
4b6f2aebaa922 arm64: dts: qcom: monaco: fix wrong connection for the replicator
bee77cd34ce83 clk: qcom: gxclkctl: Use custom disable callback for gx_gdsc
dee085f96cb91 clk: qcom: gdsc: Add custom disable callback for GX GDSC
78d9daf5e13ad cgroup/cpuset: Make nr_deadline_tasks an atomic_t
195d7cca6433e PM: sleep: Fix off-by-one in wakelocks number limit check
46b5a0f22bfd4 bus: ti-sysc: Fix /chosen node reference leak
d553a9dc1c456 nvmet-rdma: fix response resource leak on queue teardown
e24951cab8aa6 nvmet-rdma: factor out response resource cleanup
840ab22ffa4d8 nvme-apple: Use acquire/release for queue enabled state
0550a269c04b8 fuse: move "epoch" from dentry.d_time to fuse_dentry.epoch
02d4ee65dc2e8 RDMA/bng_re: return a timeout when firmware responses stall
ec790449ad225 arm64: dts: qcom: talos: Fix GMU unit address
59d485a6289cb arm64: dts: qcom: sm8750: wire UFS to ice instance
a6c0e693a7c88 RDMA/irdma: Add refcounting to user ring MRs
ff994bedc6690 RDMA/irdma: Add irdma_cq fields to track pbl allocations
e4df2e98e4393 RDMA/irdma: Add a refcount to track user ring MR associations
dc043b8d976df RDMA/irdma: Deduplicate the irdma_del_memlist logic
a3217fe799862 crypto: keembay - Fix AEAD unregister count in error path
0a261177ad324 crypto: rk3288 - fail ahash requests on HASH idle timeout
9486a6bcc90de hwrng: omap - Fix probe error path cleanup
bdc3b37a935f2 hwrng: xilinx-trng - propagate timeout before any data is read
b68b35ed97d3e crypto: sa2ul - stop probe if context pool creation fails
94abda77b57a3 crypto: atmel-sha204a - fix heap info leak on I2C transfer failure
add28e9988902 crypto: atmel-ecc - reject hardware ECDH without a public key
92e4979e1a770 crypto: qat - clear AES key schedule from stack
1a106c6e17525 crypto: qat - cancel work on re-enable SR-IOV timeout
bee8d1fcdc8f3 hwrng: core - fix rng list on registration error
15732636ac123 perf vendor events amd: Update Zen 6 core events
e9d249a231845 perf vendor events amd: Update Zen 5 core events
6959e254f522c perf test amd ibs: avoid using executable heap
1b3d6fef10e69 perf/x86/amd/uncore: Add group validation
945e335da3402 libbpf: Detect uprobe syscall with new error
7273ac5e72408 libbpf: Change has_nop_combo to work on top of nop10
16776fb9c55de perf cs-etm: Filter synthesized branch samples
54080d72abb3c perf cs-etm: Fix thread leaks on trace queue init failure
56e2ff5c9be15 tools/nolibc: mark arg1 operand in __nolibc_syscall0() as write-only
08af0f96120a2 fanotify: initialize permission event watchdog state
1b3fecd099100 uprobes/x86: Move optimized uprobe from nop5 to nop10
310a504467a18 uprobes/x86: Allow to copy uprobe trampolines on fork
88a3464c421f1 uprobes/x86: Do not leak trampoline vma mapping on optimization failure
1ca1ca70e90a9 uprobes/x86: Remove struct uprobe_trampoline object
f132fc01b359a wifi: rtw89: fix HE extended capability length check
942becee7e788 wifi: rtw89: check return values in rtw89_ops_start_ap()
80ea28c94cf18 wifi: rtw89: fw: fix link ID filling for LPS MLO common info
6268f46d83875 platform/chrome: sensorhub: Fix memory overread in ring handler
582b5e5362455 wifi: rtw89: fw: correct preload field of w2 in rtw89_fw_h2c_default_cmac_tbl_be()
876b110114da3 wifi: rtw89: debug: fix off by on in rtw89_ppdu_str()
e984c63bd3359 selftests/rseq: Replace glibc-specific __GNUC_PREREQ with portable check
343aa5275484d csky: Fix a4/a5 restoration in syscall trace path
feb0901bbcaf9 iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure
c1900758c3a8b soundwire: qcom: Fix port exhaustion check in stream_alloc_ports
8b5654d317277 dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout
54c9b3315adac dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe
aec7cf9a5bd89 dmaengine: zynqmp_dma: fix race between runtime PM and device removal
c3e943490ced0 dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers
8896852b6fcd3 dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure
7d83720d0741d leds: lp5860-spi: Fix an error handling path
989f3d01fc196 leds: lp5860: Fix a potential double-unlock
1017fe1c7f48e mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug
915c2d9d69fc6 bpf,lsm: Drop bpf_prog_free from sleepable_lsm_hooks
1d39861b9c41a selftests/bpf: Mask socket type flags in mptcpify prog
ff3f22ed8d2f3 bpf: Copy per-CPU map value padding in copy_map_value_long()
03b44839ce81d tools/bpf/bpftool: Reset vmlinux BTF after struct_ops commands
f6fd865651ccf tools/bpf/bpftool: Reset vmlinux BTF after map commands
8d52adf7c923b bpftool: Strip all -Wformat* flags from bootstrap libbpf build
32bd68edbc6cb drm/amd/display: Fix dangling pointer in CRTC reset function
80c0f51aced43 drm/amd/display: Fix dangling pointer in plane reset function
4bd683d1a7d33 ASoC: ti: j721e-evm: Avoid mixing goto with guard()
daaac025b1588 ASoC: samsung: i2s: Avoid mixing goto with guard()
06aef6dcc1d52 drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup
1664327ce797e drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup
83c680de6d41d drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read
fceac25487b21 regulator: tps6594: Fix device node reference leaks in multiphase loop
f88c65473f525 PCI: imx6: Fix building against PCI_PWRCTRL_GENERIC
6d0343961cebe PCI: imx6: Fix building against PCI_HOST_COMMON
385f7a0f62b2e perf tests: Fix flakiness in branch stack sampling tests
8c0a67e54ec32 perf tests: Fix flakiness in BPF counters test on hybrid systems
16d72de0201e8 perf tests: Fix flakiness in trace record and replay test
cf79e50a1d30d perf tests: Add robust record retry helper and use subsecond workloads
a69133af55da2 perf tests: Fix Python JIT dump profiling test failure
5aa6eb9129c46 perf tests: Skip metrics validation if system-wide recording lacks permission
63aa9756ce0b6 perf test: Truncate test description to fit terminal width
b0f59d0a779eb perf parse-events: Restrict core PMU bypass to --cputype option
2097ae16533d3 perf evlist: Add reference count checking
fa437210fcbd6 perf evsel: Add reference count
744f25f0cbab4 perf evlist: Add reference count
a1a3ba14f4430 perf util: Sort includes and add missed explicit dependencies
5678f866a499c perf pmu: Recognize default_core as a core PMU in more places
e482f9ee97762 wifi: ath12k: correct monitor destination ring size
de3e556137804 wifi: ath12k: fix TLV32 length mask
82396ecb8f518 media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define
4661b90eb66fb media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define
b7f54ac6a1313 cxl/test: Propagate -ENOMEM on platform_device_alloc() failures
348a95be32389 cxl/test: Add hierarchy enumeration support for type2 device
3e0285b77f515 cxl/test: Refactor platform device enumerations
3f6fba439a2d3 cxl/test: Add test for module parameters
66aa3763cf3fe perf test: Skip failing 'perf test aslr' test case
15a6207d39b16 workqueue: only show running workers in stall diagnostics
0d98c5669d01c riscv: kexec_file: Fix crashk_low_res not exclude bug
23d41b2e68765 drm/panthor: Fix NPD issue on partial unmap of an evicted BO
f01cb11729447 drm/panthor: Support sparse mappings
e215d705f5a07 drm/panthor: Pass vm_bind_op to vm_prepare_map_op_ctx
727f043d699ab pinctrl: bcm2835: Don't remove an unregistered GPIO chip
76777e5d5139f perf/x86/intel: Keep cap_user_rdpmc in sync with RDPMC user-disable state
1a6a214f732d9 pinctrl: imx1: fix device_node leak in dt_is_flat_functions()
64aa1bb4017d5 perf/x86/intel/uncore: Fix uncore_box ref/unref ordering
9c8967bcbb77e perf/x86/intel/uncore: Introduce PMU flags and broken state
23fcbd6df3fd3 perf/x86/intel/uncore: Factor out box setup code
18f4d93162155 perf/x86/intel/uncore: Let init_box() callback report failures
c27d15aac37a6 perf/x86/intel/uncore: Fix refcnt and other cleanups
5026e40cf9268 perf/x86/intel/uncore: Fix PCI PMU cleanup on setup failure
a48296454b486 perf/x86/intel/uncore: Keep PCI PMUs working when MMIO/MSR setup fails
f94e62d21faad sched/fair: Fix overflow in update_tg_cfs_runnable()
089e307fda2ea sched/core: Fix inter-class wakeup_preempt()
d452a11898eb2 mm/mm_init: fix incorrect node_spanned_pages
e0773ad25a34a drm/lima: call drm_mm_init() with a valid allocation range
666700062f1ce clk: imx: scu: drop redundant init.ops variable assignment
99a07a8976704 arm64: dts: imx8mp-ab2: Enable MU2 for DSP communication
11047c7ed5cc3 arm64: dts: freescale: imx95-toradex-smarc: add alias for lpuart5
4e29df25bbe67 arm64: dts: imx93-kontron: set memory node to 0x80000000/1GiB
db414a1cb1d46 firmware: imx: sm-misc: Add NULL check for kmalloc in syslog_show
bea093a6e388b ARM: OMAP2+: Fix OF node reference leaks in omap_hwmod
67c9db97fa087 ARM: imx: fix device_node refcount leaks in imx7_src_init()
6b60c84e78469 ARM: imx: fix device_node refcount leak in imx_src_init()
48852aed10700 clk: hisilicon: reset: Use devm_kzalloc to initialize hisi_reset_controller
eebc053abef68 arm64: dts: imx8mp-frdm: Add missing HDMI DDC pinctrl
22c944e440bc9 ASoC: fsl_audmix: rework runtime PM handling in probe
a47f087877bb2 ASoC: rt700-sdw: always drain jack work on remove
3d9f555852975 clk: stm32: add missing bitfield.h header
a0a546a9625d3 clk: nuvoton: ma35d1: fix ma35d1_clk_pll_determine_rate logic
ff955d3d1c45e clk: nuvoton: ma35d1: fix PLL_CTL1_FRAC bit field width and fractional calc
0a6901e715bae clk: nuvoton: ma35d1: fix ignored div_u64 return values in PLL freq calculation
36d5c243d2db6 clk: moxart: remove unused variables, fix refcount leak
69815429f8bc7 clk: eswin: Add CLK_IGNORE_UNUSED to NoC clock
c37fa5d8b2a69 clk: canaan: Clear rate fields before reprogramming dividers
7b38ddc1c1fb0 clk: versaclock7: Fix APLL clock leak on probe failure
9c2b1efef2537 ARM: imx: avic: Fix OF node reference leaks
f0c12add5439d cxl/pci: Remove incorrect mbox.valid check in cxl_pci_type3_init_mailbox()
723808b2c117c arm64: dts: imx943: Correct PCIe outbound address space configuration
0c6897bdadffb arm64: dts: imx94: Correct PCIe outbound address space configuration
b4e11c731d6be cxl/mbox: Clamp mailbox output allocation to the payload size
4992cdc4eb979 ASoC: SOF: ipc4-topology: Return error for invalid number of formats
a81768b43b592 mtd: rawnand: pl353: Fix debug prints
6559174fcb151 media: cec-pin: Fix event FIFO ordering
394dec22a5d59 soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap()
99330b12376c3 HID: roccat: bound device-supplied profile index
12c889727ddc0 HID: nintendo: Fix imu_timestamp_us double increment per report
0fecd89f979a8 HID: core: quiesce input in hid_hw_stop() to prevent use-after-free
b1af4cccae717 selftests: proc: include fcntl.h in proc-pidns
54d6b0ee9b8ba platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count
aeb3e0083a07d x86/cfi: Use symmetric SYM_START and SYM_END in __CFI_TYPE()
6a052a154106e drm/bridge: of-display-mode-bridge: Fix missing static const for the bridge funcs
26cb44b0afff9 sched_ext/scx_flatcg: Fix cvtime_delta race and add hweight scaling to bypass charging
c776670f4ec9d cgroup/cpuset: Avoid unnecessary cpus & mems update in cpuset_hotplug_update_tasks()
f2df709905ab6 smack: restrict smackfs/{direct,mapped} values to 0-255
4d27a82210103 smack: deduplicate smackfs/{direct,mapped} file_operations
c62a818897189 smack: simplify write handlers of sysfs entries
d02c55e3ea82e smack: fix incorrect task context in smack_msg_queue_msgrcv
66f8255d1dd0f drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure
4a2355385486c drm/bridge: cdns-dsi: Return an error pointer on allocation failure
b49e7a24cf5bd rust: drm: gpuvm: update DriverGpuVm for DeviceContext
c69e63065f35b drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format
a53cc0561dd18 drm/rockchip: vop2: Add RK3576 to the RG swap special case
0d33645973227 drm/display: hdmi-state-helper: Try subsampling in mode_valid
0b9878aba5cf9 drm/v3d: Clear queue->active_job when v3d_fence_create() fails
3b259831b7388 gpu: nova-core: gsp: tu102: keep unloading if FWSEC-SB fails
23c02299e7d13 drm/bridge: display-connector: trigger initial HPD event for DP
a1303a44165dd drm/bridge: display-connector: don't autoenable HPD IRQ
887315e5d2eb8 drm/rockchip: analogix_dp: Fix OF node reference leak via auto cleanup
4cd23a6e5c9d6 drm/rockchip: analogix_dp: Enable hclk for RK3588
69173c1ebedec drm/rockchip: vop2: Wait for layer cfg done before switching LAYERSEL_REGDONE_SEL
e83dbc07404a0 drm/rockchip: vop2: Fix wrong wait target in layer cfg done check
11f07929f454e drm/rockchip: dw_dp: Release core resources
b66710d95db2f drm/rockchip: dw_dp: Add missing newline in dev_err_probe() message
48aaa495e24ce drm/bridge: synopsys: dw-dp: Support unregistering the AUX channel
317dc1ead82e2 drm: lcdif: Wait for vblank before disabling DMA
ef28f1970de4b drm/tegra: dsi: Re-add clear enable register if DSI was powered by bootloader
873fab4fa057b drm/atomic: Drop drm_private_obj.state assignment from create_state
20a30536d60e3 drm: Remove unused header in drm_dumb_buffers.c
b34b41c5bda73 Smack: Fix error in capability bypass
dfc4ee8954d3e KVM: x86: Check EFER validity on KVM_SET_SREGS*
8fb2065261ec6 KVM: x86: Move the bulk of register specific code from x86.c to regs.c
562f2b0c8824a KVM: x86: Rename __{g,s}et_sregs2() => kvm_vcpu_ioctl_x86_{g,s}et_sregs2()
515dead3bb640 KVM: x86: Move get_segment_base() to regs.h, as kvm_get_segment_base()
e92b03627ad89 KVM: x86: Extract REGS and SREGS runtime sync code to helpers
34c1d674cef84 clk: qcom: Fix test_ctl_hi field for DEFAULT_EVO PLLs
6a78b7697a88e mm/mremap: reset unfaulted VMA page offset for MREMAP_DONTUNMAP
b1e740b915662 nvdimm: virtio_pmem: refcount requests for token lifetime
c4a140f0a30f2 nvdimm: virtio_pmem: use READ_ONCE()/WRITE_ONCE() for wait flags
fc25f9a9db8ee nvdimm: virtio_pmem: always wake -ENOSPC waiters
c9cd77db17a98 nvdimm: virtio_pmem: stop allocating child flush bio
72561ca1ab96f nvdimm: pmem: keep PREFLUSH before data writes
e9414030257b4 nvdimm: preserve flush callback -ENOMEM
007bc1842317b memcg: move LRU size accounting on reparenting instead of copying it
4e30fbd26e84e ksmbd: fix tree connection use-after-free in smb2_tree_connect()
a6c88e5e3a75f smb/server: fix tree connection leak in smb2_tree_connect()
35d5c59fe6b1d ksmbd: fix maximum allowed access checks
7fa251df1110e btrfs: abort transaction before releasing tree_log_mutex on commit failure
9cf8c4c60020b tracing/probes: Fix BTF kflag check for anonymous struct member access
b8f5e4ab11e09 tracing/probes: ignore id update from btf_type_skip_modifiers
15f78eea8c4be staging: sm750fb: fix mono image source stride mismatch in lynxfb_ops_imageblit()
daed571f85fe3 udf: Fix data loss when converting inline inodes to out of line
d347c971aaddc udf: Move udf_map_block() up
4822a030929e0 dm-pcache: validate the persisted dirty_tail chain at load
150e71808d371 i3c: master: Do not treat master device as a duplicate target
50034d8d0f797 i3c: master: Fix use-after-free of master->this
b4bf8af5e7d7d dm-pcache: validate seg_id fields from persistent memory
9dc73c51ed3ee i3c: master: Fix recursive locking during device registration
6ecf17bf5fe8d i3c: master: Fix device_register() error path
96b066831f6e0 mm/damon/core: skip aging from repeated aggressive merging
e54602d9e38db batman-adv: bla: avoid CRC corruption due to parallel claim add
f68038c77a2f3 batman-adv: dat: atomically update mac addresses
fe3772ea9d269 drm/amd/display: Scale custom brightness curve from full range
a300e35c0a4b4 Linux 7.2.5
be15b8da4a82c ksmbd: zero pipe read compound padding
ecdcceed4d377 PCI: Allow per function PCI slots to fix slot reset on s390
8418a7201bb3f PCI: Introduce PCI_SLOT_PLACEHOLDER constant for slot_nr placeholder value
fb27cd32dd781 mm/damon/vaddr: drop last same folio access check optimization
e3db5d6bb0349 mm/damon/paddr: drop last same folio access check reuse optimization
91b75a9e79e98 mm/damon/ops-common: use nr_accesses moving sum for quota score
8a96a06e04d21 mm/damon/core: avoid infinite kdamond_merge_regions() internal loop
013731074ab6a power: supply: ab8500_fg: fix use-after-free on remove
7a184e6f211c8 power: supply: ab8500_fg: Remove redundant dev_err()/dev_err_probe()
57dba479a3e1f remoteproc: qcom: pas: Guard dtb metadata release with dtb_pas_id check
ea0408273ccf5 rpcrdma: arm rn_done before publishing the notification
c4efdc1d4cb3e bpf: Disable preemption in bpf_get_stackid
f1e97925827c5 bpf: Use stack id functions instead of __bpf_get_stackid
b3024de68b817 bpf: Factor stackid_new_bucket from __bpf_get_stackid
370069c1f627c bpf: Factor stackid_fastpath function from __bpf_get_stackid
b8cf96ff8c113 bpf: Factor stackid_init function from __bpf_get_stackid
8cc98db4fc590 ksmbd: fix use-after-free in oplock break notification
88abd367fe8a7 drm/nouveau/gsp: fix vblank interrupts on GB20x
37ae6066f65e6 drm/nouveau/disp: fix head state readback on GB20x
37a758989faa5 drm/nouveau/disp: fix HDMI GCP AVMute register offsets on GB20x
20ca0fdad658e drm/nouveau/disp: fix HDMI vendor infoframes on GB20x
dbcaa9d0e9ee5 drm/nouveau/disp: route GSP-RM display MMIO through nvkm_disp_func hooks
a1db244bb2828 drm/nouveau/disp: move the GSP HDMI GCP AVMute write to engine/disp
0cec2ceb5d955 drm/nouveau/disp: move GSP head-timing ISR and vblank helpers to tu102.c
c60033c172420 drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE
4083d24c2636f drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE
3857238de6bce drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op
4f3f9deca7e79 drm/nouveau: Use write-combined maps for coherent
1fef7553dc628 drm/nouveau: unsubscribe the channel-kill event before the fence context
ae5d57131dbff drm/nouveau/gsp: use per-version DP_CONFIG_STREAM params on r570 firmware
4deb29b9d33bf drm/nouveau/dmem: fix mismatched DMA unmap size for large folios
0163b92946d0a drm/nouveau/dmem: fix callocated underflow on large folio split
10e92e18e3dab drm/pagemap: Fix folio allocation fallback and use-after-put
f34f8b904592e drm/sysfb: ofdrm: Fix is_avivo() constant comparison bug
d9daf9a6e7a6f drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation
bbdc6761c5566 drm/sysfb: simpledrm: Improve stride validation
48c60b763a0dd drm/sysfb: simpledrm: Improve panel-size validation
5683b1b2a6090 drm/sysfb: simpledrm: Improve framebuffer-size validation
62e744babd0b5 drm/amdkfd: Reject zero-sized AQL queue allocations after size halving
c643c229babe2 drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore
0a9a0e8a97da7 drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram
58e866711b234 drm/amdkfd: fix scope of mqd_mgr dereference in pqm_debugfs_mqds
a2035918a7a1d drm/amdkfd: Fix error path at svm_migrate_copy_to_ram
6aae545c87087 drm/amdkfd: Add TLB flush after MES queue eviction/suspension
6decb921f7c58 drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT
4e651478656b5 drm/amdgpu: update the fw version for gfx12 userqueues
bcc58f2ef7708 drm/amdgpu: update the fw version for gfx11 userqueues
c931aedaf18c9 drm/amdgpu: Skip accessing psp rum time db for APUs
ebe7542553d00 drm/amdgpu: force complete the MES ring fences on reset
bdd6a58743e00 drm/amdgpu: force complete the KIQ ring fences on reset
4614011a844b4 drm/amdgpu: fix Idle BOs list in VM debugfs status info
c41cc2632bd60 drm/amdgpu: fix byte/dword unit mismatch in coredump IB dump
236ccf3ff9fde drm/amdgpu: fix autosuspend cleanup during removal
6ea36fc580cdb drm/amdgpu: Disable runtime PM for externally attached dGPUs
0bfb938182d13 drm/amdgpu: clamp the isolation index for rings outside a partition
4d030c3487074 drm/amdgpu: delay ttm buffer func enablement on xgmi
fd4746ed0574d drm/amdgpu: check thunderbolt before switcheroo registration
a46ab76b6cf54 drm/ttm: Drop tt->restore after successful restore
e6195b941fdc8 drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used
d152b582d852c drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value
eab46d9629807 drm/gud: validate TV mode names before creating enum property
6ea61f1d4cbaa drm/gud: NUL-terminate TV mode names read from the device
9ae19bd60891b drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check
25ad527dc92aa drm/amdgpu/gfx8: only apply compute quantums to KCQs
2d2071d673039 drm/amd/display: Set gpuvm min page size to 4K on dcn35/36
647426f78a344 drm/amd/display: Remove const Qualifier From Non-Pointer Fields
b10cc09b32924 drm/amd/display: validate plane degamma LUT size for private color prop
3891405e64885 drm/amd/display: Fix HPD consideration for VGA/LVDS connectors on DCE
dac29cbb405b9 drm/amd/display: fix dc_lock leak on GPU reset error paths
15ee43aad0df4 drm/amd/display: avoid divide-by-zero in __is_lut_linear()
ac908108d1977 drm/hibmc: Use drm_atomic_helper_check_plane_state()
93f36cf57c729 drm/hibmc: Fix list of formats on the primary plane
d8c055b34ab3a drm/nouveau/disp/r535: Add scanline position support + head state support
423fd96d094c1 drm/ssd130x: fix column and row end address in partial updates in ssd133x
956005c09cfd9 drm/sun4i: fix refcount leak in sun4i_backend_init_sat()
adadda76184eb drm/ssd130x: fix column and row end address in partial updates for ssd132x
84829e324a396 drm/i915: Guard against NULL driver_data in i915_pci_probe()
80e4fd48b9004 drm/i915/display: Clear SEL_FETCH_PLANE_CTL on plane disable
2d1215a72159d drm: fix race between partial drm_dev_register() failure and ioctl
972afe6d53140 drm/panel-edp: fix i2c adapter leak on probe failure
f7f61839ba393 drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure
3e5c7cddc0073 drm/panthor: fix firmware control interface bounds checks
6ae19dce3e8c1 drm/panthor: harden firmware build-info bounds checks
c659ba6939702 drm/xe/vram: report FLAT_CCS base misalignment
967a179463d32 drm/amdgpu: avoid force-completing uninitialized UVD rings
3e234c6face86 drm/amdgpu: Fix init ordering in amdgpu_vram_mgr_init()
c42608c09b6b5 f2fs: fix to zero post-EOF data when extending file size
0b196c07407f4 f2fs: fix to pass folio->index to f2fs_sanity_check_node_footer()
153df7dc3aaee f2fs: fix to reclaim space in f2fs_allocate_pinning_section()
931e1aa4d44c5 f2fs: fix valid block count leak on data block allocation failure
bee6dfcc111b1 f2fs: protect critical_task_priority updates with s_umount
3923ec2b98c96 f2fs: fix to clear dirty flag on folio in error path
436cdabc64c10 f2fs: fix to off-by-one issue in f2fs_zero_post_eof_page()
e88a37a6ec5d9 f2fs: fix to return -EFSCORRUPTED in f2fs_get_node_info() correctly
4e85a62b0c27b f2fs: fix i_size when pinned fallocate partially fails
905411f650487 f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages()
b9776094aa711 f2fs: fix to migrate all curseg types during free_segment_range
8f3b99c50dd0d f2fs: avoid NULL checkpoint thread access in sysfs
cc34df18da92f f2fs: fix folio_nr_pages() race after put in large folio invalidate
93a3e6a4c9e72 f2fs: fix dentry folio leak in find_in_level
99d14d61aa8be f2fs: embed f2fs_gc_kthread in f2fs_sb_info
34d9717097485 f2fs: fix to avoid potential section-unaligned pinfile
47a4aaa566226 f2fs: don't drop the top folio order in the f2fs_iostat tracepoint
317d32e1a8dea f2fs: limit recovery filename logging to stored length
cb0446b707668 f2fs: return writeback error from collapse range
ab31e3b774f5d f2fs: use the mount idmap for the owner check in f2fs_xattr_advise_set()
83f234dcb0e8d f2fs: dirty directory inodes on mtime/ctime update
dcae1eeda5314 f2fs: validate MOVE_RANGE destination size
c14282d35ea86 f2fs: fix to avoid move_range and defragment on device_alias file
89c65ec3c1890 f2fs: only redirty pinned folios in redirty_blocks
45837717808fb f2fs: reject overlapping move range after len expansion
5ba01cc400413 f2fs: return symlink writeback errors
e9bfb56e2c1bd scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started
7881faf862ee3 scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak
4cd349f89daa3 scsi: qla2xxx: Use coherent DMA buffer for D_Port diagnostics
7d0b3f745efb2 scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition
91fde7ad72253 scsi: qla2xxx: Drop vport reference under lock in report ID acquisition
e70036dc2ddc0 scsi: qla2xxx: Fix NVMe abort reference leak on repeated abort
35124cfa9898b scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry()
f6e8977bce887 scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read
845d4abd92cd2 scsi: qla2xxx: Avoid double completion in async IOCB timeout
157ca7d1af45f scsi: qla2xxx: Quiesce response IRQ before freeing request queue
df86c27cf1ba9 scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb()
29f1f9ad9e354 scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path
a6374b508893d scsi: qla2xxx: Don't query firmware state while chip is down
aac0d3cb91991 scsi: qla2xxx: Fix FCE trace enable parsing in debugfs
9f31de4d07e4c scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state()
41ef7edde27ac scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump
122bf170c94a3 scsi: qla2xxx: Fix cs84xx use-after-free on host teardown
33735490789e5 scsi: qla2xxx: Serialize flash version read in reset handler
33c77254e6e91 scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation
b02ff132017b2 scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject
f2d4f025b67fc scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions()
9fc03be982763 scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak
61f05f2e98f0f scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config()
f4aaa4a4e6f1d scsi: qla2xxx: Initialize NVMe abort_work once at submission
d556f899964d1 scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()
e25241f9fa01f scsi: qla2xxx: Fix BSG job leak on validate flash image error path
b185375d2996b scsi: qla2xxx: Fix Name Server logout detection on FWI2 adapters
75fd6d041c4a3 scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check
47049fdadc0ea scsi: qla2xxx: Bound i2c->length in I2C bsg handlers
a5501c4225623 scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers
2215e55ee1e5e media: chips-media: wave5: Resume device before setting EOS flag
2e5b9d632da6d media: chips-media: wave5: Fix pipeline stall when queuing fails
63d758d2f9dba media: chips-media: wave5: Defer job_finish() only when a DEC_PIC was queued
c104f37b9f79d media: chips-media: wave5: Add timeout while stop_streaming
dc37c478ed659 media: chips-media: wave5: avoid skipping device_run while VPU has work
8c3cfb9fff965 media: chips-media: wave5: Set inst->std during default format initialization
5ee3099138fc2 media: chips-media: wave5: Guard bit depth check with initial_info_obtained
cfcaa26b36f7e media: qcom: iris: fix missing hfi_id in gen1 GOP_SIZE cap
d7f34cbaced92 media: qcom: iris: use disable_irq() during power-off
14f49e4577810 media: qcom: iris: fix state-change debug log printing stale value
672dbccf43513 media: zoran: Avoid freeing a registered video_device twice
b24d34fd0b7cc media: vimc: fix pixel format lookup in enum_framesizes
0e7f2cd72a4f9 media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure
22128985b581d media: venus: fix payload size calculation in parse_raw_formats()
66fe517d2dd38 media: venus: fix payload size returned by parse_caps() and parse_alloc_mode()
881aafb139520 media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link
2bce73ab36d69 media: v4l2-ctrls: Allow unknown HDR10 white point and luminance
30f85a7c59113 media: v4l2-ctrls: validate HEVC EXT SPS RPS counts
a57d94026cb4f media: v4l2-async: avoid deleting unlinked ASC entry on link error
fd5b4a14c87b2 media: ti: vpe: quiesce overflow recovery before freeing streams
f1ba602afd5ee media: tda18250: fix possible integer overflow
fc65623524b5b media: saa7164: fix cleanup on resource allocation failure
7d221859ba45d media: s2255: check firmware size before reading trailing marker
dd739517560c8 media: s2255: bound JPEG frame size before copying into the buffer
5249a092ed2cf media: rzg2l-cru: Align bytesperline to hardware DMA stride requirement
ac02b2c56ccef media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure
a0d9d9a3b41a1 media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak
74938f83a8abb media: rkvdec: hevc: guard INTER_REF_PIC_SET_PRED index underflow
5ef075c44c79f media: rkvdec: hevc: tighten EXT SPS RPS control dimensions
e21f0344fcdfd media: rkvdec: Propagate platform_get_irq() errors
b866d4bcd2ec6 media: rockchip: rga: don't change RGB quantization
5e6f5bffaa80f media: rc: sunxi-cir: Unregister rc device on probe failure
f220b29d318f3 media: mali-c55: Fix scaler factor overflow for large crop sizes
efb92bf2bd7a6 media: mali-c55: Fix AEXP IHIST disable bit shift
003b2bf690683 media: mali-c55: Fix clock leak on reset deassert failure
63fbd6372f77d media: mali-c55: fix dropped last AEC histogram zone weight
5a65e6f9dff66 media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks
de7192f111a47 media: nxp: imx8-isi: Correct color map between V4L2 and ISI
ab15c39a83b6d media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing
426ead7eed6d6 media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup
0259ade4c4cea media: platform: mtk-mdp3: Fix SCP device refcounting
d61ba609c3226 media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common
f99d78280faaa media: iris: Enumerate cap->bus_info to differentiate between encoder and decoder
dc31e4f1e1463 media: ipu-bridge: check all DMI entries when overriding sensor rotation
eee6069e4e951 media: intel/ipu6: fix async notifier cleanup leak on parse error
ea97482e46cc2 media: imx355: Avoid calling imx355_power_off twice in error path
64d5e26dc6bb6 media: i2c: vd55g1: Fix media bus code initialization
7304585c75972 media: i2c: vd55g1: Fix manual digital gain on color variant
c85aa92f1b166 media: i2c: ov9282: restore flash duration calculation
09453b467990e media: i2c: ov7740: fix use-after-destroy in remove
6e13784452785 media: i2c: ov02a10: fix endpoint parsing use-after-free
55eb48818f778 media: i2c: imx415: Return test pattern write errors
46c63cc1c1aef media: i2c: imx415: Release runtime PM reference on VBLANK error
9d2e6262f65dd media: i2c: alvium: Fix: Correct name of register in alvium_set_ctrl_auto_exposure
e6f1a1ac9b8cc media: go7007: defer the ALSA v4l2 put until card release
16cb1ee17e093 media: em28xx: fix use-after-free of dev_next->devlist on disconnect
4666197ca4f7d media: em28xx: defer audio-only extension registration
86d8468e9015c media: dt-bindings: nxp,imx8-isi: Drop fsl,blk-ctrl requirement for i.MX8ULP
99cd62b9b1c81 media: cx23885: cancel NetUP CI work before teardown
a636c72c7f522 media: cx231xx: reject geometry changes while the VBI queue is busy
8c6610e230b93 media: cobalt: Avoid freeing ALSA private data twice
81aa608ac3a56 media: cedrus: fix memory leak in cedrus_init_ctrls()
ae614f4871215 media: cec: Serialize exclusive follower delivery
6e7a52d237013 media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash
7ad2fec276946 media: cec: extron-da-hd-4k-plus: add sanity check
9c6ceb0949227 media: cec: disable delayed work before freeing an interrupted transmit
cca2407794795 media: cec: core: Fix kmemleak due to missed rc_free_device() call
e3c973c912aa4 media: bcm2835-unicam: Fix pipeline wrong validation for unpacked formats
a6a568171d189 media: amphion: Remove obsolete frame_count check in venc_start_session
c6749ac8f59cc media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref
cc2bc29770b31 rust: drm: ioctl: fix unbounded lifetimes in ioctl handler arguments
c4357ebeee63c LoongArch: Avoid preempt count underflow without probe
c048b0a3c0836 LoongArch: Do not save/restore percpu base register in rethook trampoline
fbf6ed7d827b4 LoongArch: Do not select HAVE_RUST when KASAN is enabled
6311b8c471afa LoongArch: Fix acpi_package_ids[] array overflow
90b84201cb651 LoongArch: BPF: Fix off-by-one error for insn_is_cast_user()
f0e4d069cb47c LoongArch: BPF: Move arena register slot below TCC context
00cdb31f17c7c LoongArch: Expand module virtual address space to 2GB
96f44d493c280 LoongArch: BPF: Refactor jump offset calculation in tail call
2a148e146993e LoongArch: BPF: Optimize redundant TCC loads in epilogue
55e18311c705c LoongArch: Add DIRECT_MAP_PHYSMEM_END definition
83715a40a2d30 LoongArch: KVM: Validate MSI data before routing it to EIOINTC
bc7a6849b4395 LoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY
3bf6f5e2e1007 LoongArch: KVM: Free init resources if kvm_init() fails
26bda95b64e8f LoongArch: KVM: Fix TOCTOU race on pv_features
de54ab63ef127 LoongArch: KVM: Fix resource leak in kvm_loongarch_env_init() error path
4595c9b2bdb0d LoongArch: KVM: Add unregister helpers for the KVM interrupt devices
8e61f76e74583 LoongArch: KVM: Fix PC double advance in kernel MMIO read fast path
f56060b0e10fa LoongArch: KVM: Fix uninitialized stack variable issue with dmsintc
46aa64821f6c0 LoongArch: KVM: Set vcpu->cpu before IN_GUEST_MODE is set
2de38f0448b45 KVM: arm64: Correctly cap TLBI Range to the architural limit
36df368861d26 KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save
2bf6e59be382a KVM: arm64: vgic: Reset in_kernel on private IRQ allocation failure
b6c2abf620a45 KVM: arm64: vgic: Fix detection of MI on no pending LR
d3a2d20b7248e KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables
3feb83918e30f KVM: arm64: Sign-extend VA for range-based TLBI invalidation
87c2bbf189829 KVM: arm64: Remove VM-wide VNCR mapping counter
11ee3faab4f17 KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry
9065c1261f8a0 KVM: arm64: Handle VNCR TLB invalidation race with vcpu_put() VNCR unmapping
c624731ca6fe5 KVM: arm64: Correctly handle end of VA space TLBI invalidation
1c9fca34b9625 KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation
66c36dd659954 KVM: arm64: Consider SCTLR_EL2.M when mapping the L1 VNCR page
f3064dde05527 KVM: s390: Restore sigset on error path
3a131f7758d33 KVM: s390: pv: Fix rc/rrc offset for PVM_DUMP
ae452b990e054 KVM: s390: keyop: use mmu_lock to read gmap->asce
7077ec953996a KVM: s390: Fix memory corruption by not reinjecting CK machine checks
f8ed98e97a460 KVM: s390: Zero initialize irq in reinject_machine_check
134f235e0e8de KVM: s390: Zero initialize data structures for inject_pfault_token
4c05bf21d1806 KVM: s390: Take srcu when importing watchpoint data
e4d8b7f176b97 KVM: s390: Free guest debug data on vcpu destroy
46cb8a273e2f8 KVM: s390: Fix old_data leak in guest debug error path
581be9f608583 KVM: s390: Fix memory leak in guest debug handling
3fe801db90bde KVM: s390: Fix length check __import_wp_info()
ac943db6e5fac KVM: x86: Move enabling EFER.SVME and EFER.LMSLE to generic EFER setup
a97d4eb883d3c KVM: x86: Ensure runtime reads of disabled_quirks are resolved once
92e24ca69e0f8 KVM: x86: Serialize writes to disabled_quirks using kvm->lock
bdb732ebee545 KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock
8edb3c09e43f7 KVM: x86/mmu: Consume the locked rmap value in the lockless rmap walk
655694a1cba2d KVM: x86/mmu: Use CMPXCHG when clearing Accessed bit in TDP MMU
9941850e8adf1 KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU
62c3ee4c9f0e2 KVM: nVMX: Service local TLB flushes on failed nested VM-Enter
bbec4adc2f340 KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit
7fda9304d0d85 KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02
121991d150735 KVM: nVMX: Always flush vpid02 on first use
bb9f763d7aed4 KVM: PPC: Book3S HV: Validate arch_compat against host compatibility mode
d393ef49d94f5 iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask
fb21a4113e911 iio: light: opt4001: Reject integration times with a non-zero seconds part
2fb1e09451aef iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem()
4157573b37f64 iio: light: opt4001: Fix power down clearing bits of the wrong register
0107ac927b1e7 iio: light: opt4060: Fix incorrect register name in threshold read error message
7d2ddfee2952e iio: light: opt4060: Reject integration times with a non-zero seconds part
a54b53b00e0f6 iio: ti-ads7138: Disable STATS_EN bit while reading conversion results
6b7584b976d58 iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register()
44063a6673a63 iio: srf04: fix pm_runtime handling on probe error path
4a84300a1033d iio: pressure: mpl115: Fix runtime PM cleanup
3fa189573cca2 iio: pressure: dps310: fix NULL pointer dereference on ACPI probe
80e7381e8cccb iio: light: ltrf216a: fix runtime PM reference leak in error path
c2c83ecb1ef7d iio: light: gp2ap002: Disable regulators on resume failure
c1870bbfcfdd2 iio: light: cm32181: return zero after writing calibscale
3ce75e455dd6e iio: light: apds9306: fix PM reference leak in apds9306_read_data()
bc5fbf9868ca1 iio: imu: st_lsm6dsx: Update enable mask when using sensor fusion
14db27a2f11af iio: gyro: mpu3050: fix sign of raw angular velocity readings
daa1674ce8736 iio: dac: mcp47feb02: add missing 'select REGMAP_I2C' to Kconfig
9fe22f563b2a0 iio: dac: m62332: Fix regulator reference count imbalance
36f17988eb86c iio: dac: ad5446: fix OF module device table
98bbd0844aeda iio: dac: ad3552r-hs: fix scnprintf() buffer bound in data source show
44d52c8b1c6da iio: chemical: sgp30: Handle IAQ thread creation failure
30b0d44c978bb iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF
777e8ebfe6b3f iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable
8b3e221590181 iio: buffer: Tie IIO dma fence lock lifetime to the fence
11cef99491117 iio: buffer: Make IIO DMA fence release RCU-safe
6d4bdbf7bad63 iio: buffer: Fix potential use-after-free in anonymous buffer release
af113b29f884f iio: adc: pac1921: fix wrong channel used in trigger handler read
90a2810faefb5 iio: adc: max34408: add missing 'select REGMAP_I2C' to Kconfig
776bb4fb57bab iio: adc: max14001: add missing 'select REGMAP' to Kconfig
fc8a0d0eb346d iio: adc: adi-axi-adc: add data size support for AD408X backend
9c408b3309ee8 iio: adc: ad4080: configure backend data size
87c0fb907c415 ASoC: tas2783-sdw: sort the register default table
adf51dd6e11b9 ASoC: tas2783-sdw: drop duplicate reg_default entry
622319a4ac9f6 ASoC: tas2780: sort the register default table
86870ada907fd ASoC: tas2764: sort the register default table
fee1916410912 ASoC: tas2552: sort the register default table
a2ec67511c156 ASoC: sti-sas: sort the register default table
abf06bc6ac17c ASoC: sgtl5000: sort the register default table
856f0648beb7f ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get
55b5e9fc08223 ASoC: rt721-sdca-sdw: sort the register default table
b4eb588408717 ASoC: rt715: sort the register default table
a099f59e8c1d2 ASoC: rt715-sdca: sort the register default tables
f735844b71afb ASoC: rt715-sdca: drop duplicate reg_default entries
418da4d4ccb80 ASoC: rt712-sdca-sdw: sort the register default table
836df0d31a9a1 ASoC: rt712-sdca-dmic: sort the register default table
cf6017e0feee7 ASoC: rt711: sort the register default table
b7f7451a29c37 ASoC: rt711-sdca: sort the register default tables
e15783332f451 ASoC: rt700: sort the register default table
a35b77dc8e265 ASoC: rt700: drop duplicate reg_default entry
3954b3b217420 ASoC: rt298: sort the register default table
b50de175dd03a ASoC: rt286: sort the register default table
b454c7ed1cf9e ASoC: rt274: sort the register default table
74fe7483e6eb2 ASoC: rt1318: sort the register default table
876d3276fd9c4 ASoC: rt1318-sdw: sort the register default table
ec7064d07e24c ASoC: rt1316-sdw: sort the register default table
b5a45169cbf91 ASoC: rt1017-sdca-sdw: sort the register default table
2f972da629f6a ASoC: pm4125-sdw: sort the register default table
fc569468e874d ASoC: pcm512x: sort the register default table
0381caa253cb9 ASoC: ml26124: sort the register default table
207f95aed374f ASoC: max9860: sort the register default table
bb1602908c67d ASoC: loongson: Fix error handling in ACPI property parsing
4731e2d22e4be AsoC: intel: sst: fix PCI device reference leak on probe failure
cb6b0b1a9d5a6 ASoC: hdac_hda: Fix hlink refcount leak on component registration failure
a201b5bcdfd61 ASoC: fsl_easrc: sort the register default table
3e50bcfe6212f ASoC: fsl_easrc: Use div64_u64 for 64-by-64 division
cbb3444113a8f ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure
99d5973d7a0f9 ASoC: cx2072x: sort the register default table
07a86575edc30 ASoC: cs35l34: drain threaded IRQ before runtime suspend
84cf6acd01a1e ASoC: cs35l33: drain threaded IRQ before runtime suspend
86f47316e536c ASoC: adau1761: sort the register default table
1c9a77101f2d1 i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure
b2956d578e87a clk: qcom: gcc-mdm9607: Drop incorrect BIMC PLL and related clocks
fb3438a00799c clk: qcom: gcc-mdm9607: Fix halt_reg for gcc_apss_axi_clk
76ff1eff73589 clk: qcom: gcc-mdm9607: Fix enable_reg for gcc_blsp1_sleep_clk
30223154daacf clk: qcom: gcc-mdm9607: Drop incorrect system_noc_bfdcd_clk_src
691d472c9509f clk: qcom: gcc-mdm9607: Drop incorrect apss_tcu_clk_src
4865ff30e9189 clk: rockchip: rk3588: Don't change PLL rates when setting dclk_vop2_src
c6679c13e3c36 clk: qcom: gcc-msm8939: Fix enable_reg for gcc_blsp1_sleep_clk
508d6150d9405 clk: qcom: gcc-msm8916: Fix enable_reg for gcc_blsp1_sleep_clk
8eb29dc9a9ad8 clk: microchip: mpfs: fix regmap_update_bits() mask/val order
bf85bd6e550c1 clk: meson: align gxbb_32k_clk_sel number of parents with actual count
bf538cdc9bb45 clk: mediatek: mt8196: Select REGMAP_MMIO for vlpckgen
9a511980e81b1 clk: clocking-wizard: fix integer overflow in rate calculation
edf86952488fa batman-adv: bla: prevent CRC corruptions after claim flush
9a0c47023d325 batman-adv: bla: fix freeing of claims on meshif deletion
0c2df865338bb batman-adv: dat: avoid unaligned fault in IP extraction
2879177539e3e batman-adv: mcast: linearize skbuff for packet generation
e4af59a2dc956 batman-adv: mcast: ensure unshared skb for multicast packets
b9c2d3a5043fc batman-adv: fix TX priority extraction for BATADV_FORW_MCAST
2dffc8c44b6e3 batman-adv: fix stale receive device on merged fragments
23e747fe58583 mtd: rawnand: validate ONFI extended parameter page sections
97f1f4cdec16f mtd: rawnand: sunxi: fix H6/H616 controller timings
6086af3e39b0a mtd: rawnand: sunxi: describe tADL and tWHR delays
c3d542c6204c8 mtd: rawnand: sunxi: group controller delay tables
a732ae52c6aef mtd: rawnand: pl353: Make sure we use the monolithic helpers for raw accesses
00b4d5d206298 mtd: nand: realtek-ecc: add missing MODULE_DEVICE_TABLE()
1e5cd8bc90233 mtd: mtdoops: free page bitmap when the backing MTD is removed
d14e6298139f5 mtd: afs: validate v2 image info bounds
0307c2e82847a s390/vfio-ap: Fix required lock not held during update of ap_matrix_mdev object
09548edc6114f s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap
7db2511fc601c s390/vfio-ap: Fix NULL deref in status_show() during queue probe
0fd74477d0574 s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects
04b35dd88c108 s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed
4f7e869d0db24 s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL
2ff68bf414de1 s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove
c8a9772f6dfee s390/vfio-ap: Fix stale do_remove flag across iterations in vfio_ap_mdev_cfg_remove
13bfc94eef389 s390/vfio-ap: fix stale pqap_hook pointer on error in vfio_ap_mdev_set_kvm()
c99e2c7811bee powerpc/crash: stop watchdogs before booting kdump kernel
08ec4e8e3c540 powerpc/pseries: Move H_WATCHDOG definitions to a common header
8536f38107a69 powerpc/pseries: Handle and log pseries-wdt registration failures
7968852a7ca3c powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population
c4cb547f26d9b powerpc/kexec_file: Prevent kexec range truncation
4ff3d9fd71c7b powerpc/kexec_file: Fix null-ptr-def in extra size calculation
c513c8d173187 parisc: Fix alignment of asm statements in head.S
16a62a3f2128b parisc: eisa: Fix infinite loop when parsing invalid IRQ value
9dfa11cef4750 nvdimm/btt: reject an arena whose nfree is below the lane count
c74eba81766ee mm/hugetlb_cgroup: call page_counter_set_max() outside VM_BUG_ON()
05caf140e24ad mm/hugetlb: keep max_huge_pages when dissolving surplus folios
10f616ef06c5b mm/hugetlb_cma: fix null nodemask dereference in hugetlb_cma_alloc_frozen_folio
e456129942506 mm/hugetlb: fix missing migratable flag on same-node hugetlb migration
99186b185c245 mm/migrate_device: avoid out-of-bounds writes for compound folios
431402bfca1c4 mm: fix incorrect vm_flags usage when checking allowable orders for tmpfs
cc5d6446ead38 Revert "pmdomain: qcom: rpmhpd: Add missing MXC and MMCX power domains for Eliza"
e19e41d1c6281 Revert "once: don't use a work queue to reset sleepable static key"
3ddf7b95818a5 Revert "irqchip/mbigen: Fix mbigen node address layout"
a78d2d9a84569 pmdomain: airoha: fix unselectable AIROHA_CPU_PM_DOMAIN kconfig
1cbed7538946c nvmet-tcp: reject unsolicited H2CData PDUs
d95d342bc0ea8 nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
eb4f9127a2b8a nvmet-auth: Synchronize timeout work during SQ teardown
bb6dafa790403 nvme: skip the zoned limits update if the zone info query failed
76023560d60f1 nvme: add missing SRCU grace period in error path
a0c389b8a495b nvme-tcp: check the data direction of a C2HData PDU
5f89d68c00ccd nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails
d21da6cc91ba1 nvme-fabrics: fix DHCHAP secret leak on parse failure
b3e0f79af1f27 accel/ethosu: fix job completion fence cleanup
f7aad73b48119 accel/ethosu: check MMIO mapping errors in probe
f00def884a831 accel/amdxdna: return early from a zero-length flush
dd403f6a38c53 ring-buffer: Allow splice reads on static buffers
50afadf1ea665 ALSA: pcm: Fix race between non-atomic ops and trigger-start
cd209eb3136e0 ALSA: harmony: initialize locks before requesting IRQ
faba321da0eb6 ALSA: rawmidi: Return the error from snd_rawmidi_input_params()
34f1d4f9f5ea6 arm64: errata: pass REVIDR when matching target implementation CPUs
d2d22ff377cd4 arm64: Don't read GMID_EL1 when MTE is disabled
0f05d95b99164 arm64: mm: Fix the lockless page-table walk in show_pte()
b00ada2f55c53 i2c: qcom-cci: fix autosuspend cleanup
694e7e6edf249 i2c: mux: Fix channel node leak on adapter add failure
552836be2d95c i2c: core: fix debugfs UAF on adapter removal
19cd6394f7ddc i2c: qcom-geni: update frequency table to fix timing parameters
ac257b283962b i2c: designware: Enable interrupt mask workaround for HJMC3001
0c739f54f1c77 perf: Fix use-after-free when perf mmap() revival races with the last munmap()
517b02eaf30dd perf build: Add clang and rust target flags for LoongArch
d9a9da94c9da6 perf hisi-ptt: Fix PTT trace TLP header parsing
ecd69a46c029c perf trace: Refactor augmented_raw_syscalls using bpf_for
92ad79c286f63 perf trace: Factor out BPF loop body
a820237b03785 perf/x86/intel: Remove anythread_deprecated bit from perf_capabilities
68c4b780b266a perf/x86/intel: Fix kernel address leakages in LBR stack
a5c7962e64fff rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers
ea318a4675ee9 rtc: rzn1: Handle unset alarm weekday in rzn1_rtc_read_alarm
75c1e64b7b14e rtc: rzn1: Fix weekday underflow when alarm crosses month boundary
2f24968108904 rtc: rzn1: Handle EPROBE_DEFER for optional pps interrupt
5ec8f629a300c memcg: make the v1 soft limit knob inert
d44c3c5986c7a memcg: bypass the reclaim and oom killer for dying tasks once oom_reaper is done
6165478eaa309 memcg: keep folio's objcg same as its node
2943f1f4b7f28 mm/mempolicy: fix sleeping allocation in alloc_pages_bulk_weighted_interleave()
9435cddf1378d mm/huge_memory: transfer the pmd dirty bit to the folio on zap
d69841dbd92af misc: fastrpc: don't publish fd before copy_to_user() succeeds
6e62cf983a2bd kprobes: Protect kprobe_blacklist with RCU
732510e13ee59 irqchip/stm32mp-exti: Fix the unit of the hwspinlock timeout
d62a84a78de5f ima: Check for ERR_PTR from dentry_path() in validate_hash_algo()
e5b64bd7e57fb ata: ahci: work around lost interrupts on Marvell 88SE61xx
df1a97d5313fc ceph: lock mutex in ceph_mds_check_access()
a5b5e62baceff bpf: Fix infinite loop in pcpu_freelist push with one possible CPU
683fa887e19f3 bpf, riscv: Make arena support depend on ZACAS
fdbaeae9313b2 block: flag zoned disks with GENHD_FL_NO_PART
9b7c322cf29ed cpuidle: psci: Fix support for probe deferral by dropping the faux device
3394c7ba23336 cpuidle: dt_idle_genpd: kfree() the original name allocation
e79449be26ac8 dmaengine: dw-edma: Mark emulated IRQ as level-triggered
d91fb6c0d10da dmaengine: dw-edma: Initialize IRQ data before requesting IRQs
3044460e2d310 dmaengine: dw-edma: Complete descriptors before pausing
8cd010697b79b dmaengine: dw-edma: Fix HDMA channel status register access
2a3801ae5c344 dmaengine: fsl-edma: tracing: no ptr dereference during log output
feeb2ef775081 dma-direct: return struct page from dma_direct_alloc_from_pool()
0d4a5d218055d dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds
94380ecd5ff9b dm: fix resume-vs-remove race
00ad6f9ed27f9 dm: fix race when loading and unloading a table
0cdc6cb242dd8 HID: wacom: validate report length in wacom_intuos_pro2_bt_irq
48934c2927414 HID: rmi: fix OOB access with undersized RMI reports
bfb7939788f3c HID: bpf: serialize device reference release in struct_ops destroy path
b260b54f11405 ftrace: Synchronize the initialization of ftrace_ops
cee8f286794df ftrace: Take trace_array reference before accessing its ftrace_ops
b715872ef0ccc futex: Provide rt_mutex_.*_schedule() equivalents for futex scheduling
e4a4ccfa470f9 futex: Prevent rcuwait use-after-free during requeue PI
3b4f72bdddff6 mm/secretmem: properly account locked pages
0b8faf28d1374 mm/damon/core: initialize damos->last_applied
463ebd63e8ee3 mm/damon/core: handle region split failure in apply_min_nr_regions()
54ef3a3f14e9b mm/damon/core-kunit: skip wrong region walk in commit_target_regions()
bbbf6a9781fda mm/damon/core-kunit: skip wrong quota goal walk in commit_quota_goals()
bee189b41f9d0 mm/damon/core-kunit: skip wrong dest walk in commit_dests_for()
03a8f89172365 mm/damon/core-kunit: handle region split failure in filter_out()
4deb1ec699936 mm/damon/core-kunit: check region count before testing in split_at()
54439210c91e4 mm/damon/sysfs: kobject_del() target (normal), context and kdamond dirs
e94f9f9478af3 mm/damon/sysfs: kobject_del() region and target (error) dirs
11ce1b269aac5 mm/damon/sysfs-schemes: kobject_del() scheme region dirs
5091760ab2ac4 mm/damon/sysfs-schemes: kobject_del() scheme quota goal dirs
eca049e5b5e56 mm/damon/sysfs-schemes: kobject_del() scheme filter dirs
df7a40102ae43 mm/damon/sysfs-schemes: kobject_del() scheme dirs
43b33bdace2c5 mm/damon/sysfs-schemes: kobject_del() scheme action destination dirs
b8ec303f53b04 samples/damon/wsse: stop and free damon ctx when damon_call() fails
e60774d6335b8 samples/damon/wsse: handle damon_start() failure
9fbc1811e83f9 samples/damon/prcl: stop and free damon ctx when damon_call() fails
f383b55811d8e samples/damon/prcl: handle damon_start() failure
215f9a7e4f1dc samples/damon/mtier: handle damon_stop() failure
b4bba194bd06e samples/damon/mtier: handle damon_start() failure
cb97afccffd6a mm/damon/vaddr-kunit: check region count in three_regions test
3ed555fb2c6e4 mm/damon/tests/core-kunit: catch test failure in test_merge_regions_of()
25253bbd8066d mm/damon/sysfs: read ops_id only once in damon_sysfs_apply_inputs()
81e9ca01ebc2d mm/damon/sysfs: read addr_unit only once in damon_sysfs_apply_inputs()
b9687ed098d7f Docs/ABI/damon: fix typo in intervals_goal sysfs path
e20b16aa3b49f scsi: pm8001: Use rollback index when freeing MSI-X vectors
4dd118d06dec9 scsi: megaraid_sas: Limit NVMe request size to the PRP chain frame
f033530105aa7 scsi: bsg: Fix TOCTOU in io_uring passthrough command setup
5d326efc334ea scsi: bsg: Cap io_uring sense copy to max_response_len
3ddf3ea291a0e scsi: target: iscsi: Reserve a terminator byte for the login payload
5def8b6aaad44 spi: Fix DMA mapping ownership on partial map failure
103e7b19d1085 spi: bcmbca-hsspi: disable clocks on resume failure
6b1ccecf311c0 spi: bcm63xx: disable clock on resume failure
d07d4fbae4793 spi: bcm63xx-hsspi: disable clocks on resume failure
220cea6c1662b soc: qcom: geni-se: Use HW PROG_RAM_DEPTH to validate firmware size
b437284a4c29d soc: fsl: qe: Add chained_irq_{enter,exit}() calls in cascade handler
fa5e1bc673ca5 ublk: clear VM_MAYWRITE on read-only ublk char device mmap
dfc17986c608d userfaultfd: reset err to be 0 when move_pages_ptes succeeded
64a41f4a9a968 tracing: Take trace_array reference when opening options file
2ee3f7d43f79e tracing: Have show_event_filters/triggers files take trace array ref
e6ccc279cb8ed tracing/probes: Fix anon_stack check for unnamed bitfields in btf_find_struct_member
50af36b7f9011 thermal/drivers/qoriq: Disable clock on resume failure
909cdbd028f84 thermal/drivers/imx: Disable clock on runtime resume failure
7236bbd2cb7d9 xhci: fix lost bounce buffers on TDs spanning several ring segments
fd19b8895f8a9 staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()
a54fd1a44862d staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()
34f51d196c43a staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr()
5117f236e9e30 usb: gadget: fix null pointer dereference in usb_put_function_instance()
64ec019bf9a8b USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()
858576de6b2f5 usb: gadget: f_midi: initialize work in f_midi_alloc()
49fab5e1bdb20 usb: gadget: f_midi2: fix use-after-free in string attribute show path
b9b5b5df5b8dd usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers()
4079f19a0e1ce usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs
bdaaf3074aedc usb: typec: ucsi: displayport: Fix OOB altmode array index
87f7222587b48 usb: typec: tipd: Fix Thunderbolt altmode VDOs for cd321x
e5f9f36c5d610 usb: typec: tcpm: constrain TCPM_SOURCING_VBUS event handling
52d556f085477 usb: typec: qcom-pmic: cancel reset_work on stop
b5efa3b89395d usb: typec: qcom-pmic-typec: drain cc_debounce_dwork if port_start() fails
1ab669c2b44e1 usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop
e2e424655e312 usb: typec: mux: Fix typec_switch_match()
312a11d6f7392 usb: typec: mux: avoid duplicated mux switches
df7cd3908e075 usb: typec: hd3ss3220: track VBUS enable state per consumer
cae9dbba6adae usb: storage: realtek_cr: fix use-after-free on disconnect
e01408ee52fe5 usb: dwc3: clear forceRM when issuing EndTransfer
d8cfb7f630eb7 usb: dwc3: google: Initialise probe properties with DWC3_DEFAULT_PROPERTIES
619aae11b85f9 usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns()
2571029a92ee7 usb: cdnsp: fix wakeup from S3 after controller context loss
996c319b8bd5a usb-storage: ene_ub6250: fix race between scan work and probe
1618257cb0aba media: usbtv: keep device alive while ALSA card exists
d2c87eadcec4e clk: qcom: gcc-mdm9607: Increase delay for USB PHY reset
9d81885d97cba ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output()
e22428f0c038c usb: image: mdc800: change kmalloc() to kzalloc()
b08c3d5ee7fea drm/amd/display: fix division by zero in get_estimated_bw()
6fedb2eaff775 NFSD: Prevent client use-after-free during blocked-lock reaping
e57a9ed34ea8c NFSD: Prevent client use-after-free during close_lru reaping
b75ecd5122088 NFSD: Consolidate the revocation-path client unpin
c05ae58fe06ce NFSD: Prevent client use-after-free during export state revocation
0146467a2fce8 NFSD: Guard admin state-revocation walks with NFSD_NET_UP
f7e7fcd82f574 NFSD: Annotate caller preconditions for the state-table walkers
2640cc26ed0dd KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped
98bcc7034db1e KVM: x86/mmu: Use split "zap all fast" helpers when invalidating memslot
689c1b2da4779 KVM: x86/mmu: Split kvm_mmu_zap_all_fast() into "front" and "back" halves
00388b7b718a1 KVM: x86/mmu: Fold kvm_mmu_zap_memslot() into kvm_arch_flush_shadow_memslot()
7a90d99686e5a ACPI: battery: Protect all properties with a separated mutex
d7a6af8e5176d ACPI: battery: Use kstrtoul() over sscanf("%lu\n")
d044d796e2a36 HID: sony: clean up device list on probe failure
5a4ed79030efb HID: sony: use guard() and scoped_guard()
3b467c68803d7 ceph: properly decrypt filenames in vmalloc() buffers
052b6b2d5fe97 zram: fix slot lock bit position on big-endian 64-bit
342d140c82251 zram: move lockmap to be per-zram instead per table
4a2fb2d12b87b usb: gadget: f_fs: Fix Use-After-Free in AIO error path
7411de0ce3b45 USB: gadget: ffs: fix mm lifetime handling
68a069b407303 mm/page_alloc: don't spin_trylock() in NMI on UP
348c3db4f1520 drm/xe: Don't hand out the flat CCS storage as usable VRAM
a84f3db72561c fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()
bab5a851e44a3 net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
---
.../linux/linux-yocto-rt_7.2.bb | 6 ++---
.../linux/linux-yocto-tiny_7.2.bb | 6 ++---
meta/recipes-kernel/linux/linux-yocto_7.2.bb | 24 +++++++++----------
3 files changed, 18 insertions(+), 18 deletions(-)
diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_7.2.bb b/meta/recipes-kernel/linux/linux-yocto-rt_7.2.bb
index f4e0d14b57..da34435770 100644
--- a/meta/recipes-kernel/linux/linux-yocto-rt_7.2.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-rt_7.2.bb
@@ -15,13 +15,13 @@ python () {
raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it")
}
-SRCREV_machine ?= "020f32fea18afa789c8eb8f28ce45ad65256fc87"
-SRCREV_meta ?= "ad69d353910ffe62233ed32046d153c01a32cba8"
+SRCREV_machine ?= "5391c0d4e57d3cacdd66e7d5a016dba8c6f5956e"
+SRCREV_meta ?= "b5d69636e3e56aa6a5b8f987b4587e7a56c4782a"
SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine;protocol=https \
git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-7.2;destsuffix=${KMETA};protocol=https"
-LINUX_VERSION ?= "7.2.4"
+LINUX_VERSION ?= "7.2.6"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_7.2.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_7.2.bb
index 8d166fd970..3a8f086d5c 100644
--- a/meta/recipes-kernel/linux/linux-yocto-tiny_7.2.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-tiny_7.2.bb
@@ -9,7 +9,7 @@ require recipes-kernel/linux/linux-yocto.inc
include recipes-kernel/linux/cve-exclusion.inc
include recipes-kernel/linux/cve-exclusion_7.2.inc
-LINUX_VERSION ?= "7.2.4"
+LINUX_VERSION ?= "7.2.6"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}"
@@ -18,8 +18,8 @@ DEPENDS += "openssl-native util-linux-native"
KMETA = "kernel-meta"
KCONF_BSP_AUDIT_LEVEL = "2"
-SRCREV_machine ?= "881860c6d624e61b44ad488360a18310ba83cf26"
-SRCREV_meta ?= "ad69d353910ffe62233ed32046d153c01a32cba8"
+SRCREV_machine ?= "c591fbeae3281cba1d1e16470afd6541ab445b46"
+SRCREV_meta ?= "b5d69636e3e56aa6a5b8f987b4587e7a56c4782a"
PV = "${LINUX_VERSION}+git"
diff --git a/meta/recipes-kernel/linux/linux-yocto_7.2.bb b/meta/recipes-kernel/linux/linux-yocto_7.2.bb
index e3edaaada5..550ba49ebc 100644
--- a/meta/recipes-kernel/linux/linux-yocto_7.2.bb
+++ b/meta/recipes-kernel/linux/linux-yocto_7.2.bb
@@ -17,25 +17,25 @@ KBRANCH:qemux86-64 ?= "v7.2/standard/base"
KBRANCH:qemuloongarch64 ?= "v7.2/standard/base"
KBRANCH:qemumips64 ?= "v7.2/standard/mti-malta"
-SRCREV_machine:qemuarm ?= "af1653e938edb4571aac7a943ec531e70badb57c"
-SRCREV_machine:qemuarm64 ?= "881860c6d624e61b44ad488360a18310ba83cf26"
-SRCREV_machine:qemuloongarch64 ?= "881860c6d624e61b44ad488360a18310ba83cf26"
+SRCREV_machine:qemuarm ?= "0e60d19f0d15f5fbef845da9454998c76b37bd97"
+SRCREV_machine:qemuarm64 ?= "c591fbeae3281cba1d1e16470afd6541ab445b46"
+SRCREV_machine:qemuloongarch64 ?= "c591fbeae3281cba1d1e16470afd6541ab445b46"
SRCREV_machine:qemumips ?= "ab0e33fefa2a3d0366b2b8deb7cfb3be2d8dc436"
-SRCREV_machine:qemuppc ?= "881860c6d624e61b44ad488360a18310ba83cf26"
-SRCREV_machine:qemuriscv64 ?= "881860c6d624e61b44ad488360a18310ba83cf26"
-SRCREV_machine:qemuriscv32 ?= "881860c6d624e61b44ad488360a18310ba83cf26"
-SRCREV_machine:qemux86 ?= "881860c6d624e61b44ad488360a18310ba83cf26"
-SRCREV_machine:qemux86-64 ?= "881860c6d624e61b44ad488360a18310ba83cf26"
+SRCREV_machine:qemuppc ?= "c591fbeae3281cba1d1e16470afd6541ab445b46"
+SRCREV_machine:qemuriscv64 ?= "c591fbeae3281cba1d1e16470afd6541ab445b46"
+SRCREV_machine:qemuriscv32 ?= "c591fbeae3281cba1d1e16470afd6541ab445b46"
+SRCREV_machine:qemux86 ?= "c591fbeae3281cba1d1e16470afd6541ab445b46"
+SRCREV_machine:qemux86-64 ?= "c591fbeae3281cba1d1e16470afd6541ab445b46"
SRCREV_machine:qemumips64 ?= "ab0e33fefa2a3d0366b2b8deb7cfb3be2d8dc436"
-SRCREV_machine ?= "881860c6d624e61b44ad488360a18310ba83cf26"
-SRCREV_meta ?= "ad69d353910ffe62233ed32046d153c01a32cba8"
+SRCREV_machine ?= "c591fbeae3281cba1d1e16470afd6541ab445b46"
+SRCREV_meta ?= "b5d69636e3e56aa6a5b8f987b4587e7a56c4782a"
# set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll
# get the <version>/base branch, which is pure upstream -stable, and the same
# meta SRCREV as the linux-yocto-standard builds. Select your version using the
# normal PREFERRED_VERSION settings.
BBCLASSEXTEND = "devupstream:target"
-SRCREV_machine:class-devupstream ?= "5015d0d945b3d3f2b038d2667880d5762f7d9437"
+SRCREV_machine:class-devupstream ?= "500df175a7f9e6bc1a9c328590ca5150f84f9ff0"
PN:class-devupstream = "linux-yocto-upstream"
KBRANCH:class-devupstream = "v7.2/base"
@@ -43,7 +43,7 @@ SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;name=machine;branch=${KBRA
git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-7.2;destsuffix=${KMETA};protocol=https"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
-LINUX_VERSION ?= "7.2.4"
+LINUX_VERSION ?= "7.2.6"
PV = "${LINUX_VERSION}+git"
--
2.43.0
^ permalink raw reply related [flat|nested] 13+ messages in thread
* [meta][PATCH 04/06] linux-yocto/7.2: drm/client: avoid spurious vblank-timeout warning
2026-09-17 5:13 [PATCH 0/6] linux-yocto: cosolidated pull request bruce.ashfield
` (2 preceding siblings ...)
2026-09-17 5:13 ` [meta][PATCH 03/06] linux-yocto/7.2: update to v7.2.6 bruce.ashfield
@ 2026-09-17 5:13 ` bruce.ashfield
2026-09-17 5:13 ` [meta-yocto-bsp][PATCH 05/06] yocto-bsps: update to v6.18.50 bruce.ashfield
` (2 subsequent siblings)
6 siblings, 0 replies; 13+ messages in thread
From: bruce.ashfield @ 2026-09-17 5:13 UTC (permalink / raw)
To: richard.purdie; +Cc: openembedded-core
From: Bruce Ashfield <bruce.ashfield@gmail.com>
Integrating the following commit(s) to linux-yocto/7.2:
1/1 [
Author: Krystian Kaniewski
Email: krystianmkaniewski@gmail.com
Subject: drm/client: Avoid warning on vblank timeout during modeset client waits
Date: Wed, 12 Aug 2026 10:05:19 +0000
[ Backport of a fix posted on LKML; not yet merged upstream. ]
Commit d8c4bddcd8bc ("drm/fb-helper: Synchronize dirty worker with
vblank") added a vblank wait to the fb-helper damage worker via
drm_client_modeset_wait_for_vblank(). On virtualized/emulated displays
(the Yocto QEMU autobuilder) and on PREEMPT_RT, the vblank can fail to
arrive within the 1s timeout even though this is harmless optional
throttling, producing a spurious warning:
WARNING: drivers/gpu/drm/drm_vblank.c:1329 drm_crtc_wait_one_vblank
vblank wait timed out on crtc 0
drm_crtc_wait_one_vblank
drm_client_modeset_wait_for_vblank
drm_fb_helper_damage_work
The traceback is picked up by Yocto's parselogs and fails runtime tests.
Add a non-warning drm_crtc_wait_one_vblank_internal() and use it from the
client modeset wait path, where a timeout is expected and does not
indicate a kernel bug. The warning is preserved for all other callers of
drm_crtc_wait_one_vblank(), whose external behaviour is unchanged.
Link: https://lore.kernel.org/all/ad8b0286-7779-4682-9516-da4280f1d846@mail.kernel.org
Fixes: d8c4bddcd8bc ("drm/fb-helper: Synchronize dirty worker with vblank")
Signed-off-by: Krystian Kaniewski <krystianmkaniewski@gmail.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
]
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
---
.../recipes-kernel/linux/linux-yocto-rt_7.2.bb | 2 +-
.../linux/linux-yocto-tiny_7.2.bb | 2 +-
meta/recipes-kernel/linux/linux-yocto_7.2.bb | 18 +++++++++---------
3 files changed, 11 insertions(+), 11 deletions(-)
diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_7.2.bb b/meta/recipes-kernel/linux/linux-yocto-rt_7.2.bb
index da34435770..438c896749 100644
--- a/meta/recipes-kernel/linux/linux-yocto-rt_7.2.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-rt_7.2.bb
@@ -15,7 +15,7 @@ python () {
raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it")
}
-SRCREV_machine ?= "5391c0d4e57d3cacdd66e7d5a016dba8c6f5956e"
+SRCREV_machine ?= "c2f967f4c1065d41084f300d3eca7cd413635dc3"
SRCREV_meta ?= "b5d69636e3e56aa6a5b8f987b4587e7a56c4782a"
SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine;protocol=https \
diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_7.2.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_7.2.bb
index 3a8f086d5c..0a9595a749 100644
--- a/meta/recipes-kernel/linux/linux-yocto-tiny_7.2.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-tiny_7.2.bb
@@ -18,7 +18,7 @@ DEPENDS += "openssl-native util-linux-native"
KMETA = "kernel-meta"
KCONF_BSP_AUDIT_LEVEL = "2"
-SRCREV_machine ?= "c591fbeae3281cba1d1e16470afd6541ab445b46"
+SRCREV_machine ?= "d8a1ec518ab72fadb60dbe9eed3775b68975defd"
SRCREV_meta ?= "b5d69636e3e56aa6a5b8f987b4587e7a56c4782a"
PV = "${LINUX_VERSION}+git"
diff --git a/meta/recipes-kernel/linux/linux-yocto_7.2.bb b/meta/recipes-kernel/linux/linux-yocto_7.2.bb
index 550ba49ebc..f1c2d475c1 100644
--- a/meta/recipes-kernel/linux/linux-yocto_7.2.bb
+++ b/meta/recipes-kernel/linux/linux-yocto_7.2.bb
@@ -17,17 +17,17 @@ KBRANCH:qemux86-64 ?= "v7.2/standard/base"
KBRANCH:qemuloongarch64 ?= "v7.2/standard/base"
KBRANCH:qemumips64 ?= "v7.2/standard/mti-malta"
-SRCREV_machine:qemuarm ?= "0e60d19f0d15f5fbef845da9454998c76b37bd97"
-SRCREV_machine:qemuarm64 ?= "c591fbeae3281cba1d1e16470afd6541ab445b46"
-SRCREV_machine:qemuloongarch64 ?= "c591fbeae3281cba1d1e16470afd6541ab445b46"
+SRCREV_machine:qemuarm ?= "56c7106647e505ca1fb15fd433b0bc991024764c"
+SRCREV_machine:qemuarm64 ?= "d8a1ec518ab72fadb60dbe9eed3775b68975defd"
+SRCREV_machine:qemuloongarch64 ?= "d8a1ec518ab72fadb60dbe9eed3775b68975defd"
SRCREV_machine:qemumips ?= "ab0e33fefa2a3d0366b2b8deb7cfb3be2d8dc436"
-SRCREV_machine:qemuppc ?= "c591fbeae3281cba1d1e16470afd6541ab445b46"
-SRCREV_machine:qemuriscv64 ?= "c591fbeae3281cba1d1e16470afd6541ab445b46"
-SRCREV_machine:qemuriscv32 ?= "c591fbeae3281cba1d1e16470afd6541ab445b46"
-SRCREV_machine:qemux86 ?= "c591fbeae3281cba1d1e16470afd6541ab445b46"
-SRCREV_machine:qemux86-64 ?= "c591fbeae3281cba1d1e16470afd6541ab445b46"
+SRCREV_machine:qemuppc ?= "d8a1ec518ab72fadb60dbe9eed3775b68975defd"
+SRCREV_machine:qemuriscv64 ?= "d8a1ec518ab72fadb60dbe9eed3775b68975defd"
+SRCREV_machine:qemuriscv32 ?= "d8a1ec518ab72fadb60dbe9eed3775b68975defd"
+SRCREV_machine:qemux86 ?= "d8a1ec518ab72fadb60dbe9eed3775b68975defd"
+SRCREV_machine:qemux86-64 ?= "d8a1ec518ab72fadb60dbe9eed3775b68975defd"
SRCREV_machine:qemumips64 ?= "ab0e33fefa2a3d0366b2b8deb7cfb3be2d8dc436"
-SRCREV_machine ?= "c591fbeae3281cba1d1e16470afd6541ab445b46"
+SRCREV_machine ?= "d8a1ec518ab72fadb60dbe9eed3775b68975defd"
SRCREV_meta ?= "b5d69636e3e56aa6a5b8f987b4587e7a56c4782a"
# set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll
--
2.43.0
^ permalink raw reply related [flat|nested] 13+ messages in thread
* [meta-yocto-bsp][PATCH 05/06] yocto-bsps: update to v6.18.50
2026-09-17 5:13 [PATCH 0/6] linux-yocto: cosolidated pull request bruce.ashfield
` (3 preceding siblings ...)
2026-09-17 5:13 ` [meta][PATCH 04/06] linux-yocto/7.2: drm/client: avoid spurious vblank-timeout warning bruce.ashfield
@ 2026-09-17 5:13 ` bruce.ashfield
2026-09-17 5:34 ` Patchtest results for " patchtest
2026-09-17 5:13 ` [meta-yocto-bsp][PATCH 06/06] yocto-bsps: update to v6.18.52 bruce.ashfield
2026-09-17 10:19 ` [PATCH 0/6] linux-yocto: cosolidated pull request Richard Purdie
6 siblings, 1 reply; 13+ messages in thread
From: bruce.ashfield @ 2026-09-17 5:13 UTC (permalink / raw)
To: richard.purdie; +Cc: openembedded-core
From: Bruce Ashfield <bruce.ashfield@gmail.com>
Updating linux-yocto/6.18 to the latest korg -stable release that comprises
the following commits:
7cfc41f8e80f1 Linux 6.18.50
8e30f5427f345 mm/rmap: use huge_ptep_get() in try_to_unmap_one()
381a0a524e967 mm: avoid unnecessary use of is_swap_pmd()
6a259dd313043 platform/chrome: sensorhub: Fix dropped timestamp events and log spam
e91d66e5ff661 selftests/mm: fix on-fault-limit false failure under sudo-rs
2d6150e5e6aa6 udf: Fix i_lenExtents truncation on 32-bit kernels
b7eff3f621ef2 timer: Keep debugobjects state consistent in migrate_timer_list()
fecf1e3777526 timekeeping: Check the return value of tk_get_aux_ts64 in __do_adjtimex()
6067c39c2cec1 taskstats: fix cpumask parsing cutting off the last character
ed64aa505875a smack: fix cred UAF in smack_file_send_sigiotask()
a246da20c8e4a signal: avoid shared siginfo namespace rewrites
236c8ecaafc63 sticon/parisc: Detect default STI graphics card for console output
e8527de7fea19 sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[]
cde2d927c29e8 tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout
c3c7e87c76b42 zloop: truncate finished zones to zone capacity
f49e55b1c8fe1 xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc()
ae0c79a852704 w1: ds28e17: reject an oversize length on an I2C block read
165a330a68b5f vsock/virtio: flush works in dependency order
03b81f015dbb2 wifi: mt76: mt7996: validate default EEPROM firmware size
01f2e0da8548f wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames
304470333b7f5 wifi: mt76: mt7925: cancel mlo_pm_work on stop
5fdaf7016d768 wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy
4506e229b2e46 wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex
34a505071d1ff wifi: rtw88: pci: fix resource leak on failed NAPI setup
7364713f0931e wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb()
dc8b0be0ec4d9 wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars()
0c0b374e12d52 wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids
97a1af5ac131b wifi: rtl818x: initialize eeprom_93cx6 struct to zero
b1bbeb8970eeb wifi: mwifiex: Detach sync cmd buffer on interrupted wait
7c257a295e05c crypto: sun8i-ss - Remove crypto_rng interface
8e4f9110aba31 crypto: sun8i-ce - Remove crypto_rng interface
620acb1e8037b wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop
84ba017a1e1ea wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start()
261d7c7610b4b wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control()
7ef23317f9976 i3c: renesas: Reconfigure the DATBAS register on re-attach
9382fcf3a8c44 i3c: renesas: Clean DATBAS register on detach
0093f9fc102ba i3c: renesas: Check that the transfer is valid before accessing it
5697d779577e2 i3c: master: svc: bound IBI payload to the requested max_payload_len
94fb9786d67a8 i3c: master: Fix info leak and UAF in device unregister path
a15a1b95de980 i3c: master: adi: initialize the lock before enabling interrupts
1894fc7a3bab9 dm-pcache: fix use-after-free and invalid seg operations in kset_replay()
10acf740c3adb dm-pcache: fix implicit u8 truncation of gc_percent in message handler
83e3116283ed2 dm-pcache: only hand out initialized cache segments
663ee2f3824a5 dm-pcache: detect a cycle in the last-kset chain during replay
2cd9776fe3f2d dm-pcache: clamp the tail kset read to the segment data region
ffd9a214a94f9 dm-pcache: bound the persisted tail-position offset
91b93fe5cf4d6 dm-pcache: validate on-media seg_num against the cache device size
d8caf96040a06 dm-pcache: validate kset key_num and intra-segment bounds
ab5dcde6fa96b dm-pcache: validate geometry fields from on-disk cache_info
296efdc110b10 dm-switch: use WRITE_ONCE() in switch_region_table_write()
74210fa072960 dm-stats: fix a crash if allocation of per-cpu data fails
c860cd3f40382 arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map()
edf30d65e3ac5 net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry
44dc702be9a9e rust: rust_is_available: warn for `bindgen` < 0.72.1 && libclang >= 22
b5fe67111e63a ovpn: run deferred work on a module-owned workqueue
50f4a793c4ff2 ring-buffer: Fix subbuf resize race with ring buffer readers
22fe01a2e2f7c ALSA: hda/realtek: Fix Lenovo Yoga Slim 7 14AKP10 quirk ordering
37c3210c491ac ALSA: hda/realtek: Enable micmute LED on HP EliteBook 6 G1a p/n: AD3Q9ET#UUG
8acb66d0513de ALSA: hda/realtek: Add quirk for TongFang XxAF5xxx
40ee4224e2fe2 ALSA: virmidi: Check card index validity at probe
7555e83d7738e ALSA: serial-u16550: Check card index validity at probe
d7ef7890e3e35 ALSA: portman2x4: Check card index validity at probe
7ef9ad82d95dd ALSA: pcxhr: initialize mutexes before requesting threaded IRQ
a4e774eeb61ae ALSA: mts64: Check card index validity at probe
cc4215cc2a4b2 ALSA: mpu401: Check card index validity at probe
13d61a920435d ALSA: hda/ext: preserve PPLCCTL bits when clearing reset
7df3194bdb747 ALSA: bcd2000: clear the URB pointers on disconnect
7b3f985584936 ALSA: aloop: Check card index validity at probe
2a6f6fba3bd31 ALSA: 6fire: bound the MIDI event length from the device
94ca4f040ba48 mfd: sm501: Fix potential memory leaks during remove
5e7fe9c6c8c31 mfd: cgbc: Fix teardown ordering in cgbc_remove()
efe0ed4c0f4e8 hwrng: stm32 - Fix runtime PM cleanup on registration failure
cfa186a0857a0 seg6: reset IP6CB after IPv6 decapsulation
288f997067084 net: skbuff: don't touch shared zerocopy state in skb_tx_error()
34ab62c959f5f net: fix spurious TX timeout after dev_activate()
af0ee8f04bea2 net: cap advertised IP tunnel headroom
5bd8b764a610b net/smc: unregister the connection before draining the rx tasklet
313f79149eb33 net/smc: stop killed, freed and out_of_sync sharing a byte
c52a998a223e7 net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link()
0761e49aa78c2 net/smc: fix use-after-free in smc_rx_pipe_buf_release()
d89dc1bd8845c net/smc: fix socket refcount leak in smc_switch_conns()
f950e1b1f0aad net/smc: do not dereference an unset send buffer on the SMC-D teardown path
486c699a8cde8 net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages
b893152a886bb net: ntb_netdev: Count packets dropped on RX refill failure
4fac86e976975 net: ntb_netdev: Avoid double-accounting netif_rx() drops
dfab7171cd391 net: ntb_netdev: Fix TX busy and drop handling
6b6bbc6c878d6 NTB: ntb_transport: Reject oversized TX buffers
894e136b432da NTB: ntb_transport: Fail TX enqueue when the QP link is down
0c4aabc904490 NTB: ntb_transport: Recycle TX entries before client callbacks
f01e6a35c440b net: thunderbolt: Mark the connection down when bringing it up fails
61ff3c353e5d2 net: thunderbolt: Release the Rx HopID that was handed out on mismatch
67a82e6f886be net: ravb: serialize PTP clock teardown
8d4d06d6e2b50 net: ravb: avoid dereferencing an invalid PTP clock
b6b533f83461c net: phylink: correctly validate returned PCS in phylink_inband_caps
0860af127aa79 net: openvswitch: fix nf_connlabels leak in ovs_ct_init
ac73e3af571da net: openvswitch: fix flow mask use-after-free on flow deletion
9c340473f4822 net: l2tp: do not propagate multicast notification errors
62da38b4b3a0d net: ipa: fix stalled modem TX queue after runtime resume
42a33e679ea05 net: ibm: emac: mal: fix NAPI locking
f71087e7c63aa net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO
e098d9cc88596 net: tun: bound receive headroom
32785d75e60df net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition
486577db80789 slip: fix use-after-free in sl_sync()
15d1f3c0dbe7a xdp: fix zero-copy frame layout
8e3763f1ccac3 net/iucv: filter frames in afiucv_hs_rcv() by ingress device
99692252b348c ipmi:msghandler: Cancel work cleanly on an error
53af3a8bae0a9 ipmi: si: Fix NULL pointer dereference after failed registration
d46c97eddcbc5 ipmi: Remove all sysfs files on registration failure
5719431ca2b5f ipmi: ipmb: validate write message length
db8147c5d5ad2 interconnect: Fix use after free in icc_get() and of_icc_get_by_index()
417e02f7b6051 io_uring/query: cap user size passed to copy_struct_to_user
0c12a798078bc platform/x86: hp-bioscfg: warn on element type mismatch instead of failing
a38127df99ae8 platform/x86: hp-bioscfg: pass validated element count to package parsers
95d2f9b5189d0 platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed
b15b334fbc3c0 platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer()
e3c1c5d1c9230 platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password
0f9aad0842488 platform/x86: hp-bioscfg: fix heap OOB read on empty password write
7cd8fe01aba30 platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store()
dea1a41160e70 platform/x86: hp-bioscfg: bound ordered-list parsing by the package count
0cd1530f84e1c platform/x86: hp-bioscfg: advance elem past consumed array elements
0a14d35ef529a platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS
bc9aa5fe21c39 platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails
8178f59d76570 platform/x86/amd/pmc: Propagate SMU errors and validate S2D address
98d91d5b6a988 platform/x86/amd/pmc: Restore msg_port on amd_stb_s2d_init() error paths
5eaf7faa99578 platform/chrome: sensorhub: Bound the EC-reported sensor number
56dc46094973d platform/x86: think-lmi: Fix current password length check
9c28adde051fe platform/x86: think-lmi: Free system certificate signatures
89a076948ed61 platform/x86: think-lmi: Fix certificate thumbprint sysfs output
d7cd3e4d76034 platform/x86: lenovo/ymc: Only match lower byte in WMI lid switch query response
e1b3f89673bd1 platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path
e07a42bb9c909 platform/x86: ISST: Return error during profile addition
62840acc3044f platform/x86: ISST: Validate parameter for frequency and priority
93268bc3cd84f platform/x86: ISST: Validate parameter for core power state
5b032e1dda486 platform/x86: ISST: Validate logical CPU id and clos id
b14db79d02bd3 platform/x86: ISST: Use PP level enable mask
92c5fffa63ad9 platform/x86: ISST: Just allow 2 bits for SST feature enable
c280fcd53b938 platform/x86: ISST: Add a NULL check for sst_inst[]
2550f89589caa mmc: via-sdmmc: stop card-detect handling on probe failure
f7ff3027ef004 mmc: via-sdmmc: cancel card-detect work on remove
82e707eff9e3b platform/x86: ISST: Validate socket ID in clos_assoc ioctl
1889a9156553f platform/x86: ISST: Validate level in perf mask ioctls
22222f92b0a51 platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer
cab2895729516 iommufd: Fix UAF in selftest IOPF reporting
4c33d00ad9a91 iommufd: Release current IOAS on xa_store() failure
436189ee4bb2c iommufd: Avoid locking internal accesses during unmap
45705a6bfdb28 iommu/vt-d: Force requesting ACS when tboot is enabled
364279b5623f7 iommu/vt-d: Fix no_iommu to disable platform opt-in
f80f3acb69164 iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add
2235eafda9b3d iommu/arm-smmu-v3: Manage teardown with devm
d903d99ffd22b iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field
968e9a1f71140 iommu/sva: Set handle->dev before the SVA handle is visible
f532401be9312 iommu/msm: Unwind probe state on registration failure
cfc5c1b2caa17 iommu/amd: Put PCI device after handling PPR faults
238e1f7a1463f PCI/proc: Warn on writes to kernel-exclusive config space regions
c2d4174f49245 PCI/proc: Use file_ns_capable() when checking config space read access
301288f85679a PCI/proc: Avoid spurious runtime PM wakeup on config space accesses
b30713111325e PCI/MSI: Enable memory decoding before restoring MSI-X messages
0e59a232aaa04 PCI/ASPM: Avoid L0s for Realtek RTS525A
39c4dc79d77f8 PCI/AER: Fix mapping of errors to agent & layer
4f887d8ed75f8 PCI/AER: Emit TLP Log only for unmasked errors
6beadccc432cf PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses
7f4db64f0ba7b PCI/sysfs: Fix read byte order in pci_read_legacy_io()
43cf455dd5a9b PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608]
4b575052ea654 PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts()
01c2f0c66bd1f PCI: plda: Fix use-after-free of event IRQs during teardown
5d4bc470330a6 PCI: meson: Fix GPIO state while requesting PERST#
1ad6994853853 PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk
6053d6eacbfd2 PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip
ceafb262475ac s390/dasd: Propagate partial completion length across ERP recovery
6452c13646af7 s390/dasd: Guard sysfs discipline callbacks against unallocated private data
52b331c99baac s390/dasd: Do not complete a failed ESE read as successful
dcce7a06ea690 s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks
aad7247bd35ad power: supply: max17040: synchronize work cancellation on suspend
17d43f64b17e4 power: supply: max17040: drop incorrect I2C functionality check
13fb0477da9b4 power: supply: max17040: propagate register read errors
39b60d615dfa1 power: supply: ucs1002: fix use-after-free on remove
a4460e89d4088 power: supply: twl4030_charger: cancel workers via devm
1b9978433c61a power: supply: rt9455: quiesce delayed work before teardown
ee053561e21ce power: supply: qcom_battmgr: terminate the strings from firmware
06618447029c6 power: supply: qcom_battmgr: fix use-after-free
b3aa1e9509e1b power: supply: lp8788-charger: fix use-after-free on remove
ab6b1ad710bed power: supply: lp8727: fix use-after-free in lp8727_release_irq()
4b1f2be1e1b74 power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS
78be8b7403ff7 power: supply: cros_usbpd-charger: bound the EC-reported port count
86e4fa65368f3 power: supply: charger-manager: register regulators before exposing sysfs
238320ad029a3 power: supply: bq25890: Fix power_supply reference leak
9e1aba34df9a8 power: supply: bq256xx: drain usb_work before freeing the charger
f495808cdd6d9 power: supply: bq24257: fix use-after-free on remove
d02a5794c3dee sctp: fix stream->outcnt underflow on duplicate RECONF responses
7ad8933bca97b sctp: distinguish sequence zero from wildcard in reconf lookup
25419f516ea84 sctp: fix NULL deref on untransmitted RECONF completion
1035bdef1efb9 sctp: drop a chunk if its transport was removed
fa306a40e716c sctp: stop processing a packet once its association is deleted
8a02ad98798fd nvme-tcp: reject a read that transferred too few bytes
3b3d27670c0c8 nvme-tcp: fix host memory disclosure on R2T for a read command
6a01b58263108 nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone
0d4f317b07d6c nvme-pci: disable controller on admin queue IRQ setup failure
67551d8430df9 nvme: zero the discard fallback page
1e456cc2744ee nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path
d662f7fc04fde lockd: fix NULL dereference on lockowner allocation failure
41f0a6d31615f lockd: pin next file across nlm_inspect_file lock-drop
3088e41292fec ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user()
6aeff1636b398 i2c: mxs: fix DMA channel leak on probe error
8d2c120d2d5bf hwmon: (max6621) fix temperature clamp range
9b38d9a2e46a2 hwmon: (max6621) fix negative temperature offset and crit readings
68c59343ad1a7 ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC
f2a1a83487c6c arm64: proton-pack: Restore the nospectre_bhb command-line option
e7c9b1d433b05 arm64: compat: Fix decrementing LDM/STM alignment emulation
15d1feeae07d0 ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion
e41a59fc056f6 openvswitch: only skb_tx_error() a packet we are about to drop
d64a75369cd0f openrisc: fix arbitrary kernel memory access via or1k_atomic syscall
c0c165487a2ea ocfs2: fix readdir position truncation on 32-bit kernels
0608018a71f24 ocfs2: cluster: fix o2hb_dependent_users leak on pin failure
251e38f5af7b2 ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item
ce035f208d68b ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin()
0761d2c949442 ocfs2: validate rl_used against rl_count in refcount block validator
50c4cc9183e11 ocfs2: validate lengths in dlm_mig_lockres_handler
de10cd3b062a5 ocfs2: bound namelen in dlm_migrate_request_handler
71f07b7f90b31 ocfs2: always run deallocs on copy-on-write completion
116d14f29a052 orangefs: skip leading spaces before parsing client debug masks
f796f38a324e8 orangefs: fix double-free of trailer_buf on readdir copy failure
bc6fdd425fdeb PM: sleep: Unblock runtime PM when device prepare fails
6fcb0b745a0b8 ring-buffer: Hold cpu_buffer::lock when resizing a subbuf
8c1ecdcdea738 ring-buffer: Free cpu_buffer::free_page with subbuf_order
2dc510957fe8f ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page()
1c3036a818005 regulator: qcom-refgen: correct the regulator type to CURRENT
20e5fbb8c1a4c regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata
95342d26f9c6b regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer
71d5c41ac583d RDMA/uverbs: Add UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR
4f8bb11dd2ff3 RDMA/ucma: Lock the handler in ucma_write_cm_event()
28ac2dd416482 RDMA/ucma: Lock the handler in ucma_set_ib_path()
a38cd610b24f7 RDMA/ionic: Cap eq_count to the eth driver's interrupt vector budget
85f438382a865 RDMA/cxgb4: Cancel reg_work before freeing device on remove
2a952fb1b20d8 qede: Fix NULL pointer dereference in TPA fragment processing
3f5677d2f8173 ptp: vmclock: prevent read-only mappings from becoming writable
c7e32814a6bf2 remoteproc: scp: Fix device reference leak on failed lookup
37797d5013c9e riscv: unaligned: stop using kthread for check_vector_unaligned_access()
8f392916a3540 riscv: acpi: Handle LPI architectural context loss flags
5343399ed7242 arm64: dts: rockchip: Fix rk3588s-roc-pc audio description
8fc4bafabc065 arm64: dts: rockchip: Fix rk3399-roc-pc-plus analog audio
650d2d5c0df7e arm64: dts: rockchip: fix emmc reset polarity on px30-cobra
5512c23231206 arm64: dts: rockchip: fix eMMC reset polarity on PX30 Ringneck
fe455c13bf01e arm64: dts: rockchip: fix eMMC reset polarity on PP-1516
b6b3e4d5973bd arm64: dts: qcom: x1-dell-thena: mark l12b and l15b always-on
6bb9469c34fff arm64: dts: qcom: sm6115-pro1x: Correct touchscreen GPIO flags
ff23eb4823d82 Revert "arm64: dts: rockchip: Further describe the WiFi for the Pinephone Pro"
eb57632f9418f rpmsg: glink: smem: order FIFO read after availability check
e7143c3f4e5c0 scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()
2a8dd9fd12f3f media: staging/ipu7: fix async notifier UAF on probe error path
7f6956b6dcd66 staging: media: tegra-video: vi: fix probe failure on skipped last port
656d047dc0c29 staging: media: tegra-video: fix of_node_put() on VIP parse errors
5be6d02837d41 wifi: mt76: mt7925: cancel pending mlo_pm_work
e1330d719c047 wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets
b95c33a4e7438 udf: reject VAT indexes equal to the entry count
f84ec84d8d4bc svcrdma: Validate Read chunk positions before reconstruction
a798714b58041 svcrdma: Reject Write/Reply chunks with segcount 0
1949dd1576f7a svcrdma: Reject inline replies that overflow the pull-up buffer
3cf372cec7ab2 svcrdma: Reject connection when transport allocation fails
5aabe070c00e5 svcrdma: Fix unmatched rn_unregister on failed accept
a1c954ca4977a svcrdma: Fix pcl_for_each_segment for empty chunks
a46b35f213c24 svcrdma: Fix offset arithmetic in read_chunk_range
1de391e8b94e3 SUNRPC: wait for in-flight client TLS handshake callback
1f9856af065b6 SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field
7a1d0501cbb96 SUNRPC: reject duplicate CREDS_VALUE options
edeefb111d618 sunrpc: init gssp_lock before publishing proc entry
ebcbd2523a852 SUNRPC: harden gss_unwrap_resp_priv length checks
806584a4b67a7 SUNRPC: harden gss_krb5_unwrap_v2 against short tokens
fa46b6aa7a698 SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat
e769fcde3cc73 sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir
08bc49e054126 sunrpc: defer rq_argp and rq_resp free until after RCU grace period
bd1ef2cfb44d7 SUNRPC: Check svc pool percpu counter allocation
2e861ce2aaa46 SUNRPC: always drain cache_cleaner before destroying a cache_detail
39981133df21c SUNRPC: Restore NUMA_NO_NODE for svc thread allocations in global mode
9d04d64ad1924 sunrpc: route to a populated pool in svc_pool_for_cpu()
de942dd8c2c83 SUNRPC: svcauth_gss: enforce krb5 token minimum length
e0778464049b0 SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry
ad0cce80d4af2 SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow
f1b7b2c7ffa97 phy: fsl-imx8mq-usb: fix typec switch leak on probe error path
704ecd010d4a9 params: fix charp corruption on allocation failure
ff110e85837d7 nouveau/gem: reserve the bo in the info ioctl around the vma lookup
04ab51d4e369a module/kallsyms: fix nextval for data symbol lookup
51887ccd88791 mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction
d82b90a38c2ca mpls: reload header after pskb_may_pull()
50d0aa7d25ba4 module: validate string table section types
3b097416b4cff md: do overflow check for sb->bblog_shift in super_1_load()
0efabe6229dc6 md/raid10: fix still_degraded being inverted in raid10_sync_request()
121d35014e497 mailbox: qcom-ipcc: fix duplicate channel allocation across holes
09e649117c54b libnvdimm/labels: Prevent integer overflow in __nd_label_validate()
627ce4902df1d landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation
a602cd128d17a ipv6: use RCU iterator to dump route exceptions
63f50e9f90d02 ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv()
b8282668d8fa7 ip6_gre: fix hardware header length for NBMA tunnels
b36dfd6e8cff0 ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()
a8af6fbac895f ip: orphan prefetched skbs before multicast forwarding
31e4be21dacee ipip: fix skb leak in collect_md mode when metadata_dst allocation fails
f9182a85991a0 jbd2: check need_resched() when skipping busy checkpoint buffers
71c6b872c7464 jbd2: bound shrinker scans by examined checkpoint buffers
30e8cb8598aa4 kasan: fix cache shrink race with CPU hotplug
15deb4e33f474 Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request
657054159d83a Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative
94d548fc264a2 Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative
1bad0896cbc06 Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection
d0b28e9655f4b Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb
68e7a31abc88b Bluetooth: hci_conn: re-enable advertising only for peripheral role
946d76db77ee5 Bluetooth: RFCOMM: serialize security confirmation handling
49fd7116f76b8 Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready
ec3992e38f777 Bluetooth: hci_uart: Fix false success return in hci_uart_setup()
62100186f1771 Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative
1ed5982c53699 Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378
c674c504bfdd0 cxl/pmem: Format the nvdimm serial number as unsigned decimal
14d52c15d5d99 cxl/features: bound fwctl command payload to the input buffer
2924b2e365148 cpufreq: schedutil: Fix rate limit overflow
a807a9ef87ad0 coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior
ac4a5eb8b002a dm array: reject an array block whose value size is not the caller's
b33f76d33aaea dm array: validate array block headers on read
644140527ae49 dm raid1: reserve space for NUL-terminator in build_constructor_string()
36ff918637e35 dm-era: fix shadowed superblock leak on take-snap failure
49694a363f7ec dm-io: report non-retryable errors separatedly
9493ac67623d4 dm-io: clone the source bio instead of copying its biovec
272fcb4ba6fab bpf: Harden bloom filter sizing and indexing on 32-bit kernels
c9189693db47a buffer: avoid tail commit walk for uptodate folios
dbfecc8a6631c bpf: Disable preemption in __bpf_get_stack
6886642414f59 bpf, x86: Fix per-CPU address resolution into an extended register
49dcefa83c8ab bnxt_en: Write doorbell when linearizing skb fails
4d36e38e48340 bnx2x: fix double free in bnx2x_init_firmware() error path
c21fa79301d7d Bluetooth: eir: Fix OOB read in eir_get_service_data()
f609eac02d110 Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728
bce588b4ca081 Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU
aa7b93fe98ba7 Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU
ce76ca5fb2794 block: set QUEUE_FLAG_DYING unconditionally in blk_mark_disk_dead()
84858671842ae auxdisplay: charlcd: cancel backlight work on registration failure
c2e3dccd68706 ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes
fdc0a5e2cbace ARM: 9477/1: Disable broken eBPF JIT on the Risc PC
87d07aa5d38b6 alpha: marvel: Fix lock ordering in init_io7_irqs()
9e1eefc01912c alpha: marvel: Fix irq_set_status_flags to use correct IRQ number
2fd984c44e3e4 alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write()
6d4ed2fd022bc ACPI: pfr_update: fix stack buffer overflow in query_capability()
452eb28e03015 ACPI: APEI: GHES: fix ARM section length accounting after header
b7476b29b6961 ACPI: APEI: Fix ERST timeout unit conversion
c735dbce7ad03 acpi/apei/ghes: Use raw_spinlock_t for CXL CPER work locks
9ad8821573a36 accel/rocket: Fix error path handling in rocket_job_run()
3043230296653 accel/rocket: initialize job domain before cleanup paths
c1a5bf1b6e1d5 accel/rocket: fix NULL dereference and integer overflow in rocket_job_push()
a3c65af20cceb hugetlb: only adjust reservation during unmapping if mapcount is 0
4e019e5e247bf hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device
137c61a6cfd96 fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration
0c3f4544ff387 forcedeth: fix off-by-one when saving/restoring non-PCI config space
466a8af0dee2c fbdev: uvesafb: unregister connector callback on init failure
3bcab9b21f71d fbdev: ssd1307fb: defer I2C transfers from damage callbacks
3c1b5809615c3 fbdev: pvr2fb: correct user pointer annotation and sentinel initializer
76818e81cfcae fbdev: omapfb: panel-dsi-cm: initialize lock before registering display
2f66f8ceefc25 fat: restore original value when fat_ent_write failed
66aa9a9e6481b fanotify: fix use-after-free of file range info
92895a14329cc efivarfs: Rate limit statfs() handler
ce568f6e025df ecryptfs: show filename encryption options
9319706316a8e ecryptfs: release message context on send failure
b31da1ecf1392 ecryptfs: reject too-small tag 70 packets
14cb36a500a5a ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet
e5d254e654f23 ecryptfs: pass packet set buffer size to parser
0d9636ecba34b ecryptfs: hold msg ctx list lock when cleaning daemon queue
c1bc956a615d0 ecryptfs: fix tag 11 packet exact-fit size check
98b890563424a eCryptfs: bound the packet-length peek to the user buffer
7ccb94901f38a fs/ntfs3: bound page_lcns[] index by the log record
376ee45659a4b fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()
2d94ffc9d7b5b fs/ntfs3: validate dirty page table on log replay
5333e18e6b425 eventfs: Initialize ei->children and ei->list in init_ei()
b2301bdb4b3ed HID: intel-thc-hid: intel-quickspi: fix autosuspend cleanup during teardown
99f3e197920df HID: intel-thc-hid: intel-quicki2c: fix autosuspend cleanup during teardown
72706b44b6656 HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer
6fcefe71aeb52 HID: intel-thc-hid: intel-quickspi: validate report size before copy
127de5919820f HID: mcp2221: validate report size in mcp2221_raw_event()
c99ba6c234d4d HID: mcp2221: stop device IO before hid_hw_stop
01d9874e84d3a HID: universal-pidff: stop the device when force-feedback init fails
114a58640aaf3 HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind
f3f37b937a6ea HID: sensor: custom: Fix field sysfs group cleanup on failure
da00eac19feef HID: roccat: free buffered reports when destroying device
471f4a939c66d HID: picolcd: clamp eeprom debugfs read to bytes actually received
79465a30050da HID: corsair-void: Check size of status and firmware events before reading them
e78973fe3ef59 HID: apple: preserve keyboard backlight across T2 resume
846f0709559b9 smb: client: harden DFS cache against invalid target hints
17a1922ada873 smb: client: fix copy-paste error in WSL EA length accounting for $LXDEV
1f824f61d1df5 smb: client: fix ALIGN() overflow in symlink_data() error context loop
9ab46a13798a6 smb: client: clear ce->tgthint in free_tgts()
8b9b10fe5b8b4 cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC
c2a0dcb5a7a15 cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0
4f18c9e7ee464 cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size()
636a99bab36ba audit: avoid dropping live tree ref on fsnotify rule autoremove
25128202a8df5 btrfs: do not overwrite NODATASUM flag when removing NODATACOW flag
f42efd634c0ae btrfs: fix extent map leak in NOCOW direct I/O write
8a64baeb5bbb7 btrfs: drop recovered reloc root refs on recovery failure
ec32015a955c5 ceph: fix leaked inode reference on writeback abort at umount
37d6edb2f03b2 ceph: do not repeat ceph_trim_dentries() if no progress possible
1dd356310b166 ceph: bound xattr value length in __build_xattrs()
58c2d3e954c13 ceph: bound num_export_targets array for mds info v2/v3
c37db86d2b5e9 ceph: bound MDSCapAuth path and fs_name decode in handle_session()
06fb5e623cdc2 ceph: bound copied dentry name length in NFS export get_name
4d298880f82c4 ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode
fe46746087b5b ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock
00562ccd4e88d libceph: reject buckets with mismatched CRUSH ids
2571b35883268 libceph: validate OSD extent maps before cursor advance
b413ec5b23e34 NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup
4804c58f73a80 NFSD: Prevent lock owner use-after-free during client teardown
b56d2c5f01cdd nfsd: revoke copy-notify stateids before dropping their reference
dbc11a12aa545 nfsd: reject reclaim LOCK after RECLAIM_COMPLETE
ad02d095439f8 nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE
54e02f5e32c52 nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops
4ae5d7490ae6a nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd()
b57bd8cb739cb nfsd: initialize DRC hash table before registering shrinker
a4d7fedcaaf33 nfsd: initialize copy-notify stateid before publishing it
763c0bad87236 nfsd: hold rcu across localio cmpxchg retry
b3bff820d068e nfsd: gate nfs3 setacl by argp->mask
f951b22dbeec4 nfsd: gate nfs2 setacl by argp->mask
41ebca28e17f8 nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo
0380129b1373c nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget
4106d7a6aaf1e nfsd: fix version mismatch loops in nfsd_acl_init_request()
9b4e5e9ba5ae1 nfsd: fix stale s2s_cp_stateids IDR entry for async COPY
2ebbf4e3e9cf5 nfsd: fix reply size estimate for GET_DIR_DELEGATION
cf081015a0d1b nfsd: fix refcount leak in nfsd_file_lru_add on insertion failure
3c5119b799a7f nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs
424d5c95108a4 nfsd: fix nfsd_file leak on inter-server COPY setup failure
360e1b9e3f316 nfsd: fix netlink dumpit error handling for rpc_status_get
65c79d9bb3717 nfsd: fix FL_SLEEP being set unconditionally for all LOCK types
c1ae0f973bcba nfsd: fix dentry ref leak on V4ROOT export filehandle lookup
a631a26a8777b nfsd: fix cpntf publish race in nfs4_init_cp_state
607a56fea772c nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke
00843074d9b84 nfsd: drop the stateid, not the stateowner, on seqid_op replay retry
72d40b103bb03 nfsd: don't free session slots that are still in use
6703199f4d7e7 nfsd: defer vfree of compound ops to fix rpc_status UAF
631b7d5dbbba8 nfsd: defer setting NFSD4_CALLBACK_RUNNING in deleg_reaper
e879148867bd4 nfsd: clear opcnt on compound arg release to prevent OOB read
b137930ee52e3 nfsd: clear CALLBACK_RUNNING on failed delegation recall queue
b42dc26a14b4a nfsd: check client ownership when cancelling a copy-notify stateid
311f7d9266309 nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref
1aea0482b98ec nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry
bff024551a713 nfsd: add filehandle match check to nfsd4_delegreturn()
533964d420d38 nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()
895a485cd3758 nfsd: validate symlink target length in NFSv4 CREATE
2aca70c18c5f5 nfsd: validate sockaddr length per family in listener_set
7e7b93da7fa2e nfsd: validate nseconds in TIME_DELEG decode paths
7ff8d6363cfff nfsd: size fh_verify server sockaddr slot by xpt_locallen
1e4795766719f nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations
8277d4a11ae2c nfsd: sample writeback error cursor before async COPY loop
fc83f30731dd2 nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types
591134e059e34 nfsd: Reset write verifier when async COPY writeback fails
467d56fd3ff57 nfsd: release path refs on follow_down() error
f164eb52b6f3c nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown
dc803d46a8b90 pNFS: Fix EBUSY check in pnfs_layout_need_return
36e3f13bf0728 NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path
59baf45a06435 nfsd: guard nfsd_serv deref in nfsd_file_net_dispose
7ef182a8fe9c1 NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check
4ed8d2317aef2 NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock
75d13317f163a NFSD: Fix off-by-one in DRC bucket pruning limit
e547b06234f88 NFSD: Encode only the status in NFS-ACL v2 GETACL error replies
d8352da196349 NFSD: check truncate permission under inode lock
f3adf16435173 NFS: fix delegation_hash_table leak when nfs4_server_common_setup() fails
5215e734bf7cb NFS/localio: fix ref leak on nfs_uuid_add_file failure
344ae0e232d4f zsmalloc: account for handle size in class lookup
923578d0f0d07 zram: validate deflate params
a1dc246f98bb9 ubifs: fix out-of-bounds read in signature length check
14afe18655c09 phy: rockchip-samsung-dcphy: fix out-of-range max_register
e892f05f1f790 PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io()
9253cfc5a85be of: fix out-of-bounds read in of_alias_scan() stem parser
448636c745a3f nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation
8c14472431e27 media: vicodec: fix out-of-bounds write in FWHT encoder
0c260d3f97e52 media: cec: stm32: prevent out-of-bounds write on RX overflow
7d658da725ea8 lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()
9f43499ce6458 HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature
827ec385458ad fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write
34e88f5361464 usb: gadget: f_fs: Prevent deadlock during ep0 read loop
9897b7da8c0ad usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()
dbe2762ae8e54 usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init()
6bcd9ee6ad698 usb: gadget: f_tcm: fix deadlock in usbg_make_tpg()
a15c2acd30834 usb: gadget: midi2: remove default configfs groups on teardown
64005cf3e897e usb: gadget: snps_udc_plat: clean up PHY on probe deferral
4e747c864a885 usb: gadget: u_audio: Fix use-after-free on sound card disconnect
14fa29f3be066 usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion
ebb840d982a61 usb: typec: thunderbolt: Disable work before freeing tbt on remove
d793bd8422e78 usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive()
12414bbd3e3f3 USB: phy: fsl-usb: fix missing static keywords
51a311eb97e91 usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed
448e95c0f3eaa usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition
316abfe39dce7 usb: dwc2: gadget: Exit partial power down state when changing USB pull-up
78f5c6e6aef9a staging: greybus: hid: fix SET_REPORT return value
28b932202fcdb serial: imx: serialize imx_uart_ports[] lifetime
aad08b5f67d2a Revert "media: v4l2-dev: fix error handling in __video_register_device()"
e6e925cc1f806 rapidio: mport_cdev: fix use-after-free in dma_req_free()
c3d4be91c6fce powerpc/powermac: fix OF node refcount
29e634a18957a misc: nsm: bound the device-reported response length
ba69d892ff4e4 device property: fix infinite loop in fwnode_for_each_child_node()
4cd24873ab9fd cdx: Fix double free when sysfs file creation fails
b1a49c22de01f tracing: Fix use-after-free with same-name named triggers
ddbe921ed16a0 tracing: Fix use-after-free in trace_pipe read on sub-buffer order change
cdb6fb6cf1a7a tracing: Fix logged instance name on creation failure
adadf4192f700 tracing: Fix crash passing ERR_PTR to kthread_stop()
25a0758cf6bdb tracing/user_events: Clear copied tracing state before fork duplication
b503a61d5d392 hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start()
9b51dcb4f2305 x86/tdx: Fix zero-extension for 32-bit port I/O
c4a2215487081 x86/tdx: Fix off-by-one in port I/O handling
b9ae969e6f1e3 x86/locking: Use sfence for wmb() if SSE is available
08b4cdef3c2ef x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg()
968eea4659420 tools/compiler: match glibc 2.42 definition of __attribute_const__
d4bf3a74e2bae mm: vmscan: fix node reclaim ignoring swappiness parameter
461d23368f296 mm: page_alloc: fix non-movable reclaim storm in defrag_mode
d435ba3c21a02 mm: page_alloc: move capture_control to the page allocator
0df04778ea14a mm: page_alloc: __GFP_FS lockdep annotation for direct compaction
b3d4b65085ef5 mm: mempolicy: fix automatic numa balancing for shmem
5d866086d5f8d mm: memcontrol: update state_local when flushing NMI stats
95d87030cae77 mm: memcg: stop reclaim when a limit update is superseded
680b93894ddf6 mm: memcg-v1: fix memsw and TCP failcnt accounting
d0943afb5ed8b mm: memcg-v1: fix wrong linux-mm list address in deprecation warnings
295f5a61d3aea mm: compaction: support non-movable compaction for pageblock requests
ef765a2e4f579 mm/zswap: fix global shrinker when memory cgroup is disabled
3fd5023998630 mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec()
895cd4ecbb2e0 mm/pagewalk: fix stale walk->action escaping walk_pmd_range()
45489d4f95802 mm/mm_init: deferred_grow_zone(): fix out-of-range first_deferred_pfn
5dc0daff0341c mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()
3fc8044251de2 mm/kmemleak: avoid soft lockup when scanning task stacks
2cfa9ae90813b mm/gup: fix always draining LRU caches in collect_longterm_unpinnable_folios()
d423737dca23f mm, swap: ratelimit bad swap entry reports
f2c14f4d427d1 include/linux/list.h: mark list_add and __list_add as __always_inline
28069434aef66 apparmor: fix out-of-bounds write when null terminating a label vec
587a6a92b93ec apparmor: fix cred UAF caused by begin_current_label_crit_section()
753c978f2400f KEYS: trusted: Fix TPM teardown ordering
0a10989de6103 rust: kernel: list: fix incorrect pop_back example comment
138722d631acf rust: bug: skip arch-specific asm in `testlib` builds
2bf5e8f7c9bf4 timers/itimer: Zero-init old itimerval before copy to userspace
e6da8a0f39769 powerpc/pseries/iommu: switch to Default DMA window during kdump
c03114634d342 fs: fix user path of nested backing files
bf38be01d43c4 clocksource/drivers/timer-sun4i: Advertise a real minimum delta
d53c29a89a15e clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path
312f85fdd029b alpha: don't leak hardware-fabricated FP exception bits to user space
c25b2aa077d5b rust: time: fix as_micros_ceil() rounding near i64::MAX
7d00a3ff6244f alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally
4628e40c9ca79 drm/amd/display: Prune per-tile Timing from Apple Studio Display Primary Tile
7d860bed13369 drm/amd/display: hide Apple Studio Display secondary tile
c6b915f0df311 drm/amd/display: Refactor amdgpu_dm_connector_detect (v2)
a1fa3d1197cc2 drm/amd/display: Skip PHY SSC reduction on some 8K panels
d5c9d19b0ff2f netfs: Fix missing locking around retry adding new subreqs
ce493f9261cd3 platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmi_dev_evaluate_int()
2ab18de5ebb11 drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths
24ebaf6676ae4 nsfs: tighten permission checks for handle opening
ea150ffa9fc9f bpf: Fix incorrect pruning due to atomic fetch precision tracking
5d562153b4719 ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS
a8bbb2a60513b fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free
5fc3d921512d3 wifi: ath11k: fix memory leaks in beacon template setup
8527ac1bce87a wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req()
c79ef3342632e perf/x86/intel/uncore: Fix die ID init and look up bugs
1c732c6b94f0f Linux 6.18.49
5f08c45bdcfd2 usb: usbfs: fix use-after-free of usb_device in usbdev_release()
22edb67861272 wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb
b4cb8081cf80f USB: c67x00: fix use-after-free in c67x00_add_iso_urb()
683df50fff0f5 USB: serial: spcp8x5: drop broken carrier detect support
2ef5560387f2c USB: serial: option: fix slab OOB read in interrupt URB callback
6d3e202670b81 ALSA: usb-audio: Complete cleanup after system-resume errors
91919b3b99ab7 ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()
7eb02825b3684 usb: core: Strengthen error handling in hub_hub_status()
d80b946804674 usb: core: Add lock to usb_wakeup_notification()
935eeba276012 KVM: s390: vsie: zero stale crypto bits
545a6b9c91e2b crypto: qce - Remove unsafe/deprecated algorithms
182f16a20d329 crypto: mxs-dcp - fix source scatterlist length access
2f65718b9c109 crypto: qce - fix CCM AAD buffer underallocation
731a5b6fb4c17 crypto: krb5 - use kfree_sensitive() for derived key buffers
302ecd1106065 crypto: atmel-tdes - use scatterlist length before DMA mapping
4c00183209420 crypto: qcom-rng - Allow zero as a random number
14d9ee8286460 crypto: qcom-rng - Remove crypto_rng interface
070b73019a534 crypto: qcom-rng - Enable clock in hwrng case
5545de5050cbc crypto: virtio - bound the akcipher result length
e90bc78125cd7 kunit: irq: Continue increasing hrtimer interval for longer
34f3c35dd13a3 mm/swap: reject swapon() on filesystem-level encrypted files
6fa88d11983c6 netfilter: nf_tables: don't queue packet path object notifications
07ee91e6b7b0a netfilter: nft_set_pipapo_avx2: add missing vzeroupper
a8820c8a77183 vxlan: keep the last remote linked during FDB flush
916ec741e65af batman-adv: reject unrepresentable multicast TVLV offsets
3e4476e58343f ipv6: seg6: clear IPv4 control block on IPIP decapsulation
c069f29da7232 net: bridge: mcast: fix use-after-free of a master VLAN's multicast context
50229d334558a xfrm: bound nat keepalive state collection
cf67361e78dca xfrm: fix xfrm_state_construct() auth-trunc leak
6733ae71268a2 xfrm: ah6: validate routing header segments_left
5c86c895d1cac xfrm: avoid lock inversion in nat keepalive work
328e40aa774b4 xfrm: drop ESP-in-TCP packets with no ingress device
24efebecf415b xfrm: espintcp: fix UAF during close
73fde8fe4469f net/tcp-ao: fix use-after-free of current_key on reconnect to another peer
70051a57786d5 tcp: fix AO info use-after-free in tcp_ao_connect_init()
4527747760239 net/tcp: fix TCP-AO key deletion in VRFs
b5d1534db32af x86/CPU/AMD: Carve out a Zen5 models range
3d950e98f74af gtp: serialize PDP context updates
fadbc1ed2a872 tls: device: fix out-of-bounds write in tls_append_frag()
0b0a668febb62 KVM: SEV: Wire up kvm_x86_ops.gmem_xxx() if and only if CONFIG_KVM_AMD_SEV=y
9a45e7b0b140a KVM: SEV: Mark vCPU RUNNABLE after AP_CREATE, even if VMSA is unusable
a3d45c2d645c6 KVM: SEV: Extract loading of guest-provided VMSA to a separate helper
2de20fea62043 KVM: SEV: Track the GPA of the guest-controlled VMSA used for SNP guests
dd1638c95163d KVM: SEV: Drop FOLL_WRITE for encrypted region registration
85aa61fedcb4e usb: gadget: f_tcm: keep port count until LUN teardown completes
3f6face69034f usb: usbtest: disable dynamic ID support
776e85fda752f fuse: fix invalidate lock leak on open O_TRUNC DAX failure
1758730d9eaa3 fuse: fix invalidate lock leak on setattr writeback failure
0f127d522dbcb xhci: dbgtty: Fix unregister on tty_alloc_driver() failure
0d0faf3cc44c4 xhci: dbgtty: Fix unregister on tty_register_driver() failure
45dbddc389c59 usb: xhci: Handle USB3 port events when there is one roothub
56f20a406cc3b usb: xhci: Handle bogus TRB pointers in Missed Service Error events
9786c42df8efb accessibility: speakup: unregister tty ldisc on later init failures
8ec7271e05df7 fpga: dfl: fme: add error handling
6106fb7962a00 ksmbd: harden file lifetime during session teardown
a8e1f970f9040 HID: ft260: fix stack-use-after-return write in I2C read race
30c37ac21a458 HID: ft260: validate i2c input report length
8b5debb6252cd HID: asus: fix missing hid_is_usb() check
d0754db7883c8 HID: asus: simplify RGB init sequence
70589b0c005db HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event()
e22f4494cc948 io_uring: defer eventfd signaling when queued from a wakeup handler
0bcec5dda029c io_uring/rsrc: improve regbuf iov validation
e973a371d35a2 io_uring: simplify IORING_SETUP_DEFER_TASKRUN && !SQPOLL check
2b7c6b90ce801 io_uring/futex: only mark private futex waits as inflight
b61ebb2826ca1 powerpc/hv-gpci: fix preempt count leak in sysfs show paths
f2192741bdfc7 veth: fix OOB txq access in veth_poll() with asymmetric queue counts
34aef83af724a selinux: switch two allocations to use kzalloc_objs()
caacbfb367210 ASoC: nau8821: Cancel pending work before suspend
0599aa23734c4 riscv: Fix register corruption from uninitialized cregs on error
85dc711f742b1 bpf: Fix use-after-free in offloaded map/prog info fill
13d20517bee1c ASoC: nau8821: Cancel delayed work on component remove
9ebaeeb6c2d42 selinux: require a class's permission values to cover its permission count
dfc59a062c386 selinux: reject a permission value exceeding the class permission count
42c5747a9f839 selinux: more strict policy parsing
4ac3cc8a14db6 selinux: use u16 for security classes
71ecdc1ba07fd Revert "selinux: reject a permission value exceeding the class permission count"
64561afb42d83 nvme-tcp: fix usage of page_frag_cache
c0a9bd5fca0b5 KVM: x86/mmu: Check write tracking in all address spaces
8be5f23ae9490 drm/xe/guc_ads: use uncached mapping for UM queue BO
a65b52f6cdc92 drm/xe/guc_ads: allocate UM queues in VRAM on dGFX
af2d3f6f29b07 drm/xe/guc_ads: allocate UM queues in a separate BO
bdf5deccfbf9f RDMA/rxe: Fix OOB in free_rd_atomic_resources()
ffa4f0be69656 RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
---
meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.18.bbappend | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.18.bbappend b/meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.18.bbappend
index 3fd33fc..1b93ec2 100644
--- a/meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.18.bbappend
+++ b/meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.18.bbappend
@@ -8,4 +8,4 @@ KMACHINE:genericx86 ?= "common-pc"
KMACHINE:genericx86-64 ?= "common-pc-64"
KBRANCH:genericarm64 ?= "v6.18/standard/genericarm64"
-SRCREV_machine:genericarm64 ?= "5b1e83ae84e1bbe2ab8197bf2ea3c24302f7d1e3"
+SRCREV_machine:genericarm64 ?= "ed4c9c267bfed1a73adf650106af110034b25e2f"
--
2.43.0
^ permalink raw reply related [flat|nested] 13+ messages in thread
* [meta-yocto-bsp][PATCH 06/06] yocto-bsps: update to v6.18.52
2026-09-17 5:13 [PATCH 0/6] linux-yocto: cosolidated pull request bruce.ashfield
` (4 preceding siblings ...)
2026-09-17 5:13 ` [meta-yocto-bsp][PATCH 05/06] yocto-bsps: update to v6.18.50 bruce.ashfield
@ 2026-09-17 5:13 ` bruce.ashfield
2026-09-17 5:34 ` Patchtest results for " patchtest
2026-09-17 10:19 ` [PATCH 0/6] linux-yocto: cosolidated pull request Richard Purdie
6 siblings, 1 reply; 13+ messages in thread
From: bruce.ashfield @ 2026-09-17 5:13 UTC (permalink / raw)
To: richard.purdie; +Cc: openembedded-core
From: Bruce Ashfield <bruce.ashfield@gmail.com>
Updating linux-yocto/6.18 to the latest korg -stable release that comprises
the following commits:
8f3741e6feb04 Linux 6.18.52
0d0c637410df6 wifi: mt76: fix airoha_npu dependency tracking
637e0ea73f690 staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction
7d4024037ee30 staging: rtl8723bs: os_dep: avoid NULL pointer dereference in rtw_cbuf_alloc
7bca33d6f6e00 pinctrl: airoha: an7583: add missed gpio22 pin group
9aa021b63ab73 ACPI: processor: Add cpuidle driver check in acpi_processor_register_idle_driver()
4ba887b2bacc8 ACPI: processor: idle: Remove redundant static variable and rename cstate check function
e1cfb85ab258c ACPI: processor: idle: Move max_cstate update out of the loop
fcc577939931a ACPI: processor: idle: Remove redundant cstate check in acpi_processor_power_init
8ddc1da773644 cpufreq/amd-pstate: Allow writes to dynamic_epp when state isn't modified
9c178eba1542a cpufreq/amd-pstate: Use "epp_default_dc" as default when dynamic_epp is disabled
bf897a1fa96cb cpufreq/amd-pstate: Add support for raw EPP writes
b461ae97f2e44 cpufreq/amd-pstate: Add static asserts for EPP indices
8f8db9af24b9a cpufreq/amd-pstate: Fix some whitespace issues
a3d24aed0a3e7 io_uring/waitid: fix KCSAN warning on io_waitid->head
934ffdd1cdef2 io_uring/waitid: use io_waitid_remove_wq() consistently
798283cd0fe7b net/sched: fq: clamp quantum and initial_quantum in change path
9289c94fcfe04 Bluetooth: btmtk: hide unused btmtk_mt6639_devs[] array
2151b2bcf6fce tcp: reject non zerocopy devmem tx
384907f29dd1e ipmr: Add __rcu to netns_ipv4.mrt.
7708973e268c4 ipmr: Call ipmr_fib_lookup() under RCU.
5029156b99bd9 erofs: fix EFSCORRUPTED on multi-algorithm images in z_erofs_map_sanity_check()
a295f239dee45 erofs: relax sanity check for tail pclusters due to ztailpacking
bf8601feeb469 block: fix merging data-less bios
43a4c2afcb5ab blk-mq-dma: always initialize dma state
f54f709bfb5e4 block: save page offset gaps in cloned bio
0268313b5de3e integrity: Eliminate weak definition of arch_get_secureboot()
60aee9cbb82e0 apparmor: fix kernel-doc comments for inview
caf1e44e672b5 pinctrl: airoha: an7581: fix incorrect led mapping in phy4_led1 pin function
0ca274a45eaea pinctrl: airoha: Fix AIROHA_PINCTRL_CONFS_DRIVE_E2 in an7583_pinctrl_match_data
2e7c3c433fd79 pinctrl: airoha: an7583: add missed gpio32 pin group
46bae3189cf5c pinctrl: airoha: an7583: fix misprint in gpio19 pinconf
591424f9f5d51 pinctrl: airoha: an7583: fix incorrect led mapping in phy4_led1 pin function
cf2e698957b65 pinctrl: airoha: an7583: fix gpio21 pin group
6d0bcb2153128 pinctrl: airoha: an7583: fix phy1_led1 pin function
5331bf0d5ca05 pinctrl: airoha: an7583: remove undefined groups from pcm_spi pin function
fc00a596268a0 phy: renesas: rcar-gen3-usb2: add regulator dependency
e97bd4417010c perf annotate: Fix build with NO_SLANG=1
fe44ae31ca78a wifi: nl80211: fix UHR capability validation
3ca32b70e825f wifi: mt76: npu: Add missing rx_token_size initialization
b0af766d64bc2 wifi: mt76: restrict NPU/PPE active checks to MMIO devices
15a9acc5e6553 s390/kexec: Disable stack protector in s390_reset_system()
adf8f940e450d selftests: vDSO: getrandom: Fix path to s390 chacha implementation
dffea40a832bb cpufreq/amd-pstate: Fix setting EPP in performance mode
3b4b39f8bfb9b cpufreq/amd-pstate: Add POWER_SUPPLY select for dynamic EPP
c6584e98b60ee cpufreq/amd-pstate: Grab "amd_pstate_driver_lock" when toggling dynamic_epp
eee67e91751e0 cpufreq/amd-pstate: Return -ENOMEM on failure to allocate profile_name
c9d79e27eaefb cpufreq/amd-pstate: Reorder notifier unregistration and floor perf reset
70c8c8b50d80f cpufreq/amd-pstate: handle missing policy in dynamic EPP callbacks
be5d0964da97f usb: ucsi: huawei_gaokun: move typec_altmode off stack
65d97c3d9060f serial: 8250: Ignore flow control on suspend/resume with no_console_suspend
a79848859b1a8 platform/x86: lg-laptop: Check ACPI_COMPANION() against NULL
bd8946ddbe9a3 perf tests kvm: Avoid leaving perf.data.guest file around
3641a3aed2ecc tracing: Move d_max_latency out of CONFIG_FSNOTIFY protection
3e3fb150abad9 mtd: rawnand: pl353: Fix debug prints
9988c1c9e0d1c dm-integrity: fix buffer overflow with keyed discard
e54be9aa503a0 net/sched: sch_htb: limit htb_classify inner-class filter hops
b8f08a94b2a4a tcp: fix corruption of urgent data on multi-segment retransmit
ff7f77a234f7b usb: atm: usbatm: fix invalid ci_range initialization
1f9639caeece7 net: fec: only stop PTP if it was initialized
ddbc5dc5a2e29 slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()
1a5c26e586481 net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup
2ea42936416b2 net: stmmac: restore NET_IP_ALIGN in the RX DMA offset
6257ec22f6173 net: stmmac: selftests: Account for the UC filter list for filtering tests
f09abff67d1f2 net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering
edce4b5a76dd7 net: stmmac: dwmac4: Account for the primary MAC address for UC filtering
f64902e8ae1fa net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering
57f598f312f91 net: stmmac: selftests: Check multiple MMC counters
66cfb39635529 net: airoha: npu: fix missing streaming DMA mask
99036078abd96 selftests/arm64: Fix MTE prctl TAP plan
d3bb129dad152 selftests/arm64: Treat KSM merge_across_nodes as optional
1c6940784c556 selftests/arm64: Print missing MTE TAP headers
2f0c97b1a32fb ALSA: control: Don't add invalid kcontrols to LED layer
67dd5a6c449b4 netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited()
3b1066a859dbb netfilter: xt_HL: add pr_fmt and checkentry validation
d5497644329d3 netfilter: nf_tables: move hardware offload step after building the chain blob
0e5ed3b98d1d8 virtio-net: Ensure that TCP packets don't overflow gso_segs
023f06c98e031 drm/xe/xe_gt_idle: Add CCS to the powergating info print
c826e980f2767 net: stmmac: selftests: Pass the IP proto mask in the TC selftest
30be8c9d598f3 net: wangxun: use BIT_ULL() to prevent shift overflow on 32-bit archs
84180988a455f net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure
557599edb522a net: ethernet: sun4i-emac: Fix IRQ error handling
626614df9080d samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify
8de8e5476be39 samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-modify
6d1c6f228854a libceph: validate banner payload length
792bfe803228c ceph: revalidate ki_pos for O_APPEND writes after cap acquisition
33b3dc47202d0 ceph: Fix ERR_PTR(0) in ceph_mkdir()
10a36512c21f8 ASoC: dapm: Fix off-by-one check on the second enum channel
5449f715f24e8 apparmor: policy_int make sure list heads are initialized before fail path
59fba1d249dce apparmor: Replace sprintf/strcpy with scnprintf/strscpy in aa_policy_init
d48197cbd5d34 crypto: acomp - allocate async request context when cloning
fdc992f4bc45f tpm: st33zp24: Validate locality read result
14feaa498c20c tpm: st33zp24: Return zero on status read failure
96bc345a3f175 net/sched: sch_teql: restore skb->dev on the slave failure path
aeb8196ecb951 net/sched: sfq: clamp quantum to avoid signed overflow soft lockup
99770b5d8e0e1 net/sched: hhf: clamp quantum before hhf_change() to avoid overflow
044fa2498bbc2 net/sched: fq_pie: clamp default quantum to avoid signed overflow
7ca8a8717a9fe net/sched: sch_codel: clamp default mtu to avoid disabling CoDel
dfb4b61db8869 net/sched: fq_codel: clamp default quantum and mtu
f6b3e3848a5fc net/sched: fq: add overflow bounds to quantum and initial quantum
76c847e80d2b6 net: fix a resource leak in copy_net_ns() error handling path
d1c084d4e9f03 net: core: check skb_frags_readable before uncloning in skb_copy_ubufs
1719865b20b22 net/sched: act_skbmod: fix length calculations and avoid invalid header warnings
3e07d284ef085 selftests/proc: make proc-maps-race work with READ_IMPLIES_EXEC
4e70c064213ef maple_tree: fix argument name in header
64ae85a3a29de maple_tree: catch race in mas_alloc_cyclic()
005343e0c3294 selftests/mm: skip COW tmpfile cases when fallocate() is unsupported
3d1b2d84b4909 cifs: fix clearing stats for fastest execution of each smb2 command
b003d5b4e46ca octeontx2-pf: fix NULL deref of af_xdp_zc_qidx on rep setup
bf2b8130723ef net/rds: use wq_has_sleeper() in rds_cong_map_updated()
d218ea7df6eba net/sched: act_ife: Only operate on Ethernet frames
936e33035d54d net/sched: add qstats_cpu_drop_inc() helper
ab8e0164c0fee net: enetc: restore RX ring congestion mode after ring reconfiguration
276e747373170 octeontx2-af: Fix TL3/TL2 link config ENA clearing
7abe769e72c79 net: qualcomm: rmnet: restore skb->dev on deaggregated frames
42a139332ce81 octeontx2-vf: fix workqueue and netdev race in probe/remove
537e11a1700f6 octeontx2-af: fix NULL deref in NIX TM tree debugfs read path
7677eb2cbf2cc gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free
53a5b262d706b xsk: honor XDP_TX_METADATA in zero-copy path
5b913e87af4b2 xsk: align TX metadata layout across ABIs
aeee917a4878a Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop
a644b8df94966 Bluetooth: btnxpuart: Validate the FW dump header length
7b37556d7d801 Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path
566da1197d340 Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX
3818502f2f69d Bluetooth: btmtk: Do not discard the subsystem reset timeout
f3465a143c87c Bluetooth: btmtk: Do not report success when subsys reset fails
9fc4fd78bc650 Bluetooth: btmtk: Fix short read errors in btmtk_usb_reg_read()
5a2cb90e23587 Bluetooth: btmtk: Add MT6639 (MT7927) Bluetooth support
61d5ddbd524c7 Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan
c3f63610bceaa Bluetooth: mgmt: fix 'hdev->discovery.uuids' NULL dereference
87276dc15b559 Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN
00a73ce437e27 arm64: process: Fix context switching MTE store-only tag check
4a888ccb33d0c arm64: ptdump: Make note_page_flush() range aware
f365f36bbb5ac erofs: Fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS default logic
f30c8905abdae scsi: qla2xxx: Fix an loop timeout test
aa17842bbccae Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition
ff422b8597c28 syscore: Pass context data to callbacks
f7914ff92e4aa net_sched: sch_fq: fix pacing delay underflow with pacing offload
9c5d7bdb29ef1 net: page_pool: Remove zone/policy GFP flags when allocating XArray entries
b9838b655b708 net: libwx: fix concurrent bitmap overwrite in PTP setup
a13a63558e5c8 net: txgbe: fix MISC interrupt unmasking in non-MSI-X mode and device shutdown
38fa06f9ccccc net: wangxun: introduce WX_STATE_DOWN to serialize device shutdown state
6bf50b58f40d0 net: wangxun: schedule hardware stats update in watchdog
b1d311224479e net: wangxun: replace busy-wait reset flag with kernel mutex
71adad90236b1 net: txgbe: support RSC offload
80fd6d42f07ce net: txgbe: support RX desc merge mode
51fe3fe0ffec0 ptp: netc: fix period truncation and potential divide-by-zero in PEROUT
430afa27beb92 bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check
001ff5d8e68aa bnxt_en: Fix call to hardware monitoring event handler
012bebc861106 rtc: pcf85363: Add error checking to regmap calls in probe()
27f640cd92eeb NFSv4/pnfs: key the data server cache on the NFS version
3815b894b922e NFSv4.2: fix LAYOUTSTATS send buffer exhaustion
0879ea157acc1 net/smc: free pending qentry in smc_llc_flow_stop() before memset
0fb9a51376607 net/smc: free stashed qentry before overwrite in REQ_ADD_LINK to ADD_LINK transition
8b2d8c70b969b net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue
220cfdb17ff6a net: tcp: block mixing readable and unreadable frags
857681f6835d5 inetpeer: randomize RB-tree node comparison using SipHash
c7f9740f7a1b2 ip6mr: plug drop_reason to ip6mr_cache_report()
38778f6abdbda ipmr: Free mr_table after RCU grace period.
65f87de5f3c3b net: change sock_queue_rcv_skb_reason() to return a drop_reason
84264cb4e541f ipmr: Remove RTNL in ipmr_rules_init() and ipmr_net_init().
53eefb9db0b27 ipmr: Convert ipmr_net_exit_batch() to ->exit_rtnl().
b30f0801b9187 ipmr: Move unregister_netdevice_many() out of ipmr_free_table().
4012a0656797d ipmr: Move unregister_netdevice_many() out of mroute_clean_tables().
4be733a450c86 net: qlcnic: validate unified ROM sections before loading
bf87e4c1e58a0 net: add missing ref_tracker_dir_exit() to net_passive_dec()
f30cf8fd98722 ipv6: avoid divide by zero in rt6_multipath_rebalance
b8f32b0804b4b netdevsim: update queue NAPI association on queue reset
9d7b6916d5f85 net: ipa: balance runtime PM reference on remove error
5a66873d04b0f forcedeth: stop the tx_timeout register dump past the requested window
bcf88c039af86 net/mlx5: E-Switch, preserve max tx speed on vport state modification
38354e591e3ef net/mlx5: Move vport DOWN state check out of mlx5_query_vport_max_tx_speed()
55d18f3ead831 net/mlx5: Skip disabled vports when setting max TX speed
6f4adc05c788d RDMA/mlx5: Implement query_port_speed callback
9137881591f22 IB/core: Add query_port_speed verb
0864bab42677c IB/core: Add helper to convert port attributes to data rate
361dfb9322fdc net/mlx5: Add support for querying bond speed
70cd46d12d7cc net/mlx5: Handle port and vport speed change events in MPESW
e59b430283455 net/mlx5: E-Switch, use state lock for vport state changes
99300ea5c4365 net/mlx5: Propagate LAG effective max_tx_speed to vports
409dc14183ad1 net/mlx5: Add max_tx_speed and its CAP bit to IFC
4d3fb6977248d net/mlx5: E-Switch, support eswitch inactive mode
ed246bad28d4e net/mlx5: MPFS, add support for dynamic enable/disable
01677786ed4f0 devlink: Introduce switchdev_inactive eswitch mode
ec750e1f82385 net: thunderbolt: Count delivered packets in rx_packets and rx_bytes
ac2201b484822 net/sched: add get_fill_size callbacks for actions missing them
c0444d7499f11 net: bridge: Reject descending VLAN tunnel ranges
214fb79b0379c xsk: fix NULL pointer dereference in __xsk_rcv()
4585691b28614 xsk: avoid double checking against rx queue being full
5f02599590a4e irqchip/irq-realtek-rtl: Use readl_be()/writel_be() instead of readl()/writel()
5aa7bbe0bac89 irqchip/irq-realtek-rtl: Add mask for interrupt handling
2aa9fcf31f387 irqchip/irq-realtek-rtl: Add interrupt data structure
421615e833d73 irqchip/irq-realtek-rtl: Split out parent setup code
f7d818afcc225 irqchip/irq-realtek-rtl: Add multicore support
a9be529935266 irqchip/irq-realtek-rtl: Add/simplify register helpers
94834742ef195 smb: server: remove unused DES crypto header
72a3e6e0c8248 smb: server: Remove obsolete "select CRYPTO_LIB_DES" from Kconfig file
392c985c6b03d ALSA: mtpav: shut down output timer before card teardown
bfce0f324efaa spi: amlogic-spisg: Make sure clk_init_data is fully initialized
4d99a477e61fc RDMA/ucma: Allow path records to exactly fit the output buffer
b15782627b656 ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup
735384a9dd599 ALSA: core: Add scoped cleanup helper for card references
dca93566f0e20 irqchip/gic-v5: Use logical cpu 0 irs_data for dynamic IST allocation
265fdce1efb1b irqchip/gic-v5: Fix gicv5_init_common() error paths
76ed544059cae irqchip/gic-v5: Check for NULL LPI domain on domain teardown
099772e948cc7 irqchip/gic-v5: Synchronize CPU interface disable
8f7980033e9f7 clk: visconti: Make sure clk_init_data is fully initialized
58c368552f830 clk: ti: Make sure clk_init_data is fully initialized
41c2ccf0d740e prctl: fix PR_SET_MM_AUXV losing the forced AT_NULL terminator
589f8d44c9dca lib/interval_tree: fix allocation warning messages
5a8f18a7d3691 rtc: gamecube: check return value of devm_rtc_register_device()
fdc4b500071a2 i2c: ocores: Disable clock on failed resume
38c6831fefde0 irqchip/renesas-rzg2l: Fix loss of interrupt
367dbc320b27d rtc: zynqmp: Return optional clock lookup errors
dbaca07f78a82 cifs: remove dead size-update blocks in cifs_setattr_unix/nounix
442c5f1358ced smb: client: fix request buffer leak in smb2_new_read_req()
6fd823a8872dc rtc: spacemit: handle regmap_test_bits() error return
08a59c28c2bdb rtc: pcf8563: fix clock provider leak on unbind
28701b74c22d2 virtio: rtc: time out alarm requests
6ca752850de3b vdpa/mlx5: fix wrong list iterated in add_direct_chain error path
4d059e7af5e92 virtio_pci: fix wrong queue index for admin vq in intx path
4f723111a852b vhost/net: fix clear_user start address in VHOST_GET_FEATURES_ARRAY
6dd28e32f4d81 virtio_balloon: quiesce balloon work before device shutdown
808b1751540dd virtio_balloon: factor out virtballoon_quiesce()
0d7b20057d4fd virtio: add virtio_device_shutdown() helper
68b726b3a01fb vdpa_sim: fix cleanup after worker creation failure
8b3edaa10a303 virtio_balloon: disable indirect descriptors
5fe03b5257095 net: add missing ref_tracker_dir_exit() to alloc_netdev_mqs()
4f80425ad5a06 bonding: initialize err for empty target lists
795e7b3a356e8 mlxbf-bootctl: fix the build error with FIELD_PREP()
2c09cadec116e platform/x86/amd/hsmp: Reject negative power cap writes in hwmon
ace1ba5fca0ab platform/x86: hp-bioscfg: fix password encoding bounds check
4d35c6d698085 vsock: use sock_error() to consume sk_err after a failed connect
36e5fa009f98a vsock: don't check the listener's sk_err in vsock_accept()
06c95182234ae vsock: avoid timeout for non-blocking accept() with empty backlog
df8f661b4f329 platform/x86: dell-wmi-sysman: Fix instance ID bounds
3e8fe6503d0c1 net/smc: hash socket only after full initialisation in smc_sk_init()
6ea95c886d703 8139cp: fix Rx and Tx not being disabled in cp_suspend
3e6b705bc162f vxlan: mdb: Fix use-after-free in vxlan_mdb_flush()
5f22943cd2c84 ALSA: hda: Fix connection list comparison in proc output
a5129155ca9fb fuse: check for NULL root inode in fuse_fill_super_submount
5559dd7888d2c soc: qcom: ubwc: Fix missing include
aab1880058ac7 fs/ntfs3: validate ef->size covers the record's name and value
74a83aa05f730 fs/ntfs3: fix out-of-bounds read in read_log_rec_buf()
389bd349ddbcf cuse: wait for pending RCU callbacks on module exit
fdb9cd16f8b6e net: bridge: vlan: fix inverted default vlan notification
a34d2e0bfb74a tls: fix RX desync on overlapping skbs
f3b6834c13edd net: dsa: mv88e6xxx: Fix PCS link check on CMODE read error
daebc7064a1b4 vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes
4aed450adaee3 ipvs: fix integer overflow in ftp helper port/address parsing
448f505e19241 f2fs: fix to avoid pinfile fragment on fragment:{block, segment} mode
32ee27946f097 f2fs: cleanup w/ f2fs_need_rand_{blk, seg, seg_blk}
dd5d8f4a9c67f f2fs:Fix incomplete search range in f2fs_get_victim when f2fs_need_rand_seg is enabled
65702339b3e9f net: hsr: free learned nodes on device setup failure
54bc96aeee050 pppox: drain queued packets on channel handoff
fb511bf117edd net: dsa: b53: fix error propagation from b53_fdb_dump()
292846223eadd net: kcm: Hold RCU read lock while running BPF parser
31fbed0b409a6 ionic: fix completion descriptor access with 2x desc size
3ec0225b9d750 ptp: netc: skip PEROUT disable if channel is not enabled
00f1000a644e8 drm/xe: tests: fix error message in xe_migrate_sanity_test()
e794cdc5c369c hinic3: Fix skb linearization mismatch and drop skb when skb_checksum_help() failed
c0f208d8a5726 octeontx2-af: initialize lmac_bmap in rvu_mcs_set_lmac_bmap()
ea7b35dcc9430 bpf, xdp: move offload check into dev_xdp_install()
9e5e2ccc51dfc clk: ti: mux: resolve parent clocks by DT index, not by name
9d4843f105125 clk: devres: fix cleanup in devm_clk_get_optional_enabled_with_rate()
4c067f5ffb469 nfs: fix ENXIO on O_CREAT open of existing symlink over NFSv3
d148a652d52fd NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease()
163c16e01f53f NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers
1e1c36b206c65 pnfs/blocklayout: Fix device leaks on parse failure
3f2387e8bfbc4 NFSv4: remove callback IDR entry on client allocation failure
4c59aca79da0e nfs: refactor pNFS functions using clear_and_wake_up_bit
8179b8a1d636b nfs: replace atomic bitops sequence with clear_and_wake_up_bit helper
b967a595fb735 smb/server: fix session leak in ksmbd_session_register()
a4a307d149327 ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size
a21597b5730bc ksmbd: disconnect on SMB3 decryption failure
2bdbe00454200 bpf: Reject negative optlen in cgroup getsockopt hook
be98f92fc2446 m68k: nfcon: Do not call console_is_registered() in nfcon_device()
fe91c3f64a738 bpf: Disallow bpf_{g,s}etsockopt() in cgroup UNIX getname hooks
64eec7314e289 erofs: fix unused pcluster_pools for higher page sizes
7cf561843ed0a lwt_bpf: Restore reserved headroom after xmit program
a3d6e590268ee erofs: guard on-disk algorithm IDs against Z_EROFS_COMPRESSION_MAX
ddb7ea4fd99bf erofs: fix interlaced ztailpacking pclusters
7f10dc9a7a496 erofs: error out obviously illegal extents in advance
169f6633d2a35 erofs: clean up encoded map flags
892048f595505 smb/server: preserve error status in smb2_handle_negotiate()
b2d78c199dfd9 smb/server: fix invalid pointer dereference in ksmbd_stop_durable_scavenger()
8461f27902727 smb/server: fix null-ptr-deref in ksmbd_ipc_tree_connect_request()
a41a98ee16ae0 ksmbd: free preauth sessions on connection teardown
9f37719d6be82 ksmbd: do not advertise unimplemented CA support
0aa8f94bfd4d8 ksmbd: validate ipc response length before dereferencing its fields
7a98c3b903b10 smb: server: fix leak of ksmbd_ipc_login_request_ext() returned buffer
84c2d8e807ac4 ksmbd: Do not skip lock checks for single-byte ranges
db141a5ebcb04 hwmon: (emc1403) Drop hysteresis for low limit temperature
c38cc41bb9dc2 hwmon: (emc1403) Rely on subsystem locking
86c1617b7d4b0 hwmon: (coretemp) Fix core_data leak on CPUs without PTS
00cce5e457cb6 apparmor: fix deadlock in complain-mode change_hat
4609e0e0be709 block: mtip32xx: synchronize ioctls with device removal
7e3e5273fc9ec ublk: reject non-power-of-2 zone sizes in SET_PARAMS
32456a8599557 null_blk: serialize configfs attribute updates with device setup
65cae82fd3c39 null_blk: serialize configfs attribute stores with the lock
3e35ad503386a null_blk: reject per-device queue resize for shared tag set
b2437d37fcc31 null_blk: free zones array on device power-off
2b59484ac1e64 null_blk: free global tag_set on init error path
d761be1b8f2bb null_blk: register configfs subsystem after creating default devices
c7dea90c9b4ef null_blk: use DEFINE_MUTEX for the file-scope mutex
cbc24bce70dfd mailbox: riscv-sbi-mpxy: validate RPMI notification lengths
1bd910aae6abd mailbox: pcc: Fix command timeout due to missed interrupt
d255b6575650b mailbox: rockchip: disable pclk on probe failure and unbind
413b0b94d6d06 mailbox: qcom-cpucp: handle NULL data in send_data callback
8b8de6400c869 mailbox: qcom-cpucp: fix PREEMPT_RT self-deadlock in IRQ handler
eb05c19dfb36d perf dso: Replace assert with runtime check in dso__read_symbol()
ac09bbbde1d49 perf dso: Guard against cache underflow on short reads in dso_cache__memcpy()
d3eaeabc08ae9 perf dso: Use stored fd error instead of stale errno in file_read() and file_size()
dd9560c7b46e2 perf dso: Guard close() against invalid fd in dso__decompress_kmodule_path()
b40859b325772 perf dso: Guard against errno==0 when dso__get_filename() returns NULL
b8f8642178656 sched_ext/scx_flatcg: Fix cvtime true-up on slice expiry
9d634e8f9e20a crypto: lskcipher - propagate errors from unaligned crypt
8c9b0a3a6d27f crypto: hisilicon/sec2 - fix CCM algorithm long packet failure
efcfda20b7b7f selftests/sched_ext: Fix flaky ddsp failure tests on busy systems
6b019f0daa613 bpf: Fix pending_pos walk on 32-bit ring position wrap
15512c6b5dea7 ACPI: scan: fix bus ID cleanup on device_add() failures
04a43c321e106 ring-buffer: Remove trace_buffer::cpus
801ae90f8ce09 riscv, bpf: Fix missing sign-ext for signed 1-byte and 2-byte kfunc args
5a19c3fccc7e3 selftests/bpf: Use ping_command() for IPv6 pings in lwt_ip_encap
17a4dd3b0e6da selftests/bpf: Add tests to verify the fix of encapsulating VxLAN in lwt
54bff7c8e410a HID: multitouch: reclassify HTIX5288 to WIN_8_FORCE_MULTI_INPUT_NSMU
d2f41287b51a3 ASoC: SOF: validate topology volume range before allocation
e30214289e623 tracing: Have trace_event_update_all() only handle module that is loading
324cc98b71f0d HID: haptic: don't write an uninitialized value to unhandled usages
a561012868ae3 ALSA: core: Fix use-after-free in snd_card_do_free()
ce9a619c432b9 fs/ntfs3: reject out-of-range evcn in mi_enum_attr()
dc6d85de7e265 fs/ntfs3: fix integer overflow in MFT cluster validation
863e10c4508cf bpf, arm64: Fix stack-passed arguments for indirect trampolines
424a9fc4876cc net: page_pool: fix UAF in __page_pool_release_netmem_dma on xa_cmpxchg race
e44b3b35bb153 scsi: ufs: core: Set task state before io_schedule_timeout()
2dbdd025b2281 scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers
b6273cd8dc55f selftests/bpf: Fix for veristat file/prog filters processing
d0a3729d464fc Squashfs: check block offset is not negative
f8747d81aa6d3 ocfs2: fix circular locking dependency in ocfs2_init_acl()
e35fa6eb4d2a3 ocfs2: validate DIO orphan slot during inode read
c6c908f9b4edf ocfs2: validate orphan slot during inode read
508907eb8ea4a bpftool: Fix double close in map dump
b000458cab958 x86/pkeys: Fix pkey_alloc() return value when pkeys are not supported
0ef3f5629051f selftests/cgroup: Preserve CPU hotplug write errors
210c193a9ef13 ALSA: seq: midi: Serialize input teardown with event_input
5c94ea1e64d3b ALSA: seq: midi: Optimize event_input locking with RCU
1f6d28c428cae clocksource/drivers/armada: Unwind timer clock on init failure
fa0901c1c5551 clocksource/drivers/clps711x: Do not unmap clocksource MMIO
5d83f3faa3fb7 s390/debug: Fix deadlock during unregister
e0cb87f438854 xenbus: Unregister reboot notifier on init failure
ac7b10121140a power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address
b3827f2e7b609 power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address
2f890ba8521f7 power: supply: bq27xxx: bq27520g4: fix REG_TTES address
7d181b48da3ff power: supply: bd99954: Drop bad register fields
3ab6f4eccbbf5 PCI/ASPM: Disable/restore ASPM on every function for multi-function devices
a3040b9e90eb4 spi: img-spfi: don't disable runtime PM on DMA deferred probe
41849630000ec selftests/bpf: vmtest.sh: Preserve command quoting when running in the VM
5e41939ae4929 selftests: harness: Mark test fixture objects __maybe_unused
d97cb1421c944 selftests: harness: Restore order of test functions
e17ba89f8b78f kunit: tool: fix _list_tests filtering wrong variable when list has TAP prefix
afc211a293999 perf build: Remove leftover feature tests for removed cxx and clang support
1e94e67483e01 super: fix dying superblock warning messages
c01652db11c29 PCI/ASPM: Use pcie_capability_clear_and_set_word() for ASPM disable/restore
d6037e42aa4dd firewire: core: fix memory leak in error path of build_tree()
4679bf3517cec firewire: core: validate parent port count before allocating nodes in build_tree()
861e6dd1f5939 firewire: core: consolidate port counting in build_tree()
6d2eba5cdb815 firewire: core: add KUnit tests for failure of tree building
d7d075f17d612 firewire: core: add KUnit tests for successful tree building
b5d3c30d03dbc firewire: core: add KUnit test skeleton for node tree
3216ff97d329a UBI: fix two issues in the ubi.mtd MODULE_PARM_DESC
8b30628dfc2b2 ASoC: xilinx: formatter_pcm: fix stream_data leak on open error
e065960366b55 mtd: ubi: Release device reference on busy detach
e3f7e58189bc2 ubi: Fix rollback for explicit UBI device numbers
e6d77e2ea55f1 UBI: fastmap: Pass to_be_tortured when reusing old fastmap PEBs
34b180031021f UBI: Preserve torture flag when rescheduling failed erasures
e06806a8f4cf2 ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready
efc40977e7104 ASoC: pxa: Use devm_clk_get_optional() for extclk clock
99c554f193478 idpf: add missing cpu_to_le32 in idpf_tx_splitq_build_flow_desc
f06d77436aab6 ice: acquire NVM lock around each flash read
42ff18e407e9c ice: refactor to use helpers
c0fcef8e24a8b ice: clear the default forwarding VSI rule when releasing a VSI
f5071e3ad4ca3 ice: fall back to SBQ when LL PHY timer interface times out
544e40805dbb6 RDMA/cma: Fix WARNING in res_to_rt
046425412529d RDMA/cxgb4: Free debugfs on registration failure
3c9c9b56fbaff dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal
b1e8d40663997 ALSA: seq: Don't leak the extension cell pointer in the bounce payload
4f0483bbcdacc nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing
9cfe74542b544 nfc: digital: Do not dump a NULL response in command completion
7a8e0a7aef807 nfc: pn533: hold a reference to the request skb during send_frame
749a9048bf51a nfc: llcp: bound SNL TLV parsing to the skb and add length checks
ba4c776af3dc2 nfc: nci: fix double completion race in nci_data_exchange_complete
156e65bd29307 nfc: llcp: read llcp_sock->local under the socket lock in getsockopt
8bf228fa02b1e nfc: llcp: avoid userspace overflow on invalid optlen
4b59f93cf4baa nvme: reject passthrough of driver-managed Set Features
736b7c6adc7a6 nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()
1fb1236312ee1 nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns()
a2cf452ba7109 nvme-apple: Drop the PRP null check chicken bit
311e4e21ffd41 nvme-apple: Require page aligned buffers on the admin queue
5ee7e381b1bc8 nvme: Add a quirk for page aligned admin queue buffers
25c76e0c07f2a nvme: expose active quirks in sysfs
95e93ee7053b8 nvme: remove virtual boundary for sgl capable devices
85571e5a37ff2 block: accumulate memory segment gaps per bio
897184def60c9 nvme-apple: Never set the opcode in the NVMMU TCB
751e8e18be0a4 nvme-apple: Don't set a DMA direction for commands without a data transfer
215d1682f0bae nvme-apple: Destroy the admin queue on removal
c38a818632679 nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()
cb30449ee9a9c nvme: Add the DHCHAP maximum HD IDs
a3453d50130cb s390/irqflags: Add out-of-line definitions of arch_local_irq_*() for KMSAN
af20646a329e6 s390: Drop unnecessary CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT
283d2d61c4a3b integrity: Make arch_ima_get_secureboot integrity-wide
d408d69f92b8c arm64: bti: Disable in-kernel BTI with recent versions of Clang
bc34d10432303 ASoC: qcom: q6apm: keep the graph start count in sync with the DSP
79c05936be12c spi: sprd-adi: Fix probe succeeding without registering the controller
b68d3a7a14585 phy: qcom: qmp-combo: Drop qmp_v4_calibrate_dp_phy
b499e89a828ed phy: qualcomm: qmp-combo: Add DP offsets and settings for Glymur platforms
becb8b30d9da6 phy: qualcomm: qmp-combo: Update QMP PHY with Glymur settings
e1ce0661c0ce8 phy: qualcomm: Update the QMP clamp register for V6
aa615671f486a phy: qcom-qmp-combo: Use regulator_bulk_data with init_load_uA for regulator setup
660b56537e180 phy: qcom: qmp-combo: Correct pre-emphasis table for QMP v4 DP PHYs
31b8b620a8aa1 phy: renesas: rcar-gen3-usb2: Ignore missing VBUS regulator
832022bb2ba5a rust: uapi: replace direct asm-generic/ioctl.h include with linux/ioctl.h
218c36fdd5c63 iommu/amd: Fix incorrect device ID in invalid PASID error message
7d1099b86356d apparmor: fix unconfined user namespace restriction forced stack
07485821b20b2 apparmor: change fn_label_build() call to not return NULL
ab64b1584a905 apparmor: split xxx_in_ns into its two separate semantic use cases
c7f53d35455d1 powerpc/configs: enable CONFIG_RAS to fix EDAC support
569eb11f09908 amt: Don't support cross-netns setup.
6033cc02fe27d selftests/sched_ext: Check skeleton open failure in exit test
f1872cddf12ab cgroup/cpuset: Use WRITE_ONCE() for shared prs_err updates
474da0e00d0c9 cgroup/cpuset: Fail if isolated and nohz_full don't leave any housekeeping
4fd62a9418ab9 cgroup/cpuset: Rename update_unbound_workqueue_cpumask() to update_isolation_cpumasks()
c25b6b28a35f9 nvme-pci: release descriptor pools on probe failure
9e489dc3fbbf4 nvmet: propagate percpu_ref_init() failure in nvmet_ns_enable()
33f07f8fbb9cb nvmet: fix Reservation Register Replace for unregistered host with IEKEY
da652cb17f9fa sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE
cda4aacfb0bbf SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6
7d0554350d884 hwmon: (cros_ec) Synchronize EC access from the thermal device callbacks
13ad7a04b97a6 hwmon: (cros_ec) Store the hwmon device in cros_ec_hwmon_priv
49390d9d8eaf0 hwmon: (cros_ec) Register the thermal devices after the hwmon ones
786409d4dcd1b hwmon: Support guard() and scoped_guard for subsystem locks
1a010fcc0f1b0 hwmon: (cros_ec) Add support for temperature thresholds
14ec266275419 hwmon: (cros_ec) Move temperature channel params to a macro
6fa77dea178e7 hwmon: (cros_ec) Split up supported features in the documentation
28e9bcb654f19 arm64: Disable KCSAN instrumentation in delay.o
0f7f363cc6ceb xdrgen: Fix opaque and string encoders for unbounded members
97c12f3e24e7d xdrgen: Do not declare union XDR functions in the definitions header
184a3e5bbc01b xdrgen: Address some checkpatch whitespace complaints
221a025fb6aa6 m68k: Fix backtraces for non-running tasks
0fdc6aaea2965 hwrng: imx-rngc - Disable clock on registration failure
5067a5fbbd025 crypto: qat - remove dead ADF_HEX code
0c68bf6b4842e crypto: qat - use 2-arg strscpy where destination size is known
a803141597d61 iommu/vt-d: Flush context cache with correct SID when tearing down aliases
d0e978ced7429 iommu/vt-d: Tear down scalable-mode context on probe failure
3c88cfedc7768 iommu/vt-d: Clear Present bit before tearing down copied context entry
686bd59429ffe iommu/vt-d: Fix UCTP context table slot when copying root entries
e3c53e9173a47 iommu/dma: Restore locking around msi_page_list
7508654e409ed fbdev: clps711x-fb: Remove unreachable unregister_framebuffer() call
33e54e3e0b2ca fbdev: kyro: Validate overlay viewport coordinates
656e580c19ca1 fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device()
656e43f7afabb perf synthetic-events: Fix divide by zero in perf_event__synthesize_threads
e0b01aedf85f8 perf python: Fix memory leak in pyrf__metrics_cb
9eebbaf7a33be perf python: Validate CPU and thread maps in pyrf_evsel__open
ce4c4c03ef5bd perf python: Handle Py_None for thread and cpu maps
2fef75555c0aa perf python: Check counts_values size in set_values
aba46bc65e083 perf test: Fix skiplist leak in cmd_test
02ffce64f7ad6 perf test: Support dynamic test suites with setup callback and private data
122c64347d9a4 perf synthetic-events: Fix uninitialized pthread_join
a9ee5e8eae20d perf stat: Fix evsel_list leak in cmd_stat
b567e25ffda7b ARM: dts: helios4: add SATA regulator supplies
37dac96549d91 ARM: dts: helios4: add vcc-supply to GPIO expander
5934c1c867070 ARM: dts: helios4: add vcc-supply to EEPROM
19ebf0422fe91 arm64: dts: turris-mox: fix usb3 phys
c2178137a7893 i3c: renesas: Don't register devices when ENTDAA times out
8ca083c0fe2c2 i3c: renesas: Follow a unified pattern for transfer and command initialization
4e2b33373a0f3 i3c: renesas: Return immediately if there is no transfer
a052ad5edccf5 bpf: Fix mmap_lock leak in irq_work path
cc1c1c70d203a bpf: Avoid faultable build ID reads under mm locks
b25ce833d8f12 bpf: Factor out stack_map build ID helpers
c1d79bb9c4662 riscv: cpufeature: Clarify ISA spec version for canonical order
bbe2fd6d77df6 net/sched: cls_api: fix teardown of an adopted proto on insert-race loss
457ee7219c9ee iio: light: gp2ap002: re-enable irq if runtime suspend fails
0fc740c25c9ab iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes
1ab7ef7ccfb86 iio: light: opt4060: Fix pointer type passed to div_u64_rem()
1ab3da12061d7 bpf, cgroup: Fix storage null-ptr-deref after replacing prog
7c2658023d839 Bluetooth: MSFT: validate evt_prefix_len against the response length
7efd7fb4c9c77 Bluetooth: btmtksdio: fix usage_count leak when autosuspend_delay is negative
e1fc9c5878f03 Bluetooth: btmtk: add MT7902 SDIO support
534d3efd59b3c Bluetooth: btmtk: add MT7902 MCU support
c00556fbe75eb mmc: sdio: add MediaTek MT7902 SDIO device ID
e0cd7b34dc6b5 Bluetooth: MGMT: free the HCI command when it is cancelled
05438d338a875 Bluetooth: MGMT: free the mesh send cancel command when it is cancelled
9c3b6c1413bd0 Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths
c1fe3c74a89a7 Bluetooth: hci_conn: fix the SCO setup context lifetime
2f907608cbcfc Bluetooth: btintel: Fix diagnostics event detection
be1e3df2c49c9 Bluetooth: virtio_bt: avoid OOB read of build info string
244d029900814 pinctrl: airoha: fix edge-triggered interrupts handling
c7596135e7e9a pinctrl: airoha: fix IRQ mask/unmask code
fda7350f257e5 pinctrl: airoha: add missed IRQ resource helpers
9ea692247ee24 pinctrl: airoha: fix getting gpiochip/pinctrl pointers in the IRQ handling code
f3b8fe04dbfe3 pinctrl: airoha: add missed get_direction() function for gpio_chip
7d2b3f8a996d1 pinctrl: airoha: an7583: fix spi group pins
38a2a4d6c7ac7 pinctrl: airoha: an7583: fix muxing of non-gpio default pins
2313f262999c7 pinctrl: airoha: an7581: fix mux/conf of pcie_reset pins
2ad2147082592 pinctrl: airoha: fix pwm pin function for an7581 and an7583
cfe4350fdcb53 pinctrl: airoha: convert PWM GPIO to macro
fa27ddca66022 pinctrl: airoha: an7583: fix I2C0_SDA_PD register bit order
cbde1169bdd2c pinctrl: airoha: an7581: fix pinconf of i2c_scl/i2c_sda pins
75ceddfa7df7e pinctrl: airoha: fix mdio bitfield names
4bf51df55d7bd pinctrl: airoha: add support for Airoha AN7583 PINs
74c2c5b459b42 pinctrl: airoha: convert PHY LED GPIO to macro
e6edde29990af btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data()
b0059242735ea btrfs: avoid GFP_ATOMIC allocations in qgroup free paths
f44616db1dbce btrfs: use aligned range for locking in extent_fiemap()
92484ad014f2e btrfs: zoned: don't clobber the extent buffer when zeroing it out
12b6d1a1715cb btrfs: retry verity reads for not-uptodate Merkle folios
58ce50b1802a4 btrfs: always wait for ordered extents to avoid OE races
76b7c505c74f4 btrfs: merge setting ret and return ret
8a34b30bd1bfc btrfs: make btrfs_repair_io_failure() handle bs > ps cases without large folios
a9701dd06e82c btrfs: defrag: fix deadlock between defrag and delalloc space reservation
34f67cfb15fa5 scsi: sd: Fix sd_done() sense handling condition
8bd807995dd5d perf trace-event: Fix integer truncation in do_read() and skip()
14470bc005ec6 Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices
4ea16cbcc58e3 Bluetooth: btusb: Record matched usb_device_id into btusb_data
5ca4aa51ab378 Bluetooth: btusb: refactor endpoint lookup
dc849d11a7d2b Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855()
4ea53de3e47fa Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event
1403beab27c64 sched/fair: Check CPU capacity before comparing group types during load balance
ce065b76c89cb sched/fair: Also gate overloaded status update for SD_ASYM_CPUCAPACITY
cab5015ee3f25 perf/x86/intel/pt: Fix stop/start with no update
b53e430f8eab8 perf/x86/intel/pt: Use bitwise access for PERF_HES_STOPPED
ad9d3402f4b05 perf/x86/intel/pt: Factor out pt_config_enable()
54eb9b2d18f8b ACPI: video: Release PCI device reference after lookup
679b862781010 regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling
053ec85cb9f26 bpf, arm64: Fix exception table metadata for arena load-acquire
415257c38a3fc bpf, x86: Fix exception table metadata for arena load-acquire
5f13a844d0c9b bpf, riscv: Add and use bpf_atomic_is_load_acq() helper
c4c8de3bf48d3 bpf: Reject load-acquire from pointers requiring fault protection
57b72442c1672 perf: arm_pmuv3: Zero initialize hw_id branch stack field
f61f65fc81dcd coresight: Refactor etm4_config_timestamp_event()
9e804dbe28b74 coresight: etm4x: fix leaked trace id
1ade9a335c69f coresight: etm4x: fix underflow for usage of (nrseqstate - 1)
9241edfb84a0d coresight: Change syncfreq to be a u8
a29d753e9d83b coresight: etm4x: fix wrong check of etm4x_sspcicrn_present()
f9cdb5bb8efbf md/raid1: don't set array_frozen in raid1_takeover()
c55aa6c17f019 md/md-llbitmap: stop daemon timer rearm on destroy
930cc4f1af5a1 md/md-llbitmap: prevent create failure bitmap UAF
d81822fd5fa81 md: avoid stale clone I/O accounting timestamps
73881ff7a7591 md: wait for behind writes before destroying bitmap
02c10581866d0 md/raid5: round bitmap stripes with sector division
d2c069ddaec79 phy: qcom: qmp-pcie: Add pcs_lane1 offset to V5 offsets
5547fd950d6bf phy: qcom: qmp-usb: Fix possible NULL-deref on early runtime suspend
61749681e4a36 phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend
52ad86ea5f98d phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend
f67686d826755 phy: qcom: sgmii-eth: vote for both voltage rails with correct current loads
12d35c6572622 phy: qcom-sgmii-eth: relax order of .power_on() vs .set_mode*()
a834458ecaadb soc: fsl: qe: check platform_driver_register() in qe_ic_of_init()
dfe848cadfde4 hugetlbfs: release subpool on fill_super failure
2177c04ca0684 pinctrl: rockchip: Reset the pin count when recalculating SoC data
6eaa632d0ed7b firmware_loader: do not queue completed sysfs fallback requests
067504c00fe17 scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path
8d752f1bb73fa drm/amdgpu/gfx6: Use PFP on the compute queues too
375adae128dd0 drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets
1a1ea9738c41d perf trace-event: Fix buffer overflow in read_string()
b8ae06ccde3ff phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table
1489b694b1f32 phy: sunplus: fix error handling in sp_uphy_init()
bf7fefbc26e29 phy: renesas: phy-rcar-gen3-usb2: Fix devm action registration for disabled VBUS regulator
b464367d7397b phy: renesas: rcar-gen3-usb2: Add regulator for OTG VBUS control
733d3c1f3f513 phy: renesas: rcar-gen3-usb2: Factor out VBUS control logic
66ef9160e878a arm64: dts: ti: k3-am64: Fix MDIO clock reference for ICSSG0 node
7c4c228b0cc3e ext4: fix spurious message about orphan cleanup on RO fs
d2d543f9313fa drm/amdgpu/gfx6: Fixup emit_cntxcntl()
037d9babf6c6b leds: gpio: Clear error pointers for skipped LEDs
b75f84c010274 mfd: macsmc: Fix key count endianness annotation
f59ccd8eeaa09 mfd: iqs62x: Reject zero-length firmware records
8ae4d0ff3e357 mfd: rave-sp: validate received frame payload lengths
519e7de2c4c7b arm64: hibernate: Restore DAIF state on error
012823494e20c arm64: hibernate: mask DAIF before restoring hibernated kernel
73979c96a3b8f wifi: mac80211: skip default WMM setup for AP_VLAN links
48b5a520b80a7 RDMA/erdma: restrict the driver to little-endian systems
b2709aad7599f module/dups: Fix use-after-free in kmod_dup_req lifetime handling
ef7c354f7377f module/dups: Inform duplicate requests about the result directly
11fa3f7ffd4f7 module: use strscpy() to copy module names in stats and dup tracking
ba7e83ce0b340 module: replace use of system_wq with system_dfl_wq
de603f01d9ccf RDMA/siw: Fix use-after-free in siw_accept()
6c506fee5a5f2 IB/isert: post the full-feature receive buffers after session registration
a6c19af05c170 IB/isert: delay the final Login Response until the session is registered
aaa66e60c0e21 cpufreq: imx6q: fix out-of-bounds write when probed more than once
e2d2612e63e29 cpufreq: imx6q: fix devres accumulation across driver rebind
db0a49f0a37d4 rust: cpufreq: Fix temporary write in Registration::bios_limit_callback
2973978781908 rust: cpufreq: Add CPUFREQ_TABLE_END as last table entry in TableBuilder::to_table
b43a2518c3eca drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz
46510c3e496b6 drm/sun4i: dw-hdmi: Drop TCON TOP port reference
17a588752ddf8 drm/sun4i: tcon: Drop remote endpoint reference
65bc02fec98e4 drm/sun4i: crtc: Propagate layer initialization error
50806c951a68c drm/sun4i: hdmi: Don't leak sync polarity bits into packet control
1ca06d47ac40b drm/sun4i: tcon: Drop TCON TOP device reference
425a414f9b5de drm/sun4i: tcon: Set output mux for DSI and LVDS
6ec54d801440e drm/sun4i: vi scaler: Fix coefficient selection
46a5fe1a43574 clk: rockchip: rk3576: fix source muxes for SPI0..SPI4
aee687a2fb369 ocfs2: synchronize heartbeat callbacks with o2net teardown
ba32c7d6129db perf libbfd: Fix memory leaks and NULL fclose in BPF disassembly
59cc63d244d93 perf bpf: Add PROG_TAGS to required arrays in __bpf_event__print_bpf_prog_info()
c473f3aa721e8 perf libbfd: Validate BPF prog info arrays before pointer cast
c71f9a56520b4 ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults
314f1a6762b5d ARM: 9481/2: breakpoint: CFI breakpoints only on demand
dc2272c00d7c0 RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ
ec987c0654651 RDMA/erdma: Hold QP references for AE and CM processing
1fc9c1933959d RDMA/erdma: Hold CQ references when processing EQ events
56ea0a1f9f93d kbuild: fix modules.builtin(.modinfo) targets in the top-level Makefile
933076eb1d3d6 modpost: prevent leak when early return no suffix .o in read_symbols()
0fde935ae0ea9 scripts/tags.sh: Prevent binary files appearing in cscope.files
804378ff0d62c intel_idle: Avoid using deep idle states during initialization
56450feb6f485 intel_idle: Add cmdline option to adjust C-states table
33a5d2f00cac3 intel_idle: Initialize sysfs after cpuidle driver initialization
6ee7b00888498 bpf: Check load-acquire src ptr type before the load
cb0671ffce488 arm64: dts: qcom: sar2130p: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
af38023bc47dc arm64: dts: qcom: sm7225-fairphone-fp4: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
f068388689bea arm64: dts: qcom: qcs8550-aim300: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
e70a165b79419 arm64: dts: qcom: sc8280xp-blackrock: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
2fa866714f227 selftests/mm: fix ternary operator precedence in ksm_tests
5cd78a904275a selftests/mm: fix ksm NUMA merge test for systems with memoryless NUMA nodes
335b75cfed44b selftests/mm: ksm_tests: use kselftest framework
86ead17630110 bpf, cgroup: Fix invalid storage access after __cgroup_bpf_attach failed
6fd220604f06c remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()
5a5ed571032e9 remoteproc: use rsc_table_for_each_entry() in rproc_handle_resources()
a356d08d7151a remoteproc: Move resource table data structure to its own header
90361f45ffe85 arm64: dts: qcom: agatti: Add missing CX power domain to DISPCC
9063b30faae8c drm/omap: dsi: Do not copy isr table
d1cfbccccad7d riscv: dts: sophgo: cv180x: Allow the DMA multiplexer to set channel number for DMA controller
571ea4263d69d fat: release buffer head after rebuilding parent
44a37264b2691 rapidio: clear mport->net when rio_add_net() fails
9df662fcac6fe pps-gpio: remove dead capture_clear code
599d4c92aa0b4 pps: pps-gpio: split IRQ handler into hardirq timestamper + threaded handler
e31ff723811ee pps: don't try to wait for negative timeouts in PPS_FETCH
f637a83115b32 lib/string: fix memchr_inv() for large ranges
8abb2b7c60d2b ocfs2/cluster: keep heartbeat local node stable
b55e7e61c5c19 ublk: check for ublk_unmap_io() returning 0
0121c84adb6a4 ublk: check import_ubuf() return value
b4e971c80e64f block/kyber-iosched: flush per-cpu latency buckets over possible CPUs
7c25949cee2f0 block/blk-iocost: collect per-cpu latency stats over possible CPUs
55bda3de92f8c block/blk-stat: drain per-cpu callback stats over possible CPUs
3d8c3da95c75a blk-cgroup: skip dying blkg in blkcg_activate_policy()
ac34e655dffa7 blk-cgroup: fix race between policy activation and blkg destruction
c4487e4d5309d phonet: pep: do not write beyond optlen in getsockopt
f16c2c3932ce7 net: stmmac: Skip PHY attach if custom PCS is in use
c65d67b08bab4 iio: light: tsl2583: return zero in write_raw() on success
7a6a9bc87c6ee iio: light: isl29028: return zero in write_raw() on success
1e628f7ce4bc2 iio: light: tsl2772: fix ALS calibscale readback
6c98ec4447d2c perf arm-spe: Reject zero nr_cpu in metadata to prevent division by zero
9a857be21e2f3 perf intel-bts: Fix off-by-one in auxtrace_info minimum size check
b3a42fd1a0cd1 perf intel-pt: Fix off-by-one in auxtrace_info minimum size check
59910f142da84 perf auxtrace: Fix queue grow overflow and old array leak
003de0cf0810c perf thread-stack: Fix heap buffer overflow on branch stack wrap copy
5db6e27ad43d2 HID: lg4ff: validate report length before fixed offsets
bef8426d7138c HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure
f694ea0ead544 HID: steam: Reject short reads
78c39dd5cc4ae HID: steam: Improve logging and other cleanup
a0fbd9437d7dc HID: steam: Add support for sensor events on the Steam Controller (2015)
041e63bd2f73c HID: steam: Rename some constants that got renamed upstream
d73725bf86120 HID: steam: Refactor and clean up report parsing
17e532415518a HID: i2c-hid: Fix "(null)" output when reading report descriptor fails
01eeb601a1626 HID: synchronize input before cleaning up a failed probe
e5b6af32ecdd8 HID: i2c-hid: Refactor _DSM helper and add i2c-hid-acpi-prp0001 driver
d7f2ec073a05a misc: pci_endpoint_test: Check SUCCESS bit for doorbell status
5c58ea19a909e dm-integrity: replace forgeable discard filler with a keyed sector marker
4f6bd79bb7e55 tty: clear cdev pointer after cdev_add() failure
5b77848423f4a serial: amba-pl011: keep console clock enabled for atomic writes
5ac19e4e26e99 serial: amba-pl011: unprepare console clock on unregister
ea7fd4e8e8b87 MIPS: ptrace: Fix syscall skipping via PTRACE_SYSCALL
6bdbc2b4df1f5 soc: fsl: qe: implement get_direction()
0f3d1d7ab5d2f soc: fsl: qe: properly scan GPIO nodes at startup
90d953002cf0b powerpc/irq: Fix missing r2 clobber in PCREL inline assembly
5fa92c6466fa2 powerpc/smp: add NULL guard for cause_ipi in smp_muxed_ipi_message_pass
b59a47e20040a pinctrl: spacemit: validate pins in pinconf callbacks
41eba3b3ef86f pinctrl: eswin: Fix Handling of PIN_CONFIG_PERSIST_STATE
2d98a3b89394f firmware: coreboot: Validate table bounds
d0a19a59580a2 firmware: google: Add bounds checks in coreboot_table_populate()
7a22cbc6c6bdd wifi: cfg80211: stop PMSR before P2P and NAN teardown
0a0c03e4b7c63 wifi: cfg80211: Add an API to configure local NAN schedule
84263694c8d1f wifi: nl80211: split out UHR operation information
e182bf30a38c3 wifi: nl80211: refactor nl80211_parse_chandef
6481459f78be3 wifi: cfg80211: add support to handle incumbent signal detected event from mac80211/driver
335c515932a59 wifi: cfg80211: add initial UHR support
be90aa8bf1775 wifi: ieee80211: add some initial UHR definitions
66722acd740be wifi: nl80211: Add support for EPP peer indication
93b4c9130461c wifi: cfg80211: include S1G_NO_PRIMARY flag when sending channel
e7bc5ab93acd1 wifi: mac80211: disconnect on CSA to channel 0
7c3d762bc15c5 wifi: mac80211: skip unused probe response countdown offsets
979ad5269bdf0 wifi: zd1211rw: reject secondary interfaces to prevent conflicts
26e6123a93dca wifi: mac80211: send TWT teardown to peer after setup TX failure
97dd2f6560ce3 perf/cxlpmu: Fix 64-bit write to 32-bit HDM filter register
9ba040f4fec87 iommu/arm-smmu-v3: Convert to use atomic poll timeout
2a08fd5a082e1 kselftest/arm64: Don't write to P0 in irritator on SME only systems
ee46a1714d3a9 kselftest/arm64: fp-ptrace: Fix checks for inactive SVE and SSVE regsets
695e976e25a11 arm64/fpsimd: ptrace: Fix inactive SVE and SSVE regsets
a2ff70c44fe8e arm64: smp: Fix IPI teardown for GICv5 flow
80818e72aec4d wifi: mt76: mt7996: remove beacon_int_min_gcd from ADHOC interface combinations
7039825a7479d wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump
637bb99cc766a wifi: mt76: mt7996: fix out-of-bounds link array access in mt7996_tx()
13f6a9c786022 wifi: mt76: reject out-of-range link ids in mt76_vif_link()
81ccb9faf3c43 wifi: mt76: mt7925: Fix EHT Beamformee SS subfields to meet 802.11be minimum
0ead464cb43ef wifi: mt76: mt7925: advertise EHT 320MHz capabilities for 6GHz band
c59c8b962c4d8 wifi: mt76: fix queue assignment for disassoc packets
292bc52d8420a wifi: mt76: mt7915: report RX chain signal for all RX paths
4dee6aca79295 wifi: mt76: mt7915: fix chainmask handling for non-dbdc phys on band 1
76144da3c6184 wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed
d4326105ee28d wifi: mt76: mt7996: fix reg addr remap when addr is 0
ed5cc46a3c8f4 wifi: mt76: mt7915: release hif2 reference on probe IRQ failure
a7fd3bae8e11a wifi: mt76: mt7915: fix ext PHY use-after-free on register error path
249cbaa187355 wifi: mt76: mt7915: fix double hif2 init on the non-WED path
51c6d1f665401 wifi: mt76: mt7996: fix MIB TX aggregation counter registers for mt7990
2b10eb3636d0c wifi: mt76: mt7996: free vif links after clearing wcid entries on full reset
f3d8cf8c09e3b wifi: mt76: mt7996: wake MCU waiters before aborting scan in L1 SER
2cc7d32b42dab wifi: mt76: mt7996: skip key upload when adding an offchannel link
6bce0f1280c94 wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement
40f3bfbbb222b bpf, x86: Fix trampoline stack size for 128-bit arguments
f6202ed975070 perf machine: Check snprintf truncation for guest kallsyms path
eaa350a2ec347 perf machine: Free scandir entries in guest kernel map creation
9054ad50ffe27 perf machine: Reset errno before strtol in guest kernel map creation
c0b06d47ac329 perf machine: Don't abort guest map creation on first inaccessible dir
b3b3175103acf perf machine: Check snprintf truncation in machines__findnew()
15159fc5441bc perf machine: Guard against NULL strlist in machines__findnew()
e3a2ed4c0e8e0 perf machine: Fix NULL parent dereference in fork event processing
28bb9ea64c0c5 perf machine: Fix fd leak on bounds check in maps__set_modules_path_dir()
0b950aa7ec95e regulator: core: use system_freezable_wq for init complete work
2e2d63f68211e ASoC: tas2783-sdw: drop stale regcache on uninitialized re-attach
5589af278c504 ASoC: codecs: tas2783-sdw: Propagate regcache_sync() errors
551f3e27486bc ASoC: tas2783: Use new SoundWire enumeration helper
0b5c09512f21b soundwire: Add a helper function to wait for device initialisation
f5bb3471c9f46 wifi: ath11k: fix leak in ath11k_service_ready_ext_event()
83bc4eab83ae5 drm/msm/dsi: Drop dev_pm_opp_set_rate(0)
e0d1d1253ea2a drm/msm/dp: Drop dev_pm_opp_set_rate(0)
be73b1984086f drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0)
81d21396fea2d perf: arm_spe: Make wakeup range check overflow safe
ad1d83816b845 drm/msm/dp: do not reject wide-bus modes while a YUV420 mode is active
6572b5a74ab1c drm/msm/dp: reject YUV420-only modes without VSC SDP support
08827aa40f0ee drm/msm: don't tear down KMS twice when KMS init fails
64976f3b34b07 ACPI: processor: Unregister cpufreq notifier on init failure
6cffb59ee50ea ACPI: processor: idle: Optimize ACPI idle driver registration
efc57983a1d46 wifi: mt76: only consume the WO drop bit on WED v2 devices
19f108fee1470 wifi: mt76: mt7996: add missing rdd_idx check when enabling background radar
b93d0f07ed040 wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields
92dc45686b9f1 wifi: mt76: mt7996: don't leak MLD group index on remap alloc failure
45d8896e4cfff wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV
906ad486ba5c4 wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER
507eddb8175a6 wifi: mt76: mt7915: unwind state on add_interface failure
d0bb2189ade61 wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config
1c7ad1236bc6f wifi: mt76: check txfree done event on the WED hw path
31faa92cd5074 wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie
7ac05ed3a50e5 wifi: mt76: fix RXDMAD_C buffer recycling race
576683faa9381 wifi: mt76: fix uninitialised RXDMAD_C descriptor info
423be355be5ae wifi: mt76: fix stranded frames in mt76_txq_schedule_pending
471586e88861d wifi: mt76: mt7915: write RX header translation bit to the correct register
522101cbbb3bc wifi: mt76: mt7996: don't report a zero TX bitrate
6ce78d04c7ea4 wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss
b4a41a47a67c7 wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear
bf59177bab17b wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset
0f53ece876e1f wifi: mt76: mt7996: validate RX band_idx before dereferencing phys[]
310edc8f3f56b wifi: mt76: assign link_id when sending probe request during scan
fc7fae55255cc wifi: mt76: fix non-AQL packet accounting for MLO stations
5183b9f092fc0 wifi: mt76: mt7996: fix MLD ID in MAC TXD and HIF TXP
990ec9215ebe1 wifi: mt76: mt7996: fix out-of-bounds array access during hardware restart
25b765aa9a61f wifi: mt76: mt7996: set specific BSSINFO and STAREC commands after channel switch
5c350e3b6065f wifi: mt76: mt7996: support fixed rate for link station
62aea1d45b524 wifi: mt76: fix RX data queuing of RRO 3.0
97a77dc0abd90 wifi: mt76: mt7996: fix capability of EHT-MCS 15 in MRU
674e0ad0ae15f wifi: mt76: mt7996: fix EAPOL source BSS for non-MLD stations
ddf6a17d8e3d0 wifi: mt76: mt792x: Fix memory leak in SDIO TX path
52c7bcf067861 wifi: mt76: mt7925: fix msg len mismatch between driver and firmware
383bb0511dfe6 wifi: mt76: mt7925: update clc before setting sar power table
670b3dc4e3713 wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash
0015b56dff60f wifi: mt76: always enable RRO queues for non-MT7992 chipset
6e9207ac476ca wifi: mt76: Introduce the NPU generic layer
c0dbce50c8961 wifi: mt76: Move Q_READ/Q_WRITE definitions in dma.h
50c896af50e02 wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986
17d6b89e09eac wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length
0340bd33b4e21 wifi: mt76: connac: add MT7991A (0x7991) to is_mt7996()
1991d605a45f6 fanotify: report full event length for FIONREAD
6248eb1833ff0 misc: sgi-gru: remove interrupt-context page-table walks
e6e4cbc9e8fdd misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe()
2a1c16c4700cd powerpc/crash: Fix possible memory leak in update_crash_elfcorehdr()
7969b571ae940 powerpc/44x: Set GPIO chip parent
687d42d9eea41 powerpc: implement get_direction() in cpm2
e7c69c6695d84 locking/lockdep: Fix NULL pointer dereference in __lock_set_class()
37f11973c3eb7 md/raid1: create serial pool adding rdev to array with serialize_policy=1
71da948d249a5 fs: annotate inode timestamp accessors
039e490e3ac47 i3c: master: adi: add OF module alias for autoloading
9eaac0cb4ca94 i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices
35e0103177826 swiotlb: Preserve allocation virtual address for dynamic pools
fb0b39287ba89 iommu/dma: Check atomic pool allocation result directly
28fdea874f68c md: scope memalloc_noio to allocation critical sections
c510626bbacb1 md: skip redundant raid_disks update when value is unchanged
9f16747fc3b23 md: remove unused mddev argument from export_rdev
6763fb409a0b4 md/bitmap: resume array on backlog_store() error path
85ece0386c4fe clk: qcom: Return expected ENOMEM error on dynamic allocation failure
64abdd6961290 clk: qcom: gpucc-qcm2290: Park RCG's clk source at XO during disable
af7a6d6ec36a1 lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone
85cf991c881e7 bpf: Fix potential UAF when reading bpf link info
bda86e9f31b9a bpf: Fix potential UAF in bpf_netns_link_update_prog
d5266b4c5c771 power: supply: sc2731_charger: cancel work on remove
f312c5d17f2a7 power: supply: isp1704_charger: cancel work on remove
1a35eda51a501 arm64: dts: qcom: qcs6490-rb3gen2: Fix the PCIe iommu-map entries
e1c65abeb6aaf arm64: dts: qcom: lemans: Fix the PCIe iommu-map entries
03a85ccf857ac arm64: dts: qcom: lemans: Move PCIe devices into soc node
76e14b0e86567 arm64: dts: qcom: sa8775p: Add reg and clocks for QoS configuration
8d7411cc0bd95 arm64: dts: qcom: lemans: add QCrypto node
610d253bef458 arm64: dts: qcom: lemans: add refgen regulator and use it for DSI
ca29c5c0cc615 arm64: dts: qcom: lemans: move USB PHYs to a proper place
349752c7ab6be arm64: dts: qcom: talos: Fix the PCIe iommu-map entries
fc2980ea69202 arm64: dts: qcom: sm8750: Fix the PCIe iommu-map entries
f418e83ac1abe arm64: dts: qcom: sm8650: Fix the PCIe iommu-map entries
e8a7928da474e arm64: dts: qcom: sm8550: Fix the PCIe iommu-map entries
dbcbbb2033736 arm64: dts: qcom: sm8450: Fix the PCIe iommu-map entries
793dbaa91c3bf arm64: dts: qcom: sm8350: Fix the PCIe iommu-map entries
c8fd2cabd0b7c arm64: dts: qcom: sm8250: Fix the PCIe iommu-map entries
152e82a60d70e arm64: dts: qcom: sm8150: Fix the PCIe iommu-map entries
a98b8bb0ca25f arm64: dts: qcom: sdm845: Fix the PCIe iommu-map entries
8dfc4641001fb arm64: dts: qcom: sc8180x: Fix the PCIe iommu-map entries
54176af35d989 arm64: dts: qcom: sar2130p: Fix the PCIe iommu-map entries
d2b404826bf93 arm64: dts: qcom: kodiak: Fix the PCIe iommu-map entries
f063039d2e439 arm64: dts: qcom: sm8250-xiaomi-elish: correct the board ID
d29c5a88d5703 block: fix dio leak on metadata mapping error
642828f274eb7 block: add a bio_endio_status helper
8b1817b36ca5c block: don't set BIO_QUIET for BLK_STS_AGAIN
2b239a920a992 blk-crypto: use on-stack skcipher requests for fallback en/decryption
196a8f954ae6d blk-crypto: optimize bio splitting in blk_crypto_fallback_encrypt_bio
30439432f3f2e blk-crypto: submit the encrypted bio in blk_crypto_fallback_bio_prep
f57adb5beca6b firmware: qcom: scm: Fix tzmem state on probe retry
1da025b5ceb45 firmware: qcom: scm: Fix reserved memory cleanup on probe failure
1d753df5899ec firmware: qcom: scm: Fix NULL dereference in IRQ handler before __scm is published
d72c76684a4a9 firmware: qcom: scm: instrument SMC call path with tracepoints
347efe779f55f firmware: qcom: scm: add trace events for the SMC call interface
889ca992d9c4e firmware: qcom_scm: Support multiple waitq contexts
3d028e241c2aa firmware: qcom_scm: Add API to get waitqueue IRQ info
81af527ead79c arm64: dts: qcom: sc8280xp-crd: Fix the pin index for misc_3p3_reg_en
5793229726e25 clk: qcom: gcc-qcm2290: don't park QUP RCGs upon registration
939c917d037a5 arm64: dts: qcom: qcs404: Fix DTBS Check errors in usb controller nodes
4ea052255a4a6 arm64: dts: qcom: sdm632-motorola-ocean: Fix LED default trigger property
d098dd6ec09b8 arm64: dts: qcom: msm8976-longcheer-l9360: Fix accidental node override
9346a92337075 arm64: dts: qcom: msm8998: Don't pull-up I2C pins by default in sleep
179713adff1bd rcu: Mark accesses to ->rcu_urgent_qs and ->rcu_need_heavy_qs
badab2078d459 md/raid10: consistently fail atomic writes that require splitting
75185e2b214e8 wifi: ath11k: fix stride mismatch in mac_phy_caps_parse()
b9a5d12cbdeb8 wifi: ath12k: fix stride mismatch in mac_phy_caps_parse()
ec6edba35aa7b Revert "serial: 8250: Clear CON_PRINTBUFFER on port re-registration"
d44a02724576c selftests/zram: fix kernel_gte() for POSIX sh
e5ac7ab78467b md: recheck spare changes before starting sync
47b61029f146f tools/nolibc/powerpc: mark ctr and xer as clobbered by system call
a2fbef8a6318b fanotify: stop permission watchdog when timeout is zero
9d65cb2142533 md/raid5: protect lockless recovery_offset accesses during reshape
455b56209f961 md/raid5-ppl: fix use-after-free in ppl_do_flush()
dcd3d87cfc148 md/raid5: protect bitmap batch counters aka seq_flush/seq_write consistency
4fb17a7c437f1 bus: mhi: host: Fix controller cleanup on EDL sysfs failure
21ce330f921a5 bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET
a89818977338b wifi: rtlwifi: pci: fix error path in rtl_pci_probe()
e2cbe14361d7c platform/chrome: cros_ec_debugfs: Unregister panic notifier
b95664e3f82da platform/chrome: cros_ec_debugfs: Clean up console log on probe failure
e7768f3dae9f2 media: qcom: iris: handle runtime PM resume failure in core deinit
c1a48452cc16e media: qcom: iris: Fix bitmask test in iris_allow_cmd()
794f6d4c4ddef drm/msm: remove objects from evit list after pinning them
b3624eecb65a2 PCI: starfive: Fix unchecked pm_runtime_get_sync() in probe
257a0a59598f5 PCI: starfive: Fix Runtime PM handling and teardown ordering
aa8226f873c91 wifi: ath12k: validate TLV length in process_tpc_stats()
0364926fb4bfb wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event()
3b544072185c3 spi: davinci: switch to managed controller allocation
bd764baf82bb4 nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request
c345d9d0b3eef IB/isert: reject login PDUs declaring more data than was received
cf36fa5357a2f IB/isert: reject PDUs declaring more data than was received
429b75000c6a9 media: staging/ipu7: fix async notifier leak on init error
a2e37d1ab773b RDMA/cxgb4: free STAG index when TPT entry write fails
b1fe9a1bd0012 RDMA/mlx5: Send cong param changes to the resolved port mdev
4599311e78e88 RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs
75424c5a6620b scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches.
3904fb0ee741e nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch
842397fdfd2e6 nilfs2: prevent out-of-bounds read in super root block parsing
1fc6df85b4954 nilfs2: fix infinite loop in nilfs_clean_segments()
49a7d62d64f79 clk: rockchip: Fix the fractional part denominator on RK3588/RK3576 PLLs
666071b3128ac clk: mediatek: mt8135: Fix inverted gate control for devapc_ck
1158a9adc7dce clk/x86: pmc_atom: add kasprintf return value check
b8b81c6c89f0c clk: palmas: Manage external-control prepare with devm
d35e45e5bad4f clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path
ac6f7740655d8 clk: mediatek: Refactor pllfh registration to pass device
c945468a6df72 clk: mediatek: Pass device to clk_hw_register for PLLs
b7cd043b8412e clk: mediatek: Refactor pll registration to pass device
03e070e517204 clk: tegra: tegra124-emc: put EMC node on register failure
75653b0408d52 arm64: dts: allwinner: sun50i-a64-pinephone: Fix mpu6050 mount matrix
730e71d747051 wifi: mac80211: fix per-STA profile length in cross-link CSA parsing
da7805f0211af RDMA/efa: Fix PBL chunk length computation
5f1933163327c RDMA/rxe: Fix UAF in ODP init error-handling path
1d2271d7df523 iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path
9b37afb2d34d9 iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID
735698e81f798 iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs
2f627118b6686 iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs
bcb82407633c3 iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF (de)init
792f720fc23fe iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized
aad605a450611 fs/ntfs3: reject restart table growth beyond U16_MAX entries
7a7d30b1cb890 staging: rtl8723bs: use kfree_sensitive() for key material
6b2e70e9d52c0 firmware: qcom_scm: Introduce PAS context allocator helper function
f15cde1129840 remoteproc: Prevent crash handling to race with rproc_del()
df92f0e142edb remoteproc: core: Attach rproc asynchronously in rproc_add() path via schedule_work()
d6bf603246c90 remoteproc: Allow shutdown of crashed processors
a098f5894fcb4 remoteproc: core: Drop redundant initialization of 'ret' in rproc_shutdown()
8b93b783db329 cpufreq/amd-pstate: Set min_limit_freq based on bios_min_perf
9b95f10e1688c cpufreq/amd-pstate: Add comment explaining nominal_perf usage for performance policy
172f24df0dab4 w1: ds2482: Fix signedness bug in ds2482_w1_triplet()
ef5cc4a8c088d spi: oc-tiny: switch to managed controller allocation
67e2ffe98d710 clk: mediatek: mt6735: Unregister PLLs on probe failure
106e1a3b2b345 isofs: release zisofs block pointer buffer head
c39eb307b4976 powercap: intel_rapl_tpmi: Handle PMU registration failure during probe
bf32f103a325a thermal/drivers/qcom-spmi-adc-tm5: Drop IIO_VAL_INT check in adc_tm5_get_temp
686a92cc9f19b thermal/drivers/airoha: Fix copy paste error for sen internal
a06b2e6b8f508 thermal/drivers/airoha: Fix copy paste error on clamp_t low temp
5b6cfc6d7ff09 RDMA/mlx5: Fix integer overflow of user QP buffer size
9c9c64abed530 crypto: keembay - publish OF module alias for OCS AES/SM4
7efb51a5893b2 crypto: keembay - Initialize completion before requesting IRQ
cc92af8cc0e4d scsi: ufs: debugfs: Reserve space for a string terminator
15d4fc8f5f108 power: supply: sbs-battery: Use a per-device serial number buffer
e505092cb200d arm64: RSI: fix field-spanning write warning in attestation token init
386600507b23f tools/build: Allow versioning of all LLVM tools defined in Makefile.include
7f6d898179ca4 pinctrl: mediatek: free EINT resources on unbind
f54b96e8aadbf cxl/region: Fix use-after-free in find_pos_and_ways() error path
b804df9aa2942 selftests/bpf: Fix memory leak on subtest_states reallocation
b7983cd5ba2c7 selftests/bpf: Fix incorrect error checking for pthread_create
c78a9289084a7 ARM: lpc32xx: only run SoC init on LPC32xx hardware
85a33c910edc3 bpf: Fix CFI mismatch in task work callback
4f7e0be664af7 arm64: dts: rockchip: Fix rk3566-bigtreetech-cb2 touchscreen property
9ca64fd7a2fde arm64: dts: rockchip: Fix Gru WLAN sideband interrupt
053220e061c7d arm64: dts: rockchip: Add missing hclk for RK3588 eDP1
f5b4bc09c42f2 arm64: dts: rockchip: Add missing hclk for RK3588 eDP0
d65261e0902b4 drm/panthor: return PTR_ERR() from devm_drm_dev_alloc()
64bb6000bfbdf fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init
e70d48fcf8382 netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet
2e199e3ede9c1 drm/tve200: add OF module alias for autoloading
d9e01c333cebc perf cap: Remove used_root parameter and simplify capability checks
a73a88bc4f452 leds: pca9532: Fix phantom device registration on missing hardware
f1e8c4d48583d PM: hibernate: Fix memory leak in snapshot_write_next() error path
ce7d205c26466 RDMA/erdma: complete object teardown when the destroy command fails
02deb637e9659 xfrm: Fix skb double-free in xfrm_dev_direct_output()
78da16d23496f perf cs-etm: Avoid truncating AUX buffer sizes to int
f78fba8549204 perf cs-etm: Flush thread stacks after decoder reset
25be36738f5fc riscv: dts: spacemit: k1: Split gmac_clk_ref into independent pinctrl groups
fe9d15fb66d5e riscv: dts: spacemit: Add OrangePi R2S board device tree
9933e5f1f61ec riscv: dts: spacemit: add MusePi Pro board device tree
a76b20b1f0309 firmware: arm_scmi: Unrequest devices if driver registration fails
456856a349064 firmware: arm_scmi: Roll back partial protocol table registration
406d5ead1bcb0 cpufreq/amd-pstate: Toggle auto_sel in active mode on shared memory systems
821b41f6e3e4f cpufreq/amd-pstate: Fix EPP return type and handle errors during initialization
95ad5fd298bcd cpufreq/amd-pstate: Add support for platform profile class
471d6659925aa cpufreq/amd-pstate: Add dynamic energy performance preference
0b99dd4201c25 amd-pstate: Make certain freq_attrs conditionally visible
ea49944836140 cpufreq/amd-pstate: Use sysfs_match_string() for epp
baf5a7fd3f3e2 cpufreq: amd-pstate-ut: Skip tests when amd-pstate driver is not active
937f09ce104c1 ARM: dts: allwinner: a10: Fix PMU interrupt
3933884bc3102 ext4: check dir entry fits before reading the hash trailer in ext4_search_dir()
1399f102d8a18 ext4: fix buffer_head leak in ext4_init_orphan_info
0afbfe019c881 RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap
72a5e45f606ec wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx()
95d1bd1db9e9d wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx()
ccca0f7d9e906 wifi: ath11k: Correctly copy the hint BSSID in WMI scan request
8f86a58ab9412 wifi: ath12k: Correctly copy the hint BSSID in WMI scan request
0c9eac0d1fb47 wifi: ath12k: allocate HOST_DDR and BDF regions after Q6 RO region
e69fd62e8117e wifi: ath12k: refactor QMI memory assignment
42bc932e05093 wifi: ath12k: switch to name-based reserved memory lookup
abda58f4529d7 wifi: ath6kl: avoid buffer overreads in WMI event handlers
64d445d40e5ea ext4: validate readdir offset before accessing dirent
bd8d74bd46d09 ext4: use fsdata to track inline data write state and fix race
4e4e3eec50624 ext4: drain in-flight DIO before buffered write fallback
aa0042630b1f7 ext4: clear stale xarray tags on folios skipped during writeback
d7b025d3fdf3c thermal: intel: int3400: clean up ODVP on probe failures
466358635a2e4 iommu/arm-smmu-v3: Declare eats_s1chk and eats_trans as host-endian u64
267fb3771ddf6 iommu/qcom: Fix inverted fault report check in qcom_iommu_fault()
0812b282703a7 iommu/qcom: Remove sysfs device on probe failure path
8aabe0fba0148 iommu/amd: Fix undefined behavior in devid_write debugfs function
c3d4ef1c0ca69 firmware: arm_scmi: Fix requested device removal race
66d65f36d3975 RDMA/core: Fix potential use after free in ib_dealloc_pd_user()
8b22722f45a29 RDMA/core: Fix potential use after free in uverbs_free_dmah()
9abea37942534 RDMA/core: Fix potential use after free in ib_free_cq()
8c013e3a8d827 RDMA/core: Fix potential use after free in counter_release()
bedd7dee72588 RDMA/core: Fix potential use after free in ib_destroy_srq_user()
197c262dbf94c RDMA/core: Fix potential use after free in ib_destroy_cq_user()
038cf231b7099 RDMA/core: Fix use after free in ib_query_qp()
c538cd121be77 RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations
a07cba1296aaa RDMA/nldev: Fix locking when accessing mr->pd
b7091e0e2ebab RDMA/restrack: Fix typos in the comments
4aaa2ab816c71 RDMA/mana_ib: drain QP references after partial table insertion
a60c36d8d17f1 RDMA/erdma: Fix CEQ tasklet use-after-free on removal
53446b921cdd6 PCI: j721e: Fix incorrect max_lanes for J7200
8c24bda66dd1c RDMA/srpt: Pass the mapped task attribute to target_init_cmd()
e42cede6f9017 bpf: Mark bpf_refcount field as unique
28d5f20ed022a bpf: Preserve unique-field state across nested structs
dfdce1f20a7e5 bpf: Fix offset warn check for bpf_res_spin_lock
2d2616b4f3728 virt: arm-cca-guest: use migrate_disable() for attestation token requests
662f242863fd8 ACPI: battery: Adjust charging status validation check
26d9496c82658 bpf, riscv: Fix extable handling for arena load_acquire
34b1bb33a0257 riscv, bpf: Fix kernel stack corruption in tailcall with CFI
5cadc66b534fe riscv, bpf: Fix memory leak in bpf_jit_free
e991c317d4a00 libbpf: Search /lib64 and /lib in resolve_full_path()
1534c4bff3aac bpf: Zero queue and stack outputs on lock failure
5af710a4f3e39 platform/x86: acer-wmi: reject missing gaming WMI results
7ace189b9ea79 ext4: skip extra isize expansion during mount to prevent deadlock
6702c7da86d8c ext4: fix out-of-bounds read in ext4_read_inline_dir()
e4223231b6860 ext4: fix circular lock dependency in ext4_ext_migrate
3eee4c21931dc ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root
4d8ecaa332c16 ACPI: processor: validate MADT IOAPIC entry bounds
87735eb21d7e5 ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer
0bfa897e3e1a6 RDMA/nldev: validate dynamic counter attribute length
6eb1f1414bf70 irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc()
93290f29be8f9 selftests/bpf: Silence array bounds warning in global_map_resize
03cf3a1d950f4 selftests/bpf: Check malloc result with ASSERT_NEQ in test_sha256
86ce84cf93d2c x86/bugs: Don't use cpu-type matching in cpu_vuln_blacklist
1654875005c7b arm64: dts: imx8-ss-audio: Fix LPCG clock indices for ASRC0
18b1deba71546 kcsan: avoid unintended access checking in NMIs
af073bd245180 RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters
13cb7160e5b79 RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[]
3416db552eb37 RDMA/hfi1: Propagate sdma_txinit_ahg() errors
e166856d4ef2d arm64: dts: amlogic: meson-axg-s400: enable mipi_pcie_analog_dphy for PCIe
0da7e87b3044d arm64: dts: amlogic: meson-axg: Add missing nand_rb0 pin to nand_all_pins
624ddc40f2185 phy: starfive: Fix runtime PM cleanup in JH7110 DPHY RX probe
41cacaa222b0d phy: starfive: Fix runtime PM cleanup in JH7110 DPHY TX probe
8fec16898f184 ASoC: meson: Keep link pointers valid on realloc failure
20b92646ee030 dmaengine: dw-edma: Clear stale requests on termination
fe0ffa0190e86 dmaengine: dw-edma: Serialize channel state checks
0c3294066c36d dmaengine: dw-edma: Serialize abort state updates
be87d86537de7 dmaengine: dw-edma: Terminate all descriptors without callbacks
a968dffa5ab3c bpf: Reject arena frees below the arena base
122ad34f72583 drm/msm/a6xx: Fix RBBM_CLOCK_CNTL3_TP0 value in a730_hwcg
333246218efd5 driver core: soc: Unregister bus on early device registration failure
df5466412b362 software node: Fix software_node_get_reference_args() with index -1
13a234359ca8d perf ui hists: Fix uninitialized stack memory free on pstack allocation failure
398aca2f90122 mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition()
5c349c533e72a mtd: mtdswap: Avoid freeing registered blktrans device twice
b63058bd5e1be mtd: intel-dg: Fix runtime PM error path in probe
31f3f496da280 mtd: intel-dg: wake card on operations
533d0c5feef85 vfio/pci: clear vdev->msi_perm after freeing it on init failure
21d576fc7e298 char: xilinx_hwicap: unregister class on init errors
1a3258e105f71 ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove
29df4ee11433c ppdev: prevent overflow when setting port timeout
e4a7ace58941e cacheinfo: don't propagate DT/ACPI error when arch supplies info (arm64)
98bb638f583db misc: lan966x_pci: depopulate children on populate failure
c7ff7a70f405a misc: ad525x_dpot: use driver core groups for sysfs files
c8b85cad0fa49 misc: rtsx: add missing write register handling
a45d6dd3c11e9 misc: bcm-vk: Use acquire/release for msgq_inited
5310334762c3f speakup: keyhelp: guard letter_offsets possible out-of-range indexing
8688fe2941d54 accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status()
16695e9059d80 uio: Fix stale info pointer in failed registration path
1e805a7f4fe01 gpib: Move stuck SRQ update under lock
6c9f6a3b9fdd3 staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths
28ebc34373f04 staging: rtl8723bs: remove multiple blank lines in core/
368f19a5ed15f staging: rtl8723bs: replace rtw_zmalloc() with kzalloc()
aa89cd88ae034 staging: rtl8723bs: expand multiple assignment into separate statements
87ccaea185696 staging: rtl8723bs: fix operator and type cast spacing
d8664fa56c46b staging: rtl8723bs: use standard offsetof in cfg80211 operations
11b3765fcb71d staging: rtl8723bs: Fix operator spacing in rtw_security.c
8da8fd3df9fc1 UDF symlink pathComponent header OOB read
f42e35e9a7e69 tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64
2ed25c9d4400c usb: gadget: f_uac1_legacy: remove broken string configfs attributes
772f29206544f ACPI: processor: idle: Expand _LPI package sanity checks
19ae79f185bc5 crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping
d43e1bbfd4345 drm/msm: Only fini scheduler after successful init
6c472fde2c809 drm/msm: Fix task_struct reference leak in recover_worker
133c9aa5b896c drm/msm/a6xx: Fix A621 GPUCC register list for state capture
15d9b29c7da18 drm/msm/a6xx: Rebase GMU register offsets
8bc35465c51be drm/msm/a6xx: Fix A663 GPUCC register list for state capture
e36284257eeca drm/msm: Recover HW before retire hung submit
8298883bb3edb drm/msm/a6xx: Fix stale rpmh votes after suspend
9ad7a6ccc7b83 gpu: host1x: Avoid stack over-read in debug output helpers
9211efca5c657 gpu: host1x: Fix offset calculation in trace_write_gather
6b7d5abf3e374 wifi: iwlwifi: mei: pass correct argument to function
f26f72c244882 wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments
242125bbf19a2 wifi: iwlwifi: mei: check SAP message length before reading it
c9d8641aea01c wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser
8d8a526f3ec65 wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs
f20b182ff2d44 spi: geni-qcom: Fix sticky ret causing wrong return value on invalid proto
badb810da2b09 soc: renesas: r8a78000: Drop duplicate "default ARCH_RENESAS"
d9f25cc138c74 clk: qcom: gcc-glymur: Enable runtime PM
563a1fcf551cd perf jevents: Add more components to the metric sorting order
0b5f752d635c5 arm64: dts: qcom: sm8250: correct frequencies in the Iris OPP table
c795f18678de6 arm64: dts: qcom: sm8250: sort out Iris power domains
4e59a0b78e048 arm64: qcom: ipq5018: Add GEPHY RX and TX clocks
c9fed0c7056c5 arm64: dts: qcom: ipq5018: Correct CMN PLL reference clock rate
5d0fc8094678f arm64: dts: qcom: sc8280xp-x13s: Fix the drive-strength of mclk pin
188344787dacb arm64: dts: qcom: msm8996-xiaomi-gemini: Fix up ti,drv2604 enable GPIO
591b6fac9df3f x86/mm/pat: Take cpa_lock around large-page collapse
57c567e0e8aa7 drm/bridge: tc358767: clamp the reported AUX read size to the request
b6b68da41b270 perf: evsel: Fix error handling in tp_format lookup
4bc18263ef7ac remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdev
b44f085fb484d cpufreq: schedutil: Fix self-contradictory comment in sugov_iowait_apply()
c23a708a71afc cpufreq: intel_pstate: Fix setting minimum P-state at init time
ce51fcf0d2385 drm/amd/display: Remove unused-but-set variable hubp from
8ee385305e890 drm/amd/display: Fix DM I2C teardown race
5323ed5a7bb25 media: ipu6: Do not free aux device pdata after init
2c29cd408ef86 media: bcm2835-unicam: Fix asc leaked in error/remove path
96baeead354ab media: i2c: rdacm21: Fix missing media_entity_cleanup()
9acc996cb2e84 irqchip/renesas-irqc: Fix generic interrupt chip leak on remove
f6f6bdf1708ac PCI: xgene: Drop unnecessary OF node reference
9c001b7dd4d6c cpufreq: spear: Fix an IS_ERR() vs NULL bug in spear1340_set_cpu_rate()
6a37acecc7c29 dax: read holder_ops once in dax_holder_notify_failure()
91be086330c3f libnvdimm/labels: Bound the on-media label size before the shift
25b472c156364 tools/sched_ext: scx_qmap: Fix stale API name in comment
85e5eeb651a13 regulator: adp5055: Fix error code in adp5055_of_parse_cb()
b8abbd5c2928f cxl/features: Clamp Get Feature output size to the remaining buffer
1281dc84c8157 cxl/features: Reject Set Features output buffer smaller than the header
3f02031a0a53d cxl/features: Reject Get Feature count larger than the output buffer
c656427440ea6 firmware: arm_scmi: Fix transport device teardown lookup
3b0b02134ab90 firmware: arm_scmi: Unwind P2A receiver mailbox setup failure
717b8e972a667 firmware: arm_scmi: Unwind TX receiver mailbox setup failure
a54dc23e8bd22 firmware: arm_scmi: Drop handle on protocol bind failures
8197bc6acc517 firmware: arm_scmi: Protect device request lookup with RCU
71c1f8ced3cc0 firmware: arm_scmi: Use channel ID for transport teardown
e66756313d1b4 firmware: arm_scmi: Reject out of range DT protocol IDs
54e5a4f7d83db firmware: arm_scmi: Avoid IDR updates while cleaning channels
d7c60c0fe2bd4 firmware: arm_scmi: Free transport channel on IDR failure
d33b2b68bce6d firmware: arm_scmi: Clean up channels on setup failure
2aac23bc0a79a firmware: arm_scmi: Quiesce notifications before teardown
f5e528f631425 firmware: arm_scmi: Unregister device notifier before IDR teardown
1bea027f7ef6f firmware: arm_scmi: Publish channel state before callbacks
b967c097d1b6a x86/entry/fred: Encode frame pointer on entry
2bb2a778a4873 wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate
e31985c67ba00 hfsplus: validate thread record before delete key rebuild
5b894d01117b2 cxl/port: Restart port enumeration when a sibling adds the dport first
7a14b995931f1 cxl/pci: Honor -EPROBE_DEFER from component register setup
6ad491cef1a81 cxl/mbox: Break poison list loop on an empty payload
485bf44090491 cxl/memdev: Fix firmware upload exact-fit handling
a97eef0d6e2fe iommufd: Simplify iommufd_device_remove_vdev()
ecad679e2b92c rpmsg: glink: fix deadlock in endpoint destroy during driver detach
dd2b56f44be49 rpmsg: glink: remove duplicate code for rpmsg device remove
c7f41c7f7d68f perf record: Fix multiple PERF_RECORD_COMPRESSED2 records per push
f476567a3a965 perf record: Return the written size from process_comp_header()
8b771b43710f7 perf zstd: Fix compression error path in zstd_compress_stream_to_records()
ae69f936e8ffe fs/resctrl: Prevent use-after-free in rdtgroup_kn_put()
65e55f34fb2d6 media: v4l2-async: Unregister sub-device if asc_list is empty
f0b084c999606 iommufd/selftest: Avoid selftest dirty bitmap size wrap
cd616aa0449a7 isofs: fix out-of-bounds page array access on empty zisofs block
81ff877e458e0 ASoC: apple: mca: increase SERDES reset delay
1b769e5d5c33c RDMA/hfi1: Initialize debugfs after probe completes
a913960dd85dc RDMA/hfi1: Stop flushing the global IB workqueue
e32f985ea38aa RDMA/hfi1: Create workqueues before device initialization
460aaad5044d5 RDMA/hfi1: Remove redundant PCI device ID validation
149a14ec70887 RDMA/hfi1: Free RX data on late probe failure
fd4d3ad5f244a RDMA/hfi1: Preserve unit 0 on allocation failure
186df50ce26fb misc: rtsx_usb: avoid USB I/O in runtime autosuspend
1c1c2df09daac pmdomain: bcm: bcm2835: handle genpd provider registration errors
36cbb7249819a ALSA: hpi: Check transport errors during HPI6000 adapter initialization
0f679e0523ddf xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full
b0f7343a002f9 crash_dump: release keyring reference at the correct time
c115b908e3508 hwrng: ks-sa - Fix runtime PM cleanup on registration failure
4a52a2fb96d10 crypto: ccp - Fix memory leak in SEV INIT_EX path
634e56b4f9913 Revert "drm/msm: dsi: fix PLL init in bonded mode"
287f458ca2251 drm/msm/dp: add missing drm_edid_connector_update() before add_modes on cached EDID
399713f1f0eac RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state
8dc5ffcb8efcc RDMA/ipoib: Drain RCU callbacks during module teardown
7babc25d8dd5b RDMA/mlx5: Drain RCU callbacks during module teardown
9d998297fdaf4 RDMA/core: Wait for RCU callbacks before unloading ib_core
0e5c6bf4a04c8 iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE
dbe8894db922c wifi: rtw89: 8852a: fix RSSI report when average beacon RSSI is not ready
6e4b73b6b743d wifi: rtw89: phy: support per PHY RX statistics
0bae3ec6a16a9 wifi: rtw89: mlo: rearrange MLSR link decision flow
e0abd0b1e2f56 wifi: rtw89: debug: add parser to diagnose along DIAG_MAC fw element
84cb2ae9c0123 wifi: rtw89: fw: parse firmware element of DIAG_MAC
f345b7d23c6f0 wifi: rtw89: pci: add to read PCI configuration space from common code
0cfc9348a045d bpf: Require a BPF cpumask for bpf_cpumask_populate()
abe7ac019ad99 tools/sched_ext: Strip compatibility macros for cgroup and dispatch APIs
9257ece49ae72 clk: qcom: camcc-sc8280xp: unregister CAMCC_GDSC_CLK
086ac3881a8c2 bus: qcom-ebi2: use managed resources for clocks and children
03991f9a561ce soc: qcom: rpmh-rsc: manage PM notifiers with devres
dae798b950388 perf metricgroup: Fix metric expression copy leaks
846ce4d3fda94 drm/panel: samsung-s6d16d0: Power off on prepare failure
39b000d393dea usb: typec: ucsi: gaokun: unwind notifier on UCSI register failure
7f2d926a464bb usb: ucsi: huawei_gaokun: support mode switching
6b0d4519bcf09 usb: renesas_usbhs: Fix power-off ordering on unbind
f0cfba808e632 usb: mtu3: allow system suspend during active gadget connection
7fea5a310e3b2 platform/surface: acpi-notify: Check ACPI companion before use
71ba8b6e28f7a platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL
7e795801295c8 usb: fix UAF when probe runs concurrent to dyn ID removal
ff6e88e29965b usb: gadget: aspeed_udc: check endpoint DMA allocation
aed958c4f784a usb: ljca: bound bank_num in ljca_enumerate_gpio()
afbf39c0f2297 usb: gadget: configfs: fix out-of-bounds read of qw_sign
5fd8baacc7dc4 usb: gadget: f_fs: Fix fence cleanup in ffs_dmabuf_transfer() error paths
c02d030747c46 serial: qcom-geni: do not advance stale DMA completions
783961be18f5c serial: ma35d1: Fix OF node reference leaks in console init
4e2a433822524 serial: 8250: Clear CON_PRINTBUFFER on port re-registration
45c64f2c09b2d serial: 8250: Add support for console flow control
71d8fcbb767b8 serial: 8250: Set cons_flow on port registration
7416aefeeb822 serial: Replace driver usage of UPF_CONS_FLOW
b897b1f791f34 serial: core: Add dedicated uart_port field for console flow
ed07324ed4871 spi: qcom-geni: Fix missing error check on pm_runtime_get_sync()
4c59f0e5ee0df perf capstone: Fix kernel map reference count leak
45181de1077c0 selftests/sched_ext: Fix bpf_link leak on early return in prog_run
892bb4715265f hwspinlock: propagate errno when registering single lock
7420aac8b1f7e remoteproc: qcom_q6v5_adsp: Fix reference leak for device node
9a85e2d35e542 platform/x86: lg-laptop: Fix LED resource handling
c5c3e0036a7ae platform/x86: lg-laptop: Convert ACPI driver to a platform one
f7f83b0826738 platform/x86: lg-laptop: Drop debug-only ACPI notify handler
6ff6af62f042b platform/x86: dell-wmi-base: Fix resource leak on module load failure
9f860050c3d17 platform/x86: dell-privacy: Fix race condition
c9729ced165d6 ACPI: RISC-V: Fix riscv_acpi_add_prt_dep() loop handling
4cdcf4e19ed31 ACPI: RISC-V: Check acpi_get_handle() status in riscv_acpi_add_prt_dep()
7857f19b5219c ACPI: RISC-V: Fix riscv_acpi_irq_get_dep() loop termination
fbf9bb81b2153 printk: Fix possible console use-after-free
b84065e9a8307 printk: Introduce console_flush_one_record
d095438ac3320 leds: st1202: Validate LED reg property against channel count
4efb94335d70f leds: st1202: Disable channel when brightness is set to zero
9666b92fe2383 leds: st1202: Fix brightness having no effect while pattern mode is active
2176b43f70da0 leds: st1202: Set all pattern PWM slots to full after clearing pattern
48a05db611027 leds: st1202: Fix spurious pattern sequence start in setup
45dee22d52fd9 leds: st1202: Fix pattern duration prescaler and pattern_clear skip marker
b8136daec6308 leds: st1202: Stop pattern sequence before reprogramming
e774c612b7f8e leds: pca9532: Fix inverted GPIO output polarity
fb43400a3a0f3 iommu/amd: Fix false positive in SB IOAPIC IVRS validation
21750cb34ca87 iommu/amd: Add support for Hygon family 18h model 4h IOAPIC
1fe5653706500 iommu/amd: Prevent SB IOAPIC from overriding IVRS validation errors
3df590e85e1a2 iommu/msm: Return -ENOMEM on memory allocation failure in probe
9fb04596eb957 bpf: Fix security_bpf_map_create error handling
e7eda48c34679 iommu/mediatek-v1: Fix off-by-one in MT2701_LARB_NR_MAX
5587e7871ce99 bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation
86d54cf069fc5 bpf: Fix use-after-free on mm_struct in bpf_find_vma()
ca71ee2f6c28c efi: fix stale reference to efi_recover_from_page_fault()
2892f3f44bf86 bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux
78cae066f029a perf dso: Fix kallsyms DSO detection with fallback logic
e69d90bfae1aa perf vendor events amd: Reintroduce deprecated Zen 5 core events
71e3023c5dddf bpftool: Check EVP_Digest when computing excl_prog_hash
11afe1912140f udf: Mark LVID buffer as uptodate before marking it dirty
6648c47091837 usb: gadget: r8a66597: avoid double free of ep0_req in probe error path
1f44d001620fd usb: typec: ucsi: unregister debugfs entries on teardown
35bf61798e7d4 thermal/drivers/rcar: Fix error checking in probe()
593fda71983b9 staging: media: ipu7: fix pm_runtime refcount leak in ipu7_resume()
fb9fab1a4d635 staging: media: ipu7: fix pm_runtime refcount leak in ipu7_init_fw_code_region_by_sys()
947056a91d232 perf data convert json: Fix trace_seq memory leak in process_sample_event()
4b759af64a214 clk: qcom: gcc-qcs8300: Use retention for USB power domains
a2e4ebada6840 clk: qcom: gcc-qcs8300: Use retention for PCIe power domains
448f948c9767c arm64: dts: qcom: sc8180x-lenovo-flex-5g: Describe the display power net
3a624b08d7736 arm64: dts: qcom: sc8180x-lenovo-flex-5g: Rename regulator nodes
25026bef5183c arm64: dts: qcom: sc8180x-primus: Describe the display power net
76208cf896aab arm64: dts: qcom: sc8180x-primus: Rename regulator nodes
badb18b11215b arm64: dts: qcom: sc8280xp-arcata: Fix top USB-C DP alt mode
f60f495858379 clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister()
f8fe8cb89d3a8 clk: qcom: gdsc: propagate gdsc_enable() failure for ALWAYS_ON domains
e97f24ad63b83 clk: qcom: gdsc: propagate gdsc_check_status() errors from gdsc_poll_status
27b68ba9af9dd arm64: dts: qcom: Add #{address,size}-cells to Chromium-based /firmware
05a95478f9603 timekeeping: Account for monotonicity adjustment in ntp_error
0fcf7857ae110 y2038: uapi: Use 64-bit __kernel_old_timespec::tv_nsec on x32
db667d2970c75 time/namespace: Validate nanosecond field in proc_timens_set_offset()
ecd622375e6d5 timens: Simplify some calls to put_time_ns()
453812e92c760 timens: Add a __free() wrapper for put_time_ns()
b19176ff94a01 vdso/timens: Move functions to new file
6e4b520553836 x86/tsx: Make tsx_ctrl_state static
e165c01653920 timers/migration: Fix memory leak in tmigr_setup_groups() error path
ed7472619e614 timekeeping: Unwind aux clock sysfs children on failure
4222494df71bd clocksource: Unregister subsystem on device registration failure
f84b1c25712ab selftests: timers: leap-a-day: Fix -w option and update usage comment
d76656e421466 irqchip/gic-v3-its: Fix its node leak in gic_acpi_parse_madt_its()
68de28e0a098a irqchip/gic-v3-its: Fix memleak in its_probe_one()
8da5dc215ebc9 selftests/lsm: Fix memory leak in attr_lsm_count
4d6923a9912da selftests/bpf: Fix memory leak in msg_alloc_iov
58dc854c302a1 selftests/bpf: Fix memory leak in msg_alloc_iov error path
3201c4e882847 ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer()
737c928ff5092 staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()
89f9f433271fa staging: octeon: add missing napi_disable in cvm_oct_rx_shutdown
ab63b49bad0da staging: octeon: replace pr_warn with dev_warn in fill and rx paths
b62bc652590fe staging: octeon: ethernet-mem: replace pr_warn with dev_warn in free functions
269d16a78a5be staging: octeon: fix free_irq dev_id mismatch in cvm_oct_rx_shutdown
2c0c9956596e4 staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown
bcd95498f0cfe staging: fbtft: Use sysfs_emit_at() to print to sysfs file
c9191f2e2f35f greybus: audio: bound the topology section sizes against the fetched size
c458311637182 staging: sm750fb: Add missing Kconfig dependency
af65ceb437971 staging: sm750fb: gate dualview dataflow using g_dualview
311a2e65e42af staging: greybus: audio: correct sscanf() return value check
e7fccad2c8e6e wifi: mac80211_hwsim: avoid NULL skb in stop queue drain
2496d9829ab5e bus: qcom-ebi2: Fix clock leak on probe failure
e6edd7339153c bus: qcom-ebi2: Simplify with scoped for each OF child loop
3cf9e40432c5d clk: qcom: gcc-glymur: Move EVA clocks to critical clock list
7be3c0bae7c58 arm64: dts: qcom: hamoa: Fix clocks for HSPHYs
62b399c4e9856 arm64: dts: qcom: sm7225-fairphone-fp4: Fix address in fb node name
a81fad1ff1047 arm64: dts: qcom: sc8280xp-blackrock: switch to uefi rtc offset
e5965ae3f7c91 cgroup/cpuset: Make nr_deadline_tasks an atomic_t
3a1b23f9ede95 PM: sleep: Fix off-by-one in wakelocks number limit check
0f297bc93bbfd bus: ti-sysc: Fix /chosen node reference leak
ca795fc1d8a1a nvmet-rdma: fix response resource leak on queue teardown
0fed8c64266c2 nvmet-rdma: factor out response resource cleanup
e5a79244a3c52 nvme-apple: Use acquire/release for queue enabled state
7117f27eb3bfb arm64: dts: qcom: sm8750: wire UFS to ice instance
07974c267f603 RDMA/irdma: Add refcounting to user ring MRs
2ed1164153e92 RDMA/irdma: Add irdma_cq fields to track pbl allocations
e11379ca6e90b RDMA/irdma: Add a refcount to track user ring MR associations
8fb2c3106a911 RDMA/irdma: Deduplicate the irdma_del_memlist logic
5bbb726d27ff6 crypto: keembay - Fix AEAD unregister count in error path
e7d8ddd471d28 crypto: rk3288 - fail ahash requests on HASH idle timeout
62219775a07ce hwrng: xilinx-trng - propagate timeout before any data is read
91ded4742fcde crypto: sa2ul - stop probe if context pool creation fails
f4d347fb1309b crypto: atmel-sha204a - fix heap info leak on I2C transfer failure
e64d6f1aae8c8 crypto: atmel-ecc - reject hardware ECDH without a public key
9af019e213ada crypto: qat - clear AES key schedule from stack
6b19f343ae8ad crypto: qat - cancel work on re-enable SR-IOV timeout
cf293c9c7424d hwrng: core - fix rng list on registration error
48b8b438d2342 perf vendor events amd: Update Zen 5 core events
0f456e4eca61a perf/x86/amd/uncore: Add group validation
c6466466185c1 perf cs-etm: Fix thread leaks on trace queue init failure
47b3686dd841a tools/nolibc: mark arg1 operand in __nolibc_syscall0() as write-only
e3aa0446e37d1 fanotify: initialize permission event watchdog state
f2a01deff7d0d wifi: rtw89: fix HE extended capability length check
8f68dd7e4b2f9 wifi: rtw89: check return values in rtw89_ops_start_ap()
74f26d1fa61b2 wifi: rtw89: update format of addr cam H2C command
19052c700bff0 wifi: rtw89: fill addr cam H2C command by struct
847a5ba0ac75f platform/chrome: sensorhub: Fix memory overread in ring handler
e4e2d06623d32 selftests/rseq: Replace glibc-specific __GNUC_PREREQ with portable check
a776afa894245 csky: Fix a4/a5 restoration in syscall trace path
5ac21c880dcd6 iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure
69f73ad463b2e soundwire: qcom: Fix port exhaustion check in stream_alloc_ports
a13974410cee7 dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe
32f69e6c95b59 dmaengine: zynqmp_dma: fix race between runtime PM and device removal
ec927657524be dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers
e429184ed58d6 dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure
bc3b5e6519b8d mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug
d3498c7b587b7 mm: name the anonymous MMOP enum as enum mmop
420d65038c344 mm: change type of state in struct memory_block
fff12ff7b3c47 mm: convert memory block states (MEM_*) macros to enum
d5f2f741a9001 bpf,lsm: Drop bpf_prog_free from sleepable_lsm_hooks
01c5ad41cf4db selftests/bpf: Mask socket type flags in mptcpify prog
d51a838da7a79 selftests/bpf: Systematically add SO_REUSEADDR in start_server_addr
5e9f698298355 bpf: Copy per-CPU map value padding in copy_map_value_long()
e5f6d43168b2e tools/bpf/bpftool: Reset vmlinux BTF after struct_ops commands
82a43463ab091 tools/bpf/bpftool: Reset vmlinux BTF after map commands
46d27e56dbd63 drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup
8a3db9f593b64 drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup
68ce4f8223b78 regulator: tps6594: Fix device node reference leaks in multiphase loop
506a6aca57c78 perf tests: Fix flakiness in branch stack sampling tests
7980e2a92a76a perf test: Fixes for check branch stack sampling
82c0378d4569b perf tests: Fix flakiness in BPF counters test on hybrid systems
da65eac26fb1f perf test: Fix perf stat --bpf-counters on hybrid machines
0eec12a34b949 perf tests: Fix flakiness in trace record and replay test
81877759d7161 perf tests: Add robust record retry helper and use subsecond workloads
2ab5938f8427c perf test kvm: Add some basic perf kvm test coverage
f597922c6e521 perf tests: Skip metrics validation if system-wide recording lacks permission
98e165f28d9b4 perf test: Do not skip when some metrics tests succeeded
79ddb9f98a8ae perf test all metrics: Fully ignore Default metric failures
2f1b696dbbb26 perf test metrics: Update all metrics for possibly failing default metrics
97660f007672a perf test: Truncate test description to fit terminal width
de9c6dc47601f perf test: Truncate printed test descriptions dynamically to avoid terminal wrapping
17e39d310b884 perf test: Add -j/--junit option for JUnit XML test reports
bdd10298be150 perf test: Fix subtest status alignment for multi-digit indexes
68a81a1eb8d3c perf test: Add summary reporting
456e1e7ce2092 perf test: Show snippet failure output for verbose=1
a3d0aad7e44a1 perf test: Refactor parallel poll loop to drain all pipes simultaneously
1acc1bedf4e69 perf test: Drain pipe after child finishes to avoid losing output
a2590ff90dca6 wifi: ath12k: correct monitor destination ring size
5d80268945dfe media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define
6ee86a39a2ff6 media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define
9be10543297f0 riscv: kexec_file: Fix crashk_low_res not exclude bug
68ea6dd23b732 pinctrl: bcm2835: Don't remove an unregistered GPIO chip
d623e292c6a4c perf/x86/intel/uncore: Keep PCI PMUs working when MMIO/MSR setup fails
18fdd0978ec3d sched/fair: Fix overflow in update_tg_cfs_runnable()
912e7263488e1 mm/mm_init: fix incorrect node_spanned_pages
e2a7cee341986 drm/lima: call drm_mm_init() with a valid allocation range
d46160ed28478 clk: imx: scu: drop redundant init.ops variable assignment
79927acbd4594 arm64: dts: imx93-kontron: set memory node to 0x80000000/1GiB
6b82e11ed1833 ARM: imx: fix device_node refcount leaks in imx7_src_init()
cfec229dbe9ab ARM: imx: fix device_node refcount leak in imx_src_init()
9326fd5972eaa clk: hisilicon: reset: Use devm_kzalloc to initialize hisi_reset_controller
e921cc73fae68 ASoC: fsl_audmix: rework runtime PM handling in probe
1e8fddab6cbe5 ASoC: rt700-sdw: always drain jack work on remove
61cae8df14219 clk: stm32: add missing bitfield.h header
c77bf8b2ca740 clk: nuvoton: ma35d1: fix ma35d1_clk_pll_determine_rate logic
4c7503f14f25b clk: nuvoton: ma35d1: fix PLL_CTL1_FRAC bit field width and fractional calc
e165e15e1a9c8 clk: nuvoton: ma35d1: fix ignored div_u64 return values in PLL freq calculation
5e273be0a987a clk: moxart: remove unused variables, fix refcount leak
fe3e4196a57a9 clk: versaclock7: Fix APLL clock leak on probe failure
4ffaaef885fcc cxl/pci: Remove incorrect mbox.valid check in cxl_pci_type3_init_mailbox()
31d4841eca7c4 cxl/mbox: Clamp mailbox output allocation to the payload size
5b616612511eb media: cec-pin: Fix event FIFO ordering
f1fac4561cda1 soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap()
635914c60da26 HID: roccat: bound device-supplied profile index
dc32c7423b346 HID: nintendo: Fix imu_timestamp_us double increment per report
544ebb25bd58f HID: core: quiesce input in hid_hw_stop() to prevent use-after-free
97093398e75a7 selftests: proc: include fcntl.h in proc-pidns
e4728288473a5 platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count
f633cc23dbcc4 x86/cfi: Use symmetric SYM_START and SYM_END in __CFI_TYPE()
71ddadef3b912 sched_ext/scx_flatcg: Fix cvtime_delta race and add hweight scaling to bypass charging
9c73cf53361f2 smack: restrict smackfs/{direct,mapped} values to 0-255
01d32783bbe01 smack: deduplicate smackfs/{direct,mapped} file_operations
845525bfb547a smack: simplify write handlers of sysfs entries
c2ab27c2e1159 smack: fix incorrect task context in smack_msg_queue_msgrcv
04e674840f7e1 drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure
97b8580a112cc drm/bridge: cdns-dsi: Return an error pointer on allocation failure
4614b7cfaf813 drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format
e4c3fb6999a49 drm/rockchip: vop2: Add RK3576 to the RG swap special case
3a8aa74859dd7 drm/v3d: Clear queue->active_job when v3d_fence_create() fails
7d65d9651f104 drm/bridge: display-connector: trigger initial HPD event for DP
826426c26b243 drm/bridge: display-connector: don't autoenable HPD IRQ
396a193867c6e drm/rockchip: analogix_dp: Fix OF node reference leak via auto cleanup
55fda5c2887a2 drm/rockchip: analogix_dp: Enable hclk for RK3588
b4eb01616c0da drm/rockchip: vop2: Wait for layer cfg done before switching LAYERSEL_REGDONE_SEL
e97f4b4efc1ab drm/rockchip: vop2: Fix wrong wait target in layer cfg done check
362e005b816ee drm/rockchip: dw_dp: Release core resources
fe000d791c608 drm/rockchip: dw_dp: Add missing newline in dev_err_probe() message
82861bdcafda0 drm/rockchip: dw_dp: Simplify error handling
435de4476dd87 drm/bridge: synopsys: dw-dp: Set pixel mode by platform data
b2bec2d4a769d drm/bridge: synopsys: dw-dp: Support unregistering the AUX channel
5afa737da00e5 drm: lcdif: Wait for vblank before disabling DMA
fa633af222c82 drm: Remove unused header in drm_dumb_buffers.c
2a0423c648a6d Smack: Fix error in capability bypass
31507f01ba6d6 KVM: x86: Check EFER validity on KVM_SET_SREGS*
d975b36e56876 KVM: x86: Move the bulk of register specific code from x86.c to regs.c
10ddef36d1cc0 KVM: x86: Rename __{g,s}et_sregs2() => kvm_vcpu_ioctl_x86_{g,s}et_sregs2()
8c03b907b0955 KVM: x86: Extract REGS and SREGS runtime sync code to helpers
9b046de62b809 KVM: s390: Zero initialize data structures for inject_pfault_token
310df38690e9f KVM: x86: Disallow EFER.LME and EFER.LMA if long mode is not supported
5453b85c7ebb6 KVM: arm64: Remove VM-wide VNCR mapping counter
fd33e8abbcad1 media: dt-bindings: nxp,imx8-isi: Drop fsl,blk-ctrl requirement for i.MX8ULP
5cbd8761d001c KVM: arm64: Handle VNCR TLB invalidation race with vcpu_put() VNCR unmapping
892fb48d9dc77 KVM: arm64: nv: Fully update VNCR fixmap state in kvm_translate_vncr()
8195cf3f4a82e dm-pcache: validate the persisted dirty_tail chain at load
3d5a87cb909c1 dm-pcache: bound the logical key offset from persistent memory
01a700e9278da dm-pcache: reject a kset that overruns its segment
9693980cd7d2f wifi: rtw89: pci: add .shutdown callback to stop rfkill polling on reboot
9e8dd2a7a8ccb usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers()
d1856e87ee562 usb: cdnsp: fix wakeup from S3 after controller context loss
3776b82c8099e tracing/probes: Fix anon_stack check for unnamed bitfields in btf_find_struct_member
240558d6e6caf staging: sm750fb: fix mono image source stride mismatch in lynxfb_ops_imageblit()
e5daaf27b14db platform/x86: hp-wmi: Add support for OMEN MAX 16-ak0xxx (8DD6)
1b5c3f11ba548 platform/x86/amd/pmc: Fix msg_port restoration in amd_stb_debugfs_open_v2()
bf87d1ec3bc23 perf/x86/intel: Remove anythread_deprecated bit from perf_capabilities
cbb25069fd2e7 mm: fix incorrect vm_flags usage when checking allowable orders for tmpfs
853043cb12947 mm/secretmem: properly account locked pages
8e3adebbdd20f mm/mremap: reset unfaulted VMA page offset for MREMAP_DONTUNMAP
effe3cc6d4fdd mm/huge_memory: transfer the pmd dirty bit to the folio on zap
4f3145db05fed i3c: master: Fix use-after-free of master->this
d0cc00957292e i3c: master: Do not treat master device as a duplicate target
83fd7eca5ab0d ftrace: Take trace_array reference before accessing its ftrace_ops
3ae455597e3ea clk: qcom: Fix test_ctl_hi field for DEFAULT_EVO PLLs
45962da5821d0 accel/amdxdna: return early from a zero-length flush
be072a5d5e35f nvdimm: virtio_pmem: refcount requests for token lifetime
4fbee1039c460 io_uring/waitid: avoid siginfo copy during ring teardown
7549d2d113d4a nvdimm: virtio_pmem: use READ_ONCE()/WRITE_ONCE() for wait flags
0879697520abd io_uring/waitid: honor task_work cancellation
8c6bc1974311a nvdimm: virtio_pmem: always wake -ENOSPC waiters
63e1a529bb89b io_uring: add wrapper type for io_req_tw_func_t arg
c5e2e145bc5e3 nvdimm: virtio_pmem: stop allocating child flush bio
0860017371131 io_uring: only call io_should_terminate_tw() once for ctx
d0f37d77b9b4b tracing: Take trace_array reference when opening options file
23a02ff3464b2 i2c: qcom-cci: fix autosuspend cleanup
844839aa89e79 futex: Provide rt_mutex_.*_schedule() equivalents for futex scheduling
770a90c212722 nvdimm: pmem: keep PREFLUSH before data writes
15d10440b7968 io_uring/waitid: have io_waitid_complete() remove wait queue entry
76648677aa6ef tracing: Make printk_trace global for tracing system
538ef70da5229 i2c: qcom-cci: Remove overcautious disable_irq() calls
884e8484c5fe8 futex: Optimize futex hash bucket access patterns
5f00df2a88ab4 udf: Fix data loss when converting inline inodes to out of line
e4cb2bbe73089 tracing/probes: Fix BTF kflag check for anonymous struct member access
4420cc71841b5 staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()
6ba2bacc2dd3e ring-buffer: Allow splice reads on static buffers
f5eed5182d664 platform/x86: ISST: Validate max level for set feature
08dab7065f936 platform/x86: int1092: Fix potential memory leak in sar_probe()
929cb3b9dc818 perf: Fix use-after-free when perf mmap() revival races with the last munmap()
2050d900f9adb PCI: Allow per function PCI slots to fix slot reset on s390
7fad53ae2052a nvme: skip the zoned limits update if the zone info query failed
6906fb70af2de net/mlx5e: do not HW-GRO coalesce small frames
558bfaea4926c mtd: rawnand: pl353: Make sure we use the monolithic helpers for raw accesses
824348676a50f misc: fastrpc: don't publish fd before copy_to_user() succeeds
f3d97800b03cd iio: light: apds9306: fix PM reference leak in apds9306_read_data()
b25232f66e8cd i3c: master: Fix recursive locking during device registration
e9e52437120fb ALSA: FCP: do not copy out an uninitialised init response
5881506012f39 nvdimm: preserve flush callback -ENOMEM
545daf1133323 io_uring: unify task_work cancelation checks
400607f57f11d tracing: Clean up use of trace_create_maxlat_file()
871019760cd42 i2c: qcom-cci: Do not check return value of cci_init()
54bc09b41bf3a compiler_types: Move lock checking attributes to compiler-context-analysis.h
9e5abb5e2ade0 wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy
84d983e550c75 udf: Move udf_map_block() up
7d73adba5c851 tracing/probes: ignore id update from btf_type_skip_modifiers
956cb6c72ae5c staging: rtl8723bs: fix spacing around operators
cca153095a185 ring-buffer: Show persistent buffer dropped events in trace_pipe file
803208a50b042 PM: runtime: Wrapper macros for ACQUIRE()/ACQUIRE_ERR()
0d4fb4f15e550 platform/x86: ISST: Check for admin capability for write commands
e94b156e5cad0 platform/x86: intel_sar: Check ACPI_HANDLE() against NULL
b07bcdca18fb9 perf/core: Fix deadlock in perf_mmap() failure path
1d7be6ff21edc PCI: Introduce PCI_SLOT_PLACEHOLDER constant for slot_nr placeholder value
b8adb1ffa263c nvme: fold nvme_config_discard() into nvme_update_disk_info()
2158e178dfc85 net/mlx5e: SHAMPO, Always calculate page size
285f7f3a651c7 mtd: rawnand: pl353: Add message about ECC mode
7ef12e1dd06e4 i3c: master: Fix device_register() error path
69d57dbadb27f dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds
9d89ffd9101c8 ALSA: usb-audio: Relax __free() variable declarations
37ac5eb981f42 batman-adv: fix TX priority extraction for BATADV_FORW_MCAST
a1a0959b2da03 mm/damon/sysfs: read ops_id only once in damon_sysfs_apply_inputs()
8bcfa58c4277b batman-adv: bla: avoid CRC corruption due to parallel claim add
a5e4d6cb4f684 batman-adv: dat: atomically update mac addresses
463743d1d5ef2 drm/amd/display: Scale custom brightness curve from full range
7e56deae5a796 drm/amd/display: Fix backlight max_brightness to match exported range
54a97ef102523 net/mlx5e: xsk: Fix unlocked writing to ICOSQ
f6388029ea9e2 Linux 6.18.51
d83a9de7cecd4 ksmbd: zero pipe read compound padding
75640976cf474 cifs: add fscache_resize_cookie() to cifs_setsize()
d73f79d1a2c26 mm/hugetlb_vmemmap: fix incorrect vmemmap restore in rollback
15803e2276067 pidfs: protect PIDFD_GET_* ioctls() via ifdef
ed7380f4621f6 mm/huge_memory: use folio's memcg inside __folio_split()
80656031dfcd4 migrate: replace RMP_ flags with TTU_ flags
e4307837d92ca mm/huge_memory: replace can_split_folio() with direct refcount calculation
f07c94cd3cc20 mm/huge_memory: change folio_split_supported() to folio_check_splittable()
305f9b6eb8a06 mm: thp: use folio_batch to handle THP splitting in deferred_split_scan()
0a4a3d7202640 mm: thp: introduce folio_split_queue_lock and its variants
d913a85cc5f7a mm/damon/core: initialize damos->last_applied
05bdb7b867bef mm/damon/core-kunit: handle region split failure in filter_out()
7d4ecfb507f33 mm/damon/sysfs: read addr_unit only once in damon_sysfs_apply_inputs()
cd6d7f45abc82 mm/damon/core: skip aging from repeated aggressive merging
081ee85b43096 mm/damon/ops-common: use nr_accesses moving sum for quota score
cf94a9043f4a6 mm/damon/paddr: drop last same folio access check reuse optimization
11e4859ec0d8b mm/damon/vaddr: drop last same folio access check optimization
4c7275444ac65 mm/damon/tests/core-kunit: catch test failure in test_merge_regions_of()
05dc22d5c4fac iommu/arm-smmu-v3: Add HAFT support for SVA
c660c017dec1f power: supply: ab8500_fg: fix use-after-free on remove
68916940332d1 power: supply: ab8500_fg: Remove redundant dev_err()/dev_err_probe()
62fb3124bf740 Docs/ABI/damon: fix typo in intervals_goal sysfs path
1811bd8792ee1 mm/hugetlb_vmemmap: fix __hugetlb_vmemmap_optimize_folios()
dba93b8cceb00 hugetlb: remove VMEMMAP_SYNCHRONIZE_RCU
e4d1300b457e2 mm: rework compound_head() for power-of-2 sizeof(struct page)
5cec3e60e9f2d zram: set default primary compressor in zram_destroy_comps()
fb0e9ecffae59 zram: fix the issue that the write - back limits might overflow
9a78de3befad6 zram: read slot block idx under slot lock
fcd467124b19f zram: drop wb_limit_lock
d1743ec2dd2c8 zram: take write lock in wb limit store handlers
e7dbcb7a561a2 zram: fix out-of-bounds access in read_block_state()
878edb39ecf48 zram: fixup read_block_state()
83dd59ac1c345 NFSD: Prevent client use-after-free during close_lru reaping
cd489b0358737 NFSD: Prevent client use-after-free during blocked-lock reaping
7f1abc50ce253 NFSD: Consolidate the revocation-path client unpin
3be89e8039a85 smb: client: reject a tree connect response whose byte count is too small
b7e74bccf5887 cifs: Do some preparation prior to organising the function declarations
672cf86aa6aa0 smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()
9eed72e9534b1 smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2
31307a05ed827 cifs: SMB1 split: Separate out SMB1 decls into smb1proto.h
6493277a52b24 cifs: SMB1 split: Create smb1proto.h for SMB1 declarations
e7779c9f7e7f9 cifs: Remove dead function prototypes
b10015807e4c6 smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions
a3e8b98c823d5 cifs: Scripted clean up fs/smb/client/smb2proto.h
72796c2ec6e90 cifs: Scripted clean up fs/smb/client/fs_context.h
4fb5a561866c4 cifs: Scripted clean up fs/smb/client/fscache.h
1537c6c675104 cifs: Scripted clean up fs/smb/client/cifs_unicode.h
549bd9868e9d7 NFSD: Prevent client use-after-free during admin state revocation
3c0a53ee0b442 NFSD: Prevent client use-after-free during delegation revoke
969b1fefb07d1 nfsd: convert global state_lock to per-net deleg_lock
6d6b9f6a75c37 nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache
9031493ef7369 nfsd: fix UAF in async copy cancel and shutdown
ba0ee9e04b7a0 nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net
f9cec313efb2f nfsd: fix clock domain mismatch in clients_still_reclaiming()
03c512f22d3fb nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage
ccc069d5c47cd nfsd: move struct nfsd_genl_rqstp to nfsctl.c
430ed49a16cf9 nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create()
380d138a6b086 net: advertise TCP MSS from the configured MTU, not the learned PMTU
cfb44c6028e6f tcp: clamp route advmss to TCP_MIN_MSS
ea44679bc7d21 ipv4: use dst4_mtu() instead of dst_mtu()
a615a2c8c3062 ipv6: use dst6_mtu() instead of dst_mtu()
920dacce8734d inet: add dst4_mtu() and dst6_mtu() helpers
b650560c5ee21 ipv6: add some unlikely()/likely() clauses in ip6_output.c
a294168185fe8 ipv6: pass proto by value to ipv6_push_nfrag_opts() and ipv6_push_frag_opts()
194d0fb0ea472 fuse: copy request headers via a stack buffer for io-uring
b96b0d2c25d14 fuse-uring: use named constants for io-uring iovec indices
f12ebb0a3ed7d fuse-uring: refactor setting up copy state for payload copying
121fc8edf5832 fuse-uring: use enum types for header copying
c46805193fbef fuse-uring: refactor io-uring header copying from ring
6bb5347e9f8aa fuse-uring: refactor io-uring header copying to ring
8974575898cd7 fuse: fix missing barrier when checking io-uring readiness
f1c91222188be PCI: starfive: Fix resource leaks on error paths in host_init()
e5c1d10003b4d PCI: starfive: Use regulator APIs to control the 3v3 power supply of PCIe slots
0d72e78c9d38d lockd: fix swapped arguments in nlmsvc_match_ip()
fcfcba8fe17db ocfs2: validate directory-index entry counts when reading metadata
625e00fd25ef5 ocfs2: validate dx_root extent list fields during block read
a1dabe68fb537 ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page
a6f3b8dfbdf4f ASoC: codecs: aw88261: only check PLL and clock state at power-up
0ac722e964cdc ASoC: codecs: aw88261: reduce log spam
d013b7de4dccf remoteproc: qcom: pas: Guard dtb metadata release with dtb_pas_id check
d6eab9066be0f firmware: qcom_scm: Rename peripheral as pas_id
9d69422ddaa13 sched/core: Make core-sched flips wait for in-flight selections
fef4b8f17e1c5 sched: Rework prev_balance() to avoid stale prev references
c522333c35d48 sched: Add assert_balance_callbacks_empty helper
c97be9d5ab04c sched_ext: Fix inverted ops.core_sched_before() invocation
c4ade059aaeb5 scsi: fnic: Use GFP_ATOMIC for VLAN alloc under spinlock
c98197ee3cd28 RDMA/ionic: Embed counter driver data in rdma_counter allocation
27b7b0dacae79 sched_ext: Fix exit_task leak on fork failure during enable
1a3af2262cb38 svcrdma: Reject Read lists that exceed the page budget
59bcf1b38f898 svcrdma: Reject oversized Read segments at decode time
3c97b8e76ca2b rpcrdma: arm rn_done before publishing the notification
9f2f5d0999364 svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id
ee7f6e5600ae1 svcrdma: Release transport resources synchronously
3ff45361e9469 SUNRPC: fix gssx_dec_option_array error path bugs
5563db13c9528 cxl/mce: Make the MCE notifier per-region
513a9613f7a63 cxl/region: Add helper to check Soft Reserved containment by CXL regions
040cface98ffd dax/cxl, hmem: Initialize hmem early and defer dax_cxl binding
dfc86b0c2698e cxl/ras: Fix cxl_rch_get_aer_severity() wrong severity register
ccf481d73bce6 bpf: Disable preemption in bpf_get_stackid
b466ff95324f8 bpf: Use stack id functions instead of __bpf_get_stackid
73ebef25aec49 bpf: Factor stackid_new_bucket from __bpf_get_stackid
ba1e22a224c39 bpf: Factor stackid_fastpath function from __bpf_get_stackid
201a381bef3ac bpf: Factor stackid_init function from __bpf_get_stackid
7c19b94c625dc cpufreq: apple-soc: Fix OPP table cleanup
e989cede44392 ACPI: TAD: Add locking around AML evaluations
dd440f6a2e67f ACPI: TAD: Rearrange RT data validation checking
0a7a192862232 ACPI: x86/rtc-cmos: Use platform device for driver binding
ec2d81115485d ACPI: x86: cmos_rtc: Create a CMOS RTC platform device
f2e08c3f994c9 ACPI: CPPC: Reject desired_perf reads on _CPC revision 4+
7267557ce98cc erofs: skip sufficiently large global buffers when resizing
03c34309eb1bc HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes
1a503fbb116da HID: mcp2221: fix OOB write in mcp2221_raw_event()
3b4709e486490 HID: sony: clean up device list on probe failure
a15def9a6311e HID: sony: use guard() and scoped_guard()
d2dd2cced65bc cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem
85d239160dc1b smb/client: emulate small EOF-extending mode 0 fallocate ranges
41f4c99787398 smb/client: reduce fallocate zero buffer allocation
c2ae13662137c smb: move some definitions from common/smb2pdu.h into common/fscc.h
110747ff535e3 ceph: properly decrypt filenames in vmalloc() buffers
104a51265042b NFSD: Guard admin state-revocation walks with NFSD_NET_UP
0e763ab306a81 ceph: force a cap message when a deferred revoke can't be acked immediately
c040e139f1a62 ceph: cap delegated inode count in ceph_parse_deleg_inos()
8bd3523df1319 cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read
6f9b62687a383 cxl/pci: Move CXL driver's RCH error handling into core/ras_rch.c
153b5ecd29ed0 usb: gadget: f_fs: Fix Use-After-Free in AIO error path
f3d31484b3f26 USB: gadget: ffs: fix mm lifetime handling
06c76d3c389ff mm/page_alloc: don't spin_trylock() in NMI on UP
22bbde1960d1d x86/xen: fix init of balloon stats again
6f53c64a880ff xen/balloon: improve accuracy of initial balloon target for dom0
b4a6050bde9ec mm/slub: fix missing debugfs entries for caches created before sysfs init
d08ea0fd70386 mm/slab: move and refactor __kmem_cache_alias()
e7bd804e3c719 mm/rmap: use huge_ptep_get() in try_to_migrate_one()
54a58d6656dd4 mm/mglru: fix and remove redundant unevictable folio handling
d4812d21689f1 mm/mglru: use the common routine for dirty/writeback reactivation
09505232eced5 mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier
daeffb841bb96 mm/hugetlb: refactor code around vmemmap_walk
b662d7bcb5ecd mm/hugetlb: defer vmemmap population for bootmem hugepages
edc017be82664 rust: bug: prevent dead_code warning from warn_on!'s flags constant
cf24ce48d6022 pidfd: hold exec_update_lock around namespace ioctl
7aa9ab5321589 pidfs: simplify PIDFD_GET_<type>_NAMESPACE ioctls
2fa220bc0f845 ovl: fix double end_creating() on the casefold-mismatch path
1c4b90902c05c crypto: atmel-ecc - avoid stale fallback key after set_secret failure
5c1e763b713f0 crypto: atmel-ecc - clean up and improve ECDH comments
e39767b9a54d9 crypto: atmel-ecc - replace min_t with min
fc933a4a419ba crypto: iaa - unmap dst before software fallback on decompress
4fcbc9f4082ca crypto: iaa - fall back to software for multi-entry scatterlists
1517d1996b523 vlan: fix skb_under_panic and races when toggling HW VLAN offload
ed25ed29034dd net/packet: defer vmalloc TX_RING free until skbs finish
0f93090445294 fuse: fix race between interrupt and resend
f98640c27cde3 fuse: remove fm arg of args->end callback
952f7a6d392b8 fuse: split off fuse_args and related definitions into a separate header
a5bb215dbc34b fuse: publish io-uring queues with release semantics
c051f66b62169 usb: xhci: bail out of setup if the controller is inaccessible
f0ccc2d323d06 usb: xhci: simplify handling of Structural Parameters 1 values
46fb722a3bcf0 usb: xhci: use cached HCSPARAMS1 value
4e141571d0257 usb: xhci: implement USB Port Register Set struct
8dbc9c86c3186 usb: xhci: add USB Port Register Set struct
8b7ca0029e94b usb: xhci: add helper to read PORTSC register
a363197790a87 usb: xhci: add tracing for PORTSC register writes
78e8ee25a5e8f afs: Fix leak of ungot volume
c8279ae8df68c ksmbd: fix use-after-free in oplock break notification
e5e7a61fa9e82 drm/nouveau/gsp: fix vblank interrupts on GB20x
dc7c40ffaa1b6 drm/nouveau/disp: fix head state readback on GB20x
0e346b65a4130 drm/nouveau/disp: fix HDMI GCP AVMute register offsets on GB20x
ecb110991bc94 drm/nouveau/disp: fix HDMI vendor infoframes on GB20x
4739d519def72 drm/nouveau/disp: route GSP-RM display MMIO through nvkm_disp_func hooks
94d8195eb4185 drm/nouveau/disp: move the GSP HDMI GCP AVMute write to engine/disp
a046e789ab66e drm/nouveau/disp: move GSP head-timing ISR and vblank helpers to tu102.c
1101cbfe7f342 drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE
24c25b182d17d drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE
b7dc03e09313d drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op
4cf436de06ca9 drm/nouveau: Use write-combined maps for coherent
f3830fdd6930e drm/nouveau: unsubscribe the channel-kill event before the fence context
5ba4bcb3b96cd drm/nouveau/gsp: use per-version DP_CONFIG_STREAM params on r570 firmware
859d8b6c5b274 drm/sysfb: ofdrm: Fix is_avivo() constant comparison bug
ded6ad826fe0f drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation
6892f0a2f6b59 drm/sysfb: simpledrm: Improve stride validation
54e32ad5e0c74 drm/sysfb: simpledrm: Improve panel-size validation
8d65b8d1722d8 drm/sysfb: simpledrm: Improve framebuffer-size validation
fd3462acf6590 drm/amdkfd: Reject zero-sized AQL queue allocations after size halving
ebffa44e7a21e drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore
ae806a95b28fc drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram
da87bcad1f781 drm/amdkfd: Fix error path at svm_migrate_copy_to_ram
e230c546ed937 drm/amdkfd: Add TLB flush after MES queue eviction/suspension
2e4b909fab96c drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT
65e643703f150 drm/amdgpu: update the fw version for gfx12 userqueues
b7cb1b6696137 drm/amdgpu: update the fw version for gfx11 userqueues
8de8b4e11ce48 drm/amdgpu: Skip accessing psp rum time db for APUs
492dbf832964c drm/amdgpu: fix autosuspend cleanup during removal
812c406f75291 drm/amdgpu: Disable runtime PM for externally attached dGPUs
964de255497ff drm/amdgpu: clamp the isolation index for rings outside a partition
b3a7e0b69903e drm/amdgpu: check thunderbolt before switcheroo registration
66b1b30988633 drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used
acd2dd6ecd89e drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value
72a95df6bbc7d drm/gud: validate TV mode names before creating enum property
b86438a5c6b02 drm/gud: NUL-terminate TV mode names read from the device
7e28853c78c20 drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check
0b2615b8b54f5 drm/amd/display: validate plane degamma LUT size for private color prop
295d2bf42061d drm/amd/display: fix dc_lock leak on GPU reset error paths
ee28fafb50f58 drm/amd/display: avoid divide-by-zero in __is_lut_linear()
4ac7677221754 drm/hibmc: Use drm_atomic_helper_check_plane_state()
ed38f0be5b61d drm/hibmc: Fix list of formats on the primary plane
f5acd8f48cacc drm/nouveau/disp/r535: Add scanline position support + head state support
6f9bdbe713fdf drm/ssd130x: fix column and row end address in partial updates in ssd133x
6f776d0e43e04 drm/sun4i: fix refcount leak in sun4i_backend_init_sat()
63c70e292e6b4 drm/ssd130x: fix column and row end address in partial updates for ssd132x
18b3433f10ee9 drm/i915: Guard against NULL driver_data in i915_pci_probe()
79d09cfe90304 drm: fix race between partial drm_dev_register() failure and ioctl
0259846b15a66 drm/panel-edp: fix i2c adapter leak on probe failure
b51d8fb5e58c2 drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure
80c9528661c77 drm/panthor: fix firmware control interface bounds checks
5516f1acfd075 drm/panthor: harden firmware build-info bounds checks
ef41e8e4ae5b7 drm/xe/vram: report FLAT_CCS base misalignment
e184e46ca1ba6 drm/amdgpu: Fix init ordering in amdgpu_vram_mgr_init()
91ec55ddc097c f2fs: fix to zero post-EOF data when extending file size
a984446aa9d5b f2fs: fix to pass folio->index to f2fs_sanity_check_node_footer()
dde99df5a9d3b f2fs: fix valid block count leak on data block allocation failure
ab35ae07f2b5b f2fs: fix to clear dirty flag on folio in error path
c16cc4622e4b6 f2fs: fix to off-by-one issue in f2fs_zero_post_eof_page()
f6c49fae98f0f f2fs: fix i_size when pinned fallocate partially fails
161513f53e4ac f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages()
b8ae1228c1536 f2fs: fix to migrate all curseg types during free_segment_range
aefcec3bebdee f2fs: avoid NULL checkpoint thread access in sysfs
aefb4b0f465b6 f2fs: fix dentry folio leak in find_in_level
94917ffab3a94 f2fs: fix to avoid potential section-unaligned pinfile
3e61c3944b83c f2fs: return writeback error from collapse range
3b681229e9f8f f2fs: use the mount idmap for the owner check in f2fs_xattr_advise_set()
db504781ea9b0 f2fs: dirty directory inodes on mtime/ctime update
dc652b2fe916c f2fs: fix to avoid move_range and defragment on device_alias file
445e4a1e6025e f2fs: only redirty pinned folios in redirty_blocks
7f89e2775d5bb f2fs: reject overlapping move range after len expansion
95d5975c9d1c5 f2fs: return symlink writeback errors
ac4b019ac0784 scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started
4fe5790674097 scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak
0bdd0f7a1094a scsi: qla2xxx: Use coherent DMA buffer for D_Port diagnostics
776e4e8cbcf15 scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition
16c731c4f2961 scsi: qla2xxx: Drop vport reference under lock in report ID acquisition
17fb63c1d0fcd scsi: qla2xxx: Fix NVMe abort reference leak on repeated abort
5dd9bec8004ba scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry()
d7f7746ff031a scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read
9fa1d71233a82 scsi: qla2xxx: Avoid double completion in async IOCB timeout
10e9f05f7fd0a scsi: qla2xxx: Quiesce response IRQ before freeing request queue
31715d1e1cbf3 scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb()
e93aa3c5125d9 scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path
a194684853dce scsi: qla2xxx: Don't query firmware state while chip is down
7203d4aed8f44 scsi: qla2xxx: Fix FCE trace enable parsing in debugfs
e6cfb1ee18336 scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state()
8e7a26931b611 scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump
8286a9095fb59 scsi: qla2xxx: Fix cs84xx use-after-free on host teardown
8d11613711937 scsi: qla2xxx: Serialize flash version read in reset handler
7a448f5ed0b28 scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation
11834e5773e20 scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject
7b22b4cb88228 scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions()
5ecdb336df2a9 scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config()
67f0d5187c293 scsi: qla2xxx: Initialize NVMe abort_work once at submission
47272152a13d2 scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()
206df5ffa72dc scsi: qla2xxx: Fix Name Server logout detection on FWI2 adapters
94bfb61478bcb scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check
97ca58b0fb026 scsi: qla2xxx: Bound i2c->length in I2C bsg handlers
b157256c28086 scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers
dec5624a3f8cb media: chips-media: wave5: Set inst->std during default format initialization
a0506198a77b9 media: chips-media: wave5: Guard bit depth check with initial_info_obtained
ff98cd2b8b54c media: qcom: iris: use disable_irq() during power-off
ab6f088a44ef7 media: qcom: iris: fix state-change debug log printing stale value
f1c4f3885df1f media: zoran: Avoid freeing a registered video_device twice
dc005cb7ccb0c media: vimc: fix pixel format lookup in enum_framesizes
52fd9d80c0cea media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure
4a187d9443845 media: venus: fix payload size calculation in parse_raw_formats()
d031b5ecc4b39 media: venus: fix payload size returned by parse_caps() and parse_alloc_mode()
3ced388b79082 media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link
331f22dd63bf9 media: v4l2-ctrls: Allow unknown HDR10 white point and luminance
3345746e0957b media: v4l2-async: avoid deleting unlinked ASC entry on link error
7c62bd6535639 media: tda18250: fix possible integer overflow
4d2048466af9e media: saa7164: fix cleanup on resource allocation failure
342632a4d8ba3 media: s2255: check firmware size before reading trailing marker
68d664f1b4efe media: s2255: bound JPEG frame size before copying into the buffer
93e6ed88f5084 media: rzg2l-cru: Align bytesperline to hardware DMA stride requirement
26a2a985bbeee media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure
7443b16b6dd88 media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak
12b88016c199e media: rkvdec: Propagate platform_get_irq() errors
5b58d8c206f37 media: rc: sunxi-cir: Unregister rc device on probe failure
8281acf5d7049 media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks
9392375dd4c01 media: nxp: imx8-isi: Correct color map between V4L2 and ISI
2f9b2768d5ceb media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing
5026f927ef415 media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup
252850653569f media: platform: mtk-mdp3: Fix SCP device refcounting
96dafbae77f50 media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common
24aca88390388 media: iris: Enumerate cap->bus_info to differentiate between encoder and decoder
27b7997be552e media: intel/ipu6: fix async notifier cleanup leak on parse error
1d59c5254c33a media: imx355: Avoid calling imx355_power_off twice in error path
af81f35e4f429 media: i2c: ov7740: fix use-after-destroy in remove
90f9b421fc6d4 media: i2c: ov02a10: fix endpoint parsing use-after-free
4f8fd40b39bf7 media: i2c: imx415: Return test pattern write errors
1aa66bb3ba440 media: i2c: imx415: Release runtime PM reference on VBLANK error
312c68e9ed8a4 media: i2c: alvium: Fix: Correct name of register in alvium_set_ctrl_auto_exposure
0745a59945d92 media: go7007: defer the ALSA v4l2 put until card release
0782807552b6a media: em28xx: fix use-after-free of dev_next->devlist on disconnect
f9322ac9f8629 media: em28xx: defer audio-only extension registration
bf3f49273d5bf media: cx23885: cancel NetUP CI work before teardown
7087bef6510c7 media: cx231xx: reject geometry changes while the VBI queue is busy
cb1218da234ea media: cobalt: Avoid freeing ALSA private data twice
f78cf36cabf91 media: cedrus: fix memory leak in cedrus_init_ctrls()
5c62095acc2a9 media: cec: Serialize exclusive follower delivery
38c14532adb34 media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash
673611cc2ab97 media: cec: extron-da-hd-4k-plus: add sanity check
a3adb63b12193 media: cec: disable delayed work before freeing an interrupted transmit
695063fc57574 media: cec: core: Fix kmemleak due to missed rc_free_device() call
cb7a4cf63fa20 media: amphion: Remove obsolete frame_count check in venc_start_session
297fee023f46d media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref
347e9d2246b89 rust: drm: ioctl: fix unbounded lifetimes in ioctl handler arguments
76395109a051b LoongArch: Avoid preempt count underflow without probe
266ffc92e6859 LoongArch: Do not save/restore percpu base register in rethook trampoline
d692b825dc246 LoongArch: Do not select HAVE_RUST when KASAN is enabled
d3fd094c13c6d LoongArch: Fix acpi_package_ids[] array overflow
882b8912b7e92 LoongArch: BPF: Refactor jump offset calculation in tail call
462e6abc8293f LoongArch: BPF: Optimize redundant TCC loads in epilogue
ab275a23b4d9f LoongArch: Add DIRECT_MAP_PHYSMEM_END definition
4e4dbc341b158 LoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY
6b78786ee7260 LoongArch: KVM: Free init resources if kvm_init() fails
07c3037e45c94 LoongArch: KVM: Fix TOCTOU race on pv_features
b7fab314ade26 LoongArch: KVM: Fix PC double advance in kernel MMIO read fast path
566b1f08d9836 KVM: arm64: Correctly cap TLBI Range to the architural limit
3d4c26b16a04a KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save
2f1a571af300e KVM: arm64: vgic: Reset in_kernel on private IRQ allocation failure
de9b4e8f37ce6 KVM: arm64: vgic: Fix detection of MI on no pending LR
7631f95297560 KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables
72bce82c4171b KVM: arm64: Sign-extend VA for range-based TLBI invalidation
d8580e7aa189b KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry
ce447651a52ec KVM: arm64: Correctly handle end of VA space TLBI invalidation
be54a70067c7d KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation
6408605cbd509 KVM: arm64: Consider SCTLR_EL2.M when mapping the L1 VNCR page
150c43473dcf0 KVM: s390: Restore sigset on error path
5ed801685a8a3 KVM: s390: pv: Fix rc/rrc offset for PVM_DUMP
6ee52d3af2a1b KVM: s390: Fix memory corruption by not reinjecting CK machine checks
3904a3296e40d KVM: s390: Zero initialize irq in reinject_machine_check
cc710ee45395e KVM: s390: Take srcu when importing watchpoint data
b5acacfdb8966 KVM: s390: Free guest debug data on vcpu destroy
f55e4d415d953 KVM: s390: Fix old_data leak in guest debug error path
44bf3792c10f4 KVM: s390: Fix memory leak in guest debug handling
beb9c55af609c KVM: s390: Fix length check __import_wp_info()
39f7abd5927bf KVM: x86: Ensure runtime reads of disabled_quirks are resolved once
929fd2d87851a KVM: x86: Serialize writes to disabled_quirks using kvm->lock
3097582b73a8e KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock
41debfc98526c KVM: x86/mmu: Consume the locked rmap value in the lockless rmap walk
7b2721d66525f KVM: x86/mmu: Use split "zap all fast" helpers when invalidating memslot
0a25ee42e7d1a KVM: x86/mmu: Use CMPXCHG when clearing Accessed bit in TDP MMU
e29e9a9d81140 KVM: x86/mmu: Split kvm_mmu_zap_all_fast() into "front" and "back" halves
93b7f6eb76a13 KVM: x86/mmu: Fold kvm_mmu_zap_memslot() into kvm_arch_flush_shadow_memslot()
27bdeb5fd1904 KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU
c43563e7518e6 KVM: nVMX: Service local TLB flushes on failed nested VM-Enter
674a3244f07f3 KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit
d689dd4eae48d KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02
22dfcc22c95e9 KVM: nVMX: Always flush vpid02 on first use
5778dda871f15 KVM: PPC: Book3S HV: Validate arch_compat against host compatibility mode
c9f2c50bad37d iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask
b6cedf011bd95 iio: light: opt4001: Reject integration times with a non-zero seconds part
958d691403936 iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem()
4a9820aa8ef7e iio: light: opt4001: Fix power down clearing bits of the wrong register
6d00b4fec5bf2 iio: light: opt4060: Fix incorrect register name in threshold read error message
38f58a0249666 iio: light: opt4060: Reject integration times with a non-zero seconds part
fcddb4da54ab9 iio: ti-ads7138: Disable STATS_EN bit while reading conversion results
c0d491c243e70 iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register()
c2d6437663d7c iio: srf04: fix pm_runtime handling on probe error path
eef652190b00f iio: pressure: mpl115: Fix runtime PM cleanup
7ded5b76ec2df iio: pressure: dps310: fix NULL pointer dereference on ACPI probe
0614928a3eda3 iio: light: ltrf216a: fix runtime PM reference leak in error path
1ce47f00e9c00 iio: light: gp2ap002: Disable regulators on resume failure
9c1b74fdcffa4 iio: light: cm32181: return zero after writing calibscale
d2b32b71fa5bd iio: gyro: mpu3050: fix sign of raw angular velocity readings
08ac8d2976d57 iio: dac: m62332: Fix regulator reference count imbalance
bcc324f3033cd iio: dac: ad3552r-hs: fix scnprintf() buffer bound in data source show
2d386efb4c37a iio: chemical: sgp30: Handle IAQ thread creation failure
2071624c3d0f4 iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF
43bce901047e9 iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable
510497e31be4f iio: buffer: Tie IIO dma fence lock lifetime to the fence
06a9460b8b792 iio: buffer: Make IIO DMA fence release RCU-safe
f1f8f0e8e0af9 iio: buffer: Fix potential use-after-free in anonymous buffer release
8de90e0e0f6d9 iio: adc: pac1921: fix wrong channel used in trigger handler read
beec14368c943 iio: adc: max34408: add missing 'select REGMAP_I2C' to Kconfig
d2ed166c901e9 iio: adc: adi-axi-adc: add data size support for AD408X backend
e9627244ac0d7 ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get
4e580d84a638f ASoC: loongson: Fix error handling in ACPI property parsing
e11b056d69b8c AsoC: intel: sst: fix PCI device reference leak on probe failure
e8ea01a045708 ASoC: hdac_hda: Fix hlink refcount leak on component registration failure
0966b76a0e23c ASoC: fsl_easrc: Use div64_u64 for 64-by-64 division
5ca4bd7543524 ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure
5a4fe7a87841a ASoC: cs35l34: drain threaded IRQ before runtime suspend
6e369bc46663b ASoC: cs35l33: drain threaded IRQ before runtime suspend
eb5d39dd862f5 i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure
b2b87f2e0bb16 clk: qcom: gcc-mdm9607: Drop incorrect BIMC PLL and related clocks
4763197c6f344 clk: qcom: gcc-mdm9607: Fix halt_reg for gcc_apss_axi_clk
bd326b0c5b339 clk: qcom: gcc-mdm9607: Fix enable_reg for gcc_blsp1_sleep_clk
c67fc2fd71395 clk: qcom: gcc-mdm9607: Drop incorrect system_noc_bfdcd_clk_src
206a6e21a0cf4 clk: qcom: gcc-mdm9607: Drop incorrect apss_tcu_clk_src
526b0a71a4d91 clk: rockchip: rk3588: Don't change PLL rates when setting dclk_vop2_src
cc2941bc37351 clk: qcom: gcc-msm8939: Fix enable_reg for gcc_blsp1_sleep_clk
51b40cb17c216 clk: qcom: gcc-msm8916: Fix enable_reg for gcc_blsp1_sleep_clk
4582949b7badc clk: meson: align gxbb_32k_clk_sel number of parents with actual count
88fe6792be2b3 clk: mediatek: mt8196: Select REGMAP_MMIO for vlpckgen
05952e503cf65 clk: clocking-wizard: fix integer overflow in rate calculation
82f78c2b3af8f batman-adv: bla: prevent CRC corruptions after claim flush
871acdf97f64c batman-adv: bla: fix freeing of claims on meshif deletion
1cfa7d5f70d54 batman-adv: dat: avoid unaligned fault in IP extraction
c32e5e25c4120 batman-adv: mcast: linearize skbuff for packet generation
cedacfecf4b40 batman-adv: mcast: ensure unshared skb for multicast packets
e91d2cc7441d8 batman-adv: fix stale receive device on merged fragments
c8f86e375b39c mtd: rawnand: validate ONFI extended parameter page sections
4b282dc6a9e96 mtd: nand: realtek-ecc: add missing MODULE_DEVICE_TABLE()
d06f91a52af11 mtd: mtdoops: free page bitmap when the backing MTD is removed
18916f475057c mtd: afs: validate v2 image info bounds
e8bcb9d54429b s390/vfio-ap: Fix required lock not held during update of ap_matrix_mdev object
6d554f2571e6b s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap
69632952aca04 s390/vfio-ap: Fix NULL deref in status_show() during queue probe
647916988272f s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects
c45753c32d452 s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed
178ea7a1c2c3c s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL
f7d66afc34bc6 s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove
3c5f51f257e14 s390/vfio-ap: Fix stale do_remove flag across iterations in vfio_ap_mdev_cfg_remove
fc069d00a0dbe s390/vfio-ap: fix stale pqap_hook pointer on error in vfio_ap_mdev_set_kvm()
3b90d769b351a powerpc/crash: stop watchdogs before booting kdump kernel
36dcb8c2e3391 powerpc/pseries: Move H_WATCHDOG definitions to a common header
d2be3dd20e833 powerpc/pseries: Handle and log pseries-wdt registration failures
9c914b7a0bd18 powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population
da88a2a2119e4 powerpc/kexec_file: Prevent kexec range truncation
df45337587db2 powerpc/kexec_file: Fix null-ptr-def in extra size calculation
6ae9306c75981 parisc: Fix alignment of asm statements in head.S
3e2691eeee83a parisc: eisa: Fix infinite loop when parsing invalid IRQ value
6b1faf1f099f7 nvdimm/btt: reject an arena whose nfree is below the lane count
bdd929e60bc54 mm/hugetlb_cgroup: call page_counter_set_max() outside VM_BUG_ON()
631d8f39b33e7 mm/hugetlb: keep max_huge_pages when dissolving surplus folios
ae6a8b0c69901 mm/hugetlb: fix missing migratable flag on same-node hugetlb migration
8e287f463fc4f Revert "irqchip/mbigen: Fix mbigen node address layout"
6e96e2bb1065b pmdomain: airoha: fix unselectable AIROHA_CPU_PM_DOMAIN kconfig
cf1484d9a75de nvmet-tcp: reject unsolicited H2CData PDUs
dbc4acbdb3ca8 nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
7555ddd60af72 nvmet-auth: Synchronize timeout work during SQ teardown
d663944dbad81 nvme: add missing SRCU grace period in error path
b4af7999a9987 nvme-tcp: check the data direction of a C2HData PDU
7df913a7ced5d nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails
15d7a35a48928 nvme-fabrics: fix DHCHAP secret leak on parse failure
7ad2ea7c10044 ALSA: pcm: Fix race between non-atomic ops and trigger-start
89992bda7dfbb ALSA: harmony: initialize locks before requesting IRQ
1e67ad10373ea ALSA: rawmidi: Return the error from snd_rawmidi_input_params()
cd090af03f5df arm64: errata: pass REVIDR when matching target implementation CPUs
68cbd70795dd8 arm64: mm: Fix the lockless page-table walk in show_pte()
2b3b06cb709c4 i2c: mux: Fix channel node leak on adapter add failure
112b3d48084c8 i2c: core: fix debugfs UAF on adapter removal
954f30c8df0a0 i2c: qcom-geni: update frequency table to fix timing parameters
c643b6e7852e9 i2c: designware: Enable interrupt mask workaround for HJMC3001
19d65da9f7497 perf hisi-ptt: Fix PTT trace TLP header parsing
2421389840738 perf trace: Refactor augmented_raw_syscalls using bpf_for
f3a6663138496 perf trace: Factor out BPF loop body
3c492c8eba026 perf/x86/intel: Fix kernel address leakages in LBR stack
267f0a4fb9fe7 rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers
3a2b79eae5bef rtc: rzn1: Handle unset alarm weekday in rzn1_rtc_read_alarm
a4d6666a65d6f rtc: rzn1: Fix weekday underflow when alarm crosses month boundary
350cb7821b3d2 rtc: rzn1: Handle EPROBE_DEFER for optional pps interrupt
0a90e268cce70 memcg: make the v1 soft limit knob inert
801bcbdbfd595 memcg: bypass the reclaim and oom killer for dying tasks once oom_reaper is done
7269bd95d707e Input: aiptek - validate raw macro indices before updating state
d07e281f2a771 fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()
4d6ccd3883df6 fs/ntfs3: fix KMSAN uninit-value in ni_create_attr_list
0ceda28f371df mm/mempolicy: fix sleeping allocation in alloc_pages_bulk_weighted_interleave()
5da247e4d1e86 kprobes: Protect kprobe_blacklist with RCU
863f6726a5c02 irqchip/stm32mp-exti: Fix the unit of the hwspinlock timeout
f8a2f2a460231 ima: Check for ERR_PTR from dentry_path() in validate_hash_algo()
685c195fbd7d4 ata: ahci: work around lost interrupts on Marvell 88SE61xx
ca5bfea2045ef ceph: lock mutex in ceph_mds_check_access()
a24a146ae2cb5 bpf: Fix infinite loop in pcpu_freelist push with one possible CPU
bfb469f20aa9e block: flag zoned disks with GENHD_FL_NO_PART
634e2d23736d4 cpuidle: psci: Fix support for probe deferral by dropping the faux device
b519dfce1998c cpuidle: dt_idle_genpd: kfree() the original name allocation
fac202d73e7a6 dmaengine: dw-edma: Initialize IRQ data before requesting IRQs
8fd47ccbba86c dmaengine: dw-edma: Complete descriptors before pausing
3b313f7a00d14 dmaengine: dw-edma: Fix HDMA channel status register access
d382aaf5fed38 dmaengine: fsl-edma: tracing: no ptr dereference during log output
408ff2d5bf555 dma-direct: return struct page from dma_direct_alloc_from_pool()
36177beff2a9d dm: fix resume-vs-remove race
af1f32ccf8051 dm: fix race when loading and unloading a table
74ec08f7b81c2 HID: wacom: validate report length in wacom_intuos_pro2_bt_irq
f4cb9c4556dcb HID: rmi: fix OOB access with undersized RMI reports
c7f927aa8b550 HID: bpf: serialize device reference release in struct_ops destroy path
078adc03f6e60 ftrace: Synchronize the initialization of ftrace_ops
7d1559126d86b futex: Prevent rcuwait use-after-free during requeue PI
1cd41131bc4b8 mm/damon/core-kunit: check region count before testing in split_at()
382e58c24eabf mm/damon/sysfs: kobject_del() target (normal), context and kdamond dirs
368f84ec79104 mm/damon/sysfs: kobject_del() region and target (error) dirs
23c7b91895ff0 mm/damon/sysfs-schemes: kobject_del() scheme region dirs
20a40e7eb5ec3 mm/damon/sysfs-schemes: kobject_del() scheme quota goal dirs
e608e7bbe82cb mm/damon/sysfs-schemes: kobject_del() scheme filter dirs
8a1ebb241fc70 mm/damon/sysfs-schemes: kobject_del() scheme dirs
b9847d539b9c8 mm/damon/sysfs-schemes: kobject_del() scheme action destination dirs
cb55606449fd6 samples/damon/wsse: stop and free damon ctx when damon_call() fails
6179c7f47876d samples/damon/wsse: handle damon_start() failure
2446d3820cbaf samples/damon/prcl: stop and free damon ctx when damon_call() fails
9f370353bba7f samples/damon/prcl: handle damon_start() failure
3c07c57b89411 samples/damon/mtier: handle damon_stop() failure
f0808262a7616 samples/damon/mtier: handle damon_start() failure
71de5a082d2ca mm/damon/vaddr-kunit: check region count in three_regions test
dd817463c9b42 scsi: pm8001: Use rollback index when freeing MSI-X vectors
4bb34769ef44a scsi: megaraid_sas: Limit NVMe request size to the PRP chain frame
1624bff4c5118 scsi: target: iscsi: Reserve a terminator byte for the login payload
a38051fa2dded spi: Fix DMA mapping ownership on partial map failure
148a3f03aec89 spi: bcmbca-hsspi: disable clocks on resume failure
0acbfd61aee18 spi: bcm63xx: disable clock on resume failure
b782a7cb0a424 spi: bcm63xx-hsspi: disable clocks on resume failure
907752a7b64a6 soc: qcom: geni-se: Use HW PROG_RAM_DEPTH to validate firmware size
e373c1acdbcf8 ublk: clear VM_MAYWRITE on read-only ublk char device mmap
89f06342743ca userfaultfd: reset err to be 0 when move_pages_ptes succeeded
65c2029f3bbae thermal/drivers/qoriq: Disable clock on resume failure
ec2db87a0bbb8 thermal/drivers/imx: Disable clock on runtime resume failure
efaab8938fb92 xhci: fix lost bounce buffers on TDs spanning several ring segments
b041e3f35e0d2 staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()
ff61aa3289355 staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr()
d3a7fa61997db usb: gadget: fix null pointer dereference in usb_put_function_instance()
c29a83c1ff3f0 USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()
02ac76f27db23 usb: gadget: f_midi: initialize work in f_midi_alloc()
e89e30f0b5d30 usb: gadget: f_midi2: fix use-after-free in string attribute show path
9c3d5091e3568 usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs
33a81acd2d1d0 usb: typec: ucsi: displayport: Fix OOB altmode array index
6be5169e7615d usb: typec: tipd: Fix Thunderbolt altmode VDOs for cd321x
42828aeb40b4a usb: typec: tcpm: constrain TCPM_SOURCING_VBUS event handling
d4e00a1eb3917 usb: typec: qcom-pmic: cancel reset_work on stop
1e4f33f99bfb7 usb: typec: qcom-pmic-typec: drain cc_debounce_dwork if port_start() fails
c614d7c44ca7f usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop
7c4e2f964c65d usb: storage: realtek_cr: fix use-after-free on disconnect
0afe5c31612de usb: dwc3: clear forceRM when issuing EndTransfer
62a8b67960637 usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns()
1c67f2ba9c5f7 usb-storage: ene_ub6250: fix race between scan work and probe
7690a86b19327 media: usbtv: keep device alive while ALSA card exists
296a884cd6feb clk: qcom: gcc-mdm9607: Increase delay for USB PHY reset
9392a2c346762 ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output()
838455cc8bfe1 usb: image: mdc800: change kmalloc() to kzalloc()
4814f28c45f58 drm/amd/display: fix division by zero in get_estimated_bw()
12ee39c2b1d3c bpf: fix the return value of push_stack
c96477e0cabf5 drm/xe: Don't hand out the flat CCS storage as usable VRAM
a6b088bee95fd fsnotify: inotify: pass mark connector to fsnotify_recalc_mask()
0ec897493ff82 drm/amd: Drop calls to restore power limit and clock from smu_resume()
0b6680e306397 mfd: qnap-mcu: keep the reply buffer alive past a command timeout
617b48fc0baf0 objtool/rust: add one more `noreturn` Rust function
947400af98b9e fsnotify: Fix stale object mask after concurrent mark updates
459f33f828647 entry: Fix seccomp bypass after ptrace with TSYNC
b5a5d389eee65 mm/page_vma_mapped: use huge_ptep_get() for hugetlb
e15407c3a8a00 openvswitch: Fix CT limit teardown use-after-free
a13b1e80e5015 net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
---
meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.18.bbappend | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.18.bbappend b/meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.18.bbappend
index 1b93ec2..247dea6 100644
--- a/meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.18.bbappend
+++ b/meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.18.bbappend
@@ -8,4 +8,4 @@ KMACHINE:genericx86 ?= "common-pc"
KMACHINE:genericx86-64 ?= "common-pc-64"
KBRANCH:genericarm64 ?= "v6.18/standard/genericarm64"
-SRCREV_machine:genericarm64 ?= "ed4c9c267bfed1a73adf650106af110034b25e2f"
+SRCREV_machine:genericarm64 ?= "07acbdc95f3e934116546b9a90b813d7b30397b7"
--
2.43.0
^ permalink raw reply related [flat|nested] 13+ messages in thread
* Patchtest results for [meta-yocto-bsp][PATCH 06/06] yocto-bsps: update to v6.18.52
2026-09-17 5:13 ` [meta-yocto-bsp][PATCH 06/06] yocto-bsps: update to v6.18.52 bruce.ashfield
@ 2026-09-17 5:34 ` patchtest
0 siblings, 0 replies; 13+ messages in thread
From: patchtest @ 2026-09-17 5:34 UTC (permalink / raw)
To: bruce.ashfield; +Cc: openembedded-core
[-- Attachment #1: Type: text/plain, Size: 3302 bytes --]
Thank you for your submission. Patchtest identified one
or more issues with the patch. Please see the log below for
more information:
---
Testing patch /home/patchtest/share/mboxes/meta-yocto-bsp-06-06-yocto-bsps-update-to-v6.18.52.patch
FAIL: test target mailing list: Series sent to the wrong mailing list or some patches from the series correspond to different mailing lists (test_mbox.TestMbox.test_target_mailing_list)
PASS: test Signed-off-by presence (test_mbox.TestMbox.test_signed_off_by_presence)
PASS: test auh changelog truncation notice (test_mbox.TestMbox.test_auh_changelog_truncation_notice)
PASS: test author valid (test_mbox.TestMbox.test_author_valid)
PASS: test commit message presence (test_mbox.TestMbox.test_commit_message_presence)
PASS: test commit message user tags (test_mbox.TestMbox.test_commit_message_user_tags)
PASS: test max line length (test_metadata.TestMetadata.test_max_line_length)
PASS: test mbox format (test_mbox.TestMbox.test_mbox_format)
PASS: test non-AUH upgrade (test_mbox.TestMbox.test_non_auh_upgrade)
PASS: test shortlog format (test_mbox.TestMbox.test_shortlog_format)
PASS: test shortlog length (test_mbox.TestMbox.test_shortlog_length)
SKIP: pretest pylint: No python related patches, skipping test (test_python_pylint.PyLint.pretest_pylint)
SKIP: pretest src uri left files: Patch cannot be merged (test_metadata.TestMetadata.pretest_src_uri_left_files)
SKIP: test CVE check ignore: No modified recipes or older target branch, skipping test (test_metadata.TestMetadata.test_cve_check_ignore)
SKIP: test CVE tag format: No new source patches introduced (test_patch.TestPatch.test_cve_tag_format)
SKIP: test Signed-off-by presence: No new source patches introduced (test_patch.TestPatch.test_signed_off_by_presence)
SKIP: test Upstream-Status presence: No new source patches introduced (test_patch.TestPatch.test_upstream_status_presence_format)
SKIP: test bugzilla entry format: No bug ID found (test_mbox.TestMbox.test_bugzilla_entry_format)
SKIP: test lic files chksum modified not mentioned: No modified recipes, skipping test (test_metadata.TestMetadata.test_lic_files_chksum_modified_not_mentioned)
SKIP: test lic files chksum presence: No added recipes, skipping test (test_metadata.TestMetadata.test_lic_files_chksum_presence)
SKIP: test license presence: No added recipes, skipping test (test_metadata.TestMetadata.test_license_presence)
SKIP: test pylint: No python related patches, skipping test (test_python_pylint.PyLint.test_pylint)
SKIP: test series merge on head: Merge test is disabled for now (test_mbox.TestMbox.test_series_merge_on_head)
SKIP: test src uri left files: Patch cannot be merged (test_metadata.TestMetadata.test_src_uri_left_files)
SKIP: test summary presence: No added recipes, skipping test (test_metadata.TestMetadata.test_summary_presence)
---
Please address the issues identified and
submit a new revision of the patch, or alternatively, reply to this
email with an explanation of why the patch should be accepted. If you
believe these results are due to an error in patchtest, please submit a
bug at https://bugzilla.yoctoproject.org/ (use the 'Patchtest' category
under 'Yocto Project Subprojects'). For more information on specific
failures, see: https://wiki.yoctoproject.org/wiki/Patchtest. Thank
you!
^ permalink raw reply [flat|nested] 13+ messages in thread
* Patchtest results for [meta-yocto-bsp][PATCH 05/06] yocto-bsps: update to v6.18.50
2026-09-17 5:13 ` [meta-yocto-bsp][PATCH 05/06] yocto-bsps: update to v6.18.50 bruce.ashfield
@ 2026-09-17 5:34 ` patchtest
0 siblings, 0 replies; 13+ messages in thread
From: patchtest @ 2026-09-17 5:34 UTC (permalink / raw)
To: bruce.ashfield; +Cc: openembedded-core
[-- Attachment #1: Type: text/plain, Size: 3302 bytes --]
Thank you for your submission. Patchtest identified one
or more issues with the patch. Please see the log below for
more information:
---
Testing patch /home/patchtest/share/mboxes/meta-yocto-bsp-05-06-yocto-bsps-update-to-v6.18.50.patch
FAIL: test target mailing list: Series sent to the wrong mailing list or some patches from the series correspond to different mailing lists (test_mbox.TestMbox.test_target_mailing_list)
PASS: test Signed-off-by presence (test_mbox.TestMbox.test_signed_off_by_presence)
PASS: test auh changelog truncation notice (test_mbox.TestMbox.test_auh_changelog_truncation_notice)
PASS: test author valid (test_mbox.TestMbox.test_author_valid)
PASS: test commit message presence (test_mbox.TestMbox.test_commit_message_presence)
PASS: test commit message user tags (test_mbox.TestMbox.test_commit_message_user_tags)
PASS: test max line length (test_metadata.TestMetadata.test_max_line_length)
PASS: test mbox format (test_mbox.TestMbox.test_mbox_format)
PASS: test non-AUH upgrade (test_mbox.TestMbox.test_non_auh_upgrade)
PASS: test shortlog format (test_mbox.TestMbox.test_shortlog_format)
PASS: test shortlog length (test_mbox.TestMbox.test_shortlog_length)
SKIP: pretest pylint: No python related patches, skipping test (test_python_pylint.PyLint.pretest_pylint)
SKIP: pretest src uri left files: Patch cannot be merged (test_metadata.TestMetadata.pretest_src_uri_left_files)
SKIP: test CVE check ignore: No modified recipes or older target branch, skipping test (test_metadata.TestMetadata.test_cve_check_ignore)
SKIP: test CVE tag format: No new source patches introduced (test_patch.TestPatch.test_cve_tag_format)
SKIP: test Signed-off-by presence: No new source patches introduced (test_patch.TestPatch.test_signed_off_by_presence)
SKIP: test Upstream-Status presence: No new source patches introduced (test_patch.TestPatch.test_upstream_status_presence_format)
SKIP: test bugzilla entry format: No bug ID found (test_mbox.TestMbox.test_bugzilla_entry_format)
SKIP: test lic files chksum modified not mentioned: No modified recipes, skipping test (test_metadata.TestMetadata.test_lic_files_chksum_modified_not_mentioned)
SKIP: test lic files chksum presence: No added recipes, skipping test (test_metadata.TestMetadata.test_lic_files_chksum_presence)
SKIP: test license presence: No added recipes, skipping test (test_metadata.TestMetadata.test_license_presence)
SKIP: test pylint: No python related patches, skipping test (test_python_pylint.PyLint.test_pylint)
SKIP: test series merge on head: Merge test is disabled for now (test_mbox.TestMbox.test_series_merge_on_head)
SKIP: test src uri left files: Patch cannot be merged (test_metadata.TestMetadata.test_src_uri_left_files)
SKIP: test summary presence: No added recipes, skipping test (test_metadata.TestMetadata.test_summary_presence)
---
Please address the issues identified and
submit a new revision of the patch, or alternatively, reply to this
email with an explanation of why the patch should be accepted. If you
believe these results are due to an error in patchtest, please submit a
bug at https://bugzilla.yoctoproject.org/ (use the 'Patchtest' category
under 'Yocto Project Subprojects'). For more information on specific
failures, see: https://wiki.yoctoproject.org/wiki/Patchtest. Thank
you!
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH 0/6] linux-yocto: cosolidated pull request
2026-09-17 5:13 [PATCH 0/6] linux-yocto: cosolidated pull request bruce.ashfield
` (5 preceding siblings ...)
2026-09-17 5:13 ` [meta-yocto-bsp][PATCH 06/06] yocto-bsps: update to v6.18.52 bruce.ashfield
@ 2026-09-17 10:19 ` Richard Purdie
6 siblings, 0 replies; 13+ messages in thread
From: Richard Purdie @ 2026-09-17 10:19 UTC (permalink / raw)
To: bruce.ashfield; +Cc: openembedded-core
Hi Bruce,
On Thu, 2026-09-17 at 01:13 -0400, bruce.ashfield@gmail.com wrote:
> Here's the pending stable updates, one of which I think I sent
> before, but I'm
> resening it to be complete.
>
> We also have a fix for the autobuilder issue. I wasn't able to
> reproduce the problem here, but this is a temporary fix until
> upstream merges something.
> It didn't break my existing use case, so let's try it on the AB.
>
> I went back to a unified patch series for this one, just to keep us
> on our toes.
Thanks for that. We can run it through a few builds but having one less
source of error noise will be good!
Cheers,
Richard
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [OE-core] [meta][PATCH 03/06] linux-yocto/7.2: update to v7.2.6
2026-09-17 5:13 ` [meta][PATCH 03/06] linux-yocto/7.2: update to v7.2.6 bruce.ashfield
@ 2026-09-17 14:05 ` Antonin Godard
2026-09-17 14:13 ` Bruce Ashfield
0 siblings, 1 reply; 13+ messages in thread
From: Antonin Godard @ 2026-09-17 14:05 UTC (permalink / raw)
To: bruce.ashfield, richard.purdie; +Cc: openembedded-core
Hi,
Am I missing something or this series is missing a patch to meta-yocto-bsp to
update SRCREV_machine:genericarm64 to 7.2.6?
Antonin
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [OE-core] [meta][PATCH 03/06] linux-yocto/7.2: update to v7.2.6
2026-09-17 14:05 ` [OE-core] " Antonin Godard
@ 2026-09-17 14:13 ` Bruce Ashfield
2026-09-17 14:37 ` Antonin Godard
0 siblings, 1 reply; 13+ messages in thread
From: Bruce Ashfield @ 2026-09-17 14:13 UTC (permalink / raw)
To: Antonin Godard; +Cc: richard.purdie, openembedded-core
[-- Attachment #1: Type: text/plain, Size: 563 bytes --]
On Thu, Sep 17, 2026 at 10:05 AM Antonin Godard <antonin.godard@bootlin.com>
wrote:
> Hi,
>
> Am I missing something or this series is missing a patch to meta-yocto-bsp
> to
> update SRCREV_machine:genericarm64 to 7.2.6?
>
yup. I didn't the bump, but in my rush to generate the series, I didn't
send it out.
It'll arrive shortly, I just rebased and re-generated it.
Bruce
>
> Antonin
>
--
- Thou shalt not follow the NULL pointer, for chaos and madness await thee
at its end
- "Use the force Harry" - Gandalf, Star Trek II
[-- Attachment #2: Type: text/html, Size: 1569 bytes --]
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [OE-core] [meta][PATCH 03/06] linux-yocto/7.2: update to v7.2.6
2026-09-17 14:13 ` Bruce Ashfield
@ 2026-09-17 14:37 ` Antonin Godard
0 siblings, 0 replies; 13+ messages in thread
From: Antonin Godard @ 2026-09-17 14:37 UTC (permalink / raw)
To: Bruce Ashfield; +Cc: richard.purdie, openembedded-core
On Thu Sep 17, 2026 at 4:13 PM CEST, Bruce Ashfield wrote:
> On Thu, Sep 17, 2026 at 10:05 AM Antonin Godard <antonin.godard@bootlin.com>
> wrote:
>
>> Hi,
>>
>> Am I missing something or this series is missing a patch to meta-yocto-bsp
>> to
>> update SRCREV_machine:genericarm64 to 7.2.6?
>>
>
> yup. I didn't the bump, but in my rush to generate the series, I didn't
> send it out.
>
> It'll arrive shortly, I just rebased and re-generated it.
Great thanks, received :)
Antonin
^ permalink raw reply [flat|nested] 13+ messages in thread
end of thread, other threads:[~2026-09-17 14:37 UTC | newest]
Thread overview: 13+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-17 5:13 [PATCH 0/6] linux-yocto: cosolidated pull request bruce.ashfield
2026-09-17 5:13 ` [meta][PATCH 01/06] linux-yocto/6.18: update to v6.18.50 bruce.ashfield
2026-09-17 5:13 ` [meta][PATCH 02/06] linux-yocto/6.18: update to v6.18.52 bruce.ashfield
2026-09-17 5:13 ` [meta][PATCH 03/06] linux-yocto/7.2: update to v7.2.6 bruce.ashfield
2026-09-17 14:05 ` [OE-core] " Antonin Godard
2026-09-17 14:13 ` Bruce Ashfield
2026-09-17 14:37 ` Antonin Godard
2026-09-17 5:13 ` [meta][PATCH 04/06] linux-yocto/7.2: drm/client: avoid spurious vblank-timeout warning bruce.ashfield
2026-09-17 5:13 ` [meta-yocto-bsp][PATCH 05/06] yocto-bsps: update to v6.18.50 bruce.ashfield
2026-09-17 5:34 ` Patchtest results for " patchtest
2026-09-17 5:13 ` [meta-yocto-bsp][PATCH 06/06] yocto-bsps: update to v6.18.52 bruce.ashfield
2026-09-17 5:34 ` Patchtest results for " patchtest
2026-09-17 10:19 ` [PATCH 0/6] linux-yocto: cosolidated pull request Richard Purdie
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.