* Re: [OE-core][wrynose 05/17] kernel-fit-image: Add KERNEL_DTBVENDORED support for FIT_CONF_DEFAULT_DTB
From: Freihofer, Adrian @ 2026-07-20 17:12 UTC (permalink / raw)
To: yoann.congal@smile.fr, Paul Barker,
openembedded-core@lists.openembedded.org
Cc: Ryan Eatmon
In-Reply-To: <DK3I8NXUCRHK.C3U8MB8K4NZV@smile.fr>
Hi Yoann
Just a confirmation from my side: Taking the 4 patches is the best we
can do. Considering them as a series of bug fixes is right. Getting the
test back-ported is of course nice to have.
Regards
Adrian
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#241413):
> https://lists.openembedded.org/g/openembedded-core/message/241413
> Mute This Topic: https://lists.openembedded.org/mt/120329199/3616858
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe:
> https://lists.openembedded.org/g/openembedded-core/unsub [
> adrian.freihofer@siemens.com]
> -=-=-=-=-=-=-=-=-=-=-=-
^ permalink raw reply
* Re: [OE-core][wrynose 05/17] kernel-fit-image: Add KERNEL_DTBVENDORED support for FIT_CONF_DEFAULT_DTB
From: Freihofer, Adrian @ 2026-07-20 17:11 UTC (permalink / raw)
To: yoann.congal@smile.fr, Paul Barker,
openembedded-core@lists.openembedded.org
Cc: Ryan Eatmon
In-Reply-To: <DK3I8NXUCRHK.C3U8MB8K4NZV@smile.fr>
Hi Yoann
Just a confirmation from my side: Taking the 4 patches is the best we
can do. Considering them as a series of bug fixes is right. Getting the
test back-ported is of course nice to have.
Regards
Adrian
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#241413):
> https://lists.openembedded.org/g/openembedded-core/message/241413
> Mute This Topic: https://lists.openembedded.org/mt/120329199/3616858
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe:
> https://lists.openembedded.org/g/openembedded-core/unsub [
> adrian.freihofer@siemens.com]
> -=-=-=-=-=-=-=-=-=-=-=-
^ permalink raw reply
* Re: [OE-core][scarthgap][PATCH v2] libpng: Fix CVE-2026-34757
From: Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 17:07 UTC (permalink / raw)
To: Sudhir Dumbhare -X (sudumbha - E INFOCHIPS PRIVATE LIMITED at Cisco),
openembedded-core@lists.openembedded.org, yoann.congal@smile.fr
In-Reply-To: <DK2WCCX2M98E.292ZS2S1QFM96@smile.fr>
[-- Attachment #1: Type: text/plain, Size: 2624 bytes --]
Hi Yoann,
I have sent the patch for wrynose: openembedded-core@lists.openembedded.org | [wrynose][PATCH] libpng: fix CVE-2026-34757<https://lists.openembedded.org/g/openembedded-core/topic/120362567>
Thanks for your review.
Regards,
Deepak
________________________________
From: openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org> on behalf of Yoann Congal via lists.openembedded.org <yoann.congal=smile.fr@lists.openembedded.org>
Sent: Monday, July 20, 2026 3:51 AM
To: Sudhir Dumbhare -X (sudumbha - E INFOCHIPS PRIVATE LIMITED at Cisco) <sudumbha@cisco.com>; openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org>
Subject: Re: [OE-core][scarthgap][PATCH v2] libpng: Fix CVE-2026-34757
On Tue Jul 14, 2026 at 3:46 PM CEST, Sudhir Dumbhare via lists.openembedded.org wrote:
> From: Sudhir Dumbhare <sudumbha@cisco.com>
>
> These patches apply the upstream fixes [1][2], which address
> getter-to-setter aliasing issues in libpng chunk setters that could
> cause stale-pointer reads, as described in [3].
>
> [1] https://github.com/pnggroup/libpng/commit/398cbe3df03f4e11bb031e07f416dfdde3684e8a
> [2] https://github.com/pnggroup/libpng/commit/55d20aaa322c9274491cda82c5cd4f99b48c6bcc
> [3] https://github.com/pnggroup/libpng/issues/836
>
> Reference:
> https://security-tracker.debian.org/tracker/CVE-2026-34757
> https://nvd.nist.gov/vuln/detail/CVE-2026-34757
>
> Test results on qemux86-64 using ptest-runner:
> START: ptest-runner
> 2026-06-04T11:29
> BEGIN: /usr/lib/libpng/ptest
> PASS: tests/pnggetset
> Testsuite summary
> # TOTAL: 33
> # PASS: 33
> # SKIP: 0
> # XFAIL: 0
> # FAIL: 0
> # XPASS: 0
> # ERROR: 0
> DURATION: 80
> END: /usr/lib/libpng/ptest
> 2026-06-04T11:31
> STOP: ptest-runner
> TOTAL: 1 FAIL: 0
>
> Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com>
> ---
> Changes v1 -> v2:
> - Rebased on latest scarthgap (2bf388381ae3)
>
> .../libpng/files/CVE-2026-34757_p1.patch | 521 ++++++++++++++++++
> .../libpng/files/CVE-2026-34757_p2.patch | 484 ++++++++++++++++
> .../libpng/libpng_1.6.42.bb | 4 +-
> 3 files changed, 1008 insertions(+), 1 deletion(-)
> create mode 100644 meta/recipes-multimedia/libpng/files/CVE-2026-34757_p1.patch
> create mode 100644 meta/recipes-multimedia/libpng/files/CVE-2026-34757_p2.patch
As fas as I can tell, this patch is also needed on wrynose.
I can't merge here until this is fixed on wrynose.
Can you send a patch to fix this and then, ping back here?
Thanks!
--
Yoann Congal
Smile ECS
[-- Attachment #2: Type: text/html, Size: 5689 bytes --]
^ permalink raw reply
* [OE-core][wrynose][PATCH] libpng: fix CVE-2026-34757
From: Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 17:02 UTC (permalink / raw)
To: openembedded-core
From: Deepak Rathore <deeratho@cisco.com>
This patch applies the upstream fixes for libpng 1.6.57 for
CVE-2026-34757. The upstream fix commit is referenced in [1] & [2]
and the public CVE advisory is referenced in [3].
[1] https://github.com/pnggroup/libpng/commit/398cbe3df03f4e11bb031e07f416dfdde3684e8a
[2] https://github.com/pnggroup/libpng/commit/55d20aaa322c9274491cda82c5cd4f99b48c6bcc
[3] https://github.com/pnggroup/libpng/issues/836
Reference:
https://security-tracker.debian.org/tracker/CVE-2026-34757
https://nvd.nist.gov/vuln/detail/CVE-2026-34757
Test results on qemux86-64 using ptest-runner:
====================================================================
Testsuite summary for libpng 1.6.56
====================================================================
# TOTAL: 36
# PASS: 36
# SKIP: 0
# XFAIL: 0
# FAIL: 0
# XPASS: 0
# ERROR: 0
=====================================================================
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
---
.../libpng/files/CVE-2026-34757_p1.patch | 518 ++++++++++++++++++
.../libpng/files/CVE-2026-34757_p2.patch | 481 ++++++++++++++++
.../libpng/libpng_1.6.56.bb | 4 +-
3 files changed, 1002 insertions(+), 1 deletion(-)
create mode 100644 meta/recipes-multimedia/libpng/files/CVE-2026-34757_p1.patch
create mode 100644 meta/recipes-multimedia/libpng/files/CVE-2026-34757_p2.patch
diff --git a/meta/recipes-multimedia/libpng/files/CVE-2026-34757_p1.patch b/meta/recipes-multimedia/libpng/files/CVE-2026-34757_p1.patch
new file mode 100644
index 0000000000..7b5ebb18b7
--- /dev/null
+++ b/meta/recipes-multimedia/libpng/files/CVE-2026-34757_p1.patch
@@ -0,0 +1,518 @@
+From e621c40a46aa748608d5392f6a5c0278f77573d3 Mon Sep 17 00:00:00 2001
+From: Cosmin Truta <ctruta@gmail.com>
+Date: Mon, 30 Mar 2026 17:35:30 +0300
+Subject: [PATCH] fix: Handle self-referencing pointers in getter-to-setter
+ aliasing
+
+Apply a robustness fix for a caller-side API usage pattern involving
+the getters and the setters for PLTE, tRNS, and hIST.
+
+Passing a pointer returned by the PLTE, tRNS, or hIST getters back
+into the corresponding setters used to cause the setters to read from
+a stale pointer. The fix consists in snapshotting the caller's data
+into a stack-local buffer before freeing the old internal storage.
+
+Fixes pnggroup/libpng#836
+
+Reported-by: Iv4n <Iv4n550@noreply.github.com>
+CVE: CVE-2026-34757
+Upstream-Status: Backport [https://github.com/pnggroup/libpng/commit/398cbe3df03f4e11bb031e07f416dfdde3684e8a]
+
+(cherry picked from commit 398cbe3df03f4e11bb031e07f416dfdde3684e8a)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ CMakeLists.txt | 12 ++
+ Makefile.am | 9 +-
+ contrib/libtests/pnggetset.c | 328 +++++++++++++++++++++++++++++++++++
+ pngset.c | 29 +++-
+ tests/pnggetset | 5 +
+ 5 files changed, 380 insertions(+), 3 deletions(-)
+ create mode 100644 contrib/libtests/pnggetset.c
+ create mode 100755 tests/pnggetset
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index fde2a323c..6401b7bd3 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -624,6 +624,9 @@ set(pngvalid_sources
+ set(pngstest_sources
+ contrib/libtests/pngstest.c
+ )
++set(pnggetset_sources
++ contrib/libtests/pnggetset.c
++)
+ set(pngunknown_sources
+ contrib/libtests/pngunknown.c
+ )
+@@ -786,6 +789,15 @@ if(PNG_TESTS AND PNG_SHARED)
+ COMMAND pngtest
+ FILES "${TEST_PNG3_PNGS}")
+
++ # pnggetset test:
++ # Getter-to-setter roundtrips for various chunk types.
++ add_executable(pnggetset ${pnggetset_sources})
++ target_link_libraries(pnggetset
++ PRIVATE png_shared)
++
++ png_add_test(NAME pnggetset
++ COMMAND pnggetset)
++
+ # pngvalid tests:
+ # Internal validation of standard and progressive reading,
+ # transforms, and gamma handling.
+diff --git a/Makefile.am b/Makefile.am
+index 88f7ab628..fa5bbeb61 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -13,7 +13,7 @@ ACLOCAL_AMFLAGS = -I scripts/autoconf
+
+ # test programs - run on make check, make distcheck
+ if ENABLE_TESTS
+-check_PROGRAMS= pngtest pngunknown pngstest pngvalid pngimage pngcp
++check_PROGRAMS= pngtest pnggetset pngunknown pngstest pngvalid pngimage pngcp
+ if HAVE_CLOCK_GETTIME
+ check_PROGRAMS += timepng
+ endif
+@@ -42,6 +42,9 @@ if ENABLE_TESTS
+ pngtest_SOURCES = pngtest.c
+ pngtest_LDADD = libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@.la
+
++pnggetset_SOURCES = contrib/libtests/pnggetset.c
++pnggetset_LDADD = libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@.la
++
+ pngvalid_SOURCES = contrib/libtests/pngvalid.c
+ pngvalid_LDADD = libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@.la
+
+@@ -73,6 +76,7 @@ endif
+ if ENABLE_TESTS
+ TESTS =\
+ tests/pngtest-all\
++ tests/pnggetset\
+ tests/pngvalid-gamma-16-to-8\
+ tests/pngvalid-gamma-alpha-mode\
+ tests/pngvalid-gamma-background\
+@@ -303,9 +307,10 @@ $(srcdir)/scripts/pnglibconf.h.prebuilt:
+ pngtest.o: pnglibconf.h
+
+ contrib/libtests/makepng.o: pnglibconf.h
++contrib/libtests/pnggetset.o: pnglibconf.h
++contrib/libtests/pngimage.o: pnglibconf.h
+ contrib/libtests/pngstest.o: pnglibconf.h
+ contrib/libtests/pngunknown.o: pnglibconf.h
+-contrib/libtests/pngimage.o: pnglibconf.h
+ contrib/libtests/pngvalid.o: pnglibconf.h
+ contrib/libtests/readpng.o: pnglibconf.h
+ contrib/libtests/tarith.o: pnglibconf.h
+diff --git a/contrib/libtests/pnggetset.c b/contrib/libtests/pnggetset.c
+new file mode 100644
+index 000000000..b42508094
+--- /dev/null
++++ b/contrib/libtests/pnggetset.c
+@@ -0,0 +1,328 @@
++/* pnggetset.c
++ *
++ * Copyright (c) 2026 Cosmin Truta
++ *
++ * This code is released under the libpng license.
++ * For conditions of distribution and use, see the disclaimer
++ * and license in png.h
++ *
++ * Test the get-then-set roundtrip pattern for PLTE, tRNS, and hIST.
++ *
++ * Passing the internal pointer returned by a getter back into the
++ * corresponding setter is a natural API usage pattern. A previous
++ * version had a use-after-free on this path because the setter freed
++ * the internal buffer before copying from the caller-supplied pointer.
++ */
++
++#include <stdio.h>
++#include <stdlib.h>
++#include <string.h>
++
++#if defined(HAVE_CONFIG_H) && !defined(PNG_NO_CONFIG_H)
++# include <config.h>
++#endif
++
++#ifdef PNG_FREESTANDING_TESTS
++# include <png.h>
++#else
++# include "../../png.h"
++#endif
++
++/* Test: get the PLTE, pass it straight back to set, verify roundtrip. */
++static int
++test_plte_roundtrip(void)
++{
++ png_structp png_ptr;
++ png_infop info_ptr;
++ png_color palette[4];
++ png_colorp got_palette = NULL;
++ int num_palette = 0;
++ int i;
++
++ png_ptr = png_create_write_struct(PNG_LIBPNG_VER_STRING,
++ NULL, NULL, NULL);
++ if (png_ptr == NULL)
++ {
++ fprintf(stderr, "pnggetset: png_create_write_struct failed\n");
++ return 1;
++ }
++
++ info_ptr = png_create_info_struct(png_ptr);
++ if (info_ptr == NULL)
++ {
++ fprintf(stderr, "pnggetset: png_create_info_struct failed\n");
++ png_destroy_write_struct(&png_ptr, NULL);
++ return 1;
++ }
++
++ if (setjmp(png_jmpbuf(png_ptr)))
++ {
++ fprintf(stderr, "pnggetset: libpng error in test_plte_roundtrip\n");
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++
++ /* Set up a palette-color image header. */
++ png_set_IHDR(png_ptr, info_ptr, 1, 1, 8, PNG_COLOR_TYPE_PALETTE,
++ PNG_INTERLACE_NONE, PNG_COMPRESSION_TYPE_BASE, PNG_FILTER_TYPE_BASE);
++
++ /* Populate with recognizable values. */
++ for (i = 0; i < 4; i++)
++ {
++ palette[i].red = (png_byte)(i * 10);
++ palette[i].green = (png_byte)(i * 20);
++ palette[i].blue = (png_byte)(i * 30);
++ }
++ png_set_PLTE(png_ptr, info_ptr, palette, 4);
++
++ /* Get the internal pointer and feed it straight back. */
++ png_get_PLTE(png_ptr, info_ptr, &got_palette, &num_palette);
++ if (got_palette == NULL || num_palette != 4)
++ {
++ fprintf(stderr, "pnggetset: png_get_PLTE returned unexpected values\n");
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++
++ /* This is the critical call: the pointer aliases info_ptr->palette. */
++ png_set_PLTE(png_ptr, info_ptr, got_palette, num_palette);
++
++ /* Verify the data survived the roundtrip. */
++ got_palette = NULL;
++ num_palette = 0;
++ png_get_PLTE(png_ptr, info_ptr, &got_palette, &num_palette);
++ if (got_palette == NULL || num_palette != 4)
++ {
++ fprintf(stderr, "pnggetset: PLTE lost after roundtrip\n");
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++ for (i = 0; i < 4; i++)
++ {
++ if (got_palette[i].red != (png_byte)(i * 10) ||
++ got_palette[i].green != (png_byte)(i * 20) ||
++ got_palette[i].blue != (png_byte)(i * 30))
++ {
++ fprintf(stderr,
++ "pnggetset: PLTE entry %d corrupted after roundtrip\n", i);
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++ }
++
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 0;
++}
++
++#ifdef PNG_hIST_SUPPORTED
++/* Test: get the hIST, pass it straight back to set, verify roundtrip. */
++static int
++test_hist_roundtrip(void)
++{
++ png_structp png_ptr;
++ png_infop info_ptr;
++ png_color palette[4];
++ png_uint_16 hist[4];
++ png_uint_16p got_hist = NULL;
++ int i;
++
++ png_ptr = png_create_write_struct(PNG_LIBPNG_VER_STRING,
++ NULL, NULL, NULL);
++ if (png_ptr == NULL)
++ {
++ fprintf(stderr, "pnggetset: png_create_write_struct failed\n");
++ return 1;
++ }
++
++ info_ptr = png_create_info_struct(png_ptr);
++ if (info_ptr == NULL)
++ {
++ fprintf(stderr, "pnggetset: png_create_info_struct failed\n");
++ png_destroy_write_struct(&png_ptr, NULL);
++ return 1;
++ }
++
++ if (setjmp(png_jmpbuf(png_ptr)))
++ {
++ fprintf(stderr, "pnggetset: libpng error in test_hist_roundtrip\n");
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++
++ /* Set up a palette-color image header. */
++ memset(palette, 0, sizeof palette);
++ png_set_IHDR(png_ptr, info_ptr, 1, 1, 8, PNG_COLOR_TYPE_PALETTE,
++ PNG_INTERLACE_NONE, PNG_COMPRESSION_TYPE_BASE, PNG_FILTER_TYPE_BASE);
++ png_set_PLTE(png_ptr, info_ptr, palette, 4);
++
++ /* Populate with recognizable values. */
++ for (i = 0; i < 4; i++)
++ hist[i] = (png_uint_16)(i * 100 + 42);
++
++ png_set_hIST(png_ptr, info_ptr, hist);
++
++ /* Get the internal pointer and feed it straight back. */
++ if (png_get_hIST(png_ptr, info_ptr, &got_hist) == 0 || got_hist == NULL)
++ {
++ fprintf(stderr, "pnggetset: png_get_hIST returned unexpected values\n");
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++
++ /* This is the critical call: the pointer aliases info_ptr->hist. */
++ png_set_hIST(png_ptr, info_ptr, got_hist);
++
++ /* Verify the data survived the roundtrip. */
++ got_hist = NULL;
++ if (png_get_hIST(png_ptr, info_ptr, &got_hist) == 0 || got_hist == NULL)
++ {
++ fprintf(stderr, "pnggetset: hIST lost after roundtrip\n");
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++ for (i = 0; i < 4; i++)
++ {
++ if (got_hist[i] != (png_uint_16)(i * 100 + 42))
++ {
++ fprintf(stderr,
++ "pnggetset: hIST entry %d corrupted after roundtrip\n", i);
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++ }
++
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 0;
++}
++#endif /* PNG_hIST_SUPPORTED */
++
++#ifdef PNG_tRNS_SUPPORTED
++/* Test: get the tRNS, pass it straight back to set, verify roundtrip. */
++static int
++test_trns_roundtrip(void)
++{
++ png_structp png_ptr;
++ png_infop info_ptr;
++ png_color palette[4];
++ png_byte trans_alpha[4];
++ png_color_16 trans_color;
++ png_bytep got_alpha = NULL;
++ png_color_16p got_color = NULL;
++ int num_trans = 0;
++ int i;
++
++ png_ptr = png_create_write_struct(PNG_LIBPNG_VER_STRING,
++ NULL, NULL, NULL);
++ if (png_ptr == NULL)
++ {
++ fprintf(stderr, "pnggetset: png_create_write_struct failed\n");
++ return 1;
++ }
++
++ info_ptr = png_create_info_struct(png_ptr);
++ if (info_ptr == NULL)
++ {
++ fprintf(stderr, "pnggetset: png_create_info_struct failed\n");
++ png_destroy_write_struct(&png_ptr, NULL);
++ return 1;
++ }
++
++ if (setjmp(png_jmpbuf(png_ptr)))
++ {
++ fprintf(stderr, "pnggetset: libpng error in test_trns_roundtrip\n");
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++
++ /* Set up a palette-color image. */
++ memset(palette, 0, sizeof palette);
++ png_set_IHDR(png_ptr, info_ptr, 1, 1, 8, PNG_COLOR_TYPE_PALETTE,
++ PNG_INTERLACE_NONE, PNG_COMPRESSION_TYPE_BASE, PNG_FILTER_TYPE_BASE);
++ png_set_PLTE(png_ptr, info_ptr, palette, 4);
++
++ /* Populate tRNS with recognizable values. */
++ for (i = 0; i < 4; i++)
++ trans_alpha[i] = (png_byte)(0xff - i * 0x11);
++ memset(&trans_color, 0, sizeof trans_color);
++
++ png_set_tRNS(png_ptr, info_ptr, trans_alpha, 4, &trans_color);
++
++ /* Get the internal pointer and feed it straight back. */
++ png_get_tRNS(png_ptr, info_ptr, &got_alpha, &num_trans, &got_color);
++ if (got_alpha == NULL || num_trans != 4)
++ {
++ fprintf(stderr, "pnggetset: png_get_tRNS returned unexpected values\n");
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++
++ /* This is the critical call: the pointer aliases info_ptr->trans_alpha. */
++ png_set_tRNS(png_ptr, info_ptr, got_alpha, num_trans, got_color);
++
++ /* Verify the data survived the roundtrip. */
++ got_alpha = NULL;
++ num_trans = 0;
++ png_get_tRNS(png_ptr, info_ptr, &got_alpha, &num_trans, &got_color);
++ if (got_alpha == NULL || num_trans != 4)
++ {
++ fprintf(stderr, "pnggetset: tRNS lost after roundtrip\n");
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++ for (i = 0; i < 4; i++)
++ {
++ if (got_alpha[i] != (png_byte)(0xff - i * 0x11))
++ {
++ fprintf(stderr,
++ "pnggetset: tRNS entry %d corrupted after roundtrip\n", i);
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++ }
++
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 0;
++}
++#endif /* PNG_tRNS_SUPPORTED */
++
++int
++main(void)
++{
++ int result = 0;
++
++ printf("Testing PLTE get-then-set roundtrip... ");
++ fflush(stdout);
++ if (test_plte_roundtrip() != 0)
++ {
++ printf("FAIL\n");
++ result = 1;
++ }
++ else
++ printf("PASS\n");
++
++#ifdef PNG_hIST_SUPPORTED
++ printf("Testing hIST get-then-set roundtrip... ");
++ fflush(stdout);
++ if (test_hist_roundtrip() != 0)
++ {
++ printf("FAIL\n");
++ result = 1;
++ }
++ else
++ printf("PASS\n");
++#endif
++
++#ifdef PNG_tRNS_SUPPORTED
++ printf("Testing tRNS get-then-set roundtrip... ");
++ fflush(stdout);
++ if (test_trns_roundtrip() != 0)
++ {
++ printf("FAIL\n");
++ result = 1;
++ }
++ else
++ printf("PASS\n");
++#endif
++
++ return result;
++}
+diff --git a/pngset.c b/pngset.c
+index b9ccb7fb1..a6f20123e 100644
+--- a/pngset.c
++++ b/pngset.c
+@@ -385,6 +385,7 @@ void PNGAPI
+ png_set_hIST(png_const_structrp png_ptr, png_inforp info_ptr,
+ png_const_uint_16p hist)
+ {
++ png_uint_16 safe_hist[PNG_MAX_PALETTE_LENGTH];
+ int i;
+
+ png_debug1(1, "in %s storage function", "hIST");
+@@ -401,6 +402,13 @@ png_set_hIST(png_const_structrp png_ptr, png_inforp info_ptr,
+ return;
+ }
+
++ /* Snapshot the caller's hist before freeing, in case it points to
++ * info_ptr->hist (getter-to-setter aliasing).
++ */
++ memcpy(safe_hist, hist, (unsigned int)info_ptr->num_palette *
++ (sizeof (png_uint_16)));
++ hist = safe_hist;
++
+ png_free_data(png_ptr, info_ptr, PNG_FREE_HIST, 0);
+
+ /* Changed from info->num_palette to PNG_MAX_PALETTE_LENGTH in
+@@ -742,7 +750,7 @@ void PNGAPI
+ png_set_PLTE(png_structrp png_ptr, png_inforp info_ptr,
+ png_const_colorp palette, int num_palette)
+ {
+-
++ png_color safe_palette[PNG_MAX_PALETTE_LENGTH];
+ png_uint_32 max_palette_length;
+
+ png_debug1(1, "in %s storage function", "PLTE");
+@@ -776,6 +784,15 @@ png_set_PLTE(png_structrp png_ptr, png_inforp info_ptr,
+ png_error(png_ptr, "Invalid palette");
+ }
+
++ /* Snapshot the caller's palette before freeing, in case it points to
++ * info_ptr->palette (getter-to-setter aliasing).
++ */
++ if (num_palette > 0)
++ memcpy(safe_palette, palette, (unsigned int)num_palette *
++ (sizeof (png_color)));
++
++ palette = safe_palette;
++
+ png_free_data(png_ptr, info_ptr, PNG_FREE_PLTE, 0);
+
+ /* Changed in libpng-1.2.1 to allocate PNG_MAX_PALETTE_LENGTH instead
+@@ -1165,6 +1182,16 @@ png_set_tRNS(png_structrp png_ptr, png_inforp info_ptr,
+
+ if (trans_alpha != NULL)
+ {
++ /* Snapshot the caller's trans_alpha before freeing, in case it
++ * points to info_ptr->trans_alpha (getter-to-setter aliasing).
++ */
++ png_byte safe_trans[PNG_MAX_PALETTE_LENGTH];
++
++ if (num_trans > 0 && num_trans <= PNG_MAX_PALETTE_LENGTH)
++ memcpy(safe_trans, trans_alpha, (size_t)num_trans);
++
++ trans_alpha = safe_trans;
++
+ png_free_data(png_ptr, info_ptr, PNG_FREE_TRNS, 0);
+
+ if (num_trans > 0 && num_trans <= PNG_MAX_PALETTE_LENGTH)
+diff --git a/tests/pnggetset b/tests/pnggetset
+new file mode 100755
+index 000000000..57ef731a5
+--- /dev/null
++++ b/tests/pnggetset
+@@ -0,0 +1,5 @@
++#!/bin/sh
++
++# pnggetset test:
++# Getter-to-setter roundtrips for various chunk types.
++exec ./pnggetset
diff --git a/meta/recipes-multimedia/libpng/files/CVE-2026-34757_p2.patch b/meta/recipes-multimedia/libpng/files/CVE-2026-34757_p2.patch
new file mode 100644
index 0000000000..894f9d618b
--- /dev/null
+++ b/meta/recipes-multimedia/libpng/files/CVE-2026-34757_p2.patch
@@ -0,0 +1,481 @@
+From 815fdfc8dba0603abc26523d0b7e37f7ad21988b Mon Sep 17 00:00:00 2001
+From: Cosmin Truta <ctruta@gmail.com>
+Date: Mon, 30 Mar 2026 17:43:05 +0300
+Subject: [PATCH] fix: Handle getter-to-setter aliasing in append-style chunk
+ setters
+
+Apply the same class of robustness fix from the previous commit to
+`png_set_text`, `png_set_sPLT` and `png_set_unknown_chunks`. These
+append-style setters used `png_realloc_array` to grow the internal
+array, then freed the old array before copying from the caller's
+input. If the caller's pointer was obtained from the corresponding
+getter, it aliased the freed array.
+
+The fix defers the freeing of the old array until after the copy loop.
+
+Also extend the pnggetset regression test to cover all three setters.
+
+CVE: CVE-2026-34757
+Upstream-Status: Backport [https://github.com/pnggroup/libpng/commit/55d20aaa322c9274491cda82c5cd4f99b48c6bcc]
+
+(cherry picked from commit 55d20aaa322c9274491cda82c5cd4f99b48c6bcc)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ contrib/libtests/pnggetset.c | 330 ++++++++++++++++++++++++++++++++++-
+ pngset.c | 25 ++-
+ 2 files changed, 347 insertions(+), 8 deletions(-)
+
+diff --git a/contrib/libtests/pnggetset.c b/contrib/libtests/pnggetset.c
+index b42508094..6ae43dc66 100644
+--- a/contrib/libtests/pnggetset.c
++++ b/contrib/libtests/pnggetset.c
+@@ -6,12 +6,12 @@
+ * For conditions of distribution and use, see the disclaimer
+ * and license in png.h
+ *
+- * Test the get-then-set roundtrip pattern for PLTE, tRNS, and hIST.
++ * Test the get-then-set roundtrip for chunk types whose getters return
++ * a pointer to internal storage.
+ *
+- * Passing the internal pointer returned by a getter back into the
+- * corresponding setter is a natural API usage pattern. A previous
+- * version had a use-after-free on this path because the setter freed
+- * the internal buffer before copying from the caller-supplied pointer.
++ * Passing such a pointer back into the corresponding setter must not
++ * cause a use-after-free. A previous version freed the internal buffer
++ * before copying from the caller-supplied pointer.
+ */
+
+ #include <stdio.h>
+@@ -285,6 +285,290 @@ test_trns_roundtrip(void)
+ }
+ #endif /* PNG_tRNS_SUPPORTED */
+
++#ifdef PNG_TEXT_SUPPORTED
++/* Test: get the text array, pass it straight back to set, verify data. */
++#define TEXT_COUNT 6 /* enough to trigger reallocation on the second set */
++static int
++test_text_roundtrip(void)
++{
++ png_structp png_ptr;
++ png_infop info_ptr;
++ png_text text_entries[TEXT_COUNT];
++ png_textp got_text = NULL;
++ int got_num_text = 0;
++ int i;
++
++ /* Recognizable keys and values. */
++ static const char *keys[TEXT_COUNT] = {
++ "Title", "Author", "Desc", "Copyright", "Source", "Comment"
++ };
++ static const char *vals[TEXT_COUNT] = {
++ "t0", "t1", "t2", "t3", "t4", "t5"
++ };
++
++ png_ptr = png_create_write_struct(PNG_LIBPNG_VER_STRING,
++ NULL, NULL, NULL);
++ if (png_ptr == NULL)
++ {
++ fprintf(stderr, "pnggetset: png_create_write_struct failed\n");
++ return 1;
++ }
++
++ info_ptr = png_create_info_struct(png_ptr);
++ if (info_ptr == NULL)
++ {
++ fprintf(stderr, "pnggetset: png_create_info_struct failed\n");
++ png_destroy_write_struct(&png_ptr, NULL);
++ return 1;
++ }
++
++ if (setjmp(png_jmpbuf(png_ptr)))
++ {
++ fprintf(stderr, "pnggetset: libpng error in test_text_roundtrip\n");
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++
++ /* Populate the text entries. */
++ memset(text_entries, 0, sizeof text_entries);
++ for (i = 0; i < TEXT_COUNT; i++)
++ {
++ text_entries[i].compression = PNG_TEXT_COMPRESSION_NONE;
++ text_entries[i].key = (png_charp)keys[i];
++ text_entries[i].text = (png_charp)vals[i];
++ }
++ png_set_text(png_ptr, info_ptr, text_entries, TEXT_COUNT);
++
++ /* Get the internal pointer and feed it straight back (append). */
++ png_get_text(png_ptr, info_ptr, &got_text, &got_num_text);
++ if (got_text == NULL || got_num_text != TEXT_COUNT)
++ {
++ fprintf(stderr, "pnggetset: png_get_text returned unexpected values\n");
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++
++ /* This is the critical call: got_text aliases info_ptr->text. */
++ png_set_text(png_ptr, info_ptr, got_text, got_num_text);
++
++ /* Verify the original entries survived. */
++ got_text = NULL;
++ got_num_text = 0;
++ png_get_text(png_ptr, info_ptr, &got_text, &got_num_text);
++ if (got_text == NULL || got_num_text != TEXT_COUNT * 2)
++ {
++ fprintf(stderr, "pnggetset: text count %d, expected %d after roundtrip\n",
++ got_num_text, TEXT_COUNT * 2);
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++ for (i = 0; i < TEXT_COUNT; i++)
++ {
++ if (got_text[i].key == NULL ||
++ strcmp(got_text[i].key, keys[i]) != 0 ||
++ got_text[i].text == NULL ||
++ strcmp(got_text[i].text, vals[i]) != 0)
++ {
++ fprintf(stderr,
++ "pnggetset: text entry %d corrupted after roundtrip\n", i);
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++ }
++
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 0;
++}
++#undef TEXT_COUNT
++#endif /* PNG_TEXT_SUPPORTED */
++
++#ifdef PNG_sPLT_SUPPORTED
++/* Test: get the sPLT array, pass it straight back to set, verify data. */
++static int
++test_splt_roundtrip(void)
++{
++ png_structp png_ptr;
++ png_infop info_ptr;
++ png_sPLT_t splt;
++ png_sPLT_entry splt_entries[4];
++ png_sPLT_tp got_spalettes = NULL;
++ int got_num, i;
++
++ png_ptr = png_create_write_struct(PNG_LIBPNG_VER_STRING,
++ NULL, NULL, NULL);
++ if (png_ptr == NULL)
++ {
++ fprintf(stderr, "pnggetset: png_create_write_struct failed\n");
++ return 1;
++ }
++
++ info_ptr = png_create_info_struct(png_ptr);
++ if (info_ptr == NULL)
++ {
++ fprintf(stderr, "pnggetset: png_create_info_struct failed\n");
++ png_destroy_write_struct(&png_ptr, NULL);
++ return 1;
++ }
++
++ if (setjmp(png_jmpbuf(png_ptr)))
++ {
++ fprintf(stderr, "pnggetset: libpng error in test_splt_roundtrip\n");
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++
++ /* Populate with recognizable values. */
++ memset(splt_entries, 0, sizeof splt_entries);
++ for (i = 0; i < 4; i++)
++ {
++ splt_entries[i].red = (png_uint_16)(i * 1000);
++ splt_entries[i].green = (png_uint_16)(i * 2000);
++ splt_entries[i].blue = (png_uint_16)(i * 3000);
++ splt_entries[i].alpha = 0xffffU;
++ splt_entries[i].frequency = (png_uint_16)(i + 1);
++ }
++ memset(&splt, 0, sizeof splt);
++ splt.name = (png_charp)"test_sPLT";
++ splt.depth = 16;
++ splt.entries = splt_entries;
++ splt.nentries = 4;
++
++ png_set_sPLT(png_ptr, info_ptr, &splt, 1);
++
++ /* Get the internal pointer and feed it straight back (append). */
++ got_num = png_get_sPLT(png_ptr, info_ptr, &got_spalettes);
++ if (got_spalettes == NULL || got_num != 1)
++ {
++ fprintf(stderr, "pnggetset: png_get_sPLT returned unexpected values\n");
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++
++ /* This is the critical call: got_spalettes aliases internal storage. */
++ png_set_sPLT(png_ptr, info_ptr, got_spalettes, got_num);
++
++ /* Verify the original entry survived. */
++ got_spalettes = NULL;
++ got_num = png_get_sPLT(png_ptr, info_ptr, &got_spalettes);
++ if (got_spalettes == NULL || got_num != 2)
++ {
++ fprintf(stderr, "pnggetset: sPLT count %d, expected 2 after roundtrip\n",
++ got_num);
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++ if (strcmp(got_spalettes[0].name, "test_sPLT") != 0 ||
++ got_spalettes[0].nentries != 4 ||
++ got_spalettes[0].depth != 16)
++ {
++ fprintf(stderr,
++ "pnggetset: sPLT entry 0 corrupted after roundtrip\n");
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++ for (i = 0; i < 4; i++)
++ {
++ if (got_spalettes[0].entries[i].red != (png_uint_16)(i * 1000) ||
++ got_spalettes[0].entries[i].green != (png_uint_16)(i * 2000) ||
++ got_spalettes[0].entries[i].blue != (png_uint_16)(i * 3000))
++ {
++ fprintf(stderr,
++ "pnggetset: sPLT[0] entry %d corrupted after roundtrip\n", i);
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++ }
++
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 0;
++}
++#endif /* PNG_sPLT_SUPPORTED */
++
++#ifdef PNG_STORE_UNKNOWN_CHUNKS_SUPPORTED
++/* Test: get unknown chunks, pass them straight back to set, verify data. */
++static int
++test_unknown_roundtrip(void)
++{
++ png_structp png_ptr;
++ png_infop info_ptr;
++ png_unknown_chunk unk;
++ png_unknown_chunkp got_unknowns = NULL;
++ int got_num;
++ static const png_byte test_data[] = {0xde, 0xad, 0xbe, 0xef};
++
++ png_ptr = png_create_write_struct(PNG_LIBPNG_VER_STRING,
++ NULL, NULL, NULL);
++ if (png_ptr == NULL)
++ {
++ fprintf(stderr, "pnggetset: png_create_write_struct failed\n");
++ return 1;
++ }
++
++ info_ptr = png_create_info_struct(png_ptr);
++ if (info_ptr == NULL)
++ {
++ fprintf(stderr, "pnggetset: png_create_info_struct failed\n");
++ png_destroy_write_struct(&png_ptr, NULL);
++ return 1;
++ }
++
++ if (setjmp(png_jmpbuf(png_ptr)))
++ {
++ fprintf(stderr,
++ "pnggetset: libpng error in test_unknown_roundtrip\n");
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++
++ /* Set up an unknown chunk with recognizable data. */
++ memset(&unk, 0, sizeof unk);
++ memcpy(unk.name, "teSt", 5);
++ unk.data = (png_bytep)test_data;
++ unk.size = sizeof test_data;
++ unk.location = PNG_HAVE_IHDR;
++
++ png_set_keep_unknown_chunks(png_ptr, PNG_HANDLE_CHUNK_ALWAYS, NULL, 0);
++ png_set_unknown_chunks(png_ptr, info_ptr, &unk, 1);
++
++ /* Get the internal pointer and feed it straight back (append). */
++ got_num = png_get_unknown_chunks(png_ptr, info_ptr, &got_unknowns);
++ if (got_unknowns == NULL || got_num != 1)
++ {
++ fprintf(stderr,
++ "pnggetset: png_get_unknown_chunks returned unexpected values\n");
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++
++ /* This is the critical call: got_unknowns aliases internal storage. */
++ png_set_unknown_chunks(png_ptr, info_ptr, got_unknowns, got_num);
++
++ /* Verify the original entry survived. */
++ got_unknowns = NULL;
++ got_num = png_get_unknown_chunks(png_ptr, info_ptr, &got_unknowns);
++ if (got_unknowns == NULL || got_num != 2)
++ {
++ fprintf(stderr,
++ "pnggetset: unknown_chunks count %d, expected 2 after roundtrip\n",
++ got_num);
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++ if (memcmp(got_unknowns[0].name, "teSt", 4) != 0 ||
++ got_unknowns[0].size != sizeof test_data ||
++ memcmp(got_unknowns[0].data, test_data, sizeof test_data) != 0)
++ {
++ fprintf(stderr,
++ "pnggetset: unknown chunk 0 corrupted after roundtrip\n");
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 0;
++}
++#endif /* PNG_STORE_UNKNOWN_CHUNKS_SUPPORTED */
++
+ int
+ main(void)
+ {
+@@ -324,5 +608,41 @@ main(void)
+ printf("PASS\n");
+ #endif
+
++#ifdef PNG_TEXT_SUPPORTED
++ printf("Testing tEXt get-then-set roundtrip... ");
++ fflush(stdout);
++ if (test_text_roundtrip() != 0)
++ {
++ printf("FAIL\n");
++ result = 1;
++ }
++ else
++ printf("PASS\n");
++#endif
++
++#ifdef PNG_sPLT_SUPPORTED
++ printf("Testing sPLT get-then-set roundtrip... ");
++ fflush(stdout);
++ if (test_splt_roundtrip() != 0)
++ {
++ printf("FAIL\n");
++ result = 1;
++ }
++ else
++ printf("PASS\n");
++#endif
++
++#ifdef PNG_STORE_UNKNOWN_CHUNKS_SUPPORTED
++ printf("Testing unknown chunks get-then-set roundtrip... ");
++ fflush(stdout);
++ if (test_unknown_roundtrip() != 0)
++ {
++ printf("FAIL\n");
++ result = 1;
++ }
++ else
++ printf("PASS\n");
++#endif
++
+ return result;
+ }
+diff --git a/pngset.c b/pngset.c
+index a6f20123e..513c51eb4 100644
+--- a/pngset.c
++++ b/pngset.c
+@@ -954,6 +954,7 @@ png_set_text_2(png_const_structrp png_ptr, png_inforp info_ptr,
+ png_const_textp text_ptr, int num_text)
+ {
+ int i;
++ png_textp old_text = NULL;
+
+ png_debug1(1, "in text storage function, chunk typeid = 0x%lx",
+ png_ptr == NULL ? 0xabadca11UL : (unsigned long)png_ptr->chunk_name);
+@@ -1001,7 +1002,10 @@ png_set_text_2(png_const_structrp png_ptr, png_inforp info_ptr,
+ return 1;
+ }
+
+- png_free(png_ptr, info_ptr->text);
++ /* Defer freeing the old array until after the copy loop below,
++ * in case text_ptr aliases info_ptr->text (getter-to-setter).
++ */
++ old_text = info_ptr->text;
+
+ info_ptr->text = new_text;
+ info_ptr->free_me |= PNG_FREE_TEXT;
+@@ -1086,6 +1090,7 @@ png_set_text_2(png_const_structrp png_ptr, png_inforp info_ptr,
+ {
+ png_chunk_report(png_ptr, "text chunk: out of memory",
+ PNG_CHUNK_WRITE_ERROR);
++ png_free(png_ptr, old_text);
+
+ return 1;
+ }
+@@ -1139,6 +1144,8 @@ png_set_text_2(png_const_structrp png_ptr, png_inforp info_ptr,
+ png_debug1(3, "transferred text chunk %d", info_ptr->num_text);
+ }
+
++ png_free(png_ptr, old_text);
++
+ return 0;
+ }
+ #endif
+@@ -1276,6 +1283,7 @@ png_set_sPLT(png_const_structrp png_ptr,
+ */
+ {
+ png_sPLT_tp np;
++ png_sPLT_tp old_spalettes;
+
+ png_debug1(1, "in %s storage function", "sPLT");
+
+@@ -1296,7 +1304,10 @@ png_set_sPLT(png_const_structrp png_ptr,
+ return;
+ }
+
+- png_free(png_ptr, info_ptr->splt_palettes);
++ /* Defer freeing the old array until after the copy loop below,
++ * in case entries aliases info_ptr->splt_palettes (getter-to-setter).
++ */
++ old_spalettes = info_ptr->splt_palettes;
+
+ info_ptr->splt_palettes = np;
+ info_ptr->free_me |= PNG_FREE_SPLT;
+@@ -1360,6 +1371,8 @@ png_set_sPLT(png_const_structrp png_ptr,
+ }
+ while (--nentries);
+
++ png_free(png_ptr, old_spalettes);
++
+ if (nentries > 0)
+ png_chunk_report(png_ptr, "sPLT out of memory", PNG_CHUNK_WRITE_ERROR);
+ }
+@@ -1408,6 +1421,7 @@ png_set_unknown_chunks(png_const_structrp png_ptr,
+ png_inforp info_ptr, png_const_unknown_chunkp unknowns, int num_unknowns)
+ {
+ png_unknown_chunkp np;
++ png_unknown_chunkp old_unknowns;
+
+ if (png_ptr == NULL || info_ptr == NULL || num_unknowns <= 0 ||
+ unknowns == NULL)
+@@ -1454,7 +1468,10 @@ png_set_unknown_chunks(png_const_structrp png_ptr,
+ return;
+ }
+
+- png_free(png_ptr, info_ptr->unknown_chunks);
++ /* Defer freeing the old array until after the copy loop below,
++ * in case unknowns aliases info_ptr->unknown_chunks (getter-to-setter).
++ */
++ old_unknowns = info_ptr->unknown_chunks;
+
+ info_ptr->unknown_chunks = np; /* safe because it is initialized */
+ info_ptr->free_me |= PNG_FREE_UNKN;
+@@ -1500,6 +1517,8 @@ png_set_unknown_chunks(png_const_structrp png_ptr,
+ ++np;
+ ++(info_ptr->unknown_chunks_num);
+ }
++
++ png_free(png_ptr, old_unknowns);
+ }
+
+ void PNGAPI
diff --git a/meta/recipes-multimedia/libpng/libpng_1.6.56.bb b/meta/recipes-multimedia/libpng/libpng_1.6.56.bb
index 7ede0a6c8b..9dbd0d26e0 100644
--- a/meta/recipes-multimedia/libpng/libpng_1.6.56.bb
+++ b/meta/recipes-multimedia/libpng/libpng_1.6.56.bb
@@ -12,7 +12,9 @@ LIBV = "16"
SRC_URI = "${SOURCEFORGE_MIRROR}/${BPN}/${BPN}${LIBV}/${BP}.tar.xz \
file://run-ptest \
-"
+ file://CVE-2026-34757_p1.patch \
+ file://CVE-2026-34757_p2.patch \
+ "
SRC_URI[sha256sum] = "f7d8bf1601b7804f583a254ab343a6549ca6cf27d255c302c47af2d9d36a6f18"
--
2.35.6
^ permalink raw reply related
* Patchtest results for [meta-yocto-bsp][PATCH 05/06] yocto-bsps: update to v6.18.38
From: patchtest @ 2026-07-20 16:19 UTC (permalink / raw)
To: bruce.ashfield; +Cc: openembedded-core
In-Reply-To: <20260720155842.569263-6-bruce.ashfield@gmail.com>
[-- Attachment #1: Type: text/plain, Size: 3201 bytes --]
Thank you for your submission. Patchtest identified one
or more issues with the patch. Please see the log below for
more information:
---
Testing patch /home/patchtest/share/mboxes/meta-yocto-bsp-05-06-yocto-bsps-update-to-v6.18.38.patch
FAIL: test target mailing list: Series sent to the wrong mailing list or some patches from the series correspond to different mailing lists (test_mbox.TestMbox.test_target_mailing_list)
PASS: test Signed-off-by presence (test_mbox.TestMbox.test_signed_off_by_presence)
PASS: test author valid (test_mbox.TestMbox.test_author_valid)
PASS: test commit message presence (test_mbox.TestMbox.test_commit_message_presence)
PASS: test commit message user tags (test_mbox.TestMbox.test_commit_message_user_tags)
PASS: test max line length (test_metadata.TestMetadata.test_max_line_length)
PASS: test mbox format (test_mbox.TestMbox.test_mbox_format)
PASS: test non-AUH upgrade (test_mbox.TestMbox.test_non_auh_upgrade)
PASS: test shortlog format (test_mbox.TestMbox.test_shortlog_format)
PASS: test shortlog length (test_mbox.TestMbox.test_shortlog_length)
SKIP: pretest pylint: No python related patches, skipping test (test_python_pylint.PyLint.pretest_pylint)
SKIP: pretest src uri left files: Patch cannot be merged (test_metadata.TestMetadata.pretest_src_uri_left_files)
SKIP: test CVE check ignore: No modified recipes or older target branch, skipping test (test_metadata.TestMetadata.test_cve_check_ignore)
SKIP: test CVE tag format: No new source patches introduced (test_patch.TestPatch.test_cve_tag_format)
SKIP: test Signed-off-by presence: No new source patches introduced (test_patch.TestPatch.test_signed_off_by_presence)
SKIP: test Upstream-Status presence: No new source patches introduced (test_patch.TestPatch.test_upstream_status_presence_format)
SKIP: test bugzilla entry format: No bug ID found (test_mbox.TestMbox.test_bugzilla_entry_format)
SKIP: test lic files chksum modified not mentioned: No modified recipes, skipping test (test_metadata.TestMetadata.test_lic_files_chksum_modified_not_mentioned)
SKIP: test lic files chksum presence: No added recipes, skipping test (test_metadata.TestMetadata.test_lic_files_chksum_presence)
SKIP: test license presence: No added recipes, skipping test (test_metadata.TestMetadata.test_license_presence)
SKIP: test pylint: No python related patches, skipping test (test_python_pylint.PyLint.test_pylint)
SKIP: test series merge on head: Merge test is disabled for now (test_mbox.TestMbox.test_series_merge_on_head)
SKIP: test src uri left files: Patch cannot be merged (test_metadata.TestMetadata.test_src_uri_left_files)
SKIP: test summary presence: No added recipes, skipping test (test_metadata.TestMetadata.test_summary_presence)
---
Please address the issues identified and
submit a new revision of the patch, or alternatively, reply to this
email with an explanation of why the patch should be accepted. If you
believe these results are due to an error in patchtest, please submit a
bug at https://bugzilla.yoctoproject.org/ (use the 'Patchtest' category
under 'Yocto Project Subprojects'). For more information on specific
failures, see: https://wiki.yoctoproject.org/wiki/Patchtest. Thank
you!
^ permalink raw reply
* Patchtest results for [meta-yocto-bsp][PATCH 04/06] yocto-bsps: update to v6.18.36
From: patchtest @ 2026-07-20 16:19 UTC (permalink / raw)
To: bruce.ashfield; +Cc: openembedded-core
In-Reply-To: <20260720155842.569263-5-bruce.ashfield@gmail.com>
[-- Attachment #1: Type: text/plain, Size: 3314 bytes --]
Thank you for your submission. Patchtest identified one
or more issues with the patch. Please see the log below for
more information:
---
Testing patch /home/patchtest/share/mboxes/meta-yocto-bsp-04-06-yocto-bsps-update-to-v6.18.36.patch
FAIL: test commit message user tags: Mbox includes one or more GitHub-style username tags. Ensure that any "@" symbols are stripped out of usernames (test_mbox.TestMbox.test_commit_message_user_tags)
FAIL: test target mailing list: Series sent to the wrong mailing list or some patches from the series correspond to different mailing lists (test_mbox.TestMbox.test_target_mailing_list)
PASS: test Signed-off-by presence (test_mbox.TestMbox.test_signed_off_by_presence)
PASS: test author valid (test_mbox.TestMbox.test_author_valid)
PASS: test commit message presence (test_mbox.TestMbox.test_commit_message_presence)
PASS: test max line length (test_metadata.TestMetadata.test_max_line_length)
PASS: test mbox format (test_mbox.TestMbox.test_mbox_format)
PASS: test non-AUH upgrade (test_mbox.TestMbox.test_non_auh_upgrade)
PASS: test shortlog format (test_mbox.TestMbox.test_shortlog_format)
PASS: test shortlog length (test_mbox.TestMbox.test_shortlog_length)
SKIP: pretest pylint: No python related patches, skipping test (test_python_pylint.PyLint.pretest_pylint)
SKIP: pretest src uri left files: Patch cannot be merged (test_metadata.TestMetadata.pretest_src_uri_left_files)
SKIP: test CVE check ignore: No modified recipes or older target branch, skipping test (test_metadata.TestMetadata.test_cve_check_ignore)
SKIP: test CVE tag format: No new source patches introduced (test_patch.TestPatch.test_cve_tag_format)
SKIP: test Signed-off-by presence: No new source patches introduced (test_patch.TestPatch.test_signed_off_by_presence)
SKIP: test Upstream-Status presence: No new source patches introduced (test_patch.TestPatch.test_upstream_status_presence_format)
SKIP: test bugzilla entry format: No bug ID found (test_mbox.TestMbox.test_bugzilla_entry_format)
SKIP: test lic files chksum modified not mentioned: No modified recipes, skipping test (test_metadata.TestMetadata.test_lic_files_chksum_modified_not_mentioned)
SKIP: test lic files chksum presence: No added recipes, skipping test (test_metadata.TestMetadata.test_lic_files_chksum_presence)
SKIP: test license presence: No added recipes, skipping test (test_metadata.TestMetadata.test_license_presence)
SKIP: test pylint: No python related patches, skipping test (test_python_pylint.PyLint.test_pylint)
SKIP: test series merge on head: Merge test is disabled for now (test_mbox.TestMbox.test_series_merge_on_head)
SKIP: test src uri left files: Patch cannot be merged (test_metadata.TestMetadata.test_src_uri_left_files)
SKIP: test summary presence: No added recipes, skipping test (test_metadata.TestMetadata.test_summary_presence)
---
Please address the issues identified and
submit a new revision of the patch, or alternatively, reply to this
email with an explanation of why the patch should be accepted. If you
believe these results are due to an error in patchtest, please submit a
bug at https://bugzilla.yoctoproject.org/ (use the 'Patchtest' category
under 'Yocto Project Subprojects'). For more information on specific
failures, see: https://wiki.yoctoproject.org/wiki/Patchtest. Thank
you!
^ permalink raw reply
* Patchtest results for [meta][PATCH 01/06] linux-yocto/6.18: update to v6.18.36
From: patchtest @ 2026-07-20 16:19 UTC (permalink / raw)
To: bruce.ashfield; +Cc: openembedded-core
In-Reply-To: <20260720155842.569263-2-bruce.ashfield@gmail.com>
[-- Attachment #1: Type: text/plain, Size: 3058 bytes --]
Thank you for your submission. Patchtest identified one
or more issues with the patch. Please see the log below for
more information:
---
Testing patch /home/patchtest/share/mboxes/meta-01-06-linux-yocto-6.18-update-to-v6.18.36.patch
FAIL: test commit message user tags: Mbox includes one or more GitHub-style username tags. Ensure that any "@" symbols are stripped out of usernames (test_mbox.TestMbox.test_commit_message_user_tags)
PASS: pretest src uri left files (test_metadata.TestMetadata.pretest_src_uri_left_files)
PASS: test CVE check ignore (test_metadata.TestMetadata.test_cve_check_ignore)
PASS: test Signed-off-by presence (test_mbox.TestMbox.test_signed_off_by_presence)
PASS: test author valid (test_mbox.TestMbox.test_author_valid)
PASS: test commit message presence (test_mbox.TestMbox.test_commit_message_presence)
PASS: test lic files chksum modified not mentioned (test_metadata.TestMetadata.test_lic_files_chksum_modified_not_mentioned)
PASS: test max line length (test_metadata.TestMetadata.test_max_line_length)
PASS: test mbox format (test_mbox.TestMbox.test_mbox_format)
PASS: test non-AUH upgrade (test_mbox.TestMbox.test_non_auh_upgrade)
PASS: test shortlog format (test_mbox.TestMbox.test_shortlog_format)
PASS: test shortlog length (test_mbox.TestMbox.test_shortlog_length)
PASS: test src uri left files (test_metadata.TestMetadata.test_src_uri_left_files)
PASS: test target mailing list (test_mbox.TestMbox.test_target_mailing_list)
SKIP: pretest pylint: No python related patches, skipping test (test_python_pylint.PyLint.pretest_pylint)
SKIP: test CVE tag format: No new source patches introduced (test_patch.TestPatch.test_cve_tag_format)
SKIP: test Signed-off-by presence: No new source patches introduced (test_patch.TestPatch.test_signed_off_by_presence)
SKIP: test Upstream-Status presence: No new source patches introduced (test_patch.TestPatch.test_upstream_status_presence_format)
SKIP: test bugzilla entry format: No bug ID found (test_mbox.TestMbox.test_bugzilla_entry_format)
SKIP: test lic files chksum presence: No added recipes, skipping test (test_metadata.TestMetadata.test_lic_files_chksum_presence)
SKIP: test license presence: No added recipes, skipping test (test_metadata.TestMetadata.test_license_presence)
SKIP: test pylint: No python related patches, skipping test (test_python_pylint.PyLint.test_pylint)
SKIP: test series merge on head: Merge test is disabled for now (test_mbox.TestMbox.test_series_merge_on_head)
SKIP: test summary presence: No added recipes, skipping test (test_metadata.TestMetadata.test_summary_presence)
---
Please address the issues identified and
submit a new revision of the patch, or alternatively, reply to this
email with an explanation of why the patch should be accepted. If you
believe these results are due to an error in patchtest, please submit a
bug at https://bugzilla.yoctoproject.org/ (use the 'Patchtest' category
under 'Yocto Project Subprojects'). For more information on specific
failures, see: https://wiki.yoctoproject.org/wiki/Patchtest. Thank
you!
^ permalink raw reply
* Patchtest results for [meta-yocto-bsp][PATCH 06/06] yocto-bsps: update to v6.18.39
From: patchtest @ 2026-07-20 16:19 UTC (permalink / raw)
To: bruce.ashfield; +Cc: openembedded-core
In-Reply-To: <20260720155842.569263-7-bruce.ashfield@gmail.com>
[-- Attachment #1: Type: text/plain, Size: 3201 bytes --]
Thank you for your submission. Patchtest identified one
or more issues with the patch. Please see the log below for
more information:
---
Testing patch /home/patchtest/share/mboxes/meta-yocto-bsp-06-06-yocto-bsps-update-to-v6.18.39.patch
FAIL: test target mailing list: Series sent to the wrong mailing list or some patches from the series correspond to different mailing lists (test_mbox.TestMbox.test_target_mailing_list)
PASS: test Signed-off-by presence (test_mbox.TestMbox.test_signed_off_by_presence)
PASS: test author valid (test_mbox.TestMbox.test_author_valid)
PASS: test commit message presence (test_mbox.TestMbox.test_commit_message_presence)
PASS: test commit message user tags (test_mbox.TestMbox.test_commit_message_user_tags)
PASS: test max line length (test_metadata.TestMetadata.test_max_line_length)
PASS: test mbox format (test_mbox.TestMbox.test_mbox_format)
PASS: test non-AUH upgrade (test_mbox.TestMbox.test_non_auh_upgrade)
PASS: test shortlog format (test_mbox.TestMbox.test_shortlog_format)
PASS: test shortlog length (test_mbox.TestMbox.test_shortlog_length)
SKIP: pretest pylint: No python related patches, skipping test (test_python_pylint.PyLint.pretest_pylint)
SKIP: pretest src uri left files: Patch cannot be merged (test_metadata.TestMetadata.pretest_src_uri_left_files)
SKIP: test CVE check ignore: No modified recipes or older target branch, skipping test (test_metadata.TestMetadata.test_cve_check_ignore)
SKIP: test CVE tag format: No new source patches introduced (test_patch.TestPatch.test_cve_tag_format)
SKIP: test Signed-off-by presence: No new source patches introduced (test_patch.TestPatch.test_signed_off_by_presence)
SKIP: test Upstream-Status presence: No new source patches introduced (test_patch.TestPatch.test_upstream_status_presence_format)
SKIP: test bugzilla entry format: No bug ID found (test_mbox.TestMbox.test_bugzilla_entry_format)
SKIP: test lic files chksum modified not mentioned: No modified recipes, skipping test (test_metadata.TestMetadata.test_lic_files_chksum_modified_not_mentioned)
SKIP: test lic files chksum presence: No added recipes, skipping test (test_metadata.TestMetadata.test_lic_files_chksum_presence)
SKIP: test license presence: No added recipes, skipping test (test_metadata.TestMetadata.test_license_presence)
SKIP: test pylint: No python related patches, skipping test (test_python_pylint.PyLint.test_pylint)
SKIP: test series merge on head: Merge test is disabled for now (test_mbox.TestMbox.test_series_merge_on_head)
SKIP: test src uri left files: Patch cannot be merged (test_metadata.TestMetadata.test_src_uri_left_files)
SKIP: test summary presence: No added recipes, skipping test (test_metadata.TestMetadata.test_summary_presence)
---
Please address the issues identified and
submit a new revision of the patch, or alternatively, reply to this
email with an explanation of why the patch should be accepted. If you
believe these results are due to an error in patchtest, please submit a
bug at https://bugzilla.yoctoproject.org/ (use the 'Patchtest' category
under 'Yocto Project Subprojects'). For more information on specific
failures, see: https://wiki.yoctoproject.org/wiki/Patchtest. Thank
you!
^ permalink raw reply
* [meta][scarthgap][PATCH 01/02] linux-yocto/6.6: update to v6.6.143
From: bruce.ashfield @ 2026-07-20 16:00 UTC (permalink / raw)
To: richard.purdie; +Cc: openembedded-core
From: Bruce Ashfield <bruce.ashfield@gmail.com>
Updating linux-yocto/6.6 to the latest korg -stable release that comprises
the following commits:
d1cfde2d5d15 Linux 6.6.143
726abf975668 netfilter: require Ethernet MAC header before using eth_hdr()
05bd072e97fe x86/CPU/AMD: Rename init_amd_zn() to init_amd_zen_common()
4a83b435acf8 x86/CPU/AMD: Call the spectral chicken in the Zen2 init function
5e0c93dca433 x86/CPU/AMD: Move the Zen3 BTC_NO detection to the Zen3 init function
217f53b5e3c6 Revert "selftest/ptp: update ptp selftest to exercise the gettimex options"
189c7e57826f mptcp: fix missing wakeups in edge scenarios
c12e67a0ef93 mptcp: add-addr: always drop other suboptions
1111ab94fd49 arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU
e5b6bdc3d8b8 arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU
e717a4d08779 arm64: errata: Mitigate TLBI errata on various Arm CPUs
baf63e6a6435 arm64: cputype: Add C1-Premium definitions
1e4a5225b4d3 arm64: cputype: Add C1-Ultra definitions
f58e88f8653f arm64: cputype: Add NVIDIA Olympus definitions
2602d4b53925 ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6
9aa7edc1347b ipvs: skip ipv6 extension headers for csum checks
2de5c8eea0a9 net: bonding: fix use-after-free in bond_xmit_broadcast()
8fe0231adebe RDMA/umem: Fix truncation for block sizes >= 4G
3faebd387ed1 RDMA: Move DMA block iterator logic into dedicated files
a7c6be320c0e RDMA/umem: fix kernel-doc warnings
09dc18894148 RDMA: During rereg_mr ensure that REREG_ACCESS is compatible
09b8a7aa5a34 hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf
77b73b54801a mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison
252bb328b36f mm/memory-failure: fix missing ->mf_stats count in hugetlb poison
05f1ad6d62a3 mm/hugetlb: rename folio_putback_active_hugetlb() to folio_putback_hugetlb()
471f5d78ea4b mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio
411fa5113da0 mm/hugetlb: rename isolate_hugetlb() to folio_isolate_hugetlb()
eb8a8124484d netfilter: nft_fib: fix stale stack leak via the OIFNAME register
46582b0fd381 usb: typec: ucsi: Don't update power_supply on power role change if not connected
c91ea13375f7 serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ
d3e9b79aa794 scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()
b4621e5ef634 thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()
078c11224c7f usb: typec: ucsi: Check if power role change actually happened before handling
e15c414092b3 usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind
5542d2c35930 usb: dwc3: xilinx: fix error handling in zynqmp init error paths
b987f380620b usb: musb: omap2430: Fix use-after-free in omap2430_probe()
a9c22e0f93ba tty: serial: samsung: Remove redundant port lock acquisition in rx helpers
8809b7941c4a tty: serial: samsung: use u32 for register interactions
33da47d4a003 serial: samsung_tty: Use port lock wrappers
1cdb07d8946c ALSA: firewire-motu: Protect register DSP event queue positions
b3f4f82d1315 memfd: deny writeable mappings when implying SEAL_WRITE
2619d9d2aac3 iio: dac: ad5686: fix ref bit initialization for single-channel parts
f8dcef820161 usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure
e85bc501947f iio: chemical: scd30: fix division by zero in write_raw
73d8bf36f217 iio: chemical: scd30: Use guard(mutex) to allow early returns
86298fb6829c iio: gyro: adis16260: fix division by zero in write_raw
b35e71b7cc7a mptcp: handle first subflow closing consistently
792fa6eee73e Bluetooth: hci_qca: Convert timeout from jiffies to ms
c3fc351d256c Bluetooth: hci_qca: Migrate to serdev specific shutdown function
123724bb6ee5 serdev: Provide a bustype shutdown function
ca2f48b9c03d serdev: make serdev_bus_type const
c0e37017a452 mm/damon/sysfs-schemes: delete tried region in regions_rmdirs()
e7af1b15c884 mm/memory: fix spurious warning when unmapping device-private/exclusive pages
fe76413677e7 mptcp: do not drop partial packets
293b0e63136b mptcp: introduce the mptcp_init_skb helper
681d14ef45b1 iio: adc: npcm: fix unbalanced clk_disable_unprepare()
4ed1366f9f90 iio: adc: npcm: Convert to platform remove callback returning void
d766a49d9b55 arm64: tlb: Flush walk cache when unsharing PMD tables
4c29603498b0 octeontx2-pf: avoid double free of pool->stack on AQ init failure
26342087fac9 af_unix: Fix UAF read of tail->len in unix_stream_data_wait()
db9389042db4 af_unix: Cache state->msg in unix_stream_read_generic().
c2c764b00c0f rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer
a05bf6d9e621 rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg
7713f4aafb57 net: hsr: defer node table free until after RCU readers
1dca7e491f07 ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()
dcc42d701529 ipv6/addrconf: annotate data-races around devconf fields (II)
ada8dcfd5298 mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient
04318e252c58 ice: fix VF queue configuration with low MTU values
d37a60086ee7 selftests: mptcp: drop nanoseconds width specifier
00ffe9893f4b mptcp: reset rcv wnd on disconnect
1521fecf44fc mptcp: cleanup fallback dummy mapping generation
78f9d747f386 mptcp: use plain bool instead of custom binary enum
e043017ac429 octeontx2-af: CGX: add bounds check to cgx_speed_mbps index
1132ca7a1ba8 octeontx2-af: replace deprecated strncpy with strscpy
557edaf01062 platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery
969bc6370334 smb: client: require net admin for CIFS SWN netlink
e19eff331240 genetlink: Use internal flags for multicast groups
14897ef9341c cgroup/cpuset: Reset DL migration state on can_attach() failure
850452af77f5 ksmbd: fix OOB write in QUERY_INFO for compound requests
6d8f52f3f80a fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros
666bd0598f37 ipmi:ssif: NULL thread on error
318a0403b270 ipmi:ssif: Remove unnecessary indention
ae9d4caf6f13 mm/huge_memory: update file PMD counter before folio_put()
310a8cc74612 soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get()
428a33573dcb mm/hugetlb: avoid false positive lockdep assertion
000e8f55fbc7 driver core: reject devices with unregistered buses
b5fa9e32fb67 fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling
201151e120f0 drm/amd/display: Use krealloc_array() in dal_vector_reserve()
7fc4fab4acc3 drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs
4d1c3c26c2ab drm/amd/display: Clamp VBIOS HDMI retimer register count to array size
79e0273272a0 drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size
3fe2c6af3f51 drm/amdgpu: restart the CS if some parts of the VM are still invalidated
16dad1fb0d78 drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11
62bd09e23a23 drm/amdkfd: fix NULL dereference in get_queue_ids()
d54a221b0f3c slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock
9f4a76c7e9fa slimbus: qcom-ngd-ctrl: fix OF node refcount
fc261397295b thunderbolt: Limit XDomain response copy to actual frame size
0dd61ba03d05 thunderbolt: Validate XDomain request packet size before type cast
5db10c8ad8c0 thunderbolt: Clamp XDomain response data copy to allocation size
4d0b1524caad thunderbolt: Bound root directory content to block size
5f56bc6bddff thunderbolt: Reject zero-length property entries in validator
7dd9a42b044a sctp: stream: fully roll back denied add-stream state
e97c2a535e23 sctp: diag: reject stale associations in dump_one path
7e60d675288d mmc: sdhci: add signal voltage switch in sdhci_resume_host
b46521877611 mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC
6dc14b9b431e mmc: litex_mmc: Set mandatory idle clocks before CMD0
30e727657185 mmc: core: Fix host controller programming for fixed driver type
8d6e1dd3ad13 mm/hugetlb: restore reservation on error in hugetlb folio copy paths
f0ca9c7f44a9 octeontx2-af: fix memory leak in rvu_setup_hw_resources()
033d498b0f47 nvmem: layouts: onie-tlv: fix hang on unknown types
e7cf30aa5f1f net: rds: clear i_sends on setup unwind
1ccad3ee7998 net: mv643xx: fix OF node refcount
a629418d463f net: bonding: fix NULL pointer dereference in bond_do_ioctl()
c090df5be6bc net/mlx5: Reorder completion before putting command entry in cmd_work_handler
8fb4a23df5b7 misc: fastrpc: Fix NULL pointer dereference in rpmsg callback
d3e26df2e8eb misc: fastrpc: fix DMA address corruption due to find_vma misuse
8b080c891831 misc: fastrpc: fix use-after-free race in fastrpc_map_create
df08fadcf0e5 misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context
6560be3f6a5b ipc/shm: serialize orphan cleanup with shm_nattch updates
7a395a147f06 Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard
81d60181ed55 Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)
2d175d6aae9c i2c: tegra: Fix NOIRQ suspend/resume
5bebff5e8492 i2c: stm32f7: fix timing computation ignoring i2c-analog-filter
7107627b8b35 i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()
dd92773d4d9c fuse: reject fuse_notify() pagecache ops on directories
254c469a404a pidfd: refuse access to tasks that have started exiting harder
0e823ca0e739 inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush
c1234229399f IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
1a418ad0e5e5 bnxt_en: Fix NULL pointer dereference
6f5285a6054a ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write
dfd853197615 vsock/vmci: fix sk_ack_backlog leak on failed handshake
688fcac7054a wifi: nl80211: reject oversized EMA RNR lists
eb13ab2f66e2 selftests: mptcp: add test for extra_subflows underflow on userspace PM
026c4a70e2a9 mptcp: sockopt: check timestamping ret value
b1fd13074f22 mptcp: allow subflow rcv wnd to shrink
907ac6b1658e mptcp: close TOCTOU race while computing rcv_wnd
f2c9012fc115 mptcp: fix retransmission loop when csum is enabled
c2e3aadc8fef ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow
b6290cc96dc8 ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O
c35c0763af34 ARM: socfpga: Fix OF node refcount leak in SMP setup
1b585673a224 udp: clear skb->dev before running a sockmap verdict
0c2821665ff7 zram: fix use-after-free in zram_bvec_write_partial()
0d64bc200ebe RDMA/srp: bound SRP_RSP sense copy by the received length
5c97ae9382de mm/damon/ops-common: call folio_test_lru() after folio_get()
5242b5f3c77f drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info()
898bd0ccfed7 drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait()
e2331730175f ALSA: timer: Fix UAF at snd_timer_user_params()
a1288cd700f7 USB: serial: kl5kusb105: fix bulk-out buffer overflow
f71f8f99a9cd USB: serial: option: add usb-id for Dell Wireless DW5826e-m
4cb722747ed2 USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()
d92f17af7097 USB: serial: io_ti: fix heap overflow in get_manuf_info()
aa82a078f70f xfrm: espintcp: do not reuse an in-progress partial send
0da2e073f9cb ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL
07c33be968d9 drm/i915/gem: Fix phys BO pread/pwrite with offset
033d39e41fc3 KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying
88520b2fecc4 mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation
1e927a468500 tracing/probes: Point the error offset correctly for eprobe argument error
214a2042b16b Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig
1338ee049a89 Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend
8767fe4079af netfilter: nft_tunnel: fix use-after-free on object destroy
e0ce103e89d6 drm/vc4: fix krealloc() memory leak
ed3e134700a2 drm/virtio: Fix driver removal with disabled KMS
c5f438dd2fd8 clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time
5e1c1d22268a netfilter: ctnetlink: ensure safe access to master conntrack
5f82b02b4059 ipv6: Fix a potential NPD in cleanup_prefix_route()
ccdd7f1949bb net: mvpp2: build skb from XDP-adjusted data on XDP_PASS
580f92f27cb8 net: mvpp2: refill RX buffers before XDP or skb use
26c0986cb613 net: mvpp2: Add metadata support for xdp mode
3b8b0c3631b1 net: mvpp2: limit XDP frame size to the RX buffer
bede0f481b91 net: mvpp2: sync RX data at the hardware packet offset
cd513e43b4b2 netfilter: nft_exthdr: fix register tracking for F_PRESENT flag
8a81e336da68 netfilter: nf_log: validate MAC header was set before dumping it
a0d16941adf3 netfilter: x_tables: avoid leaking percpu counter pointers
29d8cc44bbdf netfilter: nf_conntrack: destroy stale expectfn expectations on unregister
eb7e77342e3e rds: mark snapshot pages dirty in rds_info_getsockopt()
f513f308cc4b ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
0f22412a2f4f net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion
b903e9b5629e net: guard timestamp cmsgs to real error queue skbs
8ce96f118264 sctp: fix uninit-value in __sctp_rcv_asconf_lookup()
22f4ee66614e r8152: handle the return value of usb_reset_device()
25fdf5369853 net: openvswitch: fix possible kfree_skb of ERR_PTR
0bfa7bba1f41 ipv6: sit: reload inner IPv6 header after GSO offloads
41781f278930 net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list
2047c2aa0963 net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove
12fb84dc4dc8 net: phy: clean the sfp upstream if phy probing fails
838f411b8ef8 net/mlx4: avoid GCC 10 __bad_copy_from() false positive
ecfe9171b26a tcp: restrict SO_ATTACH_FILTER to priv users
10def23b67b4 ASoC: wm_adsp: Fix NULL dereference when removing firmware controls
7db09011ce62 gpio: mvebu: fix NULL pointer dereference in suspend/resume
07a18f5c90dd netlabel: validate unlabeled address and mask attribute lengths
42827d03f800 xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()
f4e4b98cee82 iomap: don't revert iov_iter on partially completed buffered writes
fed65bc9de8e arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI
b7d3add1884c arm64: tlb: Allow XZR argument to TLBI ops
523bc49979b9 KVM: arm64: Remove VPIPT I-cache handling
d30aac0fa00c tap: free page on error paths in tap_get_user_xdp()
ceafb893b12f net: skbuff: fix missing zerocopy reference in pskb_carve helpers
9eaa4e8d5561 tools/rv: Fix cleanup after failed trace setup
7fce959e9be3 usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo
36c41e9724c9 usb: gadget: f_ncm: Fix net_device lifecycle with device_move
d68b621bb5a4 ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams
c12c4cae0cd7 time: Fix off-by-one in settimeofday() usec validation
f4aae11abb44 signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()
6e39863cefe4 ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp
2afc9e684dc7 sctp: purge outqueue on stale COOKIE-ECHO handling
6d6e42e8e17f net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr
1a827b95e62b ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()
9db4dd019a6b vxlan: vnifilter: fix spurious notification on VNI update
5a7ad529fd53 vxlan: vnifilter: send notification on VNI add
e4e7428349d9 octeontx2-af: npc: Fix CPT channel mask in npc_install_flow
72775977e89c net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown
cecdc6574a82 ptp: vclock: Switch from RCU to SRCU
8ff85dbabbbf ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options
ba760c38b38b Bluetooth: MGMT: Fix backward compatibility with userspace
0622e527a31d Bluetooth: fix memory leak in error path of hci_alloc_dev()
691f14b6a48b Bluetooth: bnep: reject short frames before parsing
10e90715e68f Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling
98377e6b1a1a Bluetooth: RFCOMM: validate skb length in MCC handlers
74c08e4db35a Bluetooth: MGMT: validate advertising TLV before type checks
de31973ef00e Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()
28a6a3762796 net: fec: fix pinctrl default state restore order on resume
caeb42f28f00 net: lan743x: permit VLAN-tagged packets up to configured MTU
74e02121be1d net: garp: fix unsigned integer underflow in garp_pdu_parse_attr
271355c2ef61 hsr: Remove WARN_ONCE() in hsr_addr_is_self().
91cdbb9b308f net: Annotate sk->sk_write_space() for UDP SOCKMAP.
daf5a9eef894 pcnet32: stop holding device spin lock during napi_complete_done
e732c4444bcf drm/imx: Fix three kernel-doc warnings in dcss-scaler.c
06ce6fc106b1 6lowpan: fix off-by-one in multicast context address compression
8b136f18ac4b net/sched: act_api: use RCU with deferred freeing for action lifecycle
b4892561552d dm cache policy smq: check allocation under invalidate lock
afd64b59c3de netfilter: bridge: make ebt_snat ARP rewrite writable
af80f78ce984 netfilter: nft_ct: bail out on template ct in get eval
7c34f9130529 netfilter: conntrack_irc: fix possible out-of-bounds read
0f8ba5e4c53d netfilter: synproxy: add mutex to guard hook reference counting
c6376b9b1b4d ipvs: clear the svc scheduler ptr early on edit
8122abd4fd92 netfilter: xt_NFQUEUE: prefer raw_smp_processor_id
945a86b21b40 ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers
9a0dc9279d09 tee: optee: prevent use-after-free when the client exits before the supplicant
5d27d2ffe487 net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS
2a613bf49702 ipv6: mcast: Fix use-after-free when processing MLD queries
aa6ef7340169 i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl
067579d5cf8c Disable -Wattribute-alias for clang-23 and newer
b26849cffaa7 hwmon: (pmbus/core) Protect regulator operations with mutex
d859e53596d1 RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug
7502c1cf303b Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync
90dbad14b109 USB: serial: mct_u232: fix memory corruption with small endpoint
f8b8f1d4bb76 bpf: Free reuseport cBPF prog after RCU grace period.
37f488be2a82 usb: core: Fix SuperSpeed root hub wMaxPacketSize
ff3c2b623bfa HID: core: Fix size_t specifier in hid_report_raw_event()
9e36568e67f8 HID: pass the buffer size to hid_report_raw_event
20a816422e98 HID: core: Add printk_ratelimited variants to hid_warn() etc
bb2040484f90 serial: zs: Convert to use a platform device
c9e78361fe92 serial: dz: Convert to use a platform device
5fc2943ad6a1 serial: dz: Fix bootconsole handover lockup
bef9e8bdbc60 xhci: tegra: Fix ghost USB device on dual-role port unplug
8a65db5edd7b USB: serial: digi_acceleport: fix memory corruption with small endpoints
fbf718d5afe2 landlock: Fix handling of disconnected directories
0e96cd314c0d x86/kexec: Disable KCOV instrumentation after load_segments()
a55618c0f4ce Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync
4bcaa59f403d USB: serial: cypress_m8: fix memory corruption with small endpoint
36f07474f2b9 serial: zs: Switch to using channel reset
633a33fe1a34 serial: zs: Fix bootconsole handover lockup
6f22119afe53 serial: dz: Fix bootconsole message clobbering at chip reset
a8bd09d3d843 drm/amdkfd: Check for pdd drm file first in CRIU restore path
4e5f808b4541 drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger
6495cc09f7e6 drm/amdkfd: fix NULL pointer bug in svm_range_set_attr
c33322ef3ce5 serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma
ea7bdbee9fc3 serial: zs: Fix swapped RI/DSR modem line transition counting
4860f9821baf serial: sh-sci: fix memory region release in error path
70982b7ac673 serial: qcom-geni: fix UART_RX_PAR_EN bit position
3c29f8af029b serial: altera_jtaguart: handle uart_add_one_port() failures
a1b9535768ed drm/amd/pm/si: Disregard vblank time when no displays are connected
28b22dbaf407 drm/i915: Fix potential UAF in TTM object purge
049a6b474823 drm/hyperv: validate VMBus packet size in receive callback
1fb565b77b8f drm/hyperv: validate resolution_count and fix WIN8 fallback
edd06675a023 scsi: target: iscsi: Validate CHAP_R length before base64 decode
4e9f0c4a645c scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf
163bd704d751 scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32
0e3c6e5a8fc1 scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker
5506c825f14d thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow
8d4a758b407a thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()
e835bf9a055f usb: gadget: f_fs: copy only received bytes on short ep0 read
a183b47fee46 usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports
046870ff6b6f usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling
5d39924ae38c usb: gadget: f_hid: fix device reference leak in hidg_alloc()
085652fda7f3 usb: gadget: net2280: Fix double free in probe error path
70bb9a2661d3 USB: serial: mct_u232: fix missing interrupt-in transfer sanity check
be3a1ed4ae51 USB: serial: mxuport: fix memory corruption with small endpoint
0bde5431037a USB: serial: keyspan: fix missing indat transfer sanity check
be50533fe706 USB: serial: cypress_m8: validate interrupt packet headers
ffb739a49186 USB: serial: belkin_sa: validate interrupt status length
37a2ac9f5125 USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL
5a0e65d56ffd USB: serial: option: add MeiG SRM813Q
17587492179c usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize
5de7df75ef3a usb: usbtmc: check URB actual_length for interrupt-IN notifications
a0638db2340e usbip: vudc: Fix use after free bug in vudc_remove due to race condition
02c76e026c06 usb: storage: Add quirks for PNY Elite Portable SSD
aec4d38ac605 USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers
e21f5abf80ad usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval
028cc2555eca usb: chipidea: core: convert ci_role_switch to local variable
6dd5c0ea139b tty: serial: pch_uart: add check for dma_alloc_coherent()
68f603bb8622 counter: Fix refcount leak in counter_alloc() error path
9fa854ea4318 comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest()
422af0f9ce0c comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest()
2ad3397f3cc5 Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490
e9b62996ba53 Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem
0fe08c5776a7 ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops
ba451cf21f1d Input: xpad - add support for ASUS ROG RAIKIRI II
6e6de3eba8e4 Input: xpad - add "Nova 2 Lite" from GameSir
322e48187e02 xfrm: esp: restore combined single-frag length gate
d780c61bd2ef ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks
ed4e2ff1ddd1 ASoC: qcom: q6asm-dai: close stream only when running
2bb6d82b586e netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check
32aa292fbcb9 xfrm: ah: use skb_to_full_sk in async output callbacks
00f2c451e57d xfrm: route MIGRATE notifications to caller's netns
c4cc6b3b0013 nfc: hci: fix out-of-bounds read in HCP header parsing
1552b979a0b6 iommu, debugobjects: avoid gcc-16.1 section mismatch warnings
ed598de9f615 HID: wacom: Fix OOB write in wacom_hid_set_device_mode()
f1e89a943ee5 ip6: vti: Use ip6_tnl.net in vti6_changelink().
48ce101cd630 xfrm: input: hold netns during deferred transport reinjection
a29768d56eb3 ipv6: validate extension header length before copying to cmsg
1acfb7d9c6fc ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().
12d957979e4a ipv6: exthdrs: refresh nh after handling HAO option
f21a9285147a ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params
bddaa4dfc7f3 ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()
679e13a65e68 macsec: fix replay protection at XPN lower-PN wrap
96b72672ce84 bpf: sockmap: fix tail fragment offset in bpf_msg_push_data
48b0aa9c08a3 Input: elan_i2c - validate firmware size before use
0584af4fe40f usb: dwc2: Fix use after free in debug code
c28bfafa9d70 usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles
96291794d162 usb: cdns3: gadget: fix request skipping after clearing halt
9a3860454bdf USB: serial: omninet: fix memory corruption with small endpoint
29783e6b6ec0 iio: buffer: hw-consumer: fix use-after-free in error path
d291f76e4231 iio: light: cm3323: fix reg_conf not being initialized correctly
d534936cf3ac iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL
c43741113cd6 iio: temperature: tsys01: fix broken PROM checksum validation
b5d9befff543 iio: ssp_sensors: cancel delayed work_refresh on remove
31bbd4b87dd6 iio: gyro: itg3200: fix i2c read into the wrong stack location
d434a6abd101 iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw
1c375f2c4a7a iio: dac: ad5686: acquire lock when doing powerdown control
99d8feee7560 iio: dac: ad5686: fix input raw value check
9a8fca2af3aa iio: dac: max5821: fix return value check in powerdown sync
baff1f00d8b5 iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux
7b9dcbe89d7a wireguard: send: append trailer after expanding head
a452ca80b7ad KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC
c881af73ae98 KVM: arm64: PMU: Preserve AArch32 counter low bits
ecc9635e7501 USB: cdc-acm: Fix bit overlap and move quirk definitions to header
15b1723c1472 parport: Fix race between port and client registration
bcfb4833cd40 Input: xpad - fix out-of-bounds access for Share button
35f68f36d988 Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock
119fb6f80c44 Bluetooth: ISO: fix UAF in iso_recv_frame
d313683d6ccd Bluetooth: HIDP: fix missing length checks in hidp_input_report()
63cd225cc13d Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn
89dec9204171 Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()
8776032fe989 auxdisplay: line-display: fix OOB read on zero-length message_store()
157ce2c6836c ipc: limit next_id allocation to the valid ID range
7c58c55a2a16 hpfs: fix a crash if hpfs_map_dnode_bitmap fails
dcd2b02b095f Bluetooth: btusb: Allow firmware re-download when version matches
4c52e31e9ea6 HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse
0cd7b3a15a49 Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free()
060fca8e0983 media: rc: igorplugusb: fix control request setup packet
9b3145b3001f USB: serial: safe_serial: fix memory corruption with small endpoint
156b6f0aec61 usb: typec: ucsi: validate connector number in ucsi_connector_change()
0af00f1459f5 usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT
5cd0e7ac4eef usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer()
70e7045849e9 usb: typec: altmodes/displayport: validate count before reading Status Update VDO
592cbdc644c6 usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO
3f432b820306 usb: typec: ucsi: ccg: reject firmware images without a ':' record header
d42ac0bfb6a1 iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer
d1c9c79eb06e soc/tegra: pmc: Fix unsafe generic_handle_irq() call
0bb1522d3081 hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock
96852c116071 hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock
7e2476057950 x86/kexec: add a sanity check on previous kernel's ima kexec buffer
566db3370f12 of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range()
43308106a176 ima: verify the previous kernel's IMA buffer lies in addressable RAM
e1d839efc1e4 phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X
64858b76ec67 arm64: io: Extract user memory type in ioremap_prot()
4356c4d85050 arm64: io: Rename ioremap_prot() to __ioremap_prot()
05ff52238039 drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used
45e27857b24e drm/dp: Add eDP 1.5 bit definition
ac7045d3f6d3 drm/i915/psr: Read Intel DPCD workaround register
28557e9deb23 drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register
22ee4010866d inet: frags: flush pending skbs in fqdir_pre_exit()
e0fc5427d6a8 inet: frags: add inet_frag_queue_flush()
711ebd961190 drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup
f707f53f9ff5 drm/fbdev-helper: Set and clear VGA switcheroo client from fb_info
228cc232079d media: rc: ttusbir: fix inverted error logic
a7becb58f6b8 media: rc: fix race between unregister and urb/irq callbacks
3edb8ebbf79b mm/page_alloc: clear page->private in free_pages_prepare()
a9393751ecf7 batman-adv: bla: avoid double decrement of bla.num_requests
99f17d1cdb37 batman-adv: tt: avoid empty VLAN responses
65a1e67339aa batman-adv: tt: fix TOCTOU race for reported vlans
5bc2d50fb66b batman-adv: tp_meter: directly shut down timer on cleanup
3c19cb8a84ef net: af_key: zero aligned sockaddr tail in PF_KEY exports
100953b5011d batman-adv: tp_meter: avoid role confusion in tp_list
cf12f8881832 batman-adv: iv: recover OGM scheduling after forward packet error
13493b00dd1e batman-adv: tvlv: reject oversized TVLV packets
2a8c9e865291 batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface
a5904f2c92b0 batman-adv: tt: reject oversized local TVLV buffers
fcedc98bd03c batman-adv: tvlv: abort OGM send on tvlv append failure
31dcb9711abd batman-adv: v: stop OGMv2 on disabled interface
ae1ada0af162 perf: Fix dangling cgroup pointer in cpuctx
1488367423a6 net: skbuff: fix pskb_carve leaking zcopy pages
c87cd3cb3096 ipv6: fix possible infinite loop in fib6_select_path()
279853aec9f5 ipv6: fix possible infinite loop in rt6_fill_node()
634a9af8a26a sctp: fix race between sctp_wait_for_connect and peeloff
95e414f83243 net: mana: Add NULL guards in teardown path to prevent panic on attach failure
88403b42faa8 gpio: rockchip: convert bank->clk to devm_clk_get_enabled()
6319b38fe69f Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
cc2b4f749de0 Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success
97e06791368c ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
65674d2489a1 ethtool: eeprom: add more safeties to EEPROM Netlink fallback
091b58d9a65b ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback
f4d78a81f57d bonding: refuse to enslave CAN devices
b06203ac5f12 Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()
5fe860af8630 ASoC: codecs: simple-mux: Fix enum control bounds check
3127a884525d ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE
e917d0c69f01 tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()
dc3bfa050f87 vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()
76cd9398a047 tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()
5165922a8b5c gpio: mxc: fix irq_high handling
a4b64f3e9c7b net: hsr: fix potential OOB access in supervision frame handling
e9e1dbdee16e ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors
8e59d4d0dcde ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()
15fb19af49f2 scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues
cd691beafea0 net/iucv: fix locking in .getsockopt
ed7a75831301 net/smc: Do not re-initialize smc hashtables
e523bb6d1de3 net: netlink: don't set nsid on local notifications
490a6ef32ab2 net: netlink: fix sending unassigned nsid after assigned one
20f977a75333 vsock: keep poll shutdown state consistent
60d9c0d6cdde tun: free page on build_skb failure in tun_xdp_one()
5b34f9e4fe2f tun: free page on short-frame rejection in tun_xdp_one()
b80ef316e978 netfilter: nf_tables: fix dst corruption in same register operation
ce0712149e21 netfilter: bitwise: add support for doing AND, OR and XOR directly
45cb4821021e netfilter: bitwise: rename some boolean operation functions
a27cb7325a6c netfilter: ebtables: fix OOB read in compat_mtw_from_user
21994d11461b netfilter: xt_cpu: prefer raw_smp_processor_id
af2c22ccb1f6 netfilter: synproxy: refresh tcphdr after skb_ensure_writable
d0cbeaa85b58 nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems
fccd685b32df xfrm: Check for underflow in xfrm_state_mtu
ee2d1a8a1833 nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()
e00f50f86977 nfc: llcp: Fix use-after-free in llcp_sock_release()
67cca9df4d17 net: cpsw_new: Fix potential unregister of netdev that has not been registered yet
4f33d74ccf69 bcache: fix uninitialized closure object
b4a659bae3b8 drm: Remove plane hsub/vsub alignment requirement for core helpers
6c153d97c100 net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked
963537a26fd8 net: mctp: ensure our nlmsg responses are initialised
5df49f0579f7 net/sched: cls_fw: fix NULL dereference of "old" filters before change()
d883312061cc Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
---
.../linux/linux-yocto-rt_6.6.bb | 6 ++--
.../linux/linux-yocto-tiny_6.6.bb | 6 ++--
meta/recipes-kernel/linux/linux-yocto_6.6.bb | 28 +++++++++----------
3 files changed, 20 insertions(+), 20 deletions(-)
diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb b/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb
index c3200cfd3f..e5a3882efe 100644
--- a/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb
@@ -14,13 +14,13 @@ python () {
raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it")
}
-SRCREV_machine ?= "1ceada58731a98237f70384921758a4df3951960"
-SRCREV_meta ?= "4a6f16d14b76e28ab7615c88e2fbdf95ee15fc98"
+SRCREV_machine ?= "fcddef60733f35eb43e4f8d5c7fd23d1c5bc4b24"
+SRCREV_meta ?= "b32016757524151fa9577e2c13b2fcc0355a076f"
SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine;protocol=https \
git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.6;destsuffix=${KMETA};protocol=https"
-LINUX_VERSION ?= "6.6.142"
+LINUX_VERSION ?= "6.6.143"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb
index 563598a2bd..ed4b0c67ae 100644
--- a/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb
@@ -8,7 +8,7 @@ require recipes-kernel/linux/linux-yocto.inc
# CVE exclusions
include recipes-kernel/linux/cve-exclusion_6.6.inc
-LINUX_VERSION ?= "6.6.142"
+LINUX_VERSION ?= "6.6.143"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}"
@@ -17,8 +17,8 @@ DEPENDS += "openssl-native util-linux-native"
KMETA = "kernel-meta"
KCONF_BSP_AUDIT_LEVEL = "2"
-SRCREV_machine ?= "66e051144e21d531fa26ef67476dfdefbfc119a2"
-SRCREV_meta ?= "4a6f16d14b76e28ab7615c88e2fbdf95ee15fc98"
+SRCREV_machine ?= "14b1b02cc139bf807405c9ad97a799a1dbfc0e4d"
+SRCREV_meta ?= "b32016757524151fa9577e2c13b2fcc0355a076f"
PV = "${LINUX_VERSION}+git"
diff --git a/meta/recipes-kernel/linux/linux-yocto_6.6.bb b/meta/recipes-kernel/linux/linux-yocto_6.6.bb
index 07a06f1852..c682d6ff17 100644
--- a/meta/recipes-kernel/linux/linux-yocto_6.6.bb
+++ b/meta/recipes-kernel/linux/linux-yocto_6.6.bb
@@ -18,25 +18,25 @@ KBRANCH:qemux86-64 ?= "v6.6/standard/base"
KBRANCH:qemuloongarch64 ?= "v6.6/standard/base"
KBRANCH:qemumips64 ?= "v6.6/standard/mti-malta64"
-SRCREV_machine:qemuarm ?= "d81ffd8843535762fecf5aa5fb2ca7d2c4343038"
-SRCREV_machine:qemuarm64 ?= "1f7f3a52dacadfcc75863f25252a534b06fdaeeb"
-SRCREV_machine:qemuloongarch64 ?= "a8a7d078f151a24e01d4501853c88c6b08c9cad9"
-SRCREV_machine:qemumips ?= "4410226fddf113b89cceb26e7ee5ca5bb70c55fb"
-SRCREV_machine:qemuppc ?= "8f8faf1fe9183f295901f8f2b8916ff54f4a4bfb"
-SRCREV_machine:qemuriscv64 ?= "a8a7d078f151a24e01d4501853c88c6b08c9cad9"
-SRCREV_machine:qemuriscv32 ?= "a8a7d078f151a24e01d4501853c88c6b08c9cad9"
-SRCREV_machine:qemux86 ?= "a8a7d078f151a24e01d4501853c88c6b08c9cad9"
-SRCREV_machine:qemux86-64 ?= "a8a7d078f151a24e01d4501853c88c6b08c9cad9"
-SRCREV_machine:qemumips64 ?= "14ca63e9f1ce2090e189c16b1024ed3df8f833f0"
-SRCREV_machine ?= "a8a7d078f151a24e01d4501853c88c6b08c9cad9"
-SRCREV_meta ?= "4a6f16d14b76e28ab7615c88e2fbdf95ee15fc98"
+SRCREV_machine:qemuarm ?= "900d4f2a9c0cd33b2f32053ea438c709ca4fc69c"
+SRCREV_machine:qemuarm64 ?= "5f9c75b34f19ebfb1ac2cf26b0cdf1e637b0a67b"
+SRCREV_machine:qemuloongarch64 ?= "d7c355e593fea6abba6099c009d0b4ec566ffba1"
+SRCREV_machine:qemumips ?= "d066c05c4207d69ff781175fbd4544af3a57a6e4"
+SRCREV_machine:qemuppc ?= "c9444b37f0f19f6f7186e4936f940b2e29cef806"
+SRCREV_machine:qemuriscv64 ?= "d7c355e593fea6abba6099c009d0b4ec566ffba1"
+SRCREV_machine:qemuriscv32 ?= "d7c355e593fea6abba6099c009d0b4ec566ffba1"
+SRCREV_machine:qemux86 ?= "d7c355e593fea6abba6099c009d0b4ec566ffba1"
+SRCREV_machine:qemux86-64 ?= "d7c355e593fea6abba6099c009d0b4ec566ffba1"
+SRCREV_machine:qemumips64 ?= "4c96d4f0d9ae5848015aa021c683bc1c68b596ee"
+SRCREV_machine ?= "d7c355e593fea6abba6099c009d0b4ec566ffba1"
+SRCREV_meta ?= "b32016757524151fa9577e2c13b2fcc0355a076f"
# set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll
# get the <version>/base branch, which is pure upstream -stable, and the same
# meta SRCREV as the linux-yocto-standard builds. Select your version using the
# normal PREFERRED_VERSION settings.
BBCLASSEXTEND = "devupstream:target"
-SRCREV_machine:class-devupstream ?= "924b4a879cbb75aef37c160b955b92f6894b11a4"
+SRCREV_machine:class-devupstream ?= "d1cfde2d5d15be14123bdd1689162bd27f995a90"
PN:class-devupstream = "linux-yocto-upstream"
KBRANCH:class-devupstream = "v6.6/base"
@@ -44,7 +44,7 @@ SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;name=machine;branch=${KBRA
git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.6;destsuffix=${KMETA};protocol=https"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
-LINUX_VERSION ?= "6.6.142"
+LINUX_VERSION ?= "6.6.143"
PV = "${LINUX_VERSION}+git"
--
2.43.0
^ permalink raw reply related
* [meta][scarthgap][PATCH 02/02] linux-yocto/6.6: update to v6.6.144
From: bruce.ashfield @ 2026-07-20 16:00 UTC (permalink / raw)
To: richard.purdie; +Cc: openembedded-core
In-Reply-To: <20260720160045.569687-1-bruce.ashfield@gmail.com>
From: Bruce Ashfield <bruce.ashfield@gmail.com>
Updating linux-yocto/6.6 to the latest korg -stable release that comprises
the following commits:
da47cbc254661 Linux 6.6.144
6848a6e39cac4 crypto: qat - remove unused character device and IOCTLs
1a42f84b0f6b5 crypto: qat - Return pointer directly in adf_ctl_alloc_resources
30d648e225447 crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user()
c0b8e6eea1b2b Documentation: ioctl-number: Extend "Include File" column width
802e113cf120d drivers/base/memory: set mem->altmap after successful device registration
511d2b92f8d20 serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails
851e1847f881e serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero
36599894fa853 ksmbd: fix out-of-bounds read in smb_check_perm_dacl()
2ef8f2a5695ae NFS: Prevent resource leak in nfs_alloc_server()
6c344fff2feff NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
abc978daffd26 nfsd: check get_user() return when reading princhashlen
1e96239fddcef nfsd: fix posix_acl leak on SETACL decode failure
1e04be34cafae NFSD: Fix SECINFO_NO_NAME decode error cleanup
1a7ee9f9f3957 fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode
c7dc382439f7b fbdev: modedb: fix a possible UAF in fb_find_mode()
7640b4f68acb5 fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var
c04d606f8b35e power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init()
889c2a9c59897 KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path
d18756b12aab3 KVM: x86: hyper-v: Bound the bank index when querying sparse banks
b84f46179c806 9p: avoid putting oldfid in p9_client_walk() error path
c5a125eadba05 ocfs2: reject oversized group bitmap descriptors
ddf13f91ca82c rpmsg: char: Fix use-after-free on probe error path
fbaf509ad7cb2 fpga: region: fix use-after-free in child_regions_with_firmware()
44567537a2623 irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove
7e37e9b3e82ad pNFS: Fix use-after-free in pnfs_update_layout()
eaca7dae02fab tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done
96e545410c4f7 blk-cgroup: fix UAF in __blkcg_rstat_flush()
508a0139d3bf6 hdlc_ppp: sync per-proto timers before freeing hdlc state
4fe388218826d gfs2: fix use-after-free in gfs2_qd_dealloc
8e0abc17fbd7e exfat: fix potential use-after-free in exfat_find_dir_entry()
ab465495b1ed5 MIPS: DEC: Prevent initial console buffer from landing in XKPHYS
81fc9a13acae9 bpf: use kvfree() for replaced sysctl write buffer
fda128096fc84 f2fs: keep atomic write retry from zeroing original data
7e4d8f98be63f f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()
1ddf3fd21c4c6 f2fs: validate ACL entry sizes in f2fs_acl_from_disk()
24f8c87070c3e f2fs: fix to round down start offset of fallocate for pin file
13e4b59d3a941 f2fs: validate compress cache inode only when enabled
bd499f138ccf7 wifi: iwlwifi: mvm: fix race condition in PTP removal
2b2060c2075a7 wifi: rtw88: usb: fix memory leaks on USB write failures
6579dcb5e0f74 wifi: rtw88: increase TX report timeout to fix race condition
16eef2a52687b wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor
318703b6f71d1 wifi: ath11k: fix warning when unbinding
a2e631fa91bb2 wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S
35ab4db86774d keys: Pin request_key_auth payload in instantiate paths
5966e4e2ba213 KEYS: fix overflow in keyctl_pkey_params_get_2()
03ef56495f0be err.h: use __always_inline on all error pointer helpers
5267eab88fa4c fbdev: fix use-after-free in store_modes()
06f6dd2ff2bd0 NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR
15fd83a1e42ed apparmor: fix use-after-free in rawdata dedup loop
faea60deaa05c apparmor: mediate the implicit connect of TCP fast open sendmsg
0eb4c16c4adb2 net: skmsg: preserve sg.copy across SG transforms
e28e7fd34c449 mac802154: llsec: add skb_cow_data() before in-place crypto
82c17e13d404f af_unix: Set gc_in_progress to true in unix_gc().
5f0b95ef68ab9 nvmet-tcp: fix race between ICReq handling and queue teardown
e8852ae29868e ntfs3: reject direct userspace writes to reserved $LX* xattrs
ce494707a9c07 ipv4: account for fraggap on the paged allocation path
f79f0db614160 inet: add indirect call wrapper for getfrag() calls
65fb14cbebb0c ipv6: account for fraggap on the paged allocation path
2660bd8333ab6 batman-adv: tvlv: avoid race of cifsnotfound handler state
9c9f4e69368a4 batman-adv: tvlv: enforce 2-byte alignment
d7fdbab25eae6 batman-adv: dat: prevent false sharing between VLANs
a8da361cdd929 batman-adv: tt: track roam count per VID
e82a02a0c1aa2 batman-adv: tt: don't merge change entries with different VIDs
0e868200cf042 batman-adv: tp_meter: handle overlapping packets
31dec4dc86cf6 batman-adv: tp_meter: prevent parallel modifications of last_recv
be3af0c705a13 batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE
f8c499fd275e5 batman-adv: tp_meter: restrict number of unacked list entries
97644fdaaf644 batman-adv: v: prevent OGM aggregation on disabled hardif
3af7f10d5fe44 batman-adv: frag: avoid underflow of TTL
cb96aa1737200 batman-adv: frag: ensure fragment is writable before modifying TTL
5263ff0bbd132 batman-adv: fix (m|b)cast csum after decrementing TTL
4741001ca0b04 batman-adv: ensure bcast is writable before modifying TTL
29f59324e61fc batman-adv: tp_meter: initialize last_recv_time during init
b88f8f4e5e78e batman-adv: prevent ELP transmission interval underflow
b5cf66cdc49b1 batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE
75445cf501ac7 batman-adv: tp_meter: add only finished tp_vars to lists
4774a32baec46 batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection
ec8ef37fea33c batman-adv: tp_meter: fix fast recovery precondition
cd74176cf1685 batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd
f58e5df92180e batman-adv: tp_meter: avoid window underflow
774d22045a8fa batman-adv: tp_meter: initialize dec_cwnd explicitly
0c610db91bbde batman-adv: tp_meter: initialize dup_acks explicitly
edae04afb11f6 batman-adv: tp_meter: keep unacked list in ascending ordered
bc6c380c1159d selinux: fix overlayfs mmap() and mprotect() access checks
41c5b269af8b1 lsm: add backing_file LSM hooks
ba3ebdd89fa20 fs: prepare for adding LSM blob to backing_file
922a03b26e354 Bluetooth: btmtk: accept too short WMT FUNC_CTRL events
36c85f7029484 Bluetooth: btmtk: validate WMT event SKB length before struct access
7536ebe0473d9 Revert "ptp: add testptp mask test"
48b91ed7e22bb KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level
9291654d69e08 KVM: x86: Fix shadow paging use-after-free due to unexpected role
2de4db145b299 eventpoll: fix ep_remove struct eventpoll / struct file UAF
a0e685da1efe0 eventpoll: move epi_fget() up
20423e2c1c84a eventpoll: rename ep_remove_safe() back to ep_remove()
0a4a2db528b0e eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}()
f484ab90b2290 eventpoll: kill __ep_remove()
903070f8f3552 eventpoll: split __ep_remove()
ff4fe83a9aabb eventpoll: use hlist_is_singular_node() in __ep_remove()
44e8907b81fea file: add fput() cleanup helper
2181a09ba980f virtiofs: fix UAF on submount umount
cd923dadefadb media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
d2bbbb6c55812 ksmbd: reject non-VALID session in compound request branch
8232fca738011 vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
08fbcba06e968 scripts/sorttable: Fix endianness handling in build-time mcount sort
80514e97c50ab scripts/sorttable: Allow matches to functions before function entry
9ba53f9808e1e scripts/sorttable: Use normal sort if theres no relocs in the mcount section
e115e9fa69b48 ftrace: Check against is_kernel_text() instead of kaslr_offset()
379e755ec2c54 ftrace: Test mcount_loc addr before calling ftrace_call_addr()
bf802b936a7b2 ftrace: Do not over-allocate ftrace memory
4c30b173b6176 ftrace: Have ftrace pages output reflect freed pages
dc06779d338de ftrace: Update the mcount_loc check of skipped entries
4893af6318fe8 scripts/sorttable: Zero out weak functions in mcount_loc table
bbfbacec9e000 scripts/sorttable: Always use an array for the mcount_loc sorting
38be2ffe9808b scripts/sorttable: Have mcount rela sort use direct values
fe0434d604a94 arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64
8297f13962063 scripts/sorttable: Use a structure of function pointers for elf helpers
ff7e015d63849 scripts/sorttable: Get start/stop_mcount_loc from ELF file directly
ecbb09356560c scripts/sorttable: Move code from sorttable.h into sorttable.c
7fbddce9a2685 scripts/sorttable: Use uint64_t for mcount sorting
23b5a9659a27d scripts/sorttable: Add helper functions for Elf_Sym
8cd6caaa4a244 scripts/sorttable: Add helper functions for Elf_Shdr
a03240485cf57 scripts/sorttable: Add helper functions for Elf_Ehdr
1dd7def1ae877 scripts/sorttable: Convert Elf_Sym MACRO over to a union
1afca399cc4d5 scripts/sorttable: Replace Elf_Shdr Macro with a union
7ce5ed40d976e scripts/sorttable: Convert Elf_Ehdr to union
e6bb2482b5b17 scripts/sorttable: Make compare_extable() into two functions
d5e14532a8b86 scripts/sorttable: Have the ORC code use the _r() functions to read
4f2fba2de0620 scripts/sorttable: Remove unneeded Elf_Rel
c13a4c1fd1b74 scripts/sorttable: Remove unused write functions
d9e259e63b36b scripts/sorttable: Remove unused macro defines
030fe3e9d8abd fuse: re-lock request before replacing page cache folio
fe95e90559bce slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD
e65ae7c948640 slimbus: qcom-ngd-ctrl: Fix up platform_driver registration
5d1ae4e17a3ec rxrpc: Fix the ACK parser to extract the SACK table for parsing
09c9b92c20104 net: phonet: free phonet_device after RCU grace period
210ac54bdd8df phonet: Pass net and ifindex to phonet_address_notify().
cf30797ea8cea phonet: Pass ifindex to fill_addr().
6707d7e0b7174 locking/rtmutex: Skip remove_waiter() when waiter is not enqueued
67fde21e4522e Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs
5df8310a41391 hv: utils: handle and propagate errors in kvp_register
23e5a1b9ae954 mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation
4830fb44d12f5 netfilter: nf_tables: always walk all pending catchall elements
7109d69bec6ed dlm: prevent NPD when writing a positive value to event_done
c84860dac7af7 regulator: core: fix locking in regulator_resolve_supply() error path
c2716362ec335 ring-buffer: Remove ring_buffer_read_prepare_sync()
f155b8f1c9576 selftests/bpf: Update comments find_equal_scalars->sync_linked_regs
8e655dbef4c9e selftests/bpf: Tests for per-insn sync_linked_regs() precision tracking
78da8e1be90c5 bpf: Remove mark_precise_scalar_ids()
0252b9d262222 bpf: Track equal scalars history on per-instruction level
b741c9c6ef59f af_unix: Reject SIOCATMARK on non-stream sockets
f68f34033d403 selftests/bpf: Add test to ensure kprobe_multi is not sleepable
89327ed787746 bpf: Reject sleepable kprobe_multi programs at attach time
eb045714bc6a2 agp/amd64: Fix broken error propagation in agp_amd64_probe()
1078ae8175777 net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()
1c4ffe6b4f043 i2c: stub: Reject I2C block transfers with invalid length
c19b360fa10c5 RDMA/bnxt_re: zero shared page before exposing to userspace
218c24bfc3334 KVM: VMX: Update SVI during runtime APICv activation
de1ba6c93868f ARM: fix branch predictor hardening
1f7cc85046f1c ARM: fix hash_name() fault
98b209cd62ef9 ARM: allow __do_kernel_fault() to report execution of memory faults
89b37df6f805f ARM: group is_permission_fault() with is_translation_fault()
5d95f6b267f3d debugobjects: Dont call fill_pool() in early boot hardirq context
a3383df76f0d7 debugobjects: Do not fill_pool() if pi_blocked_on
c8cd2ca8f085c debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP
0d2a64411b097 debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING
40fe77146137b batman-adv: tt: prevent TVLV entry number overflow
abb069fdf51a9 drm/v3d: Skip CSD when it has zeroed workgroups
756724002c5a6 drm/v3d: Store the active job inside the queue's state
f4b6b4af7ef06 ip6_vti: set netns_immutable on the fallback device.
499c6b43a79dd drm/amd/display: Bound VBIOS record-chain walk loops
b685d6ef6f07a net/sched: fix pedit partial COW leading to page cache corruption
8bef2f840b43e fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
---
.../linux/linux-yocto-rt_6.6.bb | 6 ++--
.../linux/linux-yocto-tiny_6.6.bb | 6 ++--
meta/recipes-kernel/linux/linux-yocto_6.6.bb | 28 +++++++++----------
3 files changed, 20 insertions(+), 20 deletions(-)
diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb b/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb
index e5a3882efe..cb8d8c418f 100644
--- a/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb
@@ -14,13 +14,13 @@ python () {
raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it")
}
-SRCREV_machine ?= "fcddef60733f35eb43e4f8d5c7fd23d1c5bc4b24"
-SRCREV_meta ?= "b32016757524151fa9577e2c13b2fcc0355a076f"
+SRCREV_machine ?= "d7fbdb4e5e7a35bdb8bb87d159204d74ef130a32"
+SRCREV_meta ?= "a77e1b965423603456f2d9dbf3de53bb8a3d75af"
SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine;protocol=https \
git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.6;destsuffix=${KMETA};protocol=https"
-LINUX_VERSION ?= "6.6.143"
+LINUX_VERSION ?= "6.6.144"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb
index ed4b0c67ae..73d971f7ee 100644
--- a/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb
@@ -8,7 +8,7 @@ require recipes-kernel/linux/linux-yocto.inc
# CVE exclusions
include recipes-kernel/linux/cve-exclusion_6.6.inc
-LINUX_VERSION ?= "6.6.143"
+LINUX_VERSION ?= "6.6.144"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}"
@@ -17,8 +17,8 @@ DEPENDS += "openssl-native util-linux-native"
KMETA = "kernel-meta"
KCONF_BSP_AUDIT_LEVEL = "2"
-SRCREV_machine ?= "14b1b02cc139bf807405c9ad97a799a1dbfc0e4d"
-SRCREV_meta ?= "b32016757524151fa9577e2c13b2fcc0355a076f"
+SRCREV_machine ?= "25b07b85b558f3587c11c9363cccd9cb93fcef45"
+SRCREV_meta ?= "a77e1b965423603456f2d9dbf3de53bb8a3d75af"
PV = "${LINUX_VERSION}+git"
diff --git a/meta/recipes-kernel/linux/linux-yocto_6.6.bb b/meta/recipes-kernel/linux/linux-yocto_6.6.bb
index c682d6ff17..64609554ee 100644
--- a/meta/recipes-kernel/linux/linux-yocto_6.6.bb
+++ b/meta/recipes-kernel/linux/linux-yocto_6.6.bb
@@ -18,25 +18,25 @@ KBRANCH:qemux86-64 ?= "v6.6/standard/base"
KBRANCH:qemuloongarch64 ?= "v6.6/standard/base"
KBRANCH:qemumips64 ?= "v6.6/standard/mti-malta64"
-SRCREV_machine:qemuarm ?= "900d4f2a9c0cd33b2f32053ea438c709ca4fc69c"
-SRCREV_machine:qemuarm64 ?= "5f9c75b34f19ebfb1ac2cf26b0cdf1e637b0a67b"
-SRCREV_machine:qemuloongarch64 ?= "d7c355e593fea6abba6099c009d0b4ec566ffba1"
-SRCREV_machine:qemumips ?= "d066c05c4207d69ff781175fbd4544af3a57a6e4"
-SRCREV_machine:qemuppc ?= "c9444b37f0f19f6f7186e4936f940b2e29cef806"
-SRCREV_machine:qemuriscv64 ?= "d7c355e593fea6abba6099c009d0b4ec566ffba1"
-SRCREV_machine:qemuriscv32 ?= "d7c355e593fea6abba6099c009d0b4ec566ffba1"
-SRCREV_machine:qemux86 ?= "d7c355e593fea6abba6099c009d0b4ec566ffba1"
-SRCREV_machine:qemux86-64 ?= "d7c355e593fea6abba6099c009d0b4ec566ffba1"
-SRCREV_machine:qemumips64 ?= "4c96d4f0d9ae5848015aa021c683bc1c68b596ee"
-SRCREV_machine ?= "d7c355e593fea6abba6099c009d0b4ec566ffba1"
-SRCREV_meta ?= "b32016757524151fa9577e2c13b2fcc0355a076f"
+SRCREV_machine:qemuarm ?= "3adc19c1e1e3ee865f9b0d7bc0fedd0e4aeee995"
+SRCREV_machine:qemuarm64 ?= "39a4fe09d3d795042cc14eb3c78f6a03874c48df"
+SRCREV_machine:qemuloongarch64 ?= "2baf8e92ef6ad38945005adf39342b9efb4509ec"
+SRCREV_machine:qemumips ?= "ba0b8f925ec8b5926c6c2ddbc2c2c77305324bab"
+SRCREV_machine:qemuppc ?= "66c01b44545110249c940f865c4ed10d4d315b29"
+SRCREV_machine:qemuriscv64 ?= "2baf8e92ef6ad38945005adf39342b9efb4509ec"
+SRCREV_machine:qemuriscv32 ?= "2baf8e92ef6ad38945005adf39342b9efb4509ec"
+SRCREV_machine:qemux86 ?= "2baf8e92ef6ad38945005adf39342b9efb4509ec"
+SRCREV_machine:qemux86-64 ?= "2baf8e92ef6ad38945005adf39342b9efb4509ec"
+SRCREV_machine:qemumips64 ?= "1793417d6568e244579278e6f1fc7107987946f5"
+SRCREV_machine ?= "2baf8e92ef6ad38945005adf39342b9efb4509ec"
+SRCREV_meta ?= "a77e1b965423603456f2d9dbf3de53bb8a3d75af"
# set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll
# get the <version>/base branch, which is pure upstream -stable, and the same
# meta SRCREV as the linux-yocto-standard builds. Select your version using the
# normal PREFERRED_VERSION settings.
BBCLASSEXTEND = "devupstream:target"
-SRCREV_machine:class-devupstream ?= "d1cfde2d5d15be14123bdd1689162bd27f995a90"
+SRCREV_machine:class-devupstream ?= "da47cbc254661aa66d61ef061485a7080305c4be"
PN:class-devupstream = "linux-yocto-upstream"
KBRANCH:class-devupstream = "v6.6/base"
@@ -44,7 +44,7 @@ SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;name=machine;branch=${KBRA
git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.6;destsuffix=${KMETA};protocol=https"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
-LINUX_VERSION ?= "6.6.143"
+LINUX_VERSION ?= "6.6.144"
PV = "${LINUX_VERSION}+git"
--
2.43.0
^ permalink raw reply related
* [meta-yocto-bsp][PATCH 06/06] yocto-bsps: update to v6.18.39
From: bruce.ashfield @ 2026-07-20 15:58 UTC (permalink / raw)
To: richard.purdie; +Cc: openembedded-core
In-Reply-To: <20260720155842.569263-1-bruce.ashfield@gmail.com>
From: Bruce Ashfield <bruce.ashfield@gmail.com>
Updating linux-yocto/6.18 to the latest korg -stable release that comprises
the following commits:
f89c296854b75 Linux 6.18.39
06b1729436efc xfs: use rtrefcount btree cursor in xchk_xref_is_rt_cow_staging
457a93a233bd7 xfs: write the rg superblock when fixing it
e696ef088f557 xfs: fix off-by-one error when calling xchk_xref_has_rt_owner
6403ef9a81e6c xfs: don't zap bmbt forks if they are MAXLEVELS tall
1ea0868a477b7 xfs: fully check the parent handle when it points to the rootdir
c9662ffd62c4e xfs: clamp timestamp nanoseconds correctly
424be21ed8cd4 xfs: handle non-inode owners for rtrmap record checking
d399b026a6b34 xfs: set xfarray killable sort correctly
08b191ae64659 xfs: use the rt version of the cow staging checker
104584477883b xfs: grab rtrmap btree when checking rgsuper
d1c4c40599c37 xfs: don't wrap around quota ids in dqiterate
206c09b04dc54 xfs: resample the data fork mapping after cycling ILOCK
d98f22d2e11e0 xfs: fail recovery on a committed log item with no regions
dca861f2cc9e6 xfs: fix null pointer dereference in tracepoint
fdafa1e68dc75 smb: client: reject overlapping data areas in SMB2 responses
1991d49433e90 Revert "f2fs: remove non-uptodate folio from the page cache in move_data_block"
1c56c46519353 Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev
e697df336662b timekeeping: Register default clocksource before taking tk_core.lock
9e04055ab5fc0 usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks
75e1d2787005d sched/fair: Only update stats for allowed CPUs when looking for dst group
0b466cf1b96e1 fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref
e1711479e9068 fuse-uring: make a fuse_req on SQE commit only findable after memcpy
39c8e925b207a fuse-uring: Avoid queue->stopped races and set/read that value under lock
23a356e0bd96c fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues
bb476ef8e1027 fuse-uring: end fuse_req on io-uring cancel task work
50f3e03db823c fuse-uring: fix moving cancelled entry to ent_in_userspace list
b156bb9966972 fuse-uring: fix data races on ring->ready
0483fffdeeb36 fuse-uring: fix EFAULT clobber in fuse_uring_commit
7366e6f4d2b4c fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req
096cb2e58a6db fuse: fix io-uring background queue dispatch on request completion
be353caffa864 fuse: re-lock request before returning from fuse_ref_folio()
e6620208bdd34 fuse: fix device node leak in cuse_process_init_reply()
6e2d84fdeac05 fuse: avoid 32-bit prune notification count wrap
69cfae58b9a32 fuse: back uncached readdir buffers with pages
423a78ff7928c RDMA/siw: bound Read Response placement to the RREAD length
ab45808c141a3 RDMA/core: Fix broadcast address falsely detected as local
5a45d0aa1fa50 RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg
95de76f6ad474 Input: maplecontrol - set driver data before registering input device
9376c744bea2c Input: maplemouse - set driver data before registering input device
699e3abac02de Input: maple_keyb - set driver data before registering input device
d7f66fbab5d21 Input: mms114 - fix multi-touch slot corruption
1b4cb75f254fb Input: maplemouse - fix NULL pointer dereference in open()
37fbe63bccf21 Input: gscps2 - advance receive buffer write index
8301c33530534 Input: mms114 - reject an oversized device packet size
3e6f007b43e2f Input: touchwin - reset the packet index on every complete packet
05dee4007cf30 Input: ads7846 - don't use scratch for tx_buf when clearing register
75b12874b4172 Input: mms114 - fix touch indexing for MMS134S and MMS136
70019779325f2 Input: iforce - bound the device-reported force-feedback effect index
3b32303460155 Input: goodix - clamp the device-reported contact count
01e0317c256c5 Input: elan_i2c - prevent division by zero and arithmetic underflow
e849c6f51e687 Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count
8db211aed8373 Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count
11f275f01c46b Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure
bb5133a7d5f3f i2c: i801: fix hardware state machine corruption in error path
b2523f26979e0 i2c: imx-lpi2c: mark I2C adapter when hardware is powered down
369635fbcf7f3 i2c: stm32f7: truncate clock period instead of rounding it
b65667ec5e9a9 i2c: davinci: Unregister cpufreq notifier on probe failure
56945871123e2 i2c: mpc: Fix timeout calculations
b6d2af6fe9c1f i2c: core: fix adapter deregistration race
71b7da959031f i2c: core: fix adapter debugfs creation
0345994d64761 i2c: core: fix adapter probe deferral loop
3351c5e77749a i2c: core: fix NULL-deref on adapter registration failure
9ec02cc9a04e5 i2c: core: fix irq domain leak on adapter registration failure
59070040fd12e fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()
34696563461c9 dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning
f8e1dc70efe48 udmabuf: fix DMA direction mismatch in release_udmabuf()
0c93681aea0a1 KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier
4ad73ef0e7966 KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits
ab253cf6e1118 KVM: VMX: Handle bad values on proxied writes to LBR MSRs
eeb456eb35565 KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs
35f3ea7e49a37 KVM: SVM: Only disable x2AVIC WRMSR interception for MSRs that are accelerated
7949aa38e1094 KVM: SVM: Disable x2AVIC RDMSR interception for MSRs KVM actually supports
4b200e0c9c339 KVM: x86: Add dedicated API for getting mask of accelerated x2APIC MSRs
6bea2f8becdb2 KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU
2d710d4fcd2cd LoongArch: KVM: Add missing slots_lock for device register/unregister
7c73a269a880b KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB
b51a7439c166a selftests/landlock: Filter dealloc records in audit_count_records()
859fef2c3d40a landlock: Set audit_net.sk for socket access checks
e4427c19554b5 audit: fix removal of dangling executable rules
32ca4aed2a662 iommufd: Set upper bounds on cache invalidation entry_num and entry_len
67daea4c09351 iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read()
5539da127d03c iommufd: Break the loop on failure in iommufd_fault_fops_read()
f2dbe1dba01e6 iommufd: Reject invalid read count in iommufd_fault_fops_read()
f549a749b6255 iommufd: Reject invalid read count in iommufd_veventq_fops_read()
64011399d8819 iommufd: Rewind header length in done if iommufd_veventq_fops_read() fails
f565297edf316 iommufd: Set veventq_depth upper bound
5c5f1b5184f7d iommufd: Fix data_len byte-count vs element-count mismatch
04a177f91160e iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read
50612ce318b1c iommu/amd: Don't split flush for amd_iommu_domain_flush_all()
bb354384f40bb iommu/vt-d: Avoid WARNING in sva unbind path
037ec8353711c crypto: loongson - Remove broken and unused loongson-rng
6bbe2000d9f9f selftests/mm: pagemap_ioctl: use the correct page size for transact_test()
5c942ad7df759 mm: do file ownership checks with the proper mount idmap
8dcaa0f87a88d mm: page_ext: add count limit to page_ext_iter_next to prevent invalid PFN access
785ebd42b8b50 selftests: mm: fix and speedup "droppable" test
279c2fa731122 mm: fix mmap errno value when MAP_DROPPABLE is not supported
4d730cab96e6b riscv: mm: Unconditionally sfence.vma for spurious fault
90405c8822c5d riscv: mm: Define DIRECT_MAP_PHYSMEM_END
1c8889e0db01f NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr()
33c0b96d7e167 exfat: bound uniname advance in exfat_find_dir_entry()
a82e170637e05 module: decompress: check return value of module_extend_max_pages()
b883733302508 rqspinlock: Fix order in raw_res_spin_(un)lock_irq to allow schedule
a937e92c1d005 NFSv4: include MAY_WRITE in open permission mask for O_TRUNC
75ca99875aa4e audit: fix potential integer overflow in audit_log_n_hex()
2dad64a97e1df tracing: Prevent out-of-bounds read in glob matching
c8b7e113f7b61 perf/aux: Fix page UAF in map_range()
af6048e913052 i2c: core: fix hang on adapter registration failure
22cb337370e65 regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()
6b01ed165d298 watchdog: apple: Add "apple,t8103-wdt" compatible
f4dd5621a6eef EDAC/i10nm: Don't fail probing if ADXL is missing
add1e4112e00b x86/mm: Fix freeing of PMD-sized vmemmap pages
808033d80d5c9 spi: fsl-lpspi: terminate the RX channel on TX prepare failure path
18d6048b1b1b4 spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync()
75422f5e50222 arm64: fpsimd: Fix type mismatch in sme_{save,load}_state()
93f000e89976e crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation
fda9cb9b7191c crypto: talitos/hash - remove useless wrapper
99cc3f5511d8b crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request
b960edc92c81b crypto: talitos/hash - drop workqueue mechanism for SEC1
042730207a991 crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue
40a2e90acdb1a crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor
a8decb89920a1 crypto: talitos - move code in current_desc_hdr() into a standalone function
aea8cfbd60da9 crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function
3fa1846f75edf crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function
664e7f16e74fc crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1
f52aa95e3cae1 crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header
7584c92f72447 crypto: qat - factor out AER reset helpers
6fb62b767f3e2 crypto: qat - validate RSA CRT component lengths
fabf364ef9db5 crypto: qat - skip restart for down devices
c3c5925791cff crypto: qat - protect service table iterations with service_lock
e310e8dc8ce72 crypto: qat - notify fatal error before AER reset preparation
45b65a21edbe0 crypto: qat - keep VFs enabled during reset
33cfc0ce28ac9 crypto: qat - handle sysfs-triggered reset callbacks
050bded706ee5 crypto: qat - centralize bus master enable
5337b5cd3608a crypto: drbg - Fix the fips_enabled priority boost
53d38b93cadc0 crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels
23b8b188cb32e crypto: drbg - Fix returning success on failure in CTR_DRBG
441ea32cf2755 crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG)
92567ed9306d5 crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD)
7a361c74bb12f crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)
9e983d0a74a6a crypto: ccp - Do not initialize SNP for SEV ioctls
53b8fb85f332b crypto: loongson - Select CRYPTO_RNG
cc4e42b3ee9fc crypto: tegra - fix refcount leak in tegra_se_host1x_submit()
c4bd2f4c35b0e crypto: pcrypt - restore callback for non-parallel fallback
ee6a2a25665c6 crypto: hisi-trng - Remove crypto_rng interface
774ddddf5eb26 crypto: ecc - Fix carry overflow in vli multiplication
ac667f9f18c6b crypto: crypto4xx - Remove insecure and unused rng_alg
0016d3c21c6ab crypto: chacha20poly1305 - validate poly1305 template argument
d0b8cafd529b4 crypto: caam - use print_hex_dump_devel to guard key hex dumps again
6f7b8e0321f3a crypto: caam - use print_hex_dump_devel to guard key hex dumps
7465ed1524ace crypto: af_alg - Remove zero-copy support from skcipher and aead
b5699642640d6 isofs: bound Rock Ridge symlink components to the SL record
ce93228e2193a partitions: aix: bound the pp_count scan to the ppe array
7a64521802997 btrfs: do not trim a device which is not writeable
0912b98151eea btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC
6d7649c1231da nvmet-auth: validate reply message payload bounds against transfer length
56c021a086926 nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page
7a69463e9ad23 nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks
13f2f5defb4d7 dm-ioctl: report an error if a device has no table
427c82497e269 block: partitions: fix of_node refcount leak in of_partition()
a8803c4f0ac3f nvme: target: rdma: fix ndev refcount leak on queue connect
d161d47aba31d crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A
c60932d6f8373 hwrng: jh7110 - fix refcount leak in starfive_trng_read()
04f4599a9efb9 udf: validate sparing table length as an entry count, not a byte count
e610fb113cdfa udf: validate VAT header length against the VAT inode size
335202ab25b01 udf: validate free block extents against the partition length
d944b8add3318 bpf: Prefer dirty packs for eBPF allocations
0229944ba7923 bpf: Prefer packs that won't trigger an IBPB flush on allocation
f1f36bf9bb117 bpf: Skip redundant IBPB in pack allocator
666fc2e6e4d0a bpf: Restrict JIT predictor flush to cBPF
8a4c8af9ae67e x86/bugs: Enable IBPB flush on BPF JIT allocation
8ff183ee4d8c4 bpf: Support for hardening against JIT spraying
bd818dcf4783e rust_binder: fix BINDER_GET_EXTENDED_ERROR
e5049526a7aac rust_binder: introduce TransactionInfo
be1567992417d x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled
b7b2d2ccdbc4d mm: shmem: fix potential livelock issue for shmem direct swapin
9818bcae3c0ca block: skip sync_blockdev() on surprise removal in bdev_mark_dead()
e086c16962a1b usb: gadget: f_fs: Fix DMA fence leak
b45be66ed47d4 usb: typec: ucsi: cancel pending work on system suspend
f5c772b76bbd9 usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove
b1dfdff51a865 usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode
8c00aec752ce1 usb: typec: ucsi: Invert DisplayPort role assignment
3e1b1ac47e816 usb: typec: tcpm: Validate SVID index in svdm_consume_modes()
0bc177820bd38 usb: typec: tcpm: Fix VDM type for Enter Mode commands
bf6aa6c0ce0db usb: typec: class: drop PD lookup reference
1126f1110b86c usb: typec: anx7411: use devm_pm_runtime_enable()
347b59e9f9671 usbip: vudc: fix NULL deref in vep_dequeue()
6c7e8e2514374 usbip: tools: support SuperSpeedPlus devices
2d84c8376f7aa USB: usb-storage: ene_ub6250: restore media-ready check
1967a7f0cd5c0 USB: ulpi: fix memory leak on registration failure
1243f12079004 USB: serial: digi_acceleport: fix write buffer corruption
2b7dc482f859f USB: serial: digi_acceleport: fix hard lockup on disconnect
eab394781e932 USB: serial: digi_acceleport: fix broken rx after throttle
4b147eb6ae6e0 USB: serial: option: add Telit Cinterion FE990D50 compositions
cf6ca0aefae03 USB: serial: keyspan_pda: fix information leak
8c29d9cfab1c3 usb: mtu3: unmap request DMA on queue failure
729b68a5bad71 USB: misc: uss720: unregister parport on probe failure
48394f94211cf usb: misc: usbio: bound bulk IN response length to the received transfer
964d572b6c009 USB: storage: include US_FL_NO_SAME in quirks mask
e0886775952e3 usb: sl811-hcd: disable controller wakeup on remove
766738ecf2b81 USB: legousbtower: fix use-after-free on disconnect race
6af28345cbf8b USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD
b748f97aff339 USB: iowarrior: fix use-after-free on disconnect
2107a4fc8ff1c USB: ldusb: fix use-after-free on disconnect race
54c2b7356b4ae USB: idmouse: fix use-after-free on disconnect race
8a5eba992c862 usb: gadget: f_printer: take kref only for successful open
b52476a83d9e1 usb: gadget: udc: Fix use-after-free in gadget_match_driver
01feaf024f296 usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler
6bc17a78a0567 usb: free iso schedules on failed submit
0bbab8882a319 usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume()
4b0779207e36d USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub
c00826e87bb75 usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()
e22f044b0b20d usb: cdc_acm: Add quirk for Uniden BC125AT scanner
e24eb271061db net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()
cd407de2ef5dc bpf: Validate BTF repeated field counts before expansion
d94ab0e91d3ff bpf: Restore sysctl new-value from 1 to 0
a9bb2d9c798cb bpf: Reject fragmented frames in devmap
c3d3d2212c296 xfs: fix memory leak in xfs_dqinode_metadir_create()
a62ef2d13d6e7 xfs: fix exchmaps reservation limit check
55e4d8413fb54 xfs: fix pointer arithmetic error on 32-bit systems
dd8d0665cdabf xfs: fix unreachable BIGTIME check in dquot flush validation
936618643591c xfs: release dquot buffer after dqflush failure
200794d0354cd xfs: use null daddr for unset first bad log block
1cd54e217c6e2 serial: 8250_mid: Disable DMA for selected platforms
973408ceab145 media: mtk-jpeg: cancel workqueue on release for supported platforms only
223463c488b05 nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers
f3461b84a4865 hfs/hfsplus: zero-initialize buffer in hfs_bnode_read
c63bc6308da71 HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads
4d0d51bc12d24 HID: lg-g15: cancel pending work on remove to fix a use-after-free
b363d964ca829 HID: appleir: fix UAF on pending key_up_timer in remove()
37daa8c96bd56 HID: multitouch: fix out-of-bounds bit access on mt_io_flags
3eca1a8165b5e HID: letsketch: fix UAF on inrange_timer at driver unbind
bbe1e55629bfa HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush()
ca899a926c11a HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert
cb90a01e478c2 HID: pidff: Use correct effect type in effect update
416095e9a6037 HID: wacom: stop hardware after post-start probe failures
7ce2c7dd28ab8 HID: uhid: convert to hid_safe_input_report()
dae1d000ddfd5 HID: hid-goodix-spi: validate report size to prevent stack buffer overflow
abf07f5c3584f tools/mm/slabinfo: fix total_objects attribute name
e0eec7497bcc7 tools/mm/slabinfo: Fix trace disable logic inversion
2382971aaaef5 mm/slab: do not limit zeroing to orig_size when only red zoning is enabled
18d90dc05d98b X.509: Fix validation of ASN.1 certificate header
28390912740a2 perf/arm-cmn: Fix DVM node events
be79d285bea70 s390: Revert support for DCACHE_WORD_ACCESS
2421a7b24f9c8 clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances
cd25e9819620a time/jiffies: Register jiffies clocksource before usage
7776f9226e99e posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path
6ba6f6783be2f cpufreq: pcc: fix use-after-free and double free in _OSC evaluation
6e175c00c62dc cpufreq: Fix hotplug-suspend race during reboot
4bd0da48fbc1d sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT
f77e55baeeb8c cpufreq: intel_pstate: Sync policy->cur during CPU offline
59626d0d29217 perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box()
b9d45d328fcda libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo()
92f41769e5fd1 firmware_loader: fix device reference leak in firmware_upload_register()
e904961332801 cpufreq: qcom-cpufreq-hw: Fix possible double free
a277489337c7d OPP: of: Fix potential memory leak in opp_parse_supplies()
685fc15a41088 writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()
c6c484a7d5bff smb: client: mask server-provided mode to 07777 in modefromsid
157c67a657a7d smb: client: fix atime clamp check in read completion
86c5d470f5d42 smb: client: harden POSIX SID length parsing
3d89ae65ef78a smb: client: use unaligned reads in parse_posix_ctxt()
297243e365fc9 smb: client: Fix next buffer leak in receive_encrypted_standard()
d15d83125007f smb: client: fix double-free in SMB2_close() replay
14498ff5ce0f2 smb: client: fix double-free in SMB2_open() replay
3407240cde132 smb: client: fix double-free in SMB2_flush() replay
52af1975f0dfa smb: client: fix change notify replay double-free
276c8efbc49f9 smb: client: fix double-free in SMB2_ioctl() replay
f1add4acb656f smb: client: fix query_info() replay double-free
00b0fa4259414 smb: client: fix query directory replay double-free
2b4592cea2146 ksmbd: use opener credentials for ADS I/O
e72c15085b6d8 ksmbd: use opener credentials for delete-on-close
df501c0f320b5 ksmbd: add per-handle permission check to FILE_LINK_INFORMATION
2ca82bfff49c8 ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION
20ee516a62989 ksmbd: run set info with opener credentials
f56535db508ea ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY
db231af842868 ksmbd: require source read access for duplicate extents
5aa1cb01155f9 ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation
a1d5d31cad593 ksmbd: serialize QUERY_DIRECTORY requests per file
57f2042fd87d7 ksmbd: add a permission check for FSCTL_SET_ZERO_DATA
baae7b39673ec ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE
a187883cc1dc7 smb/client: Fix error code in smb2_aead_req_alloc()
91b8a58c6ac15 smb: client: resolve SWN tcon from live registrations
661a019ac0413 coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()
08fad5d5a26cc fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()
6dd58c56ab864 fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio()
764e6f76fdbd4 fs/ntfs3: fsync files by syncing parent inodes
38cbb1feebcf5 fs/ntfs3: rename ni_readpage_cmpr into ni_read_folio_cmpr
4718007870547 iommu/vt-d: Fix race condition during PASID entry replacement
73abbaf91aa33 Bluetooth: L2CAP: validate option length before reading conf opt value
d5616beb3355b Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock
b84eeb7636d69 Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()
b9dd39cf1667e Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled
61701912c58a0 Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()
26168db1ce5a9 Bluetooth: fix UAF in bt_accept_dequeue()
2a68a77308920 Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3()
a6b22dbd80926 Bluetooth: bnep: pin L2CAP connection during netdev registration
0039bdde36b23 Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()
81a5971cbe18b netfilter: flowtable: fix offloaded ct timeout never being extended
6fe8d3cecd20b netfilter: ebtables: terminate table name before find_table_lock()
13a5f532e3a4f netfilter: ebtables: module names must be null-terminated
9f74d28e903fa netfilter: ebtables: zero chainstack array
fc5bfe63bacf8 netfilter: handle unreadable frags
a8f03a3793289 netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump
69c0e6246575b mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent softlockup
b415c00bf23df mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless host
006467ab93269 mm: shrinker: fix NULL pointer dereference in debugfs
6465ff3ce6513 mm: shrinker: fix shrinker_info teardown race with expansion
560e21e8ccff8 mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()
b5f41d5bf08e7 mfd: cros_ec: Delay dev_set_drvdata() until probe success
bbae351c0f32f net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes
2ca18df1c2611 ipv4: igmp: remove multicast group from hash table on device destruction
a33f37f8d079d netpoll: fix a use-after-free on shutdown path
f090acf881a26 io_uring/rw: preserve partial result for iopoll
1636d85dc139b io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item
722869fcff598 io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE
4508366ab7dd0 gpio: sch: use raw_spinlock_t in the irq startup path
4750909a40da9 gpio: eic-sprd: use raw_spinlock_t in the irq startup path
f71e8d9875069 NTB: epf: Avoid calling pci_irq_vector() from hardirq context
cf28fc1658463 fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns
c00164c9e7fa6 debugobjects: Plug race against a concurrent OOM disable
cbb684ef39e9f coresight: etb10: restore atomic_t for shared reading state
b346efa825b5e Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete
d3b739db5dc6f Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref
fe997a84a385f audit: Fix data races of skb_queue_len() readers on audit_queue
e8417353cbd07 net: af_key: initialize alg_key_len for IPComp states
94083db751930 ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL
ef6feb77e2d91 crypto: krb5 - filter out async aead implementations at alloc
84a00be9b736a crypto: amlogic - avoid double cleanup in meson_crypto_probe()
6f91621fc4502 staging: rtl8723bs: fix OOB write in HT_caps_handler()
a6105ea8ca6eb staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop
c38d16b1ffac3 staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()
69f174a0673b6 staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop
04f612dc03427 staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop
64ec4192d9c10 staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()
b9c4bf133c3c4 staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()
b5ddc7257bee7 staging: media: ipu7: fix double-free and use-after-free in error paths
1ca4f310c6b1f staging: media: atomisp: reduce load_primary_binaries() stack usage
b4ba13dafa13c media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe
e3ceafa6d8ee6 staging: vme_user: fix location monitor leak in tsi148 bridge
a921486313975 staging: vme_user: fix location monitor leak in fake bridge
ceb875a375ded smb: client: restrict implied bcc[0] exemption to responses without data area
e99f2df433c63 staging: vme_user: bound slave read/write to the kern_buf size
2de42e2681747 tipc: fix out-of-bounds read in broadcast Gap ACK blocks
0beccbcf50de1 6lowpan: fix NHC entry use-after-free on error path
c40090f8d19b4 usb: misc: usbio: fix disconnect UAF in client teardown
c4e232bd07fe2 usb: dwc3: run gadget disconnect from sleepable suspend context
2a52d55c86a42 USB: chaoskey: Fix slab-use-after-free in chaoskey_release()
285e17c44e387 hwrng: virtio: clamp device-reported used.len at copy_data()
65e93ec592f5b virtio-mmio: fix device release warning on module unload
075bc3c779e1e virtio_pci: fix vq info pointer lookup via wrong index
81d54c766337b netfilter: ipset: fix race between dump and ip_set_list resize
9c8f31eaae614 mm/damon/ops-common: handle extreme intervals in damon_hot_score()
657646c08c94e tcp: restore RCU grace period in tcp_ao_destroy_sock
b775246212504 PCI/IOV: Skip VF Resizable BAR restore on read error
1115680bca1d7 PCI: qcom: Initialize DWC MSI lock for firmware-managed ECAM hosts
6e6a529d6f779 PCI: mediatek: Fix IRQ domain leak when port fails to enable
69416a5308675 PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling
1d2e66a4bc0dd PCI: host-common: Request bus reassignment when not probe-only
9c698af5c2a12 PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining
09c43b7b7d29c PCI: altera: Fix resource leaks on probe failure
5e42a981887d2 PCI: altera: Do not dispose parent IRQ mapping
d666c5aec822d PCI: loongson: Override PCIe bridge supported speeds for Loongson-3C6000 series
e5406c8fb71cd usb: typec: tcpci_rt1711h: unregister TCPCI port with devres
99d00a9e35e31 xhci: sideband: fix ring sg table pages leak
f90586129cf9e usb: xhci: Fix sleep in atomic context in xhci_free_streams()
91b27f8172cdb rust_binder: clear freeze listener on node removal
281335996ab21 rust_binder: synchronize Rust Binder stats with freeze commands
08e21d86d2722 rust_binder: reject context manager self-transaction
89b8cc948dce6 rust_binder: use a u64 stride when cleaning up the offsets array
328ccf32acb87 binder: fix UAF in binder_free_transaction()
ea02df466df60 binder: fix UAF in binder_thread_release()
17a2d3f903455 Bluetooth: btusb: fix wakeup source leak on probe failure
a7e941a395711 Bluetooth: btusb: fix use-after-free on marvell probe failure
8db0ce3de7836 Bluetooth: btusb: fix use-after-free on registration failure
79f9e221dddec Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB
a53109ffb6b51 vfio: Remove device debugfs before releasing devres
7f2d6b31089e4 vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc
ba96666d991e6 vfio/pci: Fix racy bitfields and tighten struct layout
52adb2dff7ce3 vfio/pci: Release the VGA arbiter client on register_device() failure
f6c67cf0051f9 vfio/pci: Latch disable_idle_d3 per device
a385d3435a7af vfio/pci: Use a private flag to prevent power state change with VFs
afc90150551dd ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes
54c448e4f26a7 ALSA: usb-audio: Update Babyface Pro control caches only after successful writes
f3e8a6cca15b8 ALSA: usb-audio: Roll back quirk control caches on write errors
3061b6c114458 ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks
bfd28b07541e5 ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()
a263eb12cbe2e ALSA: usb-audio: avoid kobject path lookup in DualSense match
16f14f55141d4 ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on each resubmission
651ba82fe2a14 ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()
71b87108ad93d ALSA: ice1712: check snd_ctl_new1() return value
04dd210180575 ALSA: hda/realtek: Fix noisy mic for Clevo V6xxAW
1933e6ee136b1 ALSA: hda/hdmi: Use 'AC_PINSENSE_ELDV' to detect pinsense for Loongson
4dd2552e559bd ALSA: hda/hdmi: Add force-connect quirk for HP EliteDesk 800 G5 Mini
ce0a903d0591e ALSA: hda/cs35l41: Fix firmware load work teardown
5e74e5e8cb7cc ALSA: gus: check snd_ctl_new1() return value
8e48a29813df8 ALSA: firewire: isight: bound the sample count to the packet payload
db25755e7629d ALSA: FCP: Add Focusrite ISA C8X support
9e53e99b6fa3c ALSA: es1938: check snd_ctl_new1() return value
b27a75d42044d ALSA: compress: Fix task creation error unwind
af2b009b773bc ALSA: cmipci: check snd_ctl_new1() return value
a5fd3122283bf ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser
fd786466889e4 ALSA: aoa: check snd_ctl_new1() return value
f6538a318947b ALSA: ymfpci: check snd_ctl_new1() return value
5da9742de22db ALSA: virtio: Validate control metadata from the device
df0fe53a7104b ALSA: virtio: Add missing 384 kHz PCM rate mapping
c071df05bcda0 ALSA: usx2y: us144mkii: fix work UAF on disconnect
a4f8491da9563 iio: temperature: tmp006: use devm_iio_trigger_register
62a0d75bedd4b iio: temperature: ltc2983: Fix reinit_completion() called after conversion start
e16258913be6a iio: temperature: ltc2983: Fix n_wires default bypassing rotation check
b50344ab202f3 iio: temperature: Build mlx90635 with CONFIG_MLX90635
7d4d60f7c0541 iio: resolver: ad2s1210: notify trigger and clear state on fault read error
c6ca87c7bbb3f iio: proximity: vl53l0x: notify trigger and clear IRQ on error paths
b3f1af4ba8e9c iio: pressure: mpl115: fix runtime PM leak on read error
e2d5b9673bf71 iio: pressure: bmp280: zero-init bmp580 trigger handler buffer
f829d6c32f31b iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call
0975e013179d3 iio: light: veml6030: fix channel type when pushing events
ef6c2a521454f iio: light: tsl2591: return actual error from probe IRQ failure
9d421c2827ea1 iio: light: opt3001: fix missing state reset on timeout
0c655d067ac69 iio: light: gp2ap002: fix runtime PM leak on read error
a60bf629a760d iio: light: al3320a: read both ALS ADC registers again
a1dafc918d793 iio: light: al3320a: add missing REGMAP_I2C to Kconfig
a00d471cf3580 iio: light: al3010: read both ALS ADC registers again
cd278561640c7 iio: light: al3010: fix incorrect scale for the highest gain range
9fb4ff07d97e3 iio: light: al3010: add missing REGMAP_I2C to Kconfig
6afb69bb969ed iio: light: al3000a: add missing REGMAP_I2C to Kconfig
482b24660ec3b iio: imu: st_lsm6dsx: deselect shub page before reading whoami
76e12a71ac053 iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading
34656a59322e5 iio: imu: inv_icm42600: fix timestamp clock period by using lower value
0522819228284 iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ
bdafd53ae671e iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ
001527e2382e3 iio: gyro: bmg160: wait full startup time after mode change at probe
7bbf02b63961f iio: gyro: bmg160: bail out when bandwidth/filter is not in table
9edefd4c56bee iio: event: Fix event FIFO reset race
2358da87315d1 iio: dac: ad3552r-hs: fix uninitialized data ni ad3552r_hs_write_data_source()
e166a8cfb28a3 iio: core: fix uninitialized data in debugfs
b947bde73461f iio: common: st_sensors: honour channel endianness in read_axis_data
82accdd574043 iio: chemical: scd30: Cleanup initializations and fix sign-extension bug
c28835b8618ec iio: backend: fix uninitialized data in debugfs
0f30e68dd6c1f iio: adc: ti-ads124s08: Return reset GPIO lookup errors
ffb2195921c3d iio: adc: ti-ads1119: fix PM reference leak in buffer preenable
bbfebae473ac2 iio: adc: spear: Initialize completion before requesting IRQ
9e2e8b8cdfd37 iio: adc: lpc32xx: Initialize completion before requesting IRQ
c313bb7c38855 iio: adc: ad_sigma_delta: fix CS held asserted and state leaks
3394e0b332842 iio: adc: ad_sigma_delta: fix clear_pending_event for registerless devices
46e93fcbe7c2c iio: adc: ad7779: add missing 'select IIO_TRIGGERED_BUFFER' to Kconfig
24a9514b606e7 iio: adc: ad7768-1: Select GPIOLIB
e6ade81631d76 iio: adc: ad7380: select REGMAP
6293211d14260 iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error
3e766526827ac iio: accel: bmc150: clamp the device-reported FIFO frame count
7515a6d4a9e9e usb: gadget: function: rndis: add length check for header
e01e7814b4223 usb: gadget: function: rndis: add length check to response query
9d1dc507b99ce fscrypt: Replace mk_users keyring with simple list
85f8b440a09ba fscrypt: Fix key setup in edge case with multiple data unit sizes
20133754d46fe rust: kasan: KASAN+RUST requires clang
a2d5d3ee7b6e3 perf/core: Detach event groups during remove_on_exec
94396fd93226a futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock""
1cc8f512cd905 rust: Kbuild: set frame-pointer llvm module flag for CONFIG_FRAME_POINTER
70fe1ac8647b0 rust: doctest: fix incorrect pattern in replacement
e7636f26f7707 rust: block: fix GenDisk cleanup paths
c1dd0b1071004 rust: cpufreq: clean new `clippy::map_or_identity` lint for Rust 1.98.0
30d5d4eef35a9 LoongArch: Add PIO for early access before ACPI PCI root register
86df6499dfd23 platform/x86: intel-hid: Protect ACPI notify handler against recursion
452945662fd8e ACPI: NFIT: core: Fix possible NULL pointer dereference
f29dc6132d496 ACPI: CPPC: Suppress UBSAN warning caused by field misuse
ff9c4c6428883 KVM: x86: Unconditionally recompute CR8 intercept on PPR update
3dcfb04dd43b1 KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode
0d0187a46b16e KVM: x86: Move update_cr8_intercept() to lapic.c
9baa2833e6bc8 perf trace beauty fcntl: Fix build with older kernel headers
47e4c6e06e78e slab: recognize @GFP parameter as optional in kernel-doc
1776f29327a13 default_gfp(): avoid using the "newfangled" __VA_OPT__ trick
50c26b461b8e7 add default_gfp() helper macro and use it in the new *alloc_obj() helpers
2dca62902eb35 slab: Introduce kmalloc_flex() and family
1c2672781b1b3 mm/khugepaged: write all dirty file folios when collapsing
2539f67b75461 nfsd: change nfs4_client_to_reclaim() to allocate data
05e48af3bf58d nfsd: move name lookup out of nfsd4_list_rec_dir()
c4b70c1512b8f net/sched: dualpi2: fix GSO backlog accounting
076b1aa65f77a fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()
406c28af75123 f2fs: fix to do sanity check on f2fs_get_node_folio_ra()
3f42fbd3c891d f2fs: detect more inconsistent cases in sanity_check_node_footer()
ed87e57558dc5 f2fs: optimize trace_f2fs_write_checkpoint with enums
8dbc4c5686820 f2fs: introduce f2fs_schedule_timeout()
599d7d82eeecc f2fs: use memalloc_retry_wait() as much as possible
ec9f79c8d5b28 f2fs: fix listxattr handling of corrupted xattr entries
89479a27fa4e1 f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()
998536c96b6ad f2fs: fix potential deadlock in f2fs_balance_fs()
4ce2d52f680c1 f2fs: bound i_inline_xattr_size for non-inline-xattr inodes
a499f77c06050 f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode
5a4d3968cf820 f2fs: remove non-uptodate folio from the page cache in move_data_block
9c86a1f930bb2 device property: initialize the remaining fields of fwnode_handle in fwnode_init()
60d696a037eee userfaultfd: gate must_wait writability check on pte_present()
3436a7dd067c5 rust: str: clean unused import for Rust >= 1.98
3603500c868a1 rust: str: use the "kernel vertical" imports style
8dee7c278f1c2 nfsd: release layout stid on setlease failure
6f88ca186a984 nfsd: update mtime/ctime on COPY in presence of delegated attributes
7c702bb4f8d83 nfsd: update mtime/ctime on CLONE in presense of delegated attributes
501543207378f bpf, arm64: Reject out-of-range B.cond targets
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
---
meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.18.bbappend | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.18.bbappend b/meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.18.bbappend
index d8790f3..8816184 100644
--- a/meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.18.bbappend
+++ b/meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.18.bbappend
@@ -8,4 +8,4 @@ KMACHINE:genericx86 ?= "common-pc"
KMACHINE:genericx86-64 ?= "common-pc-64"
KBRANCH:genericarm64 ?= "v6.18/standard/genericarm64"
-SRCREV_machine:genericarm64 ?= "daaaf767b0cba42bcd9ba3f5b5f6b42b5e695a3f"
+SRCREV_machine:genericarm64 ?= "08d2d1aaeb84ad2774df573efc336bb7ca773d40"
--
2.43.0
^ permalink raw reply related
* [meta-yocto-bsp][PATCH 05/06] yocto-bsps: update to v6.18.38
From: bruce.ashfield @ 2026-07-20 15:58 UTC (permalink / raw)
To: richard.purdie; +Cc: openembedded-core
In-Reply-To: <20260720155842.569263-1-bruce.ashfield@gmail.com>
From: Bruce Ashfield <bruce.ashfield@gmail.com>
Updating linux-yocto/6.18 to the latest korg -stable release that comprises
the following commits:
e46dc0adfe397 Linux 6.18.38
92c63a5ef3c7a apparmor: advertise the tcp fast open fix is applied
e77fbefd1269b net/tcp-ao: fix use-after-free of key in del_async path
3d205fe80f218 serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails
7627ff8c4f991 ksmbd: fix out-of-bounds read in smb_check_perm_dacl()
62c26720121bf NFS: Prevent resource leak in nfs_alloc_server()
6919eb549e8f3 NFSv4: clear exception state on successful mkdir retry
012d37a568bfb NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
d8c90c7cc0612 NFSv4/flexfiles: reject zero filehandle version count
4367afc119c51 nfsd: reset write verifier on deferred writeback errors
017a6150106b0 nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race
0f28337f54cfb nfsd: check get_user() return when reading princhashlen
dba7da4835de7 nfsd: fix inverted cp_ttl check in async copy reaper
136b416593f13 nfsd: fix posix_acl leak on SETACL decode failure
c8a24effd96d4 NFSD: Fix SECINFO_NO_NAME decode error cleanup
6a946038f2a5a i2c: core: fix adapter registration race
fc6aa9bdbae60 fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode
4d418cf8daf57 fbdev: modedb: fix a possible UAF in fb_find_mode()
eea16b6f805c0 fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var
7643e5622994f riscv: kfence: Call mark_new_valid_map() for kfence_unprotect()
3b33dbb43e21a riscv: mm: Extract helper mark_new_valid_map()
2205275be9be9 power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init()
720949ed666f3 KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path
e36095d8d922b KVM: x86: hyper-v: Bound the bank index when querying sparse banks
f9b57a0015c24 MIPS: smp: report dying CPU to RCU in stop_this_cpu()
6dbe9443d9f5f 9p: avoid putting oldfid in p9_client_walk() error path
4cd57ebee3950 ocfs2: reject oversized group bitmap descriptors
104d100212396 rpmsg: char: Fix use-after-free on probe error path
369496d885b4c fpga: region: fix use-after-free in child_regions_with_firmware()
b3a3831b2eb88 irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove
200e7637f4d6a pNFS: Fix use-after-free in pnfs_update_layout()
90e254f18b8c2 LoongArch: Report dying CPU to RCU in stop_this_cpu()
e18769616fd5a tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done
5e5b7f2ef8549 blk-cgroup: fix UAF in __blkcg_rstat_flush()
5a84398101bf9 hdlc_ppp: sync per-proto timers before freeing hdlc state
e91df6d273445 pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()
b85ef03f726b1 gfs2: fix use-after-free in gfs2_qd_dealloc
8d8507a457667 crypto: nx - fix nx_crypto_ctx_exit argument
5da9b1a87ec7c KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()
18587f9831612 KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level
adfacfbaeae2c exfat: fix potential use-after-free in exfat_find_dir_entry()
6e61fc2e06e44 MIPS: DEC: Prevent initial console buffer from landing in XKPHYS
65bd0c0afb0e1 bpf: use kvfree() for replaced sysctl write buffer
3804e6de30ae7 block: Avoid mounting the bdev pseudo-filesystem in userspace
db2c5b9fb9087 f2fs: keep atomic write retry from zeroing original data
20190e4980579 f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()
ff83de56882cb f2fs: validate ACL entry sizes in f2fs_acl_from_disk()
888d94cc9afbf f2fs: fix to round down start offset of fallocate for pin file
77f216ff9ce5c f2fs: validate compress cache inode only when enabled
8aad54746c251 f2fs: validate orphan inode entry count
1e48fefac682c f2fs: pass correct iostat type for single node writes
1de92789ce31e wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers
b0b07e04f0c72 wifi: iwlwifi: mld: fix race condition in PTP removal
df626f284cb90 wifi: iwlwifi: mvm: fix race condition in PTP removal
200d58c851b8f wifi: rtw88: usb: fix memory leaks on USB write failures
73d427d271f7a wifi: rtw88: increase TX report timeout to fix race condition
0aeb4d3ff6ced wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor
40aa3c2b0cb8e wifi: ath11k: fix warning when unbinding
a7cdc384c9c57 wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer
7e25b5e22c1f4 wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S
ec1c9e8962555 userfaultfd: ensure mremap_userfaultfd_fail() releases mmap_changing
7216ce8cb12fe keys: Pin request_key_auth payload in instantiate paths
b11c1fa326676 KEYS: fix overflow in keyctl_pkey_params_get_2()
49d893b9cbcfc gcov: use atomic counter updates to fix concurrent access crashes
2b7ec72786094 err.h: use __always_inline on all error pointer helpers
1fcca1260c6e7 KVM: arm64: Omit tag sync on stage-2 mappings of the zero page
97e1044e79c5d block: invalidate cached plug timestamp after task switch
99e6c712cc300 kernel/fork: clear PF_BLOCK_TS in copy_process()
0d35f9f194a85 fbdev: fix use-after-free in store_modes()
81371dbd23601 NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR
c3ca2631073b2 apparmor: fix use-after-free in rawdata dedup loop
4a69b83045d31 apparmor: mediate the implicit connect of TCP fast open sendmsg
1697957eb0971 net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink
1acdd14c0990d net: skmsg: preserve sg.copy across SG transforms
bd968bdd568be mac802154: llsec: add skb_cow_data() before in-place crypto
0cfa78c050662 af_unix: Set gc_in_progress to true in unix_gc().
3c499851753a2 wifi: mt76: add wcid publish check in mt76_sta_add
5e658b9245a52 ntfs3: reject direct userspace writes to reserved $LX* xattrs
77798d7be6ef7 ipv4: account for fraggap on the paged allocation path
6374fb9edf72c ipv6: account for fraggap on the paged allocation path
565ab66005b14 batman-adv: tvlv: avoid race of cifsnotfound handler state
4cc9f7711bb89 batman-adv: tvlv: enforce 2-byte alignment
04e1a6557fbf8 batman-adv: dat: prevent false sharing between VLANs
3f82fc92cf523 batman-adv: tt: track roam count per VID
3470d583fc652 batman-adv: tt: don't merge change entries with different VIDs
af5a069805f67 batman-adv: tp_meter: handle overlapping packets
d511c72a83dd5 batman-adv: tp_meter: prevent parallel modifications of last_recv
1dafdd0794be1 batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE
2233787658db8 batman-adv: tp_meter: restrict number of unacked list entries
3d4548c96d6f2 batman-adv: v: prevent OGM aggregation on disabled hardif
44ae137a2acef batman-adv: frag: avoid underflow of TTL
116e94025f0f4 batman-adv: frag: ensure fragment is writable before modifying TTL
0473ae882624a batman-adv: fix (m|b)cast csum after decrementing TTL
49bf27fcd7ee4 batman-adv: ensure bcast is writable before modifying TTL
646b68639c06b batman-adv: gw: don't deselect gateway with active hardif
95a061f587b76 batman-adv: tp_meter: initialize last_recv_time during init
75612c100a9e2 batman-adv: prevent ELP transmission interval underflow
43733e5b525fb batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE
23d085bd63086 batman-adv: tp_meter: add only finished tp_vars to lists
b8bf8400e50cb batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection
1db02f3e315da batman-adv: tp_meter: fix fast recovery precondition
7d2a44bc6bbe3 batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd
8e77fe0414f5c batman-adv: tp_meter: avoid window underflow
7cb88d91d5f9f batman-adv: tp_meter: initialize dec_cwnd explicitly
696c4cae872cc batman-adv: tp_meter: initialize dup_acks explicitly
1c5a1268418e8 batman-adv: tp_meter: keep unacked list in ascending ordered
e055e74b80eb8 lockd: fix TEST handling when not all permissions are available.
671ec2eabb874 Revert "PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion support"
d844702198395 selinux: fix overlayfs mmap() and mprotect() access checks
5dfcb15974e7d lsm: add backing_file LSM hooks
5e470998a23e4 KVM: x86: Fix shadow paging use-after-free due to unexpected role
0c503cf3dde2e Linux 6.18.37
71003a32bef54 mm: do not copy page tables unnecessarily for VM_UFFD_WP
2abfd3ffbd945 virtiofs: fix UAF on submount umount
f965cf22dda7f media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
7cad3ceaf679c ksmbd: reject non-VALID session in compound request branch
6c25bf4e44a2b drivers/base/memory: set mem->altmap after successful device registration
50b72074c5e8d serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero
7cc3dd79777f6 vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
b8ebf008696de crypto: qat - remove unused character device and IOCTLs
d08d82d83ed45 iio: adc: ti-ads1298: add bounds check to pga_settings index
0a89002737ee3 iio: light: veml6075: add bounds check to veml6075_it_ms index
76db054931846 net: net_failover: Fix the deadlock in slave register
c5b3871b567c2 net: export netif_open for self_test usage
cc1494fd6c65d testing/selftests/mm: add soft-dirty merge self-test
f563ce913a831 mm: propagate VM_SOFTDIRTY on merge
b836839c1fd94 mm: set the VM_MAYBE_GUARD flag on guard region install
3d6cb2ed06f7f mm: introduce copy-on-fork VMAs and make VM_MAYBE_GUARD one
05cdec24a8589 mm: implement sticky VMA flags
a093c80a1f139 mm: update vma_modify_flags() to handle residual flags, document
bdeadba743375 mm: add atomic VMA flags and set VM_MAYBE_GUARD as such
efce8a486bffc mm: introduce VM_MAYBE_GUARD and make visible in /proc/$pid/smaps
0de7db2eb27e8 sctp: disable BH before calling udp_tunnel_xmit_skb()
eee6be6ab6375 firmware: samsung: acpm: Fix cross-thread RX length corruption
02ac3ba41628a Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs
072bbd2846d1b hv: utils: handle and propagate errors in kvp_register
bde74af8d4466 regulator: core: fix locking in regulator_resolve_supply() error path
9477cbc5107a8 rose: don't free fd-owned sockets when reaping in the heartbeat
395b6573b389f rose: clear neighbour pointer in rose_kill_by_device()
9e8fc2195f8b5 rose: cancel neighbour timers in rose_neigh_put() before freeing
c31a0fa15a4b4 rose: drop CALL_REQUEST in loopback timer when device is not running
74cbe94c913a4 rose: release netdev ref and destroy orphaned incoming sockets
c794d35f73a7b rose: fix netdev double-hold in rose_make_new()
ce27bcdd857a9 rose: disconnect orphaned STATE_2 sockets when device is gone
ab849a6972c99 rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup
c98cc00c2d3b1 rose: fix notifier unregistered too early in rose_exit()
19139026dc1c0 rose: fix netdev double-hold in rose_rx_call_request()
1d94857c11d60 rose: guard rose_neigh_put() against NULL in timer expiry
270ef709257eb rose: clear neighbour pointer after rose_neigh_put() in state machines
940f39e153323 rose: fix race between loopback timer and module removal
fe8cbcc3e79d4 rose: hold loopback neighbour reference across timer callback
7dac298524b41 rose: fix dev_put() leak in rose_loopback_timer()
19b3691ec9402 ACPI: scan: Use async schedule function in acpi_scan_clear_dep_fn()
53483a9f4ee9e agp/amd64: Fix broken error propagation in agp_amd64_probe()
8b17adf6d4fb6 net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()
5f4d2bd028ebb i2c: stub: Reject I2C block transfers with invalid length
e2b143df29003 RDMA/bnxt_re: zero shared page before exposing to userspace
44b8b03a9fb5c debugobjects: Dont call fill_pool() in early boot hardirq context
3a408cae608d9 debugobjects: Do not fill_pool() if pi_blocked_on
9cd2087cd7026 debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP
a460935022f51 debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING
95f9eb19d5e65 Revert "NFSD: Defer sub-object cleanup in export put callbacks"
af2892249d982 fuse: re-lock request before replacing page cache folio
29706ac73f93b net: stmmac: fix stm32 (and potentially others) resume regression
b6099150949f8 io_uring/net: Avoid msghdr on op_connect/op_bind async data
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
---
meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.18.bbappend | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.18.bbappend b/meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.18.bbappend
index c012ad3..d8790f3 100644
--- a/meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.18.bbappend
+++ b/meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.18.bbappend
@@ -8,4 +8,4 @@ KMACHINE:genericx86 ?= "common-pc"
KMACHINE:genericx86-64 ?= "common-pc-64"
KBRANCH:genericarm64 ?= "v6.18/standard/genericarm64"
-SRCREV_machine:genericarm64 ?= "c02123f16c412c8b8629ff2a9f06e9feca9077d6"
+SRCREV_machine:genericarm64 ?= "daaaf767b0cba42bcd9ba3f5b5f6b42b5e695a3f"
--
2.43.0
^ permalink raw reply related
* [meta-yocto-bsp][PATCH 04/06] yocto-bsps: update to v6.18.36
From: bruce.ashfield @ 2026-07-20 15:58 UTC (permalink / raw)
To: richard.purdie; +Cc: openembedded-core
In-Reply-To: <20260720155842.569263-1-bruce.ashfield@gmail.com>
From: Bruce Ashfield <bruce.ashfield@gmail.com>
Updating linux-yocto/6.18 to the latest korg -stable release that comprises
the following commits:
275d294b2b24 Linux 6.18.36
5d634afb8b83 netfilter: require Ethernet MAC header before using eth_hdr()
bf7a9cacd95e cfi: Include uaccess.h for get_kernel_nofault()
f455405e3207 vsock/virtio: fix skb overhead overflow on 32-bit builds
36a0faaa4e3d block: fix handling of dead zone write plugs
7b569b3a2f29 arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU
99abe00c605e arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU
d4fd42822040 arm64: errata: Mitigate TLBI errata on various Arm CPUs
8097f93f9b77 arm64: cputype: Add C1-Premium definitions
e9ea7cb17677 arm64: cputype: Add C1-Ultra definitions
eca6743b148a vsock/virtio: fix skb overhead accounting to preserve full buf_alloc
9bdc637fde66 vsock/virtio: fix potential unbounded skb queue
cdce1e797add ipvs: skip ipv6 extension headers for csum checks
afd35fec9297 RDMA/umem: Fix truncation for block sizes >= 4G
cd26d54bfbc2 RDMA: Move DMA block iterator logic into dedicated files
ebf22feff492 RDMA/umem: fix kernel-doc warnings
84d8f58cf28a netfilter: nft_fib: fix stale stack leak via the OIFNAME register
2904e985a291 RDMA: During rereg_mr ensure that REREG_ACCESS is compatible
f58efaf9fcf7 RDMA/umem: Add helpers for umem dmabuf revoke lock
5f3286ca5fbb RDMA/umem: Move umem dmabuf revoke logic into helper function
ceddd32231dd RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper
0ffcad63b19a sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task()
37c059d4d92f wifi: mac80211: tests: mark HT check strict
4dac39a4db14 wifi: mac80211: skip ieee80211_verify_sta_ht_mcs_support check in non-strict mode
17faa39ba980 driver core: reject devices with unregistered buses
20a93e397abe fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling
e09689286385 drm/amd/display: Use krealloc_array() in dal_vector_reserve()
454d3b3d499c drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()
bb6f705b73b5 drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs
c000da79df78 drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs
3f32d52ec604 drm/amd/display: Clamp VBIOS HDMI retimer register count to array size
1906064d50d1 drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size
0e56f460bddb drm/amd/display: Bound VBIOS record-chain walk loops
57607fe55e6d drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in set_soft_freq_limited_range
932642791cb1 drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2
8979ded4d899 drm/amd/pm: fix smu13 power limit default/cap calculation
39b5397bf8de drm/amdgpu: set noretry=1 as default for GFX 10.1.x (Navi10/12/14)
fcd51a085e9a drm/amdgpu: restart the CS if some parts of the VM are still invalidated
68455b117258 drm/amdgpu: fix waiting for all submissions for userptrs
9655b56b6de9 drm/v3d: Skip CSD when it has zeroed workgroups
90b629269088 drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups
3e1947573140 drm/v3d: Fix global performance monitor reference counting
11e9bdf8824b drm/v3d: Wait for pending L2T flush before cleaning caches
4c10fd55187a drm/xe: Clear pending_disable before signaling suspend fence
0f68ddfaaebf drm/xe/display: fix oops in suspend/shutdown without display
d3efcadfe3ee drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11
72e259a32084 drm/amdkfd: fix NULL dereference in get_queue_ids()
c0639ede2f24 drm/gem: Try to fix change_handle ioctl, attempt 4
9f0d45d509b4 slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock
8f4b371f4939 slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD
5204cd22c1c7 slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership
dd8e1025a84e slimbus: qcom-ngd-ctrl: Initialize controller resources in controller
24ec89123fc9 slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd
3bb2ac834ed3 slimbus: qcom-ngd-ctrl: Fix probe error path ordering
d6cb003e4661 slimbus: qcom-ngd-ctrl: Fix up platform_driver registration
6890bd2451a9 slimbus: qcom-ngd-ctrl: fix OF node refcount
b5daa920f44c thunderbolt: Limit XDomain response copy to actual frame size
46da5c3ea011 thunderbolt: Validate XDomain request packet size before type cast
fcbd0cdab928 thunderbolt: Clamp XDomain response data copy to allocation size
60ba62174607 thunderbolt: Bound root directory content to block size
2e0ddac549eb thunderbolt: Reject zero-length property entries in validator
d5ea0b3e261f sctp: stream: fully roll back denied add-stream state
78c4f964b2f9 sctp: diag: reject stale associations in dump_one path
566c4c1244de rxrpc: Fix the ACK parser to extract the SACK table for parsing
1bf84f4013fa rtase: Reset TX subqueue when clearing TX ring
54f9cdcd7311 rtase: Avoid sleeping in get_stats64()
ddcf84b25af0 pmdomain: ti_sci: add wakeup constraint to parent devices of wakeup source
0d11992d1898 pmdomain: imx: fix OF node refcount
0aecf3c7b8f8 mmc: sdhci: add signal voltage switch in sdhci_resume_host
535ff092b686 mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC
2f72d36f8acc mmc: litex_mmc: Set mandatory idle clocks before CMD0
7f8007be13e6 mmc: dw_mmc-rockchip: Add missing private data for very old controllers
c677b13671dc mmc: core: Fix host controller programming for fixed driver type
a8f91ddf67f6 mm/mincore: handle non-swap entries before !CONFIG_SWAP guard
c19ff4351214 mm/list_lru: drain before clearing xarray entry on reparent
c72469ac0f27 mm/hugetlb: restore reservation on error in hugetlb folio copy paths
ecc24f0a8a30 mm/hugetlb: avoid false positive lockdep assertion
66bc00ea37fa mm/damon/reclaim: handle ctx allocation failure
6d48f1565939 mm/damon/lru_sort: handle ctx allocation failure
d83390b21a02 mm/cma_debug: fix invalid accesses for inactive CMA areas
52078596dce1 mm/cma: fix reserved page leak on activation failure
d5d37b7b72a9 io_uring/wait: fix min_timeout behavior
c888d5198ffc io_uring/kbuf: don't truncate end buffer for bundles
3fdcca838f97 pinctrl: mcp23s08: Read spi-present-mask as u8 not u32
e646b86b3b48 octeontx2-af: fix memory leak in rvu_setup_hw_resources()
4a4d21f531cc nvmem: layouts: onie-tlv: fix hang on unknown types
cb85ef5a227b nvmem: core: fix use-after-free bugs in error paths
bef389a210e7 net: sfp: initialize i2c_block_size at adapter configure time
1d4ec754ee38 net: rds: clear i_sends on setup unwind
52b8f5ef82c8 net: phonet: free phonet_device after RCU grace period
4a73cacb5586 net: mv643xx: fix OF node refcount
bcb8fad90f27 net: bonding: fix NULL pointer dereference in bond_do_ioctl()
01f7d4b50458 net: airoha: Add NULL check for of_reserved_mem_lookup() in airoha_qdma_init_hfwd_queues()
e0df4d9c0909 net/mlx5: Reorder completion before putting command entry in cmd_work_handler
0a46c7a5646d firmware: samsung: acpm: Fix mailbox channel leak on probe error
d5de9cb5355d misc: fastrpc: Fix NULL pointer dereference in rpmsg callback
53e06f8a3c2b misc: fastrpc: fix DMA address corruption due to find_vma misuse
992f121796b7 misc: fastrpc: fix use-after-free race in fastrpc_map_create
5278ccd357e0 misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context
89bd8215e25a memcg: use round-robin victim selection in refill_stock
a388e3dfaf95 locking/rtmutex: Skip remove_waiter() when waiter is not enqueued
db752ebfdaf2 ipc/shm: serialize orphan cleanup with shm_nattch updates
ab61c990a87d iommu/dma: Do not try to iommu_map a 0 length region in swiotlb
f35a368fee8a Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard
a3dff1e1a554 Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)
7f59e4f72a78 i2c: tegra: Fix NOIRQ suspend/resume
6018d73137cd i2c: stm32f7: fix timing computation ignoring i2c-analog-filter
a162a260c8c4 i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()
9fa82cf393ba i2c: imx: fix clock and pinctrl state inconsistency in runtime PM
b39f30c0a72f i2c: imx-lpi2c: fix resource leaks switching to devm_dma_request_chan()
16f8e17184b3 futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock
56763afa0134 fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios
12df4cfa738a fuse: reject fuse_notify() pagecache ops on directories
57a9c085be07 fs/qnx6: fix pointer arithmetic in directory iteration
2990f143ec86 pidfd: refuse access to tasks that have started exiting harder
89b909e97045 inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush
df422fd273c9 IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
32138633e51e fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()
3884976f8744 bnxt_en: Fix NULL pointer dereference
6f72b902c34d ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write
735dabdf2156 staging: rtl8723bs: fix buffer over-read in rtw_update_protection
1d6c2062b77b timers/migration: Fix livelock in tmigr_handle_remote_up()
ba9ad6015937 vsock/vmci: fix sk_ack_backlog leak on failed handshake
265c07c09c83 wifi: nl80211: reject oversized EMA RNR lists
ac2000be0cbe wifi: iwlwifi: pcie: simplify the resume flow if fast resume is not used
fcfdff42e841 xfs: fix rtgroup cleanup in CoW fork repair
d84ed2f9718e xfs: fix error returns in CoW fork repair
9f21885c11ba mptcp: add-addr: always drop other suboptions
6ea1134f1b5f selftests: mptcp: add test for extra_subflows underflow on userspace PM
7bbc11437a20 mptcp: sockopt: set sockopt on all subflows
f591cbc088c9 mptcp: sockopt: check timestamping ret value
c0c152fc4ae6 mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation
653245266913 mptcp: allow subflow rcv wnd to shrink
3b8cbba7c0ed mptcp: close TOCTOU race while computing rcv_wnd
edaf0c955ace mptcp: fix retransmission loop when csum is enabled
95f27fcda681 arm64: mm: call pagetable dtor when freeing hot-removed page tables
517720913bd3 ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow
da295adc9dab ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O
6243a363ec90 ARM: socfpga: Fix OF node refcount leak in SMP setup
6822eed69572 udp: clear skb->dev before running a sockmap verdict
c96786d6ff1a zram: fix use-after-free in zram_bvec_write_partial()
f92a285db7ff RDMA/srp: bound SRP_RSP sense copy by the received length
bd5e818be796 RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc
96b6e98ff12d RDMA/core: Validate the passed in fops for ib_get_ucaps()
e99807bdcd20 mm/huge_memory: update file PUD counter before folio_put()
cb5230b6d8a0 mm/damon/ops-common: call folio_test_lru() after folio_get()
5f5b604e1e6b mm/huge_memory: update file PMD counter before folio_put()
edabfe80e34e drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info()
8348567a6afb drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait()
0bbc9481f970 io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries
3d39da65b5c4 ALSA: timer: Fix UAF at snd_timer_user_params()
f46093dd2296 ALSA: timer: Forcibly close timer instances at closing
372f33ebed74 USB: serial: kl5kusb105: fix bulk-out buffer overflow
85bd2b3afa0a USB: serial: option: add usb-id for Dell Wireless DW5826e-m
294692d3296e USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()
f96cf7bf9fbf USB: serial: io_ti: fix heap overflow in get_manuf_info()
a13ca53e47e5 xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()
dd66f7f6e360 xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()
f9b38a8fbfa0 xfrm: espintcp: do not reuse an in-progress partial send
14d2eee0193a ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL
0b38870d81ab hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf
32d4c5d328a3 drm/i915/gem: Fix phys BO pread/pwrite with offset
0b79bcff7210 KVM: arm64: Restore POR_EL0 access to host EL0
196f1ee137eb KVM: SEV: Decouple the need to sync the GHCB SA from the need to free the SA
343e95c8ecc4 KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying
0864bdde152e mshv: add a missing padding field
8bcbedce9bfa mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation
a0a4600b396b rust: kasan/kbuild: fix rustc-option when cross-compiling
d0f25a1755f2 rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES
5037b2ee1a17 ARM: Do not select HAVE_RUST when KASAN is enabled
00875811f372 rust: x86: support Rust >= 1.98.0 target spec
592be0dc491d tracing/probes: Point the error offset correctly for eprobe argument error
09df291fdf96 tracing: Fix CFI violation in probestub being called by tprobes
45cb105b8642 accel/ivpu: Fix signed integer truncation in IPC receive
fa598556ecef accel/ivpu: Add buffer overflow check in MS get_info_ioctl
8ec70c0dbdf0 accel/ivpu: Add bounds checks for firmware log indices
dd77a83915b0 mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison
cc160ce08540 soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get()
dedc92b96dc1 Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig
dafc9f57140e Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend
c10c9c48b290 tee: shm: fix shm leak in register_shm_helper()
07acb9798477 netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register
941d7394efda netfilter: nft_tunnel: fix use-after-free on object destroy
e83fc4c28226 accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()
361e97d81331 drm/xe: fix refcount leak in xe_range_fence_insert()
02f5e4db57c0 drm/vc4: fix krealloc() memory leak
19a6a00ff50c drm/virtio: Fix driver removal with disabled KMS
dda720b2928d drm/i915/edp: Check supported link rates DPCD read
489f6d759fa4 clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time
3a4fc3617b7e clk: samsung: gs101: Fix missing USI7_USI DIV clock in peric0_clk_regs
656939c67595 clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from getting parked
f34689e7a0b3 KVM: VMX: Update SVI during runtime APICv activation
07d9a0870a17 ipv6: Fix a potential NPD in cleanup_prefix_route()
2c98343c9b23 net: txgbe: initialize module info buffer
19a4d2aace1d net: txgbe: rename the SFP related
9157060fed92 net: txgbe: support CR modules for AML devices
7649ba2b1291 net: txgbe: optimize the flow to setup PHY for AML devices
af08fe9ba091 net: mvpp2: build skb from XDP-adjusted data on XDP_PASS
8a2126c5afe8 net: mvpp2: refill RX buffers before XDP or skb use
910617a4e67d net: mvpp2: limit XDP frame size to the RX buffer
a13199fa224e net: mvpp2: sync RX data at the hardware packet offset
78069a6d8bc8 netfilter: nft_exthdr: fix register tracking for F_PRESENT flag
af1b7699466f netfilter: nf_log: validate MAC header was set before dumping it
08a3e218064d netfilter: x_tables: avoid leaking percpu counter pointers
9d017671dcfc netfilter: nf_conntrack: destroy stale expectfn expectations on unregister
4beffcd726e2 netfilter: revalidate bridge ports
865e94f6d8a5 spi: rzv2h-rspi: Fix SPDR read access width for 16-bit RX
5ae8a38169fc rds: mark snapshot pages dirty in rds_info_getsockopt()
2abfb19bbb81 ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
5fd1fa5a4254 tun: zero the whole vnet header in tun_put_user()
dcf458120add net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion
3dde4fb941fa net: guard timestamp cmsgs to real error queue skbs
7560afb8cdda sctp: validate embedded INIT chunk and address list lengths in cookie
ecf8904067dc ip6_vti: set netns_immutable on the fallback device.
f76a8b323e28 sctp: fix uninit-value in __sctp_rcv_asconf_lookup()
d23d53355300 ASoC: SOF: amd: fix for ipc flags check
6c75ee4d1d40 net: mctp: usb: don't fail mctp_usb_rx_queue on a deferred submission
9c46f3ee1837 net: mctp: usb: fix race between urb completion and rx_retry cancellation
bace7b99bfa5 gpio: rockchip: fix generic IRQ chip leak on remove
5d4bca5cbb69 gpio: zynq: fix runtime PM leak on remove
c838ffc154cb r8152: handle the return value of usb_reset_device()
ecc55aad3390 net: openvswitch: fix possible kfree_skb of ERR_PTR
2fa49b2715e1 ipv6: sit: reload inner IPv6 header after GSO offloads
289c06418ed9 net/mlx5: Use effective affinity mask for IRQ selection
2789b74ae1f4 net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure
0f807764bb12 net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list
ab269990ed58 net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove
3a254779c169 net: phy: clean the sfp upstream if phy probing fails
c299321bc623 netdev: fix double-free in netdev_nl_bind_rx_doit()
c09c2e236eef net: ibm: emac: Fix use-after-free during device removal
8b0541231091 net/mlx4: avoid GCC 10 __bad_copy_from() false positive
0cde3a004119 net: add pskb_may_pull() to skb_gro_receive_list()
ede69b8f6670 tcp: restrict SO_ATTACH_FILTER to priv users
12e579b88962 ASoC: wm_adsp: Fix NULL dereference when removing firmware controls
6136c1474db8 gpio: mvebu: fix NULL pointer dereference in suspend/resume
0c4bb32ad7fd netlabel: validate unlabeled address and mask attribute lengths
972c106f5d01 bnge: fix context mem iteration
6b8baf42b1b7 net: ena: PHC: Add missing barrier
640edc281d2f idpf: fix mailbox capability for set device clock time
6bdbe6f43ecf ice: fix missing priority callbacks for U.FL DPLL pins
b5316e2b8614 xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()
5513dcb378f9 dma-debug: fix physical address retrieval in debug_dma_sync_sg_for_device
4ee4d628c4d9 dma-mapping: direct: fix missing mapping for THRU_HOST_BRIDGE segments
8d9a79fbf517 xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload
e27c17346628 tap: free page on error paths in tap_get_user_xdp()
0c03692e2372 verification/rvgen: Fix ltl2k writing True as a literal
43ad0a0da486 verification/rvgen: Fix options shared among commands
73590b4cfd05 tools/rv: Fix cleanup after failed trace setup
fd1923910bbf tools/rv: Fix substring match when listing container monitors
2122d68f0864 tools/rv: Fix substring match bug in monitor name search
618193aba6fe tools/rv: Ensure monitor name and desc are NUL-terminated
65046b0d853d cpufreq/amd-pstate: drop stale @epp_cached kdoc
63a9f6012f45 spi: cadence-quadspi: fix unclocked access on unbind
6671a46144f8 ALSA: seq: dummy: fix UMP event stack overread
cd98837db15f ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams
6b71956c25f9 time: Fix off-by-one in settimeofday() usec validation
ed0ad6574126 hyperv: Clean up and fix the guest ID comment in hvgdk.h
8c046f36222c signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()
6dc6e5b5c32e selftests: harness: fix pidfd leak in __wait_for_test
752e22ecf4df drm/hyperv: During panic do VMBus unload after frame buffer is flushed
b0f77f76231b Drivers: hv: vmbus: Provide option to skip VMBus unload on panic
1639df1a9844 Drivers: hv: VMBus protocol version 6.0
a6207349e703 sctp: purge outqueue on stale COOKIE-ECHO handling
42446ca0f357 net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr
285b0842f2e0 ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()
3b7ee029b556 vxlan: vnifilter: fix spurious notification on VNI update
8e4d1188bad7 vxlan: vnifilter: send notification on VNI add
eb676fb14427 octeontx2-af: npc: Fix CPT channel mask in npc_install_flow
cc272185c9a9 sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing
b198ed4e5258 net/sched: fix pedit partial COW leading to page cache corruption
e634408d2b0c net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown
6f829e2c17a5 net: airoha: Fix use-after-free in metadata dst teardown
9a263bbd1ec0 ptp: vclock: Switch from RCU to SRCU
a4f3fd651692 ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options
91106d0348a5 af_unix: Fix inq_len update problem in partial read
f010cf9aea01 octeontx2-af: Fix initialization of mcam's entry2target_pffunc field
ddf930f28be6 octeontx2-pf: Fix NDC sync operation errors
0dfe05b93843 xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata()
58d810354de1 Bluetooth: MGMT: Fix backward compatibility with userspace
446a17b1b509 Bluetooth: SCO: Fix data-race on sco_pi fields in sco_connect
ab84fd7779a2 Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls
33d677d2e371 Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync
ce4b4cac3c57 Bluetooth: fix memory leak in error path of hci_alloc_dev()
c893e17d2809 Bluetooth: bnep: reject short frames before parsing
7f5367f1ad9b Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling
3eabc6d47a0a Bluetooth: RFCOMM: validate skb length in MCC handlers
1a3c8ffbb469 Bluetooth: MGMT: validate advertising TLV before type checks
8802413ce631 Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()
fb8db813eba2 wifi: fix leak if split 6 GHz scanning fails
15be7e9fdbff ipv6: anycast: insert aca into global hash under idev->lock
23bf7d5c250b net: fec: fix pinctrl default state restore order on resume
76244b33640b net: lan743x: permit VLAN-tagged packets up to configured MTU
04e22fefac1a net: garp: fix unsigned integer underflow in garp_pdu_parse_attr
66a46e22396f hsr: Remove WARN_ONCE() in hsr_addr_is_self().
07f13816be5a net: Annotate sk->sk_write_space() for UDP SOCKMAP.
83810d51d699 pcnet32: stop holding device spin lock during napi_complete_done
9b40c59bab08 wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap
e3f6ba5f8cf3 drm/imx: Fix three kernel-doc warnings in dcss-scaler.c
927f96861f93 devlink: Release nested relation on devlink free
e251d4cdfc72 l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()
c32f30ef5e66 6lowpan: fix off-by-one in multicast context address compression
b60e9391142e net/sched: act_api: use RCU with deferred freeing for action lifecycle
42ff6774ecd9 dm cache policy smq: check allocation under invalidate lock
b18675263db1 netfilter: bridge: make ebt_snat ARP rewrite writable
f071b0bf0781 netfilter: nft_ct: bail out on template ct in get eval
9e5da2379f96 netfilter: conntrack_irc: fix possible out-of-bounds read
aaf80701dc2f netfilter: synproxy: add mutex to guard hook reference counting
25918720ba97 ipvs: clear the svc scheduler ptr early on edit
cdaf13260c99 netfilter: xt_NFQUEUE: prefer raw_smp_processor_id
e735dbd489e3 ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers
9dca67624721 wifi: iwlwifi: mvm: don't support the reset handshake for old firmwares
00bf6868df65 erofs: fix use-after-free on sbi->sync_decompress
50fd261b1ec4 erofs: tidy up synchronous decompression
8db2fabb5ecd tee: qcomtee: add missing va_end in early return qcomtee_object_user_init()
ac7eca1ae4e5 tee: fix tee_ioctl_object_invoke_arg padding
633db9a1991a soc: qcom: ice: Return -ENODEV if the ICE platform device is not found
40fc6ed12f91 ARM: dts: microchip: sam9x7: fix GMAC clock configuration
9cb93ec617fb arm64: dts: qcom: x1-dell-thena: remove i2c20 (battery SMBus) and reserve its pins
a171bc68e9af soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE
d5b57bb314d7 tee: optee: prevent use-after-free when the client exits before the supplicant
dcd90f42a33e net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS
4203806f700b ipv6: mcast: Fix use-after-free when processing MLD queries
ffbcf31f032e i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl
97706097f9b8 KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation
9e767af5f109 ARM: fix branch predictor hardening
05e22564a4f9 ARM: fix hash_name() fault
8bdb574b2176 ARM: allow __do_kernel_fault() to report execution of memory faults
22e26df355af ARM: group is_permission_fault() with is_translation_fault()
87dfb977bdb6 bpf: Free reuseport cBPF prog after RCU grace period.
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
---
meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.18.bbappend | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.18.bbappend b/meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.18.bbappend
index 7505946..c012ad3 100644
--- a/meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.18.bbappend
+++ b/meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.18.bbappend
@@ -8,4 +8,4 @@ KMACHINE:genericx86 ?= "common-pc"
KMACHINE:genericx86-64 ?= "common-pc-64"
KBRANCH:genericarm64 ?= "v6.18/standard/genericarm64"
-SRCREV_machine:genericarm64 ?= "d6f3a955dcf77a71454a2d70f291bd39d06422ff"
+SRCREV_machine:genericarm64 ?= "c02123f16c412c8b8629ff2a9f06e9feca9077d6"
--
2.43.0
^ permalink raw reply related
* [meta][PATCH 01/06] linux-yocto/6.18: update to v6.18.36
From: bruce.ashfield @ 2026-07-20 15:58 UTC (permalink / raw)
To: richard.purdie; +Cc: openembedded-core
In-Reply-To: <20260720155842.569263-1-bruce.ashfield@gmail.com>
From: Bruce Ashfield <bruce.ashfield@gmail.com>
Updating linux-yocto/6.18 to the latest korg -stable release that comprises
the following commits:
275d294b2b24 Linux 6.18.36
5d634afb8b83 netfilter: require Ethernet MAC header before using eth_hdr()
bf7a9cacd95e cfi: Include uaccess.h for get_kernel_nofault()
f455405e3207 vsock/virtio: fix skb overhead overflow on 32-bit builds
36a0faaa4e3d block: fix handling of dead zone write plugs
7b569b3a2f29 arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU
99abe00c605e arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU
d4fd42822040 arm64: errata: Mitigate TLBI errata on various Arm CPUs
8097f93f9b77 arm64: cputype: Add C1-Premium definitions
e9ea7cb17677 arm64: cputype: Add C1-Ultra definitions
eca6743b148a vsock/virtio: fix skb overhead accounting to preserve full buf_alloc
9bdc637fde66 vsock/virtio: fix potential unbounded skb queue
cdce1e797add ipvs: skip ipv6 extension headers for csum checks
afd35fec9297 RDMA/umem: Fix truncation for block sizes >= 4G
cd26d54bfbc2 RDMA: Move DMA block iterator logic into dedicated files
ebf22feff492 RDMA/umem: fix kernel-doc warnings
84d8f58cf28a netfilter: nft_fib: fix stale stack leak via the OIFNAME register
2904e985a291 RDMA: During rereg_mr ensure that REREG_ACCESS is compatible
f58efaf9fcf7 RDMA/umem: Add helpers for umem dmabuf revoke lock
5f3286ca5fbb RDMA/umem: Move umem dmabuf revoke logic into helper function
ceddd32231dd RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper
0ffcad63b19a sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task()
37c059d4d92f wifi: mac80211: tests: mark HT check strict
4dac39a4db14 wifi: mac80211: skip ieee80211_verify_sta_ht_mcs_support check in non-strict mode
17faa39ba980 driver core: reject devices with unregistered buses
20a93e397abe fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling
e09689286385 drm/amd/display: Use krealloc_array() in dal_vector_reserve()
454d3b3d499c drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()
bb6f705b73b5 drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs
c000da79df78 drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs
3f32d52ec604 drm/amd/display: Clamp VBIOS HDMI retimer register count to array size
1906064d50d1 drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size
0e56f460bddb drm/amd/display: Bound VBIOS record-chain walk loops
57607fe55e6d drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in set_soft_freq_limited_range
932642791cb1 drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2
8979ded4d899 drm/amd/pm: fix smu13 power limit default/cap calculation
39b5397bf8de drm/amdgpu: set noretry=1 as default for GFX 10.1.x (Navi10/12/14)
fcd51a085e9a drm/amdgpu: restart the CS if some parts of the VM are still invalidated
68455b117258 drm/amdgpu: fix waiting for all submissions for userptrs
9655b56b6de9 drm/v3d: Skip CSD when it has zeroed workgroups
90b629269088 drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups
3e1947573140 drm/v3d: Fix global performance monitor reference counting
11e9bdf8824b drm/v3d: Wait for pending L2T flush before cleaning caches
4c10fd55187a drm/xe: Clear pending_disable before signaling suspend fence
0f68ddfaaebf drm/xe/display: fix oops in suspend/shutdown without display
d3efcadfe3ee drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11
72e259a32084 drm/amdkfd: fix NULL dereference in get_queue_ids()
c0639ede2f24 drm/gem: Try to fix change_handle ioctl, attempt 4
9f0d45d509b4 slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock
8f4b371f4939 slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD
5204cd22c1c7 slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership
dd8e1025a84e slimbus: qcom-ngd-ctrl: Initialize controller resources in controller
24ec89123fc9 slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd
3bb2ac834ed3 slimbus: qcom-ngd-ctrl: Fix probe error path ordering
d6cb003e4661 slimbus: qcom-ngd-ctrl: Fix up platform_driver registration
6890bd2451a9 slimbus: qcom-ngd-ctrl: fix OF node refcount
b5daa920f44c thunderbolt: Limit XDomain response copy to actual frame size
46da5c3ea011 thunderbolt: Validate XDomain request packet size before type cast
fcbd0cdab928 thunderbolt: Clamp XDomain response data copy to allocation size
60ba62174607 thunderbolt: Bound root directory content to block size
2e0ddac549eb thunderbolt: Reject zero-length property entries in validator
d5ea0b3e261f sctp: stream: fully roll back denied add-stream state
78c4f964b2f9 sctp: diag: reject stale associations in dump_one path
566c4c1244de rxrpc: Fix the ACK parser to extract the SACK table for parsing
1bf84f4013fa rtase: Reset TX subqueue when clearing TX ring
54f9cdcd7311 rtase: Avoid sleeping in get_stats64()
ddcf84b25af0 pmdomain: ti_sci: add wakeup constraint to parent devices of wakeup source
0d11992d1898 pmdomain: imx: fix OF node refcount
0aecf3c7b8f8 mmc: sdhci: add signal voltage switch in sdhci_resume_host
535ff092b686 mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC
2f72d36f8acc mmc: litex_mmc: Set mandatory idle clocks before CMD0
7f8007be13e6 mmc: dw_mmc-rockchip: Add missing private data for very old controllers
c677b13671dc mmc: core: Fix host controller programming for fixed driver type
a8f91ddf67f6 mm/mincore: handle non-swap entries before !CONFIG_SWAP guard
c19ff4351214 mm/list_lru: drain before clearing xarray entry on reparent
c72469ac0f27 mm/hugetlb: restore reservation on error in hugetlb folio copy paths
ecc24f0a8a30 mm/hugetlb: avoid false positive lockdep assertion
66bc00ea37fa mm/damon/reclaim: handle ctx allocation failure
6d48f1565939 mm/damon/lru_sort: handle ctx allocation failure
d83390b21a02 mm/cma_debug: fix invalid accesses for inactive CMA areas
52078596dce1 mm/cma: fix reserved page leak on activation failure
d5d37b7b72a9 io_uring/wait: fix min_timeout behavior
c888d5198ffc io_uring/kbuf: don't truncate end buffer for bundles
3fdcca838f97 pinctrl: mcp23s08: Read spi-present-mask as u8 not u32
e646b86b3b48 octeontx2-af: fix memory leak in rvu_setup_hw_resources()
4a4d21f531cc nvmem: layouts: onie-tlv: fix hang on unknown types
cb85ef5a227b nvmem: core: fix use-after-free bugs in error paths
bef389a210e7 net: sfp: initialize i2c_block_size at adapter configure time
1d4ec754ee38 net: rds: clear i_sends on setup unwind
52b8f5ef82c8 net: phonet: free phonet_device after RCU grace period
4a73cacb5586 net: mv643xx: fix OF node refcount
bcb8fad90f27 net: bonding: fix NULL pointer dereference in bond_do_ioctl()
01f7d4b50458 net: airoha: Add NULL check for of_reserved_mem_lookup() in airoha_qdma_init_hfwd_queues()
e0df4d9c0909 net/mlx5: Reorder completion before putting command entry in cmd_work_handler
0a46c7a5646d firmware: samsung: acpm: Fix mailbox channel leak on probe error
d5de9cb5355d misc: fastrpc: Fix NULL pointer dereference in rpmsg callback
53e06f8a3c2b misc: fastrpc: fix DMA address corruption due to find_vma misuse
992f121796b7 misc: fastrpc: fix use-after-free race in fastrpc_map_create
5278ccd357e0 misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context
89bd8215e25a memcg: use round-robin victim selection in refill_stock
a388e3dfaf95 locking/rtmutex: Skip remove_waiter() when waiter is not enqueued
db752ebfdaf2 ipc/shm: serialize orphan cleanup with shm_nattch updates
ab61c990a87d iommu/dma: Do not try to iommu_map a 0 length region in swiotlb
f35a368fee8a Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard
a3dff1e1a554 Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)
7f59e4f72a78 i2c: tegra: Fix NOIRQ suspend/resume
6018d73137cd i2c: stm32f7: fix timing computation ignoring i2c-analog-filter
a162a260c8c4 i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()
9fa82cf393ba i2c: imx: fix clock and pinctrl state inconsistency in runtime PM
b39f30c0a72f i2c: imx-lpi2c: fix resource leaks switching to devm_dma_request_chan()
16f8e17184b3 futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock
56763afa0134 fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios
12df4cfa738a fuse: reject fuse_notify() pagecache ops on directories
57a9c085be07 fs/qnx6: fix pointer arithmetic in directory iteration
2990f143ec86 pidfd: refuse access to tasks that have started exiting harder
89b909e97045 inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush
df422fd273c9 IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
32138633e51e fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()
3884976f8744 bnxt_en: Fix NULL pointer dereference
6f72b902c34d ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write
735dabdf2156 staging: rtl8723bs: fix buffer over-read in rtw_update_protection
1d6c2062b77b timers/migration: Fix livelock in tmigr_handle_remote_up()
ba9ad6015937 vsock/vmci: fix sk_ack_backlog leak on failed handshake
265c07c09c83 wifi: nl80211: reject oversized EMA RNR lists
ac2000be0cbe wifi: iwlwifi: pcie: simplify the resume flow if fast resume is not used
fcfdff42e841 xfs: fix rtgroup cleanup in CoW fork repair
d84ed2f9718e xfs: fix error returns in CoW fork repair
9f21885c11ba mptcp: add-addr: always drop other suboptions
6ea1134f1b5f selftests: mptcp: add test for extra_subflows underflow on userspace PM
7bbc11437a20 mptcp: sockopt: set sockopt on all subflows
f591cbc088c9 mptcp: sockopt: check timestamping ret value
c0c152fc4ae6 mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation
653245266913 mptcp: allow subflow rcv wnd to shrink
3b8cbba7c0ed mptcp: close TOCTOU race while computing rcv_wnd
edaf0c955ace mptcp: fix retransmission loop when csum is enabled
95f27fcda681 arm64: mm: call pagetable dtor when freeing hot-removed page tables
517720913bd3 ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow
da295adc9dab ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O
6243a363ec90 ARM: socfpga: Fix OF node refcount leak in SMP setup
6822eed69572 udp: clear skb->dev before running a sockmap verdict
c96786d6ff1a zram: fix use-after-free in zram_bvec_write_partial()
f92a285db7ff RDMA/srp: bound SRP_RSP sense copy by the received length
bd5e818be796 RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc
96b6e98ff12d RDMA/core: Validate the passed in fops for ib_get_ucaps()
e99807bdcd20 mm/huge_memory: update file PUD counter before folio_put()
cb5230b6d8a0 mm/damon/ops-common: call folio_test_lru() after folio_get()
5f5b604e1e6b mm/huge_memory: update file PMD counter before folio_put()
edabfe80e34e drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info()
8348567a6afb drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait()
0bbc9481f970 io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries
3d39da65b5c4 ALSA: timer: Fix UAF at snd_timer_user_params()
f46093dd2296 ALSA: timer: Forcibly close timer instances at closing
372f33ebed74 USB: serial: kl5kusb105: fix bulk-out buffer overflow
85bd2b3afa0a USB: serial: option: add usb-id for Dell Wireless DW5826e-m
294692d3296e USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()
f96cf7bf9fbf USB: serial: io_ti: fix heap overflow in get_manuf_info()
a13ca53e47e5 xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()
dd66f7f6e360 xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()
f9b38a8fbfa0 xfrm: espintcp: do not reuse an in-progress partial send
14d2eee0193a ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL
0b38870d81ab hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf
32d4c5d328a3 drm/i915/gem: Fix phys BO pread/pwrite with offset
0b79bcff7210 KVM: arm64: Restore POR_EL0 access to host EL0
196f1ee137eb KVM: SEV: Decouple the need to sync the GHCB SA from the need to free the SA
343e95c8ecc4 KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying
0864bdde152e mshv: add a missing padding field
8bcbedce9bfa mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation
a0a4600b396b rust: kasan/kbuild: fix rustc-option when cross-compiling
d0f25a1755f2 rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES
5037b2ee1a17 ARM: Do not select HAVE_RUST when KASAN is enabled
00875811f372 rust: x86: support Rust >= 1.98.0 target spec
592be0dc491d tracing/probes: Point the error offset correctly for eprobe argument error
09df291fdf96 tracing: Fix CFI violation in probestub being called by tprobes
45cb105b8642 accel/ivpu: Fix signed integer truncation in IPC receive
fa598556ecef accel/ivpu: Add buffer overflow check in MS get_info_ioctl
8ec70c0dbdf0 accel/ivpu: Add bounds checks for firmware log indices
dd77a83915b0 mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison
cc160ce08540 soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get()
dedc92b96dc1 Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig
dafc9f57140e Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend
c10c9c48b290 tee: shm: fix shm leak in register_shm_helper()
07acb9798477 netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register
941d7394efda netfilter: nft_tunnel: fix use-after-free on object destroy
e83fc4c28226 accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()
361e97d81331 drm/xe: fix refcount leak in xe_range_fence_insert()
02f5e4db57c0 drm/vc4: fix krealloc() memory leak
19a6a00ff50c drm/virtio: Fix driver removal with disabled KMS
dda720b2928d drm/i915/edp: Check supported link rates DPCD read
489f6d759fa4 clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time
3a4fc3617b7e clk: samsung: gs101: Fix missing USI7_USI DIV clock in peric0_clk_regs
656939c67595 clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from getting parked
f34689e7a0b3 KVM: VMX: Update SVI during runtime APICv activation
07d9a0870a17 ipv6: Fix a potential NPD in cleanup_prefix_route()
2c98343c9b23 net: txgbe: initialize module info buffer
19a4d2aace1d net: txgbe: rename the SFP related
9157060fed92 net: txgbe: support CR modules for AML devices
7649ba2b1291 net: txgbe: optimize the flow to setup PHY for AML devices
af08fe9ba091 net: mvpp2: build skb from XDP-adjusted data on XDP_PASS
8a2126c5afe8 net: mvpp2: refill RX buffers before XDP or skb use
910617a4e67d net: mvpp2: limit XDP frame size to the RX buffer
a13199fa224e net: mvpp2: sync RX data at the hardware packet offset
78069a6d8bc8 netfilter: nft_exthdr: fix register tracking for F_PRESENT flag
af1b7699466f netfilter: nf_log: validate MAC header was set before dumping it
08a3e218064d netfilter: x_tables: avoid leaking percpu counter pointers
9d017671dcfc netfilter: nf_conntrack: destroy stale expectfn expectations on unregister
4beffcd726e2 netfilter: revalidate bridge ports
865e94f6d8a5 spi: rzv2h-rspi: Fix SPDR read access width for 16-bit RX
5ae8a38169fc rds: mark snapshot pages dirty in rds_info_getsockopt()
2abfb19bbb81 ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
5fd1fa5a4254 tun: zero the whole vnet header in tun_put_user()
dcf458120add net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion
3dde4fb941fa net: guard timestamp cmsgs to real error queue skbs
7560afb8cdda sctp: validate embedded INIT chunk and address list lengths in cookie
ecf8904067dc ip6_vti: set netns_immutable on the fallback device.
f76a8b323e28 sctp: fix uninit-value in __sctp_rcv_asconf_lookup()
d23d53355300 ASoC: SOF: amd: fix for ipc flags check
6c75ee4d1d40 net: mctp: usb: don't fail mctp_usb_rx_queue on a deferred submission
9c46f3ee1837 net: mctp: usb: fix race between urb completion and rx_retry cancellation
bace7b99bfa5 gpio: rockchip: fix generic IRQ chip leak on remove
5d4bca5cbb69 gpio: zynq: fix runtime PM leak on remove
c838ffc154cb r8152: handle the return value of usb_reset_device()
ecc55aad3390 net: openvswitch: fix possible kfree_skb of ERR_PTR
2fa49b2715e1 ipv6: sit: reload inner IPv6 header after GSO offloads
289c06418ed9 net/mlx5: Use effective affinity mask for IRQ selection
2789b74ae1f4 net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure
0f807764bb12 net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list
ab269990ed58 net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove
3a254779c169 net: phy: clean the sfp upstream if phy probing fails
c299321bc623 netdev: fix double-free in netdev_nl_bind_rx_doit()
c09c2e236eef net: ibm: emac: Fix use-after-free during device removal
8b0541231091 net/mlx4: avoid GCC 10 __bad_copy_from() false positive
0cde3a004119 net: add pskb_may_pull() to skb_gro_receive_list()
ede69b8f6670 tcp: restrict SO_ATTACH_FILTER to priv users
12e579b88962 ASoC: wm_adsp: Fix NULL dereference when removing firmware controls
6136c1474db8 gpio: mvebu: fix NULL pointer dereference in suspend/resume
0c4bb32ad7fd netlabel: validate unlabeled address and mask attribute lengths
972c106f5d01 bnge: fix context mem iteration
6b8baf42b1b7 net: ena: PHC: Add missing barrier
640edc281d2f idpf: fix mailbox capability for set device clock time
6bdbe6f43ecf ice: fix missing priority callbacks for U.FL DPLL pins
b5316e2b8614 xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()
5513dcb378f9 dma-debug: fix physical address retrieval in debug_dma_sync_sg_for_device
4ee4d628c4d9 dma-mapping: direct: fix missing mapping for THRU_HOST_BRIDGE segments
8d9a79fbf517 xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload
e27c17346628 tap: free page on error paths in tap_get_user_xdp()
0c03692e2372 verification/rvgen: Fix ltl2k writing True as a literal
43ad0a0da486 verification/rvgen: Fix options shared among commands
73590b4cfd05 tools/rv: Fix cleanup after failed trace setup
fd1923910bbf tools/rv: Fix substring match when listing container monitors
2122d68f0864 tools/rv: Fix substring match bug in monitor name search
618193aba6fe tools/rv: Ensure monitor name and desc are NUL-terminated
65046b0d853d cpufreq/amd-pstate: drop stale @epp_cached kdoc
63a9f6012f45 spi: cadence-quadspi: fix unclocked access on unbind
6671a46144f8 ALSA: seq: dummy: fix UMP event stack overread
cd98837db15f ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams
6b71956c25f9 time: Fix off-by-one in settimeofday() usec validation
ed0ad6574126 hyperv: Clean up and fix the guest ID comment in hvgdk.h
8c046f36222c signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()
6dc6e5b5c32e selftests: harness: fix pidfd leak in __wait_for_test
752e22ecf4df drm/hyperv: During panic do VMBus unload after frame buffer is flushed
b0f77f76231b Drivers: hv: vmbus: Provide option to skip VMBus unload on panic
1639df1a9844 Drivers: hv: VMBus protocol version 6.0
a6207349e703 sctp: purge outqueue on stale COOKIE-ECHO handling
42446ca0f357 net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr
285b0842f2e0 ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()
3b7ee029b556 vxlan: vnifilter: fix spurious notification on VNI update
8e4d1188bad7 vxlan: vnifilter: send notification on VNI add
eb676fb14427 octeontx2-af: npc: Fix CPT channel mask in npc_install_flow
cc272185c9a9 sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing
b198ed4e5258 net/sched: fix pedit partial COW leading to page cache corruption
e634408d2b0c net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown
6f829e2c17a5 net: airoha: Fix use-after-free in metadata dst teardown
9a263bbd1ec0 ptp: vclock: Switch from RCU to SRCU
a4f3fd651692 ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options
91106d0348a5 af_unix: Fix inq_len update problem in partial read
f010cf9aea01 octeontx2-af: Fix initialization of mcam's entry2target_pffunc field
ddf930f28be6 octeontx2-pf: Fix NDC sync operation errors
0dfe05b93843 xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata()
58d810354de1 Bluetooth: MGMT: Fix backward compatibility with userspace
446a17b1b509 Bluetooth: SCO: Fix data-race on sco_pi fields in sco_connect
ab84fd7779a2 Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls
33d677d2e371 Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync
ce4b4cac3c57 Bluetooth: fix memory leak in error path of hci_alloc_dev()
c893e17d2809 Bluetooth: bnep: reject short frames before parsing
7f5367f1ad9b Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling
3eabc6d47a0a Bluetooth: RFCOMM: validate skb length in MCC handlers
1a3c8ffbb469 Bluetooth: MGMT: validate advertising TLV before type checks
8802413ce631 Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()
fb8db813eba2 wifi: fix leak if split 6 GHz scanning fails
15be7e9fdbff ipv6: anycast: insert aca into global hash under idev->lock
23bf7d5c250b net: fec: fix pinctrl default state restore order on resume
76244b33640b net: lan743x: permit VLAN-tagged packets up to configured MTU
04e22fefac1a net: garp: fix unsigned integer underflow in garp_pdu_parse_attr
66a46e22396f hsr: Remove WARN_ONCE() in hsr_addr_is_self().
07f13816be5a net: Annotate sk->sk_write_space() for UDP SOCKMAP.
83810d51d699 pcnet32: stop holding device spin lock during napi_complete_done
9b40c59bab08 wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap
e3f6ba5f8cf3 drm/imx: Fix three kernel-doc warnings in dcss-scaler.c
927f96861f93 devlink: Release nested relation on devlink free
e251d4cdfc72 l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()
c32f30ef5e66 6lowpan: fix off-by-one in multicast context address compression
b60e9391142e net/sched: act_api: use RCU with deferred freeing for action lifecycle
42ff6774ecd9 dm cache policy smq: check allocation under invalidate lock
b18675263db1 netfilter: bridge: make ebt_snat ARP rewrite writable
f071b0bf0781 netfilter: nft_ct: bail out on template ct in get eval
9e5da2379f96 netfilter: conntrack_irc: fix possible out-of-bounds read
aaf80701dc2f netfilter: synproxy: add mutex to guard hook reference counting
25918720ba97 ipvs: clear the svc scheduler ptr early on edit
cdaf13260c99 netfilter: xt_NFQUEUE: prefer raw_smp_processor_id
e735dbd489e3 ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers
9dca67624721 wifi: iwlwifi: mvm: don't support the reset handshake for old firmwares
00bf6868df65 erofs: fix use-after-free on sbi->sync_decompress
50fd261b1ec4 erofs: tidy up synchronous decompression
8db2fabb5ecd tee: qcomtee: add missing va_end in early return qcomtee_object_user_init()
ac7eca1ae4e5 tee: fix tee_ioctl_object_invoke_arg padding
633db9a1991a soc: qcom: ice: Return -ENODEV if the ICE platform device is not found
40fc6ed12f91 ARM: dts: microchip: sam9x7: fix GMAC clock configuration
9cb93ec617fb arm64: dts: qcom: x1-dell-thena: remove i2c20 (battery SMBus) and reserve its pins
a171bc68e9af soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE
d5b57bb314d7 tee: optee: prevent use-after-free when the client exits before the supplicant
dcd90f42a33e net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS
4203806f700b ipv6: mcast: Fix use-after-free when processing MLD queries
ffbcf31f032e i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl
97706097f9b8 KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation
9e767af5f109 ARM: fix branch predictor hardening
05e22564a4f9 ARM: fix hash_name() fault
8bdb574b2176 ARM: allow __do_kernel_fault() to report execution of memory faults
22e26df355af ARM: group is_permission_fault() with is_translation_fault()
87dfb977bdb6 bpf: Free reuseport cBPF prog after RCU grace period.
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
---
.../linux/linux-yocto-rt_6.18.bb | 6 ++---
.../linux/linux-yocto-tiny_6.18.bb | 6 ++---
meta/recipes-kernel/linux/linux-yocto_6.18.bb | 24 +++++++++----------
3 files changed, 18 insertions(+), 18 deletions(-)
diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb b/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb
index 00c0b090df..c4c68844ce 100644
--- a/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb
@@ -15,13 +15,13 @@ python () {
raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it")
}
-SRCREV_machine ?= "35a623d1a755631bbc73e11fa02eee0e1092188b"
-SRCREV_meta ?= "4dafe0e420087b6381728e68eeeff6d9af0a32e7"
+SRCREV_machine ?= "f477695299adc9d29b883d1642a6672e4899a83f"
+SRCREV_meta ?= "0267ec897e3d765fd04d70212dc834570e72d438"
SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine;protocol=https \
git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.18;destsuffix=${KMETA};protocol=https"
-LINUX_VERSION ?= "6.18.35"
+LINUX_VERSION ?= "6.18.36"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb
index e2fd09a403..d8eb5724c8 100644
--- a/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb
@@ -9,7 +9,7 @@ require recipes-kernel/linux/linux-yocto.inc
include recipes-kernel/linux/cve-exclusion.inc
include recipes-kernel/linux/cve-exclusion_6.18.inc
-LINUX_VERSION ?= "6.18.35"
+LINUX_VERSION ?= "6.18.36"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}"
@@ -18,8 +18,8 @@ DEPENDS += "openssl-native util-linux-native"
KMETA = "kernel-meta"
KCONF_BSP_AUDIT_LEVEL = "2"
-SRCREV_machine ?= "efc05d9af9f5b5a647e229c92542e413c3a9915d"
-SRCREV_meta ?= "4dafe0e420087b6381728e68eeeff6d9af0a32e7"
+SRCREV_machine ?= "f1d01f240ab00120824a557c26509996d02ac37c"
+SRCREV_meta ?= "0267ec897e3d765fd04d70212dc834570e72d438"
PV = "${LINUX_VERSION}+git"
diff --git a/meta/recipes-kernel/linux/linux-yocto_6.18.bb b/meta/recipes-kernel/linux/linux-yocto_6.18.bb
index 2b1298dedf..148b440fd4 100644
--- a/meta/recipes-kernel/linux/linux-yocto_6.18.bb
+++ b/meta/recipes-kernel/linux/linux-yocto_6.18.bb
@@ -17,25 +17,25 @@ KBRANCH:qemux86-64 ?= "v6.18/standard/base"
KBRANCH:qemuloongarch64 ?= "v6.18/standard/base"
KBRANCH:qemumips64 ?= "v6.18/standard/mti-malta"
-SRCREV_machine:qemuarm ?= "84b49a9fef57bf4ff3a2919591fde336fe7944bf"
-SRCREV_machine:qemuarm64 ?= "efc05d9af9f5b5a647e229c92542e413c3a9915d"
-SRCREV_machine:qemuloongarch64 ?= "efc05d9af9f5b5a647e229c92542e413c3a9915d"
+SRCREV_machine:qemuarm ?= "15e3830e8c3a3c15924ce4e6f65430e6e9800512"
+SRCREV_machine:qemuarm64 ?= "f1d01f240ab00120824a557c26509996d02ac37c"
+SRCREV_machine:qemuloongarch64 ?= "f1d01f240ab00120824a557c26509996d02ac37c"
SRCREV_machine:qemumips ?= "62ea92a539f58803a222be98b81118403074206e"
-SRCREV_machine:qemuppc ?= "efc05d9af9f5b5a647e229c92542e413c3a9915d"
-SRCREV_machine:qemuriscv64 ?= "efc05d9af9f5b5a647e229c92542e413c3a9915d"
-SRCREV_machine:qemuriscv32 ?= "efc05d9af9f5b5a647e229c92542e413c3a9915d"
-SRCREV_machine:qemux86 ?= "efc05d9af9f5b5a647e229c92542e413c3a9915d"
-SRCREV_machine:qemux86-64 ?= "efc05d9af9f5b5a647e229c92542e413c3a9915d"
+SRCREV_machine:qemuppc ?= "f1d01f240ab00120824a557c26509996d02ac37c"
+SRCREV_machine:qemuriscv64 ?= "f1d01f240ab00120824a557c26509996d02ac37c"
+SRCREV_machine:qemuriscv32 ?= "f1d01f240ab00120824a557c26509996d02ac37c"
+SRCREV_machine:qemux86 ?= "f1d01f240ab00120824a557c26509996d02ac37c"
+SRCREV_machine:qemux86-64 ?= "f1d01f240ab00120824a557c26509996d02ac37c"
SRCREV_machine:qemumips64 ?= "9fb4ff0187c85426f21fd40d4c61b742800f65c4"
-SRCREV_machine ?= "efc05d9af9f5b5a647e229c92542e413c3a9915d"
-SRCREV_meta ?= "4dafe0e420087b6381728e68eeeff6d9af0a32e7"
+SRCREV_machine ?= "f1d01f240ab00120824a557c26509996d02ac37c"
+SRCREV_meta ?= "0267ec897e3d765fd04d70212dc834570e72d438"
# set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll
# get the <version>/base branch, which is pure upstream -stable, and the same
# meta SRCREV as the linux-yocto-standard builds. Select your version using the
# normal PREFERRED_VERSION settings.
BBCLASSEXTEND = "devupstream:target"
-SRCREV_machine:class-devupstream ?= "acb7cf4c1184e27622be0faf89244d5001ed1e87"
+SRCREV_machine:class-devupstream ?= "275d294b2b24abcd65452198551cd8a5b8d4f775"
PN:class-devupstream = "linux-yocto-upstream"
KBRANCH:class-devupstream = "v6.18/base"
@@ -43,7 +43,7 @@ SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;name=machine;branch=${KBRA
git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.18;destsuffix=${KMETA};protocol=https"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
-LINUX_VERSION ?= "6.18.35"
+LINUX_VERSION ?= "6.18.36"
PV = "${LINUX_VERSION}+git"
--
2.43.0
^ permalink raw reply related
* [meta][PATCH 02/06] linux-yocto/6.18: update to v6.18.38
From: bruce.ashfield @ 2026-07-20 15:58 UTC (permalink / raw)
To: richard.purdie; +Cc: openembedded-core
In-Reply-To: <20260720155842.569263-1-bruce.ashfield@gmail.com>
From: Bruce Ashfield <bruce.ashfield@gmail.com>
Updating linux-yocto/6.18 to the latest korg -stable release that comprises
the following commits:
e46dc0adfe397 Linux 6.18.38
92c63a5ef3c7a apparmor: advertise the tcp fast open fix is applied
e77fbefd1269b net/tcp-ao: fix use-after-free of key in del_async path
3d205fe80f218 serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails
7627ff8c4f991 ksmbd: fix out-of-bounds read in smb_check_perm_dacl()
62c26720121bf NFS: Prevent resource leak in nfs_alloc_server()
6919eb549e8f3 NFSv4: clear exception state on successful mkdir retry
012d37a568bfb NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
d8c90c7cc0612 NFSv4/flexfiles: reject zero filehandle version count
4367afc119c51 nfsd: reset write verifier on deferred writeback errors
017a6150106b0 nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race
0f28337f54cfb nfsd: check get_user() return when reading princhashlen
dba7da4835de7 nfsd: fix inverted cp_ttl check in async copy reaper
136b416593f13 nfsd: fix posix_acl leak on SETACL decode failure
c8a24effd96d4 NFSD: Fix SECINFO_NO_NAME decode error cleanup
6a946038f2a5a i2c: core: fix adapter registration race
fc6aa9bdbae60 fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode
4d418cf8daf57 fbdev: modedb: fix a possible UAF in fb_find_mode()
eea16b6f805c0 fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var
7643e5622994f riscv: kfence: Call mark_new_valid_map() for kfence_unprotect()
3b33dbb43e21a riscv: mm: Extract helper mark_new_valid_map()
2205275be9be9 power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init()
720949ed666f3 KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path
e36095d8d922b KVM: x86: hyper-v: Bound the bank index when querying sparse banks
f9b57a0015c24 MIPS: smp: report dying CPU to RCU in stop_this_cpu()
6dbe9443d9f5f 9p: avoid putting oldfid in p9_client_walk() error path
4cd57ebee3950 ocfs2: reject oversized group bitmap descriptors
104d100212396 rpmsg: char: Fix use-after-free on probe error path
369496d885b4c fpga: region: fix use-after-free in child_regions_with_firmware()
b3a3831b2eb88 irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove
200e7637f4d6a pNFS: Fix use-after-free in pnfs_update_layout()
90e254f18b8c2 LoongArch: Report dying CPU to RCU in stop_this_cpu()
e18769616fd5a tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done
5e5b7f2ef8549 blk-cgroup: fix UAF in __blkcg_rstat_flush()
5a84398101bf9 hdlc_ppp: sync per-proto timers before freeing hdlc state
e91df6d273445 pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()
b85ef03f726b1 gfs2: fix use-after-free in gfs2_qd_dealloc
8d8507a457667 crypto: nx - fix nx_crypto_ctx_exit argument
5da9b1a87ec7c KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()
18587f9831612 KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level
adfacfbaeae2c exfat: fix potential use-after-free in exfat_find_dir_entry()
6e61fc2e06e44 MIPS: DEC: Prevent initial console buffer from landing in XKPHYS
65bd0c0afb0e1 bpf: use kvfree() for replaced sysctl write buffer
3804e6de30ae7 block: Avoid mounting the bdev pseudo-filesystem in userspace
db2c5b9fb9087 f2fs: keep atomic write retry from zeroing original data
20190e4980579 f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()
ff83de56882cb f2fs: validate ACL entry sizes in f2fs_acl_from_disk()
888d94cc9afbf f2fs: fix to round down start offset of fallocate for pin file
77f216ff9ce5c f2fs: validate compress cache inode only when enabled
8aad54746c251 f2fs: validate orphan inode entry count
1e48fefac682c f2fs: pass correct iostat type for single node writes
1de92789ce31e wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers
b0b07e04f0c72 wifi: iwlwifi: mld: fix race condition in PTP removal
df626f284cb90 wifi: iwlwifi: mvm: fix race condition in PTP removal
200d58c851b8f wifi: rtw88: usb: fix memory leaks on USB write failures
73d427d271f7a wifi: rtw88: increase TX report timeout to fix race condition
0aeb4d3ff6ced wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor
40aa3c2b0cb8e wifi: ath11k: fix warning when unbinding
a7cdc384c9c57 wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer
7e25b5e22c1f4 wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S
ec1c9e8962555 userfaultfd: ensure mremap_userfaultfd_fail() releases mmap_changing
7216ce8cb12fe keys: Pin request_key_auth payload in instantiate paths
b11c1fa326676 KEYS: fix overflow in keyctl_pkey_params_get_2()
49d893b9cbcfc gcov: use atomic counter updates to fix concurrent access crashes
2b7ec72786094 err.h: use __always_inline on all error pointer helpers
1fcca1260c6e7 KVM: arm64: Omit tag sync on stage-2 mappings of the zero page
97e1044e79c5d block: invalidate cached plug timestamp after task switch
99e6c712cc300 kernel/fork: clear PF_BLOCK_TS in copy_process()
0d35f9f194a85 fbdev: fix use-after-free in store_modes()
81371dbd23601 NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR
c3ca2631073b2 apparmor: fix use-after-free in rawdata dedup loop
4a69b83045d31 apparmor: mediate the implicit connect of TCP fast open sendmsg
1697957eb0971 net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink
1acdd14c0990d net: skmsg: preserve sg.copy across SG transforms
bd968bdd568be mac802154: llsec: add skb_cow_data() before in-place crypto
0cfa78c050662 af_unix: Set gc_in_progress to true in unix_gc().
3c499851753a2 wifi: mt76: add wcid publish check in mt76_sta_add
5e658b9245a52 ntfs3: reject direct userspace writes to reserved $LX* xattrs
77798d7be6ef7 ipv4: account for fraggap on the paged allocation path
6374fb9edf72c ipv6: account for fraggap on the paged allocation path
565ab66005b14 batman-adv: tvlv: avoid race of cifsnotfound handler state
4cc9f7711bb89 batman-adv: tvlv: enforce 2-byte alignment
04e1a6557fbf8 batman-adv: dat: prevent false sharing between VLANs
3f82fc92cf523 batman-adv: tt: track roam count per VID
3470d583fc652 batman-adv: tt: don't merge change entries with different VIDs
af5a069805f67 batman-adv: tp_meter: handle overlapping packets
d511c72a83dd5 batman-adv: tp_meter: prevent parallel modifications of last_recv
1dafdd0794be1 batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE
2233787658db8 batman-adv: tp_meter: restrict number of unacked list entries
3d4548c96d6f2 batman-adv: v: prevent OGM aggregation on disabled hardif
44ae137a2acef batman-adv: frag: avoid underflow of TTL
116e94025f0f4 batman-adv: frag: ensure fragment is writable before modifying TTL
0473ae882624a batman-adv: fix (m|b)cast csum after decrementing TTL
49bf27fcd7ee4 batman-adv: ensure bcast is writable before modifying TTL
646b68639c06b batman-adv: gw: don't deselect gateway with active hardif
95a061f587b76 batman-adv: tp_meter: initialize last_recv_time during init
75612c100a9e2 batman-adv: prevent ELP transmission interval underflow
43733e5b525fb batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE
23d085bd63086 batman-adv: tp_meter: add only finished tp_vars to lists
b8bf8400e50cb batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection
1db02f3e315da batman-adv: tp_meter: fix fast recovery precondition
7d2a44bc6bbe3 batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd
8e77fe0414f5c batman-adv: tp_meter: avoid window underflow
7cb88d91d5f9f batman-adv: tp_meter: initialize dec_cwnd explicitly
696c4cae872cc batman-adv: tp_meter: initialize dup_acks explicitly
1c5a1268418e8 batman-adv: tp_meter: keep unacked list in ascending ordered
e055e74b80eb8 lockd: fix TEST handling when not all permissions are available.
671ec2eabb874 Revert "PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion support"
d844702198395 selinux: fix overlayfs mmap() and mprotect() access checks
5dfcb15974e7d lsm: add backing_file LSM hooks
5e470998a23e4 KVM: x86: Fix shadow paging use-after-free due to unexpected role
0c503cf3dde2e Linux 6.18.37
71003a32bef54 mm: do not copy page tables unnecessarily for VM_UFFD_WP
2abfd3ffbd945 virtiofs: fix UAF on submount umount
f965cf22dda7f media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
7cad3ceaf679c ksmbd: reject non-VALID session in compound request branch
6c25bf4e44a2b drivers/base/memory: set mem->altmap after successful device registration
50b72074c5e8d serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero
7cc3dd79777f6 vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
b8ebf008696de crypto: qat - remove unused character device and IOCTLs
d08d82d83ed45 iio: adc: ti-ads1298: add bounds check to pga_settings index
0a89002737ee3 iio: light: veml6075: add bounds check to veml6075_it_ms index
76db054931846 net: net_failover: Fix the deadlock in slave register
c5b3871b567c2 net: export netif_open for self_test usage
cc1494fd6c65d testing/selftests/mm: add soft-dirty merge self-test
f563ce913a831 mm: propagate VM_SOFTDIRTY on merge
b836839c1fd94 mm: set the VM_MAYBE_GUARD flag on guard region install
3d6cb2ed06f7f mm: introduce copy-on-fork VMAs and make VM_MAYBE_GUARD one
05cdec24a8589 mm: implement sticky VMA flags
a093c80a1f139 mm: update vma_modify_flags() to handle residual flags, document
bdeadba743375 mm: add atomic VMA flags and set VM_MAYBE_GUARD as such
efce8a486bffc mm: introduce VM_MAYBE_GUARD and make visible in /proc/$pid/smaps
0de7db2eb27e8 sctp: disable BH before calling udp_tunnel_xmit_skb()
eee6be6ab6375 firmware: samsung: acpm: Fix cross-thread RX length corruption
02ac3ba41628a Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs
072bbd2846d1b hv: utils: handle and propagate errors in kvp_register
bde74af8d4466 regulator: core: fix locking in regulator_resolve_supply() error path
9477cbc5107a8 rose: don't free fd-owned sockets when reaping in the heartbeat
395b6573b389f rose: clear neighbour pointer in rose_kill_by_device()
9e8fc2195f8b5 rose: cancel neighbour timers in rose_neigh_put() before freeing
c31a0fa15a4b4 rose: drop CALL_REQUEST in loopback timer when device is not running
74cbe94c913a4 rose: release netdev ref and destroy orphaned incoming sockets
c794d35f73a7b rose: fix netdev double-hold in rose_make_new()
ce27bcdd857a9 rose: disconnect orphaned STATE_2 sockets when device is gone
ab849a6972c99 rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup
c98cc00c2d3b1 rose: fix notifier unregistered too early in rose_exit()
19139026dc1c0 rose: fix netdev double-hold in rose_rx_call_request()
1d94857c11d60 rose: guard rose_neigh_put() against NULL in timer expiry
270ef709257eb rose: clear neighbour pointer after rose_neigh_put() in state machines
940f39e153323 rose: fix race between loopback timer and module removal
fe8cbcc3e79d4 rose: hold loopback neighbour reference across timer callback
7dac298524b41 rose: fix dev_put() leak in rose_loopback_timer()
19b3691ec9402 ACPI: scan: Use async schedule function in acpi_scan_clear_dep_fn()
53483a9f4ee9e agp/amd64: Fix broken error propagation in agp_amd64_probe()
8b17adf6d4fb6 net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()
5f4d2bd028ebb i2c: stub: Reject I2C block transfers with invalid length
e2b143df29003 RDMA/bnxt_re: zero shared page before exposing to userspace
44b8b03a9fb5c debugobjects: Dont call fill_pool() in early boot hardirq context
3a408cae608d9 debugobjects: Do not fill_pool() if pi_blocked_on
9cd2087cd7026 debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP
a460935022f51 debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING
95f9eb19d5e65 Revert "NFSD: Defer sub-object cleanup in export put callbacks"
af2892249d982 fuse: re-lock request before replacing page cache folio
29706ac73f93b net: stmmac: fix stm32 (and potentially others) resume regression
b6099150949f8 io_uring/net: Avoid msghdr on op_connect/op_bind async data
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
---
.../linux/linux-yocto-rt_6.18.bb | 6 ++---
.../linux/linux-yocto-tiny_6.18.bb | 6 ++---
meta/recipes-kernel/linux/linux-yocto_6.18.bb | 24 +++++++++----------
3 files changed, 18 insertions(+), 18 deletions(-)
diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb b/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb
index c4c68844ce..23c43c0cc1 100644
--- a/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb
@@ -15,13 +15,13 @@ python () {
raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it")
}
-SRCREV_machine ?= "f477695299adc9d29b883d1642a6672e4899a83f"
-SRCREV_meta ?= "0267ec897e3d765fd04d70212dc834570e72d438"
+SRCREV_machine ?= "0d0c54addf4ff32e49c485061bd9ea5bde241d94"
+SRCREV_meta ?= "bf23930cc9805c0e87bdaff762832446c730a39b"
SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine;protocol=https \
git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.18;destsuffix=${KMETA};protocol=https"
-LINUX_VERSION ?= "6.18.36"
+LINUX_VERSION ?= "6.18.38"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb
index d8eb5724c8..e186b5f992 100644
--- a/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb
@@ -9,7 +9,7 @@ require recipes-kernel/linux/linux-yocto.inc
include recipes-kernel/linux/cve-exclusion.inc
include recipes-kernel/linux/cve-exclusion_6.18.inc
-LINUX_VERSION ?= "6.18.36"
+LINUX_VERSION ?= "6.18.38"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}"
@@ -18,8 +18,8 @@ DEPENDS += "openssl-native util-linux-native"
KMETA = "kernel-meta"
KCONF_BSP_AUDIT_LEVEL = "2"
-SRCREV_machine ?= "f1d01f240ab00120824a557c26509996d02ac37c"
-SRCREV_meta ?= "0267ec897e3d765fd04d70212dc834570e72d438"
+SRCREV_machine ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636"
+SRCREV_meta ?= "bf23930cc9805c0e87bdaff762832446c730a39b"
PV = "${LINUX_VERSION}+git"
diff --git a/meta/recipes-kernel/linux/linux-yocto_6.18.bb b/meta/recipes-kernel/linux/linux-yocto_6.18.bb
index 148b440fd4..5c849202ad 100644
--- a/meta/recipes-kernel/linux/linux-yocto_6.18.bb
+++ b/meta/recipes-kernel/linux/linux-yocto_6.18.bb
@@ -17,25 +17,25 @@ KBRANCH:qemux86-64 ?= "v6.18/standard/base"
KBRANCH:qemuloongarch64 ?= "v6.18/standard/base"
KBRANCH:qemumips64 ?= "v6.18/standard/mti-malta"
-SRCREV_machine:qemuarm ?= "15e3830e8c3a3c15924ce4e6f65430e6e9800512"
-SRCREV_machine:qemuarm64 ?= "f1d01f240ab00120824a557c26509996d02ac37c"
-SRCREV_machine:qemuloongarch64 ?= "f1d01f240ab00120824a557c26509996d02ac37c"
+SRCREV_machine:qemuarm ?= "053c98bdd6c074a24771d69d24ff077f6016b299"
+SRCREV_machine:qemuarm64 ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636"
+SRCREV_machine:qemuloongarch64 ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636"
SRCREV_machine:qemumips ?= "62ea92a539f58803a222be98b81118403074206e"
-SRCREV_machine:qemuppc ?= "f1d01f240ab00120824a557c26509996d02ac37c"
-SRCREV_machine:qemuriscv64 ?= "f1d01f240ab00120824a557c26509996d02ac37c"
-SRCREV_machine:qemuriscv32 ?= "f1d01f240ab00120824a557c26509996d02ac37c"
-SRCREV_machine:qemux86 ?= "f1d01f240ab00120824a557c26509996d02ac37c"
-SRCREV_machine:qemux86-64 ?= "f1d01f240ab00120824a557c26509996d02ac37c"
+SRCREV_machine:qemuppc ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636"
+SRCREV_machine:qemuriscv64 ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636"
+SRCREV_machine:qemuriscv32 ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636"
+SRCREV_machine:qemux86 ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636"
+SRCREV_machine:qemux86-64 ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636"
SRCREV_machine:qemumips64 ?= "9fb4ff0187c85426f21fd40d4c61b742800f65c4"
-SRCREV_machine ?= "f1d01f240ab00120824a557c26509996d02ac37c"
-SRCREV_meta ?= "0267ec897e3d765fd04d70212dc834570e72d438"
+SRCREV_machine ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636"
+SRCREV_meta ?= "bf23930cc9805c0e87bdaff762832446c730a39b"
# set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll
# get the <version>/base branch, which is pure upstream -stable, and the same
# meta SRCREV as the linux-yocto-standard builds. Select your version using the
# normal PREFERRED_VERSION settings.
BBCLASSEXTEND = "devupstream:target"
-SRCREV_machine:class-devupstream ?= "275d294b2b24abcd65452198551cd8a5b8d4f775"
+SRCREV_machine:class-devupstream ?= "e46dc0adfe39724bcf52cea47b8f9c9aed86a394"
PN:class-devupstream = "linux-yocto-upstream"
KBRANCH:class-devupstream = "v6.18/base"
@@ -43,7 +43,7 @@ SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;name=machine;branch=${KBRA
git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.18;destsuffix=${KMETA};protocol=https"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
-LINUX_VERSION ?= "6.18.36"
+LINUX_VERSION ?= "6.18.38"
PV = "${LINUX_VERSION}+git"
--
2.43.0
^ permalink raw reply related
* [meta][PATCH 03/06] linux-yocto/6.18: update to v6.18.39
From: bruce.ashfield @ 2026-07-20 15:58 UTC (permalink / raw)
To: richard.purdie; +Cc: openembedded-core
In-Reply-To: <20260720155842.569263-1-bruce.ashfield@gmail.com>
From: Bruce Ashfield <bruce.ashfield@gmail.com>
Updating linux-yocto/6.18 to the latest korg -stable release that comprises
the following commits:
f89c296854b75 Linux 6.18.39
06b1729436efc xfs: use rtrefcount btree cursor in xchk_xref_is_rt_cow_staging
457a93a233bd7 xfs: write the rg superblock when fixing it
e696ef088f557 xfs: fix off-by-one error when calling xchk_xref_has_rt_owner
6403ef9a81e6c xfs: don't zap bmbt forks if they are MAXLEVELS tall
1ea0868a477b7 xfs: fully check the parent handle when it points to the rootdir
c9662ffd62c4e xfs: clamp timestamp nanoseconds correctly
424be21ed8cd4 xfs: handle non-inode owners for rtrmap record checking
d399b026a6b34 xfs: set xfarray killable sort correctly
08b191ae64659 xfs: use the rt version of the cow staging checker
104584477883b xfs: grab rtrmap btree when checking rgsuper
d1c4c40599c37 xfs: don't wrap around quota ids in dqiterate
206c09b04dc54 xfs: resample the data fork mapping after cycling ILOCK
d98f22d2e11e0 xfs: fail recovery on a committed log item with no regions
dca861f2cc9e6 xfs: fix null pointer dereference in tracepoint
fdafa1e68dc75 smb: client: reject overlapping data areas in SMB2 responses
1991d49433e90 Revert "f2fs: remove non-uptodate folio from the page cache in move_data_block"
1c56c46519353 Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev
e697df336662b timekeeping: Register default clocksource before taking tk_core.lock
9e04055ab5fc0 usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks
75e1d2787005d sched/fair: Only update stats for allowed CPUs when looking for dst group
0b466cf1b96e1 fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref
e1711479e9068 fuse-uring: make a fuse_req on SQE commit only findable after memcpy
39c8e925b207a fuse-uring: Avoid queue->stopped races and set/read that value under lock
23a356e0bd96c fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues
bb476ef8e1027 fuse-uring: end fuse_req on io-uring cancel task work
50f3e03db823c fuse-uring: fix moving cancelled entry to ent_in_userspace list
b156bb9966972 fuse-uring: fix data races on ring->ready
0483fffdeeb36 fuse-uring: fix EFAULT clobber in fuse_uring_commit
7366e6f4d2b4c fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req
096cb2e58a6db fuse: fix io-uring background queue dispatch on request completion
be353caffa864 fuse: re-lock request before returning from fuse_ref_folio()
e6620208bdd34 fuse: fix device node leak in cuse_process_init_reply()
6e2d84fdeac05 fuse: avoid 32-bit prune notification count wrap
69cfae58b9a32 fuse: back uncached readdir buffers with pages
423a78ff7928c RDMA/siw: bound Read Response placement to the RREAD length
ab45808c141a3 RDMA/core: Fix broadcast address falsely detected as local
5a45d0aa1fa50 RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg
95de76f6ad474 Input: maplecontrol - set driver data before registering input device
9376c744bea2c Input: maplemouse - set driver data before registering input device
699e3abac02de Input: maple_keyb - set driver data before registering input device
d7f66fbab5d21 Input: mms114 - fix multi-touch slot corruption
1b4cb75f254fb Input: maplemouse - fix NULL pointer dereference in open()
37fbe63bccf21 Input: gscps2 - advance receive buffer write index
8301c33530534 Input: mms114 - reject an oversized device packet size
3e6f007b43e2f Input: touchwin - reset the packet index on every complete packet
05dee4007cf30 Input: ads7846 - don't use scratch for tx_buf when clearing register
75b12874b4172 Input: mms114 - fix touch indexing for MMS134S and MMS136
70019779325f2 Input: iforce - bound the device-reported force-feedback effect index
3b32303460155 Input: goodix - clamp the device-reported contact count
01e0317c256c5 Input: elan_i2c - prevent division by zero and arithmetic underflow
e849c6f51e687 Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count
8db211aed8373 Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count
11f275f01c46b Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure
bb5133a7d5f3f i2c: i801: fix hardware state machine corruption in error path
b2523f26979e0 i2c: imx-lpi2c: mark I2C adapter when hardware is powered down
369635fbcf7f3 i2c: stm32f7: truncate clock period instead of rounding it
b65667ec5e9a9 i2c: davinci: Unregister cpufreq notifier on probe failure
56945871123e2 i2c: mpc: Fix timeout calculations
b6d2af6fe9c1f i2c: core: fix adapter deregistration race
71b7da959031f i2c: core: fix adapter debugfs creation
0345994d64761 i2c: core: fix adapter probe deferral loop
3351c5e77749a i2c: core: fix NULL-deref on adapter registration failure
9ec02cc9a04e5 i2c: core: fix irq domain leak on adapter registration failure
59070040fd12e fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()
34696563461c9 dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning
f8e1dc70efe48 udmabuf: fix DMA direction mismatch in release_udmabuf()
0c93681aea0a1 KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier
4ad73ef0e7966 KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits
ab253cf6e1118 KVM: VMX: Handle bad values on proxied writes to LBR MSRs
eeb456eb35565 KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs
35f3ea7e49a37 KVM: SVM: Only disable x2AVIC WRMSR interception for MSRs that are accelerated
7949aa38e1094 KVM: SVM: Disable x2AVIC RDMSR interception for MSRs KVM actually supports
4b200e0c9c339 KVM: x86: Add dedicated API for getting mask of accelerated x2APIC MSRs
6bea2f8becdb2 KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU
2d710d4fcd2cd LoongArch: KVM: Add missing slots_lock for device register/unregister
7c73a269a880b KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB
b51a7439c166a selftests/landlock: Filter dealloc records in audit_count_records()
859fef2c3d40a landlock: Set audit_net.sk for socket access checks
e4427c19554b5 audit: fix removal of dangling executable rules
32ca4aed2a662 iommufd: Set upper bounds on cache invalidation entry_num and entry_len
67daea4c09351 iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read()
5539da127d03c iommufd: Break the loop on failure in iommufd_fault_fops_read()
f2dbe1dba01e6 iommufd: Reject invalid read count in iommufd_fault_fops_read()
f549a749b6255 iommufd: Reject invalid read count in iommufd_veventq_fops_read()
64011399d8819 iommufd: Rewind header length in done if iommufd_veventq_fops_read() fails
f565297edf316 iommufd: Set veventq_depth upper bound
5c5f1b5184f7d iommufd: Fix data_len byte-count vs element-count mismatch
04a177f91160e iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read
50612ce318b1c iommu/amd: Don't split flush for amd_iommu_domain_flush_all()
bb354384f40bb iommu/vt-d: Avoid WARNING in sva unbind path
037ec8353711c crypto: loongson - Remove broken and unused loongson-rng
6bbe2000d9f9f selftests/mm: pagemap_ioctl: use the correct page size for transact_test()
5c942ad7df759 mm: do file ownership checks with the proper mount idmap
8dcaa0f87a88d mm: page_ext: add count limit to page_ext_iter_next to prevent invalid PFN access
785ebd42b8b50 selftests: mm: fix and speedup "droppable" test
279c2fa731122 mm: fix mmap errno value when MAP_DROPPABLE is not supported
4d730cab96e6b riscv: mm: Unconditionally sfence.vma for spurious fault
90405c8822c5d riscv: mm: Define DIRECT_MAP_PHYSMEM_END
1c8889e0db01f NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr()
33c0b96d7e167 exfat: bound uniname advance in exfat_find_dir_entry()
a82e170637e05 module: decompress: check return value of module_extend_max_pages()
b883733302508 rqspinlock: Fix order in raw_res_spin_(un)lock_irq to allow schedule
a937e92c1d005 NFSv4: include MAY_WRITE in open permission mask for O_TRUNC
75ca99875aa4e audit: fix potential integer overflow in audit_log_n_hex()
2dad64a97e1df tracing: Prevent out-of-bounds read in glob matching
c8b7e113f7b61 perf/aux: Fix page UAF in map_range()
af6048e913052 i2c: core: fix hang on adapter registration failure
22cb337370e65 regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()
6b01ed165d298 watchdog: apple: Add "apple,t8103-wdt" compatible
f4dd5621a6eef EDAC/i10nm: Don't fail probing if ADXL is missing
add1e4112e00b x86/mm: Fix freeing of PMD-sized vmemmap pages
808033d80d5c9 spi: fsl-lpspi: terminate the RX channel on TX prepare failure path
18d6048b1b1b4 spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync()
75422f5e50222 arm64: fpsimd: Fix type mismatch in sme_{save,load}_state()
93f000e89976e crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation
fda9cb9b7191c crypto: talitos/hash - remove useless wrapper
99cc3f5511d8b crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request
b960edc92c81b crypto: talitos/hash - drop workqueue mechanism for SEC1
042730207a991 crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue
40a2e90acdb1a crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor
a8decb89920a1 crypto: talitos - move code in current_desc_hdr() into a standalone function
aea8cfbd60da9 crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function
3fa1846f75edf crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function
664e7f16e74fc crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1
f52aa95e3cae1 crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header
7584c92f72447 crypto: qat - factor out AER reset helpers
6fb62b767f3e2 crypto: qat - validate RSA CRT component lengths
fabf364ef9db5 crypto: qat - skip restart for down devices
c3c5925791cff crypto: qat - protect service table iterations with service_lock
e310e8dc8ce72 crypto: qat - notify fatal error before AER reset preparation
45b65a21edbe0 crypto: qat - keep VFs enabled during reset
33cfc0ce28ac9 crypto: qat - handle sysfs-triggered reset callbacks
050bded706ee5 crypto: qat - centralize bus master enable
5337b5cd3608a crypto: drbg - Fix the fips_enabled priority boost
53d38b93cadc0 crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels
23b8b188cb32e crypto: drbg - Fix returning success on failure in CTR_DRBG
441ea32cf2755 crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG)
92567ed9306d5 crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD)
7a361c74bb12f crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)
9e983d0a74a6a crypto: ccp - Do not initialize SNP for SEV ioctls
53b8fb85f332b crypto: loongson - Select CRYPTO_RNG
cc4e42b3ee9fc crypto: tegra - fix refcount leak in tegra_se_host1x_submit()
c4bd2f4c35b0e crypto: pcrypt - restore callback for non-parallel fallback
ee6a2a25665c6 crypto: hisi-trng - Remove crypto_rng interface
774ddddf5eb26 crypto: ecc - Fix carry overflow in vli multiplication
ac667f9f18c6b crypto: crypto4xx - Remove insecure and unused rng_alg
0016d3c21c6ab crypto: chacha20poly1305 - validate poly1305 template argument
d0b8cafd529b4 crypto: caam - use print_hex_dump_devel to guard key hex dumps again
6f7b8e0321f3a crypto: caam - use print_hex_dump_devel to guard key hex dumps
7465ed1524ace crypto: af_alg - Remove zero-copy support from skcipher and aead
b5699642640d6 isofs: bound Rock Ridge symlink components to the SL record
ce93228e2193a partitions: aix: bound the pp_count scan to the ppe array
7a64521802997 btrfs: do not trim a device which is not writeable
0912b98151eea btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC
6d7649c1231da nvmet-auth: validate reply message payload bounds against transfer length
56c021a086926 nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page
7a69463e9ad23 nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks
13f2f5defb4d7 dm-ioctl: report an error if a device has no table
427c82497e269 block: partitions: fix of_node refcount leak in of_partition()
a8803c4f0ac3f nvme: target: rdma: fix ndev refcount leak on queue connect
d161d47aba31d crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A
c60932d6f8373 hwrng: jh7110 - fix refcount leak in starfive_trng_read()
04f4599a9efb9 udf: validate sparing table length as an entry count, not a byte count
e610fb113cdfa udf: validate VAT header length against the VAT inode size
335202ab25b01 udf: validate free block extents against the partition length
d944b8add3318 bpf: Prefer dirty packs for eBPF allocations
0229944ba7923 bpf: Prefer packs that won't trigger an IBPB flush on allocation
f1f36bf9bb117 bpf: Skip redundant IBPB in pack allocator
666fc2e6e4d0a bpf: Restrict JIT predictor flush to cBPF
8a4c8af9ae67e x86/bugs: Enable IBPB flush on BPF JIT allocation
8ff183ee4d8c4 bpf: Support for hardening against JIT spraying
bd818dcf4783e rust_binder: fix BINDER_GET_EXTENDED_ERROR
e5049526a7aac rust_binder: introduce TransactionInfo
be1567992417d x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled
b7b2d2ccdbc4d mm: shmem: fix potential livelock issue for shmem direct swapin
9818bcae3c0ca block: skip sync_blockdev() on surprise removal in bdev_mark_dead()
e086c16962a1b usb: gadget: f_fs: Fix DMA fence leak
b45be66ed47d4 usb: typec: ucsi: cancel pending work on system suspend
f5c772b76bbd9 usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove
b1dfdff51a865 usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode
8c00aec752ce1 usb: typec: ucsi: Invert DisplayPort role assignment
3e1b1ac47e816 usb: typec: tcpm: Validate SVID index in svdm_consume_modes()
0bc177820bd38 usb: typec: tcpm: Fix VDM type for Enter Mode commands
bf6aa6c0ce0db usb: typec: class: drop PD lookup reference
1126f1110b86c usb: typec: anx7411: use devm_pm_runtime_enable()
347b59e9f9671 usbip: vudc: fix NULL deref in vep_dequeue()
6c7e8e2514374 usbip: tools: support SuperSpeedPlus devices
2d84c8376f7aa USB: usb-storage: ene_ub6250: restore media-ready check
1967a7f0cd5c0 USB: ulpi: fix memory leak on registration failure
1243f12079004 USB: serial: digi_acceleport: fix write buffer corruption
2b7dc482f859f USB: serial: digi_acceleport: fix hard lockup on disconnect
eab394781e932 USB: serial: digi_acceleport: fix broken rx after throttle
4b147eb6ae6e0 USB: serial: option: add Telit Cinterion FE990D50 compositions
cf6ca0aefae03 USB: serial: keyspan_pda: fix information leak
8c29d9cfab1c3 usb: mtu3: unmap request DMA on queue failure
729b68a5bad71 USB: misc: uss720: unregister parport on probe failure
48394f94211cf usb: misc: usbio: bound bulk IN response length to the received transfer
964d572b6c009 USB: storage: include US_FL_NO_SAME in quirks mask
e0886775952e3 usb: sl811-hcd: disable controller wakeup on remove
766738ecf2b81 USB: legousbtower: fix use-after-free on disconnect race
6af28345cbf8b USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD
b748f97aff339 USB: iowarrior: fix use-after-free on disconnect
2107a4fc8ff1c USB: ldusb: fix use-after-free on disconnect race
54c2b7356b4ae USB: idmouse: fix use-after-free on disconnect race
8a5eba992c862 usb: gadget: f_printer: take kref only for successful open
b52476a83d9e1 usb: gadget: udc: Fix use-after-free in gadget_match_driver
01feaf024f296 usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler
6bc17a78a0567 usb: free iso schedules on failed submit
0bbab8882a319 usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume()
4b0779207e36d USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub
c00826e87bb75 usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()
e22f044b0b20d usb: cdc_acm: Add quirk for Uniden BC125AT scanner
e24eb271061db net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()
cd407de2ef5dc bpf: Validate BTF repeated field counts before expansion
d94ab0e91d3ff bpf: Restore sysctl new-value from 1 to 0
a9bb2d9c798cb bpf: Reject fragmented frames in devmap
c3d3d2212c296 xfs: fix memory leak in xfs_dqinode_metadir_create()
a62ef2d13d6e7 xfs: fix exchmaps reservation limit check
55e4d8413fb54 xfs: fix pointer arithmetic error on 32-bit systems
dd8d0665cdabf xfs: fix unreachable BIGTIME check in dquot flush validation
936618643591c xfs: release dquot buffer after dqflush failure
200794d0354cd xfs: use null daddr for unset first bad log block
1cd54e217c6e2 serial: 8250_mid: Disable DMA for selected platforms
973408ceab145 media: mtk-jpeg: cancel workqueue on release for supported platforms only
223463c488b05 nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers
f3461b84a4865 hfs/hfsplus: zero-initialize buffer in hfs_bnode_read
c63bc6308da71 HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads
4d0d51bc12d24 HID: lg-g15: cancel pending work on remove to fix a use-after-free
b363d964ca829 HID: appleir: fix UAF on pending key_up_timer in remove()
37daa8c96bd56 HID: multitouch: fix out-of-bounds bit access on mt_io_flags
3eca1a8165b5e HID: letsketch: fix UAF on inrange_timer at driver unbind
bbe1e55629bfa HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush()
ca899a926c11a HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert
cb90a01e478c2 HID: pidff: Use correct effect type in effect update
416095e9a6037 HID: wacom: stop hardware after post-start probe failures
7ce2c7dd28ab8 HID: uhid: convert to hid_safe_input_report()
dae1d000ddfd5 HID: hid-goodix-spi: validate report size to prevent stack buffer overflow
abf07f5c3584f tools/mm/slabinfo: fix total_objects attribute name
e0eec7497bcc7 tools/mm/slabinfo: Fix trace disable logic inversion
2382971aaaef5 mm/slab: do not limit zeroing to orig_size when only red zoning is enabled
18d90dc05d98b X.509: Fix validation of ASN.1 certificate header
28390912740a2 perf/arm-cmn: Fix DVM node events
be79d285bea70 s390: Revert support for DCACHE_WORD_ACCESS
2421a7b24f9c8 clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances
cd25e9819620a time/jiffies: Register jiffies clocksource before usage
7776f9226e99e posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path
6ba6f6783be2f cpufreq: pcc: fix use-after-free and double free in _OSC evaluation
6e175c00c62dc cpufreq: Fix hotplug-suspend race during reboot
4bd0da48fbc1d sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT
f77e55baeeb8c cpufreq: intel_pstate: Sync policy->cur during CPU offline
59626d0d29217 perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box()
b9d45d328fcda libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo()
92f41769e5fd1 firmware_loader: fix device reference leak in firmware_upload_register()
e904961332801 cpufreq: qcom-cpufreq-hw: Fix possible double free
a277489337c7d OPP: of: Fix potential memory leak in opp_parse_supplies()
685fc15a41088 writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()
c6c484a7d5bff smb: client: mask server-provided mode to 07777 in modefromsid
157c67a657a7d smb: client: fix atime clamp check in read completion
86c5d470f5d42 smb: client: harden POSIX SID length parsing
3d89ae65ef78a smb: client: use unaligned reads in parse_posix_ctxt()
297243e365fc9 smb: client: Fix next buffer leak in receive_encrypted_standard()
d15d83125007f smb: client: fix double-free in SMB2_close() replay
14498ff5ce0f2 smb: client: fix double-free in SMB2_open() replay
3407240cde132 smb: client: fix double-free in SMB2_flush() replay
52af1975f0dfa smb: client: fix change notify replay double-free
276c8efbc49f9 smb: client: fix double-free in SMB2_ioctl() replay
f1add4acb656f smb: client: fix query_info() replay double-free
00b0fa4259414 smb: client: fix query directory replay double-free
2b4592cea2146 ksmbd: use opener credentials for ADS I/O
e72c15085b6d8 ksmbd: use opener credentials for delete-on-close
df501c0f320b5 ksmbd: add per-handle permission check to FILE_LINK_INFORMATION
2ca82bfff49c8 ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION
20ee516a62989 ksmbd: run set info with opener credentials
f56535db508ea ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY
db231af842868 ksmbd: require source read access for duplicate extents
5aa1cb01155f9 ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation
a1d5d31cad593 ksmbd: serialize QUERY_DIRECTORY requests per file
57f2042fd87d7 ksmbd: add a permission check for FSCTL_SET_ZERO_DATA
baae7b39673ec ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE
a187883cc1dc7 smb/client: Fix error code in smb2_aead_req_alloc()
91b8a58c6ac15 smb: client: resolve SWN tcon from live registrations
661a019ac0413 coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()
08fad5d5a26cc fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()
6dd58c56ab864 fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio()
764e6f76fdbd4 fs/ntfs3: fsync files by syncing parent inodes
38cbb1feebcf5 fs/ntfs3: rename ni_readpage_cmpr into ni_read_folio_cmpr
4718007870547 iommu/vt-d: Fix race condition during PASID entry replacement
73abbaf91aa33 Bluetooth: L2CAP: validate option length before reading conf opt value
d5616beb3355b Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock
b84eeb7636d69 Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()
b9dd39cf1667e Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled
61701912c58a0 Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()
26168db1ce5a9 Bluetooth: fix UAF in bt_accept_dequeue()
2a68a77308920 Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3()
a6b22dbd80926 Bluetooth: bnep: pin L2CAP connection during netdev registration
0039bdde36b23 Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()
81a5971cbe18b netfilter: flowtable: fix offloaded ct timeout never being extended
6fe8d3cecd20b netfilter: ebtables: terminate table name before find_table_lock()
13a5f532e3a4f netfilter: ebtables: module names must be null-terminated
9f74d28e903fa netfilter: ebtables: zero chainstack array
fc5bfe63bacf8 netfilter: handle unreadable frags
a8f03a3793289 netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump
69c0e6246575b mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent softlockup
b415c00bf23df mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless host
006467ab93269 mm: shrinker: fix NULL pointer dereference in debugfs
6465ff3ce6513 mm: shrinker: fix shrinker_info teardown race with expansion
560e21e8ccff8 mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()
b5f41d5bf08e7 mfd: cros_ec: Delay dev_set_drvdata() until probe success
bbae351c0f32f net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes
2ca18df1c2611 ipv4: igmp: remove multicast group from hash table on device destruction
a33f37f8d079d netpoll: fix a use-after-free on shutdown path
f090acf881a26 io_uring/rw: preserve partial result for iopoll
1636d85dc139b io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item
722869fcff598 io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE
4508366ab7dd0 gpio: sch: use raw_spinlock_t in the irq startup path
4750909a40da9 gpio: eic-sprd: use raw_spinlock_t in the irq startup path
f71e8d9875069 NTB: epf: Avoid calling pci_irq_vector() from hardirq context
cf28fc1658463 fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns
c00164c9e7fa6 debugobjects: Plug race against a concurrent OOM disable
cbb684ef39e9f coresight: etb10: restore atomic_t for shared reading state
b346efa825b5e Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete
d3b739db5dc6f Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref
fe997a84a385f audit: Fix data races of skb_queue_len() readers on audit_queue
e8417353cbd07 net: af_key: initialize alg_key_len for IPComp states
94083db751930 ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL
ef6feb77e2d91 crypto: krb5 - filter out async aead implementations at alloc
84a00be9b736a crypto: amlogic - avoid double cleanup in meson_crypto_probe()
6f91621fc4502 staging: rtl8723bs: fix OOB write in HT_caps_handler()
a6105ea8ca6eb staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop
c38d16b1ffac3 staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()
69f174a0673b6 staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop
04f612dc03427 staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop
64ec4192d9c10 staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()
b9c4bf133c3c4 staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()
b5ddc7257bee7 staging: media: ipu7: fix double-free and use-after-free in error paths
1ca4f310c6b1f staging: media: atomisp: reduce load_primary_binaries() stack usage
b4ba13dafa13c media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe
e3ceafa6d8ee6 staging: vme_user: fix location monitor leak in tsi148 bridge
a921486313975 staging: vme_user: fix location monitor leak in fake bridge
ceb875a375ded smb: client: restrict implied bcc[0] exemption to responses without data area
e99f2df433c63 staging: vme_user: bound slave read/write to the kern_buf size
2de42e2681747 tipc: fix out-of-bounds read in broadcast Gap ACK blocks
0beccbcf50de1 6lowpan: fix NHC entry use-after-free on error path
c40090f8d19b4 usb: misc: usbio: fix disconnect UAF in client teardown
c4e232bd07fe2 usb: dwc3: run gadget disconnect from sleepable suspend context
2a52d55c86a42 USB: chaoskey: Fix slab-use-after-free in chaoskey_release()
285e17c44e387 hwrng: virtio: clamp device-reported used.len at copy_data()
65e93ec592f5b virtio-mmio: fix device release warning on module unload
075bc3c779e1e virtio_pci: fix vq info pointer lookup via wrong index
81d54c766337b netfilter: ipset: fix race between dump and ip_set_list resize
9c8f31eaae614 mm/damon/ops-common: handle extreme intervals in damon_hot_score()
657646c08c94e tcp: restore RCU grace period in tcp_ao_destroy_sock
b775246212504 PCI/IOV: Skip VF Resizable BAR restore on read error
1115680bca1d7 PCI: qcom: Initialize DWC MSI lock for firmware-managed ECAM hosts
6e6a529d6f779 PCI: mediatek: Fix IRQ domain leak when port fails to enable
69416a5308675 PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling
1d2e66a4bc0dd PCI: host-common: Request bus reassignment when not probe-only
9c698af5c2a12 PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining
09c43b7b7d29c PCI: altera: Fix resource leaks on probe failure
5e42a981887d2 PCI: altera: Do not dispose parent IRQ mapping
d666c5aec822d PCI: loongson: Override PCIe bridge supported speeds for Loongson-3C6000 series
e5406c8fb71cd usb: typec: tcpci_rt1711h: unregister TCPCI port with devres
99d00a9e35e31 xhci: sideband: fix ring sg table pages leak
f90586129cf9e usb: xhci: Fix sleep in atomic context in xhci_free_streams()
91b27f8172cdb rust_binder: clear freeze listener on node removal
281335996ab21 rust_binder: synchronize Rust Binder stats with freeze commands
08e21d86d2722 rust_binder: reject context manager self-transaction
89b8cc948dce6 rust_binder: use a u64 stride when cleaning up the offsets array
328ccf32acb87 binder: fix UAF in binder_free_transaction()
ea02df466df60 binder: fix UAF in binder_thread_release()
17a2d3f903455 Bluetooth: btusb: fix wakeup source leak on probe failure
a7e941a395711 Bluetooth: btusb: fix use-after-free on marvell probe failure
8db0ce3de7836 Bluetooth: btusb: fix use-after-free on registration failure
79f9e221dddec Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB
a53109ffb6b51 vfio: Remove device debugfs before releasing devres
7f2d6b31089e4 vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc
ba96666d991e6 vfio/pci: Fix racy bitfields and tighten struct layout
52adb2dff7ce3 vfio/pci: Release the VGA arbiter client on register_device() failure
f6c67cf0051f9 vfio/pci: Latch disable_idle_d3 per device
a385d3435a7af vfio/pci: Use a private flag to prevent power state change with VFs
afc90150551dd ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes
54c448e4f26a7 ALSA: usb-audio: Update Babyface Pro control caches only after successful writes
f3e8a6cca15b8 ALSA: usb-audio: Roll back quirk control caches on write errors
3061b6c114458 ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks
bfd28b07541e5 ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()
a263eb12cbe2e ALSA: usb-audio: avoid kobject path lookup in DualSense match
16f14f55141d4 ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on each resubmission
651ba82fe2a14 ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()
71b87108ad93d ALSA: ice1712: check snd_ctl_new1() return value
04dd210180575 ALSA: hda/realtek: Fix noisy mic for Clevo V6xxAW
1933e6ee136b1 ALSA: hda/hdmi: Use 'AC_PINSENSE_ELDV' to detect pinsense for Loongson
4dd2552e559bd ALSA: hda/hdmi: Add force-connect quirk for HP EliteDesk 800 G5 Mini
ce0a903d0591e ALSA: hda/cs35l41: Fix firmware load work teardown
5e74e5e8cb7cc ALSA: gus: check snd_ctl_new1() return value
8e48a29813df8 ALSA: firewire: isight: bound the sample count to the packet payload
db25755e7629d ALSA: FCP: Add Focusrite ISA C8X support
9e53e99b6fa3c ALSA: es1938: check snd_ctl_new1() return value
b27a75d42044d ALSA: compress: Fix task creation error unwind
af2b009b773bc ALSA: cmipci: check snd_ctl_new1() return value
a5fd3122283bf ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser
fd786466889e4 ALSA: aoa: check snd_ctl_new1() return value
f6538a318947b ALSA: ymfpci: check snd_ctl_new1() return value
5da9742de22db ALSA: virtio: Validate control metadata from the device
df0fe53a7104b ALSA: virtio: Add missing 384 kHz PCM rate mapping
c071df05bcda0 ALSA: usx2y: us144mkii: fix work UAF on disconnect
a4f8491da9563 iio: temperature: tmp006: use devm_iio_trigger_register
62a0d75bedd4b iio: temperature: ltc2983: Fix reinit_completion() called after conversion start
e16258913be6a iio: temperature: ltc2983: Fix n_wires default bypassing rotation check
b50344ab202f3 iio: temperature: Build mlx90635 with CONFIG_MLX90635
7d4d60f7c0541 iio: resolver: ad2s1210: notify trigger and clear state on fault read error
c6ca87c7bbb3f iio: proximity: vl53l0x: notify trigger and clear IRQ on error paths
b3f1af4ba8e9c iio: pressure: mpl115: fix runtime PM leak on read error
e2d5b9673bf71 iio: pressure: bmp280: zero-init bmp580 trigger handler buffer
f829d6c32f31b iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call
0975e013179d3 iio: light: veml6030: fix channel type when pushing events
ef6c2a521454f iio: light: tsl2591: return actual error from probe IRQ failure
9d421c2827ea1 iio: light: opt3001: fix missing state reset on timeout
0c655d067ac69 iio: light: gp2ap002: fix runtime PM leak on read error
a60bf629a760d iio: light: al3320a: read both ALS ADC registers again
a1dafc918d793 iio: light: al3320a: add missing REGMAP_I2C to Kconfig
a00d471cf3580 iio: light: al3010: read both ALS ADC registers again
cd278561640c7 iio: light: al3010: fix incorrect scale for the highest gain range
9fb4ff07d97e3 iio: light: al3010: add missing REGMAP_I2C to Kconfig
6afb69bb969ed iio: light: al3000a: add missing REGMAP_I2C to Kconfig
482b24660ec3b iio: imu: st_lsm6dsx: deselect shub page before reading whoami
76e12a71ac053 iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading
34656a59322e5 iio: imu: inv_icm42600: fix timestamp clock period by using lower value
0522819228284 iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ
bdafd53ae671e iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ
001527e2382e3 iio: gyro: bmg160: wait full startup time after mode change at probe
7bbf02b63961f iio: gyro: bmg160: bail out when bandwidth/filter is not in table
9edefd4c56bee iio: event: Fix event FIFO reset race
2358da87315d1 iio: dac: ad3552r-hs: fix uninitialized data ni ad3552r_hs_write_data_source()
e166a8cfb28a3 iio: core: fix uninitialized data in debugfs
b947bde73461f iio: common: st_sensors: honour channel endianness in read_axis_data
82accdd574043 iio: chemical: scd30: Cleanup initializations and fix sign-extension bug
c28835b8618ec iio: backend: fix uninitialized data in debugfs
0f30e68dd6c1f iio: adc: ti-ads124s08: Return reset GPIO lookup errors
ffb2195921c3d iio: adc: ti-ads1119: fix PM reference leak in buffer preenable
bbfebae473ac2 iio: adc: spear: Initialize completion before requesting IRQ
9e2e8b8cdfd37 iio: adc: lpc32xx: Initialize completion before requesting IRQ
c313bb7c38855 iio: adc: ad_sigma_delta: fix CS held asserted and state leaks
3394e0b332842 iio: adc: ad_sigma_delta: fix clear_pending_event for registerless devices
46e93fcbe7c2c iio: adc: ad7779: add missing 'select IIO_TRIGGERED_BUFFER' to Kconfig
24a9514b606e7 iio: adc: ad7768-1: Select GPIOLIB
e6ade81631d76 iio: adc: ad7380: select REGMAP
6293211d14260 iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error
3e766526827ac iio: accel: bmc150: clamp the device-reported FIFO frame count
7515a6d4a9e9e usb: gadget: function: rndis: add length check for header
e01e7814b4223 usb: gadget: function: rndis: add length check to response query
9d1dc507b99ce fscrypt: Replace mk_users keyring with simple list
85f8b440a09ba fscrypt: Fix key setup in edge case with multiple data unit sizes
20133754d46fe rust: kasan: KASAN+RUST requires clang
a2d5d3ee7b6e3 perf/core: Detach event groups during remove_on_exec
94396fd93226a futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock""
1cc8f512cd905 rust: Kbuild: set frame-pointer llvm module flag for CONFIG_FRAME_POINTER
70fe1ac8647b0 rust: doctest: fix incorrect pattern in replacement
e7636f26f7707 rust: block: fix GenDisk cleanup paths
c1dd0b1071004 rust: cpufreq: clean new `clippy::map_or_identity` lint for Rust 1.98.0
30d5d4eef35a9 LoongArch: Add PIO for early access before ACPI PCI root register
86df6499dfd23 platform/x86: intel-hid: Protect ACPI notify handler against recursion
452945662fd8e ACPI: NFIT: core: Fix possible NULL pointer dereference
f29dc6132d496 ACPI: CPPC: Suppress UBSAN warning caused by field misuse
ff9c4c6428883 KVM: x86: Unconditionally recompute CR8 intercept on PPR update
3dcfb04dd43b1 KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode
0d0187a46b16e KVM: x86: Move update_cr8_intercept() to lapic.c
9baa2833e6bc8 perf trace beauty fcntl: Fix build with older kernel headers
47e4c6e06e78e slab: recognize @GFP parameter as optional in kernel-doc
1776f29327a13 default_gfp(): avoid using the "newfangled" __VA_OPT__ trick
50c26b461b8e7 add default_gfp() helper macro and use it in the new *alloc_obj() helpers
2dca62902eb35 slab: Introduce kmalloc_flex() and family
1c2672781b1b3 mm/khugepaged: write all dirty file folios when collapsing
2539f67b75461 nfsd: change nfs4_client_to_reclaim() to allocate data
05e48af3bf58d nfsd: move name lookup out of nfsd4_list_rec_dir()
c4b70c1512b8f net/sched: dualpi2: fix GSO backlog accounting
076b1aa65f77a fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()
406c28af75123 f2fs: fix to do sanity check on f2fs_get_node_folio_ra()
3f42fbd3c891d f2fs: detect more inconsistent cases in sanity_check_node_footer()
ed87e57558dc5 f2fs: optimize trace_f2fs_write_checkpoint with enums
8dbc4c5686820 f2fs: introduce f2fs_schedule_timeout()
599d7d82eeecc f2fs: use memalloc_retry_wait() as much as possible
ec9f79c8d5b28 f2fs: fix listxattr handling of corrupted xattr entries
89479a27fa4e1 f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()
998536c96b6ad f2fs: fix potential deadlock in f2fs_balance_fs()
4ce2d52f680c1 f2fs: bound i_inline_xattr_size for non-inline-xattr inodes
a499f77c06050 f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode
5a4d3968cf820 f2fs: remove non-uptodate folio from the page cache in move_data_block
9c86a1f930bb2 device property: initialize the remaining fields of fwnode_handle in fwnode_init()
60d696a037eee userfaultfd: gate must_wait writability check on pte_present()
3436a7dd067c5 rust: str: clean unused import for Rust >= 1.98
3603500c868a1 rust: str: use the "kernel vertical" imports style
8dee7c278f1c2 nfsd: release layout stid on setlease failure
6f88ca186a984 nfsd: update mtime/ctime on COPY in presence of delegated attributes
7c702bb4f8d83 nfsd: update mtime/ctime on CLONE in presense of delegated attributes
501543207378f bpf, arm64: Reject out-of-range B.cond targets
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
---
.../linux/linux-yocto-rt_6.18.bb | 6 ++---
.../linux/linux-yocto-tiny_6.18.bb | 6 ++---
meta/recipes-kernel/linux/linux-yocto_6.18.bb | 24 +++++++++----------
3 files changed, 18 insertions(+), 18 deletions(-)
diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb b/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb
index 23c43c0cc1..6d287cdc7d 100644
--- a/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb
@@ -15,13 +15,13 @@ python () {
raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it")
}
-SRCREV_machine ?= "0d0c54addf4ff32e49c485061bd9ea5bde241d94"
-SRCREV_meta ?= "bf23930cc9805c0e87bdaff762832446c730a39b"
+SRCREV_machine ?= "0156acd2db993abc3baa366fee892d503aab1ccc"
+SRCREV_meta ?= "2f71b0a288c307062fc60948ac793d8d51c685e2"
SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine;protocol=https \
git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.18;destsuffix=${KMETA};protocol=https"
-LINUX_VERSION ?= "6.18.38"
+LINUX_VERSION ?= "6.18.39"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb
index e186b5f992..8b9201a73e 100644
--- a/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb
@@ -9,7 +9,7 @@ require recipes-kernel/linux/linux-yocto.inc
include recipes-kernel/linux/cve-exclusion.inc
include recipes-kernel/linux/cve-exclusion_6.18.inc
-LINUX_VERSION ?= "6.18.38"
+LINUX_VERSION ?= "6.18.39"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}"
@@ -18,8 +18,8 @@ DEPENDS += "openssl-native util-linux-native"
KMETA = "kernel-meta"
KCONF_BSP_AUDIT_LEVEL = "2"
-SRCREV_machine ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636"
-SRCREV_meta ?= "bf23930cc9805c0e87bdaff762832446c730a39b"
+SRCREV_machine ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e"
+SRCREV_meta ?= "2f71b0a288c307062fc60948ac793d8d51c685e2"
PV = "${LINUX_VERSION}+git"
diff --git a/meta/recipes-kernel/linux/linux-yocto_6.18.bb b/meta/recipes-kernel/linux/linux-yocto_6.18.bb
index 5c849202ad..8528869a5e 100644
--- a/meta/recipes-kernel/linux/linux-yocto_6.18.bb
+++ b/meta/recipes-kernel/linux/linux-yocto_6.18.bb
@@ -17,25 +17,25 @@ KBRANCH:qemux86-64 ?= "v6.18/standard/base"
KBRANCH:qemuloongarch64 ?= "v6.18/standard/base"
KBRANCH:qemumips64 ?= "v6.18/standard/mti-malta"
-SRCREV_machine:qemuarm ?= "053c98bdd6c074a24771d69d24ff077f6016b299"
-SRCREV_machine:qemuarm64 ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636"
-SRCREV_machine:qemuloongarch64 ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636"
+SRCREV_machine:qemuarm ?= "162946cfb65f28f0a5f60e927bdae5615e6356a8"
+SRCREV_machine:qemuarm64 ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e"
+SRCREV_machine:qemuloongarch64 ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e"
SRCREV_machine:qemumips ?= "62ea92a539f58803a222be98b81118403074206e"
-SRCREV_machine:qemuppc ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636"
-SRCREV_machine:qemuriscv64 ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636"
-SRCREV_machine:qemuriscv32 ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636"
-SRCREV_machine:qemux86 ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636"
-SRCREV_machine:qemux86-64 ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636"
+SRCREV_machine:qemuppc ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e"
+SRCREV_machine:qemuriscv64 ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e"
+SRCREV_machine:qemuriscv32 ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e"
+SRCREV_machine:qemux86 ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e"
+SRCREV_machine:qemux86-64 ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e"
SRCREV_machine:qemumips64 ?= "9fb4ff0187c85426f21fd40d4c61b742800f65c4"
-SRCREV_machine ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636"
-SRCREV_meta ?= "bf23930cc9805c0e87bdaff762832446c730a39b"
+SRCREV_machine ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e"
+SRCREV_meta ?= "2f71b0a288c307062fc60948ac793d8d51c685e2"
# set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll
# get the <version>/base branch, which is pure upstream -stable, and the same
# meta SRCREV as the linux-yocto-standard builds. Select your version using the
# normal PREFERRED_VERSION settings.
BBCLASSEXTEND = "devupstream:target"
-SRCREV_machine:class-devupstream ?= "e46dc0adfe39724bcf52cea47b8f9c9aed86a394"
+SRCREV_machine:class-devupstream ?= "f89c296854b755a66657065c35b05406fc18264d"
PN:class-devupstream = "linux-yocto-upstream"
KBRANCH:class-devupstream = "v6.18/base"
@@ -43,7 +43,7 @@ SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;name=machine;branch=${KBRA
git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.18;destsuffix=${KMETA};protocol=https"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
-LINUX_VERSION ?= "6.18.38"
+LINUX_VERSION ?= "6.18.39"
PV = "${LINUX_VERSION}+git"
--
2.43.0
^ permalink raw reply related
* [PATCH 0/6] kernel-yocto: stable udpates
From: bruce.ashfield @ 2026-07-20 15:58 UTC (permalink / raw)
To: richard.purdie; +Cc: openembedded-core
From: Bruce Ashfield <bruce.ashfield@gmail.com>
Richard,
Here's the latest round of 6.18 -stable updates.
I'm in the process of updating the -dev kernel to v7.2, and that will
be the release kernel for the fall release. The plan is to keep 6.18
in the release and add 7.2 for those needing a newer reference.
As usual, this is a single series spanning oe-core and yocto-bsps
to show that they are in sync. If it causes problems, let me know and
I can send separately.
libc-headers will also be bumped.
Other than that, this is a routine set of updates.
Bruce
openembedded-core (3):
linux-yocto/6.18: update to v6.18.36
linux-yocto/6.18: update to v6.18.38
linux-yocto/6.18: update to v6.18.39
meta-yocto (3):
yocto-bsps: update to v6.18.36
yocto-bsps: update to v6.18.38
yocto-bsps: update to v6.18.39
openembedded-core:
meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb | 6 +++---
meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb | 6 +++---
meta/recipes-kernel/linux/linux-yocto_6.18.bb | 24 ++++++++++++------------
3 files changed, 18 insertions(+), 18 deletions(-)
meta-yocto:
meta-yocto-bsp/recipes-kernel/linux/linux-yocto_6.18.bbappend | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--
2.43.0
^ permalink raw reply
* Re: [OE-core] [PATCH 03/12] libpsl: use libidn2 instead of ICU
From: Ross Burton @ 2026-07-20 15:45 UTC (permalink / raw)
To: Khem Raj; +Cc: Patches and discussions about the oe-core layer
In-Reply-To: <CAMKF1sraBgBmbCpkpARTZK8y62F_uC2+ydM2aLsmBvO2JGFu_A@mail.gmail.com>
On 20 Jul 2026, at 16:18, Khem Raj <raj.khem@gmail.com> wrote:
> Yes that certainly helps and maybe its fine to use libidn2 as default. However there are valid use cases in real products of using ICU since ICU is used system wide as well by many other applications in those systems and ICU data can be regenerated to contain just the data you need default kitchen sink of 30MB is not real usecase.
Sure, and the option to switch it back to ICU will remain.
Ross
^ permalink raw reply
* Re: [OE-core] [wrynose][PATCH] kernel-fit-image.bbclass: Do not include kernel property in DTBO config subnodes
From: Marek Vasut @ 2026-07-20 15:31 UTC (permalink / raw)
To: Yoann Congal, adrian.freihofer, Freihofer, Adrian,
openembedded-core@lists.openembedded.org
Cc: Ryan Eatmon
In-Reply-To: <DK3HZYI7OV4C.YF3JS912EHFG@smile.fr>
On 7/20/26 5:19 PM, Yoann Congal wrote:
Hello Yoann,
>>> [1] https://patchwork.yoctoproject.org/project/oe-core/
>>> patch/20260704214812.365483-1-marek.vasut@mailbox.org/
>>> [2] https://patchwork.yoctoproject.org/project/oe-core/
>>> patch/20260630074356.10265-1-marek.vasut@mailbox.org/
>>> [3] https://patchwork.yoctoproject.org/project/oe-core/
>>> patch/20260630074423.10306-1-marek.vasut@mailbox.org/
>>
>> Do you think those three backports can be picked up for OE wrynose ?
>>
>> Thank you for your help !
>
> Sure! They even are in the branch I sent for review:
> https://lore.kernel.org/all/cover.1784364567.git.yoann.congal@smile.fr/
Oh, that's nice.
> Following Paul's review, I will most likely hold it for one cycle in order to merge
> the test at the same time.
> See: https://lore.kernel.org/all/c791b1b82e236039c614ab41402844c965fdc6c5.camel@pbarker.dev/
Thank you !
--
Best regards,
Marek Vasut
^ permalink raw reply
* Re: [OE-core][wrynose 05/17] kernel-fit-image: Add KERNEL_DTBVENDORED support for FIT_CONF_DEFAULT_DTB
From: Yoann Congal @ 2026-07-20 15:30 UTC (permalink / raw)
To: Yoann Congal, Paul Barker, openembedded-core; +Cc: Ryan Eatmon
In-Reply-To: <DK3HWGV0JCOP.14DJEFKWLP67L@smile.fr>
On Mon Jul 20, 2026 at 5:15 PM CEST, Yoann Congal wrote:
> On Mon Jul 20, 2026 at 9:39 AM CEST, Paul Barker wrote:
>> On Sat, 2026-07-18 at 10:52 +0200, Yoann Congal wrote:
>>> From: Ryan Eatmon <reatmon@ti.com>
>>>
>>> When specifying a FIT_CONF_DEFAULT_DTB for a machine, you have to
>>> exactly align the name with what will be in the fitImage file or you
>>> will get a build error. If you also turn on KERNEL_DTBVENDORED then you
>>> must also specify the vendor directory as part of the dtb name that you
>>> want for the default, but you must manually do the same mapping that the
>>> kernel-fit-image class is doing when it generates the fit-image.its file.
>>>
>>> This patch just adds the same logic to figure out the value for the
>>> requested default dtb and eliminate the need to understand the internal
>>> mapping of the class. It should make specifying the value more
>>> intuitive. The same value that you put in the KERNEL_DEVICETREE can be
>>> used in the FIT_CONF_DEFAULT_DTB and the new code will correctly honor
>>> the KERNEL_DTBVENDORED setting.
>>>
>>> Before:
>>>
>>> KERNEL_DEVICETREE = "
>>> ti/k3-am62p5-sk.dtb \
>>> ... \
>>> "
>>> FIT_CONF_DEFAULT_DTB = "ti_k3-am62p5-sk.dtb"
>>>
>>> After:
>>>
>>> KERNEL_DEVICETREE = "
>>> ti/k3-am62p5-sk.dtb \
>>> ... \
>>> "
>>> FIT_CONF_DEFAULT_DTB = "ti/k3-am62p5-sk.dtb"
>>>
>>> Signed-off-by: Ryan Eatmon <reatmon@ti.com>
>>> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
>>> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
>>> (cherry picked from commit 3bceb2dabeee13c0a80ddd74ea7ae991606d6772)
>>> Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
>>
>> Hi Yoann,
>>
>> This looks like an enhancement rather than a bug fix. If there is a
>> strong reason to backport it though we could take it as it's small, self
>> contained and not invasive.
>
> I interpreted the mismatch between KERNEL_DEVICETREE and
> FIT_CONF_DEFAULT_DTB as a bug to solve.
> But one could argue that each variable has its syntax, a bit weird but
> not worthy of a stable fix.
>
> I still think this is worth fixing though.
>
>>
>> Does the previous syntax (FIT_CONF_DEFAULT_DTB = "ti_k3-am62p5-sk.dtb")
>> still work after this patch?
>
> As I read it, the patch only add a .replace('/', '_') (when
> KERNEL_DTBVENDORED="1") so the old syntax should be preserved.
>
>> If we do take this, should we take the accompanying test case [1]?
>>
>> [1]: https://lore.kernel.org/openembedded-core/20260706221933.4026508-2-reatmon@ti.com/
>
> Yes, Ryan suggested it but it was not yet merged when I reviewed it.
>
> Now it has merged, I think I should hold the series:
> * oe-selftest: fitimage: Do not expect kernel property in DTBO config subnodes
> * kernel-fit-image.bbclass: Do not include kernel property in DTBO config subnodes
> * kernel-fit-image.bbclass: Fix operation with KERNEL_DTBVENDORED = "1"
> * kernel-fit-image: Add KERNEL_DTBVENDORED support for FIT_CONF_DEFAULT_DTB
> ... until next wrynose review cycle, and add
> * de2e11e6362 - oe-selftest: fitimage: Add tests for KERNEL_DTBVENDORED
> from master to test it.
To clarify, I expect a backport patch of "oe-selftest: fitimage: Add
tests for KERNEL_DTBVENDORED" for wrynose from Ryan. The cherry-pick is not
trivial.
--
Yoann Congal
Smile ECS
^ permalink raw reply
* Re: [PATCH] kernel.bbclass: pass args instead of tuple of args to runstrip()
From: Robert P. J. Day @ 2026-07-20 15:30 UTC (permalink / raw)
To: Quentin Schulz; +Cc: openembedded-core, Quentin Schulz
In-Reply-To: <20260720-runstrip-not-tuple-arg-v1-1-e07764fe3f41@cherry.de>
On Mon, 20 Jul 2026, Quentin Schulz wrote:
> From: Quentin Schulz <quentin.schulz@cherry.de>
>
> Since commit 7c99f90079e7 ("lib/package/utils: Improve
> multiprocess_launch argument passing"), runstrip() now expects arguments
> individually instead as a big tuple so let's fix the one user in OE-Core
> of that function which we forgot to migrate.
>
> Fixes: 7c99f90079e7 ("lib/package/utils: Improve multiprocess_launch argument passing")
> Reported-by: Robert P. J. Day <rpjday@crashcourse.ca>
> Closes: https://lore.kernel.org/openembedded-core/319bb00c-9712-4aa7-38b0-e1ad2bab840b@crashcourse.ca/
> Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
> ---
> Not tested. Just read the code and found an issue. Robert, can you give
> this a try maybe?
> ---
> meta/classes-recipe/kernel.bbclass | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/meta/classes-recipe/kernel.bbclass b/meta/classes-recipe/kernel.bbclass
> index 48e394b650..91248467be 100644
> --- a/meta/classes-recipe/kernel.bbclass
> +++ b/meta/classes-recipe/kernel.bbclass
> @@ -750,7 +750,7 @@ python do_strip() {
> if (extra_sections and kernel_image.find(d.getVar('KERNEL_IMAGEDEST') + '/vmlinux') != -1):
> kernel_image_stripped = kernel_image + ".stripped"
> shutil.copy2(kernel_image, kernel_image_stripped)
> - oe.package.runstrip((kernel_image_stripped, 8, strip, extra_sections))
> + oe.package.runstrip(kernel_image_stripped, 8, strip, extra_sections)
> bb.debug(1, "KERNEL_IMAGE_STRIP_EXTRA_SECTIONS is set, stripping sections: " + \
> extra_sections)
> }
>
> ---
> base-commit: aa33c4317dbe3e46e903d5350771413959462b37
> change-id: 20260720-runstrip-not-tuple-arg-97483264ad89
>
> Best regards,
> --
> Quentin Schulz <quentin.schulz@cherry.de>
>
Tested-by: Robert P. J. Day <rpjday@crashcourse.ca>
^ permalink raw reply
* Re: [OE-core] [wrynose][PATCH] kernel-fit-image.bbclass: Do not include kernel property in DTBO config subnodes
From: Yoann Congal @ 2026-07-20 15:19 UTC (permalink / raw)
To: Marek Vasut, adrian.freihofer, Freihofer, Adrian,
openembedded-core@lists.openembedded.org
Cc: Ryan Eatmon
In-Reply-To: <2304e3c8-1b90-4bbf-8022-80f19d1447a7@mailbox.org>
On Mon Jul 20, 2026 at 5:09 PM CEST, Marek Vasut wrote:
> On 7/4/26 11:55 PM, Marek Vasut wrote:
>
> Hello one more time,
>
>>>>>> I guess, before this patch can be applied, this one (or a back-
>>>>>> port of
>>>>>> it) is required:
>>>>>> https://git.openembedded.org/openembedded-core/commit/?
>>>>>> id=85e0408a81bdca0411a8625061e5e343c05f92d9
>>>>>> Otherwise, the oe-selftest fail.
>>>>> Thank you for staying vigilant.
>>>>>
>>>>> Yoann, can you please pick the aforementioned commit too ?
>>>>>
>>>>> Thank you for your help !
>>>>
>>>> Hello,
>>>>
>>>> I missed that discussion, sorry. But was reminded by Ryan (thanks).
>>>>
>>>> If I understood correclty, the set of patches we need for wrynose is:
>>>> * kernel-fit-image.bbclass: Do not include kernel property in DTBO
>>>> config subnodes
>>>> * kernel-fit-image.bbclass: Fix operation with KERNEL_DTBVENDORED =
>>>> "1"
>>>> * oe-selftest: fitimage: Do not expect kernel property in DTBO config
>>>> subnodes
>>>> * kernel-fit-image: Add KERNEL_DTBVENDORED support for
>>>> FIT_CONF_DEFAULT_DTB (this one is not merged on master yet)
>>>>
>>>> Marek, Adrian, Ryan: does that sound correct?
>>>>
>>>
>>> Yes, that's correct. One little detail is the order of the patches. If
>>> you pick the oe-selftest commit first, all commits are compile and
>>> test-able. That's my suggestion:
>>>
>>> * oe-selftest: fitimage: Do not expect kernel property in DTBO config
>>> subnodes
>>
>> This is [1].
>>
>>> * kernel-fit-image.bbclass: Do not include kernel property in DTBO
>>> config subnodes
>>
>> This is [2].
>>
>>> * kernel-fit-image.bbclass: Fix operation with KERNEL_DTBVENDORED =
>>> "1"
>>
>> This is [3].
>>
>>> * kernel-fit-image: Add KERNEL_DTBVENDORED support for
>>> FIT_CONF_DEFAULT_DTB (this one is not merged on master yet)
>>
>> This is still not even in master-next .
>>
>>> same order as on master branch.
>>
>> Thank you for your help !
>>
>> [1] https://patchwork.yoctoproject.org/project/oe-core/
>> patch/20260704214812.365483-1-marek.vasut@mailbox.org/
>> [2] https://patchwork.yoctoproject.org/project/oe-core/
>> patch/20260630074356.10265-1-marek.vasut@mailbox.org/
>> [3] https://patchwork.yoctoproject.org/project/oe-core/
>> patch/20260630074423.10306-1-marek.vasut@mailbox.org/
>
> Do you think those three backports can be picked up for OE wrynose ?
>
> Thank you for your help !
Sure! They even are in the branch I sent for review:
https://lore.kernel.org/all/cover.1784364567.git.yoann.congal@smile.fr/
Following Paul's review, I will most likely hold it for one cycle in order to merge
the test at the same time.
See: https://lore.kernel.org/all/c791b1b82e236039c614ab41402844c965fdc6c5.camel@pbarker.dev/
Regards,
--
Yoann Congal
Smile ECS
^ permalink raw reply
* Re: [OE-core] [PATCH 03/12] libpsl: use libidn2 instead of ICU
From: Khem Raj @ 2026-07-20 15:18 UTC (permalink / raw)
To: Ross Burton; +Cc: Patches and discussions about the oe-core layer
In-Reply-To: <A4197DA1-6F0E-4267-BFAB-235AE2728B9F@arm.com>
[-- Attachment #1: Type: text/plain, Size: 1281 bytes --]
On Mon, Jul 20, 2026, 2:12 AM Ross Burton <Ross.Burton@arm.com> wrote:
> On 18 Jul 2026, at 17:08, Khem Raj <raj.khem@gmail.com> wrote:
> > libidn2 default was switched to build non-GPL3 images conveniently by
> > switching to use ICU, where ICU is used by embedded systems more
> commonly
> > than libidn2.
>
> Luckily the library is dual-licensed which should help this. Only the
> -bin package is v3-only.
>
> Yes that certainly helps and maybe its fine to use libidn2 as default.
> However there are valid use cases in real products of using ICU since ICU
> is used system wide as well by many other applications in those systems and
> ICU data can be regenerated to contain just the data you need default
> kitchen sink of 30MB is not real usecase.
> Switch back to libidn2 to respect upstream's opinion, and because ICU is
> > a monolithic dependency: this switch causes a minimal image containg
> > libpsl to shrink by ~30MB.
> >
> > Which production image are you building ?
>
> Production images are obviously hard to compare, so I was comparing
> minimal. Basically ICU is large, libidn2 is likely already present (gnutls
> and curl use it by default), so if you’re not otherwise using ICU that’s a
> big saving.
>
> Ross
>
>
[-- Attachment #2: Type: text/html, Size: 1970 bytes --]
^ permalink raw reply
* Re: [OE-core][wrynose 05/17] kernel-fit-image: Add KERNEL_DTBVENDORED support for FIT_CONF_DEFAULT_DTB
From: Yoann Congal @ 2026-07-20 15:15 UTC (permalink / raw)
To: Paul Barker, openembedded-core; +Cc: Ryan Eatmon
In-Reply-To: <c791b1b82e236039c614ab41402844c965fdc6c5.camel@pbarker.dev>
On Mon Jul 20, 2026 at 9:39 AM CEST, Paul Barker wrote:
> On Sat, 2026-07-18 at 10:52 +0200, Yoann Congal wrote:
>> From: Ryan Eatmon <reatmon@ti.com>
>>
>> When specifying a FIT_CONF_DEFAULT_DTB for a machine, you have to
>> exactly align the name with what will be in the fitImage file or you
>> will get a build error. If you also turn on KERNEL_DTBVENDORED then you
>> must also specify the vendor directory as part of the dtb name that you
>> want for the default, but you must manually do the same mapping that the
>> kernel-fit-image class is doing when it generates the fit-image.its file.
>>
>> This patch just adds the same logic to figure out the value for the
>> requested default dtb and eliminate the need to understand the internal
>> mapping of the class. It should make specifying the value more
>> intuitive. The same value that you put in the KERNEL_DEVICETREE can be
>> used in the FIT_CONF_DEFAULT_DTB and the new code will correctly honor
>> the KERNEL_DTBVENDORED setting.
>>
>> Before:
>>
>> KERNEL_DEVICETREE = "
>> ti/k3-am62p5-sk.dtb \
>> ... \
>> "
>> FIT_CONF_DEFAULT_DTB = "ti_k3-am62p5-sk.dtb"
>>
>> After:
>>
>> KERNEL_DEVICETREE = "
>> ti/k3-am62p5-sk.dtb \
>> ... \
>> "
>> FIT_CONF_DEFAULT_DTB = "ti/k3-am62p5-sk.dtb"
>>
>> Signed-off-by: Ryan Eatmon <reatmon@ti.com>
>> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
>> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
>> (cherry picked from commit 3bceb2dabeee13c0a80ddd74ea7ae991606d6772)
>> Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
>
> Hi Yoann,
>
> This looks like an enhancement rather than a bug fix. If there is a
> strong reason to backport it though we could take it as it's small, self
> contained and not invasive.
I interpreted the mismatch between KERNEL_DEVICETREE and
FIT_CONF_DEFAULT_DTB as a bug to solve.
But one could argue that each variable has its syntax, a bit weird but
not worthy of a stable fix.
I still think this is worth fixing though.
>
> Does the previous syntax (FIT_CONF_DEFAULT_DTB = "ti_k3-am62p5-sk.dtb")
> still work after this patch?
As I read it, the patch only add a .replace('/', '_') (when
KERNEL_DTBVENDORED="1") so the old syntax should be preserved.
> If we do take this, should we take the accompanying test case [1]?
>
> [1]: https://lore.kernel.org/openembedded-core/20260706221933.4026508-2-reatmon@ti.com/
Yes, Ryan suggested it but it was not yet merged when I reviewed it.
Now it has merged, I think I should hold the series:
* oe-selftest: fitimage: Do not expect kernel property in DTBO config subnodes
* kernel-fit-image.bbclass: Do not include kernel property in DTBO config subnodes
* kernel-fit-image.bbclass: Fix operation with KERNEL_DTBVENDORED = "1"
* kernel-fit-image: Add KERNEL_DTBVENDORED support for FIT_CONF_DEFAULT_DTB
... until next wrynose review cycle, and add
* de2e11e6362 - oe-selftest: fitimage: Add tests for KERNEL_DTBVENDORED
from master to test it.
Thanks!
--
Yoann Congal
Smile ECS
^ permalink raw reply
* Re: [OE-core] [wrynose][PATCH] kernel-fit-image.bbclass: Do not include kernel property in DTBO config subnodes
From: Marek Vasut @ 2026-07-20 15:09 UTC (permalink / raw)
To: adrian.freihofer, yoann.congal, Freihofer, Adrian,
openembedded-core@lists.openembedded.org
Cc: Ryan Eatmon
In-Reply-To: <e4369955-eae6-4c45-b00c-01ca18d94fa2@mailbox.org>
On 7/4/26 11:55 PM, Marek Vasut wrote:
Hello one more time,
>>>>> I guess, before this patch can be applied, this one (or a back-
>>>>> port of
>>>>> it) is required:
>>>>> https://git.openembedded.org/openembedded-core/commit/?
>>>>> id=85e0408a81bdca0411a8625061e5e343c05f92d9
>>>>> Otherwise, the oe-selftest fail.
>>>> Thank you for staying vigilant.
>>>>
>>>> Yoann, can you please pick the aforementioned commit too ?
>>>>
>>>> Thank you for your help !
>>>
>>> Hello,
>>>
>>> I missed that discussion, sorry. But was reminded by Ryan (thanks).
>>>
>>> If I understood correclty, the set of patches we need for wrynose is:
>>> * kernel-fit-image.bbclass: Do not include kernel property in DTBO
>>> config subnodes
>>> * kernel-fit-image.bbclass: Fix operation with KERNEL_DTBVENDORED =
>>> "1"
>>> * oe-selftest: fitimage: Do not expect kernel property in DTBO config
>>> subnodes
>>> * kernel-fit-image: Add KERNEL_DTBVENDORED support for
>>> FIT_CONF_DEFAULT_DTB (this one is not merged on master yet)
>>>
>>> Marek, Adrian, Ryan: does that sound correct?
>>>
>>
>> Yes, that's correct. One little detail is the order of the patches. If
>> you pick the oe-selftest commit first, all commits are compile and
>> test-able. That's my suggestion:
>>
>> * oe-selftest: fitimage: Do not expect kernel property in DTBO config
>> subnodes
>
> This is [1].
>
>> * kernel-fit-image.bbclass: Do not include kernel property in DTBO
>> config subnodes
>
> This is [2].
>
>> * kernel-fit-image.bbclass: Fix operation with KERNEL_DTBVENDORED =
>> "1"
>
> This is [3].
>
>> * kernel-fit-image: Add KERNEL_DTBVENDORED support for
>> FIT_CONF_DEFAULT_DTB (this one is not merged on master yet)
>
> This is still not even in master-next .
>
>> same order as on master branch.
>
> Thank you for your help !
>
> [1] https://patchwork.yoctoproject.org/project/oe-core/
> patch/20260704214812.365483-1-marek.vasut@mailbox.org/
> [2] https://patchwork.yoctoproject.org/project/oe-core/
> patch/20260630074356.10265-1-marek.vasut@mailbox.org/
> [3] https://patchwork.yoctoproject.org/project/oe-core/
> patch/20260630074423.10306-1-marek.vasut@mailbox.org/
Do you think those three backports can be picked up for OE wrynose ?
Thank you for your help !
--
Best regards,
Marek Vasut
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox