From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 921FF205E25; Sat, 11 Apr 2026 12:53:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775912005; cv=none; b=uua7aw0j2zc2DT01iPhVDlT9uIdaJu/iC1kNfEChIjCYcfdSJYGk0SaHrqrdDPRxh3kJF0DxXdHjqqUon4ZQpwmkygG7nEXFNVApTvHDXQYtg9E0Ng3plLASvoH5+0JIV+XF/kDcs5C+sCOdg//nqH5L2J9/krVQQ9sXBaLUZEM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775912005; c=relaxed/simple; bh=8x7MP+8+hTIHq/afnIFk3ONP01thXLQL0HFOO2mT+ss=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=hSspHGqoKXKo9wI+J1osuyQI2wh4oNCqcZPDk43yBtQurNZE4IHxT5EXL3enFhhHzz0yW92qs3/PH2jG8eSip0StBisijRPXBNrr0cVzFDitiwwyOCq29AsEJ5DZzflbf9xcr1JpRc+INX5hIHlQnv6+fL/Dx2cpREWQnByB4Yw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=NhA7el6/; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="NhA7el6/" Received: by smtp.kernel.org (Postfix) with ESMTPSA id EA1ECC116C6; Sat, 11 Apr 2026 12:53:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1775912005; bh=8x7MP+8+hTIHq/afnIFk3ONP01thXLQL0HFOO2mT+ss=; h=From:To:Cc:Subject:Date:From; b=NhA7el6/zTPHFvviFak/P6gcxwu88F8LEEYX/1dSNgcbE07LNjPW/GfLjlDhTGlnw vBqqDy7X+RXnPOjZ/mDw/vIcebx/KsbYVzFaODqQmj9KdbJQHzjLw5nofX3vBPdP/d Z7gGeqgau80/qiOjyftscXtRQ0yqsYE56YXkez7s= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, akpm@linux-foundation.org, torvalds@linux-foundation.org, stable@vger.kernel.org Cc: lwn@lwn.net, jslaby@suse.cz, Greg Kroah-Hartman Subject: Linux 6.6.134 Date: Sat, 11 Apr 2026 14:53:17 +0200 Message-ID: <2026041118-untouched-reveal-cd6a@gregkh> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit I'm announcing the release of the 6.6.134 kernel. All users of the 6.6 kernel series must upgrade. The updated 6.6.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.6.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Documentation/devicetree/bindings/auxdisplay/holtek,ht16k33.yaml | 2 Documentation/devicetree/bindings/connector/usb-connector.yaml | 1 Documentation/devicetree/bindings/gpio/microchip,mpfs-gpio.yaml | 4 Makefile | 2 arch/arm64/kernel/patch-scs.c | 8 arch/loongarch/include/asm/linkage.h | 36 + arch/loongarch/include/asm/sigframe.h | 9 arch/loongarch/kernel/asm-offsets.c | 2 arch/loongarch/kernel/signal.c | 6 arch/loongarch/vdso/Makefile | 4 arch/loongarch/vdso/sigreturn.S | 6 arch/mips/lib/multi3.c | 6 arch/mips/mm/tlb-r4k.c | 2 arch/mips/ralink/clk.c | 8 arch/riscv/kernel/kgdb.c | 7 arch/x86/kernel/cpu/common.c | 18 crypto/af_alg.c | 4 drivers/accel/qaic/qaic_control.c | 47 + drivers/comedi/drivers.c | 8 drivers/comedi/drivers/dt2815.c | 12 drivers/comedi/drivers/me4000.c | 16 drivers/comedi/drivers/me_daq.c | 35 - drivers/comedi/drivers/ni_atmio16d.c | 3 drivers/counter/rz-mtu3-cnt.c | 67 +- drivers/cpufreq/cpufreq_governor.c | 6 drivers/crypto/caam/caamalg_qi2.c | 3 drivers/crypto/caam/caamhash.c | 3 drivers/dma/fsl-edma-main.c | 31 - drivers/gpio/gpio-mxc.c | 10 drivers/gpu/drm/ast/ast_dp501.c | 2 drivers/gpu/drm/drm_ioc32.c | 2 drivers/gpu/drm/i915/display/g4x_dp.c | 2 drivers/hid/hid-multitouch.c | 7 drivers/hid/wacom_wac.c | 10 drivers/hwmon/occ/common.c | 19 drivers/hwmon/pmbus/pxe1610.c | 5 drivers/hwmon/pmbus/tps53679.c | 4 drivers/i2c/busses/Kconfig | 2 drivers/i2c/busses/i2c-tegra.c | 5 drivers/iio/accel/adxl355_core.c | 2 drivers/iio/adc/ti-adc161s626.c | 41 - drivers/iio/dac/ad5770r.c | 2 drivers/iio/gyro/mpu3050-core.c | 32 - drivers/iio/imu/bmi160/bmi160_core.c | 15 drivers/iio/imu/bno055/bno055.c | 2 drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c | 3 drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 4 drivers/iio/light/vcnl4035.c | 18 drivers/input/joystick/xpad.c | 5 drivers/input/rmi4/rmi_f54.c | 4 drivers/input/serio/i8042-acpipnpio.h | 7 drivers/misc/fastrpc.c | 1 drivers/net/ethernet/broadcom/tg3.c | 13 drivers/net/ethernet/cadence/macb_main.c | 13 drivers/net/ethernet/cadence/macb_pci.c | 10 drivers/net/ethernet/faraday/ftgmac100.c | 28 - drivers/net/ethernet/freescale/fec_ptp.c | 3 drivers/net/ethernet/mellanox/mlx5/core/devlink.c | 4 drivers/net/ethernet/mellanox/mlx5/core/fw.c | 53 + drivers/net/ethernet/mellanox/mlx5/core/lag/debugfs.c | 3 drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h | 4 drivers/net/ethernet/microsoft/mana/mana_en.c | 6 drivers/net/ethernet/xilinx/xilinx_axienet.h | 4 drivers/net/phy/sfp.c | 7 drivers/net/vxlan/vxlan_core.c | 6 drivers/net/wireless/ath/ath11k/dp.h | 6 drivers/net/wireless/ath/ath11k/dp_rx.c | 210 ++++--- drivers/net/wireless/ath/ath11k/hal.c | 16 drivers/net/wireless/ath/ath11k/hal.h | 2 drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 2 drivers/net/wireless/microchip/wilc1000/hif.c | 2 drivers/net/wireless/virtual/virt_wifi.c | 1 drivers/nfc/pn533/uart.c | 3 drivers/nvmem/imx-ocotp-ele.c | 1 drivers/nvmem/imx-ocotp.c | 1 drivers/spi/spi-geni-qcom.c | 9 drivers/target/loopback/tcm_loop.c | 52 + drivers/thermal/thermal_core.c | 1 drivers/thunderbolt/nhi.c | 2 drivers/usb/cdns3/cdns3-gadget.c | 4 drivers/usb/class/cdc-acm.c | 9 drivers/usb/class/cdc-acm.h | 1 drivers/usb/class/usbtmc.c | 3 drivers/usb/common/ulpi.c | 5 drivers/usb/core/quirks.c | 3 drivers/usb/dwc2/gadget.c | 2 drivers/usb/gadget/function/f_rndis.c | 9 drivers/usb/gadget/function/f_subset.c | 6 drivers/usb/gadget/function/f_uac1_legacy.c | 47 + drivers/usb/gadget/function/f_uvc.c | 39 + drivers/usb/gadget/function/u_ether.c | 10 drivers/usb/gadget/function/uvc.h | 3 drivers/usb/gadget/function/uvc_v4l2.c | 5 drivers/usb/gadget/udc/dummy_hcd.c | 42 - drivers/usb/host/ehci-brcm.c | 4 drivers/usb/serial/io_edgeport.c | 3 drivers/usb/serial/io_usbvend.h | 1 drivers/usb/serial/option.c | 4 drivers/vfio/device_cdev.c | 7 drivers/vfio/group.c | 7 drivers/vfio/pci/vfio_pci_core.c | 271 ++-------- drivers/vfio/vfio_main.c | 44 + fs/btrfs/inode.c | 6 fs/btrfs/tree-checker.c | 17 fs/btrfs/zoned.c | 6 fs/ext4/fast_commit.c | 4 fs/ext4/inode.c | 15 fs/ext4/mballoc.c | 2 fs/gfs2/dir.c | 37 - fs/gfs2/glops.c | 40 - fs/gfs2/xattr.c | 28 - include/linux/netfilter/ipset/ip_set.h | 2 include/linux/swapops.h | 20 include/linux/vfio.h | 1 include/linux/vfio_pci_core.h | 2 include/net/netfilter/nf_conntrack_expect.h | 20 kernel/bpf/verifier.c | 10 kernel/fork.c | 29 - net/atm/lec.c | 72 +- net/atm/lec.h | 2 net/bluetooth/hci_event.c | 33 - net/bluetooth/hci_sync.c | 11 net/bluetooth/mgmt.c | 17 net/bluetooth/sco.c | 26 net/bluetooth/smp.c | 11 net/bridge/br_arp_nd_proxy.c | 18 net/core/dev.c | 22 net/core/skmsg.c | 13 net/hsr/hsr_device.c | 32 - net/ipv6/addrconf.c | 6 net/ipv6/datagram.c | 10 net/ipv6/icmp.c | 3 net/ipv6/ioam6.c | 4 net/ipv6/ip6_flowlabel.c | 5 net/ipv6/ip6_tunnel.c | 5 net/ipv6/ndisc.c | 3 net/mptcp/pm_netlink.c | 2 net/netfilter/ipset/ip_set_core.c | 4 net/netfilter/ipset/ip_set_hash_gen.h | 2 net/netfilter/ipset/ip_set_list_set.c | 4 net/netfilter/nf_conntrack_broadcast.c | 8 net/netfilter/nf_conntrack_expect.c | 25 net/netfilter/nf_conntrack_h323_main.c | 12 net/netfilter/nf_conntrack_helper.c | 13 net/netfilter/nf_conntrack_netlink.c | 87 +-- net/netfilter/nf_conntrack_sip.c | 4 net/netfilter/nf_flow_table_offload.c | 196 ++++--- net/netfilter/nf_tables_api.c | 7 net/netfilter/nfnetlink_log.c | 2 net/netfilter/x_tables.c | 23 net/netfilter/xt_cgroup.c | 6 net/netfilter/xt_rateest.c | 5 net/qrtr/af_qrtr.c | 31 - net/rds/ib_rdma.c | 7 net/sched/cls_api.c | 1 net/sched/cls_flow.c | 10 net/sched/cls_fw.c | 14 net/sched/sch_hfsc.c | 4 net/sched/sch_netem.c | 5 net/x25/x25_in.c | 9 net/x25/x25_subr.c | 1 sound/pci/ctxfi/ctdaio.c | 1 sound/soc/cirrus/ep93xx-i2s.c | 34 - sound/usb/caiaq/device.c | 2 tools/objtool/check.c | 5 165 files changed, 1664 insertions(+), 943 deletions(-) Alan Stern (2): USB: dummy-hcd: Fix locking/synchronization error USB: dummy-hcd: Fix interrupt synchronization error Alex Williamson (3): vfio: Create vfio_fs_type with inode per device vfio/pci: Use unmap_mapping_range() vfio/pci: Insert full vma on mmap'd MMIO fault Alexander Popov (1): wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free Alexei Starovoitov (1): bpf: Fix regsafe() for pointers to packet Alexey Velichayshiy (1): wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler() Andrew Price (2): gfs2: Improve gfs2_consist_inode() usage gfs2: Validate i_depth for exhash directories Antoniu Miclaus (1): iio: dac: ad5770r: fix error return in ad5770r_read_raw() Bart Van Assche (1): Input: synaptics-rmi4 - fix a locking bug in an error path Benoît Sevens (1): HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq Berk Cem Goksel (1): ALSA: caiaq: fix stack out-of-bounds read in init_card Buday Csaba (1): net: fec: fix the PTP periodic output sysfs interface Cen Zhang (1): Bluetooth: SCO: fix race conditions in sco_sock_connect() Christian Eggers (1): nvmem: imx: assign nvmem_cell_info::raw_len Christoffer Sandberg (1): Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table Cosmin Tanislav (2): counter: rz-mtu3-cnt: prevent counter from being toggled multiple times counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member David Lechner (4): iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one iio: adc: ti-adc161s626: fix buffer read on big-endian iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() iio: light: vcnl4035: fix scan buffer on big-endian Deepanshu Kartikey (2): atm: lec: fix use-after-free in sock_def_readable() comedi: dt2815: add hardware detection to prevent crash Eric Dumazet (3): ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() ip6_tunnel: clear skb2->cb[] in ip4ip6_err() ipv6: avoid overflows in ip6_datagram_send_ctl() Ernestas Kulik (1): USB: serial: option: add MeiG Smart SRM825WN Ethan Tidmore (4): iio: gyro: mpu3050: Fix incorrect free_irq() variable iio: gyro: mpu3050: Fix irq resource leak iio: gyro: mpu3050: Move iio_device_register() to correct location iio: gyro: mpu3050: Fix out-of-sequence free_irq() Fedor Pchelkin (2): net: macb: fix clk handling on PCI glue driver removal net: macb: properly unregister fixed rate clocks Filipe Manana (1): btrfs: do not free data reservation in fallback from inline due to -ENOSPC Florian Westphal (3): netfilter: nfnetlink_log: account for netlink header size netfilter: x_tables: ensure names are nul-terminated netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr Francesco Lavra (1): iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only Frank Li (1): dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning Frej Drejhammar (1): USB: serial: io_edgeport: add support for Blackbox IC135A Greg Kroah-Hartman (2): drm/ioc32: stop speculation on the drm_compat_ioctl path Linux 6.6.134 Guangshuo Li (3): usb: ulpi: fix double free in ulpi_register_interface() error path cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path net: mana: fix use-after-free in add_adev() error path Heitor Alves de Siqueira (1): usb: usbtmc: Flush anchored URBs in usbtmc_release Horia Geantă (2): crypto: caam - fix DMA corruption on long hmac keys crypto: caam - fix overflow on long hmac keys Ian Abbott (4): comedi: Reinit dev->spinlock between attachments to low-level drivers comedi: ni_atmio16d: Fix invalid clean-up after failed attach comedi: me_daq: Fix potential overrun of firmware buffer comedi: me4000: Fix potential overrun of firmware buffer JP Hein (1): USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam Jamie Gibbons (1): dt-bindings: gpio: fix microchip #interrupt-cells Jean-Baptiste Maneyrol (1): iio: imu: inv_icm42600: fix odr switch when turning buffer off Jiayuan Chen (1): net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak Jihed Chaibi (1): ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure Jimmy Hu (1): usb: gadget: uvc: fix NULL pointer dereference during unbind race Jinjiang Tu (1): mm/huge_memory: fix folio isn't locked in softleaf_to_folio() Johannes Thumshirn (1): btrfs: don't take device_list_mutex when querying zone info Josef Bacik (1): scsi: target: tcm_loop: Drain commands in target_reset handler Josh Poimboeuf (2): objtool: Fix Clang jump table detection iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin() Joy Zou (2): dmaengine: fsl-edma: change to guard(mutex) within fsl_edma3_xlate() dmaengine: fsl-edma: fix channel parameter config for fixed channel requests Juno Choi (1): usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() Justin Chen (1): usb: ehci-brcm: fix sleep during atomic Keenan Dong (2): Bluetooth: MGMT: validate LTK enc_size on load Bluetooth: MGMT: validate mesh send advertising payload length Kevin Hao (1): net: macb: Move devm_{free,request}_irq() out of spin lock area Konrad Dybcio (1): thunderbolt: Fix property read in nhi_wake_supported() Kuen-Han Tsai (3): usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop usb: gadget: f_subset: Fix unbalanced refcnt in geth_free usb: gadget: f_rndis: Protect RNDIS options with mutex Kuniyuki Iwashima (1): bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready(). Lee Jones (1): HID: multitouch: Check to ensure report responses match the request Li Chen (1): ext4: publish jinode after initialization Li Xiasong (1): MPTCP: fix lock class name family in pm_nl_create_listen_socket Luka Gejak (1): net: hsr: fix VLAN add unwind on slave errors Maciej W. Rozycki (1): MIPS: Fix the GCC version check for `__multi3' workaround Marek Behún (1): net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta Martin Schiller (2): net/x25: Fix potential double free of skb net/x25: Fix overflow when accumulating packets Miao Li (1): usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive Miaohe Lin (1): fork: defer linking file vma until vma is fully initialized Mikko Perttunen (1): i2c: tegra: Don't mark devices with pins as IRQ safe Nikunj A Dadhania (1): x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling() Norbert Szetei (1): crypto: af-alg - fix NULL pointer dereference in scatterwalk Oleh Konko (2): Bluetooth: SMP: derive legacy responder STK authentication from MITM state Bluetooth: SMP: force responder MITM requirements before building the pairing response Oliver Neukum (1): cdc-acm: new quirk for EPSON HMD P Praneesh (1): wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation Pablo Neira Ayuso (7): netfilter: flowtable: strictly check for maximum number of actions netfilter: nf_conntrack_expect: honor expectation helper field netfilter: nf_conntrack_expect: use expect->helper netfilter: nf_conntrack_expect: store netns and zone in expectation netfilter: ctnetlink: ignore explicit helper on new expectations netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP netfilter: nf_tables: reject immediate NF_QUEUE verdict Paolo Abeni (1): ipv6: prevent possible UaF in addrconf_permanent_addr() Paul SAGE (1): tg3: replace placeholder MAC address with device property Paul Walmsley (1): riscv: kgdb: fix several debug register assignment bugs Pauli Virtanen (2): Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt Pengpeng Hou (2): net/ipv6: ioam6: prevent schema length wraparound in trace fill NFC: pn533: bound the UART receive buffer Pepper Gray (1): arm64/scs: Fix handling of advance_loc4 Praveen Talari (1): spi: geni-qcom: Check DMA interrupts early in ISR Qi Tang (3): netfilter: nf_conntrack_helper: pass helper to expect cleanup netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent bpf: reject direct access to nullable PTR_TO_BUF pointers Qu Wenruo (1): btrfs: fix the qgroup data free range for inline data extents Rafael J. Wysocki (1): thermal: core: Fix thermal zone device registration error path Reshma Immaculate Rajkumar (1): wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session Saeed Mahameed (1): net/mlx5: Avoid "No data available" when FW version queries fail Sanman Pradhan (4): hwmon: (pxe1610) Check return value of page-select write in probe hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify() hwmon: (occ) Fix missing newline in occ_show_extended() hwmon: (occ) Fix division by zero in occ_show_power_1() Sebastian Urban (1): usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer Shay Drory (1): net/mlx5: lag: Check for LAG device before creating debugfs Shengyu Qu (1): Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode Shenwei Wang (1): gpio: mxc: map Both Edge pad wakeup to Rising Edge Shiji Yang (1): mips: ralink: update CPU clock index Stefan Wiehler (1): mips: mm: Allocate tlb_vpn array atomically Suraj Gupta (1): net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec Taegu Ha (1): usb: gadget: f_uac1_legacy: validate control request size Takashi Iwai (1): ALSA: ctxfi: Fix missing SPDIFI1 index handling Theodore Ts'o (1): ext4: handle wraparound when searching for blocks for indirect mapped blocks Thomas Bogendoerfer (1): tg3: Fix race for querying speed/duplex Thomas Zimmermann (1): drm/ast: dp501: Fix initialization of SCU2C Valek Andrej (1): iio: accel: fix ADXL355 temperature signature value Venkateswara Naralasetty (1): wifi: ath11k: skip status ring entry processing Ville Syrjälä (1): drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP Wanquan Zhong (1): USB: serial: option: add support for Rolling Wireless RW135R-GL Weiming Shi (1): rds: ib: reject FRMR registration before IB connection is established Willem de Bruijn (1): net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback Xi Ruoyao (1): LoongArch: vDSO: Emit GNU_EH_FRAME correctly Xiang Mei (3): net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() net/sched: cls_fw: fix NULL pointer dereference on shared blocks net/sched: cls_flow: fix NULL pointer dereference on shared blocks Xingjing Deng (1): misc: fastrpc: possible double-free of cctx->remote_heap Xu Yang (1): dt-bindings: connector: add pd-disable dependency Yang Yang (3): bridge: br_nd_send: linearize skb before parsing ND options bridge: br_nd_send: validate ND option lengths vxlan: validate ND option lengths in vxlan_na_create Yasuaki Torimaru (1): wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation Yifan Wu (1): netfilter: ipset: drop logically empty buckets in mtype_del Yochai Eisenrich (2): net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak Yongchao Wu (2): usb: cdns3: gadget: fix NULL pointer dereference in ep_queue usb: cdns3: gadget: fix state inconsistency on gadget init failure Youssef Samir (1): accel/qaic: Handle DBC deactivation if the owner went away Yucheng Lu (1): net/sched: sch_netem: fix out-of-bounds access in packet corruption Yufan Chen (1): net: ftgmac100: fix ring allocation unwind on open failure ZhengYuan Huang (1): btrfs: reject root items with drop_progress and zero drop_level Zhengchuan Liang (1): net: ipv6: flowlabel: defer exclusive option free until RCU teardown Zoltan Illes (1): Input: xpad - add support for Razer Wolverine V3 Pro