291696c6d6db Linux 6.18.29-rt-xanmod1
7bfe90e90e7f Merge branch '6.18' into 6.18-rt
3c8a7708d26d Linux 6.18.29-xanmod1
369de376366a Merge tag 'v6.18.29' into 6.18
d31a849ff501 Linux 6.18.29
3eae0f4f9f72 rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
c31b94a4231c Linux 6.18.28
71a1d9d985d2 xfrm: esp: avoid in-place decrypt on shared skb frags
386484d53ce6 Linux 6.18.27-xanmod1
95bd50e63f30 Merge tag 'v6.18.27' into 6.18
ce685b6a03dc Linux 6.18.27
97d35052a816 ipmi:ssif: NULL thread on error
52a7c9a2823d ipmi:ssif: Remove unnecessary indention
6f820139d16a netfilter: reject zero shift in nft_bitwise
b778b6d09542 net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels
a8d95d274be2 mm/slab: return NULL early from kmalloc_nolock() in NMI on UP
05b4ed8bef30 mm/page_alloc: return NULL early from alloc_frozen_pages_nolock() in NMI on UP
e9b057a44def vmalloc: fix buffer overflow in vrealloc_node_align()
bdd9503c3d22 ALSA: aloop: Fix peer runtime UAF during format-change stop
6153878c5255 ALSA: caiaq: fix usb_dev refcount leak on probe failure
30c000a49094 drm/amdgpu: fix zero-size GDS range init on RDNA4
c261d07a8057 ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
3d46009e2ad4 ALSA: caiaq: Don't abort when no input device is available
1d160e30aa42 ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path
b8c5acce56e0 driver core: Add kernel-doc for DEV_FLAG_COUNT enum value
b42821c15445 crypto: authencesn - reject short ahash digests during instance creation
5cf6d5e5e3b8 net: qrtr: ns: Limit the total number of nodes
20855cef7e65 net: qrtr: ns: Limit the maximum number of lookups
35fb4a0c077c net: qrtr: ns: Limit the maximum server registration per node
5e9f1bad26df iio: frequency: admv1013: fix NULL pointer dereference on str
c772e9efe2b1 iio: frequency: admv1013: add dev variable
0adac0ee2c42 media: rc: igorplugusb: heed coherency rules
7ba734027b2b media: rc: ttusbir: respect DMA coherency rules
7d7863018f40 wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling
0bc155c4ca47 wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor
09e1c96594af phy: qcom: m31-eusb2: clear PLL_EN during init
37ef11ab2cf3 phy: qcom: m31-eusb2: Update init sequence to set PHY_ENABLE
da4a33e739dc mei: me: add nova lake point H DID
09033be12a82 mei: me: use PCI_DEVICE_DATA macro
38f113f81d3f lib: test_hmm: evict device pages on file close to avoid use-after-free
1e67c82fb778 arm64: mm: Fix rodata=full block mapping support for realm guests
5e07126d7ab8 arm64: mm: Simplify check in arch_kfence_init_pool()
6f977b0472f7 mm: prevent droppable mappings from being locked
bbc4bfae9e43 seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode
13e550fbfccd scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails
9da6e314ea5f sched_ext: Documentation: Clarify ops.dispatch() role in task lifecycle
43222ac484f9 rxgk: Fix potential integer overflow in length check
3fb7394a8377 rtmutex: Use waiter::task instead of current in remove_waiter()
f1af27cec07a ntfs3: fix integer overflow in run_unpack() volume boundary check
d3012690a706 ntfs3: add buffer boundary checks to run_unpack()
83e31039e0d7 NFSv4.1: Apply session size limits on clone path
fc8d81f189f0 ktest: Fix the month in the name of the failure directory
9f4ba5966c78 IB/core: Fix zero dmac race in neighbor resolution
4db061a40543 gtp: disable BH before calling udp_tunnel_xmit_skb()
b91e535f208c ceph: only d_add() negative dentries when they are unhashed
87c99a50e0fd dm mirror: fix integer overflow in create_dirty_log()
a616126cb080 crypto: nx - Fix packed layout in struct nx842_crypto_header
354a27e28447 crypto: nx - fix context leak in nx842_crypto_free_ctx
5c07962fed66 crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx
2ae365e32998 crypto: atmel-sha204a - Fix uninitialized data access on OTP read error
1193c12126d3 crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path
64ea9dbf4c77 crypto: atmel-sha204a - Fix error codes in OTP reads
863d11b39277 crypto: atmel-tdes - fix DMA sync direction
910f335786a0 crypto: ccree - fix a memory leak in cc_mac_digest()
808685bfd124 crypto: hisilicon - Fix dma_unmap_single() direction
9c032781c2b1 crypto: atmel-ecc - Release client on allocation failure
61516b4a5b26 crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup
4d713333dd32 crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit
343a5bf68a8f crypto: acomp - fix wrong pointer stored by acomp_save_req()
c524c124e309 can: ucan: fix devres lifetime
1656698656f6 bus: mhi: host: pci_generic: Switch to async power up to avoid boot delays
e08d75753db1 Bluetooth: hci_event: fix potential UAF in SSP passkey handlers
b4339521bb43 apparmor: use target task's context in apparmor_getprocattr()
b7a953374db9 mfd: core: Preserve OF node when ACPI handle is present
e88827bb0399 taskstats: set version in TGID exit notifications
83bb57635d7c tcp: call sk_data_ready() after listener migration
69c4d137b22d wifi: rtl8xxxu: fix potential use of uninitialized value
4f3374c990fb x86/shstk: Prevent deadlock during shstk sigreturn
ef7ce8f4a341 x86/cpu: Disable FRED when PTI is forced on
fdaa42ca370d inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails
371f4dc80601 HID: apple: ensure the keyboard backlight is off if suspending
ea43a34452a6 check-uapi: link into shared objects
73ce72edd113 md/raid5: validate payload size before accessing journal metadata
1985cb3247e8 md/raid5: fix soft lockup in retry_aligned_read()
9142f00a9287 md/md-llbitmap: raise barrier before state machine transition
98623c7e2a51 md/md-llbitmap: skip reading rdevs that are not in_sync
f7d9d0e4a64f amdgpu/jpeg: fix deepsleep register for jpeg 5_0_0 and 5_0_2
ac858718219f mtd: spinand: winbond: Declare the QE bit on W25NxxJW
134975be170b mtd: spi-nor: sst: Fix write enable before AAI sequence
1e6b0a69bf2c ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all()
537e06597702 ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access
6b4bf6519e50 ring-buffer: Do not double count the reader_page
f9c279ffee6b ARM: 9472/1: fix race condition on PG_dcache_clean in __sync_icache_dcache()
cd2689d625b0 perf annotate: Use jump__delete when freeing LoongArch jumps
5955e053ff00 KVM: nSVM: Always intercept VMMCALL when L2 is active
009c0f726abe KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1
83f7e055c138 KVM: nSVM: Add missing consistency check for nCR3 validity
0d1f3fd2664b KVM: nSVM: Drop the non-architectural consistency check for NP_ENABLE
aabd785f9565 KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS
d79720fc9959 KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT
b6656ba26525 KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT
c2fad967e652 KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID)
d6f6371bbea6 KVM: nSVM: Triple fault if mapping VMCB12 fails on nested #VMEXIT
410ea5575c66 KVM: nSVM: Refactor writing vmcb12 on nested #VMEXIT as a helper
72fe7d04a669 KVM: nSVM: Refactor checking LBRV enablement in vmcb12 into a helper
49c8b2395bac KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN
2b922a42b531 KVM: SVM: Add missing save/restore handling of LBR MSRs
18ff4ab16412 KVM: SVM: Switch svm_copy_lbrs() to a macro
a5ea402844f1 KVM: nSVM: Delay setting soft IRQ RIP tracking fields until vCPU run
a3f0981a5a0e KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12
88572f9d83d7 KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT
3a95eb7c6950 KVM: nSVM: Delay stuffing L2's current RIP into NextRIP until vCPU run
3428ed1529a1 KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN
46b3827abc44 KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode
8302e9be9f9c KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts
c15392ed9e49 KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0
497f6af9679f KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2
076ab13fe321 KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2
e07ad47e53e9 KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state
c098979293da KVM: x86: Defer non-architectural deliver of exception payload to userspace read
26f01d03775e LoongArch: KVM: Use CSR_CRMD_PLV in kvm_arch_vcpu_in_kernel()
fe06ea2f7b7f userfaultfd: allow registration of ranges below mmap_min_addr
0fedd09ef952 mm/damon/core: use time_in_range_open() for damos quota window start
b09958e235f2 mm/damon/core: validate damos_quota_goal->nid for node_mem_{used,free}_bp
8a62c58411cb mm/damon/stat: fix memory leak on damon_start() failure in damon_stat_start()
c42a7efb9060 mm/mempolicy: fix memory leaks in weighted_interleave_auto_store()
687ccdf58216 mm/vmalloc: take vmap_purge_lock in shrinker
5184e2c065e3 rtc: ntxec: fix OF node reference imbalance
b5856e85a1f0 tpm: tpm_tis: stop transmit if retries are exhausted
6503775a5c41 tpm: tpm_tis: add error logging for data transfer
53e6d2d834df tpm: Use kfree_sensitive() to free auth session in tpm_dev_release()
726ce5042359 tpm: Fix auth session leak in tpm2_get_random() error path
f8775d9d9062 tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public()
82aa32a4d697 pwm: imx-tpm: Count the number of enabled channels in probe
dedaa897b9d7 crypto: talitos - rename first/last to first_desc/last_desc
4861d6cd923f crypto: talitos - fix SEC1 32k ahash request limitation
75d40ccf38ca firmware: google: framebuffer: Do not unregister platform device
5c293a1e1ef0 xfs: fix a resource leak in xfs_alloc_buftarg()
fe570daa5193 xfs: start gc on zonegc_low_space attribute updates
27f561bf894e crypto: qat - fix IRQ cleanup on 6xxx probe failure
6d8087a7d0f3 arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins
52e1a80bacc6 mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration
d73c3a4070dc mmc: block: use single block write in retry
d780f24a4939 randomize_kstack: Maintain kstack_offset per task
95d48e37a130 hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data()
6b11dfb3c517 ASoC: Intel: avs: replace strcmp with sysfs_streq
77eb3e79a3e7 drm/amd: Fix set but not used warnings
b3166d165753 fs: prepare for adding LSM blob to backing_file
b69a8729f84a hwmon: (isl28022) Fix integer overflow in power calculation on 32-bit
bff7dbfc326a power: supply: axp288_charger: Do not cancel work before initializing it
988eff645be4 LoongArch: Show CPU vulnerabilites correctly
c5dfddc57f1b tpm: avoid -Wunused-but-set-variable
80f54d6f9142 extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE'
11baa8b24bcb spi: fix resource leaks on device setup failure
016bc6636573 libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply()
c2178ff1c70e ipv4: icmp: validate reply type before using icmp_pointers
9b924f3a26b2 RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv
f344f04e33bf tracing/fprobe: Reject registration of a registered fprobe before init
38387ccc0fbe slub: fix data loss and overflow in krealloc()
9eed57e9defd drm/arcpgu: fix device node leak
e9be7d2fb0b1 net: ks8851: Avoid excess softirq scheduling
f826f0000100 net: mctp: fix don't require received header reserved bits to be zero
20ba739bd627 netconsole: avoid out-of-bounds access on empty string in trim_newline()
5424e678f9b3 net: bridge: use a stable FDB dst snapshot in RCU readers
be8aad558b46 net: ks8851: Reinstate disabling of BHs around IRQ handler
ea0b5d0fe963 net/smc: avoid early lgr access in smc_clc_wait_msg
1c2afc4a1dd1 net: txgbe: fix firmware version check
033370ffb3c9 net: rds: fix MR cleanup on copy error
154fc7fe3f62 net: qrtr: ns: Free the node during ctrl_cmd_bye()
7ef5b521785b arm64: dts: marvell: uDPU: add ethernet aliases
d29cafc7e4ee net: txgbe: fix RTNL assertion warning when remove module
491344b826a5 tools/accounting: handle truncated taskstats netlink messages
ff591df2cd7f EDAC/versalnet: Fix memory leak in remove and probe error paths
761c37b761ed rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets
76cb9a2d2522 rxrpc: Fix re-decryption of RESPONSE packets
293095ef6188 rxrpc: Fix error handling in rxgk_extract_token()
f0d3efd03b2a rxrpc: Fix rxkad crypto unalignment handling
ca71ac2de389 rxrpc: Fix conn-level packet handling to unshare RESPONSE packets
861b9a0a1823 rxrpc: Fix memory leaks in rxkad_verify_response()
996b0487b3cd rxrpc: Fix potential UAF after skb_unshare() failure
d42d5404782f iio: adc: ad7768-1: remove switch to one-shot mode
4ca3746d9492 iio: adc: ad7768-1: fix one-shot mode data acquisition
54af1a51bb8b ALSA: pcmtest: Fix resource leaks in module init error paths
91c8e75ba1f1 ALSA: pcmtest: fix reference leak on failed device registration
89ed38540e6b ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa2xxx
1ac67f49ae2c ALSA: 6fire: Fix input volume change detection
e59ecd4ee3a4 ALSA: caiaq: Handle probe errors properly
30bd9ed68c84 ALSA: caiaq: Fix control_put() result and cache rollback
33df74673674 ALSA: core: Fix potential data race at fasync handling
9678e1b7f512 io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE
ea0697129807 io_uring/poll: fix signed comparison in io_poll_get_ownership()
23b4b18bac28 iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned()
8661370e0865 block: relax pgmap check in bio_add_page for compatible zone device pages
dd154d768db5 io_uring/timeout: check unused sqe fields
81880f84cb36 block: fix zone write plugs refcount handling in disk_zone_wplug_schedule_bio_work()
ad0126ffcba8 rbd: fix null-ptr-deref when device_add_disk() fails
4d79d0cf6538 selftests/landlock: Skip stale records in audit_match_record()
127ae2e73e61 selftests/landlock: Fix snprintf truncation checks in audit helpers
1e85a1ae1452 selftests/landlock: Fix format warning for __u64 in net_test
a496488e1702 selftests/landlock: Drain stale audit records on init
2fcde49092aa landlock: Fix LOG_SUBDOMAINS_OFF inheritance across fork()
df865a3bb91b selftests/mqueue: Fix incorrectly named file
558aa1e2cd11 sched: Use u64 for bandwidth ratio calculations
961db0b89200 reset: rzv2h-usb2phy: Keep PHY clock enabled for entire device lifetime
06d0bed2552f remoteproc: xlnx: Only access buffer information if IPI is buffered
8ba804869382 RDMA/mana_ib: Disable RX steering on RSS QP destroy
dffdcbeabaac PCI: cadence: Use cdns_pcie_read_sz() for byte or word read access
1fe317364cb5 parisc: Drop ip_fast_csum() inline assembly implementation
e6e3724c7870 parisc: _llseek syscall is only available for 32-bit userspace
c2462d54af3c nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set
8bcc66896e01 nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4
d89044889ecd mtd: docg3: fix use-after-free in docg3_release()
2774bcf71473 mm/hugetlb: fix early boot crash on parameters without '=' separator
2691332ad88b mm/damon/core: fix damon_call() vs kdamond_fn() exit race
d5b495ba9de0 mm/alloc_tag: clear codetag for pages allocated before page_ext initialization
3c52d0946977 mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused
377f5ad257fb io_uring/register: fix ring resizing with mixed/large SQEs/CQEs
cac2106bb9a2 md/raid10: fix deadlock with check operation and nowait requests
bdf33ba450af KVM: selftests: Fix reserved value WRMSR testcase for multi-feature MSRs
2b2fee890250 jbd2: fix deadlock in jbd2_journal_cancel_revoke()
858bc8b9edb6 ipmi:ssif: Clean up kthread on errors
8ebb951a284b erofs: fix the out-of-bounds nameoff handling for trailing dirents
33074b1e6c18 ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes
09496158f6eb ALSA: ctxfi: Add fallback to default RSR for S/PDIF
8d3124290a03 ALSA: aoa: Skip devices with no codecs in i2sbus_resume()
df462e82e82c ALSA: aoa: i2sbus: fix OF node lifetime handling
e79427ee11a8 ALSA: aoa: i2sbus: clear stale prepared state
0ae7d28dda5c mm/zsmalloc: copy KMSAN metadata in zs_page_migrate()
2dde6377ab2e ext2: reject inodes with zero i_nlink and valid mode in ext2_iget()
2e127ceb1c41 net: qrtr: ns: Fix use-after-free in driver remove()
da47f8a5958c media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe()
4d3a4638e9d2 lib/ts_kmp: fix integer overflow in pattern length calculation
dca29d20ab23 PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete
127a1fe59c78 Revert "ALSA: usb: Increase volume range that triggers a warning"
65fc57c8b8f0 PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown
4ca4351d269f crypto: atmel-sha204a - Fix OTP sysfs read and error handling
26506a30e0e2 media: mtk-jpeg: fix use-after-free in release path due to uncancelled work
19ca9475f18f net: strparser: fix skb_head leak in strp_abort_strp()
63d21a3aa010 net: caif: clear client service pointer on teardown
654c818a69c2 ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names()
fdc150dac1ad media: amphion: Fix race between m2m job_abort and device_run
e0a621459c61 PCI: imx6: Skip waiting for L2/L3 Ready on i.MX6SX
b6e61356ad24 EDAC/versalnet: Fix device_node leak in mc_probe()
b6cb07f02253 hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt
5b6122a67a29 of: unittest: fix use-after-free in testdrv_probe()
7f0f0926f301 of: unittest: fix use-after-free in of_unittest_changeset()
824897e69d7a dt-bindings: display: ti, am65x-dss: Fix AM62L DSS reg and clock constraints
77d55bc8675e crypto: pcrypt - Fix handling of MAY_BACKLOG requests
ebc235675f24 crypto: algif_aead - snapshot IV for async AEAD requests
efc52947247a mm: call ->free_folio() directly in folio_unmap_invalidate()
ff8a7996dc8b spi: ch341: fix memory leaks on probe failures
132e47030b0b spi: imx: fix use-after-free on unbind
75f8f3c3e091 thermal: core: Fix thermal zone governor cleanup issues
2810fc760aaf um: drivers: call kernel_strrchr() explicitly in cow_user.c
5d6c349c9823 vfio/cdx: Fix NULL pointer dereference in interrupt trigger path
7b436ade16cc vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex
08da3594c8ba vfio/virtio: Convert list_lock from spinlock to mutex
7aa27b20e938 vfio: selftests: Fix VLA initialisation in vfio_pci_irq_set()
4e179a60a60c wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()
000134a20bbf wifi: rtw88: check for PCI upstream bridge existence
a02363f71a79 zram: do not forget to endio for partial discard requests
a516d4388662 Input: edt-ft5x06 - fix use-after-free in debugfs teardown
3c636a3edca9 ocfs2: split transactions in dio completion to avoid credit exhaustion
944a6864aa06 mm: migrate: requeue destination folio on deferred split queue
3f8805b8ca23 arm64/mm: Enable batched TLB flush in unmap_hotplug_range()
ecb3e4fa31ff firmware: google: framebuffer: Do not mark framebuffer as busy
f51f85c04480 fs: afs: revert mmap_prepare() change
d4d0c91a0afc kbuild: rust: allow `clippy::uninlined_format_args`
5447be57b311 rust: dma: remove DMA_ATTR_NO_KERNEL_MAPPING from public attrs
4404d7d2dda4 drm/nouveau: fix nvkm_device leak on aperture removal failure
fa9a4c5e69aa device property: Make modifications of fwnode "flags" thread safe
3e8fefd2997c driver core: Don't let a device probe until it's ready
c1c2417c60db ibmasm: fix heap over-read in ibmasm_send_i2o_message()
ee5737891464 ibmasm: fix OOB reads in command_file_write due to missing size checks
22a16d3eafee misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt()
b2801647c203 greybus: gb-beagleplay: fix sleep in atomic context in hdlc_tx_frames()
fb91d4e49fcb greybus: gb-beagleplay: bound bootloader receive buffering
438e357b3cc6 leds: qcom-lpg: Check for array overflow when selecting the high resolution
332884f5eb79 drm/nouveau: fix u32 overflow in pushbuf reloc bounds check
85cbf7fb568a LoongArch: Add spectre boundry for syscall dispatch table
c578b48b9fdf ALSA: usb-audio: Evaluate packsize caps at the right place
b216de91c0c0 usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change
6f480aa64d4d usb: chipidea: otg: not wait vbus drop if use role_switch
49340680d41f usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable()
f28a8281792b ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch
9bbbbbd404d3 ALSA: usb-audio: Avoid false E-MU sample-rate notifications
4d7893a137ea ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES
1fe06068166d Linux 6.18.26
d5f59216650c Buffer overflow in drivers/xen/sys-hypervisor.c
446ee446d9ae xen/privcmd: fix double free via VMA splitting
00ac7cb3bb2a Linux 6.18.25-rt-xanmod1
41926056cec4 Merge branch '6.18' into 6.18-rt
b7e7f36157eb Linux 6.18.25-xanmod1
3dac54db8c6c Merge tag 'v6.18.25' into 6.18
a256b1e6892e Linux 6.18.25
ce383ba61533 rxrpc: Fix missing validation of ticket length in non-XDR key preparsing
2937f17bbeef crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed
051e51aa55fd crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed
111dcc6d0f01 crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed
28324a3b62d9 net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()
6473ed16df1f ALSA: caiaq: take a reference on the USB device in create_card()
f8397fc0ff9a ALSA: hda/realtek: Add quirk for Legion S7 15IMH
1d30e8d4a07c ALSA: usb-audio: apply quirk for MOONDROP JU Jiu
c76cf339b879 f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io()
028103656b84 writeback: Fix use after free in inode_switch_wbs_work_fn()
feefd5d5b5ee ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id()
5e7b8f3c539d ksmbd: use check_add_overflow() to prevent u16 DACL size overflow
790304c02bf9 ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment
3e5360b422dd ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl()
299db777ea0c ksmbd: validate response sizes in ipc_validate_msg()
078fae8f50ad smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path
38a69f08ee82 smb: client: require a full NFS mode SID before reading mode bits
3943e4565aae smb: server: fix max_connections off-by-one in tcp accept path
283027aa9338 smb: server: fix active_num_conn leak on transport allocation failure
90089584b2e2 ksmbd: require minimum ACE size in smb_check_perm_dacl()
3fa185e32019 fuse: fuse_dev_ioctl_clone() should wait for device file to be initialized
9ef130452eaf fuse: quiet down complaints in fuse_conn_limit_write
1381635aeb7f fuse: Check for large folio with SPLICE_F_MOVE
0c7fca880a40 fuse: abort on fatal signal during sync init
7de93abfaae1 fuse: reject oversized dirents in page cache
59970b2586fe f2fs: fix to avoid uninit-value access in f2fs_sanity_check_node_footer
047c0aef6af3 f2fs: fix to avoid memory leak in f2fs_rename()
963d2e24d9d9 f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io()
748c5d08f1a9 f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally
0112e6279420 fs/ntfs3: validate rec->used in journal-replay file record check
f218fb82877b scripts/dtc: Remove unused dts_version in dtc-lexer.l
c846ed5ac80f lib/crypto: tests: Drop the default to CRYPTO_SELFTESTS
ca47b87f2457 kunit: configs: Enable all crypto library tests in all_tests.config
95c05443aa34 lib/crypto: tests: Introduce CRYPTO_LIB_ENABLE_ALL_FOR_KUNIT
b0ca42c01883 lib/crypto: tests: Add a .kunitconfig file
05f723be4d64 kunit: configs: Enable all CRC tests in all_tests.config
04c61029a3b7 lib/crc: tests: Add a .kunitconfig file
6897bdfa505f lib/crc: tests: Add CRC_ENABLE_ALL_FOR_KUNIT
e70c01412893 lib/crc: tests: Make crc_kunit test only the enabled CRC variants
28f77fca4449 sched/debug: Fix avg_vruntime() usage
c6c87a23de4b arm64: errata: Work around early CME DVMSync acknowledgement
ee5ce483d428 arm64: cputype: Add C1-Pro definitions
456d6040bb3b arm64: tlb: Pass the corresponding mm to __tlbi_sync_s1ish()
e785d2751b1d arm64: tlb: Introduce __tlbi_sync_s1ish_{kernel,batch}() for TLB maintenance
243cec136a74 arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI
609624576b6f arm64: tlb: Allow XZR argument to TLBI ops
00ce8d6789da ksmbd: validate owner of durable handle on reconnect
3d6682726c2d ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger
377bbec04e16 scripts: generate_rust_analyzer.py: define scripts
07cbb1bd4243 crypto: krb5enc - fix async decrypt skipping hash verification
41d151254caa crypto: krb5enc - fix sleepable flag handling in encrypt dispatch
b7cddf6c0175 drm/amdgpu: replace PASID IDR with XArray
e97593f32bd5 net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registers
c5cedee5d973 ipv6: add NULL checks for idev in SRv6 paths
ecc0eb147806 crypto: authencesn - Fix src offset when decrypting in-place
4e28c6d769e4 Linux 6.18.24-xanmod1
89fc24d35ca7 Merge tag 'v6.18.24' into 6.18
c0d886e4af57 Linux 6.18.24
ff628171d5f4 dma-mapping: handle DMA_ATTR_CPU_CACHE_CLEAN in trace output
c2d109c982e9 dma-debug: Allow multiple invocations of overlapping entries
574501ede47a mm/userfaultfd: fix hugetlb fault mutex hash calculation
07e9e674b614 media: hackrf: fix to not free memory after the device is registered in hackrf_probe()
6d75a9ec5bdb media: vidtv: fix pass-by-value structs causing MSAN warnings
c36e206f302f nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map
09e9206008b8 media: as102: fix to not free memory after the device is registered in as102_usb_probe()
9a9e69155b20 wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit
2d6965581e16 bcache: fix cached_dev.sb_bio use-after-free and crash
d21e8a2af486 ALSA: 6fire: fix use-after-free on disconnect
9e1b798257f9 hwmon: (powerz) Fix use-after-free on USB disconnect
871b8ea8ef39 media: em28xx: fix use-after-free in em28xx_v4l2_open()
f99353cd0e9f media: mediatek: vcodec: fix use-after-free in encoder release path
25f19e476ab1 media: vidtv: fix nfeeds state corruption on start_streaming failure
ea3af09eb87d mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()
f6204f7ff6af mm/kasan: fix double free for kasan pXds
30383b7780ff ASoC: qcom: q6apm: move component registration to unmanaged version
22d2ff69d487 KVM: x86: Use scratch field in MMIO fragment to hold small write values
576d365f31d9 x86-64/arm64/powerpc: clean up and rename __copy_from_user_flushcache
03fd014cd9f3 x86: rename and clean up __copy_from_user_inatomic_nocache()
c6d4e0599e7e x86-64: rename misleadingly named '__copy_user_nocache()' function
8e7666acfabb checkpatch: add support for Assisted-by tag
0c1af902223b ocfs2: fix out-of-bounds write in ocfs2_write_end_inline
cd2d765aa715 ocfs2: validate inline data i_size during inode read
df030a9374a5 ocfs2: add inline inode consistency check to ocfs2_validate_inode_block()
0ed88ac9bc64 KVM: x86: Use __DECLARE_FLEX_ARRAY() for UAPI structures with VLAs
df61c2c99c7f KVM: Remove subtle "struct kvm_stats_desc" pseudo-overlay
9309daac5034 selftests/bpf: Test refinement of single-value tnum
28cc13ca2043 KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION
30fd9d8c8208 KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish
2c59132c4786 KVM: SEV: Disallow LAUNCH_FINISH if vCPUs are actively being created
35a0963d361f KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock
692fdf05e55f KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU
5d57a1ee587c KVM: selftests: Remove duplicate LAUNCH_UPDATE_VMSA call in SEV-ES migrate test
cec9ead73ab1 PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown
9921cce25bfe PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup
e384a850a337 ocfs2: handle invalid dinode in ocfs2_group_extend
d45ff441b416 ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY
bc0fb5c7d54c ocfs2: fix possible deadlock between unlink and dio_end_io_write
2dff11fb5098 media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections
8140b21d1901 arm64: mm: Handle invalid large leaf mappings correctly
755b40903eff dcache: Limit the minimal number of bucket to two
3fd0685d7fef ALSA: ctxfi: Limit PTP to a single page
de5c3e67037f Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates race
4c971d577a9f USB: serial: option: add Telit Cinterion FN990A MBIM composition
1412ba36597a staging: sm750fb: fix division by zero in ps_to_hz()
89a9c1bc7d79 wifi: rtw88: fix device leak on probe failure
9c401606e2d0 scripts: generate_rust_analyzer.py: avoid FD leak
6de048d78f30 fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
5d02df1b130b usb: port: add delay after usb_hub_set_port_power()
eb6ef6185f20 usb: gadget: f_hid: don't call cdev_init while cdev in use
5d29d7ff8679 USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen
63dc7cdb1f4e usb: storage: Expand range of matched versions for VL817 quirks entry
9aef3f979190 usb: typec: fusb302: Switch to threaded IRQ handler
906f16a836de usbip: validate number_of_packets in usbip_pack_ret_submit()
6968c91fab05 smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list()
a9940dcbe5cb smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush()
dd53414e301b ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc
d2454f4a002d ksmbd: require 3 sub-authorities before reading sub_auth[2]
3363a770b193 ksmbd: validate EaNameLength in smb2_get_ea()
e0dd90d14cbb smb: client: fix OOB reads parsing symlink error response
b2b76d09a64c smb: client: fix off-by-8 bounds check in check_wsl_eas()
44216e3dd445 usb: gadget: renesas_usb3: validate endpoint index in standard request handlers
4e476c25bfca usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete()
6762f8a95772 usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb()
fc386daa6846 fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
67cfd14074cd ALSA: fireworks: bound device-supplied status before string array lookup
09b145c1f133 ALSA: usx2y: us144mkii: fix NULL deref on missing interface 0
0185e0494a56 drm/vc4: platform_get_irq_byname() returns an int
5a59bf70c38e NFC: digital: Bounds check NFC-A cascade depth in SDD response handler
c183d5775129 net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()
8a8333237f1f HID: core: clamp report_size in s32ton() to avoid undefined shift
0091dfa542a3 HID: alps: fix NULL pointer dereference in alps_raw_event()
b487a7754d87 staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify()
377fae22a137 i2c: s3c24xx: check the size of the SMBUS message before using it
1a0f2de81f7f can: raw: fix ro->uniq use-after-free in raw_rcv()
8977fad2b3c6 nfc: llcp: add missing return after LLCP_CLOSED checks
67c53c1978ce netfilter: conntrack: add missing netlink policy validations
78cea133daf7 crypto: algif_aead - Fix minimum RX size check for decryption
dea5fcf085f9 crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl
66dfc9179b78 sched/deadline: Use revised wakeup rule for dl_server
f34feda8e0c9 perf/x86/intel/uncore: Skip discovery table for offline dies
07c6f6ffe290 crypto: af_alg - limit RX SG extraction by receive buffer budget
7af379af9d34 gpio: tegra: fix irq_release_resources calling enable instead of disable
86534c97abd6 l2tp: Drop large packets with UDP encap
2d2dc166d551 net: ipa: fix event ring index not programmed for IPA v5.0+
bafc45ea30d2 net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+
a31b3ee4dba0 devlink: Fix incorrect skb socket family dumping
900a4e0910e9 af_unix: read UNIX_DIAG_VFS data under unix_state_lock
8eff73e58e1f net: txgbe: leave space for null terminators on property_entry
6d1d9ed9b409 net: ioam6: fix OOB and missing lock
607b86397622 net: mdio: realtek-rtl9300: use scoped device_for_each_child_node loop
8c3984a0872c ASoC: amd: acp: update DMI quirk and add ACP DMIC for Lenovo platforms
c877bc8058a9 ASoC: SDCA: Fix overwritten var within for loop
41e3652a178c netfilter: nfnetlink_queue: make hash table per queue
06e054ace8b8 netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation
807d6ee15804 netfilter: ip6t_eui64: reject invalid MAC header for all packets
8368ce8eb01f netfilter: xt_multiport: validate range encoding in checkentry
d552bcfca323 netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator
a32dabacee11 ipvs: fix NULL deref in ip_vs_add_service error path
585fe11fedb8 selftests: net: bridge_vlan_mcast: wait for h1 before querier check
8083b7da229b drm/xe: Fix bug in idledly unit conversion
a4532ec7b885 ASoC: Intel: avs: Fix memory leak in avs_register_i2s_test_boards()
f779a6b6cdb6 xfrm_user: fix info leak in build_mapping()
836ee1b0426e xfrm: fix refcount leak in xfrm_migrate_policy_find
3733fce2871c xfrm: Wait for RCU readers during policy netns exit
25e1e91a8da8 xsk: validate MTU against usable frame size on bind
4947e2ae9c57 xsk: fix XDP_UMEM_SG_FLAG issues
29a68f4baaf9 xsk: respect tailroom for ZC setups
9ea6ba4f3195 xsk: tighten UMEM headroom validation to account for tailroom and min frame
70b85c177344 e1000: check return value of e1000_read_eeprom
4db7b61ec1d1 ixgbevf: add missing negotiate_features op to Hyper-V ops table
4da3465a7f00 ixgbe: stop re-reading flash on every get_drvinfo for e610
e19675b384e9 ice: ptp: don't WARN when controlling PF is unavailable
7dad8bf14346 tracing/probe: reject non-closed empty immediate strings
9550d1d9f716 dt-bindings: net: Fix Tegra234 MGBE PTP clock
b6b9c17ef8ae net: stmmac: Fix PTP ref clock for Tegra234
6d931680a985 nfc: s3fwrn5: allocate rx skb before consuming bytes
4d90f9a271a6 net: increase IP_TUNNEL_RECURSION_LIMIT to 5
f91b3ed9e7fa ipv4: icmp: fix null-ptr-deref in icmp_build_probe()
40bd39e383a0 ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()
69aa3c713980 ipv4: nexthop: avoid duplicate NHA_HW_STATS_ENABLE on nexthop group dump
0975b64ffb34 rtnetlink: add missing netlink_ns_capable() check for peer netns
fb612d436ff0 bridge: guard local VLAN-0 FDB helpers against NULL vlan group
4198aab6f000 ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data()
4429b761874f net: airoha: Fix memory leak in airoha_qdma_rx_process()
63851f60781a net: lapbether: handle NETDEV_PRE_TYPE_CHANGE
ec4930979b3f net: sched: act_csum: validate nested VLAN headers
7e8083f5eeed eventpoll: defer struct eventpoll free to RCU grace period
0cf8ea9d677b drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock
e352e9adc9f6 drm/vc4: Fix a memory leak in hang state error path
421cea4f71f7 drm/vc4: Fix memory leak of BO array in hang state
ce12a1af6779 drm/vc4: Release runtime PM reference after binding V3D
9a945edeabb5 dma-debug: suppress cacheline overlap warning when arch has no DMA alignment requirement
ad187e0506ab dma-debug: track cache clean flag in entries
4e8a1b970168 dma-mapping: add DMA_ATTR_CPU_CACHE_CLEAN
e62e322ea20b xfrm: account XFRMA_IF_ID in aevent size calculation
73e3e4dac102 HID: amd_sfh: don't log error when device discovery fails with -EOPNOTSUPP
0d364d863c70 PCI: hv: Set default NUMA node to 0 for devices without affinity info
e4093997420f ARM: dts: microchip: sam9x7: fix gpio-lines count for pioB
edde62571f76 arm64: dts: qcom: monaco: Reserve full Gunyah metadata region
d0deac48e57a tools/power turbostat: Fix --show/--hide for individual cpuidle counters
fbc581977db2 tools/power/turbostat: Fix microcode patch level output for AMD/Hygon
7d75145672cf soc: qcom: pd-mapper: Fix element length in servreg_loc_pfr_req_ei
52632daf6425 arm64: dts: qcom: monaco: Fix UART10 pinconf
95894966bce9 arm64: dts: imx93-tqma9352: improve eMMC pad configuration
b3b725b902b3 arm64: dts: imx91-tqma9131: improve eMMC pad configuration
737a4ee014e1 arm64: dts: imx93-9x9-qsb: change usdhc tuning step for eMMC and SD
d0fcd4858918 arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency
ecbc5e9277da arm64: dts: qcom: qcm6490-idp: Fix WCD9370 reset GPIO polarity
878ccc18d94c arm64: dts: qcom: hamoa/x1: fix idle exit latency
c448aad9a779 soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching
d2c7153fe0ca ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J
c64cebcc5c4f x86: shadow stacks: proper error handling for mmap lock
0a59c12ce50a net: sfp: add quirks for Hisense and HSGQ GPON ONT SFP modules
1ae1e1caa428 wifi: brcmfmac: validate bsscfg indices in IF events
f5a5d0e8704e ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585
36bb2d0b9150 HID: roccat: fix use-after-free in roccat_report_event
0fa5713ac7a1 ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10
42032a75da03 HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3
c2854af5774b HID: Intel-thc-hid: Intel-quickspi: Add NVL Device IDs
0f2e312626c7 platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug
91f915d57416 pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer)
b98ecc1c60ad ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IMH9
1d788e6a4150 ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx
86f9c23e0814 fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath
647fb0dc3818 drm/amdkfd: Fix queue preemption/eviction failures by aligning control stack size to GPU page size
fceb2a469121 ALSA: hda/realtek: Add quirk for Lenovo Yoga Slim 7 14AKP10
66b315279b88 ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex
f664b56d8fc3 ALSA: hda/realtek: Add quirk for Samsung Book2 Pro 360 (NP950QED)
a9d32e6c8a55 ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list
8d7465be5163 wifi: wl1251: validate packet IDs before indexing tx_frames
21a1acf6b16a ALSA: hda/realtek: add quirk for Framework F111:000F
07de44424bb7 netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry
7556bd5cd8ef ALSA: hda/realtek: add HP Laptop 15-fd0xxx mute LED quirk
6a9f2683c66d drm/amdgpu: Handle GPU page faults correctly on non-4K page systems
f338ced04738 netfilter: ctnetlink: ensure safe access to master conntrack
8db3663d3c3e ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx
2e4adfaec97e btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file()
d4ff92dd98ad platform/x86: hp-wmi: Add support for Omen 16-wf1xxx (8C76)
fddb157536e6 btrfs: fix zero size inode with non-zero size after log replay
c66a0e9a19c0 platform/x86: asus-nb-wmi: add DMI quirk for ASUS ROG Flow Z13-KJP GZ302EAC
c2be593c7ec2 ALSA:usb:qcom: add AUXILIARY_BUS to Kconfig dependencies
5486d20a0818 ASoC: amd: acp: add ASUS HN7306EA quirk for legacy SDW machine
c306ac170bc3 can: mcp251x: add error handling for power enable in open and resume
550243229155 ASoC: SOF: topology: reject invalid vendor array size in token parser
36d706d03346 ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF
a7a1cdb4a64c Bluetooth: hci_sync: annotate data-races around hdev->req_status
02ce2a77acc8 ALSA: asihpi: avoid write overflow check warning
222f4fd0fe06 media: rkvdec: reduce stack usage in rkvdec_init_v4l2_vp9_count_tbl()
fc40821d94b9 ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC
e656ef8698e2 ALSA: hda/realtek: add quirk for Lenovo Yoga 7 2-in-1 16AKP10
b395549928e5 ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk
4b59719db211 ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA
0f22c32141ac RDMA/irdma: Fix double free related to rereg_user_mr
0aa0c509aa69 dmaengine: idxd: Fix lockdep warnings when calling idxd_device_config()
5cb6e2637329 Linux 6.18.23-xanmod1
8a13a70b5640 Merge tag 'v6.18.23' into 6.18
47a33eea6d51 Linux 6.18.23
ad17f07e95e6 x86/CPU: Fix FPDSS on Zen1
2d64618ea846 net: skb: fix cross-cache free of KFENCE-allocated skb head
db297c78ce53 rxrpc: proc: size address buffers for %pISpc output
d0035e634dae rxrpc: only handle RESPONSE during service challenge
794586789800 rxrpc: Fix buffer overread in rxgk_do_verify_authenticator()
4b5e8365515f rxrpc: Fix leak of rxgk context in rxgk_verify_response()
1f864d9daaf6 rxrpc: Fix integer overflow in rxgk_verify_response()
bf4d6e4a6856 rxrpc: Fix missing error checks for rxkad encryption/decryption failure
03d1c51decae rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING)
8ee931c3cd97 rxrpc: fix reference count leak in rxrpc_server_keyring()
beee051f259a rxrpc: fix oversized RESPONSE authenticator length check
7875f3d9777b rxrpc: fix RESPONSE authenticator parser OOB read
22f6258e7b31 rxrpc: reject undecryptable rxkad response tickets
8299ca146489 rxrpc: Only put the call ref if one was acquired
8b353f5f1385 rxrpc: Fix to request an ack if window is limited
2e6ef713b159 rxrpc: Fix key reference count leak from call->key
86303a1da93f rxrpc: Fix rack timer warning to report unexpected mode
9132b1a7bf83 rxrpc: Fix use of wrong skb when comparing queued RESP challenge serial
3e04596cba8a rxrpc: Fix RxGK token loading to check bounds
3be718f65968 rxrpc: Fix call removal to use RCU safe deletion
3bb18ed3b2f6 rxrpc: Fix anonymous key handling
d5f76f812d2c rxrpc: Fix key parsing memleak
862cb78fb2c9 rxrpc: Fix key quota calculation for multitoken keys
92a673019943 net: lan966x: fix use-after-free and leak in lan966x_fdma_reload()
22e1ee9f22b5 net: lan966x: fix page pool leak in error paths
b5dcb41ba891 net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool()
214ceaa8a3a2 idpf: set the payload size before calling the async handler
d6e9bef3313a idpf: improve locking around idpf_vc_xn_push_free()
e02c974fc331 idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling
576543bedd61 mm: filemap: fix nr_pages calculation overflow in filemap_map_pages()
6fca757c2039 net: stmmac: fix integer underflow in chain mode
9fdece45f6e0 net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure
ea7468f61be0 mmc: vub300: fix use-after-free on disconnect
c83a282615d8 mmc: vub300: fix NULL-deref on disconnect
447f8870b484 mm/damon/stat: deallocate damon_call() failure leaking damon_ctx
b9dadf026a9f mm/damon/sysfs: dealloc repeat_call_control if damon_call() fails
49c00ae87230 mm/memory_hotplug: maintain N_NORMAL_MEMORY during hotplug
470047177574 igb: remove napi_synchronize() in igb_down()
e44919669f07 pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled
82e8174d1d0e net/mlx5: Update the list of the PCI supported devices
de9aa7e89b98 drm/i915/psr: Do not use pipe_src as borders for SU area
2af8b200cae3 drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat
4dee4c068844 batman-adv: hold claim backbone gateways by reference
60f462cd2716 net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit()
5d70eb25b41e net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption
87ce8ae51196 EDAC/mc: Fix error path ordering in edac_mc_alloc()
206121294b9c X.509: Fix out-of-bounds access when parsing extensions
de6c1dc3c7d0 batman-adv: reject oversized global TT response buffers
21ae2cda66a5 nfc: pn533: allocate rx skb before consuming bytes
083c5a417dee arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges
f0a0a6a8c1cc arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity
c82a3c9d9fb3 arm64: dts: renesas: sparrow-hawk: Reserve first 128 MiB of DRAM
a4115c2abab3 arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V
3b31b15230b0 Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower"
aee881c21b57 Revert "arm64: dts: rockchip: Further describe the WiFi for the Pinebook Pro"
fecceacbaf48 platform/x86/intel-uncore-freq: Handle autonomous UFS status bit
c4e1eff4606c platform/x86: ISST: Reset core count to 0
b27fa888e4a4 wifi: brcmsmac: Fix dma_free_coherent() size
1b6f13f62666 tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG
0f451b43c88b xfrm: hold dev ref until after transport_finish NF_HOOK
b1dfd6b27df3 xfrm: clear trailing padding in build_polexpire()
688c1b491c35 modpost: Declare extra_warn with unused attribute
0133aa1a28af workqueue: Add pool_workqueue to pending_pwqs list when unplugging multiple inactive works
fbdb43f6bb2a firmware: thead: Fix buffer overflow and use standard endian macros
b42aca3660dc netfilter: nft_ct: fix use-after-free in timeout object destroy
2802ba3981f1 i2c: imx: zero-initialize dma_slave_config for eDMA
72cf49ad50c1 af_unix: Give up GC if MSG_PEEK intervened.
33120558237c af_unix: Simplify GC state.
1e211179f1d9 af_unix: Count cyclic SCC.
450e6a685d0c btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref()
2124a61e6e2b btrfs: remove pointless out labels from extent-tree.c
d8b281165a86 MIPS: mm: Rewrite TLB uniquification for the hidden bit feature
ccc6a2241a49 MIPS: mm: Suppress TLB uniquification on EHINV hardware
6c600fc0e991 MIPS: Always record SEGBITS in cpu_data.vmbits
6c098142b370 Input: uinput - take event lock when submitting FF request "event"
1e09dfbb4f5d Input: uinput - fix circular locking dependency with ff-core
fb56de5d9921 seg6: separate dst_cache for input and output paths in seg6 lwtunnel
15fa9ead4d5e mptcp: fix slab-use-after-free in __inet_lookup_established
96a95b6d9e6d Revert "mptcp: add needs_id for netlink appending addr"
130c991e6aad Revert "ALSA: hda/realtek: Add quirk for Gigabyte Technology to fix headphone"
a8c26800e022 net: rfkill: prevent unlimited numbers of rfkill events from being created
6c55714c9310 xfrm_user: fix info leak in build_report()
e360d15fcb1e wifi: rt2x00usb: fix devres lifetime
f4786c34216a usb: typec: ucsi: skip connector validation before init
6e9f8d2b9557 Linux 6.18.22-rt-xanmod1
34d3dc0d2e5a XANMOD: .gitlab-ci: Change registry image to trixie
d0b0ca7f80ac Merge branch '6.18' into 6.18-rt
1d9cd8c1c15f Linux 6.18.22-xanmod1
1cfd3a296c3c Merge tag 'v6.18.22' into 6.18
f2b09e8b594c Linux 6.18.22
5e7b2cc8fae9 sched_ext: Fix stale direct dispatch state in ddsp_dsq_id
d5776a31c165 sched_ext: Refactor do_enqueue_task() local and global DSQ paths
9e36ceb5ca43 mm/memory: fix PMD/PUD checks in follow_pfnmap_start()
cef18bb87a6c mm: replace READ_ONCE() with standard page table accessors
a836054ea810 scsi: target: tcm_loop: Drain commands in target_reset handler
ce54802fe6bb scsi: target: file: Use kzalloc_flex for aio_cmd
a98b78116a27 net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback
5f4061f8225d net: mana: fix use-after-free in add_adev() error path
24ce568f7553 drm/amd/display: Fix DCE LVDS handling
ba9be472a438 drm/amd/pm: disable OD_FAN_CURVE if temp or pwm range invalid for smu v13
5bbadf60b121 wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free
e367143b520a kallsyms: prevent module removal when printing module name and buildid
10bbeed03e1d kallsyms: cleanup code for appending the module buildid
c1d72e846cb4 kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid()
ab5f05ae96fc kallsyms: clean up @namebuf initialization in kallsyms_lookup_buildid()
8e5eb1d6e6a3 usb: gadget: f_uac1_legacy: validate control request size
5d1bb391ceee usb: gadget: f_hid: move list and spinlock inits from bind to alloc
18ada801899f usb: gadget: f_rndis: Fix net_device lifecycle with device_move
9cbc4f109bb2 usb: gadget: f_subset: Fix net_device lifecycle with device_move
4ccdccff8feb usb: gadget: f_eem: Fix net_device lifecycle with device_move
4e34f3f491fd usb: gadget: f_ecm: Fix net_device lifecycle with device_move
446f1842cda9 usb: gadget: f_rndis: Protect RNDIS options with mutex
3d436670b474 usb: gadget: f_subset: Fix unbalanced refcnt in geth_free
1aa9356881ee usb: gadget: uvc: fix NULL pointer dereference during unbind race
a36e5e800b9c usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo
6ad77458637b usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop
63dc317dfcd3 ice: Fix memory leak in ice_set_ringparam()
7d581e253469 HID: appletb-kbd: add .resume method in PM
f4e608fe12b7 usb: typec: ucsi: validate connector number in ucsi_notify_common()
cc300853b9eb usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer
5687a0977606 USB: dummy-hcd: Fix interrupt synchronization error
efbd9441f1e7 USB: dummy-hcd: Fix locking/synchronization error
cd9c6fcd1cf1 thunderbolt: Fix property read in nhi_wake_supported()
15f0c2d9eebc usb: typec: thunderbolt: Set enter_vdo during initialization
acea446ba4f4 misc: fastrpc: check qcom_scm_assign_mem() return in rpmsg_probe
3a164f640953 misc: fastrpc: possible double-free of cctx->remote_heap
c4c7219e9331 thermal: core: Fix thermal zone device registration error path
2dbe93f344f1 thermal: core: Address thermal zone removal races with resume
f0cf9c7b7c28 gpio: Fix resource leaks on errors in gpiochip_add_data_with_key()
70b6e2e01503 gpio: mxc: map Both Edge pad wakeup to Rising Edge
72c43eb2e334 sched_ext: Fix is_bpf_migration_disabled() false negative on non-PREEMPT_RCU
d2703b4f8fb7 cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path
65a5847e1a6c virtio_net: clamp rss_max_key_size to NETDEV_RSS_KEY_LEN
5dff799c6771 net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled
8351d18989c8 net: ftgmac100: fix ring allocation unwind on open failure
eddfce70a6f3 vxlan: validate ND option lengths in vxlan_na_create
3aea268b6d5c crypto: tegra - Add missing CRYPTO_ALG_ASYNC
6562290225c1 counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member
e07237df8538 counter: rz-mtu3-cnt: prevent counter from being toggled multiple times
bbb6c37c7a48 vt: resize saved unicode buffer on alt screen exit after resize
891d790fdb5c vt: discard stale unicode buffer on alt screen exit after resize
554d005d5161 gpib: Fix fluke driver s390 compile issue
68ca0eea0af0 netfilter: ipset: drop logically empty buckets in mtype_del
784ed4abded1 nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy
0c94b84b6ef5 nvmem: imx: assign nvmem_cell_info::raw_len
5a8f2e95f9a1 s390/cpum_sf: Cap sampling rate to prevent lsctl exception
586222c37d40 s390/zcrypt: Fix memory leak with CCA cards used as accelerator
a11f022db7d8 spi: cadence-qspi: Fix exec_mem_op error handling
f5526abe978f dt-bindings: connector: add pd-disable dependency
d266498da90d firmware: microchip: fail auto-update probe if no flash found
eae19cab4420 comedi: me4000: Fix potential overrun of firmware buffer
a47ae40339c1 comedi: me_daq: Fix potential overrun of firmware buffer
43c68a2c7cc3 comedi: ni_atmio16d: Fix invalid clean-up after failed attach
b89c02622771 comedi: Reinit dev->spinlock between attachments to low-level drivers
34c8b3a91bdf comedi: dt2815: add hardware detection to prevent crash
e92f5ee73065 cdc-acm: new quirk for EPSON HMD
837392a38445 bridge: br_nd_send: validate ND option lengths
5da684c24e8b ASoC: qcom: sc7280: make use of common helpers
f43f77499ec8 io_uring: protect remaining lockless ctx->rings accesses with RCU
09f78265a93d usb: core: use dedicated spinlock for offload state
5a85599ca4d2 usb: cdns3: gadget: fix state inconsistency on gadget init failure
390536cc6af4 usb: cdns3: gadget: fix NULL pointer dereference in ep_queue
701903fcac4a usb: core: phy: avoid double use of 'usb3-phy'
61937f686290 usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop()
6288b46e5ac6 usb: ehci-brcm: fix sleep during atomic
34af2da733f4 usb: host: xhci-sideband: delegate offload_usage tracking to class drivers
65ff09f48b0e usb: misc: usbio: Fix URB memory leak on submit failure
977b632db51d usb: usbtmc: Flush anchored URBs in usbtmc_release
38c28fe25611 usb: ulpi: fix double free in ulpi_register_interface() error path
882bdb01ff12 usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive
21f942879f86 gpib: lpvo_usb: fix memory leak on disconnect
ffacfe07177d mei: me: reduce the scope on unexpected reset
fefd0bceac15 iio: gyro: mpu3050: Fix out-of-sequence free_irq()
cc3de12a5612 iio: gyro: mpu3050: Move iio_device_register() to correct location
3a8e68d65a44 iio: gyro: mpu3050: Fix irq resource leak
ac1233397f4c iio: gyro: mpu3050: Fix incorrect free_irq() variable
7f14b52a81f9 iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only
d6e078c63409 iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin()
04d8f0a785dc iio: light: veml6070: fix veml6070_read() return value
0ad74c370e8d iio: light: vcnl4035: fix scan buffer on big-endian
b0e1fec0a0d0 iio: imu: adis16550: fix swapped gyro/accel filter functions
2ed3d9bc86b6 iio: dac: ad5770r: fix error return in ad5770r_read_raw()
d7161e8b6211 iio: accel: adxl313: add missing error check in predisable
b6d6f6e2e329 iio: accel: adxl380: fix FIFO watermark bit 8 always written as 0
6c4591e71668 iio: accel: fix ADXL355 temperature signature value
85981790ea35 iio: adc: aspeed: clear reference voltage bits before configuring vref
5f482fd456bc iio: adc: ade9000: move mutex init before IRQ registration
87180f65f90d iio: adc: ade9000: fix wrong register in CALIBBIAS case for active power
3707af316f86 iio: adc: ade9000: fix wrong return type in streaming push
25e04a8291f4 iio: adc: ti-ads7950: do not clobber gpio state in ti_ads7950_get()
6afa581aed0f iio: adc: ti-ads7950: normalize return value of gpio_get
d0a6b8d186da Input: xpad - add support for Razer Wolverine V3 Pro
86620132e9c4 Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode
00f0cc75356b Input: bcm5974 - recover from failed mode switch
beba26c55f4e Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table
33e646804070 Input: synaptics-rmi4 - fix a locking bug in an error path
8ea8dc0d62e3 USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam
42e4fbeb853a USB: serial: option: add support for Rolling Wireless RW135R-GL
70fd81b9c4bf USB: serial: io_edgeport: add support for Blackbox IC135A
2b8ae82d85d7 drm/amdgpu/pm: drop SMU driver if version not matched messages
77c918eaa4c9 drm/amdgpu: Change AMDGPU_VA_RESERVED_TRAP_SIZE to 64KB
3543005a42d7 drm/amdgpu: validate doorbell_offset in user queue creation
1e130cf9cd17 drm/amdgpu: Fix wait after reset sequence in S4
d0fd0bea8475 drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP
86e926b10888 drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode
df4979eef358 drm/ast: dp501: Fix initialization of SCU2C
5a17678b7419 iio: adc: ti-ads1119: Replace IRQF_ONESHOT with IRQF_NO_THREAD
30e2275b3469 iio: adc: ti-ads1119: Reinit completion before wait_for_completion_timeout()
64bc0219e4d8 iio: adc: ti-ads1119: Fix unbalanced pm reference count in ds1119_single_conversion()
014c6d27878d iio: adc: ti-adc161s626: use DMA-safe memory for spi_read()
054ea2f12beb iio: adc: ti-adc161s626: fix buffer read on big-endian
d9bf25ef3d30 iio: orientation: hid-sensor-rotation: add timestamp hack to not break userspace
7d14b49de8fc iio: orientation: hid-sensor-rotation: fix quaternion alignment
2b655a917644 iio: add IIO_DECLARE_QUATERNION() macro
cae26eff1b56 gpib: fix use-after-free in IO ioctl handlers
115a4c8df909 drm/amdgpu: fix the idr allocation flags
1e3e98596c27 x86/kexec: Disable KCOV instrumentation after load_segments()
16062d6830a7 mips: mm: Allocate tlb_vpn array atomically
243d55bd3f08 hwmon: (occ) Fix division by zero in occ_show_power_1()
1010390094fa MIPS: Fix the GCC version check for `__multi3' workaround
247e1e7e25c8 MIPS: SiByte: Bring back cache initialisation
075ea208c648 ksmbd: fix OOB write in QUERY_INFO for compound requests
aba0aea35401 Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync
fa14e0e19820 Bluetooth: SMP: force responder MITM requirements before building the pairing response
061ee71ac6b0 Bluetooth: SMP: derive legacy responder STK authentication from MITM state
c314b405dcc4 io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs()
2e8194b4fdee ALSA: hda/realtek: add quirk for HP Victus 15-fb0xxx
682b5fd11568 ALSA: hda/realtek: Add quirk for ASUS ROG Strix SCAR 15
57698f184e1a ALSA: ctxfi: Fix missing SPDIFI1 index handling
3afa2e67f352 ALSA: caiaq: fix stack out-of-bounds read in init_card
1933249263c3 lib/crypto: chacha: Zeroize permuted_state before it leaves scope
b49bf41b4114 sched_ext: Fix inconsistent NUMA node lookup in scx_select_cpu_dfl()
10c13c111d0d drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw()
ce47541f5c40 USB: serial: option: add MeiG Smart SRM825WN
dd90880eb5ec wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler()
d8388614de61 wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation
20e2418b9836 rust_binder: use AssertSync for BINDER_VM_OPS
f0e441be08a2 drm/ioc32: stop speculation on the drm_compat_ioctl path
1200f4240c07 ACPI: RIMT: Add dependency between iommu and devices
50392cdfe95e riscv: Reset pmm when PR_TAGGED_ADDR_ENABLE is not set
e1425ff578c4 riscv: kgdb: fix several debug register assignment bugs
e435a30ca6fe perf/x86: Fix potential bad container_of in intel_pmu_hw_config
87573883c30f sched/fair: Fix zero_vruntime tracking fix
a99f94e4f28a mips: ralink: update CPU clock index
d6fbc5750f38 hwmon: (asus-ec-sensors) Fix T_Sensor for PRIME X670E-PRO WIFI
d16f8716c927 drm/sysfb: Fix efidrm error handling and memory type mismatch
6205de166dfb hwmon: (occ) Fix missing newline in occ_show_extended()
ee4c064e37d4 spi: amlogic: spifc-a4: unregister ECC engine on probe failure and remove() callback
fdbfa1bf2c75 hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify()
9e962e68a9d2 drm/xe/pxp: Clear restart flag in pxp_start after jumping back
5633454e28d3 drm/xe/pxp: Remove incorrect handling of impossible state during suspend
ec4530967192 drm/xe/pxp: Clean up termination status on failure
e8298e0cc68d spi: stm32-ospi: Fix reset control leak on probe error
b4ec54c974c6 spi: stm32-ospi: Fix resource leak in remove() callback
3a8b66a84f05 dt-bindings: gpio: fix microchip #interrupt-cells
dfe3a785ae7f hwmon: (ltc4286) Add missing MODULE_IMPORT_NS("PMBUS")
13b0cb996365 hwmon: (pxe1610) Check return value of page-select write in probe
79b7e588399b hwmon: (tps53679) Fix array access with zero-length block read
040a1e7e0e2f io_uring/rsrc: reject zero-length fixed buffer import
f403094d9075 accel/qaic: Handle DBC deactivation if the owner went away
33b54c7793cf gpiolib: clear requested flag if line is invalid
606f88c162b2 gpio: rename gpio_chip_hwgpio() to gpiod_hwgpio()
9e5495d216bf iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one
89c3a4ba6030 Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug"
dc9a060d76c1 bpf: Reject sleepable kprobe_multi programs at attach time
63276547debc bpf: reject direct access to nullable PTR_TO_BUF pointers
7c15dabcbc9e eth: fbnic: Increase FBNIC_QUEUE_SIZE_MIN to 64
9ed81d692758 ipv6: avoid overflows in ip6_datagram_send_ctl()
1fe371a34e80 net: hsr: fix VLAN add unwind on slave errors
a208c3e12329 net/sched: cls_flow: fix NULL pointer dereference on shared blocks
3cb055df9e86 net/sched: cls_fw: fix NULL pointer dereference on shared blocks
8c92969c197b net/x25: Fix overflow when accumulating packets
fa1dbc93530b net/x25: Fix potential double free of skb
311efb3cfc92 bnxt_en: Restore default stat ctxs for ULP when resource is available
e27153b2bd6e net/mlx5: Fix switchdev mode rollback in case of failure
276b3efb2b48 net/mlx5: Avoid "No data available" when FW version queries fail
c53cf44588a9 net/mlx5: lag: Check for LAG device before creating debugfs
5392a5174df4 net: macb: properly unregister fixed rate clocks
16ab4c0e2b15 net: macb: fix clk handling on PCI glue driver removal
3a2999704ac3 net/sched: sch_netem: fix out-of-bounds access in packet corruption
18861f87a043 bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready().
23e07c340c44 rds: ib: reject FRMR registration before IB connection is established
edb5898cfa91 Bluetooth: MGMT: validate mesh send advertising payload length
1d0bdbfe3e91 Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt
7d568fede8ea Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync
50fb64defa72 Bluetooth: MGMT: validate LTK enc_size on load
3ec3a1588876 Bluetooth: hci_h4: Fix race during initialization
98c8d3bfdaa6 Bluetooth: SCO: fix race conditions in sco_sock_connect()
d4d1a4eed6f6 Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate
42a47f4b1b76 netfilter: nf_tables: reject immediate NF_QUEUE verdict
dc3e27dd7d76 netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP
187b6ec5229e netfilter: ctnetlink: ignore explicit helper on new expectations
a0684ccc1ddd netfilter: nf_conntrack_expect: store netns and zone in expectation
b53294bff19e netfilter: nf_conntrack_expect: use expect->helper
54cb3500e8af netfilter: nf_conntrack_expect: honor expectation helper field
929f7a9a7aad netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent
620f3d14c1ef netfilter: nf_conntrack_helper: pass helper to expect cleanup
a54bbbcd3c62 netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr
f419bdc20589 netfilter: x_tables: ensure names are nul-terminated
88a8f56e6276 netfilter: nfnetlink_log: account for netlink header size
504c9456699d netfilter: flowtable: strictly check for maximum number of actions
908dd5faf816 ALSA: usb-audio: Exclude Scarlett 2i2 1st Gen (8016) from SKIP_IFACE_SETUP
87a8287e7624 net: stmmac: skip VLAN restore when VLAN hash ops are missing
58b58b9ba89c mptcp: fix soft lockup in mptcp_recvmsg()
8d38f222795d mptcp: add eat_recv_skb helper
414726b69921 net: ipv6: flowlabel: defer exclusive option free until RCU teardown
8aebe1806939 bpf: Fix regsafe() for pointers to packet
917303fda0f1 ASoC: Intel: boards: fix unmet dependency on PINCTRL
2a0323a91310 net: xilinx: axienet: Fix BQL accounting for multi-BD TX packets
f3cf32dc1ebb net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec
ad2f60de5045 NFC: pn533: bound the UART receive buffer
d4cc7e4c80b1 net: bonding: fix use-after-free in bond_xmit_broadcast()
153d5520c3f9 crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption
fafe0fa2995a crypto: algif_aead - Revert to operating out-of-place
c8d53b70166d bnxt_en: set backing store type from query type
906997ea3766 net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak
cc91202fc20a net: use skb_header_pointer() for TCPv4 GSO frag_off check
846cd4a5ffdc net: introduce mangleid_features
ae585d9ac863 net: airoha: Add missing cleanup bits in airoha_qdma_cleanup_rx_queue()
3cd4efb5df72 ipv6: prevent possible UaF in addrconf_permanent_addr()
2321b0d47a11 ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure
19f90e0061b6 ALSA: usb-audio: Exclude Scarlett Solo 1st Gen from SKIP_IFACE_SETUP
15db5c44f79c net: enetc: do not allow VF to configure the RSS key
85b4fb46a898 net: enetc: check whether the RSS algorithm is Toeplitz
3b4df3d43ae4 net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta
17c1b9807b8a net/sched: sch_hfsc: fix divide-by-zero in rtsc_min()
9c55e41c73af bridge: br_nd_send: linearize skb before parsing ND options
117f9453dd7c eth: fbnic: Account for page fragments when updating BDQ tail
590f622669b9 ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
a2edbb639397 ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()
7e55845bd897 tg3: Fix race for querying speed/duplex
184d2e9db27c net/ipv6: ioam6: prevent schema length wraparound in trace fill
b485eef3d97b net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak
f2664bc4f0f3 net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak
77c5f0a105d0 net: enetc: reset PIR and CIR if they are not equal when initializing TX ring
98bef6f424a3 net: fec: fix the PTP periodic output sysfs interface
53219f87bd22 netdevsim: fix build if SKB_EXTENSIONS=n
7267e4c75f9f net: mana: Fix RX skb truesize accounting
00cbdec17c15 crypto: af-alg - fix NULL pointer dereference in scatterwalk
83622e52431e crypto: deflate - fix spurious -ENOSPC
aa545df01133 crypto: caam - fix overflow on long hmac keys
68feed135a0c crypto: caam - fix DMA corruption on long hmac keys
91478edb8cbc wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session
52dc79062f23 wifi: iwlwifi: mld: correctly set wifi generation data
2f84d5e9c1c5 wifi: iwlwifi: disable EHT if the device doesn't allow it
9d713f4f8bb0 wifi: iwlwifi: cfg: add new device names
c0b3fa5e0eae wifi: iwlwifi: mvm: don't send a 6E related command when not supported
624af5c3baa2 wifi: iwlwifi: mld: Fix MLO scan timing
ee555d539975 wifi: iwlwifi: fix remaining kernel-doc warnings
fdbc00b8b2ee dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning
4d47b812f925 spi: geni-qcom: Check DMA interrupts early in ISR
f4e35576da43 smb: client: fix generic/694 due to wrong ->i_blocks
850de3d87f47 btrfs: reject root items with drop_progress and zero drop_level
86d7c80e1cff i2c: tegra: Don't mark devices with pins as IRQ safe
cf930a651eef btrfs: reserve enough transaction items for qgroup ioctls
7f66fdbc077f HID: multitouch: Check to ensure report responses match the request
8f7103464973 HID: core: Mitigate potential OOB by removing bogus memset()
b846fb0a73e9 HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure
34b12ab75ae2 objtool: Fix Clang jump table detection
7e0576dcf245 tg3: replace placeholder MAC address with device property
8b3484011a83 btrfs: don't take device_list_mutex when querying zone info
abc10f85a396 atm: lec: fix use-after-free in sock_def_readable()
c8dc23c97680 HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq
be81f17151fc wifi: mac80211: check tdls flag in ieee80211_tdls_oper
6c4e67e6ba25 HID: logitech-hidpp: Enable MX Master 4 over bluetooth
1c41248cef83 arm64/scs: Fix handling of advance_loc4
eb894ca03fcd Linux 6.18.21-xanmod1
ecb9a3fa0c2b Merge tag 'v6.18.21' into 6.18
44c944a67997 Linux 6.18.21
e75a5c054d49 Bluetooth: L2CAP: Fix regressions caused by reusing ident
853f70c67d1b futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy()
18b7d09c2b79 futex: Require sys_futex_requeue() to have identical flags
a7df91375471 irqchip/renesas-rzv2h: Fix error path in rzv2h_icu_probe_common()
f0035858dfb2 netfs: Fix the handling of stream->front by removing it
e7ba52b38766 xen/privcmd: unregister xenstore notifier on module exit
806d40421a59 btrfs: fix lost error when running device stats on multiple devices fs
3c844d01f987 btrfs: fix leak of kobject name for sub-group space_info
c1677817b906 btrfs: fix super block offset in error message in btrfs_validate_super()
3e5fd8f53b57 netfs: Fix read abandonment during retry
0c9256f31003 selftests/mount_setattr: increase tmpfs size for idmapped mount tests
285a2602bf37 dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA
ec48fb2f5936 dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction
e75f5f76be90 dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA
e9a6eba5f0c0 dmaengine: xilinx: xilinx_dma: Fix dma_device directions
82656e8daf8d dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc()
a4d1b4ba9754 netfs: Fix NULL pointer dereference in netfs_unbuffered_write() on retry
4bc2d72c7695 netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators
f27197ccfd2e dmaengine: xilinx: xdma: Fix regmap init error handling
e1d0d0080bab dmaengine: dw-edma: Fix multiple times setting of the CYCLE_STATE and CYCLE_BIT bits for HDMA.
eb048d11fa2a phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types()
facd0012708e dmaengine: idxd: Fix leaking event log memory
a18e809e22d3 dmaengine: idxd: Fix freeing the allocated ida too late
a9e7815d3862 dmaengine: idxd: Fix memory leak when a wq is reset
958e96533ddb dmaengine: idxd: Fix not releasing workqueue on .release()
504c0e675100 dmaengine: idxd: Fix possible invalid memory access after FLR
aa0ffc6d3990 dmaengine: idxd: Fix crash when the event log is disabled
40b3f4700e55 mm/mseal: update VMA end correctly on merge
a5c6f6d6ceef ksmbd: fix use-after-free and NULL deref in smb_grant_oplock()
7ad1997b9bc8 mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
e9de9f3ce06b mm/damon/sysfs: fix param_ctx leak on damon_sysfs_new_test_ctx() failure
9c495f9d3781 mm/damon/core: avoid use of half-online-committed context
9cf7588aa578 mm/damon/stat: monitor all System RAM resources
5eeba3a7bf49 drm/amd/pm: fix amdgpu_irq enabled counter unbalanced on smu v11.0
e1cd6e0251ef rust: pin-init: internal: init: document load-bearing fact of field accessors
6b60e35a7fdb unwind_user/x86: Fix arch=um build
41fc9825ac25 powerpc64/bpf: do not increment tailcall count when prog is NULL
b159111cdd8a arm64: dts: imx8mn-tqma8mqnl: fix LDO5 power off
812b6a7cd3e7 ext4: always drain queued discard work in ext4_mb_release()
f7817ad399d6 ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths
12624c5b724a ext4: handle wraparound when searching for blocks for indirect mapped blocks
0652ab1bd814 ext4: fix the might_sleep() warnings in kvfree()
c97e282f7bfd ext4: fix use-after-free in update_super_work when racing with umount
ad1f6d608f33 ext4: reject mount if bigalloc with s_first_data_block != 0
1895f7904be7 ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()
416c86f30f91 ext4: avoid infinite loops caused by residual data
93f2e975ed65 ext4: validate p_idx bounds in ext4_ext_correct_indexes
b44fc445b3b7 ext4: test if inode's all dirty pages are submitted to disk
4855a59e2178 ext4: publish jinode after initialization
823849a26af0 ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio
f49a14810dfe ext4: make recently_deleted() properly work with lazy itable initialization
1d4460f33ce8 ext4: fix fsync(2) for nojournal mode
16041a808b50 ext4: do not check fast symlink during orphan recovery
95de75794cd9 ext4: fix stale xarray tags after writeback
93cb2d103e5c ext4: convert inline data to extents when truncate exceeds inline size
69835472c726 ext4: fix journal credit check when setting fscrypt context
2c2db09b9043 xfs: remove file_path tracepoint data
a1a5df1038f0 xfs: don't irele after failing to iget in xfs_attri_recover_work
68d80f35ea62 xfs: fix ri_total validation in xlog_recover_attri_commit_pass2
3b0c3414b308 xfs: scrub: unlock dquot before early return in quota scrub
95fb5d643cc7 xfs: avoid dereferencing log items after push callbacks
50f5f056807b xfs: save ailp before dropping the AIL lock in push callbacks
8147e304d7d3 xfs: stop reclaim before pushing AIL during unmount
38ec58670a0c mm/pagewalk: fix race between concurrent split and refault
3527e9fdc385 mm/damon/sysfs: check contexts->nr in repeat_call_fn
708033c231bd mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0]
54c143028eb4 drm/amd/pm: Return -EOPNOTSUPP for unsupported OD_MCLK on smu_v13_0_6
126053d0a685 LoongArch: KVM: Handle the case that EIOINTC's coremap is empty
878cf6acb4fd LoongArch: KVM: Make kvm_get_vcpu_by_cpuid() more robust
70fb63c5d36c LoongArch: Workaround LS2K/LS7A GPU DMA hang bug
53a27c09850b LoongArch: vDSO: Emit GNU_EH_FRAME correctly
a1da957c25cf LoongArch: Fix missing NULL checks for kstrdup()
70e2eb91cb63 drm/i915: Unlink NV12 planes earlier
859b14e0be9e drm/i915: Order OP vs. timeout correctly in __wait_for()
8581466b827f drm/i915/dp_tunnel: Fix error handling when clearing stream BW in atomic state
eb95595194e4 drm/amd/display: Fix drm_edid leak in amdgpu_dm
51ccaf0e30c3 drm/amdgpu: prevent immediate PASID reuse case
b6a468966347 dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock
2b2518b1abb3 dmaengine: sh: rz-dmac: Protect the driver specific lists
79d2151a7c30 dmaengine: fsl-edma: fix channel parameter config for fixed channel requests
20768be1734c i2c: imx: ensure no clock is generated after last read
dca0e38ecfd0 i2c: imx: fix i2c issue when reading multiple messages
92e47ad03e03 futex: Clear stale exiting pointer in futex_lock_pi() retry path
83bcea9da919 i2c: designware: amdisp: Fix resume-probe race condition issue
7319d57db908 irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment
1d896b408646 jbd2: gracefully abort on checkpointing state corruptions
bab090e8fd56 KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE
695320de6ead KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE
f4bc91398b57 net: macb: Use dev_consume_skb_any() to free TX SKBs
33eeb5471a8b net: macb: Protect access to net_device::ip_ptr with RCU lock
99405131d6ed net: macb: Move devm_{free,request}_irq() out of spin lock area
4771b85954be scsi: ses: Handle positive SCSI error from ses_recv_diag()
786f10b1966e scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done()
e02685511282 ovl: fix wrong detection of 32bit inode numbers
ebbac99bb666 ovl: make fsync after metadata copy-up opt-in mount option
db08e8c32090 phy: qcom: qmp-ufs: Fix SM8650 PCS table for Gear 4
4cce3cd5ed79 x86/fred: Fix early boot failures on SEV-ES/SNP guests
a6e14114684d x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask
5433c7ac4bc8 x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling()
83800f8ef358 writeback: don't block sync for filesystems with no data integrity guarantees
e54c8863ba33 alarmtimer: Fix argument order in alarm_timer_forward()
da4046406459 erofs: add GFP_NOIO in the bio completion if needed
9a18629f2525 virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
6f3c8795ae9b virt: tdx-guest: Fix handling of host controlled 'quote' buffer length
371a43c4ac70 xfrm: iptfs: only publish mode_data after clone setup
de6d8e8ce518 xfrm: iptfs: validate inner IPv4 header length in IPTFS payload
72b9e81e0203 media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex
529a3f3c49d3 hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible()
d640ef7117a1 hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute temperature
67fd1e71f768 hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs attributes
bf28ab8bed18 hwmon: (pmbus/ina233) Fix error handling and sign extension in shunt voltage read
8e209d882b67 KVM: arm64: Discard PC update state on vcpu reset
4cf2cc6bc1cd platform/x86: ISST: Correct locked bit width
fdaf61f2831a RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init()
ab839325a41c thermal: intel: int340x: soc_slider: Set offset only for balanced mode
8def1e51df14 kbuild: Delete .builtin-dtbs.S when running make clean
e2f7e4d83ab8 cpufreq: conservative: Reset requested_freq on limits change
f162aa749a40 can: netlink: can_changelink(): add missing error handling to call can_ctrlmode_changelink()
eec8a1b18a79 can: isotp: fix tx.buf use-after-free in isotp_sendmsg()
84f8b76d2427 can: gw: fix OOB heap access in cgw_csum_crc8_rel()
cab361aa6404 ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload
d472d1a52985 ASoC: sma1307: fix double free of devm_kzalloc() memory
6ab27f2dc76d ASoC: codecs: wcd934x: fix typo in dt parsing
c215d25cf050 ALSA: firewire-lib: fix uninitialized local variable
61aff3c1edc3 ALSA: hda/realtek: add quirk for ASUS Strix G16 G615JMR
47c459a6c9b6 Revert "ALSA: hda/intel: Add MSI X870E Tomahawk to denylist"
a897064a4570 ksmbd: do not expire session on binding failure
3cdacd11b415 ksmbd: fix memory leaks and NULL deref in smb2_lock()
b0cd9725fe2b ksmbd: fix potencial OOB in get_file_all_info() for compound requests
80824c7e527b ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len()
5eda8001ebb5 drm/xe: always keep track of remap prev/next
f278b8ebf7eb tracing: Fix potential deadlock in cpu hotplug with osnoise
7f4e3233faa8 s390/entry: Scrub r12 register on kernel entry
3d39a4ec6380 s390/barrier: Make array_index_mask_nospec() __always_inline
87776f02449e s390/syscalls: Add spectre boundary for syscall dispatch table
449005087718 ALSA: usb-audio: Exclude Scarlett 2i4 1st Gen from SKIP_IFACE_SETUP
e89e2b97253c spi: spi-fsl-lpspi: fix teardown order issue (UAF)
efb07062d95c ASoC: adau1372: Fix clock leak on PLL lock failure
02709ae51f93 ASoC: adau1372: Fix unchecked clk_prepare_enable() return value
01d5711be772 sysctl: fix uninitialized variable in proc_do_large_bitmap
4e9d723d9f19 hwmon: (pmbus/core) Protect regulator operations with mutex
cdf31cf5ca4a hwmon: (pmbus) Introduce the concept of "write-only" attributes
34479e52f1e9 hwmon: (pmbus) Mark lowest/average/highest/rated attributes as read-only
8b476d95e98b hwmon: (adm1177) fix sysfs ABI violation and current unit conversion
39820864eacd drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib
d04c007047c8 ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()
c73a58661a76 spi: use generic driver_override infrastructure
15da4f5e1001 drm/xe: Implement recent spec updates to Wa_16025250150
4e96a8440e74 rust: regulator: do not assume that regulator_get() returns non-null
8f3226f00cb1 ASoC: dt-bindings: stm32: Fix incorrect compatible string in stm32h7-sai match
8a5edc97fd9c drm/amd/display: Do not skip unrelated mode changes in DSC validation
da06a104f048 spi: meson-spicc: Fix double-put in remove path
7af2d06ec25b ASoC: Intel: catpt: Fix the device initialization
234a82a13886 spi: sn-f-ospi: Fix resource leak in f_ospi_probe()
3025ca5daa9d PM: sleep: Drop spurious WARN_ON() from pm_restore_gfp_mask()
13a6af01c1e3 PM: hibernate: Drain trailing zero pages on userspace restore
842aa6103b6f drm/i915/gmbus: fix spurious timeout on 512-byte burst reads
9a709b7e3632 drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register
f8afc292d4bc x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size
a8b66cf9ba3c scsi: scsi_transport_sas: Fix the maximum channel scanning issue
6140239d4518 ASoC: fsl: imx-card: initialize playback_only and capture_only
3f08351de5ca RDMA/irdma: Harden depth calculation functions
0e04f3f2dca4 RDMA/irdma: Return EINVAL for invalid arp index error
cd8bcec2de5e RDMA/irdma: Fix deadlock during netdev reset with active connections
8203f295b4bc RDMA/irdma: Remove reset check from irdma_modify_qp_to_err()
30d9491bbb69 RDMA/irdma: Clean up unnecessary dereference of event->cm_node
4c2b2ea802bc RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce()
feeabfc936d7 RDMA/irdma: Update ibqp state to error if QP is already in error state
3cb88c12461b RDMA/irdma: Initialize free_qp completion before using it
9d4fe0d7586e ALSA: usb-audio: Exclude Scarlett 2i2 1st Gen from SKIP_IFACE_SETUP
f9433abfcf83 RDMA/efa: Fix possible deadlock
21ae8790e5a8 RDMA/rw: Fall back to direct SGE on MR pool exhaustion
a1dc886137ab ALSA: hda/realtek: Sequence GPIO2 on Star Labs StarFighter
f710129df9fc regmap: Synchronize cache for the page selector
0dd98aea1c0c RDMA/efa: Fix use of completion ctx after free
97da0d993d7c RDMA/efa: Improve admin completion context state machine
26bd3a77c5ff RDMA/efa: Check stored completion CTX command ID with received one
7ff87da09921 net: macb: use the current queue number for stats
c6cb41eaae87 netfilter: ctnetlink: use netlink policy range checks
01f34a80ac23 netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp
9ca8c7452493 netfilter: nf_conntrack_expect: skip expectations in other netns via proc
53d8899452d9 netfilter: nft_set_rbtree: revisit array resize logic
d8795fde1f78 netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()
c9f6c51d3648 netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD
9f557c7eae12 tls: Purge async_hold in tls_decrypt_async_wait()
1019028eb124 Bluetooth: btusb: clamp SCO altsetting table indices
900e4db5385e Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop
3f26ecbd9cde Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del()
ea6cf86167b3 Bluetooth: L2CAP: Fix not tracking outstanding TX ident
66696648af47 Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock
5c7cd74673bc Bluetooth: L2CAP: Fix send LE flow credits in ACL link
4f23cceb3500 dma-mapping: add missing `inline` for `dma_free_attrs`
064fede3ae78 rtnetlink: fix leak of SRCU struct in rtnl_link_register
4e27807943b1 net: lan743x: fix duplex configuration in mac_link_up
0a7468ed49a6 team: fix header_ops type confusion with non-Ethernet ports
a72891444623 virtio-net: correct hdr_len handling for tunnel gso
5f217e718236 virtio-net: correct hdr_len handling for VIRTIO_NET_F_GUEST_HDRLEN
2fefa595d484 net: enetc: fix the output issue of 'ethtool --show-ring'
18d84c45def3 udp: Fix wildcard bind conflict check when using hash2
966937039e07 net: airoha: add RCU lock around dev_fill_forward_path
d0c7cdc15fdf net: fix fanout UAF in packet_release() via NETDEV_UP race
103931f6fdbb ipv6: Don't remove permanent routes with exceptions from tb6_gc_hlist.
edf57ce04bc1 ipv6: Remove permanent routes from tb6_gc_hlist when all exceptions expire.
bb85741d2dc2 iavf: fix out-of-bounds writes in iavf_get_ethtool_stats()
22c117745495 ice: use ice_update_eth_stats() for representor stats
218609e1e466 ice: fix inverted ready check for VF representors
fe1ed519210a platform/x86: intel-hid: disable wakeup_mode during hibernation
a825ab202533 platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen
eaa3dae239f2 platform/x86: lenovo: wmi-gamezone: Drop gz_chain_head
e29850b0faa8 platform/x86: ISST: Check HWP support before MSR access
d57cf5c770c0 net: bcmasp: fix double disable of clk
9e5f5c07cc7d net: bcmasp: fix double free of WoL irq
aba90ae2379f net: bcmasp: streamline early exit in probe
60ed7fa717b1 rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size
6fa3f2764f49 rtnetlink: count IFLA_PARENT_DEV_{NAME,BUS_NAME} in if_nlmsg_size
54c87a730157 net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer
bd50c7484c3b openvswitch: validate MPLS set/set_masked payload length
98b726ab5e2a openvswitch: defer tunnel netdev_put to RCU release
95265232b497 net: openvswitch: Avoid releasing netdev before teardown completes
d89b74bf08f0 nfc: nci: fix circular locking dependency in nci_close_device
097b16ffa61e ionic: fix persistent MAC address override on PF
936a3c0c10e2 pinctrl: mediatek: common: Fix probe failure for devices without EINT
1dc6db047919 Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb
9ecbfd93cd6d Bluetooth: hci_ll: Fix firmware leak on error path
bafec9325d4d Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete
7197462e90b8 Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold
8c96f3bd4ae0 Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()
5b35f8211a91 Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req
46737243be21 pinctrl: stm32: fix HDP driver dependency on GPIO_GENERIC
1500005f286f can: statistics: add missing atomic access in hot path
5cf3972c8221 erofs: set fileio bio failed in short read case
f4b4debc0b73 dma: swiotlb: add KMSAN annotations to swiotlb_bounce()
83f644ea9298 af_key: validate families in pfkey_send_migrate()
8854e9367465 xfrm: prevent policy_hthresh.work from racing with netns teardown
2255ed6adbc3 xfrm: Fix work re-schedule after cancel in xfrm_nat_keepalive_net_fini()
ee0e3521f806 pinctrl: renesas: rza1: Normalize return value of gpio_get()
33a7b3626893 xfrm: iptfs: fix skb_put() panic on non-linear skb during reassembly
7068aaa1cef4 pinctrl: renesas: rzt2h: Fix device node leak in rzt2h_gpio_register()
88d386243ed3 esp: fix skb leak with espintcp and async crypto
af834169a410 xfrm: call xdo_dev_state_delete during state update
ecb02f949e3e xfrm: fix the condition on x->pcpu_num in xfrm_sa_len
88467620fa4a xfrm: add missing extack for XFRMA_SA_PCPU in add_acquire and allocspi
b4a1e07944fe i3c: master: dw-i3c: Fix missing of_node for virtual I2C adapter
6eee692c4204 ALSA: hda/realtek: add quirk for ASUS UM6702RC
72969a102f93 spi: intel-pci: Add support for Nova Lake mobile SPI flash
cbc467b4d9f3 usb: core: new quirk to handle devices with zero configurations
ad696758a45c drm/amdgpu: fix gpu idle power consumption issue for gfx v12
ca111c9d8d6c nvmet: move async event work off nvmet-wq
17c9ad5aa46c objtool: Handle Clang RSP musical chairs
90420418e622 ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390
f93b6da04ec7 ALSA: hda/realtek: Add quirk for Gigabyte Technology to fix headphone
bee43f7b9bc6 ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk
ed97a37b00d9 powerpc64/ftrace: fix OOL stub count with clang
2ec578e64521 btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create
91608747a8d2 sched_ext: Use WRITE_ONCE() for the write side of dsq->seq update
be1a341c1614 HID: apple: avoid memory leak in apple_report_fixup()
74b1b0d84697 bpf: Fix u32/s32 bounds when ranges cross min/max boundary
b4770c2e70e6 ASoC: amd: acp: Add ACP6.3 match entries for Cirrus Logic parts
be0c2255d717 drm/ttm/tests: Fix build failure on PREEMPT_RT
34f0790eb712 ALSA: hda/senary: Ensure EAPD is enabled during init
5cf83b76f738 block: break pcpu_alloc_mutex dependency on freeze_lock
e33c0c59f1f4 dma-buf: Include ioctl.h in UAPI header
9924fd289901 ASoC: cs35l56: Only patch ASP registers if the DAI is part of a DAIlink
1e68eeada7b0 ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits()
77759925aeb6 ALSA: hda/hdmi: Add Tegra238 HDA codec device ID
3d5f63d86720 ASoC: Intel: sof_sdw: Add quirk for Alienware Area 51 (2025) 0CCD SKU
74b25178943f scsi: devinfo: Add BLIST_SKIP_IO_HINTS for Iomega ZIP
09293aecd479 ASoC: rt1321: fix DMIC ch2/3 mask issue
99c9a684b22d scsi: mpi3mr: Clear reset history on ready and recheck state after timeout
f927555140c7 ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg()
ef75dc1401d8 module: Fix kernel panic when a symbol st_shndx is out of bounds
4ebc4d48fca9 HID: asus: add xg mobile 2023 external hardware support
bf0ffc028f82 HID: mcp2221: cancel last I2C command on read error
0a4e44eb4b0c platform/x86: oxpec: Add support for OneXPlayer X1 Air
ba6af12e600b platform/x86: oxpec: Add support for Aokzoe A2 Pro
6ea6cfdbd646 kbuild: install-extmod-build: Package resolve_btfids if necessary
4121e616c08a net: usb: r8152: add TRENDnet TUC-ET2G
1faaa81aabab platform/x86: oxpec: Add support for OneXPlayer X1z
b06021c3cfd8 HID: apple: Add EPOMAKER TH87 to the non-apple keyboards list
43c40bfb8503 platform/x86: oxpec: Add support for OneXPlayer APEX
f061affafb59 HID: intel-ish-hid: ipc: Add Nova Lake-H/S PCI device IDs
136f605e246b HID: magicmouse: avoid memory leak in magicmouse_report_fixup()
4101a437c236 HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2
b96c7b25eb1b nvme-pci: ensure we're polling a polled queue
4877461104f2 platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10
05bc9939b501 platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1
94b2a56fd4b1 platform/x86: hp-wmi: Add Omen 16-xd0xxx fan and thermal support
470e01ae896c nvme-fabrics: use kfree_sensitive() for DHCHAP secrets
2e9b4ca982d8 nvme-pci: cap queue creation to used queues
47910033f542 platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list
a41cc7c1668e HID: asus: avoid memory leak in asus_report_fixup()
c6a021ae84aa platform/x86: hp-wmi: Add Omen 16-wf0xxx fan and thermal support
61415d080d43 tracing: Revert "tracing: Remove pid in task_rename tracing output"
58bd87d0e692 bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR
f14ca604c0ff bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN
c0281da1f2aa bpf: Fix exception exit lock checking for subprogs
a85bbd9ef8a0 cxl: Adjust the startup priority of cxl_pmem to be higher than that of cxl_acpi
a446dbcb3877 bpf: Release module BTF IDR before module unload
7c02a9bd7d14 driver core: platform: use generic driver_override infrastructure
ad9465ca3444 driver core: generalize driver_override in struct device
1b1f570444dc sh: platform_early: remove pdev->driver_override check
1f11dc6dc792 hwmon: axi-fan: don't use driver_override as IRQ name
e85f446e82aa cxl/hdm: Avoid incorrect DVSEC fallback when HDM decoders are enabled
b36b0e804aee s390/mm: Add missing secure storage access fixups for donated memory
35f7914e54fe perf: Make sure to use pmu_ctx->pmu for groups
d94e6989e26c x86/perf: Make sure to program the counter value for stopped events on migration
ccbf29b28b55 bpf: Fix constant blinding for PROBE_MEM32 stores
a17443af8742 bpf: Reset register ID for BPF_END value tracking
2c3214146204 cxl/port: Fix use after free of parent_port in cxl_detach_ep()
40410158d77d Linux 6.18.20-xanmod1
a60ab72620d3 Merge tag 'v6.18.20' into 6.18
dd26ea937ef5 Linux 6.18.20
a52e3970f971 xen/privcmd: add boot control for restricted usage in domU
389bae9a4409 xen/privcmd: restrict usage in unprivileged domU
f909f22f5cec hwmon: (max6639) Fix pulses-per-revolution implementation
96955cf9f5ba arm64: realm: Fix PTE_NS_SHARED for 52bit PA support
ef6e6484747e tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure
d03e8c281fd3 lib/bootconfig: check xbc_init_node() return in override path
3ab1d7c8b6b7 fs/tests: exec: Remove bad test vector
cf4b224ffb9a drm/i915/gt: Check set_default_submission() before deferencing
a5828c14a9e3 ksmbd: fix use-after-free in durable v2 replay of active file handles
7f7468fd2a75 ksmbd: fix use-after-free of share_conf in compound request
2cb24caacee2 drm/bridge: dw-hdmi-qp: fix multi-channel audio output
c51a5319bf65 drm/amd: fix dcn 2.01 check
430334e9e4e8 drm/amd/display: Fix DisplayID not-found handling in parse_edid_displayid_vrr()
58abeb7b9562 iommu/sva: Fix crash in iommu_sva_unbind_device()
3f300a41a366 drm/vmwgfx: Don't overwrite KMS surface dirty tracker
bec21d97c968 spi: amlogic-spisg: Fix memory leak in aml_spisg_probe()
f15e0706e366 spi: amlogic: spifc-a4: Remove redundant clock cleanup
a9e119d027fd mtd: rawnand: brcmnand: skip DMA during panic write
5fd5c078af23 mtd: rawnand: serialize lock/unlock against other NAND operations
f8b5b833728b binfmt_elf_fdpic: fix AUXV size calculation for ELF_HWCAP3 and ELF_HWCAP4
75668e58244e tracing: Fix trace_marker copy link list updates
79f0faf81d3b x86/platform/uv: Handle deconfigured sockets
38539f55f61a tracing: Fix failure to read user space from system call trace events
b6925774dd15 ring-buffer: Fix to update per-subbuf entries of persistent ring buffer
886fa8691539 perf/x86: Move event pointer setup earlier in x86_pmu_enable()
ed1f5c1d43c3 perf/x86/intel: Add missing branch counters constraint apply
560ec8f99852 irqchip/riscv-rpmi-sysmsi: Fix mailbox channel leak in rpmi_sysmsi_probe()
aa9faa6486cf i2c: pxa: defer reset on Armada 3700 when recovery is used
bf8a9c92cdd1 i2c: fsi: Fix a potential leak in fsi_i2c_probe()
a9778298f470 i2c: cp2615: fix serial string NULL-deref at probe
7003794316b1 USB: serial: f81232: fix incomplete serial port generation
58b91c5cb685 hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit()
81f61e3e1ca2 hwmon: (pmbus/mp2869) Check pmbus_read_byte_data() before using its return value
48fed6459080 hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return value
4418f3186b22 hwmon: (pmbus/ina233) Add error check for pmbus_read_word_data() return value
beab26de7bca MPTCP: fix lock class name family in pm_nl_create_listen_socket
d938dd5a0ad7 icmp: fix NULL pointer dereference in icmp_tag_validation()
6ab68b4adf74 net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths
719f6784f918 net: shaper: protect from late creation of hierarchy
581eee0890a8 net: shaper: protect late read accesses to the hierarchy
7df2b50cae1a net: mvpp2: guard flow control update with global_tx_fc in buffer switching
3932620c04c2 nfnetlink_osf: validate individual option lengths in fingerprints
c8092edb9a11 netfilter: nf_tables: release flowtable after rcu grace period on error
c25e0dec366a netfilter: bpf: defer hook memory release until rcu readers are done
017d674cf693 net: bonding: fix NULL deref in bond_debug_rlb_hash_show
003343985f26 udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n
96c9c25b7468 net/mlx5e: Fix race condition during IPSec ESN update
2c6a5be0aee5 net/mlx5e: Prevent concurrent access to IPSec ASO context
ea52e95be463 net/mlx5: qos: Restrict RTNL area to avoid a lock cycle
c852ebfe4334 net: macb: fix uninitialized rx_fs_lock
63e192b8956a netdevsim: drop PSP ext ref on forward failure
98473309a36a ACPI: processor: Fix previous acpi_processor_errata_piix4() fix
06e769dddcbe wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure
46c670ff1ff4 wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom
44699c6cdfce wifi: mac80211: fix NULL deref in mesh_matches_local()
5f284b12cc12 libie: prevent memleak in fwlog code
cff11b1c03e6 iavf: fix VLAN filter lost on add/delete race
31521c124e64 igc: fix page fault in XDP TX timestamps handling
3472c22c067a igc: fix missing update of skb->tail in igc_xmit_frame()
89b2b1c64d09 ACPICA: Update the format of Arg3 of _DSM
d3e32a612c63 net: usb: aqc111: Do not perform PM inside suspend callback
4c9af67f99aa clsact: Fix use-after-free in init/destroy rollback asymmetry
a5bd5a271031 net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check
403f94ddcb36 net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check
d538b371da1e net: airoha: Remove airoha_dev_stop() in airoha_remove()
e9c66d3e7d85 net/sched: teql: Fix double-free in teql_master_xmit
fd7579f0a2c8 net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()
4172a7901cf4 bonding: prevent potential infinite loop in bond_header_parse()
bb081fd37f83 PM: runtime: Fix a race condition related to device removal
34c979e29bf6 sched: idle: Consolidate the handling of two special cases
afdb1533eb9c net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown
6995dcc1a93d net: bcmgenet: increase WoL poll timeout
683be1d1670e crypto: ccp - Fix leaking the same page twice
9d00fe7d6d7c netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()
f1aa81396d77 netfilter: xt_time: use unsigned int for monthday bit shift
cb549925875f netfilter: xt_CT: drop pending enqueued packets on template removal
f29a055e4f59 netfilter: nft_ct: drop pending enqueued packets on removal
31641c682db7 nf_tables: nft_dynset: fix possible stateful expression memleak in error path
6bce72daeccc netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case
865dba58958c netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp()
04c8907ce4e3 netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()
e01a597707c8 mpls: add missing unregister_netdevice_notifier to mpls_init
0c3e8bff808f net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect
d8f35767bacb bridge: cfm: Fix race condition in peer_mep deletion
1e1b7a7496a2 Bluetooth: qca: fix ROM version reading on WCN3998 chips
da3000cbe485 Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user
f8b6ed2f06d3 Bluetooth: HIDP: Fix possible UAF
b5c5e96f3b0a Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers
84d041cfefab Bluetooth: hci_sync: Fix hci_le_create_conn_sync
874e73969d48 Bluetooth: ISO: Fix defer tests being unstable
fce04c8b54e4 Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy
37021b16b270 Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU
734aa845f274 Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU
70d9bd9a2e68 firmware: arm_scmi: Fix NULL dereference on notify error path
d282757b0f6d firmware: arm_scpi: Fix device_node reference leak in probe path
3983811cab77 firmware: arm_ffa: Remove vm_id argument in ffa_rxtx_unmap()
ad01256fa62d arm64: dts: renesas: rzg3s-smarc-som: Set bypass for Versa3 PLL2
2a53d63ac78c arm64: dts: renesas: r9a09g087: Fix CPG register region sizes
dfe08c4dde87 arm64: dts: renesas: r9a09g077: Fix CPG register region sizes
fa59e9cfbed9 arm64: dts: renesas: r9a09g057: Remove wdt{0,2,3} nodes
74893eb6d360 arm64: dts: renesas: r9a09g057: Add RTC node
2e5902c28fbd arm64: dts: renesas: rzv2-evk-cn15-sd: Add ramp delay for SD0 regulator
edf76d957690 arm64: dts: renesas: rzt2h-n2h-evk: Add ramp delay for SD0 card regulator
a1b7a843f12a wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down
5ba05436f15d wifi: mac80211: Fix static_branch_dec() underflow for aql_disable.
31d4ceb785d9 wifi: mac80211: use jiffies_delta_to_msecs() for sta_info inactive times
f6a620a9d6a6 wifi: mac80211: remove keys after disabling beaconing
c2f6107728ea tee: shm: Remove refcounting of kernel pages
294e0c8bc350 soc: fsl: cpm1: qmc: Fix error check for devm_ioremap_resource() in qmc_qe_init_resources()
85dbbf7dc88b soc: fsl: qbman: fix race condition in qman_destroy_fq
2315d328faa8 soc: rockchip: grf: Add missing of_node_put() when returning
640452dbc118 cache: ax45mp: Fix device node reference leak in ax45mp_cache_init()
606fcf901c13 cache: starfive: fix device node leak in starlink_cache_init()
e3dd5cffba07 soc: microchip: mpfs: Fix memory leak in mpfs_sys_controller_probe()
8f9e054f605a btrfs: tree-checker: fix misleading root drop_level error message
1cf30c73602c btrfs: log new dentries when logging parent dir of a conflicting inode
9691c50fd5dd drm/i915/psr: Compute PSR entry_setup_frames into intel_crtc_state
8d0d94f8ba5b Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ
1e9e2640d870 drm/xe: Open-code GGTT MMIO access protection
8613cca4f5f4 drm/xe/oa: Allow reading after disabling OA stream
954dae0d94fb drm/xe/guc: Ensure CT state transitions via STOP before DISABLED
0b35d11fbbcf drm/i915/dmc: Fix an unlikely NULL pointer deference at probe
5ce4a38e6c24 drm/amdgpu: Limit BO list entry count to prevent resource exhaustion
73908f65f5cc drm/amdgpu: apply state adjust rules to some additional HAINAN vairants
c18eef45af03 drm/radeon: apply state adjust rules to some additional HAINAN vairants
772f3653eef5 drm/imagination: Synchronize interrupts before suspending the GPU
9497b1f30943 drm/imagination: Fix deadlock in soft reset sequence
7687403d6580 drm/amdgpu/mmhub4.1.0: add bounds checking for cid
72365be44cc7 drm/amdgpu/mmhub3.0: add bounds checking for cid
4b9e5676db81 drm/amdgpu/mmhub3.0.2: add bounds checking for cid
56f0473d3c63 drm/amdgpu/mmhub3.0.1: add bounds checking for cid
603db8a36517 drm/amdgpu/mmhub2.3: add bounds checking for cid
2c4eea0eba19 drm/amdgpu/mmhub2.0: add bounds checking for cid
3256b95b2d3c drm/amdgpu/gmc9.0: add bounds checking for cid
e25fff4a9eac drm/amd/display: Wrap dcn32_override_min_req_memclk() in DC_FP_{START, END}
074d06d3724c drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
3b02923b046a serial: uartlite: fix PM runtime usage count underflow on probe
efe85a557186 serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN
a773f019c0b0 serial: 8250_dw: Ensure BUSY is deasserted
0e16f461f2b1 serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY
5dfd8c76c0a4 serial: 8250_dw: Rework IIR_NO_INT handling to stop interrupt storm
2d21617bce4f serial: 8250_dw: Rework dw8250_handle_irq() locking and IIR handling
9bb497252a42 serial: 8250: Add serial8250_handle_irq_locked()
3b1d813de41e serial: 8250_dw: Avoid unnecessary LCR writes
e6cc0536d154 serial: 8250: Protect LCR write in shutdown
4afc12dae748 serial: 8250: always disable IRQ during THRE test
5f6b17562f03 serial: 8250: Fix TX deadlock when using DMA
5e5b209b2d93 serial: 8250_pci: add support for the AX99100
c4efef65a46f vt: save/restore unicode screen buffer for alternate screen
19e46bf37943 io_uring/kbuf: propagate BUF_MORE through early buffer commit path
f98405afd2a7 io_uring/kbuf: fix missing BUF_MORE for incremental buffers at EOF
0f4ce79b8db7 io_uring/poll: fix multishot recv missing EOF on wakeup race
ee312bb1052e iommu/vt-d: Only handle IOPF for SVA when PRI is supported
300e7cfdc92b iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry
c4054ad2d8bf mtd: Avoid boot crash in RedBoot partition table parser
215f6d6845a3 mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init()
978f50a3d7da mtd: rawnand: pl353: make sure optimal timings are applied
378b295f6710 spi: fix statistics allocation
80f3e8cd2b4a spi: fix use-after-free on controller registration failure
18605b1b936b pmdomain: bcm: bcm2835-power: Increase ASB control timeout
5ed633b212bd mmc: sdhci: fix timing selection for 1-bit bus width
c8d5757ab6d6 mmc: sdhci-pci-gli: fix GL9750 DMA write corruption
1343f110663d ata: libata-scsi: report correct sense field pointer in ata_scsiop_maint_in()
2229b4cf9730 ata: libata-core: disable LPM on ADATA SU680 SSD
08b2b65c63bb mm/huge_memory: fix a folio_split() race condition with folio_try_get()
edb6c2118293 ipmi:msghandler: Handle error returns from the SMI sender
1e363c11cd2f ipmi: Consolidate the run to completion checking for xmit msgs lock
522acaae34aa sched_ext: Disable preemption between scx_claim_exit() and kicking helper work
c1b8245c0a38 sched_ext: Simplify breather mechanism with scx_aborting flag
c44198f25fdf sched_ext: Fix starvation of scx_enable() under fair-class saturation
2f3dea284c76 nsfs: tighten permission checks for ns iteration ioctls
05edc78eb469 drm/xe/sync: Fix user fence leak on alloc failure
528aaa37d3c3 fgraph: Fix thresh_return nosleeptime double-adjust
407cc37c21d5 ksmbd: Don't log keys in SMB3 signing and encryption key generation
58f5d34f88e8 net: macb: Shuffle the tx ring before enabling tx
0cbc0d719ecc net: macb: sort #includes
8a7d29b8bda1 drm/i915/vrr: Configure VRR timings after enabling TRANS_DDI_FUNC_CTL
1aa7745b97fd drm/i915/vrr: Move HAS_VRR() check into intel_vrr_set_transcoder_timings()
c3aa7b837920 drm/xe: Fix memory leak in xe_vm_madvise_ioctl
f655467a9973 cifs: open files should not hold ref on superblock
6f502049a96b crypto: atmel-sha204a - Fix OOM ->tfm_count leak
2d7238eec40a netconsole: fix sysdata_release_enabled_show checking wrong flag
f13fe6794726 ublk: fix NULL pointer dereference in ublk_ctrl_set_size()
bea2848ba20e LoongArch: Check return values for set_memory_{rw,rox}
fc9d6999ebfa net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume
4e1436e0b13c net: macb: Introduce gem_init_rx_ring()
4ab7c9fa0a47 drm/i915/psr: Write DSC parameters on Selective Update in ET mode
a5cdbbc77147 drm/i915/dsc: Add helper for writing DSC Selective Update ET parameters
291d19d586a5 drm/i915/dsc: Add Selective Update register definitions
3d80ebe6d1b7 ksmbd: use volume UUID in FS_OBJECT_ID_INFORMATION
9feb2d1bf86d ksmbd: unset conn->binding on failed binding request
9ee803bfdba0 smb: client: fix krb5 mount with username option
e7ff754e339e Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access
5a1ea296f858 Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp()
1768244b85dd crypto: padlock-sha - Disable for Zhaoxin processor
5a86d4e920d9 mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN stations
0e35db29fc5a batman-adv: avoid OGM aggregation when skb tailroom is insufficient
f5ed9e50c087 parisc: Flush correct cache in cacheflush() syscall
19aa416eed9e bnxt_en: fix OOB access in DBG_BUF_PRODUCER async event handler
1f4714065b2b net: macb: fix use-after-free access to PTP clock
4de9ed2ea22d NFC: nxp-nci: allow GPIOs to sleep
8dd23bb5c6f5 LoongArch: No need to flush icache if text copy failed
250aae6a5738 LoongArch: Give more information if kmem access failed
6e096db800db mm/huge_memory: fix early failure try_to_migrate() when split huge pmd for shared THP
f3caaee0f9e4 mm/huge_memory: fix use of NULL folio in move_pages_huge_pmd()
99888a4f340c mm/rmap: fix incorrect pte restoration for lazyfree folios
4897bd307ba8 crash_dump: don't log dm-crypt key bytes in read_key_from_user_keying
a226e5b49e5f nvdimm/bus: Fix potential use after free in asynchronous initialization
be5c35960e5e sunrpc: fix cache_request leak in cache_release
73c5b5aea1c4 HID: bpf: prevent buffer overflow in hid_hw_request
6487774a576d selftests/hid: fix compilation when bpf_wq and hid_device are not exported
0f0e2a54a31a nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
db4a9f99b12a NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd
2829e80d29b6 NFSD: Defer sub-object cleanup in export put callbacks
40bc25e65151 Linux 6.18.19-rt-xanmod1
f8727ea54c2b Merge branch '6.18' into 6.18-rt
8c86bc38bc32 Linux 6.18.19-xanmod1
aeeb1cca8fa7 Merge tag 'v6.18.19' into 6.18
4aea1dc4cad1 Linux 6.18.19
224404f54036 bpf: drop kthread_exit from noreturn_deny
9fd37b636bc2 drm/bridge: ti-sn65dsi86: Add support for DisplayPort mode with HPD
24fda228496c mm/damon/core: disallow non-power of two min_region_sz
b0d0903594dd io_uring/eventfd: use ctx->rings_rcu for flags checking
7cc4530b3e95 io_uring: ensure ctx->rings is stable for task work flags manipulation
ae3831b44f47 net/tcp-md5: Fix MAC comparison to be constant-time
ce2a263bc57c lib/crypto: tests: Depend on library options rather than selecting them
93c0a22fec91 ksmbd: Compare MACs in constant time
4af5dfb8dca3 smb: client: Compare MACs in constant time
97ea8f3bbdae kbuild: Leave objtool binary around with 'make clean'
ba3bca40f9f2 KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated
0ff26b41c882 KVM: SVM: Add a helper to look up the max physical ID for AVIC
ba28a0dcc41a KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids
b7493f48c3db KVM: arm64: Eagerly init vgic dist/redist on vgic creation
2a01a93ed226 KVM: arm64: gic: Set vgic_model before initing private IRQs
8d02bbfb0900 mmc: dw_mmc-rockchip: Fix runtime PM support for internal phase support
5b58ba042e23 mmc: dw_mmc-rockchip: Add memory clock auto-gating support
4c3a860b96e7 drm/gud: fix NULL crtc dereference on display disable
51aa99e59d7f drm/gud: rearrange gud_probe() to prepare for function splitting
94b6d0ba4b64 mm: Fix a hmm_range_fault() livelock / starvation problem
fffce2310e68 cxl/acpi: Fix CXL_ACPI and CXL_PMEM Kconfig tristate mismatch
003df94bcc92 i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue
b684b420a5bb i3c: mipi-i3c-hci: Fix race in DMA ring dequeue
a21d76333588 i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor
57f99dc660e6 i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort
d986d51a83f5 i3c: mipi-i3c-hci: Consolidate spinlocks
74a4f77bbf78 i3c: mipi-i3c-hci: Factor out DMA mapping from queuing path
478a99a96182 i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors
ad9da7d39cec iio: proximity: hx9023s: Protect against division by zero in set_samp_freq
05723a2c4b09 iio: proximity: hx9023s: fix assignment order for __counted_by
70b455484a66 iio: imu: inv_icm42600: fix odr switch when turning buffer off
b5a6825579a7 iio: imu: inv_icm42600: fix odr switch to the same value
aae572ddc285 iio: light: bh1780: fix PM runtime leak on error path
a8714d2d0df4 iio: gyro: mpu3050-i2c: fix pm_runtime error handling
ba19dd366528 iio: imu: adis: Fix NULL pointer dereference in adis_init
42685cf96e28 iio: gyro: mpu3050-core: fix pm_runtime error handling
c7ae426705b0 iio: buffer: Fix wait_queue not being removed
c528dc22d58b iio: chemical: bme680: Fix measurement wait duration calculation
7c5edf1025dd iio: potentiometer: mcp4131: fix double application of wiper shift
b8a26d21c7db iio: magnetometer: tlv493d: remove erroneous shift in X-axis data
90e978ace598 iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas()
eddba110685f iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas()
73dd9acb5b20 iio: frequency: adf4377: Fix duplicated soft reset mask
1b2d9e23452b iio: dac: ds4424: reject -128 RAW value
014a021075c5 btrfs: abort transaction on failure to update root in the received subvol ioctl
5e1ab71f74a1 btrfs: add missing RCU unlock in error path in try_release_subpage_extent_buffer()
d11aefe654a0 btrfs: fix transaction abort on set received ioctl due to item overflow
9273175bf16c btrfs: fix transaction abort on file creation due to name hash collision
bac55dde8efa btrfs: fix transaction abort when snapshotting received subvolumes
9b753ece2652 smb: client: fix iface port assignment in parse_server_interfaces
92e64f1852f4 smb: client: fix in-place encryption corruption in SMB2_write()
9509b659ca7e smb: client: fix atomic open with O_DIRECT & O_SYNC
bfbf1f286f68 lib/bootconfig: check bounds before writing in __xbc_open_brace()
6e736a18cfbd lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after()
12d2b443b860 kprobes: Remove unneeded warnings from __arm_kprobe_ftrace()
11712c4eb384 x86/apic: Disable x2apic on resume if the kernel expects so
9f9157ee67b3 scsi: core: Fix error handling for scsi_alloc_sdev()
d24330cf241f lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error
d2beb819045e powerpc64/bpf: fix the address returned by bpf_get_func_ip
2ce9b2794612 powerpc64/bpf: fix kfunc call support
4b89984f7274 powerpc/pseries: Correct MSI allocation tracking
f7eda676386c s390/dasd: Copy detected format information to secondary device
fe9cd8c8ee35 s390/dasd: Move quiesce state with pprc swap
950a76e82e05 s390/zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute
997967adf10c sched_ext: Fix enqueue_task_scx() truncation of upper enqueue flags
a35be7a17c7b xfs: ensure dquot item is deleted from AIL only after log shutdown
446a1f5bb64b xfs: fix undersized l_iclog_roundoff values
ca504d2601b3 xfs: fix returned valued from xfs_defer_can_append
2b4492d9ed0f xfs: fix integer overflow in bmap intent sort comparator
316cc7b63fd5 cifs: make default value of retrans as zero
50ad880db301 io_uring/kbuf: check if target buffer list is still legacy on recycle
950bda065b05 qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size
8738dcc844ff net-shapers: don't free reply skb after genlmsg_reply()
eb613e3d38ab tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G
18bef795332b tracing: Fix enabling multiple events on the kernel command line and bootconfig
9ecea60f132d drm/msm/dpu: Correct the SA8775P intr_underrun/intr_underrun index
38f1640db7f8 drm/amd: Fix a few more NULL pointer dereference in device cleanup
a751a1230533 drm/msm: Fix dma_free_attrs() buffer size
0189bf176dbe drm/i915/psr: Repeat Selective Update area alignment
eae4bf410757 drm/i915: Fix potential overflow of shmem scatterlist length
46275c56e747 drm/bridge: ti-sn65dsi83: halve horizontal syncs for dual LVDS output
818ebb298a75 drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding
43025c941ace drm/amd: Fix NULL pointer dereference in device cleanup
57579312e0e8 drm/amd: Set num IP blocks to 0 if discovery fails
7885eb335d8f drm/amdgpu: Fix use-after-free race in VM acquire
33c3a4db3171 drm/amd/pm: remove invalid gpu_metrics.energy_accumulator on smu v13.0.x
6c58a9fdb0d0 net: dsa: microchip: Fix error path in PTP IRQ setup
8efd5dcd31e2 net: ethernet: arc: emac: quiesce interrupts before requesting IRQ
b70c4e5e7119 net: ncsi: fix skb leak in error paths
ab5ebab96642 net: nexthop: fix percpu use-after-free in remove_nh_grp_entry
3224990fb16a net: mctp: fix device leak on probe failure
1d6abf145615 ksmbd: fix use-after-free by using call_rcu() for oplock_info
8f5b1a7cb009 smb: server: fix use-after-free in smb2_open()
dbbd328cf582 ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close()
146691daf293 memcg: fix slab accounting in refill_obj_stock() trylock path
159aebd20e0e slab: distinguish lock and trylock for sheaf_flush_main()
8938a9c60d9a s390/xor: Fix xor_xc_5() inline assembly
1a34999922ba drm/amd/display: Fallback to boot snapshot for dispclk
b9a944d0a1d3 s390/xor: Fix xor_xc_2() inline assembly constraints
87f0349beaac ata: libata-core: Disable LPM on ST1000DM010-2EP102
a547ffcb9b1d s390/stackleak: Fix __stackleak_poison() inline assembly constraint
d0e63feca380 crypto: ccp - allow callers to use HV-Fixed page API when SEV is disabled
a4d0e2c416db pmdomain: bcm: bcm2835-power: Fix broken reset status read
f29b08755103 regulator: pf9453: Respect IRQ trigger settings from firmware
4387b2cc9a63 io_uring/net: reject SEND_VECTORIZED when unsupported
823fb431e4af parisc: Check kernel mapping earlier at bootup
6f92a7a8b48a arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults
396dec23e902 parisc: Fix initial page table creation for boot
857473efe934 io_uring/zcrx: use READ_ONCE with user shared RQEs
73a7a3458169 hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read
439b5fb7280a arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation
ad8fa5bff53f nouveau/dpcd: return EBUSY for aux xfer if the device is asleep
6e6e28898e01 parisc: Increase initial mapping to 64 MB with KALLSYMS
5737b279a28b pmdomain: rockchip: Fix PD_VCODEC for RK3588
e9b0a6ffe8b9 drm/xe/xe2_hpg: Correct implementation of Wa_16025250150
2ab9f2531d37 batman-adv: Avoid double-rtnl_lock ELP metric worker
a269cbdc442f net/tcp-ao: Fix MAC comparison to be constant-time
12db29803c19 tracing: Fix syscall events activation by ensuring refcount hits zero
f6e7c4f406b6 ice: fix retry for AQ command 0x06EE
678d5802556b net: mana: Ring doorbell at 4 CQ wraparounds
8bde543d2a5f media: dvb-net: fix OOB access in ULE extension header tables
9e16152a7e33 selftests: fix mntns iteration selftests
ace46763b282 pinctrl: cy8c95x0: Don't miss reading the last bank registers
4dd2d9cf563c staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie
6d62fa548387 staging: rtl8723bs: properly validate the data in rtw_get_ie_ex()
ea535b9894d7 staging: sm750fb: add missing pci_release_region on error and removal
6b9cb42cfdb3 mm/slab: fix an incorrect check in obj_exts_alloc_size()
ce0aa47c963b mm/damon/core: clear walk_control on inactive context in damos_walk()
7c19757394dd ixgbevf: fix link setup issue
216176bcfd2b kunit: irq: Ensure timer doesn't fire too frequently
decd9942655d ice: reintroduce retry mechanism for indirect AQ
ca19f8f51064 iomap: reject delalloc mappings during writeback
7bdf00ed75c4 btrfs: fix chunk map leak in btrfs_map_block() after btrfs_chunk_map_num_copies()
f42b4afdd1f8 irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports
32752c3e8149 device property: Allow secondary lookup in fwnode_get_next_child_node()
019debe5851d nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit().
db377ed4ecca arm64: gcs: Honour mprotect(PROT_NONE) on shadow stack mappings
584926c26f0b bpf: Fix kprobe_multi cookies access in show_fdinfo callback
415aed08de0e s390/pfault: Fix virtual vs physical address confusion
af65cd185359 drm/xe/sync: Cleanup partially initialized sync on parse failure
58e6e3d39c28 ipmi:si: Fix check for a misbehaving BMC
19e1931841e4 gpiolib: normalize the return value of gc->get() on behalf of buggy drivers
32cca6518982 drm/i915/alpm: ALPM disable fixes
214b6bde0e94 nouveau/gsp: drop WARN_ON in ACPI probes
9b7855110fd7 ipmi:si: Handle waiting messages when BMC failure detected
bc001cd1a482 drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used
e6d779654cda drm/bridge: samsung-dsim: Fix memory leak in error path
1df500f363bc ipmi:si: Use a long timeout when the BMC is misbehaving
68d7fcb6a451 ipmi:si: Don't block module unload if the BMC is messed up
06ef2ba582c6 drm/amd: Disable MES LR compute W/A
b1d10508da55 drm/amdgpu: add upper bound check on user inputs in wait ioctl
762f47e2b824 drm/amdgpu/userq: Fix reference leak in amdgpu_userq_wait_ioctl
6fff5204d8aa drm/amdgpu: add upper bound check on user inputs in signal ioctl
6bfda7ce56e7 cpufreq: intel_pstate: Fix NULL pointer dereference in update_cpu_qos_request()
4729c7b00a34 kthread: consolidate kthread exit paths to prevent use-after-free
8a259a5c70dd Revert "ptdesc: remove references to folios from __pagetable_ctor() and pagetable_dtor()"
ae931283b2f3 Revert "tcpm: allow looking for role_sw device in the main node"
21a13db8d449 scsi: hisi_sas: Fix NULL pointer exception during user_scan()
b17211b512cb scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend
98074e16742a powerpc, perf: Check that current->mm is alive before getting user callchain
9e84113ea6ec i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach
2d845604ca4f time/jiffies: Mark jiffies_64_to_clock_t() notrace
2e8e9aea8cd5 ALSA: usb-audio: Improve Focusrite sample rate filtering
097cd68f4668 ceph: fix memory leaks in ceph_mdsc_build_path()
7335e21830b8 ceph: do not skip the first folio of the next object in writeback
7db008e85a5d ceph: fix i_nlink underrun during async unlink
bdf614c81081 libceph: admit message frames only in CEPH_CON_S_OPEN state
ba0a4df8c563 libceph: Use u32 for non-negative values in ceph_monmap_decode()
69fe5af33fa3 libceph: prevent potential out-of-bounds reads in process_message_header()
fc4d944dbaee libceph: reject preamble if control segment is empty
f9da5c1bbac5 libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()
8be8911f5908 ceph: add a bunch of missing ceph_path_info initializers
cae928e3178c kprobes: avoid crash when rmmod/insmod after ftrace killed
2754e7b3d647 tipc: fix divide-by-zero in tipc_sk_filter_connect()
22b05abb17e3 ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start
0e06cc511c61 mmc: core: Avoid bitfield RMW for claim/retune flags
45785772d538 mm/kfence: disable KFENCE upon KASAN HW tags enablement
24743b77cae3 mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index()
63826cf08446 mm/kfence: fix KASAN hardware tag faults during late enablement
6dc0919dc782 mm/tracing: rss_stat: ensure curr is false from kthread context
e584cb58a2ea usb: gadget: f_ncm: Fix net_device lifecycle with device_move
ef7d456d1e88 Revert "usb: gadget: u_ether: add gether_opts for config caching"
05dc0c098ca1 Revert "usb: gadget: f_ncm: align net_device lifecycle with bind/unbind"
d2a08ea03830 Revert "usb: gadget: u_ether: Add auto-cleanup helper for freeing net_device"
56cb551d2a33 Revert "usb: legacy: ncm: Fix NPE in gncm_bind"
8a607bae3a0a Revert "usb: gadget: f_ncm: Fix atomic context locking issue"
be5738d19bed usb: legacy: ncm: Fix NPE in gncm_bind
e533a44fb1b3 usb: gadget: f_ncm: Fix atomic context locking issue
679d9535aeb1 usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling
b7fed917f84e usb: image: mdc800: kill download URB on timeout
513041c71356 usb: gadget: uvc: fix interval_duration calculation
4cc30a5fc883 usb: mdc800: handle signal and read racing
c0b28a042174 usb: gadget: f_hid: fix SuperSpeed descriptors
0b7d11fd6e74 usb: renesas_usbhs: fix use-after-free in ISR during device removal
67ed312124bb usb: class: cdc-wdm: fix reordering issue in read code path
64f3d75633ae USB: core: Limit the length of unkillable synchronous timeouts
6cb7dc91f057 USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts
f7e115af4874 USB: usbcore: Introduce usb_bulk_msg_killable()
ac207d57bbb0 usb: typec: altmode/displayport: set displayport signaling rate in configure message
8c9521a5877e usb: roles: get usb role switch from parent only for usb-b-connector
9459b5731cd8 usb: cdc-acm: Restore CAP_BRK functionnality to CH343
82f7b4350b9d usb: core: don't power off roothub PHYs if phy_set_mode() fails
1a99da68a5a9 usb: misc: uss720: properly clean up reference in uss720_probe()
69f090f5e729 usb: dwc3: pci: add support for the Intel Nova Lake -H
a41d3d9202e9 usb: yurex: fix race in probe
cd41e0d1df8f usb: xhci: Prevent interrupt storm on host controller error (HCE)
c65f1b840ab8 usb: xhci: Fix memory leak in xhci_disable_slot()
8043f1c3c89d USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed
ba3b951b7f7a usb/core/quirks: Add Huawei ME906S-device to wakeup quirk
e2554ffa8c25 USB: add QUIRK_NO_BOS for video capture several devices
213e82ccdea5 KVM: arm64: pkvm: Fallback to level-3 mapping on host stage-2 fault
c513bbd7da53 KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC
b058c30cdf7d KVM: x86: Introduce KVM_X86_QUIRK_VMCS12_ALLOW_FREEZE_IN_SMM
686c8f16112c KVM: arm64: Fix protected mode handling of pages larger than 4kB
e0f582406c3e ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA
08da6c7ed70f ata: libata-core: Add BRIDGE_OK quirk for QEMU drives
f90768ed813b rust: str: make NullTerminatedFormatter public
887098159d70 rust: kbuild: allow `unused_features`
dd109e344281 rust_binder: call set_notification_done() without proc lock
e19afb53f772 rust_binder: avoid reading the written value in offsets array
20a01f20d1f4 rust_binder: check ownership before using vma
edf685946c4a rust_binder: fix oneway spam detection
3e89ddbaaea2 net: usb: lan78xx: skip LTM configuration for LAN7850
20ce2bd1c184 net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect
f62ec1babb2a net: usb: lan78xx: fix TX byte statistics for small packets
fa41007be691 net: usb: lan78xx: fix silent drop of packets with checksum errors
00293f362712 can: gs_usb: gs_can_open(): always configure bitrates before starting device
3d542cf3c4c8 ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces
4a758e9a1f5e ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain()
6eaaa67d6998 sched_ext: Remove redundant css_put() in scx_cgroup_init()
86ceaccfdfa1 cgroup: fix race between task migration and iteration
1051eb2f5388 drm/amdgpu: ensure no_hw_access is visible before MMIO
3428dc5520c8 usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks()
678f1212f77b iio: imu: inv-mpu9150: fix irq ack preventing irq storms
86f00a9e50b4 net: prevent NULL deref in ip[6]tunnel_xmit()
7065d73a78ba octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt status
c9d6bf8d139a octeontx2-af: devlink: fix NIX RAS reporter recovery condition
8ded073fc8cd net: ethernet: ti: am65-cpsw-nuss: Fix rx_filter value for PTP support
c1d06ccbee46 net: ti: am65-cpsw: move hw timestamping to ndo callback
59489ce60d74 net/mana: Null service_wq on setup error to prevent double destroy
103e4fedb478 neighbour: restore protocol != 0 check in pneigh update
f7f12d551d61 net: dsa: realtek: Fix LED group port bit for non-zero LED group
95faa1459b83 net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled
84c1adb60fdb perf synthetic-events: Fix stale build ID in module MMAP2 records
529c985da1b2 drm/amdkfd: Unreserve bo if queue update failed
b3b56d60fee1 ASoC: detect empty DMI strings
790851ecc983 ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition
9a3106a81fc3 ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address()
e987bc1d2e8d net: bcmgenet: fix broken EEE by converting to phylib-managed state
53480725b139 page_pool: store detach_time as ktime_t to avoid false-negatives
30e87ade8d67 e1000/e1000e: Fix leak in DMA error cleanup
981e2805e48f i40e: fix src IP mask checks and memcpy argument names in cloud filter
75e0a631c3a1 iavf: fix incorrect reset handling in callbacks
1b034f2429ce iavf: fix PTP use-after-free during reset
98b36857f358 drivers: net: ice: fix devlink parameters get without irdma
b56c49897bda nvme-pci: Fix race bug in nvme_poll_irqdisable()
328c551f0cc8 nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set
3cf2d7ca4828 sched: idle: Make skipping governor callbacks more consistent
a422159d766a perf ftrace: Fix hashmap__new() error checking
f7e52a24e5b7 regulator: pca9450: Correct probed name for PCA9452
55ca06f54f57 regulator: pca9450: Add support for setting debounce settings
ec1427731244 regulator: pca9450: Correct interrupt type
0b6803777c00 perf annotate: Fix hashmap__new() error checking
f5ef97c13165 netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels
05018cd9370f netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()
9853d94b82d3 netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path
bc18551c6169 netfilter: x_tables: guard option walkers against 1-byte tail reads
e047f6fbb975 netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()
de47a88c6b80 netfilter: nf_tables: always walk all pending catchall elements
6d2a95c68905 netfilter: nf_tables: Fix for duplicate device in netdev hooks
8a57deeb2560 net: add xmit recursion limit to tunnel xmit functions
f0679522f8de amd-xgbe: prevent CRC errors during RX adaptation with AN disabled
cf51e5853398 amd-xgbe: fix link status handling in xgbe_rx_adaptation
925a5ffd99cd mctp: route: hold key->lock in mctp_flow_prepare_output()
6ac890f1d60a bonding: fix type confusion in bond_setup_by_slave()
474211fb4a1d bonding: use common function to compute the features
3c5de399a442 can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value
1ec54187e1aa mctp: i2c: fix skb memory leak in receive path
569e6e72c457 bnxt_en: Fix RSS table size check when changing ethtool channels
35b58d3bc716 serial: caif: hold tty->link reference in ldisc_open and ser_release
ecb4ed7a723f net: sfp: improve Huawei MA5671a fixup
ce0b8fd5e355 ASoC: simple-card-utils: fix graph_util_is_ports0() for DT overlays
7d33e6140945 ASoC: soc-core: flush delayed work before removing DAIs and widgets
a4aa08c820f4 ASoC: soc-core: drop delayed_work_pending() check before flush
b6051f2bdd4b spi: rockchip-sfc: Fix double-free in remove() callback
0a83d6c9e149 spi: amlogic: spifc-a4: Fix DMA mapping error handling
fc7735caf016 drm/sitronix/st7586: fix bad pixel data due to byte swap
c34ebd7b24ea net: spacemit: Fix error handling in emac_tx_mem_map()
045545790fea net: spacemit: Fix error handling in emac_alloc_rx_desc_buffers()
d55fa7cd4b19 rxrpc, afs: Fix missing error pointer check after rxrpc_kernel_lookup_peer()
0bad9c86edd2 net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit
c74557495efb net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ
7d7342a18fad net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ
ce1b19dd0684 net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery
cbd8494fdd6c net/mlx5: Fix peer miss rules host disabled checks
835778685f15 net/mlx5: Fix crash when moving to switchdev mode
4a7838bebc38 net/mlx5: Fix deadlock between devlink lock and esw->wq
6aaf15f376b0 bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states
ab1bcadc7e51 bonding: do not set usable_slaves for broadcast mode
2ee3645e0f3f drm/amd/pm: add missing od setting PP_OD_FEATURE_ZERO_FAN_BIT for smu v14
4c32155265b6 drm/amd/pm: add missing od setting PP_OD_FEATURE_ZERO_FAN_BIT for smu v13
6b4a1ff80885 drm/msm/dsi: fix pclk rate calculation for bonded dsi
5f5d956b2ce0 net: dsa: realtek: rtl8365mb: remove ifOutDiscards from rx_packets
98754dda6729 dt-bindings: display/msm: qcom,sm8750-mdss: Fix model typo
676826aeddb5 perf disasm: Fix off-by-one bug in outside check
ce69c1b75374 workqueue: Use POOL_BH instead of WQ_BH when checking pool flags
a39b75c3f422 btrfs: hold space_info->lock when clearing periodic reclaim ready
8127b5fec047 xprtrdma: Decrement re_receiving on the early exit paths
2871bb923ff8 drm/msm/dsi: fix hdisplay calculation when programming dsi registers
203c792cb431 nfs: return EISDIR on nfs3_proc_create if d_alias is a dir
28a72f653832 smb/server: Fix another refcount leak in smb2_open()
f426a493db33 powerpc: 83xx: km83xx: Fix keymile vendor prefix
ba021fb57508 remoteproc: mediatek: Unprepare SCP clock during system suspend
bf39fed5f22c remoteproc: sysmon: Correct subsys_name_len type in QMI request
b7b634be7658 powerpc/crash: adjust the elfcorehdr size
c171a5f79954 powerpc/kexec/core: use big-endian types for crash variables
d5697cf3b91d kexec: Include kernel-end even without crashkernel
b3c074a394c6 powerpc/uaccess: Fix inline assembly for clang build on PPC32
71c57e74baa0 ALSA: usb-audio: Check max frame size for implicit feedback mode, too
31e6595fd1a0 drm/amdgpu/vcn5: Add SMU dpm interface type
716fc4044691 ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0
5faf0ce7d784 scsi: ufs: core: Fix shift out of bounds when MAXQ=32
f4f590c6c9df scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace()
87aa0f91ee49 ASoC: cs42l43: Report insert for exotic peripherals
c072370ad67d ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table
7035ef0f20ba scsi: ses: Fix devices attaching to different hosts
8c61a746f7bb ACPI: OSI: Add DMI quirk for Acer Aspire One D255
e03d7bddf0ec wifi: mac80211: set default WMM parameters on all links
af8f4be3b68a unshare: fix unshare_fs() handling
6407e8baef0a ALSA: hda/realtek: Fix speaker pop on Star Labs StarFighter
e978a36f332e scsi: mpi3mr: Add NULL checks when resetting request and reply queues
379e19e820dd fs: init flags_valid before calling vfs_fileattr_get
22e54d67b2f5 scsi: ufs: core: Reset urgent_bkops_lvl to allow runtime PM power mode
55d1e86cb0c9 ACPI: PM: Save NVS memory on Lenovo G70-35
c2e73d8acd05 scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT
e8a59ed2e982 Linux 6.18.18-xanmod1
516366bfa489 Merge tag 'v6.18.18' into 6.18
3318f10fa289 Linux 6.18.18
6c5e8f16b5e8 ata: libata: cancel pending work after clearing deferred_qc
13bc2772414d apparmor: fix race between freeing data and fs accessing it
af782cc8871e apparmor: fix race on rawdata dereference
623a9d211bbb apparmor: fix differential encoding verification
b60b3f7a35c4 apparmor: fix unprivileged local user can do privileged policy management
7998ab3010d2 apparmor: Fix double free of ns_name in aa_replace_profiles()
5a68e46dfe0c apparmor: fix missing bounds check on DEFAULT table in verify_dfa()
0510d1ba0976 apparmor: fix side-effect bug in match_char() macro usage
d42b2b6bb77c apparmor: fix: limit the number of levels of policy namespaces
7eade846e013 apparmor: replace recursive profile removal with iterative approach
4f0889f2df1a apparmor: fix memory leak in verify_header
0baadb0eece2 apparmor: validate DFA start states are in bounds in unpack_pdb
380ad8b7c65e net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks
04d75529dc0f net/sched: act_gate: snapshot parameters with RCU on replace
fb960c52c72f Linux 6.18.17-xanmod1
a2e6144cf49c mm: Add working set protection for anon and clean file pages
44dfb1863e21 Merge tag 'v6.18.17' into 6.18
93ea7e1363fb Linux 6.18.17
8a185304e42e selftests/bpf: Avoid simplification of crafted bounds test
63b548c86299 bpf: collect only live registers in linked regs
2ce8ece5a78d tracing: Add NULL pointer check to trigger_data_free()
52decf013d53 selftest/arm64: Fix sve2p1_sigill() to hwcap test
d15ba004b321 ata: libata-eh: Fix detection of deferred qc timeouts
98cd8b4d0b83 xdp: produce a warning when calculated tailroom is negative
45a41aecf5e5 net: enetc: use truesize as XDP RxQ info frag_size
f1ac9d19721b i40e: use xdp.frame_sz as XDP RxQ info frag_size
b6176646c36d i40e: fix registering XDP RxQ info
ff7f356cdbb4 xsk: introduce helper to determine rxq->frag_size
2a9e6ecf0e85 xdp: use modulo operation to calculate XDP frag tailroom
cd888c396667 net/sched: act_ife: Fix metalist update behavior
b3b5a037d520 net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop
fbbd2118982c net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled
33dec6f10777 net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled
d3b1c4c70da5 selftests/harness: order TEST_F and XFAIL_ADD constructors
0168443a5db5 kselftest/harness: Use helper to avoid zero-size memset warning
6f95b5952027 net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in mtk_xdp_setup()
500a50a301ce netfilter: nft_set_pipapo: split gc into unlink and reclaim phase
9154945a6394 netfilter: nf_tables: clone set on flush only
6826131c7674 netfilter: nf_tables: unconditionally bump set->nelems before insertion
6624d1727f3a net: Provide a PREEMPT_RT specific check for netdev_queue::_xmit_lock
c3e8c75fcb2e block: use trylock to avoid lockdep circular dependency in sysfs
6b0e35123ba4 net: stmmac: Defer VLAN HW configuration when interface is down
15e8ef336895 net: stmmac: Fix VLAN HW state restore
8b8b97eaecae net: stmmac: Improve double VLAN handling
d55a39435c20 net: stmmac: Fix error handling in VLAN add and delete paths
edc988613def nfc: rawsock: cancel tx_work before socket teardown
b3fdbc7f59cd nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback
91ff0d8c3464 nfc: nci: complete pending data exchange on device close
9d448bbab724 nfc: nci: free skb on nci_transceive early error paths
a77a5423e9c6 net: devmem: use READ_ONCE/WRITE_ONCE on binding->dev
4596f44d4f5b net_sched: sch_fq: clear q->band_pkt_count[] in fq_reset()
1c46edf20f82 net: nfc: nci: Fix zero-length proprietary notifications
eae2f14ab2ef tcp: secure_seq: add back ports to TS offset
8314944cc3bd net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs
d9d4ed40b3be hwmon: (max6639) fix inverted polarity
de4ea10ae6b4 timekeeping: Fix timex status validation for auxiliary clocks
5a501379a010 nvme: fix memory allocation in nvme_pr_read_keys()
76f327fa4f1b nvme: reject invalid pr_read_keys() num_keys values
05e3f01974d0 drm/xe/reg_sr: Fix leak on xa_store failure
3c8852cff2bb drm/xe/gsc: Fix GSC proxy cleanup on early initialization failure
1c72e7b0b442 i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock"
da09dfc90cb7 drm/sched: Fix kernel-doc warning for drm_sched_job_done()
5649775b3ebf amd-xgbe: fix sleep while atomic on suspend/resume
7e4ad34a8889 net: ipv4: fix ARM64 alignment fault in multipath hash seed
0b5a78260207 ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()
5566a9eeb00e smb/client: fix buffer size for smb311_posix_qinfo in SMB311_posix_query_info()
b751369b03c8 smb/client: fix buffer size for smb311_posix_qinfo in smb2_compound_op()
3eeddb80191f bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim
ba47e3371764 igb: Fix trigger of incorrect irq in igb_xsk_wakeup
2199e190cf6b iavf: fix netdev->max_mtu to respect actual hardware limit
0138d1cdb19f libie: don't unroll if fwlog isn't supported
b9333d41ee03 ice: fix adding AQ LLDP filter for VF
1e077c65e020 xen/acpi-processor: fix _CST detection using undersized evaluation buffer
6ce948fa5459 net/rds: Fix circular locking dependency in rds_tcp_tune
ca795bf1230b indirect_call_wrapper: do not reevaluate function pointer
9612d91f6172 wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211()
2831a8c57454 wifi: mt76: mt7925: Fix possible oob access in mt7925_mac_write_txwi_80211()
f4cdf6b43689 wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211()
fcef983ad888 wifi: wlcore: Fix a locking bug
f98c195052ab wifi: cw1200: Fix locking in error paths
93e00a88951d octeon_ep_vf: avoid compiler and IQ/OQ reordering
04a9f26d63d9 octeon_ep_vf: Relocate counter updates before NAPI
986904ab1613 octeon_ep: avoid compiler and IQ/OQ reordering
142a789a51d5 octeon_ep: Relocate counter updates before NAPI
0ace8027e41f bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded
d95de5acbf9e net: dsa: realtek: rtl8365mb: fix rtl8365mb_phy_ocp_write return value
01f5b85fa0da kunit: tool: copy caller args in run_kernel to prevent mutation
3589cc8f56c1 rust: kunit: fix warning when !CONFIG_PRINTK
7f971dfd4898 drm/xe/configfs: Free ctx_restore_mid_bb in release
303b446f2e8f drm/xe: Do not preempt fence signaling CS instructions
7196a1ff7b9a drm/syncobj: Fix handle <-> fd ioctls with dirty stack
95ed07644b2c wifi: rsi: Don't default to -EOPNOTSUPP in rsi_mac80211_config
d27f12c3f5e8 can: mcp251x: fix deadlock in error path of mcp251x_open
8215ba7bc99e can: bcm: fix locking for bcm_op runtime updates
d8e38dc605c1 amd-xgbe: fix MAC_TCR_SS register width for 2.5G and 10M speeds
d5947c3d2d14 net: ti: icssg-prueth: Fix ping failure after offload mode setup when link speed is not 1G
7ea92ab075d8 atm: lec: fix null-ptr-deref in lec_arp_clear_vccs
00f42ace446f dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler
6a674e0b19b0 xsk: Fix zero-copy AF_XDP fragment drop
645c6d8376ad xsk: Fix fragment node deletion to prevent buffer leak
2fc623e17854 tcp: give up on stronger sk_rcvbuf checks (for now)
b955350778b8 udp: Unhash auto-bound connected sk from 4-tuple hash table when disconnected.
f5fc6fead277 inet: annotate data-races around isk->inet_num
3d8f35e182c8 nvme-multipath: fix leak on try_module_get failure
79cc5a4c311f net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling in ALE table
f17c1c4acbe2 net: annotate data-races around sk->sk_{data_ready,write_space}
f30b95159a53 nvmet-fcloop: Check remoteport port_state before calling done callback
72d08d283964 netfs: Fix unbuffered/DIO writes to dispatch subrequests in strict sequence
54b3701901af drm/solomon: Fix page start when updating rectangle in page addressing mode
ee8e4b7469b4 e1000e: clear DPG_EN after reset to avoid autonomous power-gating
9e0f09182157 i40e: Fix preempt count leak in napi poll tracepoint
e9669c2d0535 ice: recap the VSI and QoS info after rebuild
4458f9f198f5 idpf: Fix flow rule delete failure due to invalid validation
e7fca8b7fb6f idpf: change IRQ naming to match netdev and ethtool queue numbering
8f742f495ddb idpf: increment completion queue next_to_clean in sw marker wait routine
d146275655bb hwmon: (it87) Check the it87_lock() return value
ea07fcfbba43 pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe()
acbcfe2f8e64 pinctrl: meson: amlogic-a4: Fix device node reference leak in aml_dt_node_to_map_pinmux()
6359d2d52c95 pinctrl: generic: move function to amlogic-am4 driver
2c091292ca42 HID: multitouch: new class MT_CLS_EGALAX_P80H84
ade03840f829 module: Remove duplicate freeing of lockdep classes
55aefe1647a6 platform/x86: thinkpad_acpi: Fix errors reading battery thresholds
82f1bb0ad480 pinctrl: qcom: qcs615: Add missing dual edge GPIO IRQ errata flag
53eba152810e pinctrl: equilibrium: fix warning trace on load
2c947684bdaa pinctrl: equilibrium: rename irq_chip function callbacks
9833ed224aad hwmon: (aht10) Fix initialization commands for AHT20
9c1984180260 hwmon: (aht10) Add support for dht20
e159eb852aee nvme: fix admin queue leak on controller reset
038158492979 drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink
a5c070aaf796 Bluetooth: Fix CIS host feature condition
d8a286503553 net: stmmac: remove support for lpi_intr_o
999ff1af649c platform/x86: hp-bioscfg: Support allocations of larger data
0c578e8065c4 ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths
c08ec55617cb ipmi: Fix use-after-free and list corruption on sender error
3c3462e9ae35 ASoC: fsl_xcvr: provide regmap names
227eb258c2cb ASoC: fsl_xcvr: use dev_err_probe() replacing dev_err() + return
3d46af0f8b28 ARM: clean up the memset64() C wrapper
54e841a03606 Revert "netfilter: nft_set_rbtree: validate open interval overlap"
861aa1be41bc kbuild: Split .modinfo out from ELF_DETAILS
bc2110c10128 selftests: mptcp: join: check removing signal+subflow endp
23ec7f54a9d6 selftests: mptcp: join: check RM_ADDR not sent over same subflow
ee6ce81a24a4 selftests: mptcp: more stable simult_flows tests
a64aa7db3939 mptcp: pm: in-kernel: always mark signal+subflow endp as used
19a258d03d08 mptcp: pm: avoid sending RM_ADDR over same subflow
944a333c8e4d scsi: core: Fix refcount leak for tagset_refcnt
86163b98891a smb: client: fix oops due to uninitialised var in smb2_unlink()
2ef0fc3bf49d smb: client: Don't log plaintext credentials in cifs_set_cifscreds
134596a6e4be smb: client: fix broken multichannel with krb5+signing
0786f9422cbf smb: client: fix cifs_pick_channel when channels are equally loaded
5a34959a2ab1 xfs: Fix error pointer dereference
b135cd653d1b xfs: fix xfs_group release bug in xfs_dax_notify_dev_failure
4e8935053ba3 drbd: fix null-pointer dereference on local read error
d1ef3aed4df2 drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock()
01ee0bcc2986 Squashfs: check metadata block offset is within range
0524ee56af2c mm: thp: deny THP for files on anonymous inodes
9a5641024fbf scsi: target: Fix recursive locking in __configfs_open_file()
cdd96641b642 tracing: Fix WARN_ON in tracing_buffers_mmap_close
27c13c5bb094 nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit().
a6677e23b313 net/sched: ets: fix divide by zero in the offload path
ca1684dd297b arm64: gcs: Do not set PTE_SHARED on GCS mappings if FEAT_LPA2 is enabled
a1850e2aef4d cpufreq: intel_pstate: Fix crash during turbo disable
a6f3e0fa8e86 RDMA/ionic: Fix kernel stack leak in ionic_create_cq()
cfe962216c16 RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah()
deee46b37ebd IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq()
2764dcb3c35d net: phy: register phy led_triggers during probe to avoid AB-BA deadlock
07e0c80e17ef gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL
2b6c942a5266 Bluetooth: purge error queues in socket destructors
cc6d5a3c0a85 wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()
f35ceec54d48 wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration
584279ad9ff1 wifi: cfg80211: cancel rfkill_block work in wiphy_unregister()
ed7d30f90b77 wifi: libertas: fix use-after-free in lbs_free_adapter()
2f8ceeba6706 wifi: radiotap: reject radiotap with unknown bits
bf21bfd63e01 ALSA: hda/realtek: add quirk for Samsung Galaxy Book Flex (NT950QCT-A38A)
36facbc94803 ALSA: hda/realtek: Add quirk for Acer Aspire V3-572G
7eb2d1ce7b45 ALSA: hda/realtek: fix model name typo for Samsung Galaxy Book Flex (NT950QCG-X716)
27338f3360ef ALSA: hda/intel: increase default bdl_pos_adj for Nvidia controllers
1e5753ff4c2e ALSA: usb-audio: Use correct version for UAC3 header validation
be7e624f24df ALSA: doc: usb-audio: Add doc for QUIRK_FLAG_SKIP_IFACE_SETUP
8d70dff4a2e2 ALSA: hda/realtek: Add quirk for HP Pavilion 15-eh1xxx to enable mute LED
5f935f133107 platform/x86: dell-wmi: Add audio/mic mute key codes
bf84193d9130 platform/x86: alienware-wmi-wmax: Add G-Mode support to m18 laptops
5de34126fb2e platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data
c42a92d685c4 x86/boot/sev: Move SEV decompressor variables into the .data section
a586788a669b x86/sev: Allow IBPB-on-Entry feature for SNP guests
c7258d2010e6 x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths
87aeec43ccb9 perf/x86/intel/uncore: Add per-scheduler IMC CAS count events
f9e9cc320854 x86/efi: defer freeing of boot services memory
aaca71f8562f HID: multitouch: Keep latency normal on deactivate for reactivation gesture
d1edc027a4b0 HID: pidff: Fix condition effect bit clearing
20864e3e41c7 HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them
b9a606417999 can: usb: f81604: handle bulk write errors properly
36ead5744314 can: usb: f81604: handle short interrupt urb messages properly
18eee279e9b5 can: usb: etas_es58x: correctly anchor the urb in the read bulk callback
aa9e0a7fe5ef can: ucan: Fix infinite loop from zero-length messages
f6d80b104f90 can: usb: f81604: correctly anchor the urb in the read bulk callback
1cf469026d4a can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message
c3f1672eaea6 net: usb: pegasus: validate USB endpoints
011684cd1834 net: usb: kalmia: validate USB endpoints
2795fc06e765 net: usb: kaweth: validate USB endpoints
00477cab053d nfc: pn533: properly drop the usb interface reference on disconnect
cfd94642025e media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
3acc627f235a namespace: fix proc mount iteration
a80161c20370 eventpoll: Fix integer overflow in ep_loop_check_proc()
14a1db2486fa net: arcnet: com20020-pci: fix support for 2.5Mbit cards
9498fa25a0b0 drm/i915/dp: Fix pipe BPP clamping due to HDR
99f617ea2ff0 drm/i915/dp: Fail state computation for invalid DSC source input BPP values
b05ed70feb66 LoongArch: Remove some extern variables in source files
079deecc2c9f LoongArch: Handle percpu handler address for ORC unwinder
e7c58045ad8c LoongArch: Remove unnecessary checks for ORC unwinder
e653c0718cf5 mm/slab: use prandom if !allow_spin
d3043852fffa slub: remove CONFIG_SLUB_TINY specific code paths
58aef054b290 hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler optimization induced race
378dff71efdd drm/amd: Fix hang on amdgpu unload by using pci_dev_is_disconnected()
6c80b35076bc PM: sleep: core: Avoid bit field races related to work_in_progress
5ec1d82f00b1 btrfs: zoned: fixup last alloc pointer after extent removal for RAID0/10
4b508c53f3c5 btrfs: define the AUTO_KFREE/AUTO_KVFREE helper macros
d2cfea67b1b9 KVM: x86: Add x2APIC "features" to control EOI broadcast suppression
c6db0f4a1659 PCI: dwc: ep: Fix resizable BAR support for multi-PF configurations
7c0c4b7e84b7 PCI: dwc: Remove duplicate dw_pcie_ep_hide_ext_capability() function
794b08c50128 PCI: dwc: Add new APIs to remove standard and extended Capability
26f9e895616b PCI: Add preceding capability position support in PCI_FIND_NEXT_*_CAP macros
7d610f643b04 ARM: dts: imx53-usbarmory: Replace license text comment with SPDX identifier
f50c91272425 ACPI: APEI: GHES: Disable KASAN instrumentation when compile testing with clang < 18
0a654ac440c1 ACPI: APEI: GHES: Add helper for CPER CXL protocol errors checks
baf4b13a4efc clk: tegra: tegra124-emc: fix device leak on set_rate()
e5bdc2159f8b arm64: dts: rockchip: Fix rk3588 PCIe range mappings
7f8f4acf3926 arm64: dts: rockchip: Fix rk356x PCIe range mappings
e70d5feb10c5 iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode
976c7a3750f7 Input: synaptics_i2c - guard polling restart in resume
9f5158454eae Input: synaptics_i2c - replace use of system_wq with system_dfl_wq
1aa5833f29b8 media: iris: Add missing platform data entries for SM8750
448a7662ae13 media: iris: remove v4l2_m2m_ioctl_{de,en}coder_cmd API usage during STOP handling
2698731d2582 ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O
e56d023da379 ext4: correct the comments place for EXT4_EXT_MAY_ZEROOUT
663efc5aac21 x86/uprobes: Fix XOL allocation failure for 32-bit tasks
f7df71d26b30 unwind_user/x86: Teach FP unwind about start of function
b9537a51b65a unwind_user/x86: Enable frame pointer unwinding on x86
6f553dbbb25d unwind: Implement compat fp unwind
5364f7bbd611 unwind: Simplify unwind_user_next_fp() alignment check
c45026c4135d drm/tegra: dsi: fix device leak on probe
1e88b5f854bd KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block()
2dff8966a3a8 media: tegra-video: Fix memory leak in __tegra_channel_try_format()
7fc4b49474c8 accel/rocket: fix unwinding in error path in rocket_probe
17463839162f accel/rocket: fix unwinding in error path in rocket_core_init
b62076e780a2 usb: gadget: f_ncm: align net_device lifecycle with bind/unbind
ca9ca411bbcf usb: gadget: u_ether: Add auto-cleanup helper for freeing net_device
f222eb16d597 usb: gadget: u_ether: add gether_opts for config caching
7bdff9b9b0c6 net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels
ed9c15c7be25 Revert "PCI: dw-rockchip: Enumerate endpoints based on dll_link_up IRQ"
15a66eb1b2c6 PCI: dw-rockchip: Change get_ltssm() to provide L1 Substates info
aad472c928c9 PCI: dwc: Add L1 Substates context to ltssm_status of debugfs
80d3a201d7ad PCI: dw-rockchip: Configure L1SS support
b1f114b7a6fa PCI: dwc: Advertise L1 PM Substates only if driver requests it
53abc9c61361 PCI: j721e: Add config guards for Cadence Host and Endpoint library APIs
ee7f2ce97b08 PCI: j721e: Use devm_clk_get_optional_enabled() to get and enable the clock
f69535b77fa0 memory: mtk-smi: fix device leak on larb probe
b44d090d6ca1 memory: mtk-smi: fix device leaks on common probe
a67540127042 x86/acpi/boot: Correct acpi_is_processor_usable() check again
1b99c0e5b6bd bpf: Improve bounds when tnum has a single possible value
50a4fab0887e bpf: Introduce tnum_step to step through tnum's members
4c03342e5ac5 bpf: Add bitwise tracking for BPF_END
6c10b019785d bpf: Fix race in devmap on PREEMPT_RT
7466ae2aeed4 bpf: Fix race in cpumap on PREEMPT_RT
ecb4e02614b9 PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value
878fddc519f7 spi: stm32: fix missing pointer assignment in case of dma chaining
130c436e7149 sched_ext: Fix SCX_EFLAG_INITIALIZED being a no-op flag
4778033781b5 selftests/bpf: Fix OOB read in dmabuf_collector
75d474702b2b bpf: Fix stack-out-of-bounds write in devmap
519b1ad91de5 bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing
11d1d38087e7 ASoC: SDCA: Fix comments for sdca_irq_request()
5413b1c94cfe ALSA: usb: qcom: Correct parameter comment for uaudio_transfer_buffer_setup()
51c8bedb2d08 btrfs: fix compat mask in error messages in btrfs_check_features()
771c1e38385b btrfs: print correct subvol num if active swapfile prevents deletion
136e814d1176 btrfs: fix warning in scrub_verify_one_metadata()
b178561ac38c btrfs: fix objectid value in error message in check_extent_data_ref()
845c0f1ab54e btrfs: fix incorrect key offset in error message in check_dev_extent_item()
5ba7d61b5416 btrfs: fix error message order of parameters in btrfs_delete_delayed_dir_index()
d4f210de01ea btrfs: free pages on error in btrfs_uring_read_extent()
c18c40e081c1 ALSA: hda: cs35l56: Fix signedness error in cs35l56_hda_posture_put()
73e8bdf14248 drm/amdgpu: Fix error handling in slot reset
5c42d9f8b004 drm/amdgpu: Fix locking bugs in error paths
39ae59e5c1d8 drm/amdgpu: Unlock a mutex before destroying it
1753f5f81ab6 drm/amdgpu/userq: Do not allow userspace to trivially triger kernel warnings
6f60a783860c PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry
3d64dcc0799c arm64: io: Extract user memory type in ioremap_prot()
835da0da68d0 arm64: io: Rename ioremap_prot() to __ioremap_prot()
00ea0c8696b4 s390/vtime: Fix virtual timer forwarding
d30168b0cbc1 s390/idle: Fix cpu idle exit cpu time accounting
3f89b61dd504 perf: Fix __perf_event_overflow() vs perf_remove_from_context() race
b9db33aafc12 ALSA: usb-audio: Use inclusive terms
9a6693b59843 ALSA: usb-audio: Cap the packet size pre-calculations
4e3ca5f82346 drm/client: Do not destroy NULL modes
869c979f3657 zloop: check for spurious options passed to remove
f6c6a888c8a4 zloop: advertise a volatile write cache
93b64bef8cd4 regulator: bq257xx: Fix device node reference leak in bq257xx_reg_dt_parse_gpio()
bbc104dcfc59 scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume
5fc4e150c5ad cxl: Fix race of nvdimm_bus object when creating nvdimm objects
af9bf9889663 cxl: Move devm_cxl_add_nvdimm_bridge() to cxl_pmem.ko
a29e63795063 cgroup/cpuset: Fix incorrect use of cpuset_update_tasks_cpumask() in update_cpumasks_hier()
e540616ec3a5 drm/xe/wa: Steer RMW of MCR registers while building default LRC
3464e7517551 accel/amdxdna: Validate command buffer payload count
1500b31db943 accel/amdxdna: Prevent ubuf size overflow
247cd87f0474 accel/amdxdna: Remove buffer size check when creating command BO
c67ab059953e perf/core: Fix invalid wait context in ctx_sched_in()
9a3bcd2984b8 rseq: Clarify rseq registration rseq_size bound check comment
22a1536b3f5a sched/fair: Fix lag clamp
c1591343440e sched/eevdf: Update se->vprot in reweight_entity()
ee54b5ba72d4 sched/fair: Only set slice protection at pick time
99673934a89f sched/fair: Fix zero_vruntime tracking
423b750d87d2 sched/fair: Introduce and use the vruntime_cmp() and vruntime_op() wrappers for wrapped-signed aritmetics
028084eca169 sched/fair: Rename cfs_rq::avg_vruntime to ::sum_w_vruntime, and helper functions
50890a9a01f3 sched/fair: Rename cfs_rq::avg_load to cfs_rq::sum_weight
50b3d683dcd4 x86/cfi: Fix CFI rewrite for odd alignments
e58f1a9b0677 x86/fred: Correct speculative safety in fred_extint()
ddbbdebeeea8 ALSA: usb-audio: Add QUIRK_FLAG_SKIP_IFACE_SETUP
71f72c5d74a9 ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices
561cefafd79d ALSA: scarlett2: Fix DSP filter control array handling
38072446442c drm/imx: parallel-display: check return value of devm_drm_bridge_add() in imx_pd_probe()
824a7672e354 scsi: pm8001: Fix use-after-free in pm8001_queue_command()
c3598e86c916 scsi: lpfc: Properly set WC for DPP mapping
1883332bf21f irqchip/sifive-plic: Fix frozen interrupt due to affinity setting
183a6264b32e drm/tiny: sharp-memory: fix pointer error dereference
cd2713a37336 drm/fourcc: fix plane order for 10/12/16-bit YCbCr formats
bce3847f7c51 KVM: arm64: Fix ID register initialization for non-protected pKVM guests
7a15a1e3228d KVM: arm64: Hide S1POE from guests when not supported by the host
f8a6eba20edb drm/logicvc: Fix device node reference leak in logicvc_drm_config_parse()
a473c09666f0 debugobject: Make it work with deferred page initialization - again
531f45589787 drm/vmwgfx: Return the correct value in vmw_translate_ptr functions
2633a30eb45b drm/vmwgfx: Fix invalid kref_put callback in vmw_bo_dirty_release
c27dea9f50ed perf/core: Fix refcount bug and potential UAF in perf_mmap