5d86a7f529f5 Linux 6.18.52-rt-xanmod1
936a9302783c Merge branch '6.18' into 6.18-rt
55053f36aba3 Linux 6.18.52-xanmod1
f746e3f18288 Merge tag 'v6.18.52' into 6.18
8f3741e6feb0 Linux 6.18.52
0d0c637410df wifi: mt76: fix airoha_npu dependency tracking
637e0ea73f69 staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction
7d4024037ee3 staging: rtl8723bs: os_dep: avoid NULL pointer dereference in rtw_cbuf_alloc
7bca33d6f6e0 pinctrl: airoha: an7583: add missed gpio22 pin group
9aa021b63ab7 ACPI: processor: Add cpuidle driver check in acpi_processor_register_idle_driver()
4ba887b2bacc ACPI: processor: idle: Remove redundant static variable and rename cstate check function
e1cfb85ab258 ACPI: processor: idle: Move max_cstate update out of the loop
fcc577939931 ACPI: processor: idle: Remove redundant cstate check in acpi_processor_power_init
8ddc1da77364 cpufreq/amd-pstate: Allow writes to dynamic_epp when state isn't modified
9c178eba1542 cpufreq/amd-pstate: Use "epp_default_dc" as default when dynamic_epp is disabled
bf897a1fa96c cpufreq/amd-pstate: Add support for raw EPP writes
b461ae97f2e4 cpufreq/amd-pstate: Add static asserts for EPP indices
8f8db9af24b9 cpufreq/amd-pstate: Fix some whitespace issues
a3d24aed0a3e io_uring/waitid: fix KCSAN warning on io_waitid->head
934ffdd1cdef io_uring/waitid: use io_waitid_remove_wq() consistently
798283cd0fe7 net/sched: fq: clamp quantum and initial_quantum in change path
9289c94fcfe0 Bluetooth: btmtk: hide unused btmtk_mt6639_devs[] array
2151b2bcf6fc tcp: reject non zerocopy devmem tx
384907f29dd1 ipmr: Add __rcu to netns_ipv4.mrt.
7708973e268c ipmr: Call ipmr_fib_lookup() under RCU.
5029156b99bd erofs: fix EFSCORRUPTED on multi-algorithm images in z_erofs_map_sanity_check()
a295f239dee4 erofs: relax sanity check for tail pclusters due to ztailpacking
bf8601feeb46 block: fix merging data-less bios
43a4c2afcb5a blk-mq-dma: always initialize dma state
f54f709bfb5e block: save page offset gaps in cloned bio
0268313b5de3 integrity: Eliminate weak definition of arch_get_secureboot()
60aee9cbb82e apparmor: fix kernel-doc comments for inview
caf1e44e672b pinctrl: airoha: an7581: fix incorrect led mapping in phy4_led1 pin function
0ca274a45eae pinctrl: airoha: Fix AIROHA_PINCTRL_CONFS_DRIVE_E2 in an7583_pinctrl_match_data
2e7c3c433fd7 pinctrl: airoha: an7583: add missed gpio32 pin group
46bae3189cf5 pinctrl: airoha: an7583: fix misprint in gpio19 pinconf
591424f9f5d5 pinctrl: airoha: an7583: fix incorrect led mapping in phy4_led1 pin function
cf2e698957b6 pinctrl: airoha: an7583: fix gpio21 pin group
6d0bcb215312 pinctrl: airoha: an7583: fix phy1_led1 pin function
5331bf0d5ca0 pinctrl: airoha: an7583: remove undefined groups from pcm_spi pin function
fc00a596268a phy: renesas: rcar-gen3-usb2: add regulator dependency
e97bd4417010 perf annotate: Fix build with NO_SLANG=1
fe44ae31ca78 wifi: nl80211: fix UHR capability validation
3ca32b70e825 wifi: mt76: npu: Add missing rx_token_size initialization
b0af766d64bc wifi: mt76: restrict NPU/PPE active checks to MMIO devices
15a9acc5e655 s390/kexec: Disable stack protector in s390_reset_system()
adf8f940e450 selftests: vDSO: getrandom: Fix path to s390 chacha implementation
dffea40a832b cpufreq/amd-pstate: Fix setting EPP in performance mode
3b4b39f8bfb9 cpufreq/amd-pstate: Add POWER_SUPPLY select for dynamic EPP
c6584e98b60e cpufreq/amd-pstate: Grab "amd_pstate_driver_lock" when toggling dynamic_epp
eee67e91751e cpufreq/amd-pstate: Return -ENOMEM on failure to allocate profile_name
c9d79e27eaef cpufreq/amd-pstate: Reorder notifier unregistration and floor perf reset
70c8c8b50d80 cpufreq/amd-pstate: handle missing policy in dynamic EPP callbacks
be5d0964da97 usb: ucsi: huawei_gaokun: move typec_altmode off stack
65d97c3d9060 serial: 8250: Ignore flow control on suspend/resume with no_console_suspend
a79848859b1a platform/x86: lg-laptop: Check ACPI_COMPANION() against NULL
bd8946ddbe9a perf tests kvm: Avoid leaving perf.data.guest file around
3641a3aed2ec tracing: Move d_max_latency out of CONFIG_FSNOTIFY protection
3e3fb150abad mtd: rawnand: pl353: Fix debug prints
9988c1c9e0d1 dm-integrity: fix buffer overflow with keyed discard
e54be9aa503a net/sched: sch_htb: limit htb_classify inner-class filter hops
b8f08a94b2a4 tcp: fix corruption of urgent data on multi-segment retransmit
ff7f77a234f7 usb: atm: usbatm: fix invalid ci_range initialization
1f9639caeece net: fec: only stop PTP if it was initialized
ddbc5dc5a2e2 slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()
1a5c26e58648 net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup
2ea42936416b net: stmmac: restore NET_IP_ALIGN in the RX DMA offset
6257ec22f617 net: stmmac: selftests: Account for the UC filter list for filtering tests
f09abff67d1f net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering
edce4b5a76dd net: stmmac: dwmac4: Account for the primary MAC address for UC filtering
f64902e8ae1f net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering
57f598f312f9 net: stmmac: selftests: Check multiple MMC counters
66cfb3963552 net: airoha: npu: fix missing streaming DMA mask
99036078abd9 selftests/arm64: Fix MTE prctl TAP plan
d3bb129dad15 selftests/arm64: Treat KSM merge_across_nodes as optional
1c6940784c55 selftests/arm64: Print missing MTE TAP headers
2f0c97b1a32f ALSA: control: Don't add invalid kcontrols to LED layer
67dd5a6c449b netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited()
3b1066a859db netfilter: xt_HL: add pr_fmt and checkentry validation
d5497644329d netfilter: nf_tables: move hardware offload step after building the chain blob
0e5ed3b98d1d virtio-net: Ensure that TCP packets don't overflow gso_segs
023f06c98e03 drm/xe/xe_gt_idle: Add CCS to the powergating info print
c826e980f276 net: stmmac: selftests: Pass the IP proto mask in the TC selftest
30be8c9d598f net: wangxun: use BIT_ULL() to prevent shift overflow on 32-bit archs
84180988a455 net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure
557599edb522 net: ethernet: sun4i-emac: Fix IRQ error handling
626614df9080 samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify
8de8e5476be3 samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-modify
6d1c6f228854 libceph: validate banner payload length
792bfe803228 ceph: revalidate ki_pos for O_APPEND writes after cap acquisition
33b3dc47202d ceph: Fix ERR_PTR(0) in ceph_mkdir()
10a36512c21f ASoC: dapm: Fix off-by-one check on the second enum channel
5449f715f24e apparmor: policy_int make sure list heads are initialized before fail path
59fba1d249dc apparmor: Replace sprintf/strcpy with scnprintf/strscpy in aa_policy_init
d48197cbd5d3 crypto: acomp - allocate async request context when cloning
fdc992f4bc45 tpm: st33zp24: Validate locality read result
14feaa498c20 tpm: st33zp24: Return zero on status read failure
96bc345a3f17 net/sched: sch_teql: restore skb->dev on the slave failure path
aeb8196ecb95 net/sched: sfq: clamp quantum to avoid signed overflow soft lockup
99770b5d8e0e net/sched: hhf: clamp quantum before hhf_change() to avoid overflow
044fa2498bbc net/sched: fq_pie: clamp default quantum to avoid signed overflow
7ca8a8717a9f net/sched: sch_codel: clamp default mtu to avoid disabling CoDel
dfb4b61db886 net/sched: fq_codel: clamp default quantum and mtu
f6b3e3848a5f net/sched: fq: add overflow bounds to quantum and initial quantum
76c847e80d2b net: fix a resource leak in copy_net_ns() error handling path
d1c084d4e9f0 net: core: check skb_frags_readable before uncloning in skb_copy_ubufs
1719865b20b2 net/sched: act_skbmod: fix length calculations and avoid invalid header warnings
3e07d284ef08 selftests/proc: make proc-maps-race work with READ_IMPLIES_EXEC
4e70c064213e maple_tree: fix argument name in header
64ae85a3a29d maple_tree: catch race in mas_alloc_cyclic()
005343e0c329 selftests/mm: skip COW tmpfile cases when fallocate() is unsupported
3d1b2d84b490 cifs: fix clearing stats for fastest execution of each smb2 command
b003d5b4e46c octeontx2-pf: fix NULL deref of af_xdp_zc_qidx on rep setup
bf2b8130723e net/rds: use wq_has_sleeper() in rds_cong_map_updated()
d218ea7df6eb net/sched: act_ife: Only operate on Ethernet frames
936e33035d54 net/sched: add qstats_cpu_drop_inc() helper
ab8e0164c0fe net: enetc: restore RX ring congestion mode after ring reconfiguration
276e74737317 octeontx2-af: Fix TL3/TL2 link config ENA clearing
7abe769e72c7 net: qualcomm: rmnet: restore skb->dev on deaggregated frames
42a139332ce8 octeontx2-vf: fix workqueue and netdev race in probe/remove
537e11a1700f octeontx2-af: fix NULL deref in NIX TM tree debugfs read path
7677eb2cbf2c gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free
53a5b262d706 xsk: honor XDP_TX_METADATA in zero-copy path
5b913e87af4b xsk: align TX metadata layout across ABIs
aeee917a4878 Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop
a644b8df9496 Bluetooth: btnxpuart: Validate the FW dump header length
7b37556d7d80 Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path
566da1197d34 Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX
3818502f2f69 Bluetooth: btmtk: Do not discard the subsystem reset timeout
f3465a143c87 Bluetooth: btmtk: Do not report success when subsys reset fails
9fc4fd78bc65 Bluetooth: btmtk: Fix short read errors in btmtk_usb_reg_read()
5a2cb90e2358 Bluetooth: btmtk: Add MT6639 (MT7927) Bluetooth support
61d5ddbd524c Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan
c3f63610bcea Bluetooth: mgmt: fix 'hdev->discovery.uuids' NULL dereference
87276dc15b55 Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN
00a73ce437e2 arm64: process: Fix context switching MTE store-only tag check
4a888ccb33d0 arm64: ptdump: Make note_page_flush() range aware
f365f36bbb5a erofs: Fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS default logic
f30c8905abda scsi: qla2xxx: Fix an loop timeout test
aa17842bbcca Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition
ff422b8597c2 syscore: Pass context data to callbacks
f7914ff92e4a net_sched: sch_fq: fix pacing delay underflow with pacing offload
9c5d7bdb29ef net: page_pool: Remove zone/policy GFP flags when allocating XArray entries
b9838b655b70 net: libwx: fix concurrent bitmap overwrite in PTP setup
a13a63558e5c net: txgbe: fix MISC interrupt unmasking in non-MSI-X mode and device shutdown
38fa06f9cccc net: wangxun: introduce WX_STATE_DOWN to serialize device shutdown state
6bf50b58f40d net: wangxun: schedule hardware stats update in watchdog
b1d311224479 net: wangxun: replace busy-wait reset flag with kernel mutex
71adad90236b net: txgbe: support RSC offload
80fd6d42f07c net: txgbe: support RX desc merge mode
51fe3fe0ffec ptp: netc: fix period truncation and potential divide-by-zero in PEROUT
430afa27beb9 bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check
001ff5d8e68a bnxt_en: Fix call to hardware monitoring event handler
012bebc86110 rtc: pcf85363: Add error checking to regmap calls in probe()
27f640cd92ee NFSv4/pnfs: key the data server cache on the NFS version
3815b894b922 NFSv4.2: fix LAYOUTSTATS send buffer exhaustion
0879ea157acc net/smc: free pending qentry in smc_llc_flow_stop() before memset
0fb9a5137660 net/smc: free stashed qentry before overwrite in REQ_ADD_LINK to ADD_LINK transition
8b2d8c70b969 net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue
220cfdb17ff6 net: tcp: block mixing readable and unreadable frags
857681f6835d inetpeer: randomize RB-tree node comparison using SipHash
c7f9740f7a1b ip6mr: plug drop_reason to ip6mr_cache_report()
38778f6abdbd ipmr: Free mr_table after RCU grace period.
65f87de5f3c3 net: change sock_queue_rcv_skb_reason() to return a drop_reason
84264cb4e541 ipmr: Remove RTNL in ipmr_rules_init() and ipmr_net_init().
53eefb9db0b2 ipmr: Convert ipmr_net_exit_batch() to ->exit_rtnl().
b30f0801b918 ipmr: Move unregister_netdevice_many() out of ipmr_free_table().
4012a0656797 ipmr: Move unregister_netdevice_many() out of mroute_clean_tables().
4be733a450c8 net: qlcnic: validate unified ROM sections before loading
bf87e4c1e58a net: add missing ref_tracker_dir_exit() to net_passive_dec()
f30cf8fd9872 ipv6: avoid divide by zero in rt6_multipath_rebalance
b8f32b0804b4 netdevsim: update queue NAPI association on queue reset
9d7b6916d5f8 net: ipa: balance runtime PM reference on remove error
5a66873d04b0 forcedeth: stop the tx_timeout register dump past the requested window
bcf88c039af8 net/mlx5: E-Switch, preserve max tx speed on vport state modification
38354e591e3e net/mlx5: Move vport DOWN state check out of mlx5_query_vport_max_tx_speed()
55d18f3ead83 net/mlx5: Skip disabled vports when setting max TX speed
6f4adc05c788 RDMA/mlx5: Implement query_port_speed callback
9137881591f2 IB/core: Add query_port_speed verb
0864bab42677 IB/core: Add helper to convert port attributes to data rate
361dfb9322fd net/mlx5: Add support for querying bond speed
70cd46d12d7c net/mlx5: Handle port and vport speed change events in MPESW
e59b43028345 net/mlx5: E-Switch, use state lock for vport state changes
99300ea5c436 net/mlx5: Propagate LAG effective max_tx_speed to vports
409dc14183ad net/mlx5: Add max_tx_speed and its CAP bit to IFC
4d3fb6977248 net/mlx5: E-Switch, support eswitch inactive mode
ed246bad28d4 net/mlx5: MPFS, add support for dynamic enable/disable
01677786ed4f devlink: Introduce switchdev_inactive eswitch mode
ec750e1f8238 net: thunderbolt: Count delivered packets in rx_packets and rx_bytes
ac2201b48482 net/sched: add get_fill_size callbacks for actions missing them
c0444d7499f1 net: bridge: Reject descending VLAN tunnel ranges
214fb79b0379 xsk: fix NULL pointer dereference in __xsk_rcv()
4585691b2861 xsk: avoid double checking against rx queue being full
5f02599590a4 irqchip/irq-realtek-rtl: Use readl_be()/writel_be() instead of readl()/writel()
5aa7bbe0bac8 irqchip/irq-realtek-rtl: Add mask for interrupt handling
2aa9fcf31f38 irqchip/irq-realtek-rtl: Add interrupt data structure
421615e833d7 irqchip/irq-realtek-rtl: Split out parent setup code
f7d818afcc22 irqchip/irq-realtek-rtl: Add multicore support
a9be52993526 irqchip/irq-realtek-rtl: Add/simplify register helpers
94834742ef19 smb: server: remove unused DES crypto header
72a3e6e0c824 smb: server: Remove obsolete "select CRYPTO_LIB_DES" from Kconfig file
392c985c6b03 ALSA: mtpav: shut down output timer before card teardown
bfce0f324efa spi: amlogic-spisg: Make sure clk_init_data is fully initialized
4d99a477e61f RDMA/ucma: Allow path records to exactly fit the output buffer
b15782627b65 ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup
735384a9dd59 ALSA: core: Add scoped cleanup helper for card references
dca93566f0e2 irqchip/gic-v5: Use logical cpu 0 irs_data for dynamic IST allocation
265fdce1efb1 irqchip/gic-v5: Fix gicv5_init_common() error paths
76ed544059ca irqchip/gic-v5: Check for NULL LPI domain on domain teardown
099772e948cc irqchip/gic-v5: Synchronize CPU interface disable
8f7980033e9f clk: visconti: Make sure clk_init_data is fully initialized
58c368552f83 clk: ti: Make sure clk_init_data is fully initialized
41c2ccf0d740 prctl: fix PR_SET_MM_AUXV losing the forced AT_NULL terminator
589f8d44c9dc lib/interval_tree: fix allocation warning messages
5a8f18a7d369 rtc: gamecube: check return value of devm_rtc_register_device()
fdc4b500071a i2c: ocores: Disable clock on failed resume
38c6831fefde irqchip/renesas-rzg2l: Fix loss of interrupt
367dbc320b27 rtc: zynqmp: Return optional clock lookup errors
dbaca07f78a8 cifs: remove dead size-update blocks in cifs_setattr_unix/nounix
442c5f1358ce smb: client: fix request buffer leak in smb2_new_read_req()
6fd823a8872d rtc: spacemit: handle regmap_test_bits() error return
08a59c28c2bd rtc: pcf8563: fix clock provider leak on unbind
28701b74c22d virtio: rtc: time out alarm requests
6ca752850de3 vdpa/mlx5: fix wrong list iterated in add_direct_chain error path
4d059e7af5e9 virtio_pci: fix wrong queue index for admin vq in intx path
4f723111a852 vhost/net: fix clear_user start address in VHOST_GET_FEATURES_ARRAY
6dd28e32f4d8 virtio_balloon: quiesce balloon work before device shutdown
808b1751540d virtio_balloon: factor out virtballoon_quiesce()
0d7b20057d4f virtio: add virtio_device_shutdown() helper
68b726b3a01f vdpa_sim: fix cleanup after worker creation failure
8b3edaa10a30 virtio_balloon: disable indirect descriptors
5fe03b525709 net: add missing ref_tracker_dir_exit() to alloc_netdev_mqs()
4f80425ad5a0 bonding: initialize err for empty target lists
795e7b3a356e mlxbf-bootctl: fix the build error with FIELD_PREP()
2c09cadec116 platform/x86/amd/hsmp: Reject negative power cap writes in hwmon
ace1ba5fca0a platform/x86: hp-bioscfg: fix password encoding bounds check
4d35c6d69808 vsock: use sock_error() to consume sk_err after a failed connect
36e5fa009f98 vsock: don't check the listener's sk_err in vsock_accept()
06c95182234a vsock: avoid timeout for non-blocking accept() with empty backlog
df8f661b4f32 platform/x86: dell-wmi-sysman: Fix instance ID bounds
3e8fe6503d0c net/smc: hash socket only after full initialisation in smc_sk_init()
6ea95c886d70 8139cp: fix Rx and Tx not being disabled in cp_suspend
3e6b705bc162 vxlan: mdb: Fix use-after-free in vxlan_mdb_flush()
5f22943cd2c8 ALSA: hda: Fix connection list comparison in proc output
a5129155ca9f fuse: check for NULL root inode in fuse_fill_super_submount
5559dd7888d2 soc: qcom: ubwc: Fix missing include
aab1880058ac fs/ntfs3: validate ef->size covers the record's name and value
74a83aa05f73 fs/ntfs3: fix out-of-bounds read in read_log_rec_buf()
389bd349ddbc cuse: wait for pending RCU callbacks on module exit
fdb9cd16f8b6 net: bridge: vlan: fix inverted default vlan notification
a34d2e0bfb74 tls: fix RX desync on overlapping skbs
f3b6834c13ed net: dsa: mv88e6xxx: Fix PCS link check on CMODE read error
daebc7064a1b vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes
4aed450adaee ipvs: fix integer overflow in ftp helper port/address parsing
448f505e1924 f2fs: fix to avoid pinfile fragment on fragment:{block, segment} mode
32ee27946f09 f2fs: cleanup w/ f2fs_need_rand_{blk, seg, seg_blk}
dd5d8f4a9c67 f2fs:Fix incomplete search range in f2fs_get_victim when f2fs_need_rand_seg is enabled
65702339b3e9 net: hsr: free learned nodes on device setup failure
54bc96aeee05 pppox: drain queued packets on channel handoff
fb511bf117ed net: dsa: b53: fix error propagation from b53_fdb_dump()
292846223ead net: kcm: Hold RCU read lock while running BPF parser
31fbed0b409a ionic: fix completion descriptor access with 2x desc size
3ec0225b9d75 ptp: netc: skip PEROUT disable if channel is not enabled
00f1000a644e drm/xe: tests: fix error message in xe_migrate_sanity_test()
e794cdc5c369 hinic3: Fix skb linearization mismatch and drop skb when skb_checksum_help() failed
c0f208d8a572 octeontx2-af: initialize lmac_bmap in rvu_mcs_set_lmac_bmap()
ea7b35dcc943 bpf, xdp: move offload check into dev_xdp_install()
9e5e2ccc51df clk: ti: mux: resolve parent clocks by DT index, not by name
9d4843f10512 clk: devres: fix cleanup in devm_clk_get_optional_enabled_with_rate()
4c067f5ffb46 nfs: fix ENXIO on O_CREAT open of existing symlink over NFSv3
d148a652d52f NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease()
163c16e01f53 NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers
1e1c36b206c6 pnfs/blocklayout: Fix device leaks on parse failure
3f2387e8bfbc NFSv4: remove callback IDR entry on client allocation failure
4c59aca79da0 nfs: refactor pNFS functions using clear_and_wake_up_bit
8179b8a1d636 nfs: replace atomic bitops sequence with clear_and_wake_up_bit helper
b967a595fb73 smb/server: fix session leak in ksmbd_session_register()
a4a307d14932 ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size
a21597b5730b ksmbd: disconnect on SMB3 decryption failure
2bdbe0045420 bpf: Reject negative optlen in cgroup getsockopt hook
be98f92fc244 m68k: nfcon: Do not call console_is_registered() in nfcon_device()
fe91c3f64a73 bpf: Disallow bpf_{g,s}etsockopt() in cgroup UNIX getname hooks
64eec7314e28 erofs: fix unused pcluster_pools for higher page sizes
7cf561843ed0 lwt_bpf: Restore reserved headroom after xmit program
a3d6e590268e erofs: guard on-disk algorithm IDs against Z_EROFS_COMPRESSION_MAX
ddb7ea4fd99b erofs: fix interlaced ztailpacking pclusters
7f10dc9a7a49 erofs: error out obviously illegal extents in advance
169f6633d2a3 erofs: clean up encoded map flags
892048f59550 smb/server: preserve error status in smb2_handle_negotiate()
b2d78c199dfd smb/server: fix invalid pointer dereference in ksmbd_stop_durable_scavenger()
8461f2790272 smb/server: fix null-ptr-deref in ksmbd_ipc_tree_connect_request()
a41a98ee16ae ksmbd: free preauth sessions on connection teardown
9f37719d6be8 ksmbd: do not advertise unimplemented CA support
0aa8f94bfd4d ksmbd: validate ipc response length before dereferencing its fields
7a98c3b903b1 smb: server: fix leak of ksmbd_ipc_login_request_ext() returned buffer
84c2d8e807ac ksmbd: Do not skip lock checks for single-byte ranges
db141a5ebcb0 hwmon: (emc1403) Drop hysteresis for low limit temperature
c38cc41bb9dc hwmon: (emc1403) Rely on subsystem locking
86c1617b7d4b hwmon: (coretemp) Fix core_data leak on CPUs without PTS
00cce5e457cb apparmor: fix deadlock in complain-mode change_hat
4609e0e0be70 block: mtip32xx: synchronize ioctls with device removal
7e3e5273fc9e ublk: reject non-power-of-2 zone sizes in SET_PARAMS
32456a859955 null_blk: serialize configfs attribute updates with device setup
65cae82fd3c3 null_blk: serialize configfs attribute stores with the lock
3e35ad503386 null_blk: reject per-device queue resize for shared tag set
b2437d37fcc3 null_blk: free zones array on device power-off
2b59484ac1e6 null_blk: free global tag_set on init error path
d761be1b8f2b null_blk: register configfs subsystem after creating default devices
c7dea90c9b4e null_blk: use DEFINE_MUTEX for the file-scope mutex
cbc24bce70df mailbox: riscv-sbi-mpxy: validate RPMI notification lengths
1bd910aae6ab mailbox: pcc: Fix command timeout due to missed interrupt
d255b6575650 mailbox: rockchip: disable pclk on probe failure and unbind
413b0b94d6d0 mailbox: qcom-cpucp: handle NULL data in send_data callback
8b8de6400c86 mailbox: qcom-cpucp: fix PREEMPT_RT self-deadlock in IRQ handler
eb05c19dfb36 perf dso: Replace assert with runtime check in dso__read_symbol()
ac09bbbde1d4 perf dso: Guard against cache underflow on short reads in dso_cache__memcpy()
d3eaeabc08ae perf dso: Use stored fd error instead of stale errno in file_read() and file_size()
dd9560c7b46e perf dso: Guard close() against invalid fd in dso__decompress_kmodule_path()
b40859b32577 perf dso: Guard against errno==0 when dso__get_filename() returns NULL
b8f864217865 sched_ext/scx_flatcg: Fix cvtime true-up on slice expiry
9d634e8f9e20 crypto: lskcipher - propagate errors from unaligned crypt
8c9b0a3a6d27 crypto: hisilicon/sec2 - fix CCM algorithm long packet failure
efcfda20b7b7 selftests/sched_ext: Fix flaky ddsp failure tests on busy systems
6b019f0daa61 bpf: Fix pending_pos walk on 32-bit ring position wrap
15512c6b5dea ACPI: scan: fix bus ID cleanup on device_add() failures
04a43c321e10 ring-buffer: Remove trace_buffer::cpus
801ae90f8ce0 riscv, bpf: Fix missing sign-ext for signed 1-byte and 2-byte kfunc args
5a19c3fccc7e selftests/bpf: Use ping_command() for IPv6 pings in lwt_ip_encap
17a4dd3b0e6d selftests/bpf: Add tests to verify the fix of encapsulating VxLAN in lwt
54bff7c8e410 HID: multitouch: reclassify HTIX5288 to WIN_8_FORCE_MULTI_INPUT_NSMU
d2f41287b51a ASoC: SOF: validate topology volume range before allocation
e30214289e62 tracing: Have trace_event_update_all() only handle module that is loading
324cc98b71f0 HID: haptic: don't write an uninitialized value to unhandled usages
a561012868ae ALSA: core: Fix use-after-free in snd_card_do_free()
ce9a619c432b fs/ntfs3: reject out-of-range evcn in mi_enum_attr()
dc6d85de7e26 fs/ntfs3: fix integer overflow in MFT cluster validation
863e10c4508c bpf, arm64: Fix stack-passed arguments for indirect trampolines
424a9fc4876c net: page_pool: fix UAF in __page_pool_release_netmem_dma on xa_cmpxchg race
e44b3b35bb15 scsi: ufs: core: Set task state before io_schedule_timeout()
2dbdd025b228 scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers
b6273cd8dc55 selftests/bpf: Fix for veristat file/prog filters processing
d0a3729d464f Squashfs: check block offset is not negative
f8747d81aa6d ocfs2: fix circular locking dependency in ocfs2_init_acl()
e35fa6eb4d2a ocfs2: validate DIO orphan slot during inode read
c6c908f9b4ed ocfs2: validate orphan slot during inode read
508907eb8ea4 bpftool: Fix double close in map dump
b000458cab95 x86/pkeys: Fix pkey_alloc() return value when pkeys are not supported
0ef3f5629051 selftests/cgroup: Preserve CPU hotplug write errors
210c193a9ef1 ALSA: seq: midi: Serialize input teardown with event_input
5c94ea1e64d3 ALSA: seq: midi: Optimize event_input locking with RCU
1f6d28c428ca clocksource/drivers/armada: Unwind timer clock on init failure
fa0901c1c555 clocksource/drivers/clps711x: Do not unmap clocksource MMIO
5d83f3faa3fb s390/debug: Fix deadlock during unregister
e0cb87f43885 xenbus: Unregister reboot notifier on init failure
ac7b10121140 power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address
b3827f2e7b60 power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address
2f890ba8521f power: supply: bq27xxx: bq27520g4: fix REG_TTES address
7d181b48da3f power: supply: bd99954: Drop bad register fields
3ab6f4eccbbf PCI/ASPM: Disable/restore ASPM on every function for multi-function devices
a3040b9e90eb spi: img-spfi: don't disable runtime PM on DMA deferred probe
41849630000e selftests/bpf: vmtest.sh: Preserve command quoting when running in the VM
5e41939ae492 selftests: harness: Mark test fixture objects __maybe_unused
d97cb1421c94 selftests: harness: Restore order of test functions
e17ba89f8b78 kunit: tool: fix _list_tests filtering wrong variable when list has TAP prefix
afc211a29399 perf build: Remove leftover feature tests for removed cxx and clang support
1e94e67483e0 super: fix dying superblock warning messages
c01652db11c2 PCI/ASPM: Use pcie_capability_clear_and_set_word() for ASPM disable/restore
d6037e42aa4d firewire: core: fix memory leak in error path of build_tree()
4679bf3517ce firewire: core: validate parent port count before allocating nodes in build_tree()
861e6dd1f593 firewire: core: consolidate port counting in build_tree()
6d2eba5cdb81 firewire: core: add KUnit tests for failure of tree building
d7d075f17d61 firewire: core: add KUnit tests for successful tree building
b5d3c30d03db firewire: core: add KUnit test skeleton for node tree
3216ff97d329 UBI: fix two issues in the ubi.mtd MODULE_PARM_DESC
8b30628dfc2b ASoC: xilinx: formatter_pcm: fix stream_data leak on open error
e065960366b5 mtd: ubi: Release device reference on busy detach
e3f7e58189bc ubi: Fix rollback for explicit UBI device numbers
e6d77e2ea55f UBI: fastmap: Pass to_be_tortured when reusing old fastmap PEBs
34b180031021 UBI: Preserve torture flag when rescheduling failed erasures
e06806a8f4cf ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready
efc40977e710 ASoC: pxa: Use devm_clk_get_optional() for extclk clock
99c554f19347 idpf: add missing cpu_to_le32 in idpf_tx_splitq_build_flow_desc
f06d77436aab ice: acquire NVM lock around each flash read
42ff18e407e9 ice: refactor to use helpers
c0fcef8e24a8 ice: clear the default forwarding VSI rule when releasing a VSI
f5071e3ad4ca ice: fall back to SBQ when LL PHY timer interface times out
544e40805dbb RDMA/cma: Fix WARNING in res_to_rt
046425412529 RDMA/cxgb4: Free debugfs on registration failure
3c9c9b56fbaf dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal
b1e8d4066399 ALSA: seq: Don't leak the extension cell pointer in the bounce payload
4f0483bbcdac nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing
9cfe74542b54 nfc: digital: Do not dump a NULL response in command completion
7a8e0a7aef80 nfc: pn533: hold a reference to the request skb during send_frame
749a9048bf51 nfc: llcp: bound SNL TLV parsing to the skb and add length checks
ba4c776af3dc nfc: nci: fix double completion race in nci_data_exchange_complete
156e65bd2930 nfc: llcp: read llcp_sock->local under the socket lock in getsockopt
8bf228fa02b1 nfc: llcp: avoid userspace overflow on invalid optlen
4b59f93cf4ba nvme: reject passthrough of driver-managed Set Features
736b7c6adc7a nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()
1fb1236312ee nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns()
a2cf452ba710 nvme-apple: Drop the PRP null check chicken bit
311e4e21ffd4 nvme-apple: Require page aligned buffers on the admin queue
5ee7e381b1bc nvme: Add a quirk for page aligned admin queue buffers
25c76e0c07f2 nvme: expose active quirks in sysfs
95e93ee7053b nvme: remove virtual boundary for sgl capable devices
85571e5a37ff block: accumulate memory segment gaps per bio
897184def60c nvme-apple: Never set the opcode in the NVMMU TCB
751e8e18be0a nvme-apple: Don't set a DMA direction for commands without a data transfer
215d1682f0ba nvme-apple: Destroy the admin queue on removal
c38a81863267 nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()
cb30449ee9a9 nvme: Add the DHCHAP maximum HD IDs
a3453d50130c s390/irqflags: Add out-of-line definitions of arch_local_irq_*() for KMSAN
af20646a329e s390: Drop unnecessary CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT
283d2d61c4a3 integrity: Make arch_ima_get_secureboot integrity-wide
d408d69f92b8 arm64: bti: Disable in-kernel BTI with recent versions of Clang
bc34d1043230 ASoC: qcom: q6apm: keep the graph start count in sync with the DSP
79c05936be12 spi: sprd-adi: Fix probe succeeding without registering the controller
b68d3a7a1458 phy: qcom: qmp-combo: Drop qmp_v4_calibrate_dp_phy
b499e89a828e phy: qualcomm: qmp-combo: Add DP offsets and settings for Glymur platforms
becb8b30d9da phy: qualcomm: qmp-combo: Update QMP PHY with Glymur settings
e1ce0661c0ce phy: qualcomm: Update the QMP clamp register for V6
aa615671f486 phy: qcom-qmp-combo: Use regulator_bulk_data with init_load_uA for regulator setup
660b56537e18 phy: qcom: qmp-combo: Correct pre-emphasis table for QMP v4 DP PHYs
31b8b620a8aa phy: renesas: rcar-gen3-usb2: Ignore missing VBUS regulator
832022bb2ba5 rust: uapi: replace direct asm-generic/ioctl.h include with linux/ioctl.h
218c36fdd5c6 iommu/amd: Fix incorrect device ID in invalid PASID error message
7d1099b86356 apparmor: fix unconfined user namespace restriction forced stack
07485821b20b apparmor: change fn_label_build() call to not return NULL
ab64b1584a90 apparmor: split xxx_in_ns into its two separate semantic use cases
c7f53d35455d powerpc/configs: enable CONFIG_RAS to fix EDAC support
569eb11f0990 amt: Don't support cross-netns setup.
6033cc02fe27 selftests/sched_ext: Check skeleton open failure in exit test
f1872cddf12a cgroup/cpuset: Use WRITE_ONCE() for shared prs_err updates
474da0e00d0c cgroup/cpuset: Fail if isolated and nohz_full don't leave any housekeeping
4fd62a9418ab cgroup/cpuset: Rename update_unbound_workqueue_cpumask() to update_isolation_cpumasks()
c25b6b28a35f nvme-pci: release descriptor pools on probe failure
9e489dc3fbbf nvmet: propagate percpu_ref_init() failure in nvmet_ns_enable()
33f07f8fbb9c nvmet: fix Reservation Register Replace for unregistered host with IEKEY
da652cb17f9f sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE
cda4aacfb0bb SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6
7d0554350d88 hwmon: (cros_ec) Synchronize EC access from the thermal device callbacks
13ad7a04b97a hwmon: (cros_ec) Store the hwmon device in cros_ec_hwmon_priv
49390d9d8eaf hwmon: (cros_ec) Register the thermal devices after the hwmon ones
786409d4dcd1 hwmon: Support guard() and scoped_guard for subsystem locks
1a010fcc0f1b hwmon: (cros_ec) Add support for temperature thresholds
14ec26627541 hwmon: (cros_ec) Move temperature channel params to a macro
6fa77dea178e hwmon: (cros_ec) Split up supported features in the documentation
28e9bcb654f1 arm64: Disable KCSAN instrumentation in delay.o
0f7f363cc6ce xdrgen: Fix opaque and string encoders for unbounded members
97c12f3e24e7 xdrgen: Do not declare union XDR functions in the definitions header
184a3e5bbc01 xdrgen: Address some checkpatch whitespace complaints
221a025fb6aa m68k: Fix backtraces for non-running tasks
0fdc6aaea296 hwrng: imx-rngc - Disable clock on registration failure
5067a5fbbd02 crypto: qat - remove dead ADF_HEX code
0c68bf6b4842 crypto: qat - use 2-arg strscpy where destination size is known
a803141597d6 iommu/vt-d: Flush context cache with correct SID when tearing down aliases
d0e978ced742 iommu/vt-d: Tear down scalable-mode context on probe failure
3c88cfedc776 iommu/vt-d: Clear Present bit before tearing down copied context entry
686bd59429ff iommu/vt-d: Fix UCTP context table slot when copying root entries
e3c53e9173a4 iommu/dma: Restore locking around msi_page_list
7508654e409e fbdev: clps711x-fb: Remove unreachable unregister_framebuffer() call
33e54e3e0b2c fbdev: kyro: Validate overlay viewport coordinates
656e580c19ca fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device()
656e43f7afab perf synthetic-events: Fix divide by zero in perf_event__synthesize_threads
e0b01aedf85f perf python: Fix memory leak in pyrf__metrics_cb
9eebbaf7a33b perf python: Validate CPU and thread maps in pyrf_evsel__open
ce4c4c03ef5b perf python: Handle Py_None for thread and cpu maps
2fef75555c0a perf python: Check counts_values size in set_values
aba46bc65e08 perf test: Fix skiplist leak in cmd_test
02ffce64f7ad perf test: Support dynamic test suites with setup callback and private data
122c64347d9a perf synthetic-events: Fix uninitialized pthread_join
a9ee5e8eae20 perf stat: Fix evsel_list leak in cmd_stat
b567e25ffda7 ARM: dts: helios4: add SATA regulator supplies
37dac96549d9 ARM: dts: helios4: add vcc-supply to GPIO expander
5934c1c86707 ARM: dts: helios4: add vcc-supply to EEPROM
19ebf0422fe9 arm64: dts: turris-mox: fix usb3 phys
c2178137a789 i3c: renesas: Don't register devices when ENTDAA times out
8ca083c0fe2c i3c: renesas: Follow a unified pattern for transfer and command initialization
4e2b33373a0f i3c: renesas: Return immediately if there is no transfer
a052ad5edccf bpf: Fix mmap_lock leak in irq_work path
cc1c1c70d203 bpf: Avoid faultable build ID reads under mm locks
b25ce833d8f1 bpf: Factor out stack_map build ID helpers
c1d79bb9c466 riscv: cpufeature: Clarify ISA spec version for canonical order
bbe2fd6d77df net/sched: cls_api: fix teardown of an adopted proto on insert-race loss
457ee7219c9e iio: light: gp2ap002: re-enable irq if runtime suspend fails
0fc740c25c9a iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes
1ab7ef7ccfb8 iio: light: opt4060: Fix pointer type passed to div_u64_rem()
1ab3da12061d bpf, cgroup: Fix storage null-ptr-deref after replacing prog
7c2658023d83 Bluetooth: MSFT: validate evt_prefix_len against the response length
7efd7fb4c9c7 Bluetooth: btmtksdio: fix usage_count leak when autosuspend_delay is negative
e1fc9c5878f0 Bluetooth: btmtk: add MT7902 SDIO support
534d3efd59b3 Bluetooth: btmtk: add MT7902 MCU support
c00556fbe75e mmc: sdio: add MediaTek MT7902 SDIO device ID
e0cd7b34dc6b Bluetooth: MGMT: free the HCI command when it is cancelled
05438d338a87 Bluetooth: MGMT: free the mesh send cancel command when it is cancelled
9c3b6c1413bd Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths
c1fe3c74a89a Bluetooth: hci_conn: fix the SCO setup context lifetime
2f907608cbcf Bluetooth: btintel: Fix diagnostics event detection
be1e3df2c49c Bluetooth: virtio_bt: avoid OOB read of build info string
244d02990081 pinctrl: airoha: fix edge-triggered interrupts handling
c7596135e7e9 pinctrl: airoha: fix IRQ mask/unmask code
fda7350f257e pinctrl: airoha: add missed IRQ resource helpers
9ea692247ee2 pinctrl: airoha: fix getting gpiochip/pinctrl pointers in the IRQ handling code
f3b8fe04dbfe pinctrl: airoha: add missed get_direction() function for gpio_chip
7d2b3f8a996d pinctrl: airoha: an7583: fix spi group pins
38a2a4d6c7ac pinctrl: airoha: an7583: fix muxing of non-gpio default pins
2313f262999c pinctrl: airoha: an7581: fix mux/conf of pcie_reset pins
2ad214708259 pinctrl: airoha: fix pwm pin function for an7581 and an7583
cfe4350fdcb5 pinctrl: airoha: convert PWM GPIO to macro
fa27ddca6602 pinctrl: airoha: an7583: fix I2C0_SDA_PD register bit order
cbde1169bdd2 pinctrl: airoha: an7581: fix pinconf of i2c_scl/i2c_sda pins
75ceddfa7df7 pinctrl: airoha: fix mdio bitfield names
4bf51df55d7b pinctrl: airoha: add support for Airoha AN7583 PINs
74c2c5b459b4 pinctrl: airoha: convert PHY LED GPIO to macro
e6edde29990a btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data()
b0059242735e btrfs: avoid GFP_ATOMIC allocations in qgroup free paths
f44616db1dbc btrfs: use aligned range for locking in extent_fiemap()
92484ad014f2 btrfs: zoned: don't clobber the extent buffer when zeroing it out
12b6d1a1715c btrfs: retry verity reads for not-uptodate Merkle folios
58ce50b1802a btrfs: always wait for ordered extents to avoid OE races
76b7c505c74f btrfs: merge setting ret and return ret
8a34b30bd1bf btrfs: make btrfs_repair_io_failure() handle bs > ps cases without large folios
a9701dd06e82 btrfs: defrag: fix deadlock between defrag and delalloc space reservation
34f67cfb15fa scsi: sd: Fix sd_done() sense handling condition
8bd807995dd5 perf trace-event: Fix integer truncation in do_read() and skip()
14470bc005ec Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices
4ea16cbcc58e Bluetooth: btusb: Record matched usb_device_id into btusb_data
5ca4aa51ab37 Bluetooth: btusb: refactor endpoint lookup
dc849d11a7d2 Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855()
4ea53de3e47f Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event
1403beab27c6 sched/fair: Check CPU capacity before comparing group types during load balance
ce065b76c89c sched/fair: Also gate overloaded status update for SD_ASYM_CPUCAPACITY
cab5015ee3f2 perf/x86/intel/pt: Fix stop/start with no update
b53e430f8eab perf/x86/intel/pt: Use bitwise access for PERF_HES_STOPPED
ad9d3402f4b0 perf/x86/intel/pt: Factor out pt_config_enable()
54eb9b2d18f8 ACPI: video: Release PCI device reference after lookup
679b86278101 regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling
053ec85cb9f2 bpf, arm64: Fix exception table metadata for arena load-acquire
415257c38a3f bpf, x86: Fix exception table metadata for arena load-acquire
5f13a844d0c9 bpf, riscv: Add and use bpf_atomic_is_load_acq() helper
c4c8de3bf48d bpf: Reject load-acquire from pointers requiring fault protection
57b72442c167 perf: arm_pmuv3: Zero initialize hw_id branch stack field
f61f65fc81dc coresight: Refactor etm4_config_timestamp_event()
9e804dbe28b7 coresight: etm4x: fix leaked trace id
1ade9a335c69 coresight: etm4x: fix underflow for usage of (nrseqstate - 1)
9241edfb84a0 coresight: Change syncfreq to be a u8
a29d753e9d83 coresight: etm4x: fix wrong check of etm4x_sspcicrn_present()
f9cdb5bb8efb md/raid1: don't set array_frozen in raid1_takeover()
c55aa6c17f01 md/md-llbitmap: stop daemon timer rearm on destroy
930cc4f1af5a md/md-llbitmap: prevent create failure bitmap UAF
d81822fd5fa8 md: avoid stale clone I/O accounting timestamps
73881ff7a759 md: wait for behind writes before destroying bitmap
02c10581866d md/raid5: round bitmap stripes with sector division
d2c069ddaec7 phy: qcom: qmp-pcie: Add pcs_lane1 offset to V5 offsets
5547fd950d6b phy: qcom: qmp-usb: Fix possible NULL-deref on early runtime suspend
61749681e4a3 phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend
52ad86ea5f98 phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend
f67686d82675 phy: qcom: sgmii-eth: vote for both voltage rails with correct current loads
12d35c657262 phy: qcom-sgmii-eth: relax order of .power_on() vs .set_mode*()
a834458ecaad soc: fsl: qe: check platform_driver_register() in qe_ic_of_init()
dfe848cadfde hugetlbfs: release subpool on fill_super failure
2177c04ca068 pinctrl: rockchip: Reset the pin count when recalculating SoC data
6eaa632d0ed7 firmware_loader: do not queue completed sysfs fallback requests
067504c00fe1 scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path
8d752f1bb73f drm/amdgpu/gfx6: Use PFP on the compute queues too
375adae128dd drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets
1a1ea9738c41 perf trace-event: Fix buffer overflow in read_string()
b8ae06ccde3f phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table
1489b694b1f3 phy: sunplus: fix error handling in sp_uphy_init()
bf7fefbc26e2 phy: renesas: phy-rcar-gen3-usb2: Fix devm action registration for disabled VBUS regulator
b464367d7397 phy: renesas: rcar-gen3-usb2: Add regulator for OTG VBUS control
733d3c1f3f51 phy: renesas: rcar-gen3-usb2: Factor out VBUS control logic
66ef9160e878 arm64: dts: ti: k3-am64: Fix MDIO clock reference for ICSSG0 node
7c4c228b0cc3 ext4: fix spurious message about orphan cleanup on RO fs
d2d543f9313f drm/amdgpu/gfx6: Fixup emit_cntxcntl()
037d9babf6c6 leds: gpio: Clear error pointers for skipped LEDs
b75f84c01027 mfd: macsmc: Fix key count endianness annotation
f59ccd8eeaa0 mfd: iqs62x: Reject zero-length firmware records
8ae4d0ff3e35 mfd: rave-sp: validate received frame payload lengths
519e7de2c4c7 arm64: hibernate: Restore DAIF state on error
012823494e20 arm64: hibernate: mask DAIF before restoring hibernated kernel
73979c96a3b8 wifi: mac80211: skip default WMM setup for AP_VLAN links
48b5a520b80a RDMA/erdma: restrict the driver to little-endian systems
b2709aad7599 module/dups: Fix use-after-free in kmod_dup_req lifetime handling
ef7c354f7377 module/dups: Inform duplicate requests about the result directly
11fa3f7ffd4f module: use strscpy() to copy module names in stats and dup tracking
ba7e83ce0b34 module: replace use of system_wq with system_dfl_wq
de603f01d9cc RDMA/siw: Fix use-after-free in siw_accept()
6c506fee5a5f IB/isert: post the full-feature receive buffers after session registration
a6c19af05c17 IB/isert: delay the final Login Response until the session is registered
aaa66e60c0e2 cpufreq: imx6q: fix out-of-bounds write when probed more than once
e2d2612e63e2 cpufreq: imx6q: fix devres accumulation across driver rebind
db0a49f0a37d rust: cpufreq: Fix temporary write in Registration::bios_limit_callback
297397878190 rust: cpufreq: Add CPUFREQ_TABLE_END as last table entry in TableBuilder::to_table
b43a2518c3ec drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz
46510c3e496b drm/sun4i: dw-hdmi: Drop TCON TOP port reference
17a588752ddf drm/sun4i: tcon: Drop remote endpoint reference
65bc02fec98e drm/sun4i: crtc: Propagate layer initialization error
50806c951a68 drm/sun4i: hdmi: Don't leak sync polarity bits into packet control
1ca06d47ac40 drm/sun4i: tcon: Drop TCON TOP device reference
425a414f9b5d drm/sun4i: tcon: Set output mux for DSI and LVDS
6ec54d801440 drm/sun4i: vi scaler: Fix coefficient selection
46a5fe1a4357 clk: rockchip: rk3576: fix source muxes for SPI0..SPI4
aee687a2fb36 ocfs2: synchronize heartbeat callbacks with o2net teardown
ba32c7d6129d perf libbfd: Fix memory leaks and NULL fclose in BPF disassembly
59cc63d244d9 perf bpf: Add PROG_TAGS to required arrays in __bpf_event__print_bpf_prog_info()
c473f3aa721e perf libbfd: Validate BPF prog info arrays before pointer cast
c71f9a56520b ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults
314f1a6762b5 ARM: 9481/2: breakpoint: CFI breakpoints only on demand
dc2272c00d7c RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ
ec987c065465 RDMA/erdma: Hold QP references for AE and CM processing
1fc9c1933959 RDMA/erdma: Hold CQ references when processing EQ events
56ea0a1f9f93 kbuild: fix modules.builtin(.modinfo) targets in the top-level Makefile
933076eb1d3d modpost: prevent leak when early return no suffix .o in read_symbols()
0fde935ae0ea scripts/tags.sh: Prevent binary files appearing in cscope.files
804378ff0d62 intel_idle: Avoid using deep idle states during initialization
56450feb6f48 intel_idle: Add cmdline option to adjust C-states table
33a5d2f00cac intel_idle: Initialize sysfs after cpuidle driver initialization
6ee7b0088849 bpf: Check load-acquire src ptr type before the load
cb0671ffce48 arm64: dts: qcom: sar2130p: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
af38023bc47d arm64: dts: qcom: sm7225-fairphone-fp4: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
f068388689be arm64: dts: qcom: qcs8550-aim300: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
e70a165b7941 arm64: dts: qcom: sc8280xp-blackrock: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
2fa866714f22 selftests/mm: fix ternary operator precedence in ksm_tests
5cd78a904275 selftests/mm: fix ksm NUMA merge test for systems with memoryless NUMA nodes
335b75cfed44 selftests/mm: ksm_tests: use kselftest framework
86ead1763011 bpf, cgroup: Fix invalid storage access after __cgroup_bpf_attach failed
6fd220604f06 remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()
5a5ed571032e remoteproc: use rsc_table_for_each_entry() in rproc_handle_resources()
a356d08d7151 remoteproc: Move resource table data structure to its own header
90361f45ffe8 arm64: dts: qcom: agatti: Add missing CX power domain to DISPCC
9063b30faae8 drm/omap: dsi: Do not copy isr table
d1cfbccccad7 riscv: dts: sophgo: cv180x: Allow the DMA multiplexer to set channel number for DMA controller
571ea4263d69 fat: release buffer head after rebuilding parent
44a37264b269 rapidio: clear mport->net when rio_add_net() fails
9df662fcac6f pps-gpio: remove dead capture_clear code
599d4c92aa0b pps: pps-gpio: split IRQ handler into hardirq timestamper + threaded handler
e31ff723811e pps: don't try to wait for negative timeouts in PPS_FETCH
f637a83115b3 lib/string: fix memchr_inv() for large ranges
8abb2b7c60d2 ocfs2/cluster: keep heartbeat local node stable
b55e7e61c5c1 ublk: check for ublk_unmap_io() returning 0
0121c84adb6a ublk: check import_ubuf() return value
b4e971c80e64 block/kyber-iosched: flush per-cpu latency buckets over possible CPUs
7c25949cee2f block/blk-iocost: collect per-cpu latency stats over possible CPUs
55bda3de92f8 block/blk-stat: drain per-cpu callback stats over possible CPUs
3d8c3da95c75 blk-cgroup: skip dying blkg in blkcg_activate_policy()
ac34e655dffa blk-cgroup: fix race between policy activation and blkg destruction
c4487e4d5309 phonet: pep: do not write beyond optlen in getsockopt
f16c2c3932ce net: stmmac: Skip PHY attach if custom PCS is in use
c65d67b08bab iio: light: tsl2583: return zero in write_raw() on success
7a6a9bc87c6e iio: light: isl29028: return zero in write_raw() on success
1e628f7ce4bc iio: light: tsl2772: fix ALS calibscale readback
6c98ec4447d2 perf arm-spe: Reject zero nr_cpu in metadata to prevent division by zero
9a857be21e2f perf intel-bts: Fix off-by-one in auxtrace_info minimum size check
b3a42fd1a0cd perf intel-pt: Fix off-by-one in auxtrace_info minimum size check
59910f142da8 perf auxtrace: Fix queue grow overflow and old array leak
003de0cf0810 perf thread-stack: Fix heap buffer overflow on branch stack wrap copy
5db6e27ad43d HID: lg4ff: validate report length before fixed offsets
bef8426d7138 HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure
f694ea0ead54 HID: steam: Reject short reads
78c39dd5cc4a HID: steam: Improve logging and other cleanup
a0fbd9437d7d HID: steam: Add support for sensor events on the Steam Controller (2015)
041e63bd2f73 HID: steam: Rename some constants that got renamed upstream
d73725bf8612 HID: steam: Refactor and clean up report parsing
17e532415518 HID: i2c-hid: Fix "(null)" output when reading report descriptor fails
01eeb601a162 HID: synchronize input before cleaning up a failed probe
e5b6af32ecdd HID: i2c-hid: Refactor _DSM helper and add i2c-hid-acpi-prp0001 driver
d7f2ec073a05 misc: pci_endpoint_test: Check SUCCESS bit for doorbell status
5c58ea19a909 dm-integrity: replace forgeable discard filler with a keyed sector marker
4f6bd79bb7e5 tty: clear cdev pointer after cdev_add() failure
5b77848423f4 serial: amba-pl011: keep console clock enabled for atomic writes
5ac19e4e26e9 serial: amba-pl011: unprepare console clock on unregister
ea7fd4e8e8b8 MIPS: ptrace: Fix syscall skipping via PTRACE_SYSCALL
6bdbc2b4df1f soc: fsl: qe: implement get_direction()
0f3d1d7ab5d2 soc: fsl: qe: properly scan GPIO nodes at startup
90d953002cf0 powerpc/irq: Fix missing r2 clobber in PCREL inline assembly
5fa92c6466fa powerpc/smp: add NULL guard for cause_ipi in smp_muxed_ipi_message_pass
b59a47e20040 pinctrl: spacemit: validate pins in pinconf callbacks
41eba3b3ef86 pinctrl: eswin: Fix Handling of PIN_CONFIG_PERSIST_STATE
2d98a3b89394 firmware: coreboot: Validate table bounds
d0a19a59580a firmware: google: Add bounds checks in coreboot_table_populate()
7a22cbc6c6bd wifi: cfg80211: stop PMSR before P2P and NAN teardown
0a0c03e4b7c6 wifi: cfg80211: Add an API to configure local NAN schedule
84263694c8d1 wifi: nl80211: split out UHR operation information
e182bf30a38c wifi: nl80211: refactor nl80211_parse_chandef
6481459f78be wifi: cfg80211: add support to handle incumbent signal detected event from mac80211/driver
335c515932a5 wifi: cfg80211: add initial UHR support
be90aa8bf177 wifi: ieee80211: add some initial UHR definitions
66722acd740b wifi: nl80211: Add support for EPP peer indication
93b4c9130461 wifi: cfg80211: include S1G_NO_PRIMARY flag when sending channel
e7bc5ab93acd wifi: mac80211: disconnect on CSA to channel 0
7c3d762bc15c wifi: mac80211: skip unused probe response countdown offsets
979ad5269bdf wifi: zd1211rw: reject secondary interfaces to prevent conflicts
26e6123a93dc wifi: mac80211: send TWT teardown to peer after setup TX failure
97dd2f6560ce perf/cxlpmu: Fix 64-bit write to 32-bit HDM filter register
9ba040f4fec8 iommu/arm-smmu-v3: Convert to use atomic poll timeout
2a08fd5a082e kselftest/arm64: Don't write to P0 in irritator on SME only systems
ee46a1714d3a kselftest/arm64: fp-ptrace: Fix checks for inactive SVE and SSVE regsets
695e976e25a1 arm64/fpsimd: ptrace: Fix inactive SVE and SSVE regsets
a2ff70c44fe8 arm64: smp: Fix IPI teardown for GICv5 flow
80818e72aec4 wifi: mt76: mt7996: remove beacon_int_min_gcd from ADHOC interface combinations
7039825a7479 wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump
637bb99cc766 wifi: mt76: mt7996: fix out-of-bounds link array access in mt7996_tx()
13f6a9c78602 wifi: mt76: reject out-of-range link ids in mt76_vif_link()
81ccb9faf3c4 wifi: mt76: mt7925: Fix EHT Beamformee SS subfields to meet 802.11be minimum
0ead464cb43e wifi: mt76: mt7925: advertise EHT 320MHz capabilities for 6GHz band
c59c8b962c4d wifi: mt76: fix queue assignment for disassoc packets
292bc52d8420 wifi: mt76: mt7915: report RX chain signal for all RX paths
4dee6aca7929 wifi: mt76: mt7915: fix chainmask handling for non-dbdc phys on band 1
76144da3c618 wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed
d4326105ee28 wifi: mt76: mt7996: fix reg addr remap when addr is 0
ed5cc46a3c8f wifi: mt76: mt7915: release hif2 reference on probe IRQ failure
a7fd3bae8e11 wifi: mt76: mt7915: fix ext PHY use-after-free on register error path
249cbaa18735 wifi: mt76: mt7915: fix double hif2 init on the non-WED path
51c6d1f66540 wifi: mt76: mt7996: fix MIB TX aggregation counter registers for mt7990
2b10eb3636d0 wifi: mt76: mt7996: free vif links after clearing wcid entries on full reset
f3d8cf8c09e3 wifi: mt76: mt7996: wake MCU waiters before aborting scan in L1 SER
2cc7d32b42da wifi: mt76: mt7996: skip key upload when adding an offchannel link
6bce0f1280c9 wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement
40f3bfbbb222 bpf, x86: Fix trampoline stack size for 128-bit arguments
f6202ed97507 perf machine: Check snprintf truncation for guest kallsyms path
eaa350a2ec34 perf machine: Free scandir entries in guest kernel map creation
9054ad50ffe2 perf machine: Reset errno before strtol in guest kernel map creation
c0b06d47ac32 perf machine: Don't abort guest map creation on first inaccessible dir
b3b3175103ac perf machine: Check snprintf truncation in machines__findnew()
15159fc5441b perf machine: Guard against NULL strlist in machines__findnew()
e3a2ed4c0e8e perf machine: Fix NULL parent dereference in fork event processing
28bb9ea64c0c perf machine: Fix fd leak on bounds check in maps__set_modules_path_dir()
0b950aa7ec95 regulator: core: use system_freezable_wq for init complete work
2e2d63f68211 ASoC: tas2783-sdw: drop stale regcache on uninitialized re-attach
5589af278c50 ASoC: codecs: tas2783-sdw: Propagate regcache_sync() errors
551f3e27486b ASoC: tas2783: Use new SoundWire enumeration helper
0b5c09512f21 soundwire: Add a helper function to wait for device initialisation
f5bb3471c9f4 wifi: ath11k: fix leak in ath11k_service_ready_ext_event()
83bc4eab83ae drm/msm/dsi: Drop dev_pm_opp_set_rate(0)
e0d1d1253ea2 drm/msm/dp: Drop dev_pm_opp_set_rate(0)
be73b1984086 drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0)
81d21396fea2 perf: arm_spe: Make wakeup range check overflow safe
ad1d83816b84 drm/msm/dp: do not reject wide-bus modes while a YUV420 mode is active
6572b5a74ab1 drm/msm/dp: reject YUV420-only modes without VSC SDP support
08827aa40f0e drm/msm: don't tear down KMS twice when KMS init fails
64976f3b34b0 ACPI: processor: Unregister cpufreq notifier on init failure
6cffb59ee50e ACPI: processor: idle: Optimize ACPI idle driver registration
efc57983a1d4 wifi: mt76: only consume the WO drop bit on WED v2 devices
19f108fee147 wifi: mt76: mt7996: add missing rdd_idx check when enabling background radar
b93d0f07ed04 wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields
92dc45686b9f wifi: mt76: mt7996: don't leak MLD group index on remap alloc failure
45d8896e4cff wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV
906ad486ba5c wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER
507eddb8175a wifi: mt76: mt7915: unwind state on add_interface failure
d0bb2189ade6 wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config
1c7ad1236bc6 wifi: mt76: check txfree done event on the WED hw path
31faa92cd507 wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie
7ac05ed3a50e wifi: mt76: fix RXDMAD_C buffer recycling race
576683faa938 wifi: mt76: fix uninitialised RXDMAD_C descriptor info
423be355be5a wifi: mt76: fix stranded frames in mt76_txq_schedule_pending
471586e88861 wifi: mt76: mt7915: write RX header translation bit to the correct register
522101cbbb3b wifi: mt76: mt7996: don't report a zero TX bitrate
6ce78d04c7ea wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss
b4a41a47a67c wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear
bf59177bab17 wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset
0f53ece876e1 wifi: mt76: mt7996: validate RX band_idx before dereferencing phys[]
310edc8f3f56 wifi: mt76: assign link_id when sending probe request during scan
fc7fae55255c wifi: mt76: fix non-AQL packet accounting for MLO stations
5183b9f092fc wifi: mt76: mt7996: fix MLD ID in MAC TXD and HIF TXP
990ec9215ebe wifi: mt76: mt7996: fix out-of-bounds array access during hardware restart
25b765aa9a61 wifi: mt76: mt7996: set specific BSSINFO and STAREC commands after channel switch
5c350e3b6065 wifi: mt76: mt7996: support fixed rate for link station
62aea1d45b52 wifi: mt76: fix RX data queuing of RRO 3.0
97a77dc0abd9 wifi: mt76: mt7996: fix capability of EHT-MCS 15 in MRU
674e0ad0ae15 wifi: mt76: mt7996: fix EAPOL source BSS for non-MLD stations
ddf6a17d8e3d wifi: mt76: mt792x: Fix memory leak in SDIO TX path
52c7bcf06786 wifi: mt76: mt7925: fix msg len mismatch between driver and firmware
383bb0511dfe wifi: mt76: mt7925: update clc before setting sar power table
670b3dc4e371 wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash
0015b56dff60 wifi: mt76: always enable RRO queues for non-MT7992 chipset
6e9207ac476c wifi: mt76: Introduce the NPU generic layer
c0dbce50c896 wifi: mt76: Move Q_READ/Q_WRITE definitions in dma.h
50c896af50e0 wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986
17d6b89e09ea wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length
0340bd33b4e2 wifi: mt76: connac: add MT7991A (0x7991) to is_mt7996()
1991d605a45f fanotify: report full event length for FIONREAD
6248eb1833ff misc: sgi-gru: remove interrupt-context page-table walks
e6e4cbc9e8fd misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe()
2a1c16c4700c powerpc/crash: Fix possible memory leak in update_crash_elfcorehdr()
7969b571ae94 powerpc/44x: Set GPIO chip parent
687d42d9eea4 powerpc: implement get_direction() in cpm2
e7c69c6695d8 locking/lockdep: Fix NULL pointer dereference in __lock_set_class()
37f11973c3eb md/raid1: create serial pool adding rdev to array with serialize_policy=1
71da948d249a fs: annotate inode timestamp accessors
039e490e3ac4 i3c: master: adi: add OF module alias for autoloading
9eaac0cb4ca9 i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices
35e010317782 swiotlb: Preserve allocation virtual address for dynamic pools
fb0b39287ba8 iommu/dma: Check atomic pool allocation result directly
28fdea874f68 md: scope memalloc_noio to allocation critical sections
c510626bbacb md: skip redundant raid_disks update when value is unchanged
9f16747fc3b2 md: remove unused mddev argument from export_rdev
6763fb409a0b md/bitmap: resume array on backlog_store() error path
85ece0386c4f clk: qcom: Return expected ENOMEM error on dynamic allocation failure
64abdd696129 clk: qcom: gpucc-qcm2290: Park RCG's clk source at XO during disable
af7a6d6ec36a lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone
85cf991c881e bpf: Fix potential UAF when reading bpf link info
bda86e9f31b9 bpf: Fix potential UAF in bpf_netns_link_update_prog
d5266b4c5c77 power: supply: sc2731_charger: cancel work on remove
f312c5d17f2a power: supply: isp1704_charger: cancel work on remove
1a35eda51a50 arm64: dts: qcom: qcs6490-rb3gen2: Fix the PCIe iommu-map entries
e1c65abeb6aa arm64: dts: qcom: lemans: Fix the PCIe iommu-map entries
03a85ccf857a arm64: dts: qcom: lemans: Move PCIe devices into soc node
76e14b0e8656 arm64: dts: qcom: sa8775p: Add reg and clocks for QoS configuration
8d7411cc0bd9 arm64: dts: qcom: lemans: add QCrypto node
610d253bef45 arm64: dts: qcom: lemans: add refgen regulator and use it for DSI
ca29c5c0cc61 arm64: dts: qcom: lemans: move USB PHYs to a proper place
349752c7ab6b arm64: dts: qcom: talos: Fix the PCIe iommu-map entries
fc2980ea6920 arm64: dts: qcom: sm8750: Fix the PCIe iommu-map entries
f418e83ac1ab arm64: dts: qcom: sm8650: Fix the PCIe iommu-map entries
e8a7928da474 arm64: dts: qcom: sm8550: Fix the PCIe iommu-map entries
dbcbbb203373 arm64: dts: qcom: sm8450: Fix the PCIe iommu-map entries
793dbaa91c3b arm64: dts: qcom: sm8350: Fix the PCIe iommu-map entries
c8fd2cabd0b7 arm64: dts: qcom: sm8250: Fix the PCIe iommu-map entries
152e82a60d70 arm64: dts: qcom: sm8150: Fix the PCIe iommu-map entries
a98b8bb0ca25 arm64: dts: qcom: sdm845: Fix the PCIe iommu-map entries
8dfc4641001f arm64: dts: qcom: sc8180x: Fix the PCIe iommu-map entries
54176af35d98 arm64: dts: qcom: sar2130p: Fix the PCIe iommu-map entries
d2b404826bf9 arm64: dts: qcom: kodiak: Fix the PCIe iommu-map entries
f063039d2e43 arm64: dts: qcom: sm8250-xiaomi-elish: correct the board ID
d29c5a88d570 block: fix dio leak on metadata mapping error
642828f274eb block: add a bio_endio_status helper
8b1817b36ca5 block: don't set BIO_QUIET for BLK_STS_AGAIN
2b239a920a99 blk-crypto: use on-stack skcipher requests for fallback en/decryption
196a8f954ae6 blk-crypto: optimize bio splitting in blk_crypto_fallback_encrypt_bio
30439432f3f2 blk-crypto: submit the encrypted bio in blk_crypto_fallback_bio_prep
f57adb5beca6 firmware: qcom: scm: Fix tzmem state on probe retry
1da025b5ceb4 firmware: qcom: scm: Fix reserved memory cleanup on probe failure
1d753df5899e firmware: qcom: scm: Fix NULL dereference in IRQ handler before __scm is published
d72c76684a4a firmware: qcom: scm: instrument SMC call path with tracepoints
347efe779f55 firmware: qcom: scm: add trace events for the SMC call interface
889ca992d9c4 firmware: qcom_scm: Support multiple waitq contexts
3d028e241c2a firmware: qcom_scm: Add API to get waitqueue IRQ info
81af527ead79 arm64: dts: qcom: sc8280xp-crd: Fix the pin index for misc_3p3_reg_en
5793229726e2 clk: qcom: gcc-qcm2290: don't park QUP RCGs upon registration
939c917d037a arm64: dts: qcom: qcs404: Fix DTBS Check errors in usb controller nodes
4ea052255a4a arm64: dts: qcom: sdm632-motorola-ocean: Fix LED default trigger property
d098dd6ec09b arm64: dts: qcom: msm8976-longcheer-l9360: Fix accidental node override
9346a9233707 arm64: dts: qcom: msm8998: Don't pull-up I2C pins by default in sleep
179713adff1b rcu: Mark accesses to ->rcu_urgent_qs and ->rcu_need_heavy_qs
badab2078d45 md/raid10: consistently fail atomic writes that require splitting
75185e2b214e wifi: ath11k: fix stride mismatch in mac_phy_caps_parse()
b9a5d12cbdeb wifi: ath12k: fix stride mismatch in mac_phy_caps_parse()
ec6edba35aa7 Revert "serial: 8250: Clear CON_PRINTBUFFER on port re-registration"
d44a02724576 selftests/zram: fix kernel_gte() for POSIX sh
e5ac7ab78467 md: recheck spare changes before starting sync
47b61029f146 tools/nolibc/powerpc: mark ctr and xer as clobbered by system call
a2fbef8a6318 fanotify: stop permission watchdog when timeout is zero
9d65cb214253 md/raid5: protect lockless recovery_offset accesses during reshape
455b56209f96 md/raid5-ppl: fix use-after-free in ppl_do_flush()
dcd3d87cfc14 md/raid5: protect bitmap batch counters aka seq_flush/seq_write consistency
4fb17a7c437f bus: mhi: host: Fix controller cleanup on EDL sysfs failure
21ce330f921a bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET
a89818977338 wifi: rtlwifi: pci: fix error path in rtl_pci_probe()
e2cbe14361d7 platform/chrome: cros_ec_debugfs: Unregister panic notifier
b95664e3f82d platform/chrome: cros_ec_debugfs: Clean up console log on probe failure
e7768f3dae9f media: qcom: iris: handle runtime PM resume failure in core deinit
c1a48452cc16 media: qcom: iris: Fix bitmask test in iris_allow_cmd()
794f6d4c4dde drm/msm: remove objects from evit list after pinning them
b3624eecb65a PCI: starfive: Fix unchecked pm_runtime_get_sync() in probe
257a0a59598f PCI: starfive: Fix Runtime PM handling and teardown ordering
aa8226f873c9 wifi: ath12k: validate TLV length in process_tpc_stats()
0364926fb4bf wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event()
3b544072185c spi: davinci: switch to managed controller allocation
bd764baf82bb nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request
c345d9d0b3ee IB/isert: reject login PDUs declaring more data than was received
cf36fa5357a2 IB/isert: reject PDUs declaring more data than was received
429b75000c6a media: staging/ipu7: fix async notifier leak on init error
a2e37d1ab773 RDMA/cxgb4: free STAG index when TPT entry write fails
b1fe9a1bd001 RDMA/mlx5: Send cong param changes to the resolved port mdev
4599311e78e8 RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs
75424c5a6620 scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches.
3904fb0ee741 nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch
842397fdfd2e nilfs2: prevent out-of-bounds read in super root block parsing
1fc6df85b495 nilfs2: fix infinite loop in nilfs_clean_segments()
49a7d62d64f7 clk: rockchip: Fix the fractional part denominator on RK3588/RK3576 PLLs
666071b3128a clk: mediatek: mt8135: Fix inverted gate control for devapc_ck
1158a9adc7dc clk/x86: pmc_atom: add kasprintf return value check
b8b81c6c89f0 clk: palmas: Manage external-control prepare with devm
d35e45e5bad4 clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path
ac6f7740655d clk: mediatek: Refactor pllfh registration to pass device
c945468a6df7 clk: mediatek: Pass device to clk_hw_register for PLLs
b7cd043b8412 clk: mediatek: Refactor pll registration to pass device
03e070e51720 clk: tegra: tegra124-emc: put EMC node on register failure
75653b0408d5 arm64: dts: allwinner: sun50i-a64-pinephone: Fix mpu6050 mount matrix
730e71d74705 wifi: mac80211: fix per-STA profile length in cross-link CSA parsing
da7805f0211a RDMA/efa: Fix PBL chunk length computation
5f1933163327 RDMA/rxe: Fix UAF in ODP init error-handling path
1d2271d7df52 iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path
9b37afb2d34d iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID
735698e81f79 iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs
2f627118b668 iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs
bcb82407633c iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF (de)init
792f720fc23f iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized
aad605a45061 fs/ntfs3: reject restart table growth beyond U16_MAX entries
7a7d30b1cb89 staging: rtl8723bs: use kfree_sensitive() for key material
6b2e70e9d52c firmware: qcom_scm: Introduce PAS context allocator helper function
f15cde112984 remoteproc: Prevent crash handling to race with rproc_del()
df92f0e142ed remoteproc: core: Attach rproc asynchronously in rproc_add() path via schedule_work()
d6bf603246c9 remoteproc: Allow shutdown of crashed processors
a098f5894fcb remoteproc: core: Drop redundant initialization of 'ret' in rproc_shutdown()
8b93b783db32 cpufreq/amd-pstate: Set min_limit_freq based on bios_min_perf
9b95f10e1688 cpufreq/amd-pstate: Add comment explaining nominal_perf usage for performance policy
172f24df0dab w1: ds2482: Fix signedness bug in ds2482_w1_triplet()
ef5cc4a8c088 spi: oc-tiny: switch to managed controller allocation
67e2ffe98d71 clk: mediatek: mt6735: Unregister PLLs on probe failure
106e1a3b2b34 isofs: release zisofs block pointer buffer head
c39eb307b497 powercap: intel_rapl_tpmi: Handle PMU registration failure during probe
bf32f103a325 thermal/drivers/qcom-spmi-adc-tm5: Drop IIO_VAL_INT check in adc_tm5_get_temp
686a92cc9f19 thermal/drivers/airoha: Fix copy paste error for sen internal
a06b2e6b8f50 thermal/drivers/airoha: Fix copy paste error on clamp_t low temp
5b6cfc6d7ff0 RDMA/mlx5: Fix integer overflow of user QP buffer size
9c9c64abed53 crypto: keembay - publish OF module alias for OCS AES/SM4
7efb51a5893b crypto: keembay - Initialize completion before requesting IRQ
cc92af8cc0e4 scsi: ufs: debugfs: Reserve space for a string terminator
15d4fc8f5f10 power: supply: sbs-battery: Use a per-device serial number buffer
e505092cb200 arm64: RSI: fix field-spanning write warning in attestation token init
386600507b23 tools/build: Allow versioning of all LLVM tools defined in Makefile.include
7f6d898179ca pinctrl: mediatek: free EINT resources on unbind
f54b96e8aadb cxl/region: Fix use-after-free in find_pos_and_ways() error path
b804df9aa294 selftests/bpf: Fix memory leak on subtest_states reallocation
b7983cd5ba2c selftests/bpf: Fix incorrect error checking for pthread_create
c78a9289084a ARM: lpc32xx: only run SoC init on LPC32xx hardware
85a33c910edc bpf: Fix CFI mismatch in task work callback
4f7e0be664af arm64: dts: rockchip: Fix rk3566-bigtreetech-cb2 touchscreen property
9ca64fd7a2fd arm64: dts: rockchip: Fix Gru WLAN sideband interrupt
053220e061c7 arm64: dts: rockchip: Add missing hclk for RK3588 eDP1
f5b4bc09c42f arm64: dts: rockchip: Add missing hclk for RK3588 eDP0
d65261e0902b drm/panthor: return PTR_ERR() from devm_drm_dev_alloc()
64bb6000bfbd fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init
e70d48fcf838 netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet
2e199e3ede9c drm/tve200: add OF module alias for autoloading
d9e01c333ceb perf cap: Remove used_root parameter and simplify capability checks
a73a88bc4f45 leds: pca9532: Fix phantom device registration on missing hardware
f1e8c4d48583 PM: hibernate: Fix memory leak in snapshot_write_next() error path
ce7d205c2646 RDMA/erdma: complete object teardown when the destroy command fails
02deb637e965 xfrm: Fix skb double-free in xfrm_dev_direct_output()
78da16d23496 perf cs-etm: Avoid truncating AUX buffer sizes to int
f78fba854920 perf cs-etm: Flush thread stacks after decoder reset
25be36738f5f riscv: dts: spacemit: k1: Split gmac_clk_ref into independent pinctrl groups
fe9d15fb66d5 riscv: dts: spacemit: Add OrangePi R2S board device tree
9933e5f1f61e riscv: dts: spacemit: add MusePi Pro board device tree
a76b20b1f030 firmware: arm_scmi: Unrequest devices if driver registration fails
456856a34906 firmware: arm_scmi: Roll back partial protocol table registration
406d5ead1bcb cpufreq/amd-pstate: Toggle auto_sel in active mode on shared memory systems
821b41f6e3e4 cpufreq/amd-pstate: Fix EPP return type and handle errors during initialization
95ad5fd298bc cpufreq/amd-pstate: Add support for platform profile class
471d6659925a cpufreq/amd-pstate: Add dynamic energy performance preference
0b99dd4201c2 amd-pstate: Make certain freq_attrs conditionally visible
ea4994483614 cpufreq/amd-pstate: Use sysfs_match_string() for epp
baf5a7fd3f3e cpufreq: amd-pstate-ut: Skip tests when amd-pstate driver is not active
937f09ce104c ARM: dts: allwinner: a10: Fix PMU interrupt
3933884bc310 ext4: check dir entry fits before reading the hash trailer in ext4_search_dir()
1399f102d8a1 ext4: fix buffer_head leak in ext4_init_orphan_info
0afbfe019c88 RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap
72a5e45f606e wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx()
95d1bd1db9e9 wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx()
ccca0f7d9e90 wifi: ath11k: Correctly copy the hint BSSID in WMI scan request
8f86a58ab941 wifi: ath12k: Correctly copy the hint BSSID in WMI scan request
0c9eac0d1fb4 wifi: ath12k: allocate HOST_DDR and BDF regions after Q6 RO region
e69fd62e8117 wifi: ath12k: refactor QMI memory assignment
42bc932e0509 wifi: ath12k: switch to name-based reserved memory lookup
abda58f4529d wifi: ath6kl: avoid buffer overreads in WMI event handlers
64d445d40e5e ext4: validate readdir offset before accessing dirent
bd8d74bd46d0 ext4: use fsdata to track inline data write state and fix race
4e4e3eec5062 ext4: drain in-flight DIO before buffered write fallback
aa0042630b1f ext4: clear stale xarray tags on folios skipped during writeback
d7b025d3fdf3 thermal: intel: int3400: clean up ODVP on probe failures
466358635a2e iommu/arm-smmu-v3: Declare eats_s1chk and eats_trans as host-endian u64
267fb3771ddf iommu/qcom: Fix inverted fault report check in qcom_iommu_fault()
0812b282703a iommu/qcom: Remove sysfs device on probe failure path
8aabe0fba014 iommu/amd: Fix undefined behavior in devid_write debugfs function
c3d4ef1c0ca6 firmware: arm_scmi: Fix requested device removal race
66d65f36d397 RDMA/core: Fix potential use after free in ib_dealloc_pd_user()
8b22722f45a2 RDMA/core: Fix potential use after free in uverbs_free_dmah()
9abea3794253 RDMA/core: Fix potential use after free in ib_free_cq()
8c013e3a8d82 RDMA/core: Fix potential use after free in counter_release()
bedd7dee7258 RDMA/core: Fix potential use after free in ib_destroy_srq_user()
197c262dbf94 RDMA/core: Fix potential use after free in ib_destroy_cq_user()
038cf231b709 RDMA/core: Fix use after free in ib_query_qp()
c538cd121be7 RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations
a07cba1296aa RDMA/nldev: Fix locking when accessing mr->pd
b7091e0e2eba RDMA/restrack: Fix typos in the comments
4aaa2ab816c7 RDMA/mana_ib: drain QP references after partial table insertion
a60c36d8d17f RDMA/erdma: Fix CEQ tasklet use-after-free on removal
53446b921cdd PCI: j721e: Fix incorrect max_lanes for J7200
8c24bda66dd1 RDMA/srpt: Pass the mapped task attribute to target_init_cmd()
e42cede6f901 bpf: Mark bpf_refcount field as unique
28d5f20ed022 bpf: Preserve unique-field state across nested structs
dfdce1f20a7e bpf: Fix offset warn check for bpf_res_spin_lock
2d2616b4f372 virt: arm-cca-guest: use migrate_disable() for attestation token requests
662f242863fd ACPI: battery: Adjust charging status validation check
26d9496c8265 bpf, riscv: Fix extable handling for arena load_acquire
34b1bb33a025 riscv, bpf: Fix kernel stack corruption in tailcall with CFI
5cadc66b534f riscv, bpf: Fix memory leak in bpf_jit_free
e991c317d4a0 libbpf: Search /lib64 and /lib in resolve_full_path()
1534c4bff3aa bpf: Zero queue and stack outputs on lock failure
5af710a4f3e3 platform/x86: acer-wmi: reject missing gaming WMI results
7ace189b9ea7 ext4: skip extra isize expansion during mount to prevent deadlock
6702c7da86d8 ext4: fix out-of-bounds read in ext4_read_inline_dir()
e4223231b686 ext4: fix circular lock dependency in ext4_ext_migrate
3eee4c21931d ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root
4d8ecaa332c1 ACPI: processor: validate MADT IOAPIC entry bounds
87735eb21d7e ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer
0bfa897e3e1a RDMA/nldev: validate dynamic counter attribute length
6eb1f1414bf7 irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc()
93290f29be8f selftests/bpf: Silence array bounds warning in global_map_resize
03cf3a1d950f selftests/bpf: Check malloc result with ASSERT_NEQ in test_sha256
86ce84cf93d2 x86/bugs: Don't use cpu-type matching in cpu_vuln_blacklist
1654875005c7 arm64: dts: imx8-ss-audio: Fix LPCG clock indices for ASRC0
18b1deba7154 kcsan: avoid unintended access checking in NMIs
af073bd24518 RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters
13cb7160e5b7 RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[]
3416db552eb3 RDMA/hfi1: Propagate sdma_txinit_ahg() errors
e166856d4ef2 arm64: dts: amlogic: meson-axg-s400: enable mipi_pcie_analog_dphy for PCIe
0da7e87b3044 arm64: dts: amlogic: meson-axg: Add missing nand_rb0 pin to nand_all_pins
624ddc40f218 phy: starfive: Fix runtime PM cleanup in JH7110 DPHY RX probe
41cacaa222b0 phy: starfive: Fix runtime PM cleanup in JH7110 DPHY TX probe
8fec16898f18 ASoC: meson: Keep link pointers valid on realloc failure
20b92646ee03 dmaengine: dw-edma: Clear stale requests on termination
fe0ffa0190e8 dmaengine: dw-edma: Serialize channel state checks
0c3294066c36 dmaengine: dw-edma: Serialize abort state updates
be87d86537de dmaengine: dw-edma: Terminate all descriptors without callbacks
a968dffa5ab3 bpf: Reject arena frees below the arena base
122ad34f7258 drm/msm/a6xx: Fix RBBM_CLOCK_CNTL3_TP0 value in a730_hwcg
333246218efd driver core: soc: Unregister bus on early device registration failure
df5466412b36 software node: Fix software_node_get_reference_args() with index -1
13a234359ca8 perf ui hists: Fix uninitialized stack memory free on pstack allocation failure
398aca2f9012 mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition()
5c349c533e72 mtd: mtdswap: Avoid freeing registered blktrans device twice
b63058bd5e1b mtd: intel-dg: Fix runtime PM error path in probe
31f3f496da28 mtd: intel-dg: wake card on operations
533d0c5feef8 vfio/pci: clear vdev->msi_perm after freeing it on init failure
21d576fc7e29 char: xilinx_hwicap: unregister class on init errors
1a3258e105f7 ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove
29df4ee11433 ppdev: prevent overflow when setting port timeout
e4a7ace58941 cacheinfo: don't propagate DT/ACPI error when arch supplies info (arm64)
98bb638f583d misc: lan966x_pci: depopulate children on populate failure
c7ff7a70f405 misc: ad525x_dpot: use driver core groups for sysfs files
c8b85cad0fa4 misc: rtsx: add missing write register handling
a45d6dd3c11e misc: bcm-vk: Use acquire/release for msgq_inited
5310334762c3 speakup: keyhelp: guard letter_offsets possible out-of-range indexing
8688fe2941d5 accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status()
16695e9059d8 uio: Fix stale info pointer in failed registration path
1e805a7f4fe0 gpib: Move stuck SRQ update under lock
6c9f6a3b9fdd staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths
28ebc34373f0 staging: rtl8723bs: remove multiple blank lines in core/
368f19a5ed15 staging: rtl8723bs: replace rtw_zmalloc() with kzalloc()
aa89cd88ae03 staging: rtl8723bs: expand multiple assignment into separate statements
87ccaea18569 staging: rtl8723bs: fix operator and type cast spacing
d8664fa56c46 staging: rtl8723bs: use standard offsetof in cfg80211 operations
11b3765fcb71 staging: rtl8723bs: Fix operator spacing in rtw_security.c
8da8fd3df9fc UDF symlink pathComponent header OOB read
f42e35e9a7e6 tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64
2ed25c9d4400 usb: gadget: f_uac1_legacy: remove broken string configfs attributes
772f29206544 ACPI: processor: idle: Expand _LPI package sanity checks
19ae79f185bc crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping
d43e1bbfd434 drm/msm: Only fini scheduler after successful init
6c472fde2c80 drm/msm: Fix task_struct reference leak in recover_worker
133c9aa5b896 drm/msm/a6xx: Fix A621 GPUCC register list for state capture
15d9b29c7da1 drm/msm/a6xx: Rebase GMU register offsets
8bc35465c51b drm/msm/a6xx: Fix A663 GPUCC register list for state capture
e36284257eec drm/msm: Recover HW before retire hung submit
8298883bb3ed drm/msm/a6xx: Fix stale rpmh votes after suspend
9ad7a6ccc7b8 gpu: host1x: Avoid stack over-read in debug output helpers
9211efca5c65 gpu: host1x: Fix offset calculation in trace_write_gather
6b7d5abf3e37 wifi: iwlwifi: mei: pass correct argument to function
f26f72c24488 wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments
242125bbf19a wifi: iwlwifi: mei: check SAP message length before reading it
c9d8641aea01 wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser
8d8a526f3ec6 wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs
f20b182ff2d4 spi: geni-qcom: Fix sticky ret causing wrong return value on invalid proto
badb810da2b0 soc: renesas: r8a78000: Drop duplicate "default ARCH_RENESAS"
d9f25cc138c7 clk: qcom: gcc-glymur: Enable runtime PM
563a1fcf551c perf jevents: Add more components to the metric sorting order
0b5f752d635c arm64: dts: qcom: sm8250: correct frequencies in the Iris OPP table
c795f18678de arm64: dts: qcom: sm8250: sort out Iris power domains
4e59a0b78e04 arm64: qcom: ipq5018: Add GEPHY RX and TX clocks
c9fed0c7056c arm64: dts: qcom: ipq5018: Correct CMN PLL reference clock rate
5d0fc8094678 arm64: dts: qcom: sc8280xp-x13s: Fix the drive-strength of mclk pin
188344787dac arm64: dts: qcom: msm8996-xiaomi-gemini: Fix up ti,drv2604 enable GPIO
591b6fac9df3 x86/mm/pat: Take cpa_lock around large-page collapse
57c567e0e8aa drm/bridge: tc358767: clamp the reported AUX read size to the request
b6b68da41b27 perf: evsel: Fix error handling in tp_format lookup
4bc18263ef7a remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdev
b44f085fb484 cpufreq: schedutil: Fix self-contradictory comment in sugov_iowait_apply()
c23a708a71af cpufreq: intel_pstate: Fix setting minimum P-state at init time
ce51fcf0d238 drm/amd/display: Remove unused-but-set variable hubp from
8ee385305e89 drm/amd/display: Fix DM I2C teardown race
5323ed5a7bb2 media: ipu6: Do not free aux device pdata after init
2c29cd408ef8 media: bcm2835-unicam: Fix asc leaked in error/remove path
96baeead354a media: i2c: rdacm21: Fix missing media_entity_cleanup()
9acc996cb2e8 irqchip/renesas-irqc: Fix generic interrupt chip leak on remove
f6f6bdf1708a PCI: xgene: Drop unnecessary OF node reference
9c001b7dd4d6 cpufreq: spear: Fix an IS_ERR() vs NULL bug in spear1340_set_cpu_rate()
6a37acecc7c2 dax: read holder_ops once in dax_holder_notify_failure()
91be086330c3 libnvdimm/labels: Bound the on-media label size before the shift
25b472c15636 tools/sched_ext: scx_qmap: Fix stale API name in comment
85e5eeb651a1 regulator: adp5055: Fix error code in adp5055_of_parse_cb()
b8abbd5c2928 cxl/features: Clamp Get Feature output size to the remaining buffer
1281dc84c815 cxl/features: Reject Set Features output buffer smaller than the header
3f02031a0a53 cxl/features: Reject Get Feature count larger than the output buffer
c656427440ea firmware: arm_scmi: Fix transport device teardown lookup
3b0b02134ab9 firmware: arm_scmi: Unwind P2A receiver mailbox setup failure
717b8e972a66 firmware: arm_scmi: Unwind TX receiver mailbox setup failure
a54dc23e8bd2 firmware: arm_scmi: Drop handle on protocol bind failures
8197bc6acc51 firmware: arm_scmi: Protect device request lookup with RCU
71c1f8ced3cc firmware: arm_scmi: Use channel ID for transport teardown
e66756313d1b firmware: arm_scmi: Reject out of range DT protocol IDs
54e5a4f7d83d firmware: arm_scmi: Avoid IDR updates while cleaning channels
d7c60c0fe2bd firmware: arm_scmi: Free transport channel on IDR failure
d33b2b68bce6 firmware: arm_scmi: Clean up channels on setup failure
2aac23bc0a79 firmware: arm_scmi: Quiesce notifications before teardown
f5e528f63142 firmware: arm_scmi: Unregister device notifier before IDR teardown
1bea027f7ef6 firmware: arm_scmi: Publish channel state before callbacks
b967c097d1b6 x86/entry/fred: Encode frame pointer on entry
2bb2a778a487 wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate
e31985c67ba0 hfsplus: validate thread record before delete key rebuild
5b894d01117b cxl/port: Restart port enumeration when a sibling adds the dport first
7a14b995931f cxl/pci: Honor -EPROBE_DEFER from component register setup
6ad491cef1a8 cxl/mbox: Break poison list loop on an empty payload
485bf4409049 cxl/memdev: Fix firmware upload exact-fit handling
a97eef0d6e2f iommufd: Simplify iommufd_device_remove_vdev()
ecad679e2b92 rpmsg: glink: fix deadlock in endpoint destroy during driver detach
dd2b56f44be4 rpmsg: glink: remove duplicate code for rpmsg device remove
c7f41c7f7d68 perf record: Fix multiple PERF_RECORD_COMPRESSED2 records per push
f476567a3a96 perf record: Return the written size from process_comp_header()
8b771b43710f perf zstd: Fix compression error path in zstd_compress_stream_to_records()
ae69f936e8ff fs/resctrl: Prevent use-after-free in rdtgroup_kn_put()
65e55f34fb2d media: v4l2-async: Unregister sub-device if asc_list is empty
f0b084c99960 iommufd/selftest: Avoid selftest dirty bitmap size wrap
cd616aa0449a isofs: fix out-of-bounds page array access on empty zisofs block
81ff877e458e ASoC: apple: mca: increase SERDES reset delay
1b769e5d5c33 RDMA/hfi1: Initialize debugfs after probe completes
a913960dd85d RDMA/hfi1: Stop flushing the global IB workqueue
e32f985ea38a RDMA/hfi1: Create workqueues before device initialization
460aaad5044d RDMA/hfi1: Remove redundant PCI device ID validation
149a14ec7088 RDMA/hfi1: Free RX data on late probe failure
fd4d3ad5f244 RDMA/hfi1: Preserve unit 0 on allocation failure
186df50ce26f misc: rtsx_usb: avoid USB I/O in runtime autosuspend
1c1c2df09daa pmdomain: bcm: bcm2835: handle genpd provider registration errors
36cbb7249819 ALSA: hpi: Check transport errors during HPI6000 adapter initialization
0f679e0523dd xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full
b0f7343a002f crash_dump: release keyring reference at the correct time
c115b908e350 hwrng: ks-sa - Fix runtime PM cleanup on registration failure
4a52a2fb96d1 crypto: ccp - Fix memory leak in SEV INIT_EX path
634e56b4f991 Revert "drm/msm: dsi: fix PLL init in bonded mode"
287f458ca225 drm/msm/dp: add missing drm_edid_connector_update() before add_modes on cached EDID
399713f1f0ea RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state
8dc5ffcb8efc RDMA/ipoib: Drain RCU callbacks during module teardown
7babc25d8dd5 RDMA/mlx5: Drain RCU callbacks during module teardown
9d998297fdaf RDMA/core: Wait for RCU callbacks before unloading ib_core
0e5c6bf4a04c iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE
dbe8894db922 wifi: rtw89: 8852a: fix RSSI report when average beacon RSSI is not ready
6e4b73b6b743 wifi: rtw89: phy: support per PHY RX statistics
0bae3ec6a16a wifi: rtw89: mlo: rearrange MLSR link decision flow
e0abd0b1e2f5 wifi: rtw89: debug: add parser to diagnose along DIAG_MAC fw element
84cb2ae9c012 wifi: rtw89: fw: parse firmware element of DIAG_MAC
f345b7d23c6f wifi: rtw89: pci: add to read PCI configuration space from common code
0cfc9348a045 bpf: Require a BPF cpumask for bpf_cpumask_populate()
abe7ac019ad9 tools/sched_ext: Strip compatibility macros for cgroup and dispatch APIs
9257ece49ae7 clk: qcom: camcc-sc8280xp: unregister CAMCC_GDSC_CLK
086ac3881a8c bus: qcom-ebi2: use managed resources for clocks and children
03991f9a561c soc: qcom: rpmh-rsc: manage PM notifiers with devres
dae798b95038 perf metricgroup: Fix metric expression copy leaks
846ce4d3fda9 drm/panel: samsung-s6d16d0: Power off on prepare failure
39b000d393de usb: typec: ucsi: gaokun: unwind notifier on UCSI register failure
7f2d926a464b usb: ucsi: huawei_gaokun: support mode switching
6b0d4519bcf0 usb: renesas_usbhs: Fix power-off ordering on unbind
f0cfba808e63 usb: mtu3: allow system suspend during active gadget connection
7fea5a310e3b platform/surface: acpi-notify: Check ACPI companion before use
71ba8b6e28f7 platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL
7e795801295c usb: fix UAF when probe runs concurrent to dyn ID removal
ff6e88e29965 usb: gadget: aspeed_udc: check endpoint DMA allocation
aed958c4f784 usb: ljca: bound bank_num in ljca_enumerate_gpio()
afbf39c0f229 usb: gadget: configfs: fix out-of-bounds read of qw_sign
5fd8baacc7dc usb: gadget: f_fs: Fix fence cleanup in ffs_dmabuf_transfer() error paths
c02d030747c4 serial: qcom-geni: do not advance stale DMA completions
783961be18f5 serial: ma35d1: Fix OF node reference leaks in console init
4e2a43382252 serial: 8250: Clear CON_PRINTBUFFER on port re-registration
45c64f2c09b2 serial: 8250: Add support for console flow control
71d8fcbb767b serial: 8250: Set cons_flow on port registration
7416aefeeb82 serial: Replace driver usage of UPF_CONS_FLOW
b897b1f791f3 serial: core: Add dedicated uart_port field for console flow
ed07324ed487 spi: qcom-geni: Fix missing error check on pm_runtime_get_sync()
4c59f0e5ee0d perf capstone: Fix kernel map reference count leak
45181de1077c selftests/sched_ext: Fix bpf_link leak on early return in prog_run
892bb4715265 hwspinlock: propagate errno when registering single lock
7420aac8b1f7 remoteproc: qcom_q6v5_adsp: Fix reference leak for device node
9a85e2d35e54 platform/x86: lg-laptop: Fix LED resource handling
c5c3e0036a7a platform/x86: lg-laptop: Convert ACPI driver to a platform one
f7f83b082673 platform/x86: lg-laptop: Drop debug-only ACPI notify handler
6ff6af62f042 platform/x86: dell-wmi-base: Fix resource leak on module load failure
9f860050c3d1 platform/x86: dell-privacy: Fix race condition
c9729ced165d ACPI: RISC-V: Fix riscv_acpi_add_prt_dep() loop handling
4cdcf4e19ed3 ACPI: RISC-V: Check acpi_get_handle() status in riscv_acpi_add_prt_dep()
7857f19b5219 ACPI: RISC-V: Fix riscv_acpi_irq_get_dep() loop termination
fbf9bb81b215 printk: Fix possible console use-after-free
b84065e9a830 printk: Introduce console_flush_one_record
d095438ac332 leds: st1202: Validate LED reg property against channel count
4efb94335d70 leds: st1202: Disable channel when brightness is set to zero
9666b92fe238 leds: st1202: Fix brightness having no effect while pattern mode is active
2176b43f70da leds: st1202: Set all pattern PWM slots to full after clearing pattern
48a05db61102 leds: st1202: Fix spurious pattern sequence start in setup
45dee22d52fd leds: st1202: Fix pattern duration prescaler and pattern_clear skip marker
b8136daec630 leds: st1202: Stop pattern sequence before reprogramming
e774c612b7f8 leds: pca9532: Fix inverted GPIO output polarity
fb43400a3a0f iommu/amd: Fix false positive in SB IOAPIC IVRS validation
21750cb34ca8 iommu/amd: Add support for Hygon family 18h model 4h IOAPIC
1fe565370650 iommu/amd: Prevent SB IOAPIC from overriding IVRS validation errors
3df590e85e1a iommu/msm: Return -ENOMEM on memory allocation failure in probe
9fb04596eb95 bpf: Fix security_bpf_map_create error handling
e7eda48c3467 iommu/mediatek-v1: Fix off-by-one in MT2701_LARB_NR_MAX
5587e7871ce9 bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation
86d54cf069fc bpf: Fix use-after-free on mm_struct in bpf_find_vma()
ca71ee2f6c28 efi: fix stale reference to efi_recover_from_page_fault()
2892f3f44bf8 bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux
78cae066f029 perf dso: Fix kallsyms DSO detection with fallback logic
e69d90bfae1a perf vendor events amd: Reintroduce deprecated Zen 5 core events
71e3023c5ddd bpftool: Check EVP_Digest when computing excl_prog_hash
11afe1912140 udf: Mark LVID buffer as uptodate before marking it dirty
6648c4709183 usb: gadget: r8a66597: avoid double free of ep0_req in probe error path
1f44d001620f usb: typec: ucsi: unregister debugfs entries on teardown
35bf61798e7d thermal/drivers/rcar: Fix error checking in probe()
593fda71983b staging: media: ipu7: fix pm_runtime refcount leak in ipu7_resume()
fb9fab1a4d63 staging: media: ipu7: fix pm_runtime refcount leak in ipu7_init_fw_code_region_by_sys()
947056a91d23 perf data convert json: Fix trace_seq memory leak in process_sample_event()
4b759af64a21 clk: qcom: gcc-qcs8300: Use retention for USB power domains
a2e4ebada684 clk: qcom: gcc-qcs8300: Use retention for PCIe power domains
448f948c9767 arm64: dts: qcom: sc8180x-lenovo-flex-5g: Describe the display power net
3a624b08d773 arm64: dts: qcom: sc8180x-lenovo-flex-5g: Rename regulator nodes
25026bef5183 arm64: dts: qcom: sc8180x-primus: Describe the display power net
76208cf896aa arm64: dts: qcom: sc8180x-primus: Rename regulator nodes
badb18b11215 arm64: dts: qcom: sc8280xp-arcata: Fix top USB-C DP alt mode
f60f49585837 clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister()
f8fe8cb89d3a clk: qcom: gdsc: propagate gdsc_enable() failure for ALWAYS_ON domains
e97f24ad63b8 clk: qcom: gdsc: propagate gdsc_check_status() errors from gdsc_poll_status
27b68ba9af9d arm64: dts: qcom: Add #{address,size}-cells to Chromium-based /firmware
05a95478f960 timekeeping: Account for monotonicity adjustment in ntp_error
0fcf7857ae11 y2038: uapi: Use 64-bit __kernel_old_timespec::tv_nsec on x32
db667d2970c7 time/namespace: Validate nanosecond field in proc_timens_set_offset()
ecd622375e6d timens: Simplify some calls to put_time_ns()
453812e92c76 timens: Add a __free() wrapper for put_time_ns()
b19176ff94a0 vdso/timens: Move functions to new file
6e4b52055383 x86/tsx: Make tsx_ctrl_state static
e165c0165392 timers/migration: Fix memory leak in tmigr_setup_groups() error path
ed7472619e61 timekeeping: Unwind aux clock sysfs children on failure
4222494df71b clocksource: Unregister subsystem on device registration failure
f84b1c25712a selftests: timers: leap-a-day: Fix -w option and update usage comment
d76656e42146 irqchip/gic-v3-its: Fix its node leak in gic_acpi_parse_madt_its()
68de28e0a098 irqchip/gic-v3-its: Fix memleak in its_probe_one()
8da5dc215ebc selftests/lsm: Fix memory leak in attr_lsm_count
4d6923a9912d selftests/bpf: Fix memory leak in msg_alloc_iov
58dc854c302a selftests/bpf: Fix memory leak in msg_alloc_iov error path
3201c4e88284 ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer()
737c928ff509 staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()
89f9f433271f staging: octeon: add missing napi_disable in cvm_oct_rx_shutdown
ab63b49bad0d staging: octeon: replace pr_warn with dev_warn in fill and rx paths
b62bc652590f staging: octeon: ethernet-mem: replace pr_warn with dev_warn in free functions
269d16a78a5b staging: octeon: fix free_irq dev_id mismatch in cvm_oct_rx_shutdown
2c0c9956596e staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown
bcd95498f0cf staging: fbtft: Use sysfs_emit_at() to print to sysfs file
c9191f2e2f35 greybus: audio: bound the topology section sizes against the fetched size
c45831163718 staging: sm750fb: Add missing Kconfig dependency
af65ceb43797 staging: sm750fb: gate dualview dataflow using g_dualview
311a2e65e42a staging: greybus: audio: correct sscanf() return value check
e7fccad2c8e6 wifi: mac80211_hwsim: avoid NULL skb in stop queue drain
2496d9829ab5 bus: qcom-ebi2: Fix clock leak on probe failure
e6edd7339153 bus: qcom-ebi2: Simplify with scoped for each OF child loop
3cf9e40432c5 clk: qcom: gcc-glymur: Move EVA clocks to critical clock list
7be3c0bae7c5 arm64: dts: qcom: hamoa: Fix clocks for HSPHYs
62b399c4e985 arm64: dts: qcom: sm7225-fairphone-fp4: Fix address in fb node name
a81fad1ff104 arm64: dts: qcom: sc8280xp-blackrock: switch to uefi rtc offset
e5965ae3f7c9 cgroup/cpuset: Make nr_deadline_tasks an atomic_t
3a1b23f9ede9 PM: sleep: Fix off-by-one in wakelocks number limit check
0f297bc93bbf bus: ti-sysc: Fix /chosen node reference leak
ca795fc1d8a1 nvmet-rdma: fix response resource leak on queue teardown
0fed8c64266c nvmet-rdma: factor out response resource cleanup
e5a79244a3c5 nvme-apple: Use acquire/release for queue enabled state
7117f27eb3bf arm64: dts: qcom: sm8750: wire UFS to ice instance
07974c267f60 RDMA/irdma: Add refcounting to user ring MRs
2ed1164153e9 RDMA/irdma: Add irdma_cq fields to track pbl allocations
e11379ca6e90 RDMA/irdma: Add a refcount to track user ring MR associations
8fb2c3106a91 RDMA/irdma: Deduplicate the irdma_del_memlist logic
5bbb726d27ff crypto: keembay - Fix AEAD unregister count in error path
e7d8ddd471d2 crypto: rk3288 - fail ahash requests on HASH idle timeout
62219775a07c hwrng: xilinx-trng - propagate timeout before any data is read
91ded4742fcd crypto: sa2ul - stop probe if context pool creation fails
f4d347fb1309 crypto: atmel-sha204a - fix heap info leak on I2C transfer failure
e64d6f1aae8c crypto: atmel-ecc - reject hardware ECDH without a public key
9af019e213ad crypto: qat - clear AES key schedule from stack
6b19f343ae8a crypto: qat - cancel work on re-enable SR-IOV timeout
cf293c9c7424 hwrng: core - fix rng list on registration error
48b8b438d234 perf vendor events amd: Update Zen 5 core events
0f456e4eca61 perf/x86/amd/uncore: Add group validation
c6466466185c perf cs-etm: Fix thread leaks on trace queue init failure
47b3686dd841 tools/nolibc: mark arg1 operand in __nolibc_syscall0() as write-only
e3aa0446e37d fanotify: initialize permission event watchdog state
f2a01deff7d0 wifi: rtw89: fix HE extended capability length check
8f68dd7e4b2f wifi: rtw89: check return values in rtw89_ops_start_ap()
74f26d1fa61b wifi: rtw89: update format of addr cam H2C command
19052c700bff wifi: rtw89: fill addr cam H2C command by struct
847a5ba0ac75 platform/chrome: sensorhub: Fix memory overread in ring handler
e4e2d06623d3 selftests/rseq: Replace glibc-specific __GNUC_PREREQ with portable check
a776afa89424 csky: Fix a4/a5 restoration in syscall trace path
5ac21c880dcd iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure
69f73ad463b2 soundwire: qcom: Fix port exhaustion check in stream_alloc_ports
a13974410cee dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe
32f69e6c95b5 dmaengine: zynqmp_dma: fix race between runtime PM and device removal
ec927657524b dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers
e429184ed58d dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure
bc3b5e6519b8 mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug
d3498c7b587b mm: name the anonymous MMOP enum as enum mmop
420d65038c34 mm: change type of state in struct memory_block
fff12ff7b3c4 mm: convert memory block states (MEM_*) macros to enum
d5f2f741a900 bpf,lsm: Drop bpf_prog_free from sleepable_lsm_hooks
01c5ad41cf4d selftests/bpf: Mask socket type flags in mptcpify prog
d51a838da7a7 selftests/bpf: Systematically add SO_REUSEADDR in start_server_addr
5e9f69829835 bpf: Copy per-CPU map value padding in copy_map_value_long()
e5f6d43168b2 tools/bpf/bpftool: Reset vmlinux BTF after struct_ops commands
82a43463ab09 tools/bpf/bpftool: Reset vmlinux BTF after map commands
46d27e56dbd6 drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup
8a3db9f593b6 drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup
68ce4f8223b7 regulator: tps6594: Fix device node reference leaks in multiphase loop
506a6aca57c7 perf tests: Fix flakiness in branch stack sampling tests
7980e2a92a76 perf test: Fixes for check branch stack sampling
82c0378d4569 perf tests: Fix flakiness in BPF counters test on hybrid systems
da65eac26fb1 perf test: Fix perf stat --bpf-counters on hybrid machines
0eec12a34b94 perf tests: Fix flakiness in trace record and replay test
81877759d716 perf tests: Add robust record retry helper and use subsecond workloads
2ab5938f8427 perf test kvm: Add some basic perf kvm test coverage
f597922c6e52 perf tests: Skip metrics validation if system-wide recording lacks permission
98e165f28d9b perf test: Do not skip when some metrics tests succeeded
79ddb9f98a8a perf test all metrics: Fully ignore Default metric failures
2f1b696dbbb2 perf test metrics: Update all metrics for possibly failing default metrics
97660f007672 perf test: Truncate test description to fit terminal width
de9c6dc47601 perf test: Truncate printed test descriptions dynamically to avoid terminal wrapping
17e39d310b88 perf test: Add -j/--junit option for JUnit XML test reports
bdd10298be15 perf test: Fix subtest status alignment for multi-digit indexes
68a81a1eb8d3 perf test: Add summary reporting
456e1e7ce209 perf test: Show snippet failure output for verbose=1
a3d0aad7e44a perf test: Refactor parallel poll loop to drain all pipes simultaneously
1acc1bedf4e6 perf test: Drain pipe after child finishes to avoid losing output
a2590ff90dca wifi: ath12k: correct monitor destination ring size
5d80268945df media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define
6ee86a39a2ff media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define
9be10543297f riscv: kexec_file: Fix crashk_low_res not exclude bug
68ea6dd23b73 pinctrl: bcm2835: Don't remove an unregistered GPIO chip
d623e292c6a4 perf/x86/intel/uncore: Keep PCI PMUs working when MMIO/MSR setup fails
18fdd0978ec3 sched/fair: Fix overflow in update_tg_cfs_runnable()
912e7263488e mm/mm_init: fix incorrect node_spanned_pages
e2a7cee34198 drm/lima: call drm_mm_init() with a valid allocation range
d46160ed2847 clk: imx: scu: drop redundant init.ops variable assignment
79927acbd459 arm64: dts: imx93-kontron: set memory node to 0x80000000/1GiB
6b82e11ed183 ARM: imx: fix device_node refcount leaks in imx7_src_init()
cfec229dbe9a ARM: imx: fix device_node refcount leak in imx_src_init()
9326fd5972ea clk: hisilicon: reset: Use devm_kzalloc to initialize hisi_reset_controller
e921cc73fae6 ASoC: fsl_audmix: rework runtime PM handling in probe
1e8fddab6cbe ASoC: rt700-sdw: always drain jack work on remove
61cae8df1421 clk: stm32: add missing bitfield.h header
c77bf8b2ca74 clk: nuvoton: ma35d1: fix ma35d1_clk_pll_determine_rate logic
4c7503f14f25 clk: nuvoton: ma35d1: fix PLL_CTL1_FRAC bit field width and fractional calc
e165e15e1a9c clk: nuvoton: ma35d1: fix ignored div_u64 return values in PLL freq calculation
5e273be0a987 clk: moxart: remove unused variables, fix refcount leak
fe3e4196a57a clk: versaclock7: Fix APLL clock leak on probe failure
4ffaaef885fc cxl/pci: Remove incorrect mbox.valid check in cxl_pci_type3_init_mailbox()
31d4841eca7c cxl/mbox: Clamp mailbox output allocation to the payload size
5b616612511e media: cec-pin: Fix event FIFO ordering
f1fac4561cda soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap()
635914c60da2 HID: roccat: bound device-supplied profile index
dc32c7423b34 HID: nintendo: Fix imu_timestamp_us double increment per report
544ebb25bd58 HID: core: quiesce input in hid_hw_stop() to prevent use-after-free
97093398e75a selftests: proc: include fcntl.h in proc-pidns
e4728288473a platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count
f633cc23dbcc x86/cfi: Use symmetric SYM_START and SYM_END in __CFI_TYPE()
71ddadef3b91 sched_ext/scx_flatcg: Fix cvtime_delta race and add hweight scaling to bypass charging
9c73cf53361f smack: restrict smackfs/{direct,mapped} values to 0-255
01d32783bbe0 smack: deduplicate smackfs/{direct,mapped} file_operations
845525bfb547 smack: simplify write handlers of sysfs entries
c2ab27c2e115 smack: fix incorrect task context in smack_msg_queue_msgrcv
04e674840f7e drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure
97b8580a112c drm/bridge: cdns-dsi: Return an error pointer on allocation failure
4614b7cfaf81 drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format
e4c3fb6999a4 drm/rockchip: vop2: Add RK3576 to the RG swap special case
3a8aa74859dd drm/v3d: Clear queue->active_job when v3d_fence_create() fails
7d65d9651f10 drm/bridge: display-connector: trigger initial HPD event for DP
826426c26b24 drm/bridge: display-connector: don't autoenable HPD IRQ
396a193867c6 drm/rockchip: analogix_dp: Fix OF node reference leak via auto cleanup
55fda5c2887a drm/rockchip: analogix_dp: Enable hclk for RK3588
b4eb01616c0d drm/rockchip: vop2: Wait for layer cfg done before switching LAYERSEL_REGDONE_SEL
e97f4b4efc1a drm/rockchip: vop2: Fix wrong wait target in layer cfg done check
362e005b816e drm/rockchip: dw_dp: Release core resources
fe000d791c60 drm/rockchip: dw_dp: Add missing newline in dev_err_probe() message
82861bdcafda drm/rockchip: dw_dp: Simplify error handling
435de4476dd8 drm/bridge: synopsys: dw-dp: Set pixel mode by platform data
b2bec2d4a769 drm/bridge: synopsys: dw-dp: Support unregistering the AUX channel
5afa737da00e drm: lcdif: Wait for vblank before disabling DMA
fa633af222c8 drm: Remove unused header in drm_dumb_buffers.c
2a0423c648a6 Smack: Fix error in capability bypass
31507f01ba6d KVM: x86: Check EFER validity on KVM_SET_SREGS*
d975b36e5687 KVM: x86: Move the bulk of register specific code from x86.c to regs.c
10ddef36d1cc KVM: x86: Rename __{g,s}et_sregs2() => kvm_vcpu_ioctl_x86_{g,s}et_sregs2()
8c03b907b095 KVM: x86: Extract REGS and SREGS runtime sync code to helpers
9b046de62b80 KVM: s390: Zero initialize data structures for inject_pfault_token
310df38690e9 KVM: x86: Disallow EFER.LME and EFER.LMA if long mode is not supported
5453b85c7ebb KVM: arm64: Remove VM-wide VNCR mapping counter
fd33e8abbcad media: dt-bindings: nxp,imx8-isi: Drop fsl,blk-ctrl requirement for i.MX8ULP
5cbd8761d001 KVM: arm64: Handle VNCR TLB invalidation race with vcpu_put() VNCR unmapping
892fb48d9dc7 KVM: arm64: nv: Fully update VNCR fixmap state in kvm_translate_vncr()
8195cf3f4a82 dm-pcache: validate the persisted dirty_tail chain at load
3d5a87cb909c dm-pcache: bound the logical key offset from persistent memory
01a700e9278d dm-pcache: reject a kset that overruns its segment
9693980cd7d2 wifi: rtw89: pci: add .shutdown callback to stop rfkill polling on reboot
9e8dd2a7a8cc usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers()
d1856e87ee56 usb: cdnsp: fix wakeup from S3 after controller context loss
3776b82c8099 tracing/probes: Fix anon_stack check for unnamed bitfields in btf_find_struct_member
240558d6e6ca staging: sm750fb: fix mono image source stride mismatch in lynxfb_ops_imageblit()
e5daaf27b14d platform/x86: hp-wmi: Add support for OMEN MAX 16-ak0xxx (8DD6)
1b5c3f11ba54 platform/x86/amd/pmc: Fix msg_port restoration in amd_stb_debugfs_open_v2()
bf87d1ec3bc2 perf/x86/intel: Remove anythread_deprecated bit from perf_capabilities
cbb25069fd2e mm: fix incorrect vm_flags usage when checking allowable orders for tmpfs
853043cb1294 mm/secretmem: properly account locked pages
8e3adebbdd20 mm/mremap: reset unfaulted VMA page offset for MREMAP_DONTUNMAP
effe3cc6d4fd mm/huge_memory: transfer the pmd dirty bit to the folio on zap
4f3145db05fe i3c: master: Fix use-after-free of master->this
d0cc00957292 i3c: master: Do not treat master device as a duplicate target
83fd7eca5ab0 ftrace: Take trace_array reference before accessing its ftrace_ops
3ae455597e3e clk: qcom: Fix test_ctl_hi field for DEFAULT_EVO PLLs
45962da5821d accel/amdxdna: return early from a zero-length flush
be072a5d5e35 nvdimm: virtio_pmem: refcount requests for token lifetime
4fbee1039c46 io_uring/waitid: avoid siginfo copy during ring teardown
7549d2d113d4 nvdimm: virtio_pmem: use READ_ONCE()/WRITE_ONCE() for wait flags
0879697520ab io_uring/waitid: honor task_work cancellation
8c6bc1974311 nvdimm: virtio_pmem: always wake -ENOSPC waiters
63e1a529bb89 io_uring: add wrapper type for io_req_tw_func_t arg
c5e2e145bc5e nvdimm: virtio_pmem: stop allocating child flush bio
086001737113 io_uring: only call io_should_terminate_tw() once for ctx
d0f37d77b9b4 tracing: Take trace_array reference when opening options file
23a02ff3464b i2c: qcom-cci: fix autosuspend cleanup
844839aa89e7 futex: Provide rt_mutex_.*_schedule() equivalents for futex scheduling
770a90c21272 nvdimm: pmem: keep PREFLUSH before data writes
15d10440b796 io_uring/waitid: have io_waitid_complete() remove wait queue entry
76648677aa6e tracing: Make printk_trace global for tracing system
538ef70da522 i2c: qcom-cci: Remove overcautious disable_irq() calls
884e8484c5fe futex: Optimize futex hash bucket access patterns
5f00df2a88ab udf: Fix data loss when converting inline inodes to out of line
e4cb2bbe7308 tracing/probes: Fix BTF kflag check for anonymous struct member access
4420cc71841b staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()
6ba2bacc2dd3 ring-buffer: Allow splice reads on static buffers
f5eed5182d66 platform/x86: ISST: Validate max level for set feature
08dab7065f93 platform/x86: int1092: Fix potential memory leak in sar_probe()
929cb3b9dc81 perf: Fix use-after-free when perf mmap() revival races with the last munmap()
2050d900f9ad PCI: Allow per function PCI slots to fix slot reset on s390
7fad53ae2052 nvme: skip the zoned limits update if the zone info query failed
6906fb70af2d net/mlx5e: do not HW-GRO coalesce small frames
558bfaea4926 mtd: rawnand: pl353: Make sure we use the monolithic helpers for raw accesses
824348676a50 misc: fastrpc: don't publish fd before copy_to_user() succeeds
f3d97800b03c iio: light: apds9306: fix PM reference leak in apds9306_read_data()
b25232f66e8c i3c: master: Fix recursive locking during device registration
e9e52437120f ALSA: FCP: do not copy out an uninitialised init response
5881506012f3 nvdimm: preserve flush callback -ENOMEM
545daf113332 io_uring: unify task_work cancelation checks
400607f57f11 tracing: Clean up use of trace_create_maxlat_file()
871019760cd4 i2c: qcom-cci: Do not check return value of cci_init()
54bc09b41bf3 compiler_types: Move lock checking attributes to compiler-context-analysis.h
9e5abb5e2ade wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy
84d983e550c7 udf: Move udf_map_block() up
7d73adba5c85 tracing/probes: ignore id update from btf_type_skip_modifiers
956cb6c72ae5 staging: rtl8723bs: fix spacing around operators
cca153095a18 ring-buffer: Show persistent buffer dropped events in trace_pipe file
803208a50b04 PM: runtime: Wrapper macros for ACQUIRE()/ACQUIRE_ERR()
0d4fb4f15e55 platform/x86: ISST: Check for admin capability for write commands
e94b156e5cad platform/x86: intel_sar: Check ACPI_HANDLE() against NULL
b07bcdca18fb perf/core: Fix deadlock in perf_mmap() failure path
1d7be6ff21ed PCI: Introduce PCI_SLOT_PLACEHOLDER constant for slot_nr placeholder value
b8adb1ffa263 nvme: fold nvme_config_discard() into nvme_update_disk_info()
2158e178dfc8 net/mlx5e: SHAMPO, Always calculate page size
285f7f3a651c mtd: rawnand: pl353: Add message about ECC mode
7ef12e1dd06e i3c: master: Fix device_register() error path
69d57dbadb27 dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds
9d89ffd9101c ALSA: usb-audio: Relax __free() variable declarations
37ac5eb981f4 batman-adv: fix TX priority extraction for BATADV_FORW_MCAST
a1a0959b2da0 mm/damon/sysfs: read ops_id only once in damon_sysfs_apply_inputs()
8bcfa58c4277 batman-adv: bla: avoid CRC corruption due to parallel claim add
a5e4d6cb4f68 batman-adv: dat: atomically update mac addresses
463743d1d5ef drm/amd/display: Scale custom brightness curve from full range
7e56deae5a79 drm/amd/display: Fix backlight max_brightness to match exported range
54a97ef10252 net/mlx5e: xsk: Fix unlocked writing to ICOSQ
f2573c2a3326 Linux 6.18.51-xanmod1
71f9c06ccf36 Merge tag 'v6.18.51' into 6.18
f6388029ea9e Linux 6.18.51
d83a9de7cecd ksmbd: zero pipe read compound padding
75640976cf47 cifs: add fscache_resize_cookie() to cifs_setsize()
d73f79d1a2c2 mm/hugetlb_vmemmap: fix incorrect vmemmap restore in rollback
15803e227606 pidfs: protect PIDFD_GET_* ioctls() via ifdef
ed7380f4621f mm/huge_memory: use folio's memcg inside __folio_split()
80656031dfcd migrate: replace RMP_ flags with TTU_ flags
e4307837d92c mm/huge_memory: replace can_split_folio() with direct refcount calculation
f07c94cd3cc2 mm/huge_memory: change folio_split_supported() to folio_check_splittable()
305f9b6eb8a0 mm: thp: use folio_batch to handle THP splitting in deferred_split_scan()
0a4a3d720264 mm: thp: introduce folio_split_queue_lock and its variants
d913a85cc5f7 mm/damon/core: initialize damos->last_applied
05bdb7b867be mm/damon/core-kunit: handle region split failure in filter_out()
7d4ecfb507f3 mm/damon/sysfs: read addr_unit only once in damon_sysfs_apply_inputs()
cd6d7f45abc8 mm/damon/core: skip aging from repeated aggressive merging
081ee85b4309 mm/damon/ops-common: use nr_accesses moving sum for quota score
cf94a9043f4a mm/damon/paddr: drop last same folio access check reuse optimization
11e4859ec0d8 mm/damon/vaddr: drop last same folio access check optimization
4c7275444ac6 mm/damon/tests/core-kunit: catch test failure in test_merge_regions_of()
05dc22d5c4fa iommu/arm-smmu-v3: Add HAFT support for SVA
c660c017dec1 power: supply: ab8500_fg: fix use-after-free on remove
68916940332d power: supply: ab8500_fg: Remove redundant dev_err()/dev_err_probe()
62fb3124bf74 Docs/ABI/damon: fix typo in intervals_goal sysfs path
1811bd8792ee mm/hugetlb_vmemmap: fix __hugetlb_vmemmap_optimize_folios()
dba93b8cceb0 hugetlb: remove VMEMMAP_SYNCHRONIZE_RCU
e4d1300b457e mm: rework compound_head() for power-of-2 sizeof(struct page)
5cec3e60e9f2 zram: set default primary compressor in zram_destroy_comps()
fb0e9ecffae5 zram: fix the issue that the write - back limits might overflow
9a78de3befad zram: read slot block idx under slot lock
fcd467124b19 zram: drop wb_limit_lock
d1743ec2dd2c zram: take write lock in wb limit store handlers
e7dbcb7a561a zram: fix out-of-bounds access in read_block_state()
878edb39ecf4 zram: fixup read_block_state()
83dd59ac1c34 NFSD: Prevent client use-after-free during close_lru reaping
cd489b035873 NFSD: Prevent client use-after-free during blocked-lock reaping
7f1abc50ce25 NFSD: Consolidate the revocation-path client unpin
3be89e8039a8 smb: client: reject a tree connect response whose byte count is too small
b7e74bccf588 cifs: Do some preparation prior to organising the function declarations
672cf86aa6aa smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()
9eed72e9534b smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2
31307a05ed82 cifs: SMB1 split: Separate out SMB1 decls into smb1proto.h
6493277a52b2 cifs: SMB1 split: Create smb1proto.h for SMB1 declarations
e7779c9f7e7f cifs: Remove dead function prototypes
b10015807e4c smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions
a3e8b98c823d cifs: Scripted clean up fs/smb/client/smb2proto.h
72796c2ec6e9 cifs: Scripted clean up fs/smb/client/fs_context.h
4fb5a561866c cifs: Scripted clean up fs/smb/client/fscache.h
1537c6c67510 cifs: Scripted clean up fs/smb/client/cifs_unicode.h
549bd9868e9d NFSD: Prevent client use-after-free during admin state revocation
3c0a53ee0b44 NFSD: Prevent client use-after-free during delegation revoke
969b1fefb07d nfsd: convert global state_lock to per-net deleg_lock
6d6b9f6a75c3 nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache
9031493ef736 nfsd: fix UAF in async copy cancel and shutdown
ba0ee9e04b7a nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net
f9cec313efb2 nfsd: fix clock domain mismatch in clients_still_reclaiming()
03c512f22d3f nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage
ccc069d5c47c nfsd: move struct nfsd_genl_rqstp to nfsctl.c
430ed49a16cf nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create()
380d138a6b08 net: advertise TCP MSS from the configured MTU, not the learned PMTU
cfb44c6028e6 tcp: clamp route advmss to TCP_MIN_MSS
ea44679bc7d2 ipv4: use dst4_mtu() instead of dst_mtu()
a615a2c8c306 ipv6: use dst6_mtu() instead of dst_mtu()
920dacce8734 inet: add dst4_mtu() and dst6_mtu() helpers
b650560c5ee2 ipv6: add some unlikely()/likely() clauses in ip6_output.c
a294168185fe ipv6: pass proto by value to ipv6_push_nfrag_opts() and ipv6_push_frag_opts()
194d0fb0ea47 fuse: copy request headers via a stack buffer for io-uring
b96b0d2c25d1 fuse-uring: use named constants for io-uring iovec indices
f12ebb0a3ed7 fuse-uring: refactor setting up copy state for payload copying
121fc8edf583 fuse-uring: use enum types for header copying
c46805193fbe fuse-uring: refactor io-uring header copying from ring
6bb5347e9f8a fuse-uring: refactor io-uring header copying to ring
8974575898cd fuse: fix missing barrier when checking io-uring readiness
f1c91222188b PCI: starfive: Fix resource leaks on error paths in host_init()
e5c1d10003b4 PCI: starfive: Use regulator APIs to control the 3v3 power supply of PCIe slots
0d72e78c9d38 lockd: fix swapped arguments in nlmsvc_match_ip()
fcfcba8fe17d ocfs2: validate directory-index entry counts when reading metadata
625e00fd25ef ocfs2: validate dx_root extent list fields during block read
a1dabe68fb53 ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page
a6f3b8dfbdf4 ASoC: codecs: aw88261: only check PLL and clock state at power-up
0ac722e964cd ASoC: codecs: aw88261: reduce log spam
d013b7de4dcc remoteproc: qcom: pas: Guard dtb metadata release with dtb_pas_id check
d6eab9066be0 firmware: qcom_scm: Rename peripheral as pas_id
9d69422ddaa1 sched/core: Make core-sched flips wait for in-flight selections
fef4b8f17e1c sched: Rework prev_balance() to avoid stale prev references
c522333c35d4 sched: Add assert_balance_callbacks_empty helper
c97be9d5ab04 sched_ext: Fix inverted ops.core_sched_before() invocation
c4ade059aaeb scsi: fnic: Use GFP_ATOMIC for VLAN alloc under spinlock
c98197ee3cd2 RDMA/ionic: Embed counter driver data in rdma_counter allocation
27b7b0dacae7 sched_ext: Fix exit_task leak on fork failure during enable
1a3af2262cb3 svcrdma: Reject Read lists that exceed the page budget
59bcf1b38f89 svcrdma: Reject oversized Read segments at decode time
3c97b8e76ca2 rpcrdma: arm rn_done before publishing the notification
9f2f5d099936 svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id
ee7f6e5600ae svcrdma: Release transport resources synchronously
3ff45361e946 SUNRPC: fix gssx_dec_option_array error path bugs
5563db13c952 cxl/mce: Make the MCE notifier per-region
513a9613f7a6 cxl/region: Add helper to check Soft Reserved containment by CXL regions
040cface98ff dax/cxl, hmem: Initialize hmem early and defer dax_cxl binding
dfc86b0c2698 cxl/ras: Fix cxl_rch_get_aer_severity() wrong severity register
ccf481d73bce bpf: Disable preemption in bpf_get_stackid
b466ff95324f bpf: Use stack id functions instead of __bpf_get_stackid
73ebef25aec4 bpf: Factor stackid_new_bucket from __bpf_get_stackid
ba1e22a224c3 bpf: Factor stackid_fastpath function from __bpf_get_stackid
201a381bef3a bpf: Factor stackid_init function from __bpf_get_stackid
7c19b94c625d cpufreq: apple-soc: Fix OPP table cleanup
e989cede4439 ACPI: TAD: Add locking around AML evaluations
dd440f6a2e67 ACPI: TAD: Rearrange RT data validation checking
0a7a19286223 ACPI: x86/rtc-cmos: Use platform device for driver binding
ec2d81115485 ACPI: x86: cmos_rtc: Create a CMOS RTC platform device
f2e08c3f994c ACPI: CPPC: Reject desired_perf reads on _CPC revision 4+
7267557ce98c erofs: skip sufficiently large global buffers when resizing
03c34309eb1b HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes
1a503fbb116d HID: mcp2221: fix OOB write in mcp2221_raw_event()
3b4709e48649 HID: sony: clean up device list on probe failure
a15def9a6311 HID: sony: use guard() and scoped_guard()
d2dd2cced65b cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem
85d239160dc1 smb/client: emulate small EOF-extending mode 0 fallocate ranges
41f4c9978739 smb/client: reduce fallocate zero buffer allocation
c2ae13662137 smb: move some definitions from common/smb2pdu.h into common/fscc.h
110747ff535e ceph: properly decrypt filenames in vmalloc() buffers
104a51265042 NFSD: Guard admin state-revocation walks with NFSD_NET_UP
0e763ab306a8 ceph: force a cap message when a deferred revoke can't be acked immediately
c040e139f1a6 ceph: cap delegated inode count in ceph_parse_deleg_inos()
8bd3523df131 cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read
6f9b62687a38 cxl/pci: Move CXL driver's RCH error handling into core/ras_rch.c
153b5ecd29ed usb: gadget: f_fs: Fix Use-After-Free in AIO error path
f3d31484b3f2 USB: gadget: ffs: fix mm lifetime handling
06c76d3c389f mm/page_alloc: don't spin_trylock() in NMI on UP
22bbde1960d1 x86/xen: fix init of balloon stats again
6f53c64a880f xen/balloon: improve accuracy of initial balloon target for dom0
b4a6050bde9e mm/slub: fix missing debugfs entries for caches created before sysfs init
d08ea0fd7038 mm/slab: move and refactor __kmem_cache_alias()
e7bd804e3c71 mm/rmap: use huge_ptep_get() in try_to_migrate_one()
54a58d6656dd mm/mglru: fix and remove redundant unevictable folio handling
d4812d21689f mm/mglru: use the common routine for dirty/writeback reactivation
09505232eced mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier
daeffb841bb9 mm/hugetlb: refactor code around vmemmap_walk
b662d7bcb5ec mm/hugetlb: defer vmemmap population for bootmem hugepages
edc017be8266 rust: bug: prevent dead_code warning from warn_on!'s flags constant
cf24ce48d602 pidfd: hold exec_update_lock around namespace ioctl
7aa9ab532158 pidfs: simplify PIDFD_GET_<type>_NAMESPACE ioctls
2fa220bc0f84 ovl: fix double end_creating() on the casefold-mismatch path
1c4b90902c05 crypto: atmel-ecc - avoid stale fallback key after set_secret failure
5c1e763b713f crypto: atmel-ecc - clean up and improve ECDH comments
e39767b9a54d crypto: atmel-ecc - replace min_t with min
fc933a4a419b crypto: iaa - unmap dst before software fallback on decompress
4fcbc9f4082c crypto: iaa - fall back to software for multi-entry scatterlists
1517d1996b52 vlan: fix skb_under_panic and races when toggling HW VLAN offload
ed25ed29034d net/packet: defer vmalloc TX_RING free until skbs finish
0f9309044529 fuse: fix race between interrupt and resend
f98640c27cde fuse: remove fm arg of args->end callback
952f7a6d392b fuse: split off fuse_args and related definitions into a separate header
a5bb215dbc34 fuse: publish io-uring queues with release semantics
c051f66b6216 usb: xhci: bail out of setup if the controller is inaccessible
f0ccc2d323d0 usb: xhci: simplify handling of Structural Parameters 1 values
46fb722a3bcf usb: xhci: use cached HCSPARAMS1 value
4e141571d025 usb: xhci: implement USB Port Register Set struct
8dbc9c86c318 usb: xhci: add USB Port Register Set struct
8b7ca0029e94 usb: xhci: add helper to read PORTSC register
a363197790a8 usb: xhci: add tracing for PORTSC register writes
78e8ee25a5e8 afs: Fix leak of ungot volume
c8279ae8df68 ksmbd: fix use-after-free in oplock break notification
e5e7a61fa9e8 drm/nouveau/gsp: fix vblank interrupts on GB20x
dc7c40ffaa1b drm/nouveau/disp: fix head state readback on GB20x
0e346b65a413 drm/nouveau/disp: fix HDMI GCP AVMute register offsets on GB20x
ecb110991bc9 drm/nouveau/disp: fix HDMI vendor infoframes on GB20x
4739d519def7 drm/nouveau/disp: route GSP-RM display MMIO through nvkm_disp_func hooks
94d8195eb418 drm/nouveau/disp: move the GSP HDMI GCP AVMute write to engine/disp
a046e789ab66 drm/nouveau/disp: move GSP head-timing ISR and vblank helpers to tu102.c
1101cbfe7f34 drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE
24c25b182d17 drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE
b7dc03e09313 drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op
4cf436de06ca drm/nouveau: Use write-combined maps for coherent
f3830fdd6930 drm/nouveau: unsubscribe the channel-kill event before the fence context
5ba4bcb3b96c drm/nouveau/gsp: use per-version DP_CONFIG_STREAM params on r570 firmware
859d8b6c5b27 drm/sysfb: ofdrm: Fix is_avivo() constant comparison bug
ded6ad826fe0 drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation
6892f0a2f6b5 drm/sysfb: simpledrm: Improve stride validation
54e32ad5e0c7 drm/sysfb: simpledrm: Improve panel-size validation
8d65b8d1722d drm/sysfb: simpledrm: Improve framebuffer-size validation
fd3462acf659 drm/amdkfd: Reject zero-sized AQL queue allocations after size halving
ebffa44e7a21 drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore
ae806a95b28f drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram
da87bcad1f78 drm/amdkfd: Fix error path at svm_migrate_copy_to_ram
e230c546ed93 drm/amdkfd: Add TLB flush after MES queue eviction/suspension
2e4b909fab96 drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT
65e643703f15 drm/amdgpu: update the fw version for gfx12 userqueues
b7cb1b669613 drm/amdgpu: update the fw version for gfx11 userqueues
8de8b4e11ce4 drm/amdgpu: Skip accessing psp rum time db for APUs
492dbf832964 drm/amdgpu: fix autosuspend cleanup during removal
812c406f7529 drm/amdgpu: Disable runtime PM for externally attached dGPUs
964de255497f drm/amdgpu: clamp the isolation index for rings outside a partition
b3a7e0b69903 drm/amdgpu: check thunderbolt before switcheroo registration
66b1b3098863 drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used
acd2dd6ecd89 drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value
72a95df6bbc7 drm/gud: validate TV mode names before creating enum property
b86438a5c6b0 drm/gud: NUL-terminate TV mode names read from the device
7e28853c78c2 drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check
0b2615b8b54f drm/amd/display: validate plane degamma LUT size for private color prop
295d2bf42061 drm/amd/display: fix dc_lock leak on GPU reset error paths
ee28fafb50f5 drm/amd/display: avoid divide-by-zero in __is_lut_linear()
4ac767722175 drm/hibmc: Use drm_atomic_helper_check_plane_state()
ed38f0be5b61 drm/hibmc: Fix list of formats on the primary plane
f5acd8f48cac drm/nouveau/disp/r535: Add scanline position support + head state support
6f9bdbe713fd drm/ssd130x: fix column and row end address in partial updates in ssd133x
6f776d0e43e0 drm/sun4i: fix refcount leak in sun4i_backend_init_sat()
63c70e292e6b drm/ssd130x: fix column and row end address in partial updates for ssd132x
18b3433f10ee drm/i915: Guard against NULL driver_data in i915_pci_probe()
79d09cfe9030 drm: fix race between partial drm_dev_register() failure and ioctl
0259846b15a6 drm/panel-edp: fix i2c adapter leak on probe failure
b51d8fb5e58c drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure
80c9528661c7 drm/panthor: fix firmware control interface bounds checks
5516f1acfd07 drm/panthor: harden firmware build-info bounds checks
ef41e8e4ae5b drm/xe/vram: report FLAT_CCS base misalignment
e184e46ca1ba drm/amdgpu: Fix init ordering in amdgpu_vram_mgr_init()
91ec55ddc097 f2fs: fix to zero post-EOF data when extending file size
a984446aa9d5 f2fs: fix to pass folio->index to f2fs_sanity_check_node_footer()
dde99df5a9d3 f2fs: fix valid block count leak on data block allocation failure
ab35ae07f2b5 f2fs: fix to clear dirty flag on folio in error path
c16cc4622e4b f2fs: fix to off-by-one issue in f2fs_zero_post_eof_page()
f6c49fae98f0 f2fs: fix i_size when pinned fallocate partially fails
161513f53e4a f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages()
b8ae1228c153 f2fs: fix to migrate all curseg types during free_segment_range
aefcec3bebde f2fs: avoid NULL checkpoint thread access in sysfs
aefb4b0f465b f2fs: fix dentry folio leak in find_in_level
94917ffab3a9 f2fs: fix to avoid potential section-unaligned pinfile
3e61c3944b83 f2fs: return writeback error from collapse range
3b681229e9f8 f2fs: use the mount idmap for the owner check in f2fs_xattr_advise_set()
db504781ea9b f2fs: dirty directory inodes on mtime/ctime update
dc652b2fe916 f2fs: fix to avoid move_range and defragment on device_alias file
445e4a1e6025 f2fs: only redirty pinned folios in redirty_blocks
7f89e2775d5b f2fs: reject overlapping move range after len expansion
95d5975c9d1c f2fs: return symlink writeback errors
ac4b019ac078 scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started
4fe579067409 scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak
0bdd0f7a1094 scsi: qla2xxx: Use coherent DMA buffer for D_Port diagnostics
776e4e8cbcf1 scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition
16c731c4f296 scsi: qla2xxx: Drop vport reference under lock in report ID acquisition
17fb63c1d0fc scsi: qla2xxx: Fix NVMe abort reference leak on repeated abort
5dd9bec8004b scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry()
d7f7746ff031 scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read
9fa1d71233a8 scsi: qla2xxx: Avoid double completion in async IOCB timeout
10e9f05f7fd0 scsi: qla2xxx: Quiesce response IRQ before freeing request queue
31715d1e1cbf scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb()
e93aa3c5125d scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path
a194684853dc scsi: qla2xxx: Don't query firmware state while chip is down
7203d4aed8f4 scsi: qla2xxx: Fix FCE trace enable parsing in debugfs
e6cfb1ee1833 scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state()
8e7a26931b61 scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump
8286a9095fb5 scsi: qla2xxx: Fix cs84xx use-after-free on host teardown
8d1161371193 scsi: qla2xxx: Serialize flash version read in reset handler
7a448f5ed0b2 scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation
11834e5773e2 scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject
7b22b4cb8822 scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions()
5ecdb336df2a scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config()
67f0d5187c29 scsi: qla2xxx: Initialize NVMe abort_work once at submission
47272152a13d scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()
206df5ffa72d scsi: qla2xxx: Fix Name Server logout detection on FWI2 adapters
94bfb61478bc scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check
97ca58b0fb02 scsi: qla2xxx: Bound i2c->length in I2C bsg handlers
b157256c2808 scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers
dec5624a3f8c media: chips-media: wave5: Set inst->std during default format initialization
a0506198a77b media: chips-media: wave5: Guard bit depth check with initial_info_obtained
ff98cd2b8b54 media: qcom: iris: use disable_irq() during power-off
ab6f088a44ef media: qcom: iris: fix state-change debug log printing stale value
f1c4f3885df1 media: zoran: Avoid freeing a registered video_device twice
dc005cb7ccb0 media: vimc: fix pixel format lookup in enum_framesizes
52fd9d80c0ce media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure
4a187d944384 media: venus: fix payload size calculation in parse_raw_formats()
d031b5ecc4b3 media: venus: fix payload size returned by parse_caps() and parse_alloc_mode()
3ced388b7908 media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link
331f22dd63bf media: v4l2-ctrls: Allow unknown HDR10 white point and luminance
3345746e0957 media: v4l2-async: avoid deleting unlinked ASC entry on link error
7c62bd653563 media: tda18250: fix possible integer overflow
4d2048466af9 media: saa7164: fix cleanup on resource allocation failure
342632a4d8ba media: s2255: check firmware size before reading trailing marker
68d664f1b4ef media: s2255: bound JPEG frame size before copying into the buffer
93e6ed88f508 media: rzg2l-cru: Align bytesperline to hardware DMA stride requirement
26a2a985bbee media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure
7443b16b6dd8 media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak
12b88016c199 media: rkvdec: Propagate platform_get_irq() errors
5b58d8c206f3 media: rc: sunxi-cir: Unregister rc device on probe failure
8281acf5d704 media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks
9392375dd4c0 media: nxp: imx8-isi: Correct color map between V4L2 and ISI
2f9b2768d5ce media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing
5026f927ef41 media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup
252850653569 media: platform: mtk-mdp3: Fix SCP device refcounting
96dafbae77f5 media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common
24aca8839038 media: iris: Enumerate cap->bus_info to differentiate between encoder and decoder
27b7997be552 media: intel/ipu6: fix async notifier cleanup leak on parse error
1d59c5254c33 media: imx355: Avoid calling imx355_power_off twice in error path
af81f35e4f42 media: i2c: ov7740: fix use-after-destroy in remove
90f9b421fc6d media: i2c: ov02a10: fix endpoint parsing use-after-free
4f8fd40b39bf media: i2c: imx415: Return test pattern write errors
1aa66bb3ba44 media: i2c: imx415: Release runtime PM reference on VBLANK error
312c68e9ed8a media: i2c: alvium: Fix: Correct name of register in alvium_set_ctrl_auto_exposure
0745a59945d9 media: go7007: defer the ALSA v4l2 put until card release
0782807552b6 media: em28xx: fix use-after-free of dev_next->devlist on disconnect
f9322ac9f862 media: em28xx: defer audio-only extension registration
bf3f49273d5b media: cx23885: cancel NetUP CI work before teardown
7087bef6510c media: cx231xx: reject geometry changes while the VBI queue is busy
cb1218da234e media: cobalt: Avoid freeing ALSA private data twice
f78cf36cabf9 media: cedrus: fix memory leak in cedrus_init_ctrls()
5c62095acc2a media: cec: Serialize exclusive follower delivery
38c14532adb3 media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash
673611cc2ab9 media: cec: extron-da-hd-4k-plus: add sanity check
a3adb63b1219 media: cec: disable delayed work before freeing an interrupted transmit
695063fc5757 media: cec: core: Fix kmemleak due to missed rc_free_device() call
cb7a4cf63fa2 media: amphion: Remove obsolete frame_count check in venc_start_session
297fee023f46 media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref
347e9d2246b8 rust: drm: ioctl: fix unbounded lifetimes in ioctl handler arguments
76395109a051 LoongArch: Avoid preempt count underflow without probe
266ffc92e685 LoongArch: Do not save/restore percpu base register in rethook trampoline
d692b825dc24 LoongArch: Do not select HAVE_RUST when KASAN is enabled
d3fd094c13c6 LoongArch: Fix acpi_package_ids[] array overflow
882b8912b7e9 LoongArch: BPF: Refactor jump offset calculation in tail call
462e6abc8293 LoongArch: BPF: Optimize redundant TCC loads in epilogue
ab275a23b4d9 LoongArch: Add DIRECT_MAP_PHYSMEM_END definition
4e4dbc341b15 LoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY
6b78786ee726 LoongArch: KVM: Free init resources if kvm_init() fails
07c3037e45c9 LoongArch: KVM: Fix TOCTOU race on pv_features
b7fab314ade2 LoongArch: KVM: Fix PC double advance in kernel MMIO read fast path
566b1f08d983 KVM: arm64: Correctly cap TLBI Range to the architural limit
3d4c26b16a04 KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save
2f1a571af300 KVM: arm64: vgic: Reset in_kernel on private IRQ allocation failure
de9b4e8f37ce KVM: arm64: vgic: Fix detection of MI on no pending LR
7631f9529756 KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables
72bce82c4171 KVM: arm64: Sign-extend VA for range-based TLBI invalidation
d8580e7aa189 KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry
ce447651a52e KVM: arm64: Correctly handle end of VA space TLBI invalidation
be54a70067c7 KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation
6408605cbd50 KVM: arm64: Consider SCTLR_EL2.M when mapping the L1 VNCR page
150c43473dcf KVM: s390: Restore sigset on error path
5ed801685a8a KVM: s390: pv: Fix rc/rrc offset for PVM_DUMP
6ee52d3af2a1 KVM: s390: Fix memory corruption by not reinjecting CK machine checks
3904a3296e40 KVM: s390: Zero initialize irq in reinject_machine_check
cc710ee45395 KVM: s390: Take srcu when importing watchpoint data
b5acacfdb896 KVM: s390: Free guest debug data on vcpu destroy
f55e4d415d95 KVM: s390: Fix old_data leak in guest debug error path
44bf3792c10f KVM: s390: Fix memory leak in guest debug handling
beb9c55af609 KVM: s390: Fix length check __import_wp_info()
39f7abd5927b KVM: x86: Ensure runtime reads of disabled_quirks are resolved once
929fd2d87851 KVM: x86: Serialize writes to disabled_quirks using kvm->lock
3097582b73a8 KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock
41debfc98526 KVM: x86/mmu: Consume the locked rmap value in the lockless rmap walk
7b2721d66525 KVM: x86/mmu: Use split "zap all fast" helpers when invalidating memslot
0a25ee42e7d1 KVM: x86/mmu: Use CMPXCHG when clearing Accessed bit in TDP MMU
e29e9a9d8114 KVM: x86/mmu: Split kvm_mmu_zap_all_fast() into "front" and "back" halves
93b7f6eb76a1 KVM: x86/mmu: Fold kvm_mmu_zap_memslot() into kvm_arch_flush_shadow_memslot()
27bdeb5fd190 KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU
c43563e7518e KVM: nVMX: Service local TLB flushes on failed nested VM-Enter
674a3244f07f KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit
d689dd4eae48 KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02
22dfcc22c95e KVM: nVMX: Always flush vpid02 on first use
5778dda871f1 KVM: PPC: Book3S HV: Validate arch_compat against host compatibility mode
c9f2c50bad37 iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask
b6cedf011bd9 iio: light: opt4001: Reject integration times with a non-zero seconds part
958d69140393 iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem()
4a9820aa8ef7 iio: light: opt4001: Fix power down clearing bits of the wrong register
6d00b4fec5bf iio: light: opt4060: Fix incorrect register name in threshold read error message
38f58a024966 iio: light: opt4060: Reject integration times with a non-zero seconds part
fcddb4da54ab iio: ti-ads7138: Disable STATS_EN bit while reading conversion results
c0d491c243e7 iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register()
c2d6437663d7 iio: srf04: fix pm_runtime handling on probe error path
eef652190b00 iio: pressure: mpl115: Fix runtime PM cleanup
7ded5b76ec2d iio: pressure: dps310: fix NULL pointer dereference on ACPI probe
0614928a3eda iio: light: ltrf216a: fix runtime PM reference leak in error path
1ce47f00e9c0 iio: light: gp2ap002: Disable regulators on resume failure
9c1b74fdcffa iio: light: cm32181: return zero after writing calibscale
d2b32b71fa5b iio: gyro: mpu3050: fix sign of raw angular velocity readings
08ac8d2976d5 iio: dac: m62332: Fix regulator reference count imbalance
bcc324f3033c iio: dac: ad3552r-hs: fix scnprintf() buffer bound in data source show
2d386efb4c37 iio: chemical: sgp30: Handle IAQ thread creation failure
2071624c3d0f iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF
43bce901047e iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable
510497e31be4 iio: buffer: Tie IIO dma fence lock lifetime to the fence
06a9460b8b79 iio: buffer: Make IIO DMA fence release RCU-safe
f1f8f0e8e0af iio: buffer: Fix potential use-after-free in anonymous buffer release
8de90e0e0f6d iio: adc: pac1921: fix wrong channel used in trigger handler read
beec14368c94 iio: adc: max34408: add missing 'select REGMAP_I2C' to Kconfig
d2ed166c901e iio: adc: adi-axi-adc: add data size support for AD408X backend
e9627244ac0d ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get
4e580d84a638 ASoC: loongson: Fix error handling in ACPI property parsing
e11b056d69b8 AsoC: intel: sst: fix PCI device reference leak on probe failure
e8ea01a04570 ASoC: hdac_hda: Fix hlink refcount leak on component registration failure
0966b76a0e23 ASoC: fsl_easrc: Use div64_u64 for 64-by-64 division
5ca4bd754352 ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure
5a4fe7a87841 ASoC: cs35l34: drain threaded IRQ before runtime suspend
6e369bc46663 ASoC: cs35l33: drain threaded IRQ before runtime suspend
eb5d39dd862f i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure
b2b87f2e0bb1 clk: qcom: gcc-mdm9607: Drop incorrect BIMC PLL and related clocks
4763197c6f34 clk: qcom: gcc-mdm9607: Fix halt_reg for gcc_apss_axi_clk
bd326b0c5b33 clk: qcom: gcc-mdm9607: Fix enable_reg for gcc_blsp1_sleep_clk
c67fc2fd7139 clk: qcom: gcc-mdm9607: Drop incorrect system_noc_bfdcd_clk_src
206a6e21a0cf clk: qcom: gcc-mdm9607: Drop incorrect apss_tcu_clk_src
526b0a71a4d9 clk: rockchip: rk3588: Don't change PLL rates when setting dclk_vop2_src
cc2941bc3735 clk: qcom: gcc-msm8939: Fix enable_reg for gcc_blsp1_sleep_clk
51b40cb17c21 clk: qcom: gcc-msm8916: Fix enable_reg for gcc_blsp1_sleep_clk
4582949b7bad clk: meson: align gxbb_32k_clk_sel number of parents with actual count
88fe6792be2b clk: mediatek: mt8196: Select REGMAP_MMIO for vlpckgen
05952e503cf6 clk: clocking-wizard: fix integer overflow in rate calculation
82f78c2b3af8 batman-adv: bla: prevent CRC corruptions after claim flush
871acdf97f64 batman-adv: bla: fix freeing of claims on meshif deletion
1cfa7d5f70d5 batman-adv: dat: avoid unaligned fault in IP extraction
c32e5e25c412 batman-adv: mcast: linearize skbuff for packet generation
cedacfecf4b4 batman-adv: mcast: ensure unshared skb for multicast packets
e91d2cc7441d batman-adv: fix stale receive device on merged fragments
c8f86e375b39 mtd: rawnand: validate ONFI extended parameter page sections
4b282dc6a9e9 mtd: nand: realtek-ecc: add missing MODULE_DEVICE_TABLE()
d06f91a52af1 mtd: mtdoops: free page bitmap when the backing MTD is removed
18916f475057 mtd: afs: validate v2 image info bounds
e8bcb9d54429 s390/vfio-ap: Fix required lock not held during update of ap_matrix_mdev object
6d554f2571e6 s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap
69632952aca0 s390/vfio-ap: Fix NULL deref in status_show() during queue probe
647916988272 s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects
c45753c32d45 s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed
178ea7a1c2c3 s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL
f7d66afc34bc s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove
3c5f51f257e1 s390/vfio-ap: Fix stale do_remove flag across iterations in vfio_ap_mdev_cfg_remove
fc069d00a0db s390/vfio-ap: fix stale pqap_hook pointer on error in vfio_ap_mdev_set_kvm()
3b90d769b351 powerpc/crash: stop watchdogs before booting kdump kernel
36dcb8c2e339 powerpc/pseries: Move H_WATCHDOG definitions to a common header
d2be3dd20e83 powerpc/pseries: Handle and log pseries-wdt registration failures
9c914b7a0bd1 powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population
da88a2a2119e powerpc/kexec_file: Prevent kexec range truncation
df45337587db powerpc/kexec_file: Fix null-ptr-def in extra size calculation
6ae9306c7598 parisc: Fix alignment of asm statements in head.S
3e2691eeee83 parisc: eisa: Fix infinite loop when parsing invalid IRQ value
6b1faf1f099f nvdimm/btt: reject an arena whose nfree is below the lane count
bdd929e60bc5 mm/hugetlb_cgroup: call page_counter_set_max() outside VM_BUG_ON()
631d8f39b33e mm/hugetlb: keep max_huge_pages when dissolving surplus folios
ae6a8b0c6990 mm/hugetlb: fix missing migratable flag on same-node hugetlb migration
8e287f463fc4 Revert "irqchip/mbigen: Fix mbigen node address layout"
6e96e2bb1065 pmdomain: airoha: fix unselectable AIROHA_CPU_PM_DOMAIN kconfig
cf1484d9a75d nvmet-tcp: reject unsolicited H2CData PDUs
dbc4acbdb3ca nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
7555ddd60af7 nvmet-auth: Synchronize timeout work during SQ teardown
d663944dbad8 nvme: add missing SRCU grace period in error path
b4af7999a998 nvme-tcp: check the data direction of a C2HData PDU
7df913a7ced5 nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails
15d7a35a4892 nvme-fabrics: fix DHCHAP secret leak on parse failure
7ad2ea7c1004 ALSA: pcm: Fix race between non-atomic ops and trigger-start
89992bda7dfb ALSA: harmony: initialize locks before requesting IRQ
1e67ad10373e ALSA: rawmidi: Return the error from snd_rawmidi_input_params()
cd090af03f5d arm64: errata: pass REVIDR when matching target implementation CPUs
68cbd70795dd arm64: mm: Fix the lockless page-table walk in show_pte()
2b3b06cb709c i2c: mux: Fix channel node leak on adapter add failure
112b3d48084c i2c: core: fix debugfs UAF on adapter removal
954f30c8df0a i2c: qcom-geni: update frequency table to fix timing parameters
c643b6e7852e i2c: designware: Enable interrupt mask workaround for HJMC3001
19d65da9f749 perf hisi-ptt: Fix PTT trace TLP header parsing
242138984073 perf trace: Refactor augmented_raw_syscalls using bpf_for
f3a666313849 perf trace: Factor out BPF loop body
3c492c8eba02 perf/x86/intel: Fix kernel address leakages in LBR stack
267f0a4fb9fe rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers
3a2b79eae5be rtc: rzn1: Handle unset alarm weekday in rzn1_rtc_read_alarm
a4d6666a65d6 rtc: rzn1: Fix weekday underflow when alarm crosses month boundary
350cb7821b3d rtc: rzn1: Handle EPROBE_DEFER for optional pps interrupt
0a90e268cce7 memcg: make the v1 soft limit knob inert
801bcbdbfd59 memcg: bypass the reclaim and oom killer for dying tasks once oom_reaper is done
7269bd95d707 Input: aiptek - validate raw macro indices before updating state
d07e281f2a77 fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()
4d6ccd3883df fs/ntfs3: fix KMSAN uninit-value in ni_create_attr_list
0ceda28f371d mm/mempolicy: fix sleeping allocation in alloc_pages_bulk_weighted_interleave()
5da247e4d1e8 kprobes: Protect kprobe_blacklist with RCU
863f6726a5c0 irqchip/stm32mp-exti: Fix the unit of the hwspinlock timeout
f8a2f2a46023 ima: Check for ERR_PTR from dentry_path() in validate_hash_algo()
685c195fbd7d ata: ahci: work around lost interrupts on Marvell 88SE61xx
ca5bfea2045e ceph: lock mutex in ceph_mds_check_access()
a24a146ae2cb bpf: Fix infinite loop in pcpu_freelist push with one possible CPU
bfb469f20aa9 block: flag zoned disks with GENHD_FL_NO_PART
634e2d23736d cpuidle: psci: Fix support for probe deferral by dropping the faux device
b519dfce1998 cpuidle: dt_idle_genpd: kfree() the original name allocation
fac202d73e7a dmaengine: dw-edma: Initialize IRQ data before requesting IRQs
8fd47ccbba86 dmaengine: dw-edma: Complete descriptors before pausing
3b313f7a00d1 dmaengine: dw-edma: Fix HDMA channel status register access
d382aaf5fed3 dmaengine: fsl-edma: tracing: no ptr dereference during log output
408ff2d5bf55 dma-direct: return struct page from dma_direct_alloc_from_pool()
36177beff2a9 dm: fix resume-vs-remove race
af1f32ccf805 dm: fix race when loading and unloading a table
74ec08f7b81c HID: wacom: validate report length in wacom_intuos_pro2_bt_irq
f4cb9c4556dc HID: rmi: fix OOB access with undersized RMI reports
c7f927aa8b55 HID: bpf: serialize device reference release in struct_ops destroy path
078adc03f6e6 ftrace: Synchronize the initialization of ftrace_ops
7d1559126d86 futex: Prevent rcuwait use-after-free during requeue PI
1cd41131bc4b mm/damon/core-kunit: check region count before testing in split_at()
382e58c24eab mm/damon/sysfs: kobject_del() target (normal), context and kdamond dirs
368f84ec7910 mm/damon/sysfs: kobject_del() region and target (error) dirs
23c7b91895ff mm/damon/sysfs-schemes: kobject_del() scheme region dirs
20a40e7eb5ec mm/damon/sysfs-schemes: kobject_del() scheme quota goal dirs
e608e7bbe82c mm/damon/sysfs-schemes: kobject_del() scheme filter dirs
8a1ebb241fc7 mm/damon/sysfs-schemes: kobject_del() scheme dirs
b9847d539b9c mm/damon/sysfs-schemes: kobject_del() scheme action destination dirs
cb55606449fd samples/damon/wsse: stop and free damon ctx when damon_call() fails
6179c7f47876 samples/damon/wsse: handle damon_start() failure
2446d3820cba samples/damon/prcl: stop and free damon ctx when damon_call() fails
9f370353bba7 samples/damon/prcl: handle damon_start() failure
3c07c57b8941 samples/damon/mtier: handle damon_stop() failure
f0808262a761 samples/damon/mtier: handle damon_start() failure
71de5a082d2c mm/damon/vaddr-kunit: check region count in three_regions test
dd817463c9b4 scsi: pm8001: Use rollback index when freeing MSI-X vectors
4bb34769ef44 scsi: megaraid_sas: Limit NVMe request size to the PRP chain frame
1624bff4c511 scsi: target: iscsi: Reserve a terminator byte for the login payload
a38051fa2dde spi: Fix DMA mapping ownership on partial map failure
148a3f03aec8 spi: bcmbca-hsspi: disable clocks on resume failure
0acbfd61aee1 spi: bcm63xx: disable clock on resume failure
b782a7cb0a42 spi: bcm63xx-hsspi: disable clocks on resume failure
907752a7b64a soc: qcom: geni-se: Use HW PROG_RAM_DEPTH to validate firmware size
e373c1acdbcf ublk: clear VM_MAYWRITE on read-only ublk char device mmap
89f06342743c userfaultfd: reset err to be 0 when move_pages_ptes succeeded
65c2029f3bba thermal/drivers/qoriq: Disable clock on resume failure
ec2db87a0bbb thermal/drivers/imx: Disable clock on runtime resume failure
efaab8938fb9 xhci: fix lost bounce buffers on TDs spanning several ring segments
b041e3f35e0d staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()
ff61aa328935 staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr()
d3a7fa61997d usb: gadget: fix null pointer dereference in usb_put_function_instance()
c29a83c1ff3f USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()
02ac76f27db2 usb: gadget: f_midi: initialize work in f_midi_alloc()
e89e30f0b5d3 usb: gadget: f_midi2: fix use-after-free in string attribute show path
9c3d5091e356 usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs
33a81acd2d1d usb: typec: ucsi: displayport: Fix OOB altmode array index
6be5169e7615 usb: typec: tipd: Fix Thunderbolt altmode VDOs for cd321x
42828aeb40b4 usb: typec: tcpm: constrain TCPM_SOURCING_VBUS event handling
d4e00a1eb391 usb: typec: qcom-pmic: cancel reset_work on stop
1e4f33f99bfb usb: typec: qcom-pmic-typec: drain cc_debounce_dwork if port_start() fails
c614d7c44ca7 usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop
7c4e2f964c65 usb: storage: realtek_cr: fix use-after-free on disconnect
0afe5c31612d usb: dwc3: clear forceRM when issuing EndTransfer
62a8b6796063 usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns()
1c67f2ba9c5f usb-storage: ene_ub6250: fix race between scan work and probe
7690a86b1932 media: usbtv: keep device alive while ALSA card exists
296a884cd6fe clk: qcom: gcc-mdm9607: Increase delay for USB PHY reset
9392a2c34676 ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output()
838455cc8bfe usb: image: mdc800: change kmalloc() to kzalloc()
4814f28c45f5 drm/amd/display: fix division by zero in get_estimated_bw()
12ee39c2b1d3 bpf: fix the return value of push_stack
c96477e0cabf drm/xe: Don't hand out the flat CCS storage as usable VRAM
a6b088bee95f fsnotify: inotify: pass mark connector to fsnotify_recalc_mask()
0ec897493ff8 drm/amd: Drop calls to restore power limit and clock from smu_resume()
0b6680e30639 mfd: qnap-mcu: keep the reply buffer alive past a command timeout
617b48fc0baf objtool/rust: add one more `noreturn` Rust function
947400af98b9 fsnotify: Fix stale object mask after concurrent mark updates
459f33f82864 entry: Fix seccomp bypass after ptrace with TSYNC
b5a5d389eee6 mm/page_vma_mapped: use huge_ptep_get() for hugetlb
e15407c3a8a0 openvswitch: Fix CT limit teardown use-after-free
a13b1e80e501 net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()
211a65465dd9 Linux 6.18.50-xanmod1
e8b3291361f1 Merge tag 'v6.18.50' into 6.18
7cfc41f8e80f Linux 6.18.50
8e30f5427f34 mm/rmap: use huge_ptep_get() in try_to_unmap_one()
381a0a524e96 mm: avoid unnecessary use of is_swap_pmd()
6a259dd31304 platform/chrome: sensorhub: Fix dropped timestamp events and log spam
e91d66e5ff66 selftests/mm: fix on-fault-limit false failure under sudo-rs
2d6150e5e6aa udf: Fix i_lenExtents truncation on 32-bit kernels
b7eff3f621ef timer: Keep debugobjects state consistent in migrate_timer_list()
fecf1e377752 timekeeping: Check the return value of tk_get_aux_ts64 in __do_adjtimex()
6067c39c2cec taskstats: fix cpumask parsing cutting off the last character
ed64aa505875 smack: fix cred UAF in smack_file_send_sigiotask()
a246da20c8e4 signal: avoid shared siginfo namespace rewrites
236c8ecaafc6 sticon/parisc: Detect default STI graphics card for console output
e8527de7fea1 sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[]
cde2d927c29e tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout
c3c7e87c76b4 zloop: truncate finished zones to zone capacity
f49e55b1c8fe xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc()
ae0c79a85270 w1: ds28e17: reject an oversize length on an I2C block read
165a330a68b5 vsock/virtio: flush works in dependency order
03b81f015dbb wifi: mt76: mt7996: validate default EEPROM firmware size
01f2e0da8548 wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames
304470333b7f wifi: mt76: mt7925: cancel mlo_pm_work on stop
5fdaf7016d76 wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy
4506e229b2e4 wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex
34a505071d1f wifi: rtw88: pci: fix resource leak on failed NAPI setup
7364713f0931 wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb()
dc8b0be0ec4d wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars()
0c0b374e12d5 wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids
97a1af5ac131 wifi: rtl818x: initialize eeprom_93cx6 struct to zero
b1bbeb8970ee wifi: mwifiex: Detach sync cmd buffer on interrupted wait
7c257a295e05 crypto: sun8i-ss - Remove crypto_rng interface
8e4f9110aba3 crypto: sun8i-ce - Remove crypto_rng interface
620acb1e8037 wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop
84ba017a1e1e wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start()
261d7c7610b4 wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control()
7ef23317f997 i3c: renesas: Reconfigure the DATBAS register on re-attach
9382fcf3a8c4 i3c: renesas: Clean DATBAS register on detach
0093f9fc102b i3c: renesas: Check that the transfer is valid before accessing it
5697d779577e i3c: master: svc: bound IBI payload to the requested max_payload_len
94fb9786d67a i3c: master: Fix info leak and UAF in device unregister path
a15a1b95de98 i3c: master: adi: initialize the lock before enabling interrupts
1894fc7a3bab dm-pcache: fix use-after-free and invalid seg operations in kset_replay()
10acf740c3ad dm-pcache: fix implicit u8 truncation of gc_percent in message handler
83e3116283ed dm-pcache: only hand out initialized cache segments
663ee2f3824a dm-pcache: detect a cycle in the last-kset chain during replay
2cd9776fe3f2 dm-pcache: clamp the tail kset read to the segment data region
ffd9a214a94f dm-pcache: bound the persisted tail-position offset
91b93fe5cf4d dm-pcache: validate on-media seg_num against the cache device size
d8caf96040a0 dm-pcache: validate kset key_num and intra-segment bounds
ab5dcde6fa96 dm-pcache: validate geometry fields from on-disk cache_info
296efdc110b1 dm-switch: use WRITE_ONCE() in switch_region_table_write()
74210fa07296 dm-stats: fix a crash if allocation of per-cpu data fails
c860cd3f4038 arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map()
edf30d65e3ac net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry
44dc702be9a9 rust: rust_is_available: warn for `bindgen` < 0.72.1 && libclang >= 22
b5fe67111e63 ovpn: run deferred work on a module-owned workqueue
50f4a793c4ff ring-buffer: Fix subbuf resize race with ring buffer readers
22fe01a2e2f7 ALSA: hda/realtek: Fix Lenovo Yoga Slim 7 14AKP10 quirk ordering
37c3210c491a ALSA: hda/realtek: Enable micmute LED on HP EliteBook 6 G1a p/n: AD3Q9ET#UUG
8acb66d0513d ALSA: hda/realtek: Add quirk for TongFang XxAF5xxx
40ee4224e2fe ALSA: virmidi: Check card index validity at probe
7555e83d7738 ALSA: serial-u16550: Check card index validity at probe
d7ef7890e3e3 ALSA: portman2x4: Check card index validity at probe
7ef9ad82d95d ALSA: pcxhr: initialize mutexes before requesting threaded IRQ
a4e774eeb61a ALSA: mts64: Check card index validity at probe
cc4215cc2a4b ALSA: mpu401: Check card index validity at probe
13d61a920435 ALSA: hda/ext: preserve PPLCCTL bits when clearing reset
7df3194bdb74 ALSA: bcd2000: clear the URB pointers on disconnect
7b3f98558493 ALSA: aloop: Check card index validity at probe
2a6f6fba3bd3 ALSA: 6fire: bound the MIDI event length from the device
94ca4f040ba4 mfd: sm501: Fix potential memory leaks during remove
5e7fe9c6c8c3 mfd: cgbc: Fix teardown ordering in cgbc_remove()
efe0ed4c0f4e hwrng: stm32 - Fix runtime PM cleanup on registration failure
cfa186a0857a seg6: reset IP6CB after IPv6 decapsulation
288f99706708 net: skbuff: don't touch shared zerocopy state in skb_tx_error()
34ab62c959f5 net: fix spurious TX timeout after dev_activate()
af0ee8f04bea net: cap advertised IP tunnel headroom
5bd8b764a610 net/smc: unregister the connection before draining the rx tasklet
313f79149eb3 net/smc: stop killed, freed and out_of_sync sharing a byte
c52a998a223e net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link()
0761e49aa78c net/smc: fix use-after-free in smc_rx_pipe_buf_release()
d89dc1bd8845 net/smc: fix socket refcount leak in smc_switch_conns()
f950e1b1f0aa net/smc: do not dereference an unset send buffer on the SMC-D teardown path
486c699a8cde net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages
b893152a886b net: ntb_netdev: Count packets dropped on RX refill failure
4fac86e97697 net: ntb_netdev: Avoid double-accounting netif_rx() drops
dfab7171cd39 net: ntb_netdev: Fix TX busy and drop handling
6b6bbc6c878d NTB: ntb_transport: Reject oversized TX buffers
894e136b432d NTB: ntb_transport: Fail TX enqueue when the QP link is down
0c4aabc90449 NTB: ntb_transport: Recycle TX entries before client callbacks
f01e6a35c440 net: thunderbolt: Mark the connection down when bringing it up fails
61ff3c353e5d net: thunderbolt: Release the Rx HopID that was handed out on mismatch
67a82e6f886b net: ravb: serialize PTP clock teardown
8d4d06d6e2b5 net: ravb: avoid dereferencing an invalid PTP clock
b6b533f83461 net: phylink: correctly validate returned PCS in phylink_inband_caps
0860af127aa7 net: openvswitch: fix nf_connlabels leak in ovs_ct_init
ac73e3af571d net: openvswitch: fix flow mask use-after-free on flow deletion
9c340473f482 net: l2tp: do not propagate multicast notification errors
62da38b4b3a0 net: ipa: fix stalled modem TX queue after runtime resume
42a33e679ea0 net: ibm: emac: mal: fix NAPI locking
f71087e7c63a net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO
e098d9cc8859 net: tun: bound receive headroom
32785d75e60d net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition
486577db8078 slip: fix use-after-free in sl_sync()
15d1f3c0dbe7 xdp: fix zero-copy frame layout
8e3763f1ccac net/iucv: filter frames in afiucv_hs_rcv() by ingress device
99692252b348 ipmi:msghandler: Cancel work cleanly on an error
53af3a8bae0a ipmi: si: Fix NULL pointer dereference after failed registration
d46c97eddcbc ipmi: Remove all sysfs files on registration failure
5719431ca2b5 ipmi: ipmb: validate write message length
db8147c5d5ad interconnect: Fix use after free in icc_get() and of_icc_get_by_index()
417e02f7b605 io_uring/query: cap user size passed to copy_struct_to_user
0c12a798078b platform/x86: hp-bioscfg: warn on element type mismatch instead of failing
a38127df99ae platform/x86: hp-bioscfg: pass validated element count to package parsers
95d2f9b5189d platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed
b15b334fbc3c platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer()
e3c1c5d1c923 platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password
0f9aad084248 platform/x86: hp-bioscfg: fix heap OOB read on empty password write
7cd8fe01aba3 platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store()
dea1a41160e7 platform/x86: hp-bioscfg: bound ordered-list parsing by the package count
0cd1530f84e1 platform/x86: hp-bioscfg: advance elem past consumed array elements
0a14d35ef529 platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS
bc9aa5fe21c3 platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails
8178f59d7657 platform/x86/amd/pmc: Propagate SMU errors and validate S2D address
98d91d5b6a98 platform/x86/amd/pmc: Restore msg_port on amd_stb_s2d_init() error paths
5eaf7faa9957 platform/chrome: sensorhub: Bound the EC-reported sensor number
56dc46094973 platform/x86: think-lmi: Fix current password length check
9c28adde051f platform/x86: think-lmi: Free system certificate signatures
89a076948ed6 platform/x86: think-lmi: Fix certificate thumbprint sysfs output
d7cd3e4d7603 platform/x86: lenovo/ymc: Only match lower byte in WMI lid switch query response
e1b3f89673bd platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path
e07a42bb9c90 platform/x86: ISST: Return error during profile addition
62840acc3044 platform/x86: ISST: Validate parameter for frequency and priority
93268bc3cd84 platform/x86: ISST: Validate parameter for core power state
5b032e1dda48 platform/x86: ISST: Validate logical CPU id and clos id
b14db79d02bd platform/x86: ISST: Use PP level enable mask
92c5fffa63ad platform/x86: ISST: Just allow 2 bits for SST feature enable
c280fcd53b93 platform/x86: ISST: Add a NULL check for sst_inst[]
2550f89589ca mmc: via-sdmmc: stop card-detect handling on probe failure
f7ff3027ef00 mmc: via-sdmmc: cancel card-detect work on remove
82e707eff9e3 platform/x86: ISST: Validate socket ID in clos_assoc ioctl
1889a9156553 platform/x86: ISST: Validate level in perf mask ioctls
22222f92b0a5 platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer
cab289572951 iommufd: Fix UAF in selftest IOPF reporting
4c33d00ad9a9 iommufd: Release current IOAS on xa_store() failure
436189ee4bb2 iommufd: Avoid locking internal accesses during unmap
45705a6bfdb2 iommu/vt-d: Force requesting ACS when tboot is enabled
364279b5623f iommu/vt-d: Fix no_iommu to disable platform opt-in
f80f3acb6916 iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add
2235eafda9b3 iommu/arm-smmu-v3: Manage teardown with devm
d903d99ffd22 iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field
968e9a1f7114 iommu/sva: Set handle->dev before the SVA handle is visible
f532401be931 iommu/msm: Unwind probe state on registration failure
cfc5c1b2caa1 iommu/amd: Put PCI device after handling PPR faults
238e1f7a1463 PCI/proc: Warn on writes to kernel-exclusive config space regions
c2d4174f4924 PCI/proc: Use file_ns_capable() when checking config space read access
301288f85679 PCI/proc: Avoid spurious runtime PM wakeup on config space accesses
b30713111325 PCI/MSI: Enable memory decoding before restoring MSI-X messages
0e59a232aaa0 PCI/ASPM: Avoid L0s for Realtek RTS525A
39c4dc79d77f PCI/AER: Fix mapping of errors to agent & layer
4f887d8ed75f PCI/AER: Emit TLP Log only for unmasked errors
6beadccc432c PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses
7f4db64f0ba7 PCI/sysfs: Fix read byte order in pci_read_legacy_io()
43cf455dd5a9 PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608]
4b575052ea65 PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts()
01c2f0c66bd1 PCI: plda: Fix use-after-free of event IRQs during teardown
5d4bc470330a PCI: meson: Fix GPIO state while requesting PERST#
1ad699485385 PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk
6053d6eacbfd PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip
ceafb262475a s390/dasd: Propagate partial completion length across ERP recovery
6452c13646af s390/dasd: Guard sysfs discipline callbacks against unallocated private data
52b331c99baa s390/dasd: Do not complete a failed ESE read as successful
dcce7a06ea69 s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks
aad7247bd35a power: supply: max17040: synchronize work cancellation on suspend
17d43f64b17e power: supply: max17040: drop incorrect I2C functionality check
13fb0477da9b power: supply: max17040: propagate register read errors
39b60d615dfa power: supply: ucs1002: fix use-after-free on remove
a4460e89d408 power: supply: twl4030_charger: cancel workers via devm
1b9978433c61 power: supply: rt9455: quiesce delayed work before teardown
ee053561e21c power: supply: qcom_battmgr: terminate the strings from firmware
06618447029c power: supply: qcom_battmgr: fix use-after-free
b3aa1e9509e1 power: supply: lp8788-charger: fix use-after-free on remove
ab6b1ad710be power: supply: lp8727: fix use-after-free in lp8727_release_irq()
4b1f2be1e1b7 power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS
78be8b7403ff power: supply: cros_usbpd-charger: bound the EC-reported port count
86e4fa65368f power: supply: charger-manager: register regulators before exposing sysfs
238320ad029a power: supply: bq25890: Fix power_supply reference leak
9e1aba34df9a power: supply: bq256xx: drain usb_work before freeing the charger
f495808cdd6d power: supply: bq24257: fix use-after-free on remove
d02a5794c3de sctp: fix stream->outcnt underflow on duplicate RECONF responses
7ad8933bca97 sctp: distinguish sequence zero from wildcard in reconf lookup
25419f516ea8 sctp: fix NULL deref on untransmitted RECONF completion
1035bdef1efb sctp: drop a chunk if its transport was removed
fa306a40e716 sctp: stop processing a packet once its association is deleted
8a02ad98798f nvme-tcp: reject a read that transferred too few bytes
3b3d27670c0c nvme-tcp: fix host memory disclosure on R2T for a read command
6a01b5826310 nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone
0d4f317b07d6 nvme-pci: disable controller on admin queue IRQ setup failure
67551d8430df nvme: zero the discard fallback page
1e456cc2744e nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path
d662f7fc04fd lockd: fix NULL dereference on lockowner allocation failure
41f0a6d31615 lockd: pin next file across nlm_inspect_file lock-drop
3088e41292fe ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user()
6aeff1636b39 i2c: mxs: fix DMA channel leak on probe error
8d2c120d2d5b hwmon: (max6621) fix temperature clamp range
9b38d9a2e46a hwmon: (max6621) fix negative temperature offset and crit readings
68c59343ad1a ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC
f2a1a83487c6 arm64: proton-pack: Restore the nospectre_bhb command-line option
e7c9b1d433b0 arm64: compat: Fix decrementing LDM/STM alignment emulation
15d1feeae07d ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion
e41a59fc056f openvswitch: only skb_tx_error() a packet we are about to drop
d64a75369cd0 openrisc: fix arbitrary kernel memory access via or1k_atomic syscall
c0c165487a2e ocfs2: fix readdir position truncation on 32-bit kernels
0608018a71f2 ocfs2: cluster: fix o2hb_dependent_users leak on pin failure
251e38f5af7b ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item
ce035f208d68 ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin()
0761d2c94944 ocfs2: validate rl_used against rl_count in refcount block validator
50c4cc9183e1 ocfs2: validate lengths in dlm_mig_lockres_handler
de10cd3b062a ocfs2: bound namelen in dlm_migrate_request_handler
71f07b7f90b3 ocfs2: always run deallocs on copy-on-write completion
116d14f29a05 orangefs: skip leading spaces before parsing client debug masks
f796f38a324e orangefs: fix double-free of trailer_buf on readdir copy failure
bc6fdd425fde PM: sleep: Unblock runtime PM when device prepare fails
6fcb0b745a0b ring-buffer: Hold cpu_buffer::lock when resizing a subbuf
8c1ecdcdea73 ring-buffer: Free cpu_buffer::free_page with subbuf_order
2dc510957fe8 ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page()
1c3036a81800 regulator: qcom-refgen: correct the regulator type to CURRENT
20e5fbb8c1a4 regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata
95342d26f9c6 regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer
71d5c41ac583 RDMA/uverbs: Add UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR
4f8bb11dd2ff RDMA/ucma: Lock the handler in ucma_write_cm_event()
28ac2dd41648 RDMA/ucma: Lock the handler in ucma_set_ib_path()
a38cd610b24f RDMA/ionic: Cap eq_count to the eth driver's interrupt vector budget
85f438382a86 RDMA/cxgb4: Cancel reg_work before freeing device on remove
2a952fb1b20d qede: Fix NULL pointer dereference in TPA fragment processing
3f5677d2f817 ptp: vmclock: prevent read-only mappings from becoming writable
c7e32814a6bf remoteproc: scp: Fix device reference leak on failed lookup
37797d5013c9 riscv: unaligned: stop using kthread for check_vector_unaligned_access()
8f392916a354 riscv: acpi: Handle LPI architectural context loss flags
5343399ed724 arm64: dts: rockchip: Fix rk3588s-roc-pc audio description
8fc4bafabc06 arm64: dts: rockchip: Fix rk3399-roc-pc-plus analog audio
650d2d5c0df7 arm64: dts: rockchip: fix emmc reset polarity on px30-cobra
5512c2323120 arm64: dts: rockchip: fix eMMC reset polarity on PX30 Ringneck
fe455c13bf01 arm64: dts: rockchip: fix eMMC reset polarity on PP-1516
b6b3e4d5973b arm64: dts: qcom: x1-dell-thena: mark l12b and l15b always-on
6bb9469c34ff arm64: dts: qcom: sm6115-pro1x: Correct touchscreen GPIO flags
ff23eb4823d8 Revert "arm64: dts: rockchip: Further describe the WiFi for the Pinephone Pro"
eb57632f9418 rpmsg: glink: smem: order FIFO read after availability check
e7143c3f4e5c scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()
2a8dd9fd12f3 media: staging/ipu7: fix async notifier UAF on probe error path
7f6956b6dcd6 staging: media: tegra-video: vi: fix probe failure on skipped last port
656d047dc0c2 staging: media: tegra-video: fix of_node_put() on VIP parse errors
5be6d02837d4 wifi: mt76: mt7925: cancel pending mlo_pm_work
e1330d719c04 wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets
b95c33a4e743 udf: reject VAT indexes equal to the entry count
f84ec84d8d4b svcrdma: Validate Read chunk positions before reconstruction
a798714b5804 svcrdma: Reject Write/Reply chunks with segcount 0
1949dd1576f7 svcrdma: Reject inline replies that overflow the pull-up buffer
3cf372cec7ab svcrdma: Reject connection when transport allocation fails
5aabe070c00e svcrdma: Fix unmatched rn_unregister on failed accept
a1c954ca4977 svcrdma: Fix pcl_for_each_segment for empty chunks
a46b35f213c2 svcrdma: Fix offset arithmetic in read_chunk_range
1de391e8b94e SUNRPC: wait for in-flight client TLS handshake callback
1f9856af065b SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field
7a1d0501cbb9 SUNRPC: reject duplicate CREDS_VALUE options
edeefb111d61 sunrpc: init gssp_lock before publishing proc entry
ebcbd2523a85 SUNRPC: harden gss_unwrap_resp_priv length checks
806584a4b67a SUNRPC: harden gss_krb5_unwrap_v2 against short tokens
fa46b6aa7a69 SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat
e769fcde3cc7 sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir
08bc49e05412 sunrpc: defer rq_argp and rq_resp free until after RCU grace period
bd1ef2cfb44d SUNRPC: Check svc pool percpu counter allocation
2e861ce2aaa4 SUNRPC: always drain cache_cleaner before destroying a cache_detail
39981133df21 SUNRPC: Restore NUMA_NO_NODE for svc thread allocations in global mode
9d04d64ad192 sunrpc: route to a populated pool in svc_pool_for_cpu()
de942dd8c2c8 SUNRPC: svcauth_gss: enforce krb5 token minimum length
e0778464049b SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry
ad0cce80d4af SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow
f1b7b2c7ffa9 phy: fsl-imx8mq-usb: fix typec switch leak on probe error path
704ecd010d4a params: fix charp corruption on allocation failure
ff110e85837d nouveau/gem: reserve the bo in the info ioctl around the vma lookup
04ab51d4e369 module/kallsyms: fix nextval for data symbol lookup
51887ccd8879 mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction
d82b90a38c2c mpls: reload header after pskb_may_pull()
50d0aa7d25ba module: validate string table section types
3b097416b4cf md: do overflow check for sb->bblog_shift in super_1_load()
0efabe6229dc md/raid10: fix still_degraded being inverted in raid10_sync_request()
121d35014e49 mailbox: qcom-ipcc: fix duplicate channel allocation across holes
09e649117c54 libnvdimm/labels: Prevent integer overflow in __nd_label_validate()
627ce4902df1 landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation
a602cd128d17 ipv6: use RCU iterator to dump route exceptions
63f50e9f90d0 ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv()
b8282668d8fa ip6_gre: fix hardware header length for NBMA tunnels
b36dfd6e8cff ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()
a8af6fbac895 ip: orphan prefetched skbs before multicast forwarding
31e4be21dace ipip: fix skb leak in collect_md mode when metadata_dst allocation fails
f9182a85991a jbd2: check need_resched() when skipping busy checkpoint buffers
71c6b872c746 jbd2: bound shrinker scans by examined checkpoint buffers
30e8cb8598aa kasan: fix cache shrink race with CPU hotplug
15deb4e33f47 Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request
657054159d83 Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative
94d548fc264a Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative
1bad0896cbc0 Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection
d0b28e9655f4 Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb
68e7a31abc88 Bluetooth: hci_conn: re-enable advertising only for peripheral role
946d76db77ee Bluetooth: RFCOMM: serialize security confirmation handling
49fd7116f76b Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready
ec3992e38f77 Bluetooth: hci_uart: Fix false success return in hci_uart_setup()
62100186f177 Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative
1ed5982c5369 Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378
c674c504bfdd cxl/pmem: Format the nvdimm serial number as unsigned decimal
14d52c15d5d9 cxl/features: bound fwctl command payload to the input buffer
2924b2e36514 cpufreq: schedutil: Fix rate limit overflow
a807a9ef87ad coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior
ac4a5eb8b002 dm array: reject an array block whose value size is not the caller's
b33f76d33aae dm array: validate array block headers on read
644140527ae4 dm raid1: reserve space for NUL-terminator in build_constructor_string()
36ff918637e3 dm-era: fix shadowed superblock leak on take-snap failure
49694a363f7e dm-io: report non-retryable errors separatedly
9493ac67623d dm-io: clone the source bio instead of copying its biovec
272fcb4ba6fa bpf: Harden bloom filter sizing and indexing on 32-bit kernels
c9189693db47 buffer: avoid tail commit walk for uptodate folios
dbfecc8a6631 bpf: Disable preemption in __bpf_get_stack
6886642414f5 bpf, x86: Fix per-CPU address resolution into an extended register
49dcefa83c8a bnxt_en: Write doorbell when linearizing skb fails
4d36e38e4834 bnx2x: fix double free in bnx2x_init_firmware() error path
c21fa79301d7 Bluetooth: eir: Fix OOB read in eir_get_service_data()
f609eac02d11 Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728
bce588b4ca08 Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU
aa7b93fe98ba Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU
ce76ca5fb279 block: set QUEUE_FLAG_DYING unconditionally in blk_mark_disk_dead()
84858671842a auxdisplay: charlcd: cancel backlight work on registration failure
c2e3dccd6870 ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes
fdc0a5e2cbac ARM: 9477/1: Disable broken eBPF JIT on the Risc PC
87d07aa5d38b alpha: marvel: Fix lock ordering in init_io7_irqs()
9e1eefc01912 alpha: marvel: Fix irq_set_status_flags to use correct IRQ number
2fd984c44e3e alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write()
6d4ed2fd022b ACPI: pfr_update: fix stack buffer overflow in query_capability()
452eb28e0301 ACPI: APEI: GHES: fix ARM section length accounting after header
b7476b29b696 ACPI: APEI: Fix ERST timeout unit conversion
c735dbce7ad0 acpi/apei/ghes: Use raw_spinlock_t for CXL CPER work locks
9ad8821573a3 accel/rocket: Fix error path handling in rocket_job_run()
304323029665 accel/rocket: initialize job domain before cleanup paths
c1a5bf1b6e1d accel/rocket: fix NULL dereference and integer overflow in rocket_job_push()
a3c65af20cce hugetlb: only adjust reservation during unmapping if mapcount is 0
4e019e5e247b hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device
137c61a6cfd9 fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration
0c3f4544ff38 forcedeth: fix off-by-one when saving/restoring non-PCI config space
466a8af0dee2 fbdev: uvesafb: unregister connector callback on init failure
3bcab9b21f71 fbdev: ssd1307fb: defer I2C transfers from damage callbacks
3c1b5809615c fbdev: pvr2fb: correct user pointer annotation and sentinel initializer
76818e81cfca fbdev: omapfb: panel-dsi-cm: initialize lock before registering display
2f66f8ceefc2 fat: restore original value when fat_ent_write failed
66aa9a9e6481 fanotify: fix use-after-free of file range info
92895a14329c efivarfs: Rate limit statfs() handler
ce568f6e025d ecryptfs: show filename encryption options
9319706316a8 ecryptfs: release message context on send failure
b31da1ecf139 ecryptfs: reject too-small tag 70 packets
14cb36a500a5 ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet
e5d254e654f2 ecryptfs: pass packet set buffer size to parser
0d9636ecba34 ecryptfs: hold msg ctx list lock when cleaning daemon queue
c1bc956a615d ecryptfs: fix tag 11 packet exact-fit size check
98b890563424 eCryptfs: bound the packet-length peek to the user buffer
7ccb94901f38 fs/ntfs3: bound page_lcns[] index by the log record
376ee45659a4 fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()
2d94ffc9d7b5 fs/ntfs3: validate dirty page table on log replay
5333e18e6b42 eventfs: Initialize ei->children and ei->list in init_ei()
b2301bdb4b3e HID: intel-thc-hid: intel-quickspi: fix autosuspend cleanup during teardown
99f3e197920d HID: intel-thc-hid: intel-quicki2c: fix autosuspend cleanup during teardown
72706b44b665 HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer
6fcefe71aeb5 HID: intel-thc-hid: intel-quickspi: validate report size before copy
127de5919820 HID: mcp2221: validate report size in mcp2221_raw_event()
c99ba6c234d4 HID: mcp2221: stop device IO before hid_hw_stop
01d9874e84d3 HID: universal-pidff: stop the device when force-feedback init fails
114a58640aaf HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind
f3f37b937a6e HID: sensor: custom: Fix field sysfs group cleanup on failure
da00eac19fee HID: roccat: free buffered reports when destroying device
471f4a939c66 HID: picolcd: clamp eeprom debugfs read to bytes actually received
79465a30050d HID: corsair-void: Check size of status and firmware events before reading them
e78973fe3ef5 HID: apple: preserve keyboard backlight across T2 resume
846f0709559b smb: client: harden DFS cache against invalid target hints
17a1922ada87 smb: client: fix copy-paste error in WSL EA length accounting for $LXDEV
1f824f61d1df smb: client: fix ALIGN() overflow in symlink_data() error context loop
9ab46a13798a smb: client: clear ce->tgthint in free_tgts()
8b9b10fe5b8b cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC
c2a0dcb5a7a1 cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0
4f18c9e7ee46 cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size()
636a99bab36b audit: avoid dropping live tree ref on fsnotify rule autoremove
25128202a8df btrfs: do not overwrite NODATASUM flag when removing NODATACOW flag
f42efd634c0a btrfs: fix extent map leak in NOCOW direct I/O write
8a64baeb5bbb btrfs: drop recovered reloc root refs on recovery failure
ec32015a955c ceph: fix leaked inode reference on writeback abort at umount
37d6edb2f03b ceph: do not repeat ceph_trim_dentries() if no progress possible
1dd356310b16 ceph: bound xattr value length in __build_xattrs()
58c2d3e954c1 ceph: bound num_export_targets array for mds info v2/v3
c37db86d2b5e ceph: bound MDSCapAuth path and fs_name decode in handle_session()
06fb5e623cdc ceph: bound copied dentry name length in NFS export get_name
4d298880f82c ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode
fe46746087b5 ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock
00562ccd4e88 libceph: reject buckets with mismatched CRUSH ids
2571b3588326 libceph: validate OSD extent maps before cursor advance
b413ec5b23e3 NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup
4804c58f73a8 NFSD: Prevent lock owner use-after-free during client teardown
b56d2c5f01cd nfsd: revoke copy-notify stateids before dropping their reference
dbc11a12aa54 nfsd: reject reclaim LOCK after RECLAIM_COMPLETE
ad02d095439f nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE
54e02f5e32c5 nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops
4ae5d7490ae6 nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd()
b57bd8cb739c nfsd: initialize DRC hash table before registering shrinker
a4d7fedcaaf3 nfsd: initialize copy-notify stateid before publishing it
763c0bad8723 nfsd: hold rcu across localio cmpxchg retry
b3bff820d068 nfsd: gate nfs3 setacl by argp->mask
f951b22dbeec nfsd: gate nfs2 setacl by argp->mask
41ebca28e17f nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo
0380129b1373 nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget
4106d7a6aaf1 nfsd: fix version mismatch loops in nfsd_acl_init_request()
9b4e5e9ba5ae nfsd: fix stale s2s_cp_stateids IDR entry for async COPY
2ebbf4e3e9cf nfsd: fix reply size estimate for GET_DIR_DELEGATION
cf081015a0d1 nfsd: fix refcount leak in nfsd_file_lru_add on insertion failure
3c5119b799a7 nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs
424d5c95108a nfsd: fix nfsd_file leak on inter-server COPY setup failure
360e1b9e3f31 nfsd: fix netlink dumpit error handling for rpc_status_get
65c79d9bb371 nfsd: fix FL_SLEEP being set unconditionally for all LOCK types
c1ae0f973bcb nfsd: fix dentry ref leak on V4ROOT export filehandle lookup
a631a26a8777 nfsd: fix cpntf publish race in nfs4_init_cp_state
607a56fea772 nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke
00843074d9b8 nfsd: drop the stateid, not the stateowner, on seqid_op replay retry
72d40b103bb0 nfsd: don't free session slots that are still in use
6703199f4d7e nfsd: defer vfree of compound ops to fix rpc_status UAF
631b7d5dbbba nfsd: defer setting NFSD4_CALLBACK_RUNNING in deleg_reaper
e879148867bd nfsd: clear opcnt on compound arg release to prevent OOB read
b137930ee52e nfsd: clear CALLBACK_RUNNING on failed delegation recall queue
b42dc26a14b4 nfsd: check client ownership when cancelling a copy-notify stateid
311f7d926630 nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref
1aea0482b98e nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry
bff024551a71 nfsd: add filehandle match check to nfsd4_delegreturn()
533964d420d3 nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()
895a485cd375 nfsd: validate symlink target length in NFSv4 CREATE
2aca70c18c5f nfsd: validate sockaddr length per family in listener_set
7e7b93da7fa2 nfsd: validate nseconds in TIME_DELEG decode paths
7ff8d6363cff nfsd: size fh_verify server sockaddr slot by xpt_locallen
1e4795766719 nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations
8277d4a11ae2 nfsd: sample writeback error cursor before async COPY loop
fc83f30731dd nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types
591134e059e3 nfsd: Reset write verifier when async COPY writeback fails
467d56fd3ff5 nfsd: release path refs on follow_down() error
f164eb52b6f3 nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown
dc803d46a8b9 pNFS: Fix EBUSY check in pnfs_layout_need_return
36e3f13bf072 NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path
59baf45a0643 nfsd: guard nfsd_serv deref in nfsd_file_net_dispose
7ef182a8fe9c NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check
4ed8d2317aef NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock
75d13317f163 NFSD: Fix off-by-one in DRC bucket pruning limit
e547b06234f8 NFSD: Encode only the status in NFS-ACL v2 GETACL error replies
d8352da19634 NFSD: check truncate permission under inode lock
f3adf1643517 NFS: fix delegation_hash_table leak when nfs4_server_common_setup() fails
5215e734bf7c NFS/localio: fix ref leak on nfs_uuid_add_file failure
344ae0e232d4 zsmalloc: account for handle size in class lookup
923578d0f0d0 zram: validate deflate params
a1dc246f98bb ubifs: fix out-of-bounds read in signature length check
14afe18655c0 phy: rockchip-samsung-dcphy: fix out-of-range max_register
e892f05f1f79 PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io()
9253cfc5a85b of: fix out-of-bounds read in of_alias_scan() stem parser
448636c745a3 nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation
8c14472431e2 media: vicodec: fix out-of-bounds write in FWHT encoder
0c260d3f97e5 media: cec: stm32: prevent out-of-bounds write on RX overflow
7d658da725ea lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()
9f43499ce645 HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature
827ec385458a fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write
34e88f536146 usb: gadget: f_fs: Prevent deadlock during ep0 read loop
9897b7da8c0a usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()
dbe2762ae8e5 usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init()
6bcd9ee6ad69 usb: gadget: f_tcm: fix deadlock in usbg_make_tpg()
a15c2acd3083 usb: gadget: midi2: remove default configfs groups on teardown
64005cf3e897 usb: gadget: snps_udc_plat: clean up PHY on probe deferral
4e747c864a88 usb: gadget: u_audio: Fix use-after-free on sound card disconnect
14fa29f3be06 usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion
ebb840d982a6 usb: typec: thunderbolt: Disable work before freeing tbt on remove
d793bd8422e7 usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive()
12414bbd3e3f USB: phy: fsl-usb: fix missing static keywords
51a311eb97e9 usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed
448e95c0f3ea usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition
316abfe39dce usb: dwc2: gadget: Exit partial power down state when changing USB pull-up
78f5c6e6aef9 staging: greybus: hid: fix SET_REPORT return value
28b932202fcd serial: imx: serialize imx_uart_ports[] lifetime
aad08b5f67d2 Revert "media: v4l2-dev: fix error handling in __video_register_device()"
e6e925cc1f80 rapidio: mport_cdev: fix use-after-free in dma_req_free()
c3d4be91c6fc powerpc/powermac: fix OF node refcount
29e634a18957 misc: nsm: bound the device-reported response length
ba69d892ff4e device property: fix infinite loop in fwnode_for_each_child_node()
4cd24873ab9f cdx: Fix double free when sysfs file creation fails
b1a49c22de01 tracing: Fix use-after-free with same-name named triggers
ddbe921ed16a tracing: Fix use-after-free in trace_pipe read on sub-buffer order change
cdb6fb6cf1a7 tracing: Fix logged instance name on creation failure
adadf4192f70 tracing: Fix crash passing ERR_PTR to kthread_stop()
25a0758cf6bd tracing/user_events: Clear copied tracing state before fork duplication
b503a61d5d39 hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start()
9b51dcb4f230 x86/tdx: Fix zero-extension for 32-bit port I/O
c4a221548708 x86/tdx: Fix off-by-one in port I/O handling
b9ae969e6f1e x86/locking: Use sfence for wmb() if SSE is available
08b4cdef3c2e x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg()
968eea465942 tools/compiler: match glibc 2.42 definition of __attribute_const__
d4bf3a74e2ba mm: vmscan: fix node reclaim ignoring swappiness parameter
461d23368f29 mm: page_alloc: fix non-movable reclaim storm in defrag_mode
d435ba3c21a0 mm: page_alloc: move capture_control to the page allocator
0df04778ea14 mm: page_alloc: __GFP_FS lockdep annotation for direct compaction
b3d4b65085ef mm: mempolicy: fix automatic numa balancing for shmem
5d866086d5f8 mm: memcontrol: update state_local when flushing NMI stats
95d87030cae7 mm: memcg: stop reclaim when a limit update is superseded
680b93894ddf mm: memcg-v1: fix memsw and TCP failcnt accounting
d0943afb5ed8 mm: memcg-v1: fix wrong linux-mm list address in deprecation warnings
295f5a61d3ae mm: compaction: support non-movable compaction for pageblock requests
ef765a2e4f57 mm/zswap: fix global shrinker when memory cgroup is disabled
3fd502399863 mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec()
895cd4ecbb2e mm/pagewalk: fix stale walk->action escaping walk_pmd_range()
45489d4f9580 mm/mm_init: deferred_grow_zone(): fix out-of-range first_deferred_pfn
5dc0daff0341 mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()
3fc8044251de mm/kmemleak: avoid soft lockup when scanning task stacks
2cfa9ae90813 mm/gup: fix always draining LRU caches in collect_longterm_unpinnable_folios()
d423737dca23 mm, swap: ratelimit bad swap entry reports
f2c14f4d427d include/linux/list.h: mark list_add and __list_add as __always_inline
28069434aef6 apparmor: fix out-of-bounds write when null terminating a label vec
587a6a92b93e apparmor: fix cred UAF caused by begin_current_label_crit_section()
753c978f2400 KEYS: trusted: Fix TPM teardown ordering
0a10989de610 rust: kernel: list: fix incorrect pop_back example comment
138722d631ac rust: bug: skip arch-specific asm in `testlib` builds
2bf5e8f7c9bf timers/itimer: Zero-init old itimerval before copy to userspace
e6da8a0f3976 powerpc/pseries/iommu: switch to Default DMA window during kdump
c03114634d34 fs: fix user path of nested backing files
bf38be01d43c clocksource/drivers/timer-sun4i: Advertise a real minimum delta
d53c29a89a15 clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path
312f85fdd029 alpha: don't leak hardware-fabricated FP exception bits to user space
c25b2aa077d5 rust: time: fix as_micros_ceil() rounding near i64::MAX
7d00a3ff6244 alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally
4628e40c9ca7 drm/amd/display: Prune per-tile Timing from Apple Studio Display Primary Tile
7d860bed1336 drm/amd/display: hide Apple Studio Display secondary tile
c6b915f0df31 drm/amd/display: Refactor amdgpu_dm_connector_detect (v2)
a1fa3d1197cc drm/amd/display: Skip PHY SSC reduction on some 8K panels
d5c9d19b0ff2 netfs: Fix missing locking around retry adding new subreqs
ce493f9261cd platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmi_dev_evaluate_int()
2ab18de5ebb1 drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths
24ebaf6676ae nsfs: tighten permission checks for handle opening
ea150ffa9fc9 bpf: Fix incorrect pruning due to atomic fetch precision tracking
5d562153b471 ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS
a8bbb2a60513 fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free
5fc3d921512d wifi: ath11k: fix memory leaks in beacon template setup
8527ac1bce87 wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req()
c79ef3342632 perf/x86/intel/uncore: Fix die ID init and look up bugs