8bab3e07b105 Linux 6.18.54-xanmod1 867f462b0bcd x86/build/64: Fix kconfig recursive dependency cfeec564ed59 XANMOD: Makefile: Move x86 instruction set selection to kernel-wide build [v6.18.54+] b0eb53a7822e x86/kconfig: more x86-64 ISA levels and uarches [v6.18.54+] 327603557267 Merge tag 'v6.18.54' into 6.18 f3b5493c81ab Revert "x86/kconfig: more x86-64 ISA levels and uarches" 1313bbcb930e Revert "XANMOD: Makefile: Move x86 instruction set selection to kernel-wide build" 1b357ecb3213 Linux 6.18.54 c8c7639aa324 smb/client: send lease break ACKs thru correct session for multiuser mounts 024eb5c4cea0 Revert "ksmbd: Fix to handle removal of rfc1002 header from smb_hdr" 74f179e75ab0 Bluetooth: hci_qca: fix NULL pointer dereference in qca_setup() for non-serdev device 8a143f91f1f7 ASoC: sdw_utils: subtract the endpoint that is not present 3c8f0ae0d3b0 wifi: mac80211: fix list iteration in ieee80211_add_virtual_monitor() 5a93dbeb555d ksmbd: fix partial normalized name responses d1152c96a300 smb: client: fix reparse buffer bounds in cifs_query_reparse_point() ac7c08626f67 wifi: libipw: reject TKIP frames without a full MIC 87b9893107ea wifi: ipw2x00: Use michael_mic() from cfg80211 dcbb37bb1f1e wifi: mac80211, cfg80211: Export michael_mic() and move it to cfg80211 47e09d6fd0bf wifi: ipw2x00: Rename michael_mic() to libipw_michael_mic() aeaa7bdc0ea2 drm/amdgpu: hold a runtime PM reference for P2P dma-buf attachments 801d8647dcb0 drm/amdgpu: lock bo before calling amdgpu_vm_bo_update_shared b8f46ca5cbd6 xfs: fix under-reservation of blocks when repairing sf directories 24beea233aae xfs: remove the i_ino field in struct xfs_inode 1e0a34f690e5 xfs: convert xchk_inode_xref_set_corrupt to xchk_ip_xref_set_corrupt 34b3b32fb1a9 xfs: add a xfs_rmap_inode_owner helper a6767712902b smb: client: fix cifsFileInfo reference leak in deferred close 226e066932b5 scsi: fnic: Fix missed link-up when critical IRQ targets offline CPU d2494dc0d9de scsi: fnic: Bump up version number again 8118e473d7a1 scsi: fnic: Make debug logging protocol independent d1b7ca587d81 scsi: fnic: Bump up version number 822214913b12 scsi: fnic: Rename fnic_scsi_fcpio_reset() abe15e643e57 wifi: mac80211: refuse to make a monitor active when it has no queue 07c78e1b1690 wifi: mac80211: track MU-MIMO configuration on disabled interfaces fb5400bff669 mm/vma: correctly unaccount on mmap_prepare() failure 88871ab548c1 9p: Fix v9fs_issue_write() to update i_size and remote_i_size a548c7abf65b mm/huge_memory: bypass THP tuneables for huge pfnmap mappings 148db154066b xfrm: save input state data before secpath resets 1acd93259b6b xfrm: Fix dev use-after-free in xfrm async resumption e29d6ab39ea3 xfrm: Refactor xfrm_input lock to reduce contention with RSS 621c36573982 signal: Prevent exec() race 9eeb282ae6d5 signal: Move MMCID exit out of sighand lock 79c55a7b5d71 ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity 722ee726148e ALSA: usb-audio: Optimize the copy of packet sizes for implicit fb handling 9fc87899276a smb: client: fix busy dentry warning on unmount after DIO 4cc1bb956993 ntsync: reject wait ioctls with zero owner fe474ad6dc48 ntsync: Honour caller's time namespace for absolute MONOTONIC timeouts 29bd40e11126 time/namespace: Export init_time_ns and do_timens_ktime_to_host() 36981ba106d9 HID: asus: fortify keyboard handshake 2f8ed71aaaba smb: client: fix missing iov bounds check in parse_posix_sids() 62b50ebc5ded smb: client: fix missing lower-bound check on DFS referral string offsets ebb8a075fdc7 smb: client: fix server->total_read for compound encrypted PDUs 1cdf0d304d82 smb: client: fix potential OOB read in smb3_enum_snapshots() 34a3942e787b smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs() 96c436e4b010 smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs a1d2a407fdc1 smb: client: fix unaligned access in WSL reparse point parser 928edc4bd6a6 smb: client: fix smbd_connection leak on cifs_get_tcp_session() error a3e4c288e933 smb: client: reject short Next offsets in parse_server_interfaces() e99040e5e9c6 smb: client: fix use-after-free of iface in cifs_try_adding_channels() 04082b183385 smb: client: fix rlist race and missing initialization 7ab9ceedd860 smb: client: cancel reconnect work in clean_demultiplex_info() cd55dde2b637 drm/amdgpu: fix rmmio iounmap skipped on device removal d81bf4581903 drm/msm: RCU-free the scheduler-containing ring and VM objects f41e64aca2e6 drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure 7b7b590d721f drm/msm/dpu: clear pending peripheral flush state 57322415b079 drm/msm/adreno: fix autosuspend cleanup during teardown e84425f789fa drm/gud: Ignore damage clips in full update mode 2c92af27ad23 drm/gud: fix out-of-bounds write in gud_plane_atomic_check() 432c8532d5cc wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver 71612bda2115 wifi: mwifiex: validate action frame fixed fields 5747eaa38a7f wifi: mwifiex: prevent authentication frame length truncation 9cff2f39ed38 wifi: mwifiex: validate scan response extents 8bbef2b1ebfb wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length d2fb6b588dc5 wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST 3bdcc4d61212 wifi: p54: validate curve data length in the calibration curve converters 4f86fb6f9dce wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() 68b786691ce2 wifi: wilc1000: fix out-of-bounds read in P2P public action frames 7f1f25b2db14 wifi: wlcore: release runtime PM ref on regdomain config failure 2bddc5d088cf wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown f4f2852b664c wifi: rsi: fix heap OOB write on key removal e82536aad653 wifi: libertas_tf: fix UAF in lbtf_free_adapter() 55d34422c0d9 wifi: iwlegacy: fix broadcast stations deallocation 1edb3ddd261e wifi: brcmsmac: fix UAF in brcms_free_timer() 405e575444b7 watchdog: starfive-wdt: Fix runtime PM leak in starfive_wdt_pm_start() 0e2302dc2324 watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init() eb14ee406e1d watchdog: rzv2h: Avoid division by zero b4ede87765a2 watchdog: rtd119x: Avoid division by zero efb76b8ba522 watchdog: msc313e: Propagate error code in resume() 61bcb2403bde watchdog: msc313e: Fix premature reset during timeout update 1e995d1eef00 watchdog: digicolor: Avoid division by zero 960d1c85381b watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog 8319a4142f7d hwmon: (cgbc-hwmon) Add missing sensors 3a5bfc3145c0 hwmon: (cgbc-hwmon) Fix current sensors ID lookup 1fd330df340c hwmon: (w83793) release probe data through kref 2c381e6e0f03 hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove a5ce3fe5335a hwmon: (pwm-fan) Stop RPM timer before freeing tach data d84769ab7aae hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676 ec7443983cab hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding 9558fc1e042a hwmon: (pmbus/core) increase number of phases and add new mask 72c85149794a hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show() 0d05b43b55d4 Input: zero ff_effect before compat copy in input_ff_effect_from_user fa1713dc3d43 Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound f16f62b7462f Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722) 8a70a192e3e5 Input: soc_button_array - check btns_desc->package.count 518c9f2b8ab4 Input: soc_button_array - fix MS Surface Pro 11 probe failure dc05ec97b829 Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() 8202e2cb3db2 Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P d1704059be95 Input: hp_sdc - shut down kicker timer on module exit 71e5619db11d Input: evdev - zero absinfo before partial copy in EVIOCSABS 9eb261092d4c Input: cyttsp5 - clamp the HID report size before memcpy 143330cc00d5 Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026 a0a73ae16b57 Input: adp5588-keys - cache GPIO state before registering the gpiochip bb8c4aa9a0dc mmc: sdhci_am654: Fallback to DT-provided itap delay on DDR50 tuning failure 818ec2ffc985 mmc: sdhci_am654: Clear ITAPDLY on tuning failure bf1e2c818559 mmc: sdhci_am654: Reset command and data lines on failed tuning f6bf12758013 mmc: sdhci_am654: Move tuning_loop to local variable 4885e587f1af mmc: spi: reset bytes_xfered before retrying CRC failures ba4118e164ab mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt ac866db277a4 mmc: sdio_uart: fix xmit_fifo leak when the port table is full 15b5ffd8af2d mmc: sdhci-of-aspeed: Remove children before releasing SDC resources 58c1a7a41c3f mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260 23383e0578b5 mmc: mxcmmc: cancel data work and watchdog on remove 7fecf79f3156 mmc: mmci: Fix use-after-free in busy-timeout work 8439bf262ce3 mmc: hsq: Fix use-after-free in retry work 2d48c5a611b7 mmc: core: Fix OF node reference leak on card add failure 4553b5004eca mmc: core: Cancel SDIO IRQ work before freeing host a2890c1eb96d power: sequencing: fix NULL-pointer dereference in pwrseq_device_register() 859880b07a75 power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new() 244aacaa5e31 power: sequencing: don't call .post_enable() if pwrseq_unit_enable() failed 24e00850bcff selinux: always fill AVC decision in avc_has_perm_noaudit() d127c7e1f3e1 selinux: recheck intermediate backing files on mprotect() 9d99b770e7b6 selinux: preserve user SID across nested backing files 180752deb727 IB/hfi1: Fix the PIO_CRED credit-return mmap 352eab79c004 IB/hfi1: Resolve the credit-return buffer through the send context's node ffb80872617b IB/mlx4: Fix use-after-free on pkey sysfs registration failure 66c7c59cb74e i2c: imx: disable autosuspend on remove a114c27eb5a9 i2c: imx: release DMA channels on probe error 8b6230a17439 i2c: qcom-cci: fix device_node refcount leak in cci_probe()/cci_remove() eabf7a3d33cd i2c: atr: fix dangling adapter pointer on add failure 48285f272770 i2c: at91: release DMA channels on remove and probe error 9ddbc5f4bb49 KEYS: trusted: Fix tpm2_load_cmd() boundary check cdc17d8ab62a keys: translate request_key_auth pid for the reading procfs instance a1a98eca102b KEYS: encrypted: fix integer overflow of datablob_len 2897601dffe5 mm: filemap: retain mapped dropbehind folios 6e3fe3102005 mm/mremap: account mm->locked_vm correctly for MREMAP_DONTUNMAP f5d0e92e2354 mm/mlock: use the IRQ-safe accessor for NR_MLOCK in __munlock_folio() 0a41a46859df mm, swap: fix SWAP_USAGE_OFFLIST_BIT collision with real usage count 6611f78ec3fd memstick: ms_block: destroy io_queue workqueue on removal d5cdff14c385 memcg: avoid charging the root memcg from obj_cgroup_charge_pages() 4450102d6aa2 soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node 4748c27e2e6a xfrm: use hlist_del_init_rcu for state_cache and state_cache_input 75fc4561772e xfrm: serialize state GC with device state flush 6233d0b3ef46 scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable() 2d432d59f10a net/packet: avoid truncating TPACKET_V3 private size 805edbdcb868 net/packet: clear RX owner on VNET header error 1731ff1d2048 net/sched: hhf: cap hh_flows_limit at change time 1be63e4579af net/sched: act_api: release tail references on DELACTION failure 02eba5f36d20 net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value 8dad70ff7e25 net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain 9dbf13de4edf net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() 21b231c11275 net: phy: mediatek: do not report link and per-speed LED rules together 5c216bfa9fb7 net: lan743x: fix RX checksum use-after-free 9907325257b4 net: ip_tunnel: initialize `options_len` before referencing options 4c030a0400eb ipv6: xfrm: use full sockets in local error paths b14e6c528725 dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() 3c42546d6c7a dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status 31396d731b28 dmaengine: sun6i: fix non-atomic read of DMA position registers a32bedab8ece btrfs: clear free space tree creation state on rebuild failure 709f6a5e9865 btrfs: take commit root semaphore when iterating in mark_block_group_to_copy() 4dc1ae5ff75b Bluetooth: hci_sync: Serialize local codec list cleanup f49a543d76d4 Bluetooth: hci_codec: validate vendor codec count length 4eb614045056 Bluetooth: eir: validate service data length before reading UUID 684d7252dc4e Bluetooth: btusb: fix NXP IW610 composite device handling 390742871a72 arm64: percpu: Fix LSE operations on {8,16}-bit types d575e0079149 arm64: percpu: Fix this_cpu_and() mask generation 0dd78559c144 arm64: percpu: Fix this_cpu_write() casting 169b53d64a94 arm64: dts: renesas: r8a779f0: Set UFS lane count e80ea8118a07 arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc 8eaf3c3a994f kselftest/arm64: Fix size of thread_data values for pthread_join() 4ed6f5d94cc8 HID: logitech-hidpp: fix race condition when accessing stale stack pointer cce630c75127 net: xfrm: reject unrepresentable espintcp transport headers d16f089bd700 openvswitch: avoid reallocating confirmed conntrack labels e15eb536be4f RDMA/core: fix refcount bug in iwpm_get_nlmsg_request() 01cbdb724c58 RDMA/ucma: Serialize join and leave on copy_to_user failure 8fc1eaae65f5 spi: virtio: Use the per-transfer bits per word 6eeecd941f4e spi: spi-zynqmp-gqspi: stop the controller on shutdown ebeff6e7133a spi: fsl-qspi: Reprogram the clock rate when the operation frequency changes aa4709813b29 swiotlb: use the adjusted address for the highmem page lookup ff037920c688 tcp: exclude old ACKs from tcp fast path 857559b83c81 x86/microcode/intel: Reject problematic loading on Granite Rapids systems e0fbc37f09b1 x86/build/64: Prevent native builds from generating EGPR use 526d8f45c6ef drm/nouveau/gsp/r570: Enable S/R Display workaround in GSP 80b8a76823de drm/nouveau/gsp/r570: Set GcOff = 0 in fbsr 28b898b5c700 drm/nouveau/gsp: Increase delay for magic sleep in r535_gsp_fini() b0bd757f910a Revert "nouveau/gsp: fix suspend/resume regression on r570 firmware" f22d349940cb rust: net: phy: fix off-by-one bit positions in device status accessors 65ca0a503715 rds: ib: use rds_conn_drop() on protocol version mismatch 9971dac1a778 posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list 8a15369ad1da phy: renesas: rcar-gen3-usb2: Avoid long delay in atomic context 44ab7420ab52 fs/dax: check zero or empty entry before converting xarray entry 75aa08b93c65 exec: Cleanup POSIX timers right after de_thread() fcc0a935bb6e cifs: Fix server use-after-free in cifs_chan_skip_or_disable() 7ab7aea170bc ata: libahci_platform: Fix device reference leak in ahci_platform_get_resources() b691a3e24427 ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY d93988c9e58d ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type 3e24b4a6acfd ALSA: virtio: reset device before deleting virtqueues 2dec4642589a ALSA: core: Fix potential UAF after asynchronous card release c03fb163a885 Input: xpad - fix PDP Marvel Xbox 360 controller 3e6dcea0e12f Input: xpad - add support for Azeron devices e97d781ec9c8 Input: xpad - add support for Victrix Pro BFG Controller 55ca2a79ebd7 wifi: rtw88: TX QOS Null data the same way as Null data aeab608c9700 ACPI: processor: Update cpuidle driver check in __acpi_processor_start() 38024286029f watchdog: da9062: fix suspend/resume handling of HW_RUNNING watchdog 984e18de4fcf hwmon: (hp-wmi-sensors) Improve raw WMI string handling 63a31916448f hwmon: (gpio-fan) return IRQ_HANDLED from the shared alarm IRQ handler 7ddff1a7cc8a Input: eeti_ts - publish the OF module alias 63c3d0435f2c x86/fred: Reconstruct the #GP context for rejected INT instructions b2faf2cafd14 btrfs: check if there is space for chunk item when validating sys chunk array 9588850bfa75 btrfs: abort transaction on failure to update inode for hole punching and reflinking 37583946d875 drm/amdgpu: check ras and obj before dereference bff8a8e53a6d net: skbuff: do not leave stale header offsets after pskb_carve() f0e7d62c1eb9 net: mvpp2: prevent buffer overflow in page_pool allocation 748b7a5aca24 net: macb: fix ordering around PTP timestamp read cfc1af3d054a x86/kprobes: Fix crash when probing CS CALL instructions 1977c843c577 x86/alternative: Refactor INT3 call emulation selftest a13cca5ba537 net: psp: avoid conflicts with skb->decrypted and sk_validate_xmit_skb() 598814c24620 net: stmmac: propagate FPE preemption-class mapping errors 4f33e036e827 net: ethernet: cortina: Ack RX overrun interrupt correctly d9f96bc2d822 net: lock the socket in sock_gettstamp() 60ef74357a36 eth: fbnic: ring the doorbell if a burst ends in a drop 647b0ff3bdef net: netsec: fix device_node reference leak on phy_np 9ba5cd743002 ASoC: amd: acp: fix ffs() operator precedence for SoundWire link ID a1b0456c90b1 ASoC: amd: acp: refactor codec config count in SOF SoundWire machine driver 32e85888af46 ASoC: sdw_utils: tidyup asoc_sdw_parse_sdw_endpoints() a4d56b384f82 ASoC: sdw_utils: tidyup .count_sidecar 91c2615e4dac ASoC: intel: sof_sdw: Add ability to have auxiliary devices 7939a4028c39 ASoC: sdw_utils: Add codec_conf for every DAI d1cb686d9ff1 ASoC: amd: acp: bounds-check SoundWire link ID in machine drivers 944e1a2c0225 ASoC: hdmi-codec: Report a change when the channel status moves 6d1c95803e1a ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments 4b7ecabd87dc btrfs: handle lack of space when cleaning up verity items 4a4294fe7cf7 btrfs: more trivial BTRFS_PATH_AUTO_FREE conversions 5468a4855b63 futex: Also allocate private hash on vfork() 0543813753ef powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba dfb842749327 KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure fbf69b7d0555 KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid() 82d4e43c6261 net: stmmac: do not overwrite phc_index when no PTP clock is registered 530ae0a14580 drop_monitor: fix out-of-bounds write in reset_per_cpu_data() 9616b0c67fbd drop_monitor: use timer_shutdown_sync() to prevent timer rearming during teardown 1da515f2e3b2 drop_monitor: synchronize tracepoint unregistration on error path e2f5529b0016 pppoatm: ensure a writable skb header and linear data b8f71d69380a af_unix: Unify scc_index when finalising SCC in __unix_walk_scc(). bfce253f039e Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup 18464860ce27 Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit 80f7bb41b0a8 Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown d42c798a14a3 Bluetooth: btmtk: fix wrong status for short WMT FUNC_CTRL events 49520ae0f292 Bluetooth: ISO: set BT_LISTEN before requesting a BIG sync e2b156a8d259 Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() a5414b0a9464 Bluetooth: hci_qca: Do not write to the serial port after it is closed 18a9e9f0070f Bluetooth: qca: enable pwrseq support for WCN39xx devices aa7aba716456 Bluetooth: qca: Refactor code on the basis of chipset names 7812a441617a Bluetooth: hci_qca: Refactor HFP hardware offload capability handling dcaf10ef27f9 Bluetooth: coredump: Quiesce dump work on unregister 84f353256e17 Bluetooth: btintel_pcie: validate TX skb length in send_sync e220c1242a64 Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained bae65e492592 dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() b0024111e4c2 ksmbd: keep compound responses on query info errors f86a9f901a94 ksmbd: fix partial file information responses bc616390103d ksmbd: return buffer overflow for partial filesystem info 7898bda1ebc1 tcp: do not let tcp_rmem be set below 4096 619bfbaacbff tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv(). d5c4ee1fa4e8 net: bridge: mst: move switchdev call outside rcu 72206aff346f wifi: brcmfmac: fix lost 802.1x TX completion wakeup d6f63fdb298d net: fddi: skfp: fix NULL deref when setting the MAC address while down 1af2d87964d8 ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup 56db7ec462d6 net: bcmgenet: restore the hardware filters on open 2077a6997c45 net: bcmgenet: convert RX path to page_pool ddf60220c925 seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation 78cb2ee98159 drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL 441f80df6022 btrfs: tree-checker: print dev extent offset in error message 57bc3cd46458 wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all() 8477643cb91c ALSA: hda: trace PCM open only after assigning a stream ee507691c18f drm/vc4: Use managed KMS polling to fix UAF on unbind 5d6c49d74a17 drm/xe/shrinker: Return the freed page count through a parameter fb2027f7e58c drm/xe/mmio_gem: Revoke drm_vma_node on xe_mmio_gem destroy 2a4555ed7571 drm/xe/mmio_gem: use write-back mapping for dummy page 6d726f1689cc drm/xe/mmio_gem: forbid VMA split 293c56a66510 wifi: virt_wifi: don't transfer operstate before register ea11ade10583 ALSA: 6fire: fix OOB write from device-reported iso length 999f433c09e4 ALSA: usb: 6fire: Avoid embedded URBs 84bfead4d4a1 gpio: virtuser: skip free_irq when no IRQ is installed 80f620951727 Input: trackpoint - fix the inertia attribute name in the ABI document 74b77820f923 spi: spi-qpic-snand: avoid writing QPIC_EBI2_ECC_BUF_CFG register e9aea0962697 ASoC: soc-pcm: Apply snd_soc_dai_link_ch_map.codec_ch_mask to codec params 2d3bc8ffb52f ASoC: Add codec_ch_mask to snd_soc_dai_link_ch_map 72f5fde1285d ASoC: Rename snd_soc_dai_link_ch_map.ch_mask to cpu_ch_mask 438f0ba25bb6 drm/msm/dp: fix link bandwidth check when wide bus is enabled dc57147549a1 drm/msm/dp: skip PUSH_IDLE when the link was never enabled d63f5a9f8121 ALSA: pcm: set timer->private_data before registering the PCM timer 3388f3b76ed0 phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting 7aa1360aca37 phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow 812ca56867be ALSA: bcd2000: Fix race between rawmidi and disconnect 17ac813d4b78 neighbour: Skip default parms when resumed in neightbl_dump_info(). 8de873ba128f neighbour: Add missing RCU annotation for neightbl_dump_info(). b9d00ccdb40b neighbour: Convert RTM_GETNEIGHTBL to RCU. 982c7f66c041 neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS. 151c5a1e4fff keys: fix lost wakeup when reaping a dead key type daefd7ff159b drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr 739208827c0b arm64: hibernate: clone only the linear map that exists at runtime 7974314fe4cd perf/arm-cmn: Fix wp_dev_sel2 setting for multi-DTM configurations 12c1ac230f4c netfilter: flowtable: hold reference on ct until flow is released 79084567cd08 netfilter: nf_nat: unregister and release hooks on error 197a03f5fa9d netfilter: nf_tables: fix device name and prefix match in hook lookup 0ce42c7b8403 netfilter: nft_nat: fully initialise new_addr in netmap setup ea2789490445 drm/msm/adreno: Fix the skip_gpu parameter description c30c774c2fa6 drm/msm: Fix the separate_gpu_kms parameter description b72dcfb9bf1f RDMA/siw: Bound fragmented header copies by the remaining length 38871ff47e2a RDMA/efa: Keep EQ resources alive while IRQ is registered d2a1c0bf4139 RDMA/efa: Keep admin queues alive while IRQ is registered 320bf29481fd dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA c2337cb6d6f3 dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order 57537562b026 scsi: qla2xxx: Fix the ql2xfc2target parameter description f824f6b83b72 mm: memblock: show all region flags in debugfs 0fb37d2b6cb8 wifi: mac80211: set up the TX info early to fix failure paths 41bee71112db wifi: mac80211: mesh: release the channel if start fails bd3b21145ae2 wifi: mac80211: mesh: reset the CSA state when leaving ad5bd0f6a0c3 wifi: mac80211: add HE 6 GHz capability in the scan elems len c53040cf8bbd wifi: mac80211: don't access the TSF of a down interface 7ef5774db0ed wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set 30c59052fe60 wifi: mac80211: don't allow link changes when iface is down fce36d242a18 wifi: mac80211: require a peer station for TDLS setup confirm 4b54d01b4844 wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown 73f48f7e16ca wifi: mac80211: don't allow injecting frames wider than the chanctx 5c79ef616aa1 wifi: mac80211_hwsim: don't hand frames to mac80211 while stopping caa02072b298 wifi: cfg80211: get the wiphy out of a dying network namespace d45bf731ec70 wifi: mac80211: unlist vifs when their netdev is unregistered 96bef5667b0c wifi: cfg80211: undo netns switch if renaming the wiphy fails fe50844cf94b wifi: cfg80211: restore netns_immutable on failures 5d5ff5b36f57 wifi: mac80211: reset state when starting AP fails 2e1d6e801484 wifi: mac80211: abort chanswitch when leaving a mesh ae40190b7c5f wifi: mac80211: suppress chanctx warning for debugfs reset 9c34f01b8f21 wifi: mac80211: don't offload TC setup on AP_VLAN interfaces 5f139e17f5bd wifi: mac80211: don't warn when an IBSS has no channel to scan 81baab8b645e wifi: mac80211: don't start a ROC while scanning 6d2fd2618567 wifi: cfg80211: don't filter by BSS type when removing stale entries 86235be78809 wifi: cfg80211: only group hidden BSSes with beacon entries e8c75736cfd0 wifi: cfg80211: don't free driver-owned scan requests fc1f4884f1d4 dmaengine: wait for RCU readers before releasing dma_device 6cf31716b77a dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() 1a0d9b406feb dmaengine: Fix device kref underflow in dma_chan_put() 3b8633cae8b4 dma-coherent: report a failed reserved memory assignment 80aafcce8de2 MIPS: Octeon: apply USB FDT fixups also when USB is modular fa9ff3bb85a9 soundwire: cadence_master: wait and cancel cdns->work before clock stop a2cdb4a675ca wifi: cfg80211: check IP header size in cfg80211_classify8021d() 693d777846d5 wifi: cfg80211: don't get the radio mask for netdev-less wdevs 188b334a6db3 IB/IPoIB: Avoid restoring OPER_UP after multicast flush 14cb425ba1f3 wifi: libipw: reject too-short association responses 2c87bbc00dc9 wifi: libipw: reject too-short beacon and probe responses c2cf589c7d54 wifi: brcmfmac: cyw: pass PMKID to firmware if present 0969c9688389 wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path 4f266738af45 wifi: virt_wifi: free skb when disconnected b96bc9784a61 wifi: mac80211: include TIM bitmap control for buffered S1G mcast traffic afc048e4d2ac dmaengine: sprd: Fix runtime PM reference leak in probe 8f253d5893f9 RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted 8433a15e414a RDMA/irdma: Enforce local fence for IB_WR_REG_MR 5091e25ec503 RDMA/mad: Fix receive buffer leak when PKey enforcement fails a0fb2007d00b RDMA/bnxt_re: check create_singlethread_workqueue() in DCB setup b96b8b3e41c3 IB/isert: wait for deferred control PDU completions before releasing the connection 6ed3ebaff334 IB/iser: reject a remote invalidation of an unregistered direction 89d0406f7759 arm64: dts: renesas: r9a09g047: Switch GBETH TX queue scheduling to WRR 9d84572a2f7c arm64: dts: renesas: r9a09g056: Switch GBETH TX queue scheduling to WRR 4a2cdf631dfb arm64: dts: renesas: r9a09g057: Switch GBETH TX queue scheduling to WRR 77ea927d924f power: sequencing: Fix build issue with COMPILE_TEST a219459fbd1b RDMA/core: Reject unregistering netdevs in ib_get_eth_speed 9cd08fdca43f RDMA/mlx5: Remove warn on missing representor in query_port_speed 02c0a2fa69c1 RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds c6f56982ec5c RDMA/rxe: Restore HMM_PFN_WRITE check in ODP write paths e1188332a911 clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate 69ec03cd4819 firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS 2f3b705144e3 RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access fe602c91a52e RDMA/rxe: validate access flags before swapping the MR's PD 9dcc0f4e488b RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept 593436d6e69f ARM: socfpga: select the PL310 erratum 753970 workaround 6cab554f2c0f esp: downgrade zerocopy managed frags before mutating skb frags 6eb3b071be8e xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject() 248433942155 xfrm: fix compat ALLOCSPI request use-after-free c2c6e6f45f30 xfrm: avoid RCU warnings around the per-netns netlink socket a7018ee0ea86 xfrm: iptfs: fix runt reassembly panic from short inner tot_len 7e1c6884a0b4 xfrm: iptfs: fix stack OOB read in iptfs_skb_reset_frag_walk() e62a16848bf2 ipv6: Honor oif when choosing nexthop for locally generated traffic 94671f802bb0 ipv6: Select best matching nexthop object in fib6_table_lookup() ba9d1d352466 media: video-i2c: fix buffer queue ordering 06724dd3da2e sunvdc: fix -EIO issue due to lack of retries 38984b41f995 selftests/landlock: Add audit test for whiteout object creation ea9965b9474b selftests/landlock: Add tests for whiteout object creation 74bdf27404c2 selftests/landlock: Use an actual chardev for MAKE_CHAR audit test ac0a0d7696aa selftests/landlock: Add disconnected leafs and branch test suites f289962f0045 selftests/landlock: Add tests for access through disconnected paths cdc543c9eceb selftests/landlock: Explicitly disable audit in teardowns 3d6f8e2556d5 selftests/landlock: Increase default audit socket timeout 1be91aa4f5dc selftests/landlock: Fix socket file descriptor leaks in audit helpers d54c0ec29dfa selftests/landlock: Add missing connect(minimal AF_UNSPEC) test ab115d19fb2c selftests/landlock: Add test for TCP fast open 27d09eaa8b5f landlock: Fix TCP Fast Open connection bypass 8c3b2bf7f39c Revert "perf annotate: Fix build with NO_SLANG=1"