9c4e23d39c1a Linux 6.18.55-xanmod1
48efd6293fa7 Merge tag 'v6.18.55' into 6.18
725bd2f3c81d Linux 6.18.55
fa047f2a0250 bpf: Reject key-less BTF for hash maps
98fd50aaaeb2 rose: don't warn on stray CALL_ACCEPTED/CLEAR_CONFIRMATION in state 3
5454ea6e22e7 rose: use timer_shutdown_sync() for t0timer teardown
bcf4c43f797c rose: guard rose_transmit_link() against a NULL neighbour
7d10439345e2 rose: keep the route needed for routing loop detection
6c401ae426e2 sched_ext: Derive SCX_RQ_IN_WAKEUP from the core enqueue flags
d3c8fb7094c5 hfsplus: avoid double unload_nls() on mount failure
500c9259f5a6 mm/damon/core: fix unconditionally skip last region
f6660e9a3e1e rust: net: phy: fix off-by-one bit positions in device status accessors
d50418db3b86 Revert "rust: net: phy: fix off-by-one bit positions in device status accessors"
c525772c304c RISC-V: KVM: Serialize IMSIC attributes with vCPU migration
5fdc644a4fea RISC-V: KVM: Fix null pointer dereference in kvm_riscv_aia_imsic_rw_attr()
4a04ed915758 net/sched: act_ct: avoid modifying shared unconfirmed ct entry
812c16a255e7 net/sched: act_ct: fix helper UAF due to extensions realloc
9ba16ce8f3fa x86/sev: Make vTPM SVSM calls preemption-safe
e43d42bd711e x86/sev: Remove redundant ghcbs_initialized checks around __sev_{get,put}_ghcb()
524becfebcd0 x86/sev: Carve out the SVSM code into a separate compilation unit
b2a9d6ff593b x86/sev: Add internal header guards
1cad4f235e15 x86/sev: Move the internal header
99607d955be3 perf/x86/intel: Remove incorrect LionCove PEBS data-source constraints
7ba97aa16778 perf/x86/intel: Update event constraints and cache_extra_regsfor LNL
edc0309282aa perf/x86/intel: Fix GRT PEBS load/store direction for latency events, to fix sample classification
51199c793bc0 perf/x86/intel: Update event constraints and cache_extra_regsfor ADL
24e79508b237 net: ipconfig: bound DHCP option construction
8fbfa861dfd4 net: ipconfig: Remove outdated comment and indent code block
bda487567d0b net: macb: fix dma_alloc_coherent() leak on macb_alloc() error paths
aa4845a710ae HID: alps: unregister DualPoint Stick input device on remove
48c5c02bf6fd HID: hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM
d0f6244f4af4 PCI: Fix BAR resize for devices on a root bus
85b1112945f2 super: make iterate_supers_type() deletion-safe
ccf96a4b8626 mm/hugetlb: do not dissolve gigantic pages without runtime support
2ab4b6815d10 mm/hugetlb: create hstate_is_gigantic_no_runtime helper
4cef512a955e mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish
a56e5bcc4331 mm/rmap: allocate anon_vma_chain objects unlocked when possible
fcbedba553a9 drm/client: fix restore of partially initialized client
933145e2bbb4 drm/client: Pass force parameter to client restore
0589706ace3b drm/client: Remove holds_console_lock parameter from suspend/resume
817dd706ee61 drm/amdgpu: Fix acpi device leak in amdgpu_acpi_enumerate_xcc()
13f299763f6c drm/i915/quirks: Limit eDP rate to HBR2 on HP Pavilion Plus 14-ew1
97e40aa29c10 drm/i915/psr: Disable PSR2 on Xiaomi Book Pro 14 2026 as a quirk
66f814e8af46 drm/i915/psr: Fixes for Dell XPS DA14260 quirk
782b5210e89e drm/i915/psr: Disable Panel Replay on Dell XPS 14 DA14260 as a quirk
5815329988ac i2c: qcom-geni: Fix hardcoded clock index in SE_GENI_CLK_SEL
f42562dd027d vlan: require the MAC header to be present in __vlan_insert_inner_tag()
241e67b60308 cgroup/cpuset: Return PERR_NOCPUS in remote_partition_enable() on subpartitions_cpus conflict
d186e0171c8a cgroup/cpuset: Ensure domain isolated CPUs stay in root or isolated partition
8a64ac9f03fc cgroup/cpuset: Move up prstate_housekeeping_conflict() helper
438bf73ca977 net: tls: fix silent data drop under pipe back-pressure
66a2179d0266 xfs: fix cursor and pointer handling when recovering iunlink buckets
86b17699bd0c xfs: fix blockgc group quota scanning when usrquota isn't enforced
930a9c1c321e xfs: don't let hidden_space go negative in xfs_metafile_resv_init
09ebf777ad4e xfs: call xfs_dquot_set_prealloc_limits if we installed default rtb limits
d46492fb8018 xfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots
543bc5fd7d8e xfs: fix rtgroup repair estimations
6aabf4f351cd xfs: check di_forkoff correctly in scrub
f99c67247179 xfs: use the correct reservations for rtrmap/refcount recovery
adb80d620dab xfs: don't call xfs_exchange_range_finish for a dry run
770d21b52c91 xfs: check padding field in xfs_ioc_commit_range
09b7a63e11c7 xfs: use correct jiffies comparison function in xchk_maybe_relax
6a65a68097a1 xfs: release orphanage dir inode if chown fails
ac76f8df5598 xfs: fix attr fork block count checks in xrep_inode_blockcounts
ef7a56c6630f xfs: don't assert when XFS_SCRUB_TYPE_HEALTHY scans return corruption
c2ac475ddd73 smb: client: validate POSIX create context length
31107f79ad33 smb: client: preserve create-context parsing errors
abab661eed00 smb: client: clean up failed cached directory opens
05a7fd80024f smb: client: fix create context out-of-bounds reads
8f5b30cc12c4 Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO
416546cd6a54 Bluetooth: mgmt: fix race in read_unconf_index_list()
c6a288e6001b Bluetooth: L2CAP: validate frame length before control and FCS access
ed4c026cc409 Bluetooth: ISO: release unused CIS holds after channel attach
4e49206d9574 Bluetooth: ISO: balance the parent hold in hci_bind_bis()
173457fa3e99 Bluetooth: hci_sock: reject out-of-range OCF values
f894f6292d51 Bluetooth: hci_sock: validate event length before filtering
3ff5a8d949e3 Bluetooth: hci_conn: fix CIS hold ownership on reuse
57ccaa818307 RISC-V: KVM: Fix HSM hart status error propagation
5567ce11304d RISC-V: KVM: Propagate interrupted G-stage faults
ea91f05a55b8 RISC-V: KVM: Synchronize hrtimer callback during teardown
e5dd2a91a7ae KVM: arm64: Transfer the hyp stack pages out of the host stage-2
970de111c087 KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race
c23ed110d27b KVM: arm64: Fix spurious warning for benign stage 2 teardown race
8530a05b304d KVM: arm64: Fix AArch32 DBGBXVR<n> handling
37dfb676fafd KVM: SEV: Do cache maintenance on the source VM during intra-host migration
6aef7cf80009 KVM: SEV: Free have_run_cpus during VM destruction even if VM is no longer SEV
066a53a0bc19 KVM: Don't treat reserved xarray entries as having memory attributes
7dcaf0107523 KVM: Ensure memory attributes xarray nodes are accounted to the caller's memcg
cf441a0db681 s390/vfio-ap: fix KVM GISC and page leak when queue removed from host config
af295f0eab68 s390/pci: Don't report recovery success on skipped recovery
eef5c8e1cca6 s390/pci: Report SCLP status on error events when no pdev is associated
743a8458978d s390/pci: Fix missing device lock in zpci_report_status()
dd5ed64dadb0 s390/pci: Fix leak of struct pci_dev reference in zpci_report_status()
748ec2f7f5df s390/cmf: Fix virtual vs physical address confusion
c3bbcb32deec s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str()
02664a8d8d59 pinctrl: sunxi: keep a shadow copy of the data register output latches
1deeeca89ea1 pinctrl: single: free the IRQ on domain creation failure
a23f9f9b56b7 perf/core: Run sched_task() for PMUs with only CPU-wide events
249a2bd87a0e perf/core: Fix NULL pmu_ctx passed to pmu->sched_task()
5023c70853ad parisc: Increase kernel stack size to 32kb
ee56b5e18f56 scsi: libiscsi_tcp: Check the data direction of a Data-In PDU
cc444e4ad434 nfc: trf7970a: power down on startup RX gain failure
14b1467cfc66 nfc: port100: reject frames whose declared length exceeds the received data
810f204ef8f6 nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()
841af260ff47 nfc: fix use-after-free in nfc_get_local_general_bytes
12cf803edfff netfilter: nf_tables: skip expired catchall elements on insert and delete
191239b09396 netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read
eafe081ea77d netfilter: ip6t_rpfilter: reject routes without inet6_dev
8a611f33216f net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs()
7d2377868feb net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist
43ff11501ea6 net: txgbe: fix FDIR filter restore for VF rules
9447ddd8b924 net: phy: micrel: Advance register data pointer in write loop
30ff01b4c7e4 net: ena: fix MMIO read buffer leak on probe failure
e8a2f48bbff1 net: ena: fix PHC cleanup on probe failure
ab3c4a4c85f2 net: bridge: mdb: restart port group walk after deletion
4b7161804d8f net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read
586847400b11 net: atl1c: fix soft lockup on out-of-range tpd_cons read
5f23080a625d net: openvswitch: conntrack: fix helper UAF due to extensions realloc
caefcd433ecb net: openvswitch: conntrack: remove 'add_helper' dead code
e2829ae5459d net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry
729737267e7c net: hisilicon: hns_dsaf_mac: fix mdio device leak in hns_mac_register_phy()
0f573b057625 net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read
ba664d836386 net: arp: terminate device name before lookup
aca91d8fa0ec net: airoha: npu: cancel wdt_work after releasing the WDT IRQ
968550a439f6 net/sched: reject IDR error pointers when deleting actions
3803dc8477f0 net/mlx5e: fix swapped IPv6 IPsec policy masks
0c336ecabaf9 net/mlx5e: advertise MACsec offload only when supported
99d8dc516637 net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()
c3129e6f26e1 HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()
5695ec5339d4 HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard
925da1d2a247 HID: alps: fix use-after-free on input2 registration failure
eda9bcb721f1 packet: use ubuf_info completion for TX_RING packets
879c911f77b8 PCI: of_property: Omit bus properties without a subordinate bus
e59cb7eda7c0 mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold()
850cc4a84b36 mm/hugetlb: preserve mremap address delta when skipping page tables
b1db1ec5c894 gpio: tps65219: Fix TPS65214 GPIO direction programming
ac3c7eb6a44b gpio: tps65219: Use the variant-specific direction callback
fabe897e61e4 gpio: tps65219: Fix GPIO input value reads
f2f1683955b9 drm/virtio: fix NULL pointer dereference on fence allocation failure
8fa78900fd24 drm/virtio: fix memory leak of fence event on execbuffer failure
c2d4689c3ea9 drm/xe: Keep walking on SVM eviction failure
c306b6419fd0 drm/xe: Limit sg segment size to PAGE_SIZE on Xen PV
2bcbfc5e7bfa drm/xe: harden adjust_idledly() against divide-by-zero and overflow
ba678c2b02e0 drm/xe/vm: nuke PTs only after unlinking contested VMAs
19f5a5839b30 drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked()
35151e9a8274 drm/nouveau: RCU-free the scheduler-containing nouveau_sched
59aa1f8c9594 drm/nouveau: Fix runtime PM leak in nouveau_connector_detect()
030e93fc91d5 drm/nouveau: Fix gem reference leak in validate_init()
109a8d2d5b7d drm/nouveau: fix double-free in nvif_vmm_dtor
6d497216c10a drm/nouveau: Fix bridge reference leak in nv1a_ram_new()
9132215d2c90 drm/nouveau: fix autosuspend cleanup during teardown
0d29bf51f8dd drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM
c83261854e19 drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init()
c28e74395ab0 drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show()
0bfb0419a148 drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init()
d197b15d4beb drm/amd/display: Bump frame warning limit for clang builds of dml
89a11c7efe38 drm/amd/display: Fix dc stream excess put in dm_update_crtc_state()
fe933dda0bb1 drm/i915/dp_mst: Fix configuring TUs for a disconnected stream
369f4e326437 drm/i915/dp_mst: Fix configuring FEC for a disconnected stream
cc890d3f1b15 drm/i915: fix incorrect RCU teardown order
bbef7450e2b4 drm/imagination: Fix page count for page table for map() interface
afe5b4d66d45 drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl()
e2ee06162600 rds: ib: Clear the sg list when mapping an MR fails
e35cb500dd14 mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()
e06f8b6e27cc llc: reserve device headroom for allocated frames
58a417a19d80 gpio: zynq: fix runtime PM leak on request error path
cf3d043582e1 gpio: cdev: fix kernel stack leak to user-space in error path
a9f738487c11 gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out()
6fcfc362344e ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST
1d4282856588 ipv6: do not let ipv6_find_hdr() return an offset past the packet end
599d0498a393 ipe: protect the dm-verity root hash with RCU
48f7d0233c3c ipe: fix use-after-free when auditing a newly loaded policy
c2a5e5918586 fsl/fman: Fix clk reference leak in read_dts_node()
fd3bf32279df writeback: report a Tasks-RCU quiescent state per cgwb drain pass
1dccf5dc2f8f workqueue: Fix NULL current_pwq deref in flush dependency check
dd4b92067238 writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes
37ec7353f4ac fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's "WARNING in do_new_mount" saga
b1229b210ef5 fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT
2f7042429a8e cgroup/pids: Restore pids.events notifications in local mode
caf8b2d9b30c crypto: s390/hmac - Generate intermediate CV for API partial block handling
7504b677c437 bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir
4d97a141e85a bna: prevent IOC timer rearm during teardown
1603abb0c504 ata: libata-scsi: bound the ATA passthru sense descriptor writes
cdccb760be1f arm64: errata: match the target implementation CPU's own MIDR
071f51188a5d arm64/boot: Disable trapping of PMZR_EL0 writes to EL2
6279211e7d24 af_packet: fix integer overflow in prb_calc_retire_blk_tmo()
ec23855274a7 sctp: discard the rest of the packet on a stale-cookie error
7ba87509c54c tcp: prevent collapsing skbs across boundary in rtx queue
12cc3a1eac5a tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow
ca40f4df4ab2 virtio_net: copy zerocopy frags in start_xmit without NAPI
33da1ff56f95 x86/PCI: Disable enhanced atomics on AMD NBIO 7.7 and 7.11
f50d2e8cc1f1 x86/mce: Fix hardware debug register corruption on task migration
a557816c6e38 netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase
7b32eba3fad8 rculist: add list_splice_rcu() for private lists
162bf5f73f1b mptcp: return sk_wait_data() errors from recvmsg()
9fe317b999aa sched/core: Account PSI IRQ time to the execution context, not the scheduling context
23250517cd47 perf/core: Fix a refcount leak in attach_perf_ctx_data()
654fc8445ca8 perf/x86/intel: Make @data a mandatory param for intel_guest_get_msrs()
068828975345 perf/x86/intel: Don't pointlessly context switch DS_AREA (and PEBS config) if PEBS is unused
8cb5a01cb5f1 perf/x86/intel: Don't write PEBS_ENABLED on host<=>guest xfers if CPU has PEBS isolation, to fix stuck PEBS_ENABLED
c205e3fc9962 perf/x86/intel: Ensure KVM guest PEBS path doesn't set unwanted PERF_GLOBAL_CTRL bits
4bcb37101909 autofs: fix sbi->pipe file reference leak in autofs_kill_sb()
c7ee4bea64f5 vlan: ensure sufficient headroom in vlan_dev_hard_header()
7f8b56c82919 net/sched: sch_teql: fix shadowed err in __teql_resolve()
15d00994a1bd bridge: check llc_mac_hdr_init() return value in br_send_bpdu()
41dcae82bece llc: fix skb UAF and leaks on llc_mac_hdr_init() failure
2dc3ae3942e1 gve: DQO: reject TSO packets with an out of range MSS
089e04db4475 gve: fix TX drop when GSO MSS is too small for hw
feab3880a72b gve: DQO: fix header length used by gve_can_send_tso() for UDP GSO
2f855c52a2e1 gve: add support for UDP GSO for DQO format
6d4a5ce75b6e gve: Enable hw-gro by default if device supported
adbfc707ff6b gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO
6c7937db1d56 gve: Allow ethtool to configure rx_buf_len
bcaedb514a5d gve: Use extack to log xdp config verification errors
a0d644b8ff88 gve: Consolidate and persist ethtool ring changes
5f86408eba31 net: ethernet: stmmac: dwmac-rk: fix bulk clock leak when the PHY clock fails
d990b786abfd tipc: Fix a data race on mon->peer_cnt in mon_timeout()
3d65a2eb4449 net/smc: fix UAF on lgr list traversal in smcr_port_err()
8468d05aa08d nfp: hold IPsec RX state under the XArray lock
4e7a4af364c2 net: phylink: record the PHY only once bringup cannot fail
631aa4cb4509 tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()
2357c682f6ea net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq
62c0e38b2e50 net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621
2b42adf3b8ee macsec: initialize SecY before registering the netdevice
dc106fe25e9a bonding: crypto offload enabled, non-offload slave failover, rekey failed
e0560db0ea6e drm/imagination: clamp freelist reconstruction requests
2cc1c3977acb net: xps: reject an out of range traffic class
a3c5eb6e382d vxlan: use one headroom snapshot for neighbour replies
bdd41b96e814 ip_gre: Reject enabling collect metadata through changelink
c3fab2f1d8a6 net: bcmgenet: mask DMA_TIMEOUT_MASK when reading DMA_RING0_TIMEOUT
d68899b50caf net: bcmgenet: validate Ethernet address in bcmgenet_set_mac_addr
b3ebe8983d86 net: bcmgenet: do not skip WoL power up on GENET V1
21a0de485877 net: bcmgenet: initialize u64 stats seq counter for all queues
aefa837c2667 net: bcmgenet: fix 64-bit RTNL stats reading in ethtool on 32-bit systems
501baaeca7d1 net: stmmac: clear stale buf->page after recycling on skb build failure
0f7ed27586ac tg3: use random MAC address when tg3_get_device_address fails
e40990861074 bpf: Fix BSWAP 32 and 16 on MIPS64
876ef04c75c2 bpf: Fix immediate JMP JEQ/JNE on MIPS32
6d76ddce4f1b vrf: Stop corrupting skb->csum when capturing CHECKSUM_COMPLETE packets
cfa643f2ca36 net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()
25bb7c362252 veth: manage XDP program pointers during channel resize
63bcc2fee641 net: bcmgenet: stop Tx NAPI before disabling the queues
284166f34b8f net/sched: act_gate: budget the per-entry list in get_fill_size
e72cbedc4596 nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()
8978dff63251 nfc: llcp: fix slab-out-of-bounds reads when logging service names
f234197f3bda nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap()
2386d107df6d nfc: llcp: fix -ENOMEM on connect with zero-length service name
fdd95e819d82 nfc: st21nfca: validate ISO15693 inventory length
cbde7f5d3261 nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure
0b32dcc8a3f9 nfc: virtual_ncidev: Add missing ioctl compat handler
27cf04ba4e7e selftests/nci: Fix out-of-bounds store on thread join
f9cbe5c68d93 selftests: nci: Fix uninitialized family ID on missing attribute
da8a07757383 nfc: llcp: Fix race condition in accept_queue lifecycle
3316903fdc3a selftests: nci: Correct pthread_create return value check
b94cf0972054 nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()
57919d0662d8 nfc: st21nfca: validate received frame size
ed2e00bb22c7 nfc: nfcmrvl: validate helper command length before pull
940b626854de bpf: Reject dev-bound-only programs on other devices
9923e1c537f9 net/sched: fix potential stack infoleak in em_text_dump()
92c9f2ea634d eth: fbnic: Avoid rounding zero ring sizes
3ea177bdba25 net: stmmac: selftests: Account for alignment shift on dwmac1000 for Jumbo test
b17959fb4d55 net: stmmac: dwmac4: Use the correct bufzise when the len is exactly 8K
4c4217aaa5e4 net: stmmac: selftests: Capture all packets for vlan checks
e7a8bbb6149b net: stmmac: selftests: Check the dev->features for S-TAG offload testing
74da0c1cede8 net: stmmac: selftests: Support running selftests on DSA conduits
d18cb8fd1b6b sctp: hold asoc or transport before mod_timer() in timer handlers
650dcd938e56 net/mlx5: Bridge, don't fail unlink of untracked/unsupported peer ports
cdeca5de4e18 net/mlx5: Bridge, don't fail switchdev events of sibling eswitch ports
cea597519b9c bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc
d95dd5a6c6cd bpf: Fix bpf_sock context code generation
1196903a27ca bpf: Fix bounds check for skb-backed dynptrs
fb1e2df8e2e2 thermal: gov_step_wise: Fix stale mitigation vote with non-zero lower bounds
0f5d8953cb63 net: pcs: xpcs: fix clock reference leak on xpcs_init_clks failure
54e98316ce5c genetlink: report the real command id for dump-only ops in policy dumps
41e444535c60 net: ethernet: ti: netcp: fix pm_runtime usage counter leak on error
ca9986cc824f net: spacemit: clear TX descriptor on fragment mapping failure
9c6af88fbefb s390/debug: Fix NULL pointer dereference in debug_info_copy()
36831afe8eba s390/debug: Do not register views for failed static debug areas
8b661a045082 drm/i915/psr: Clear stale sel fetch enable bits on sel fetch disable
6515c41503ee tg3: clean up PHYLIB resources on probe failure
c21daf37d5ce udp: remove a disconnected socket from the 4-tuple hash table
7a0bbe5654ec udp: relocate a connected socket in the 4-tuple hash table on re-connect
ed902d5546fb ipv6: Fix dst leak for uncached routes.
6ab6c9d120b3 net: usb: sr9700: include receive overhead in the length check
e3c21e8b5390 dpll: use exact lookup for reference sync pin id
649ffc76ed54 ipv6: Prevent rt6_insert_exception() for dying fib6_info.
ff8cff3aff67 octeontx2-af: Fix memory scaling limitation in SR-IOV mode
be00deee6004 Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()
8ec5838a35b0 Bluetooth: btintel_pcie: validate device-supplied DMA indices
8f3103132699 Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough
a8f3a829f3a5 ovpn: reject invalid peer VPN addresses
7efbc134253c ovpn: reject multipeer peers without VPN addresses
daab972893ae ovpn: reject duplicate peer VPN addresses
12ee72319805 ovpn: always unhash old VPN addresses before rehashing
c44a04722f7d ovpn: replace bind when clearing stale local source
21dbc9f4d0bd ovpn: replace bind when learning local endpoint
324ebbde06cd ovpn: validate peer state before caching UDP dst
db97cfe9a507 ovpn: track UDP socket route key for peer dst cache
ba3877bdcc9a ovpn: skip UDP source validation for unspecified addresses
8c1d7994a18e ovpn: preserve IPv6 scope id for netlink peer endpoints
ebffd70e4877 drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach
d6b59a9fece4 drm/virtio: sync shmem backing on guest-bound transfers
e7df00bb036e Revert "drm/virtio: Allow importing prime buffers when 3D is enabled"
5c2cb3dd1447 drm/virtio: release the GEM object on virtio_gpu_vram_create() errors
81c6769e069d drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl()
b516446a25bf drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl()
a93dce15dfef drm/virtio: fix object leak when drm_gem_handle_create() fails
0fa25ba50a38 net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget
cd12d3e08620 bpf: Check params size before reading reserved fields
dd9c6f8f0517 net: usb: catc: bound the RX packet length in catc_rx_done()
9c11e543fec3 bpf: Bound ownership depth through local kptrs and graph roots
c9338057df10 sctp: avoid livelock while updating retransmit path
c7a254c16c6f eth: fbnic: Handle FW mailbox completions flagged with an error
a85a019b3011 eth fbnic: Add debugfs hooks for firmware mailbox
6a112552d305 eth: fbnic: Reuse RX mailbox pages
8a052cd4b2ca eth: fbnic: Set AW_FLUSH_MODE alongside AW_FLUSH when flushing the mailbox
c5b5aee41b9f eth: fbnic: reset num_napi when the napi vectors are freed
6c903188b676 eth: fbnic: Handle maximum standalone channels
8dc566777091 ip6_gre: Call ip6erspan_tunnel_unlink_md() in ip6erspan_changelink().
7254b702e556 net: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure
40aeafbcbc7b net: gue: reject invalid REMCSUM offsets
00734f3684fc net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure
ca29834c8c14 drm/nouveau/disp: don't reject HDMI config on cards without SCDC
40afa1f7a5c7 drm/nouveau/clk: don't clobber reclock status when restoring volt/fan
0d096a7f7d79 drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update
f2e9005aadb6 ocfs2: make ocfs2_calc_xattr_init() return void
b17aa4955e3a arm64: io: Reject non-user protection in ioremap_prot()
0994c3e3b4e3 netfilter: ctnetlink: fix suspicious RCU usage in expect_iter_name
f100578039b3 ipvs: revalidate ihl before icmp_send
302477c9ffef netfilter: nft_synproxy: use the family-aware checksum helper
07a3ec8fdc5a netfilter: nfnetlink_queue: hold nfnl mutex in event notifier
b0ef9450e93f netfilter: flowtable: publish HW_DEAD after worker is done
1363c71be27a ipv4: fib: fix data-race and stale genid check around nh->nh_saddr
5be5ccd3a556 libbpf: Reject truncated ldimm64 CO-RE relocations
2d7d04357c41 bpf: Restrict CO-RE poisoning to relocatable instructions
2fe1569e32dd net/mlx5: devcom, Base component size on linked devices
8ebfd34fef75 octeontx2-af: use seq_file for rsrc_alloc debugfs
6127164efa94 net: pcs: rzn1-miic: Fix config array initialization
f6696481eedf net/sched: cls_u32: fix manual hash table handle IDR aliasing
f4277b19edbc eth: fbnic: Fix payload page pool error cleanup
6e271f093d15 bpf: Skip unsettled links in link iterator
b5c0cff0c533 xsk: Use a 32-bit compare in xsk_map_gen_lookup
e4f3e476cd40 fs: avoid repeated scans in evict_inodes()
22225cd612b2 s390/cio: Guard PMCW field accesses with dnv check
5eae708cca8f s390/cio: Check pmcw.dnv before pmcw.ena in I/O entry points
591ba131193e s390/cio: Fix cio_update_schib() to not cache invalid schib
8bd9905dfbd9 s390/pci/docs: Fix sriov_numvfs attribute name
e163f1dccede docs: s390/pci: Improve and update PCI documentation
6675f801b0d6 scsi: megaraid_sas: Protect megasas_get_ctrl_info() in megasas_resume()
0117e731435b selftests: cgroup: give the O_TMPFILE open in get_temp_fd() a mode
2189a219397d Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel
8a36598050cd Bluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump()
6fdabd654578 Bluetooth: SMP: reject Security Request over BR/EDR
9c051b12ca10 pinctrl: sunxi: A523: fix voltage withstand encoding
0af16d8be3ec scsi: sd_zbc: Reject disks with too many zones
0cb85377daae squashfs: Add dictionary size range check to prevent shift-out-of-bounds
5d54693bc457 KVM: arm64: Fix FGT mapping for HFGITR_EL2.nGCSEPP
cb68b5589318 KVM: arm64: Return -EINVAL for an empty SMCCC filter range at base 0
4efda2040871 KVM: arm64: Derive GUEST_HAS_SVE from the SVE feature bit at EL2
f12695216714 KVM: arm64: Include VM type when checking VM capabilities in pKVM
bbcd7e851d57 KVM: arm64: Fix MTE flag initialization for protected VMs
c142034ad3a8 KVM: arm64: vgic-v3: Fix GICv3 trapping in protected mode
bd46b41f412f KVM: arm64: Do not clear VM-wide SVE feature on vCPU init failure
faf66e55e874 KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve()
65bffaf100df KVM: arm64: vgic-its: Skip unreachable devices instead of failing the save
80a6b712dc19 KVM: arm64: vgic-its: Free the caches when GITS_BASER changes
c2230cd14950 RISC-V: KVM: Fix perf-backed counter accounting across stop and read
f6f1d27e0c89 RISC-V: KVM: Report snapshot write failure to the guest
f4363eede3e7 RISC-V: KVM: Preserve firmware counter value across stop/start
d6de766d8d26 KVM: riscv: Fix NACL hfence entry update order
5c221f33a518 HID: bpf: fix __hid_bpf_hw_check_params report length
5f9e2ecb725a HID: amd_sfh: Validate PCI BAR size before mapping
905d1a40f34f pinctrl: meson: Fix typo in s4 group name
b67b4c763f21 bpf, arm64: set up the frame pointer for the exception callback
ae1ffd04e98b bpf, sockmap: Fix self-redirect copied_seq double-counting
1d6581b544a8 bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk
51a17f0ce19c bpf: Register dtor for freeing special fields
6785313d4fac bpf: Fix out-of-bounds read of rtt_min in sock_ops
44f9bcb5ab2b bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch()
5ad116c23f14 KVM: x86/pmu: Move Intel PMU global MSRs to intel_is_valid_msr()
08a4d55b2672 HID: elecom: fix bus type for M-XGL20DLBK
49688a0d1ac6 HID: multitouch: Add report ID mismatch quirk for ASUS ROG Z13 Folio
55bbebf2829c tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context
91a482a81eab bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()
8eb4cd72daad bpf: Fix divide-by-zero in btf_struct_walk()
5334c609bf92 selftests/ftrace: Fix unique symbol check in kprobe_non_uniq_symbol.tc
37b18688cd18 bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL
69fe51a3bd78 bpf: Fix bpf_skb_change_tail wrt csum partial skbs
04bb5b2eb9f1 s390/uv: Prevent potential out-of-bounds read
018e137ac1da s390/uv: Fix loop condition in uv_find_secrets
a379ac504fcb KVM: s390: Fix IRQ injection with SIGP Stop and Store Status
7c7a6ba6128f remoteproc: qcom_q6v5_adsp: Fix iommu_unmap() usage
50d844aead62 ALSA: hda/realtek: Add StarFighter HDA SSID
56b321df2863 ALSA: hda/realtek: Limit Star Labs internal mic boost
2945d3eb73d6 drm/amd/display: Atomize IRQ register read/modify/write ops
d1079deec828 erofs: fix large folio race in erofs_fscache_req_complete
14ae74db795a xfs: don't stash removename operations with unknown ftype