6918125d4c60 Linux 6.18.58-rt-xanmod1
410441c252f9 Merge branch '6.18' into 6.18-rt
cc385b1d2dbc Linux 6.18.58-xanmod1
bab0735b98d6 Merge tag 'v6.18.58' into 6.18
2926d88bb7fc Linux 6.18.58
2566780c684c KVM: x86: Use active memslots for the per-vCPU MMIO cache
517404e15739 ksmbd: fix heap out-of-bounds write in krb5_authenticate()
88c7c3aa8d0f wifi: atk9k: Revert "wifi: ath9k: reject short WMI command responses"
5c0940abe76c bpf, sockmap: Account for receive queue in FIONREAD without a verdict program
8b7748e9904f kho: free chunks using free_page() instead of kfree()
a6d84b420a84 io_uring/kbuf: don't charge provided buffer rings to RLIMIT_MEMLOCK
e46794d1936c io_uring: do not charge the SQ/CQ rings to RLIMIT_MEMLOCK
314b72d5e827 rose: hold a reference on incoming sockets queued for accept()
30ec3025b771 USB: iowarrior: fix use-after-free on disconnect race
e8ed9a1dfc74 usb: iowarrior: remove inherent race with minor number
c24d2e190b95 selinux: allow multiple opens of /sys/fs/selinux/policy
93a7f297362d mm/damon/core: fix damos_walk() vs kdamond_fn() exit race
7e54ed8a780c mm/damon/core: cancel damos_walk() before damon_ctx->kdamond reset
7ea3850b9ce0 xfs: close crash window in attr dabtree inactivation
4b963fddf470 xfs: factor out xfs_attr3_leaf_init
50144efd23ad xfs: factor out xfs_attr3_node_entry_remove
0f39d936a349 ima: Fix stack-out-of-bounds in is_bprm_creds_for_exec()
265ca3f6524b ima: Access decompressed kernel module to verify appended signature
7d6fd5074648 fat: stop reading directory entries past the end-of-directory marker
f6c1e709a4f9 cifs: fix time_last_write stamp placement in setattr/truncate paths
2efa187fd4c9 drm/xe/i2c: cancel the client work on remove
97e736000731 scsi: ufs: core: Avoid unsafe MMIO reads in ufshcd_mcq_compl_all_cqes_lock()
ee01d48f0f08 scsi: ufs: core: Add a comment block above ufshcd_mcq_compl_all_cqes_lock()
e36bac5923a3 scsi: ufs: core: Add debug log for MCQ command timeout
d12c834b97c3 scsi: ufs: core: Move an assignment in ufshcd_mcq_process_cqe()
a34a230ccea1 scsi: ch: Do not keep references to data transfer element devices
8176ec7e3698 scsi: ufs: core: Decouple CQ sweep from request iterator in MCQ
9e8fc7972b39 riscv: patch: fix handling of bpf-jit execmem addresses
420bf39a22a7 riscv: patch: Avoid early phys_to_page()
08275dcfbfc3 net: mana: reserve RX buffer headroom to fix forwarding performance
eececf7c3a67 net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop
cc7732b8549e Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex
638ee6bca197 sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler
454b67fcc28c dm-integrity: validate the superblock on resume
2e25842f0e44 dm-integrity: fix NULL pointer dereference when the 'R' flag is used
0c9d4f9c66ca wifi: mt76: connac: tolerate inactive BSS deactivation
22732b0f290a nfsd: fix all-zero stateid in CB_OFFLOAD for async COPY
0c5595cba722 mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge
5720bf6b9129 mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP
fdf4f011c600 iavf: send MAC change request synchronously
5aa9efb55917 iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test
b030fde64450 drm/amd: Create a device link between APU display and XHCI devices
2d06cb25a497 ip6_gre: remove obsolete ERSPAN PMTU update
903a2ab8325a PCI: dwc: Return -EIO from dw_pcie_wait_for_link() if device is not active
adc0d81b4d41 PCI: dwc: Return -ENODEV from dw_pcie_wait_for_link() if device is not found
e32aa1d85126 RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables
3c03f6f7c6f2 usb: gadget: f_hid: Add missing error code
7820bca8cb20 spi: mpc52xx: clean up interrupt handling
cb444174e58f Linux 6.18.57-xanmod1
bdfd3c3d3684 Merge tag 'v6.18.57' into 6.18
2ff600d29ee4 Linux 6.18.57
d1e095c75d12 HID: steam: Clean up locking
cf71a6ee1d4e HID: steam: Refactor registration
86724f4bcf60 HID: steam: Rearrange teardown sequence
05d39902539a HID: steam: Fully unregister controller when hidraw is opened
3142648c952d sched_ext: Generate qseq from a per-task counter
f94a12ddd318 drm/amd/display: Don't replace a sink mode that shares the native totals
82ac8c4939bd regulator: of: fill in supply names in of_regulator_bulk_get_all()
32642616a8d7 SUNRPC: Add Kconfig dependency on CRYPTO_KRB5
69bf8d145ee1 can: fix unique skb identifier regression under RPS
cf32eb20dfac xfs: fix exchange-range-to-eof file size exchange
7d3b9b2c9dc5 xfs: stop exchanging reflink flags when exchanging mappings
87655adb5ddb xfs: remove duplicate INO1_WRITTEN check
30e08c92118c ACPI: scan: Use acpi_setup_gpe_for_wake() for buttons
d0813c7c09df ACPI: scan: Do not mark button ACPI devices as wakeup-capable
5e9c814ee4da workqueue: Annotate alloc_workqueue_va() with __printf(1, 0)
2d2c32b1b9e3 accel/amdxdna: Fix crash when destroying a suspended hardware context
a82142af837f accel/amdxdna: Fix race condition when checking rpm_on
27f52d4089ad accel/amdxdna: Resume power for creating and destroying hardware context
44e61f183483 s390/zcrypt: Pad trailing CCA or EP11 message with zeros
00a44ff06bcf s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing
f463f474773a s390/zcrypt: Improve EP11 CPRB length and overflow checks
584400144020 s390/zcrypt: Improve CCA CPRB length and overflow checks
7673661a8adc workqueue: fix devm_alloc_workqueue() va_list misuse
5c03da745171 netfs: Fix missing alloc tagging of direct mempool allocations
22adb6751bcf net: fix backlog_unlock_irq_restore() vs CONFIG_PREEMPT_RT
07861e84b766 media: verisilicon: Fix kernel panic due to __initconst misuse
a582e7391fe3 netfs, afs: Fix symlink reading
4719852d14db cifs: consolidate time_last_write stamp into _cifsFileInfo_put()
8f7285d608ed btrfs: make sure EXTENT_BUFFER_READING is cleared under refs_lock
fdee3570b282 drm/panthor: validate userspace queue count against initialized firmware slot count
e3e6779f77ab x86/CPU/AMD: Fix AMD TLBI Erratum #1718
bf0f3412d5a0 drm/vc4: Fix binner slot allocation failing on an idle GPU
4835dbcde5cc vsock: Fix memory leak in vmci_transport_recv_dgram_cb()
2594795fd832 net: openvswitch: validate transport header presence in set_ipv6_addr
0849ecf1c65e ptp: ocp: fix PCIe delay estimation calculation
3938430f0237 mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()
5b1fb3b105ff net/mlx5e: Order ICOSQ cc update after CQ doorbell
e241465838e2 veth: fix peer NETDEV_XDP_ACT_NDO_XMIT after GRO is toggled while down
9caa2eca5cc8 drm/imagination: Fix reference and vm_bo handling in remap()
cc18eb0e9941 flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()
cb0d55754b4f bnxt_en: Re-write the BARs following any type of PCIe errors
fd6a2b055dbc bnxt_en: Drop pci_save_state() after pci_restore_state()
5026c5070b82 bnxt_en: Delay for 5 seconds after AER DPC for all chips
f41becbee8fc bnxt_en: Fix driver init in kdump kernel
8ef2b3ce6d14 bnxt_en: Add bnxt_clear_bars() helper
b18a64964954 pfcp: make sure the SEID is linear before reading it
75e7f850cabd net: bcmgenet: if UMAC was suspended in SW_RESET, restore it to SW_RESET
e378bd870565 Revert "net/mlx5: E-Switch, preserve max tx speed on vport state modification"
972b9285ae53 net/sched: cls_route: reject change with no routing attribute
8de57bfec382 devlink: fix devlink_rel reference leak when notify work is pending
27748588c931 net: sparx5: start the TOD counters on non-PTP lan969x variants
9993e6a0ac1b flow_dissector: avoid u16 truncation of skb->len when computing thoff
0bcebf2c4305 cgroup/cpuset: Call is_in_v2_mode() after acquiring cpuset_mutex in cpuset_handle_hotplug()
1194fd4c6dd1 spi: sg2044-nor: Honor SPI clock limits
f3e80f5132dc spi: sg2044-nor: Return transfer errors
64bb35079dcb ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM
ef15a51966ee ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes
47c0c7a051b7 ASoC: adau1372: allow sleepy powerdown GPIOs
1bee950630df Revert "wifi: ath12k: add panic handler"
e3f7cc4ef04d wifi: mt76: mt792x: pick the SAR table layout from the table itself
83ec70a640fe wifi: mt76: mt792x: treat 0xff ACPI SAR entries as no limit
7fb2d37329c6 wifi: mt76: mt7925: don't put the band auto marker in TGID
0f9afe238eeb wifi: mt76: mt7915: disable rx napi when removing device
f24028216582 wifi: mt76: mt7996: fix struct mt7996_mcu_wed_rro_ba_delete_event layout
0ed29ec00eb3 wifi: mt76: mt7925: restore the legacy BSS after MLO teardown
69aae4146191 wifi: mt76: use ALTX queue for packets to disassociated stations
a18f68c1e72c wifi: mt76: route nullfunc frames to PSD/ALTX queue
9f28f5046508 wifi: mt76: account non-AQL frames per peer rather than per link
65b080310077 wifi: mt76: add PS buffering support for HW-managed TIM drivers
12b467683be5 wifi: mac80211: add ieee80211_txq_aql_pending()
09c6284b21f2 wifi: mac80211: add AQL support for multicast packets
aafd1724f65e wifi: mt76: don't return TXQ when exceeding max non-AQL packets
0cf84535c031 riscv: vector: Fix output operands in context save
b56f9e11ac9f riscv: vector: Fix data pointer constraints in context save/restore
2c77af8bb5dc net: make dev_xdp_sb_prog_count() see programs attached through a link
63bc3cf8d7dd drm/xe/mmio: Fix xe_mmio_wait32() to honor delay/sleep maximums
36d7e2da7a87 btrfs: fix lost error return value in btrfs_listxattr()
a97114b9b00e btrfs: fix xattr replace when multiple xattrs are packed in the same item
2797eb38773a btrfs: unlock inode and extent in caller when io_uring read extent fails
7a3addbdc5ad btrfs: free iov when btrfs_uring_read_extent() fails
033dda5b321f btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio
77de9adf46f5 zloop: zero out only the unread tail of short reads
7057b683922f arm64/boot: Don't set PMUv3p9 FGT2 bits without PMUv3
ce79a6c5cc1b nvmet: use the local P2P device on metadata allocation failure
e76979e27f0c nvmet: return Invalid Field for invalid NSIDs feature 82h
b7725acf9c57 ice: Restore Ordered MMIO Writes for Tx Doorbells
cbab667ef8b5 tee: optee: ffa: support shared memory offsets on large-page kernels
c83bf3973da6 tee: optee: fix kernel-doc warnings
7110c7f70c59 cxgb4/ch_ktls: disable softirqs around tid_list erases
181cb48c1e9a amt: send the relay's General Query directly from the receive path
85e5512369d4 net/sched: em_text: reject unterminated algo before autoload
bea10b84e22e drm/vc4: Free the BO cache size list on teardown
742619c8637b drm/aspeed: Balance the display clock enable on teardown
01318927a905 gpio: exar: initialize the ID before registering its cleanup
5b26dbb27c0c drm/dp: don't mark the AUX backlight enabled when enabling failed
73e8503fac49 Bluetooth: btintel_pcie: Add shared HW reset for clean start
39ab048cce70 Bluetooth: btintel_pcie: fix TX descriptor bounds check
62a167e7e6d8 fs: don't let a migrating task hide its reference from do_umount()
6850385e26bf fs: move mntput_no_expire() slowpath into a dedicated routine
7505f139d899 mount: refuse MOVE_MOUNT_SET_GROUP on an unbindable mount
cc21cda4cac5 arm64: dts: lx2160a: fix the iic5 spi3 pinmux offset and value
5a673697e4a3 arm64: dts: lx2160a: fix IIC1 pinmux submask rejected by pinctrl-single
ab0f32981ce3 arm64: dts: lx2160a: fix incorrect pinmux
fea9c705bbc6 smb/server: fix tree connection leak in smb2_tree_connect()
46a431c0a25a ksmbd: convert tree_conns_lock to rw_semaphore
0af43b52fe4b printk: Don't WARN on kthread_run failure.
9bf96b4347f5 bpf: check_cond_jmp_op(): properly infer if register is null
8a3257f142ae net: stmmac: fix dma mapping leak in stmmac_tso_xmit()
afca229b39ac ipv6: mcast: use rcu_assign_pointer() for __rcu list updates
45462e5ba345 ipv6: mcast: annotate data-races around mca_users
a0cd9e22f8fa bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge
3a39bc9707fb bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks
65f636322ac4 bpf: Mark syscall helpers as sleepable
364a31052aa9 ring-buffer: Add checking nr_subbufs to persistent ring buffer validation
5b40198a0c69 ring-buffer: Skip invalid sub-buffers when validating persistent ring buffer
6bb6ae5ab1be bpf: zero extend the result of an arena 32-bit cmpxchg
c4d3bdb3ab21 bpf: don't rewrite bpf_fastcall patterns entered by a jump
65bea674f43c bpf: Don't infer non-NULL from a pointer with an unbounded offset
8d19e2cdfba9 bpf: Keep refcount_acquire nullable for borrowed RCU kptrs
bb667eb575c9 bpf: Mark NULL kptr stores precise
08b534bafdd9 bpf: Preserve inner map identity in callback frames
3f30b2cd4eba tracing: Fix subbuf resize races with trace_pipe_raw readers
b1fe6379e401 bpf: mark a NULL call argument precise
787405e9e7bd iommu/riscv: Serialize command queue publishing
3e6400e3b8b8 virtio_ring: fix stale descriptor flags after a failed packed add
831dab9b9bcc vduse: validate virtqueue alignment
7f8ee0b8f632 vhost: invalidate vring access on IOTLB transitions
d9232a90c6f7 tracing: Take trace_array reference when opening a tracer options file
30dacb56f072 drm/amdgpu: skip the VMID 0 flush for VRAM
6ac7a2969155 smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid
2be31f252ade smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()
28289d880e6d ksmbd: fix maximum allowed access checks
eb2e3bb27e78 ksmbd: remove redundant DACL check in smb_check_perm_dacl
2e7e39bb8191 remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3
5c9ab0c9cede powerpc/xive: propagate IPI init errors to prevent use-after-free
e3388edec1ff powerpc/xive: add error return value to xive_smp_probe()
ebdd932dc24c ACPI: bus: Introduce acpi_bus_get_primary_device()
041cce629a08 drm/xe: don't WARN on kernel job timeout when device already wedged
40bab0da844c nfsd: convert nfsd_net boolean flags to unsigned long flags word
65aa0a4c4c1b nfsd: use workqueue enable/disable APIs for v4_end_grace sync
96d4b275281b dm-pcache: validate seg_id fields from persistent memory
3d8391d3149a drm/amd/display: Fix dangling pointer in plane reset function
3a03827bb3cd drm/amd/display: Fix dangling pointer in CRTC reset function
f786e7b3adbf dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout
7abc9b49ad01 uprobes/x86: Move optimized uprobe from nop5 to nop10
cf08ff2255de bpf: Reject MEM_ALLOC BTF accesses past object bounds
644cf4e77c27 bpf: Reject writes through untrusted BTF pointers
16a82add1918 platform/x86: dell-wmi-base: Fix handling of ultra performance key
93a20b14f862 bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max
0203146ad450 usb: gadget: uac: validate rate list length before storing
8410cd2690d4 platform/x86: asus-wmi: fix resource leaks on probe failure
1ad6456898f6 esp: do not unref managed frag pages in esp_ssg_unref()
80968b42d130 RDMA/rvt: Return NULL after port allocation failure
6a2e023429a4 fs/resctrl: Fix UAF from worker threads when domains are removed
c6492e174120 cxl/features: Serialize multi-part Get/Set Feature transfers
a60bc2df2d32 firmware: arm_scmi: Fix SCMI device destroy lifetimes
f85333284fcb firmware: arm_scmi: Fix OF node reference handling
21bc07293ec4 firmware: arm_scmi: Clear SystemPower flag on create failure
074d06204019 ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find()
094f0a895cf9 bpf: Fix WARNING in bpf_tracing_link_release
01b5fcdc30c0 pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip
f3480c59f4ce scsi: ufs: core: Validate string descriptors
9d39f6dda00f scsi: ufs: core: Convert string descriptor format macros to enum
268cbe3a36ae iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc()
c36816feff47 PCI: Fix UAF when probe runs concurrent to dyn ID removal
5e81d109f2e2 PCI: Fix dyn_id add TOCTOU
0787e34b894b PCI: Make pci_match_one_device() match on ID instead of device
2fcd26f46801 RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry()
ffd56ada81f9 nvmet: fix return status of RMI log page on allocation failure
f2be47fa8e22 drm/panthor: Add vm_bind region with kbo range overlap check
23bed4ef132c wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event()
ffcc9ea4e4d1 md: remove REQ_NOWAIT support from raid1/10/456
7a1b971b799e wifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx()
2aa3d3b9fac9 wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete
aca0cd273b48 wifi: mt76: cancel reset and rc work on device unregister
9a9e902bd055 bpf: Reject >8 byte return values on return-reading trampoline paths
e512823aabbd wifi: mt76: mt7996: clear stale link state on full reset
e9e2854fcff5 arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry
0ec1d14cf302 wifi: nl80211: clean up color-change beacon data on errors
f334b26b884d wifi: brcmfmac: fix P2P action frame handling without device vif
9260a92ce90e serial: core: do fallible allocations before the console can be registered
ddf51d74ee9f serial: core: clear freed pointers on uart_register_driver() failure
2af4c46b4299 tty: skip cdev_del() when no cdev is registered
2fd9c8112907 HID: logitech-hidpp: Fix FF device cleanup on init failure
8397942b6712 ublk: validate auto buf reg before taking uring_cmd
f81972b235f3 bpf: Invalidate RCU pointers after final spin unlock
3556caa31a2b PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers
9b405b3e7e13 thermal: hwmon: Remove hwmon class device along with its parent
9d44822ba34d ocfs2: o2hb: quiesce negotiate handlers and timeout work
bf4bd72020f3 ocfs2/heartbeat: fix slot mapping rollback leaks on error paths
1f0f61573ba4 bpf: Clear buf on error in __bpf_get_task_stack
35ef785b25ee bpf: Remove trace_in argument from __bpf_get_stack
63669625833c bpf: Factor callchain_finalize function from __bpf_get_stack
8c30d9fd61eb bpf: Factor callchain_store function from __bpf_get_stack
562d24ac214b drm/amd/display: Resize MST HDCP per-connector arrays to 32
b5896fc269e9 drm/amd/display: disable replay when crc source is enabled
d5f3dae82705 coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable
e90f746f4ca3 scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails
fcee001f57bd scsi: sd: Move the sd_config_discard() function definition
ce8103676f4d btrfs: check if root is readonly when setting posix acl
172f349f2c59 btrfs: apply the AUTO_K(V)FREE macros throughout the code
58b0ab0340ce btrfs: zoned: flush active metadata block group at btree_writepages() start
243bf1e45e40 iommu/vt-d: Fix iopf_refcount leak on RID domain replacement
11dfe2896ea2 iommu: Pass in old domain to attach_dev callback functions
6822ba1ae9b6 NFS: Return a delegation the client fails to record
e4ab436d5ba6 bpf: Compare iterator types during state pruning
a25ea67a913f clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type
6e6f8e3bfc66 nvmet: fix max_qid race between configfs and controller allocation
5c6593422eb3 blk-iolatency: clear delay state when freeing policy data
b399a88eb8b1 blk-iocost: clear delay state when freeing policy data
f4ca62414f4f blk-cgroup: delay freeing policy data after rcu grace period
d4ba9d888ac0 bpf: Check pointer type for all atomic RMW paths
272c05a51285 ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user()
dc1e34f78dfa ksmbd: serialize oplock close with pending break ownership
ff6870cf3b7e ksmbd: defer publishing granted locks to prevent UAF/double-free race
52b91bc5253b ksmbd: safely discard unregistered deferred locks
f77d2accafca ksmbd: detach blocked lock requests before freeing
1ff0e41afbe7 ksmbd: scope session state changes to bound connections
d39da3ff8d39 dpll: fix NULL deref in dpll_device_ops() during teardown race
5235abdb760b virtio_net: Fix resize of the RX ring
0887d41abf76 irqchip/gic-v5: Clear per-CPU IRS data on teardown
f57b0fd1c62e ip6mr: do not clone dst in ip6mr_cache_report()
884cbf15ccd3 net: bridge: arp/nd proxy: fix reading neigh ha
f43ef9a3f9c1 vxlan: fix reading neigh ha
f4d23937e1c4 NFSv4.1: zero referring call lists before decoding
68fb30607169 net/sched: account classifier filter allocations to memcg
1ca1df82d924 fuse: Fix the condition to enable over-io-uring
8460dc49c975 Bluetooth: L2CAP: access chan->conn safely in get/setsockopt
8a8585e421d0 Bluetooth: do not leak an hci_conn when a second LE connect is rejected
7b3e08eea1e8 net: mana: Cap MSI-X vectors to the device MSI-X table size
c08314f91782 octeontx2-af: fix cn20k mailbox lifetime on repeated rvu_mbox_init()
c6b56b8d549a netfilter: nf_tables: skip double clone set expressions on element insert
ef4dee4640c6 KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped
506f03b5f869 LoongArch: KVM: Validate MSI data before routing it to EIOINTC
34a2a7134fd6 LoongArch: KVM: Get VM PMU capability from HW GCFG register
56c2c5ad3561 media: chips-media: wave5: Resume device before setting EOS flag
c26cbd5c33cd drm/amdgpu: force complete the KIQ ring fences on reset
7d722821e2f6 drm/amdgpu: force complete the MES ring fences on reset
ef073edd7cfd zram: fix out-of-bounds access in writeback_store()
836ce2b99bcc lockd, nfsd: RCU-protect nlmsvc_ops dispatch
df5500ab85df nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths
9646dfee8807 ceph: fix UAF in check_new_map() on session freed during unlock
e1f692b6da3e cifs: call pagecache_isize_extended() in cifs_setsize() when extending
548176612504 ext2: Fix lost inode updates for IS_SYNC inodes
0692a8fdf022 kho: fix size calculation in kho_preserved_memory_reserve()
996dd15f6012 SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2
5909f8f04e9b SUNRPC: Switch MIC token verification to crypto/krb5
ffb0423b4f4b SUNRPC: Switch MIC token generation to crypto/krb5
1e9125bb7948 SUNRPC: Switch wrap token decryption to crypto/krb5
5ec781a29eed SUNRPC: Switch wrap token encryption to crypto/krb5
6b4d0c9cf2b1 SUNRPC: Prepare crypto/krb5 encryption and checksum handles
5cf04fdbbf30 SUNRPC: Add errno-to-GSS status conversion helper
08efba8d6256 SUNRPC: Add crypto/krb5 enctype lookup to krb5_ctx
65f0f82f2033 svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails
35d5dd0c2fd1 svcrdma: wake sq waiters when the transport closes
f35cf68b1442 svcrdma: Add Write chunk WRs to the RPC's Send WR chain
ddbd71a37809 RISC-V: KVM: Fix PMU event info array size overflow
0d4316e30efc KVM: riscv: Fix Spectre-v1 in PMU counter access
0f035333e199 ntb: Store original DMA address for future release
b8cd3b632a0c NTB: ntb_transport: Use ntb_get_dma_dev() for DMA buffers
6a01c4d3a3ae NTB: core: Add .get_dma_dev() callback to ntb_dev_ops
7672973957e3 tipc: avoid busy looping in tipc_exit_net()
ed7e9715849a fbdev: Wrap user-invoked calls to fb_set_var() in helper
69164d6bdad5 drm/amdkfd: Add bounds check for CRAT subtype length
39841db9322c drm/amdkfd: Fix infinite loop parsing CRAT with zero subtype length
22c2169770ad bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie
bea1f73ad69e drm/amd/display: check if dml21_add_phantom_plane() is successful
63844dc03960 dmaengine: idxd: fix double free of wq, engine, and group structs
e299b7d1334e idpf: bound interrupt-vector register fill to the allocated array
a4de6fc95b2f Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks
e124f7b17033 soc: xilinx: Fix race condition in event registration
afef4b0de4f3 drivers: firmware: xilinx: Switch to new family code in zynqmp_pm_get_family_info()
a19c48d9f5a7 drivers: firmware: xilinx: Add unique family code for all platforms
547ea9f56749 netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag
be7fb59512ff btrfs: lzo: reject compressed segment that overflows the compressed input
0977a6f23439 optee: ffa: Add NULL check in optee_ffa_lend_protmem
fdc93f4a8010 scsi: core: pair EH runtime PM get and put
5cea36555944 ovpn: defer key slot crypto freeing to workqueue
eb81c8e758f4 ipvs: revalidate ihl to prevent out-of-bounds access
d10e73572cda eth: bnxt: avoid deadlock when canceling IRQ affinity notifier
21f5381a57a5 eth: bnxt: decrease indent in bnxt_request_irq()
bf3f37c2d40b gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock
868c478abce8 soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read
056876c9db1e btrfs: lzo: reject inline extents without valid headers
618fc8dc219c accel/amdxdna: Fix locally exploitable BUG_ON in amdxdna_insert_pages()
b3d05a335cbd accel/amxdna: Fix page-insertion errors in amdxdna_insert_pages()
4af94462c0ca bpf: Fix netns reference imbalance in conntrack kfuncs
b57164cdddb4 vhost_iotlb: bound map allocation in add_range
2b80707b9e27 eventfs: Use children field for rcu head and add memory barriers
969a96479add btrfs: skip global block reserve accounting for rescue mounts
f5427cab0656 btrfs: warn about extent buffer that can not be released
23b0f4117e97 btrfs: only invalidate btree inode pages after all ebs are released
a6f972c50552 btrfs: split btrfs_fs_closing() and change return type to bool
f8e5715a3737 KVM: arm64: vgic: Fix race between LPI release and re-registration
4b296d176580 nexthop: take nh->lock for f6i_list walks in replace check and notify
f97fae992155 nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush
2c0a8cc97a9d xsk: reclaim invalid Tx descriptors in ZC batch path
1ff789fdfa23 xsk: provide sufficient space in pool->tx_descs
9990cac513e8 net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds
15ed8a9b7c63 netfs: Fix folio_queue ENOMEM in writeback by adding a mempool
ff5625d27415 Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback
ff926f3ef6c8 Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs
946dc5835c8f net: Convert proto_ops bind() callbacks to use sockaddr_unsized
f1b4c6aaf765 hdlc_ppp: fix potential null pointer in ppp_cp_event logging
68ffe4265775 Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback
a76243488740 octeontx2-af: Block VFs from clobbering special CGX PKIND state
59adeedebf02 s390/zcrypt: Close speculative mem read possibility
20b0b0159390 s390/zcrypt: Rework domain processing within zcrypt device driver
2a25ddf0bf6d s390/zcrypt: Move inline function rng_type6cprb_msgx from header to code
23a541c31b45 drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport
029b363c9b69 md/raid1,raid10: fix error-path detection with md_cloned_bio()
bcf30e14d2bd md/raid1,raid10: fix bio accounting for split md cloned bios
ea2d1d2ebf60 md/raid1,raid10: fix deadlock in read error recovery path
e4a59511e1ab md: replace wait loop with wait_event() in md_handle_request()
55c6f05b6677 wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic()
c09314b8b4c6 wifi: ath12k: fix inconsistent arvif state in vdev_create error paths
d94bf50756d7 ocfs2: validate fast symlink target during inode read
b4059a1f57ef bpf: Reject sleepable BPF_LSM_CGROUP programs at load time
68cf46755894 wifi: mac80211: bound S1G TIM PVB walk to the TIM element
0901d2c89442 wifi: ieee80211: split S1G definitions out
f488b83a3810 ixgbe: do not configure xps for XDP queues
29e07ec352f0 ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT
0bc97a4110e8 ext4: add mext_check_validity() to do basic check
6166cb1344f1 iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path
98c7e206af48 cxl/region: Block region delete during region creation
53fb46cf933d netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them
fcacd948b10a netfilter: nft_fwd_netdev: use recursion counter in neigh egress path
7d5a0dc8eaab netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding
33aed3ba04aa RDMA/bnxt_re: Free CQ toggle page after firmware teardown
2106c337905d RDMA/bnxt_re: Add a max slot check for SQ
b422e3eff0ed net: serialize netif_running() check in enqueue_to_backlog()
9a6916a93427 net: fully inline backlog_unlock_irq_restore()
459536b3acf1 net: optimize enqueue_to_backlog() for the fast path
580896e33003 fs/ntfs3: call _ntfs_bad_inode() when failing to rename
da6675b39351 fs/ntfs3: Reformat code and update terminology
308d7951ca22 i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev()
7a4504606879 md/raid1: fix writes_pending and barrier reference leaks on write failures
c642583adc13 md/raid10: fix writes_pending leak on write request failures
453f4f1e90de bpf: Guard conntrack opts error writes
644b4c05bd1a bpf: net: netfilter: drop dead NULL checks
3827ff67f9fb tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy()
9de9e8f279de drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock
bc8f2d1c6f7c xen/pvcalls: bound backend response req_id before indexing rsp[]
177d22d31a4e iomap: release pages on atomic dio size mismatch
0be672071d6e net/mlx5: LAG, Fix off-by-one in single-FDB error rollback
31cc289d5b17 Bluetooth: 6lowpan: avoid untracked enable work
3dd12422653a accel/amdxdna: Fix VMA access race
33819cca7b76 accel/amdxdna: Refactor GEM BO handling and add helper APIs for address retrieval
bf63433873a0 accel/amdxdna: Fill invalid payload for failed command
08ff33dce6f9 net/liquidio: drop cached VF pci_dev LUT
241cf3b7455b accel/amdxdna: reject user command submission without a command BO
0a2c89d538fd ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD
4739b1b833cf ata: libata-core: Disable LPM on Silicon Motion MD619{H,G}XCLDE3TC
1c3d9c6bd5b7 wifi: mac80211: validate extension-frame layout before RX
9cbad9c8125f net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains
c59a693fbd21 drm/amd/display: use kvzalloc to allocate struct dc
c2ddd180bbee wifi: cfg80211: use wiphy work for socket owner autodisconnect
01f8a354497b bpf: Fix UAF in sock clone early bailouts
0b2c44363432 bpf: Use rcu_read_lock_dont_migrate in bpf_sk_storage.c
88c38ff74f83 drm/xe/guc: Keep scheduler timeline name alive
81f70f130eff drm/xe/guc: Hold device ref until queue teardown completes
8549ac21ab50 bnxt_en: Handle partially initialized auxiliary devices
e611403f3092 fwctl/bnxt_en: Refactor aux bus functions to be more generic
5d3cea7d41dc tipc: serialize udp bearer replicast list updates
6089f561e2c3 cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths
984ce52ea0e0 cifs: prevent readdir from changing file size due to stale directory metadata
0c07e046e639 drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers
16656c3d7346 LoongArch: BPF: Zero-extend signed ALU32 div/mod results
08fffd2881e2 idpf: fix max_vport related crash on allocation error during init
c174969f6af6 drm/i915/gt: Fix NULL deref on sched_engine alloc failure
f7e744bac9a7 drm/amdgpu: Fix kernel panic during driver load failure
cfb5a56c2188 ksmbd: prevent path traversal bypass by restricting caseless retry
3eaec47518e1 smb/client: fix chown/chgrp with SMB3 POSIX Extensions
d16713c06006 wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon
3f9c0fdefa04 KVM: guest_memfd: Treat memslot binding offset+size as unsigned values
5afc2d9b86be netfs: Fix zeropoint update where i_size > remote_i_size
b76568c67218 drm/msm/adreno: Fix a reference leak in a6xx_gpu_init()
fcb23bb31508 erofs: fix metabuf leak in inode xattr initialization
48d09dea506d net: hsr: defer node table free until after RCU readers
a2650f8461cd wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb
3899d6f92492 wifi: mac80211: fix missing RX bitrate update for mesh forwarding path
f669571a2bf5 netfilter: x_tables: allocate hook ops while under mutex
a014668cbd95 netfilter: x_tables: allow initial table replace without emitting audit log message
f048f297d93f netfs: Fix missing barriers when accessing stream->subrequests locklessly
93531bca4670 afs: Fix the locking used by afs_get_link()
86f4c1586418 cachefiles: Fix error return when vfs_mkdir() fails
b9390aa62fdc nvme-pci: fix dma_vecs leak on p2p memory
fba32257979d nvme-pci: fix dma mapping leak on data setup error
c85f325d9ec3 ACPI: button: Fix ACPI GPE handler leak during removal
78677084cd09 ACPI: button: Tweak acpi_button_remove()
38c79dacc806 ACPI: button: Convert the driver to a platform one
bad88022f894 ACPI: button: Adjust event notification routines
4ec3a8ca9739 net/sched: fix packet loop on netem when duplicate is on
b050fd0c2063 net: Introduce skb tc depth field to track packet loops
2090c1a23683 KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor
fa34d3e14cb7 drm/amdgpu: fix amdgpu_hmm_range_get_pages
768daa9f4276 netfilter: nf_tables: add hook transactions for device deletions
7e4ab3907f44 f2fs: read COW data with the original inode during atomic write
8363c219d88e fbdev: omap2: fix use-after-free in omapfb_mmap
48ac6bab9999 fbdev: omap2: fix inconsistent lock returns in omapfb_mmap
4338663dfd21 power: supply: max77705: Free allocated workqueue and fix removal order
4e1af66d855f power: supply: max77705: Drop duplicated IRQ error message
fa4be2054a3e workqueue: devres: Add device-managed allocate workqueue
5459933a799a net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind
a8c1480bb066 drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED
afe815a67ec8 wifi: cfg80211: enforce HE/EHT cap/oper consistency
daacc9d1430b ptp: ocp: fix resource freeing order
9446167bef89 ptp: ocp: Make ptp_ocp_unregister_ext() NULL-aware
de05e37d02f3 ublk: reset per-IO canceled flag on each fetch
09207dc57ab4 powerpc/64s: Fix unmap race with PMD migration entries
e72ffe59e48a greybus: raw: fix use-after-free on cdev close
cb06a07d835b f2fs: fix data loss caused by incorrect use of nat_entry flag
910e498613d5 ice: fix double-free of tx_buf skb
c789649d4334 ice: fix potential NULL pointer deref in error path of ice_set_ringparam()
e98cea6d5562 ice: fix race condition in TX timestamp ring cleanup
cbfbc9d446d9 ice: reshuffle and group Rx and Tx queue fields by cachelines
349499a65b6b ceph: put folios not suitable for writeback
5df268406ef3 libceph: Fix potential out-of-bounds access in __ceph_x_decrypt()
d0ce7b07dafe drm/ttm: Fix ttm_bo_shrink() infinite LRU walk on backup failure
060f8f302051 drm/ttm: Fix ttm_bo_swapout() infinite LRU walk on swapout failure
dc24e03be0e4 Revert "net/smc: Introduce TCP ULP support"
2da62dbb4169 drm/amdgpu/userq: fix access to stale wptr mapping
b33d6f5da16e pseries/papr-hvpipe: Fix race with interrupt handler
51a321dec76f papr-hvpipe: convert papr_hvpipe_dev_create_handle() to FD_PREPARE()
1d15503e454b drm/amd/display: Fix dc_link NULL handling in HPD init
96889fcdb098 media: iris: fix use-after-free of fmt_src during MBPF check
46edfdcf95d2 media: iris: turn platform caps into constants
b0eb0a8959ac KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT
73df74544b55 udf: fix partition descriptor append bookkeeping
4456be93464a gfs2: fix memory leaks in gfs2_fill_super error path
370154a83a83 gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn
1b6a9f81c471 gfs2: Get rid of delayed withdraws
dfd14e14772c gfs2: Asynchronous withdraw
604dca7c20a1 gfs2: Add clean argument to lm_unmount hook
74b981f0d3b9 gfs2: Clean up quotad timeout handling
9e0652e243ef gfs2/sysfs: Replace sprintf/snprintf with sysfs_emit
e0e31a7ed119 ASoC: amd: acp-mach-common: Add missing error check for clock acquisition
4097a2afe8ac scsi: qla2xxx: Completely fix fcport double free
57a79c5df057 soc/tegra: pmc: Fix unsafe generic_handle_irq() call
5133ef7c893c media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC
6c5d98f24f99 media: v4l2-mem2mem: Add a kref to the v4l2_m2m_dev structure
6ad4caadc634 btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref()
6311ee6daa9c btrfs: remove 'reserved' argument from btrfs_pin_extent()
81e1ae665004 btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure()
559f856b109c hfs: Replace BUG_ON with error handling for CNID count checks
3a409a64b2d6 ASoC: qcom: q6asm: drop DSP responses for closed data streams
d9bf525dff80 ASoC: qcom: q6asm: handle the responses after closing
02b033e18e08 drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35
203a9241a738 drm/amd/display: Rename FAMS2 global control lock to DMUB HW control lock
28768bc7ea0b srcu: Use irq_work to start GP in tiny SRCU
37419fa1b0bc irqwork: Move data struct to a types header
d14847cb7f65 mshv: Fix error handling in mshv_region_pin
f33de03b47c1 mshv: Move region management to mshv_regions.c
06c0ce18055a mshv: Centralize guest memory region destruction
93ed80634288 mshv: Refactor and rename memory region handling functions
a40a75df3326 static_call: allow using STATIC_CALL_TRAMP_STR() from assembly
5cfa4f537a05 Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists
971854e7b6dd ALSA: ctxfi: Check the error for index mapping
88cc09bb7065 ALSA: ctxfi: Refactor resource alloc for sparse mappings
1422b94887c5 ALSA: ctxfi: Use explicit output flag for DAIO resources
c0904c424f7d ALSA: ctxfi: Add hw parameter to daio_mgr_dao_init()
dbc8b8d33c9e Bluetooth: hci_event: move wake reason storage into validated event handlers
c516c2e06fe5 net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path
2352d719cccf net: ti: icssg-prueth: Make emac_run_xdp function independent of page
2157742f5c32 net: ti: icssg-prueth: Add functions to create and destroy Rx/Tx queues
41f3fa0d14bb ti: icssg: convert to ndo_hwtstamp API
6e5c3ddf17a2 blktrace: fix __this_cpu_read/write in preemptible context
6b3546e3a8c6 accel/amdxdna: Fix NULL pointer dereference of mgmt_chann
2f62f8be5788 PCI: endpoint: Add missing NULL check for alloc_workqueue()
b0d908230b3d PCI: Add WQ_PERCPU to alloc_workqueue() users
b569ff8a1bc1 accel/amdxdna: Fix potential NULL pointer dereference in context cleanup
09ed30edcfa1 accel/amdxdna: Add hardware specific attributes
3bdd26582d02 accel/amdxdna: Enhance runtime power management
5a7d0e281089 ata: libata-scsi: do not lose CHECK CONDITION for failed ATAPI commands
e01c79761c7b namespace: handle mount locking for automounts correctly
6b8dc3713a76 namespace: never expire a locked mount
494c57572d2d namespace: refuse an automount below a mount that is in no namespace
fa75dae156df fcntl: refuse F_SET_RW_HINT on an immutable inode
5f97df8ca7fa namei: don't reveal overmounted entries in refwalk
d29cd99db3db namespace: unhash a dentry before detaching the mounts on it
7e1c466011ba namespace: don't let a pseudo dentry become the root of a mount
390ddcea2a8a dcache: don't put a mountpoint on a dentry that's being removed
e3aba6900483 namespace: check the mounts before reading their parents in pivot_root()
888363d74c3b namespace: remove the fsnotify marks of a mount namespace in process context
b9c40553f6ce namespace: look at the topmost mount for a mount namespace file
a0ba48256f5d namespace: check a recursive bind mount for mount namespace loops
d73f04e92c1a namespace: check a submount for references right before unmounting it
acbe9e4418e2 namespace: queue a mount only once for mount notifications
33b4344f6901 namespace: check the target before walking it in do_mount_setattr()
c44f5c30f0a9 fs: refuse fspick() on internal superblocks
b47b40c4f058 namespace: don't copy an unmounted mount tree
eecc9cd0fc07 namespace: don't inherit MNT_UMOUNT in clone_mnt()
5e0a1f2c753a namespace: reset the old parent's ->overmount in mnt_change_mountpoint()
bf2c8dec26fb fs: don't silently unmount busy mounts
9bd1181b36f2 mount: keep a copied mount unbindable
c6307228af65 drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs
d9da2f7bbbff drm/amdgpu/userq: return the memdup_user() error for the user MQD
112dbe2b10d6 drm/amdgpu/userq: only accept doorbell BOs as queue doorbell
21aee7fc9310 drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks
1a5c03198ae8 drm/amdgpu: make Mac FB workaround generic
8d6f773d7479 drm/amdgpu: serialize vblank counter reads against GPU reset
3d4890b4ab04 drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info
f009879ed990 drm/amdkfd: align SDMA doorbell base for shader doorbell writes
3a11adcfd9a2 drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin
993c952e6832 drm/xe: Fix shrinker accounting double-subtraction on nested external pins
76e5ddd7d982 drm/vmwgfx: validate pitch coming from userspace
ea22f8a5d11a drm/vc4: Fix firmware reference leak in vc4_drm_bind()
e61465d3e029 drm/vc4: drain the hangcheck timer and works on V3D unbind
f9b215b3e37a drm/imagination: Size page table preallocation by device address
0b4a0fb98b9f drm/i915/gt: Unmask interrupts only when ACTIVE is true
152fb5083b93 drm/i915/gem: Prevent overstepping exec array boundary
cd7bec509c18 drm/gud: don't keep a connector without a CRTC as connector_state
4e7b508c7c60 drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN
a661f401f83b Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown
4f46de658ce6 Bluetooth: RFCOMM: free the skb when the DLC has no owner
b108ea7ebba1 Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()
ec227cddd13c Bluetooth: MGMT: Fix status of pending commands flushed on power off
c6489a3a0ac8 Bluetooth: ISO: Serialize concurrent connect calls
90b744066ca5 Bluetooth: ISO: Reject concurrent BIS listener setup
7db33b36213a Bluetooth: hci_sync: Fix command skb lifetime during scan setup
c3d279987790 Bluetooth: hci_sock: Serialize dead-device detachment
c9c20d334cd5 Bluetooth: btintel_pcie: use managed IRQ teardown
71beae6f2e8b riscv: hwprobe: use _BITULL() rather than BIT() in MIPS vendor uapi header
2e5c80bbc062 riscv: futex: untag the user pointer before the atomic access
b86e88a3dc6e riscv: fix load_unaligned_zeropad() fixup for RV32
fa465a7819ec riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE
7d1367a53137 riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp
8bfcbd502281 scsi: qedi: Initialize callback state before registration
ce2eee635fd3 pmdomain: rockchip: propagate subdomain add errors
1072890e6c1a pmdomain: rockchip: fix clock leak on domain probe failure
5874c0e2bd03 pmdomain: rockchip: don't ignore clock lookup errors on attach
28606d4d4dbe pmdomain: imx8m-blk-ctrl: Serialize power on/off across sibling domains
f6fbe9c6b399 regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4
199a62d70314 regulator: ltc3676: don't read the write-only HRST and CLIRQ registers
681adbc9c7a8 optee: register TEE devices only once fully initialized
55f12552b00a openvswitch: fix soft lockup in the netlink flow dump
558a189ca357 nvme: fix swapped ZRASF zone state values for full and read only
961563117626 net: team: free skb when broadcast has no txable port
0c0568c9d35c net: team: stop reusing skb after queue override
5b144f83f217 net: usb: ax88179_178a: fix rx frame length for non-last packets
cc7cc5955d22 net: sparx5: free the matchall entry on destroy
5551399751e2 net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()
d7fea7141036 net: dsa: microchip: fix KSZ8765 fiber detection
d109141ba146 net: bridge: avoid recursive multicast port cleanup
6a1833f0d7dc net/smc: protect clcsock lifetime in smc_getname
3efe0e094415 net/packet: guard the ll header push in packet_rcv_spkt()
3a1caa886d41 mmc: sdhci-sprd: disable runtime PM on remove
46e75703ca3f mmc: mtk-sd: Cancel request timeout work on remove
9ac3fd9dc917 mmc: cavium-thunderx: destroy slot platform devices on remove
8668f432a9bf mmc: cavium-octeon: destroy slot platform devices on remove
e3bf232c913b dm: fix reading free memory in do_resume
c86f80cd246c dm-snap: reject the transient exception store for snapshot-merge
4f0ee735dc68 dm-integrity: fix buffer overflow in inline mode with large tag size
a1a875614dae dm-crypt: reject the lmk IV mode with AEAD ciphers
7a25ca170c12 mm: don't schedule deferred kernel page table freeing while booting
d7e811c3a49c memstick: rtsx_usb_ms: complete requests after eject instead of dropping them
f2795c50144d memstick: core: wait for request completion before freeing card
11516a0c402a KEYS: Fix add_key() race with keyring restriction
955b1f75c400 keys: finalize persistent keyring timeout after link attempt
beb05f484a1e ice: fix metadata_dst refcount handling on representor teardown
ca8a6285b11d ice: fix use-after-free in dynamic port cleanup
bb8f6b89587d ibmveth: fix TX LTB and filter unwind on open-fail
a065bd31ec46 ibmveth: h_free logical LAN on open-fail after register
06656aaa7e43 gve: fix XSK buffer leak on error descriptor
506f9de069d0 gve: fix XSK buffer leak when rings are stopped
42935a610019 gve: fix napi_disable deadlock when attempting to disable XSK pools
a027e0d7765d gpio: xilinx: fix runtime PM leak on request error path
76390ac0bca7 gpio: mpsse: fix race when arming the IRQ poll worker
1eb70d10bbb8 EDAC/amd64: Mask UMC chip select to the four implemented selects
2d79ddc9a0cc sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute
5509d498e1b9 selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts
5a41bcc5057d selinux: fix data race on AVC latest_notif
215c29f7f460 Revert "wifi: libertas: reject short monitor TX frames"
1428c5f1d346 tipc: hold a reference to nodes found by link name
0af8780bdfdf tipc: destroy topsrv workqueues before closing connections
1c7463ac0e99 tcp: reject net_iov in zerocopy receive mapping hints
3d555c31b0d2 swiotlb: fix default_swiotlb_limit() for non-growable default pool
d2b5f637b9b6 strparser: make sure __strp_recv isn't running before tearing down the parser
65cb86860a80 tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()
086944c1c2cb xen/netfront: don't leak the skb when xennet_fill_frags() fails
b12a25fb2b9d workqueue: Fix NULL current_pwq deref in chained work check
4d64a3d6e96a wireguard: noise: reject response consumption after intermediate initiation
38da24fd5c9d wireguard: queueing: preserve tstamp_type when encapsulating packet
d730b466496c wifi: mt76: mt7996: fix uninitialized buf read in mt7996_variant_fem_init()
dd117d17e8aa wifi: mt76: mt7603: initialize global station WCID
eef16a74ff8e wifi: brcmfmac: fix P2P device removal race in brcmf_detach()
38bad3930b11 vsock/virtio: account only unread bytes in read_skb()
6139c710d8be usb: f81604: fix struct f81604_int_data size mismatch
5680b6fb3054 dm ioctl: don't let data_start run past the buffer
2200fe1d6148 cipso: adjust cached option offsets when removing CIPSO
8d88d3221204 cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus()
12ba7d8b9cd4 btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()
a768b88cd157 ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P)
13bbcfe755d4 arm64: irq: exclude the softirq stack switch from KCOV
1ea724110175 ALSA: hda/tas2781: Accept V1 calibration data without CRC
f7dc71c1ce88 ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers
0b0278e760d7 Input: xpad - add support for Corsair Novablade Pro
2e4f80c02311 Input: xpad - add support for 8BitDo Pro 2 Wired Controller for Xbox
d738e51bf2c2 Input: ati_remote2 - fix type confusion in device attribute handlers
4ac7d92a4698 ipv6: do not warn on route notification size race
7dfa7ca97f3a ipv4: do not warn on route notification size race
c1f48d1c2d5e ipv4: stop route notification sizing when nexthop group shrinks
21cba134c30c ipv4: stop exception dump when nexthop group shrinks
c6d670ac656b ipv4: stop PMTU walk when nexthop group shrinks
71cbad138969 rust_binder: reschedule node refcount update on thread exit
f3e835af6226 ipv4: validate checksum_start before completing checksum
fa1bceba169b ipv6: Fix redirect exception creation for UDP/RAW sockets
61a32face36f crypto: drbg - Fix ineffective sanity check
af98611ad109 net: dsa: mt7530: fix .get_stats64 sleeping in atomic context
4d8ed219b192 f2fs: fix to reset all pinned status during fggc
b2cf17d39dd2 f2fs: fix to shrink gc_lock coverage in f2fs_gc_range()
3f63f071bf82 accel/amdxdna: Bound the sync_bo flush range to the BO size
d7b9770a487e ynl: fix schema check errors
3a49853272bd doc/netlink: netlink-raw: Add max check
56760e83aa4e netfs: zero the tail of a short DIO/unbuffered read
61519a5a1d70 net: mana: Skip WQ object destruction for uninitialized RXQ
b5aa7f1773f8 net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq()
867119b4b588 net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
639522e5056c net/mlx5e: Prevent stale XSK buffer release on refill retry
50cff3f112d6 fs: Free any excess xarray nodes in clear_inode()
fbd977e51397 bnxt_en: fix DMA mapping length for padded small packets
95d03facd0b1 Linux 6.18.56-xanmod1
a893a19142a7 Merge tag 'v6.18.56' into 6.18
17ad2612c11a Linux 6.18.56
a47406c769f7 ipv4: free inet_opt and ireq_opt after an RCU grace period
b473ee29aa0d iio: adc: adi-axi-adc: Initialize state mutex
bb29dd90885b iio: adc: adi-axi-adc: Make use of dev_err_probe()
e05c55de819b iio: buffer-dmaengine: fix sg entry iteration when building dma_vecs
845c959178cc net: mana: Sync page pool RX frags for CPU
55aa2774323e net: mana: remove double CQ cleanup in mana_create_rxq error path
72d2f5436789 xen/netfront: drop RX packets with a short Ethernet header
626deff23b54 net: usb: qmi_wwan: add Quectel EG120K-EA
525694a6021e KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails
81d787551590 KVM: x86: Add static calls for nested virtualization ops
69f1d46341c2 KVM: x86: Reject nested CAP enablement if nested virtualization is disabled
9a4605ac9045 KVM: move TSS constants from kvm_host.h to tss.h
318ef696fa3c KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted
267c586a090a KVM: arm64: Use stage-1 leaf size for VM_PFNMAP
1113374a17d7 KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT
e4f086a7d707 KVM: arm64: Always populate FGT masks at boot time
a014b1a377e4 KVM: x86: Move IRQ-related helper declarations from kvm_host.h => irq.h
cf0654248c87 arm64: errata: Add Cortex-A725 erratum 3821522 workaround
424e851050f4 arm64: errata: Factor out broken AMU const counter cap
277c4d8eac0b arm64: mm: Fix the break-before-make flush range for erratum 2645198
e506333d1b9f perf: Require kernel access for text poke events
2581b43e162c perf/core: Check kernel access when kernel callchains are requested
a16986dac7be perf: Replace perf_event_header__init_id with full header init
624370942abd unwind: Shorten lines
08bf919f041a tty: fix saved termios reset race
9e8595cbd31d usb: typec: ucsi: acpi: Assume UCSI 1.2 on Acer Nitro ANV15-41
100f92cc9014 tty: n_gsm: fix missing modem controls after DLCI open in convergence layer type 2
ba927133b301 usb: dwc3: gadget: fix IRQ storm on invalid event buffer count
9b995b757a87 drm/amd/display: Fix fast updates on DCE 8.1
6f3608823464 drm/amdgpu: reset VI ASIC on MacBookPro14,3
d12b62677fb4 drm/amdgpu: reset VI ASIC on MacBookPro15,1
0e0fd96b2626 drm/amd/display: Preserve eDP mode on initial ASSR failure
8786c5bc7737 drm/amd/display: Mark DCE 6.4 as not APU
6b0cc4e32599 iio: adc: ad4030: fix invalid oversampling_ratio validation
23222e50948a iio: adc: ad4030: Use BIT macro to improve code readability
9c8158ef4ccc units: Add HZ_PER_GHZ
a0a1929d66d6 smb: client: only require read lease for size-extending preallocate
aec958676fb7 iio: adc: aspeed: propagate reset deassert errors
49c97ba1a3a3 iio: adc: aspeed: Simplify with dev_err_probe
74d723eee729 smb: client: distinguish real EOF from a stale remote_i_size on read
cecf4114069f smb: client: flush dirty data before zeroing a range
405a969c0b33 thunderbolt: Don't access a DP tunnel after its DPRX read was canceled
9cedbfde1450 wifi: mac80211: set info->band for 802.3 encap offload frames
cbdcf80683f5 wifi: mac80211: Add sta pointer sanity check in ieee80211_8023_xmit()
03525b632908 wifi: mac80211: count only matching reservations in reserved switch
80e8b0ea73ba mtd: spinand: fix NULL pointer dereference with no ECC engine
2d86abd28071 nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known
d3d6d7efdacc nvmet: copy the hostid into the ctrl before creating PR pc_refs
dd053fc01eef nvmet-tcp: Don't error if TLS is enabed on a reset
889c61e3d0f1 Bluetooth: Serialize SMP remote OOB data access
e887e43bd5aa fsverity: add dependency on 64K or smaller pages
b4c0c41b952c fs,fsverity: remove check for fsverity being enabled in setattr_prepare()
2efdeec99ca0 fs,fsverity: reject size changes on fsverity files in setattr_prepare
8f317daa50fe rust: irq: pass RegistrationInner as cookie to request_irq
333fa4bb5dbb rust: devres: ensure revocation is complete before device finishes unbinding
e7930d857cc7 rust: devres: fix race between concurrent revokers
5017fdcb5ad7 rust: devres: add 'static bound to Devres<T>
8ae7e5dec4f3 rust: devres: fix race condition due to nesting
946ae2e1669b mm/vma: predicate setting mmap_prepare VMA fields on new vma alloc
60f3b22d501d mm/vma: rename __mmap_prepare() function to avoid confusion
98f6a4589e0f netfs: clear post-EOF pagecache when extending a file via write
4b8ce1686dea pfcp: fix socket lifetime on netdevice registration failure
8bed333470a1 mtd: rawnand: vf610_nfc: fix false bitflips on reads of erased pages
0a6c9b380190 drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read
e68380710fc9 svcrdma: Use svc_xprt_put to free listener on create failure
d1d9694ae47d mptcp: fix msk->timer_ival reset
e64703280ce7 iio: trigger: cancel reenable_work before freeing trigger
e113bac1d5e7 iio: proximity: vl53l0x-i2c: claim direct mode for raw reads
28e76a775c30 iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler
a70d84d2f6c3 iio: proximity: sx9324: Correct proximity channel resolution
20ebd7f4e35c iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure
58237debc18d iio: proximity: isl29501: Fix return type of isl29501_register_write
6501b032be21 iio: proximity: aw96103: validate firmware data length
493e743ea1b5 iio: pressure: rohm-bm1390: Return error when read fails
4fd5a61e61d6 iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup
10a958e76c73 iio: light: rohm-bu27034: Fix infinite delay on error
cc71400bc965 iio: light: gp2ap020a00f: drain irq_work after free_irq
ce308ce18ded iio: imu: adis16480: fix unprotected debugfs reads
50e8d70ba074 iio: imu: adis16400: fix unprotected debugfs reads
60699102827f iio: health: max30102: fix NULL dereference in interrupt handler
b53dc6e15aea iio: gyro: adis16136: fix unprotected debugfs reads
786f0162fe6d iio: frequency: admv1013: fix wrong channel field used in admv1013_read_raw()
d6a83a501507 iio: cdc: ad7150: fix OF matching and publish module aliases
b134ef820610 iio: buffer: Ensure bounce buffer used for unaligned case is zeroed.
b466db9e68b4 iio: buffer: serialize buffer teardown with mode claims
8aef1e8bdd86 iio: admv1013: initialize callback mutex before registering notifier
a5fe2d1b55fa iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind
f44e2ac2fb11 iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls
d74c2489acc5 iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure
6dd3bf785d03 iio: adc: stm32-adc: fix possible division by zero in processed channel
2754d336af34 iio: adc: stm32-adc: fix check on internal channel availability
56e8e9d9992b iio: adc: rohm-bd79124: Fix rising alarm
2a3fd11fd0e1 iio: adc: rohm-bd79124: Fix GPIO mask check
02a9e6a95a3b iio: adc: rohm-bd79124: Fix channel initialization
1d8beaae5a74 iio: adc: rohm-bd79124: Catch regmap errors at measurement start/stop
2eb7f097e15d iio: adc: pac1934: check ACPI label duplication
fe0ceff995d9 iio: adc: max1363: sign-extend bipolar differential channel reads
f87d392bb4eb iio: adc: axp288: Add TS bias override for Haier HV103H
ed1a6230155f iio: adc: ade9000: request interrupts after powering the device
f73b94acc7ec iio: adc: ade9000: handle Phase C dip events in IRQ1 handler
fddb6cc28134 iio: adc: ade9000: fix overlapping scan_index for current and voltage channels
d2400175228f iio: adc: ade9000: fix NULL pointer dereference in clkout registration
f20b94a7dc1f iio: adc: ad_sigma_delta: fix use-after-free on unbind
0633f83c4caa iio: adc: ad7173: Fix digital filter configuration
d2261795797b iio: accel: sca3000: fix frequency divider condition check
3365209e758c iio: accel: kxcjk-1013: reject duplicate event disable
5c7ca8fe7206 iio: accel: kionix-kx022a: Prevent memory leak and fix state
4165641d06ef smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races
f82242fe3109 smb: client: flush and commit data before querying allocated ranges
dce9bca8afcb smb: client: discard post-EOF pagecache when extending a file via copy range
b75dadb50a25 smb: client: discard post-EOF pagecache when extending a file via zero range
2f97f929dad9 thunderbolt: Reject oversized XDomain properties responses
58cb2aa1d29f thunderbolt: Disable CL states for the Anker Prime TB5 dock
2f5893172fc6 thunderbolt: Fix domain reference leak when DPRX read is canceled
34a6e27c954e thunderbolt: Tear down inactive DP tunnels when the domain is stopped
e09cbad4db58 thunderbolt: Mark discovered tunnels as active
c444d2c17dc2 thunderbolt: Hold a router reference for each allocated HopID
f18faa3d3b81 thunderbolt: Fix KASAN reported use-after-free when request is canceled
29664699216c USB: serial: option: add Compal EXC-T1 support
af4224809ea1 USB: serial: option: add Quectel RG660QB
3ef1b5c9a719 USB: serial: option: add Compal EXM-G1x support
8b495843267b USB: serial: option: add Quectel EG060W
02e1112182d8 USB: serial: option: add support for SIMCom SIM8260C
4597ddd6168a USB: serial: fix ioctl hangup race
a1aa474768f6 USB: serial: fix driver deregistration order
4d6da6867b4a USB: serial: fix dynamic id driver deregistration race
02fc7a87f029 USB: serial: ssu100: fix baud rate overflow
4e18c175cea2 USB: serial: quatech2: fix baud rate overflow
25a5f7239a43 USB: serial: cp210x: add Corsair AX1500i Power Supply
452f1c9b76f7 wifi: mac80211: handle empty FILS association request payload
128e800a4127 wifi: mac80211: fix mesh fast xmit path deletion UAF
a613c891906b wifi: mac80211: release mesh path quota on failed additions
1892e71aa2e5 wifi: mac80211: reject invalid 320 MHz CSA bandwidth
42aa9feb27b6 wifi: mac80211: minstrel_ht: validate fixed rate index
d0183cd1f6a2 wifi: mac80211: keep fallback association elements alive
3b75831ceee7 wifi: mac80211: account proxy paths against the mesh path limit
772bd89304ec wifi: mac80211: drain PS delivery work during station teardown
481f9230284c wifi: mac80211: shut down RX BA session timer on teardown
1c82d0c5d509 wifi: mac80211: keep paired old chanctx alive
cd8f8f45d81a wifi: iwlegacy: 3945: free EEPROM data on remove
b0e97bd40e0c wifi: cw1200: fix TX padding OOB read leaking heap data to device
4c9a32a80810 wifi: cfg80211: fix RTS threshold setting for single-radio PHY
98abf374e509 KVM: arm64: vgic-its: Fix MOVALL handling of source redistributor
b37ae6e65a1d KVM: arm64: Clear HCR_EL2.RW for 32-bit non-protected vCPUs
97c1dcce17ef KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy
8b7d4f68fef9 KVM: SEV: Do cache maintenance on the source VM *before* clearing SEV state
b1de3ebf5950 KVM: SEV: Nullify "have run CPUs" mask pointer when freeing it
f6189e26d023 KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified
1a62eb293f60 mtd: spinand: Do not update the QE bit on devices without one
b28120197cc1 mtd: spinand: fix zero oobavail when no ECC engine is used
23cef33571b1 mtd: spinand: Enable QE on all dies
2bbaa3f8df83 mtd: spi-nor: core: Fix mutex leak in spi_nor_rww_start_exclusive()
875c57f2df09 mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB
1ed0ccd56491 mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ
cadf42f22438 mtd: mtd_intel_dg: reset poll counter for each erase
a991c28066e7 mtd: block2mtd: Fix divide error when erase_size is zero
2423a05dd0f2 nvmet: pci-epf: reject too-short SGL segments
7fd3c363eba4 nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()
21ffcae171d1 nvme-pci: add NVME_QUIRK_DMAPOOL_ALIGN_512 for Micron 4100AT
49e8a3224c91 nvme-multipath: fix underflow in ANA log bounds checks
e30a2406408d tpm: fix off-by-four bounds check in tpm2_get_random()
aa480f05aed7 net: extend IPv6 exthdr detection of tunneled packets
6316d17324bd ipvs: bound LBLCR and LBLC cache growth
891bd8335a0d io_uring: fix task_work add use-after-free with SQPOLL
a85d0f00671b fprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching()
bdbc8e78aa96 tracing: fprobe: fix suspicious rcu usage in fprobe_entry
b0f76d4cb9be mm/damon/core: do non-safe region walk on kdamond_apply_schemes()
d3c2d2692bdf x86/mm: Drop unnecessary PMD page copy when freeing
fe23680e6f1d x86/mm: Don't apply va_align to hugetlb mappings on AMD F15h
84df222de86e Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()
c3b5e6da4ba6 Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()
c42ce5373405 Bluetooth: btintel: fix buffer over-read in btintel_hw_error()
708cdd203d0b Bluetooth: hci_core: Serialize fragmented ISO packet queueing
1681f97afdf9 Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown
86e9708f9d19 Bluetooth: hci_core: Serialize ACL scheduling with channel deletion
dd4db9f808ac Bluetooth: hci_core: Fix inquiry cache timestamps on 64-bit systems
cabd58d9bb66 Bluetooth: hci_conn: Lock parent access during enhanced SCO setup
333257e6e4a7 Bluetooth: hci_sync: Fix inquiry cache use-after-free
0a554901bd22 Bluetooth: RFCOMM: Fix initial port reference race
4230d65032fc i2c: xiic: don't clobber msg->len to signal block-read completion
51e1125ff7d6 i2c: xiic: preserve PEC byte length in SMBus block read setup
ba0632683728 EDAC/altera: Fix device node reference leaks in the SDMMC ECC setup
865f3bdebbc9 EDAC/altera: Fix use-after-free in error paths
74eeb95c0478 EDAC/altera: Fix memory leak on dci allocation failure
9846b85c2eb8 EDAC/altera: Drop __init from ECC setup paths for re-probe safety
0c03cb91b569 EDAC/altera: Do not allow driver unbinding
9d2d3b3dfe89 EDAC/versalnet: Drop remote processor handle refcount on driver removal
e561c2740b62 ALSA: hda/realtek: Fix silent speaker on Higole F9B
d8986de05cc6 ALSA: hda/realtek: Fix square wave output on ASUS Strix G615LR
eb0c7fda59cf ALSA: ua101: reject mismatched capture/playback packet sizes
fc5c52848e40 ALSA: seq: Serialize compat port-info ioctls
9590d1679162 ALSA: hda/tegra: Re-enable SDO workaround for Tegra194
69d2b7a4c115 ASoC: qcom: lpass-cpu: use DAI table index for playback constraints
d195c8c763fd ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type
7df8c39a50f3 ASoC: codecs: max98363: fix uninitialized stream_config->type
2bce6f006cfe arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems
1c17db14f2c2 serial: sc16is7xx: refill TX FIFO below trigger using fresh TXLVL
8f9103651d6a serial: sc16is7xx: fix TX gap caused by kfifo circular buffer wrap-around
48e09369839f serial: vt8500: Fix clock reference leak in vt8500_serial_probe()
f895ed664cb7 serial: tegra: don't clear the Tx FIFO on an Rx-only reset
d8233d6b391b serial: ma35d1: Fix clock reference leak in ma35d1serial_probe()
7019a84c23c1 serial: fix TIOCMIWAIT race
3f151c2e86f5 serial: revert guards in uart_wait_modem_status()
c3ba14c29d55 serial: 8250_omap: fix wake irq cleared during suspend
e32440fa536a serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()
2c8614981d3e tty: serial: max3100: shut down timer before freeing port
94af6cd832e9 tty: abort break signalling on hangup
c110c6eed54f tty: serial: qcom_geni_serial: Keep console RX functional after deep idle
6b7be3b9b857 tty: port: fix tty_port_tty_vhangup() race
7021acc84c2e tty: tty_port: restore TTY_IO_ERROR on activation failure
821050631750 tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup
4335278d0e75 tty: vcc: zero-initialize control packet in vcc_send_ctl()
3551bdf843a1 tty: amiserial: fix broken TIOCMIWAIT
e8615dfe80cf tty: vt: fix memory leak in vc_allocate()
d16046f1ace2 usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe
95160fe606e6 usb: cdns3: fix use-after-free in cdns3_gadget_exit()
072535f26dc5 usb: typec: ucsi: displayport: Current CAM OOB index fixup
f5ed186d0cf3 usb: typec: ucsi: Get the connector fwnode based on reg value
41934f92e7a5 usb: typec: ucsi: glink: fix use-after-free of ucsi on remove
75dc6cb377ef usb: typec: tipd: fix uninitialized typec_partner_desc in cd321x_update_work()
282be6ae8be7 usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect()
30dbaf3c6696 usb: typec: tipd: don't send GAID when probe fails in APP mode
b2ed8643face usb: typec: tcpm: recover after failure to start the frs ams
4333174ea52c USB: dwc2: shut down wakeup timer before freeing HCD state
1da16c46b8d7 usb: core: clear both ep_in and ep_out for non-ep0 control endpoints
bd89c4f42f56 usb: chipidea: tegra: disable runtime PM on resume failure
7811d8e26c77 usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC
5298c96bf006 USB: gadget: dummy-hcd: Fix wait for outstanding request completions
474e9e1852fb usb: gadget: aspeed-vhub: cancel wake work on device removal
9f0321e8e9af usb: dwc3: am62: Fix runtime PM usage count leak on probe error path
7b5ed2d30ccc usb: typec: port-mapper: Only match USB4 port if host interface is available
50a92c02551c usb: typec: anx7411 - stop the IRQ before destroying the workqueue
8c611876c002 usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd
87f2185423e0 usb: gadget: midi2: Fix the jack descriptor array sizes
772149e7badb usb: ohci-st: disable controller wakeup on removal
ec69932b4558 usb: ohci-spear: disable controller wakeup on removal
dc1b196ad595 usb: ohci-s3c2410: disable controller wakeup on removal
83e8bd42bd17 usb: ohci-da8xx: disable controller wakeup on cleanup
a12e803d2255 usb: octeon-hcd: fix the FIFO-flush timeout computation
e9545dd8bc62 usb: hub: use shorter 120ms post resume hold for SS root hubs
e2d62928f266 usb: storage: sierra_ms: reject short SWoC info transfers
5e8980a81af1 USB: serial: fix port tear down use-after-free
a0ed07b5bbb2 USB: cdc-acm: skip URB restart in port_shutdown if disconnected
108af6f585dd USB: cdc-acm: fix racy TIOCMIWAIT implementation
9b5b83ca2a66 soc: qcom: geni-se: Correct QUP Core ICC vote constants
d54df2de22f9 rust_binder: cancel deferred work items in thread exit
f7fb6c2835ed nitro_enclaves: fix use-after-free on SLOT_ALLOC failure
c5504e179135 Input: synaptics - limit T440p InterTouch quirk to LEN0036
fc92d4499f3f Input: synaptics - add LEN205b entry to smbus_pnp_ids for ThinkPad T490
95e8d0a7b22f Input: s6sy761 - fix resume ordering and restore sensing
d79caaf07875 Input: i8042 - add nomux quirk for Fujitsu LIFEBOOK U7410
bcfd26841471 Input: atkbd - skip deactivate for Lenovo IdeaPad Slim 3 15IWC11
0278c68c59b9 kgdboc: Fix tty driver reference leak in configure_kgdboc()
1299cb3fb061 binder: fix leaked fd fixups on TF_UPDATE_TXN supersede
86cdcc87d4ba binder: fix is_failure flag for superseded transaction cleanup
5b113e8ee326 drm/amdgpu: skip the noirq suspend reset for a switcheroo-parked GPU
587469076e4f drm/amdgpu: fix ACP MFD device leak on init failure
7ca44cb14d02 drm/amdgpu: fix IP instance memory leak on kobject add failure
b84f1386d84b drm/mediatek: Fix pdev reference leak in mtk_drm_bind()
629458b7e495 drm/mediatek: Fix ovl adaptor platform device leak
88f8a92dcb0c drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device
4d12b763c2c5 drm/radeon: Read the VRAM VBIOS signature with readb()
652f631e2e3a drm/amdgpu/gfx6: fix firmware leak on teardown
36fa4159d005 drm/amd/pm/si: Fix updating clock limits on AC/DC
e67aef159f43 drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC
197946faa1b7 drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend
f3db2853e2a2 PCI: Accept AtomicOps already enabled by the hypervisor
f3eaf3191008 spi: cs42l43: Workaround for wrong speaker ID on Dell XPS 13 DX13260
d5a81039adc6 ALSA: ice1712: Fix the error handling via auto-cleanup at probe
fc34dd95d3ba ALSA: core: Define auto-cleanup for snd_card_free()
524063fea29f perf: Fix race between perf_event_exit_task() and perf_pending_task()
7648757145aa i2c: at91: release DMA channels when probe defers
efd0d161b0cb net: mvneta: clear XDP pfmemalloc flag between frames
53b21bc2df6e ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel()
f81d40e2eb69 net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference
9a76ae59fd63 net: sparx5: make ports inherit the switch base mac address type
e3630ff89b77 of: Put coreboot node after compatibility check
47c5ac61e6fb net: microchip: vcap: stop scanning after deleting key field
4033e1a9262c netfilter: flowtable: generalize pending status bit
f6143ae109df netfilter: bpf: reject invalid NAT manipulation types
55d033324f67 ipvs: filter some flags received in the backup server
7151f14d5915 ipvs: do not create invisible templates
60e9a6e2ba71 ipvs: fix missing counter decrement in lblc
e5633d81b2da tcp: refresh TS.Recent for accepted old ACKs
35c706d6eb19 net: sparx5: skip ptp deinit if init was skipped
297769d75dc6 net: sparx5: move PTP IRQ handling out of sparx5_start()
728138dcfc92 net: sparx5: move stats initialization and add deinit function
387478e9e986 net: sparx5: move MAC table initialization and add deinit function
a0a8687eb787 net: sparx5: move VCAP initialization to probe
ebb164ae76ad net: sparx5: move netdev and notifier block registration to probe
a01c71ab74ea net: phy: qcom: at803x: Fix IPQ5018 short-cable DAC values
82be3d08de9e net: ethernet: mtk_eth_soc: allocate dummy netdev sooner
2f581814e4e3 net: cap skb->queue_mapping when the tx queue is picked
2294b62eaec6 net: bcmgenet: fix NULL dereference in set_coalesce before first open
507c895019a8 net: pcs: rzn1-miic: Clear MIIC protection state before unprotect sequence
a4b63808f99a virtio_blk: set the zone write granularity
ac4827cf9653 net/sched: sch_codel: match the no-drop threshold to the packet size
ab6842a1c7bd net/sched: fq_codel: match the no-drop threshold to the packet size
e94970076d29 gve: DQO: accept TSO packets with non-protocol gso_type bits
5069ce898148 net: restrict SO_RESERVE_MEM to TCP sockets and cap max value
358d5ac5a5d5 net: stmmac: fix rx Scatter-Gather support
5847b60561a3 net: stmmac: convert priv->sph* to boolean and rename
f78d45d5f1ac net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk()
f74f100e4958 tipc: prevent GCM nonce reuse on peer key changes
adad3ff80e50 octeontx2-af: mcs: Fix SC resource cleanup loop
3a6e67ff267a net/mlx5: Fix slab-out-of-bounds when handling team device events
8438b4f65a17 net: systemport: Fix RUNT MIB counter register offset calculation
96d8b26be5bc net: systemport: Fix buffer overflow in bcm_sysport_get_stats()
7f16443a30f4 Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister
70d2afb55401 netfilter: ipset: do not update comments from kernel-side adds
e50eaba0b34b ipv6: fix prefix route expiry in modify_prefix_route()
6598215a1d8e net: bcmgenet: allocate RX buffers as page fragments
ebc9611ab154 net/sched: cls_api: reclaim an empty proto on the error path
63120572edde net/mctp: publish the mctp_dev only after it is initialised
380acb097059 ARC: arch_cmpxchg_relaxed to use size of pointed type not pointer
a85823b074f9 arm64: topology: fix arch_freq_get_on_cpu() overflow above 4.19 GHz
b0fce76873a5 Bluetooth: btintel: validate DDC record lengths
8ba754621f10 Bluetooth: hci_core: free the HCI ID if naming fails
790730e4d95d blk-mq: set RQF_USE_SCHED when the operation is known
2e8f3fdb0825 blk-mq: factor out a helper blk_mq_limit_depth()
c97ef13ad96b block: reject polled dio with user integrity metadata
ed389554fe22 ASoC: codecs: rt274: Fix format setting for 44100 rate
eb04ba7d9780 ASoC: codecs: rt286: Revert delay value for jack setup
88e96d902efe wifi: mac80211: prevent AP VLAN tx from other interfaces
227ebe48704b wifi: mac80211: Add 802.3 multicast encapsulation offload support
9f4e5abe6bf7 wifi: mac80211: Add multicast to unicast support for 802.3 path
dd7973a4130b wifi: cfg80211: preserve hidden-group beacon IE ownership
cfd70c9b1984 rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe()
9cff19ddd7f9 rtc: ac100: Fix clock provider use-after-free on probe failure
00dc50cede96 rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak
345ce265cf60 wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE
e0c21130c1c7 wifi: ath9k: reject short WMI command responses
9a9467f7cc63 wifi: ath11k: reset ar->num_stations on hardware start
9338b2dea74c wifi: mac80211: drop oversized fragments to avoid extra_len overflow
f9d075fa9fba wifi: mac80211: remove RX_DROP
f41735133943 ASoC: tegra: Fix ASRC Stream6 input threshold control
71d140099165 wifi: wfx: validate MIB read length before copying to caller
9091199beced ASoC: wm8903: Move the DRC QR threshold to the register that holds it
b8cbeda043e4 of/overlay: don't create "//" paths for fragments targeting the root
7a46f1917b32 of/overlay: don't leak fragment references when changeset init fails
2222a8b7dfeb random: fix vgetrandom_opaque_params kernel-doc
541d61d59f19 nvmet: preserve device path on allocation failure
f971f1c63cf7 mtd: core: call _get_device() with the master MTD
4c73c1859fa6 iio: accel: kionix-kx022a: Fix array boundary check
489e51034910 iio: light: rohm-bu27034: Fix error return
09a9a2a9548f iio: dac: rohm-bd79703: Do not allow writing SCALE
7899d0530b41 mm/damon/core: don't skip damos_adjust_quota() while esz is not zero
122b8541f511 random: vDSO: avoid call to memset() when zeroing reserved parameter
3f75da1e4ee6 ALSA: line6: reject oversized playback packets
84727facd850 ALSA: caiaq: unregister the input device when probe fails
9cec23424c59 wifi: wlcore: Fix runtime PM leak in wlcore_remove()
ad06f7312d3f vt: skip screen update for DEC alignment test on backgroup consoles
037d7e3ca5c5 vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()
233a2e190b12 vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF
90c29158159e net: dst_metadata: fix false-positive memcpy overflow in tun_dst_unclone
7d2ff870f0cf rds_tcp: close NULL deref window in rds_tcp_set_callbacks
dc87b56b43c9 mm/huge_memory: initialise workingset state before folio split
9ebb974773bf mm: shmem: ignore sysfs configs for shmem forced collapse
7a1e8daeaa46 virt: vmgenid: set driver_data before registering notification handlers
0af47cb2575d virt: vmgenid: remap memory as decrypted
258310d59a82 module: fix lost error code from codetag_load_module()
512eaf01ffab netfs: zero gaps in read-gaps folio to avoid writing back stale data
96c46c75b0d4 tpm: Disable TPM on null key name mismatch
e701345d886e sctp: check RCV_SHUTDOWN after the sendmsg connect wait
e0cabda9b6f4 rtc: spear: initialize IRQ state before requesting alarm IRQ
160619b38707 rtc: ac100: Assign .num before accessing .hws
37286a49cc74 r8169: disable EEE on RTL8168h/8111h
69ca64bbb528 net/packet: prevent TX_RING byte count overflow
c5f91098edee netfilter: nft_flow_offload: drop flowtable reference on init error path
ba56d6f9f1a8 net: phy: aquantia: fix system interface type not updated in forced mode
ed997f875d03 net: fix checksum offsets in skb_splice_from_iter()
0d1525fdcd33 of/overlay: only treat a positive changeset id as registered
7dc6a769153c of/overlay: put property on deadprops only after changeset add succeeds
42f6d682e0ab of/irq: Fix remaining refcount leaks in of_irq_init()
f7ea1916e8a8 octeontx2-pf: Fix RSS indirection table size
6745fa65f411 kprobes: Skip disarmed probes when checking optkprobe overlap
c2733ea2c15a kasan: unpoison task stack below watermark only in generic mode
2ebeba4f9e81 io_uring/zcrx: requeue multishot receives stopped by a local resource
4e9e016c4f49 io_uring/cmd_net: end TX_TIMESTAMP multishot when the CQ is full
0c19a6c1d25f HID: multitouch: stop the release timer from being rearmed on remove
97be6396817b HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request
308db93de666 crypto: x86/aes-gcm - fix always true check for last AAD segment
88633025f20b audit: fix exe mark UAF in kill_rules()
745e83328dd6 ALSA: usb-audio: Apply IGNORE_CTL_ERROR quirk to all Audient devices
224b56b7c02b smb: client: close completed creates on compound wait errors
78e718c5aa14 cifs: Remove the RFC1002 header from smb_hdr
f09875ff901e smb: client: close handle after create-context parsing failure
080573f41950 smb/client: pass cifs_open_info_data to SMB2_open()
7bdc4b7d99a8 smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink()
605ef5bd74d0 cifs: on replayable errors back-off before replay, not after
178820984f2c Bluetooth: btusb: Add IMC Networks QCA9377 to quirks table
60ba99f910b7 ASoC: sdw_utils: Set snd_soc_dai_link_ch_map.codec_ch_mask for capture
f44d5d3b7e34 neighbour: Annotate access to neigh_parms fields.
3b91cdacb16b neighbour: Use RCU list helpers for neigh_parms.list writers.
df057d89e0cc RISC-V: KVM: Fix null pointer dereference in kvm_riscv_aia_imsic_has_attr()
b15c79fca280 xfs: don't let memory failures leak blocks and kill repairs
70a7918fda54 smb: client: use finish_no_open() for non-regular inodes
677aeec9783c mm/execmem: make the populate and alloc atomic
7ad8b185dd7e selftests/mm: hugetlb-mremap: add setup of HugeTLB pages
22e82acec93a KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction
81e3f065a648 KVM: arm64: nv: Fix life cycle of the nested_mmus array
e18b8236c57f btrfs: initialize inode mapping flags for cached inodes