dd88d1689590 Linux 6.18.62-xanmod1
9be512814487 Merge tag 'v6.18.62' into 6.18
c3f63d70f236 Linux 6.18.62
c49934da934c xen-blkback: Avoid UAF when reading I/O statistics
34f0f63dc6dc xen-netback: defer xenvif_mcast_addr_list_free()
37d5a7317057 xen-netback: Fix UAF when reading statistics data
7ab573237315 Linux 6.18.61
4d14072b93fa rust: bitmap: add MAX_LEN and MAX_INLINE_LEN constants
2f92c0286cfd tun: Require CAP_NET_ADMIN to attach to an ownerless device
3c5bfeef8f71 ALSA: hda/realtek: Fix audio after Windows reboot on ASUS Q423SA
9ec1c52ba989 opp: fix use after free in _update_opp_table_clk()
4225b4944f9d netfilter: conntrack: always lower timeout for non-closing RST packets
34bdda87c189 drm/amdgpu/powerplay: Align get_tonga_state_array() header with prototype
27f2fdcb6be2 selftests: ublk: add missing gitignore for metadata_size binary
7dc33618ae47 media: rc: Fix build failure with CONFIG_LIRC disabled
3594027c292b mm/rmap: don't discard lazyfree THPs at PMD level
63dc56500a91 pps: generators: fix use-after-free when closing a removed device
2b2a1d370f16 pps: change pps_gen_class to a const struct
d1df2ec20a6d media: ipu-bridge: Fix use-after-free in IVSC error path
bd47ee501b6a ksmbd: fix use-after-free after a failed durable reconnect
7f30b886c5a1 ksmbd: verify transform SessionId matches the decrypted header
c81681bcb7f0 ksmbd: fix named stream write and EOF handling
3092d8a596ef ksmbd: fix out-of-bounds read when padding the final compound response
52a8eb87416e ksmbd: use the existing xattr name for a named stream
4a7f332fd43e ksmbd: fix invalid pointer dereference when get_inode_acl() fails
fbe9fcda7ae8 ksmbd: prevent stale data from being written by SMB2 WRITE requests
2756a41a82d6 ksmbd: prevent share root removal through empty paths
38cddb9f7c91 ksmbd: fix session reference leak on compounded SESSION_SETUP
28db998d396a ksmbd: deny access for an empty DACL instead of granting the request
1f1a7cdcc7a9 driver core: take parent lock in async device attach
2af51c1d68e6 driver core: Check drivers_autoprobe for all added devices
4d6e1b44d1fb smb: client: fix early procfs exposure race
ee793cc8dcd5 smb: client: do not pass a NULL buf to is_oplock_break()
0eec7b84e83f io_uring/net: fix multishot recv length limit accounting
b5e22247346f io_uring/timeout: count cancelled timeouts in cq_timeouts
0ac8f069a8bd io_uring: defer foreign io-wq enqueues to task_work
8bfd0b631926 io_uring/sqpoll: don't wait for the thread to exit
9063d0bcba95 io_uring: free XArray nodes left by a failed store
9089fd4d2ad6 io_uring: charge tctx nodes and personalities
963c6e849b70 io_uring/rsrc: charge buffer arrays and nodes to memcg
2b8f16724d51 io_uring/io-wq: no new workers once the exit has begun
6621b094bc68 io_uring/net: don't retry a non-blocking connect() that fails with -EAGAIN
87160b45abf0 io_uring/net: keep recvmsg buffer select length within MAX_RW_COUNT
4b3c285f9c5a io_uring/kbuf: advance head when a pickup empties the buffer ring
1f5c774488fa smb: smbdirect: fix buffer length underflow in RDMA transfers
224e9856b8aa ovl: fix mount setup failing when override_creds drops CAP_SYS_ADMIN
1d9706fb79a9 ovl: do not copy up a dentry that was removed
0759376aa011 ovl: hold a reference on the parent in readdir
68439a05ed52 ovl: check that the parents of volatile/dirty are dirs
ae8c2228af6b HID: roccat: savu: reject short special reports
c2e90164acb6 HID: roccat: ryos: reject short special reports
08a4c26838f1 HID: roccat: pyra: reject short button reports
196fff636bf4 HID: roccat: kovaplus: reject short button reports
49360ac9b47f HID: roccat: konepure: reject short button reports
6d1f22a55259 HID: roccat: koneplus: reject short button reports
664627e3be18 HID: roccat: isku: reject short button reports
6ebe75dbb9cf HID: quirks: Always poll the Anne Pro 2 with product ID a292
d4cb80ade5f4 HID: pxrc: reject short input reports
ac0e2a0fbe42 HID: prodikeys: validate fixed-format MIDI reports
14acfdfca515 HID: picoLCD: check for fb_deferred_io_init() error
ee55408b95bd HID: mcp2221: validate response report length
47f50fbfd664 HID: mcp2200: validate READ_ALL response length
bf3e9e06e850 HID: logitech-dj: validate unnumbered keyboard reports
6a0a7d641826 HID: elo: reject short touchscreen reports
94d0e789d8b0 HID: cp2112: validate response report lengths
d618e93e9cf5 HID: cougar: reject short special-key reports
076bea989f99 HID: core: Fix out-of-bounds left shift by 32 in s32ton()
5652b50db002 HID: amd_sfh: Use report type from request node
292e9c446a7c HID: amd_sfh: Remove unsupported motion-state field from accelerometer report
30e55a93cdc6 HID: zydacron: validate key report length
d4de3f8bd528 KVM: PPC: Fix get_d_signext() 12-bit displacement for paired-single D-form
7a02dfbd2f4a KVM: PPC: Book3S HV: Add preempt_disable() around virtual-mode HPTE bit-lock users
216729d9780d KVM: TDX: Enable Notify VM exit
c16bdb1a4998 KVM: TDX: Check if there is valid exit infos based on vp_enter_ret
ab15e4093e2a KVM: x86: Zero reserved synic flags when delivering message to avoid stack leak
ec9df57c8e00 KVM: x86: Take SRCU in kvm_zap_gfn_range()
a92a07205e01 KVM: x86: Request event processing for exception VM-Exits
a58917a271cb KVM: x86: Preserve DR6.BLD (Bus Lock Detect) when delivering #DB payload
8239d357a937 KVM: x86: Clear hardware HLT state when userspace makes a vCPU not-halted
46f5df89f55c KVM: x86/xen: Take kvm->srcu in __kvm_xen_has_interrupt()
b7af8dc92af1 KVM: x86/xen: Enforce 4-byte alignment of vcpu_info registration
fea3d3402263 KVM: x86/mmu: Bug the VM if KVM calcs a CPU role with EFER.LMA=1 && CR4.PAE=0
54afd548602b KVM: x86/mmu: Bug the VM if KVM attempts to walk more levels than the MMU has
87152138116a KVM: VMX: Preserve negative return value in vmx_handle_exit() with bus lock detected
4ef5e623d2fe KVM: VMX: Make handle_bus_lock_vmexit() a shared helper
196450c52f35 KVM: VMX: Disallow using to_vmx() in common VT code
a12e105e9753 KVM: Use goto to handle errors during memslot preparation
a4c2d0a9a901 KVM: nSVM: Ignore EFER.LMA if EFER.LME=0 when preparing L2 state
058173bce103 KVM: SVM: Trigger new ASID allocation in both VMCBs on pCPU switch
da31978b9ccb x86/mm/pat: Fix effective RW computation in lookup_address_in_pgd_attr()
ff30731bbce1 x86/cpuid: Mark CPUID function 0x23 as being indexed
7ace4531de8a rxrpc: Fix return in rxrpc_recvmsg_data() for service calls
7ea62525912d rxrpc: Fix double IRQ enablement
ff518f5f7adc afs: Fix afs to abort the rxrpc call on send error
8b9efc7b27bf rxrpc: Fix lack of short-send handling in rxrpc_kernel_send_data()
965456110cf6 rxrpc: Fix update of call->tx_pending without holding lock
e77fe4052e15 SUNRPC: Treat every TLS error alert as fatal
8067c654ae8c sunrpc: treat empty auth.unix.gid replies as negative entries
fd7b12865b20 SUNRPC: trace an accepted transport before publishing it
03bfe7879fa8 SUNRPC: Resume receiving after a TLS control record
560956c8d247 SUNRPC: Reject a TLS alert record that is not two octets
f44daa50489f SUNRPC: Reject a socket that already has an svc_sock attached
f735700c0630 sunrpc: pin gss module across auth_domain RCU free
c5862ac50d8d SUNRPC: keep the first error in svc_register()
1cc4b3089eab SUNRPC: fix oversized GSS proxy token copy
67d36b376f76 SUNRPC: Do not credit control-record octets to the RPC stream
d514dd81771a SUNRPC: Copy the deferred RPC Call from the head buffer
c1e38828c93e nfsd: zero NFSv4 COMPOUND tag padding
f5a336ad931a NFSD: validate transport name in listener_set before serv creation
c12f04f29dac NFSD: Set nn->cld_net before registering the cld pipe
f4d884c87899 NFSD: Return NFSERR_ISDIR for NFSv2 READ and WRITE on a non-regular file
ea993a4e9ad9 NFSD: Resolve the recall-any mask names in the trace format
af501c516757 NFSD: Reject an oversized principal hash from nfsdcld
7d464c3e9321 nfsd: propagate SETXATTR value decode errors
37fc2ec21163 nfsd: preflight SEQUENCE replies before accepting a slot
76bb89e8155f NFSD: Map flex file layout IDs through the request's user namespace
16ee8e3e0615 NFSD: map fh_verify() status codes for NFS_ACLv3 replies
5733621eee9f nfsd: honour client-provided attributes for NFS4_CREATE_EXCLUSIVE4_1
540649cb8543 nfsd: hold cl_lock in client_has_openowners()
676b048197cd NFSD: Fix out-of-bounds read in the rpc_status dump
e48996466d78 nfsd: Fix id-to-name cache entry leak in idtoname_parse()
fa5fbc8f5fbd nfsd: fetch direct I/O alignment for files handed to the filecache
36fcebcb656a NFSD: Fail a pool_threads read whose reply does not fit
0b5149b7ad8c nfsd: don't modify a session slot when replaying its cached reply
f6d1f1072243 NFSD: Don't complete a cld upcall the daemon has not read
b202a337fddf NFSD: Do not send CB_RECALL_ANY to NFSv4.0 clients
20b76bdbd029 NFSD: copy SETXATTR data from all XDR buffer segments
624531ecd48b nfsd: clear XDR padding in GETXATTR replies
f256b39c64e9 NFSD: cap the number of listeners accepted in listener_set
7c4846faba43 NFS/localio: report the stability a DIO WRITE actually has
c4faa631e9e1 NFS/localio: fix nfs_local_dio_misaligned tracepoint
209ad0993fae NFS: Fix stale negative cache on failed nfs_mkdir()
d2609b2db66a NFSv4/flexfiles: Bound page coalescing on the absolute stripe offset
43b9e0c39eed NFSv4/flexfiles: Use the full 64-bit stripe_unit
12326bd73a61 NFSv4/flexfiles: Use the full 64-bit offset for read DS selection
938f374ec839 NFSv4/flexfiles: fail I/O to the data server once a lock is lost
8581c8ea5fd2 NFSv4/filelayout: Anchor page coalescing on pattern_offset
bfa512d906cd NFSv4.1/pnfs: suspend pNFS on NFS4ERR_TOOSMALL from LAYOUTGET
cf4c0b3acb1d NFSv4/pnfs: Free the netid when draining a data-server address list
9b89bd161183 pnfs/blocklayout: Complete a device upcall when the pipe is closed
7b757e120aaf pnfs/blocklayout: Complete a device upcall only on its own reply
bed2aa2307e4 pNFS: Fix CB_NOTIFY_DEVICEID CHANGE to consume ndc_immediate
520b48753e3c smb: client: validate NT transaction response layout and offsets
ba57bfe1a9fa smb: client: fix slab-out-of-bounds write in id_mode_to_cifs_acl()
4a426ca5be7e smb: client: fix fiemap wild read on empty truncated response
acf25a7be39d smb: client: fix buffer overflow in SMB2_tcon()
b304a9268f7d smb: client: don't resurrect an exiting tcon from cached dir workers
93d1fbe38f0c smb: server: size directory name conversion buffer correctly
70daf37bef86 x86/bugs: Adapt SRSO mitigation to Zen6
30fb9f2ad94a xfs: reattach dquots after changing inode ids
e6338cdc1003 xfs: range-check bc_levels array access in scrub tracepoints
a312988016bd xfs: propagate errors while checking null siblings
27b6057c9884 xfs: opportunistically skip btree block checks
05fd50e646ea xfs: only written file data blocks can be shared
a20e7217f694 xfs: never reset the default quota timer
9ee0b919b7df xfs: init inode number for tracepoint
55a29b330617 xfs: fix data fork block count check in xrep_inode_blockcounts
9702d68ad626 xfs: fix correction of unwritten extents in quota file data fork
1bde9463d752 xfs: don't try to scrub self-referential dirent in metapath checker
f12cbd5e2029 xfs: don't try to repair rtsummary if the summary file isn't computed
3e8c3ed178c1 xfs: don't subtract excess usage twice when computing agf_btreeblks
32b3e288e22c xfs: don't set a metadata directory's parent to sb_rootino
fb6d5c9a2edf xfs: don't scan across metadata/regular directory trees for dirents
1a5bcf87b611 xfs: don't rescan ifree and icount when frozen
83b5bfa2400c xfs: don't queue rmap update twice when reaping a fork
6b93f0aeb881 xfs: don't overrun incore inode when cleaning attr forks
831000829329 xfs: don't clear COWEXTSIZE on directories on reflink filesystems
7ba6cf053eaf xfs: don't allow sm_agno for non-group metadir path checking
b5eb4ffd63fd xfs: complain loudly when dirtree checker finds broken links
85975166223d xfs: clear set[ug]id mode bits when zapping attr fork
c73ee3683ab4 xfs: clarify various parts of the bitmap API
27d1f450dec6 xfs: check for termination during rmap btree walk
821a9d99caf1 xfs: check for fragments when full-extent sharing matches
f2cc5001ffcc xfs: bound inode fork length against the fork size during log recovery
5909f2935ca2 xfs: bound da-node entry count against the correct geometry
bd805c0a7914 xfs: always zero the whole shortform header when zeroing attr fork
e1903c3144d8 xfs: always report scrub errors in tracepoints
782bcf8c6d36 xfs: always report inode repair setup failures
8cce27911eb3 xfs: always forget cached ACLs if the attr fork swap succeeds
4b4979ebf938 xfs: abort directory tree repair whenever dl->aborted is set
c548d0de41b0 xfs: update quota flags on secondary supers when metadir enabled
96a80a3312b4 xfs: rescan the AGs if incore delalloc counter is negative
741d01a5f490 xfs: release ip after unlinked list store failure
97b85a593188 xfs: reject remote xattr entries with an out-of-range value length
c2cd6b3b480e xfs: reject out-of-range attribute value lengths in xfs_attr_copy_value
5e730e4a26c4 xfs: reject absurdly large xattr value lengths in xchk_xattr_actor
de55e799f549 xfs: reduce new btree slack factor if free space is negative
42451fefb076 media: usbtv: fix null-pointer dereference on disconnect
f9362852c8b9 media: usbtv: drop redundant device reference
9d275d40b6ec Revert "net: Convert proto_ops bind() callbacks to use sockaddr_unsized"
47c654431730 EDAC/mc: Really fix error path ordering in edac_mc_alloc()
9e3a6b707681 rtnetlink: wait for RCU readers in rtnl_link_unregister()
0bc2d40b9c01 ksmbd: fix breaking_cnt leak on early return in oplock_break()
818a9fd77944 ksmbd: serialize directory emptiness checks with readdir
8fd7a71a7095 netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables
d1f2c892c6cb netfilter: nft_payload: restrict checksum offsets to known values
3199bbed3a0b netfilter: validate L4 headers after userspace packet writes
593971fdc06d netfilter: nftables: restrict checkum update offset
fe189691a793 netfilter: nftables: restrict linklayer and network header writes
9b02841c69dc netfilter: nft_meta: add double-tagged vlan and pppoe support
40089f2f78aa netfilter: nfnetlink_queue: restrict writes to network header
819b2241c43e ipv6: Implement limits on extension header parsing
65367b054595 netfilter: disable payload mangling in userns
03c67f33c3d9 sched_ext: Fix scx_flush_disable_work() UAF race
92c9bc8561a7 sched_ext: sync disable_irq_work in bpf_scx_unreg()
f799665b9c8d xfs: fix xchk_stats_estimate_bufsize to allow for the trailing null
7f25f443a4a6 xfs: actually check XFS_DIFLAG2_METADATA for metadata btree data forks
38a595275d27 xfs: adjust checks for cross-AG reaping issues
2b33121ec2a8 xfs: jump out of xchk_bmap_check_rmap if fatal signals
44cc66d047ef xfs: mark overfull dabtree node blocks as corrupt
c67017f673bc xfs: check fork type against dabtree block magic number
31f79a0919e3 xfs: abort dirtree repair if the live update hook dies
50dd205bf3c0 xfs: fix revalidation of xchk_dquot_iter cached mappings
1f5def7e91a6 xfs: bail out of directory tree repairs on error
006556968a49 xfs: assign an owner to scrub_stats_fops
09b787d59559 xfs: allow softlimit with no hardlimit in quota scrub
5cdd8d436feb xfs: fix lost errno returned from xfarray_foliosort
1fc1a5a2419a xfs: don't repair fs summary counters with garbage
b5891acd62d8 xfs: fix skipped inode mask handling in iscan
0c5802d7be2b xfs: don't proceed with xattr repair if the live update fails
8edb7edb9d33 xfs: validate rc_domain in xchk_rtrefcount_mergeable
18773e41e92b xfs: don't fix the directory tree if live update fails
6b7f9ab7610b xfs: flag excessive delalloc rt extents as corruption
e065e5f8dfa4 xfs: zero out di_metatype when removing the metadir file iflag
56192355a67e xfs: don't pass iget failures up when marking ondisk inodes
a9e94a4cd5a0 xfs: always reset incore attr fork buffer when resetting fork
3b7198678a3a xfs: fix inode btree repair when a cluster is larger than a chunk
b50c563a99cb xfs: actually report corrupt xattrs as XFAIL during cross-referencing
779f9d180b4b xfs: fix buffer overflow in corrupt inline attr structure
1519f7a63f66 xfs: fix unnecessary dapos truncation in xchk_dir_walk
83f274a69ba6 xfs: actually lock the metafile reservation when adjusting after repair
84c0abd7e70f xfs: avoid cross-rtgroup reaping after a repair
c937966701c2 xfs: online quotacheck must dirty dquot if enforcement adjustments needed
173eb03891f4 xfs: fix buffer overruns in xfs_ioc_attr_list
83c2efaba866 xfs: fix missing xfs_qm_adjust_dqlimits call in quotacheck repair
6afaf9a32817 xfs: fix xfs_rename_space_res for non-pptr filesystems
95941108be83 xfs: fix ondisk symlink target validation in xrep_dinode_check_dfork
af6d2f0a3232 xfs: compute the correct fdblocks/frextents for repair when they're negative
9c1639545933 xfs: mark cow extents bad if there's no rmap mapping for them
fa21d1f4f617 xfs: clear the symlink zapped flag if inline symlink is ok
5c6a8b2f2f4d ovl: skip copy up of empty security.capability
7ecbeb1a84f2 ovl: set the revalidate flags after d_instantiate()
8cd9ec121a63 ovl: reserve space for the casefolded name terminator
9b50f28c22c9 ovl: read the nlink xattr of every indexed non-dir
37537892ca40 ovl: fortify ovl_copy_xattr() against underlying layer modifications
b9f57bb52124 ovl: fix a torn path in ovl_get_redirect()
628260a72043 ovl: do not copy up an xattr value that was never read
6a49ab7c9a68 ovl: check the casefold flag of directories only
b050952bc4e3 ovl: always encode the origin fh when index is enabled
b219cdaea16b ovl: use the pinned upper dir in ovl_fix_origin()
c7e280820989 ovl: take a snapshot of the name for copy up
7805739ce457 ovl: set OVL_WHITEOUTS before publishing the upper dir
ecc327edd96a smb: client: stop processing a read response after a receive error
daee49d7a51f smb: client: fix OOB last_entry pointer from unbounded LastNameOffset
f976692490bb ocfs2: snapshot dentry names in file and setattr traces
7ff4f020f7b0 ocfs2: pin refcount trees before dropping the lookup lock
59d336153d40 ocfs2: fix chunk number of the first chunk in a local quota file
5ff0f92064ab ocfs2: cancel quota sync work before freeing quota info
a3dd8d3af023 ocfs2/dlm: hold the lookup reference across convert AST enqueue
f4ae0b96a4ab ocfs2/dlm: hold a lock reference across grant AST enqueue
3e05df6bd33a ocfs2/heartbeat: unlink live slots when their node is missing
f185fc81aee9 media: rc: Fix ABBA deadlock by making locks more fine grained
4528f92222e7 media: rc: Fix use after free in bpf progs
e6ed118d1426 media: rc: After rc_unregister_device() timers can be re-armed
6d1be288650b media: rc: Use after free in ir_raw_event_handle()
0e18282783cc media: rc: mce_kbd: Fix inconsistent locking of keylock
87a2d2c15f1f media: rc: Fix race between bpf(BPG_PROG_ATTACH) and device unregister
d5e446e0a054 media: rc: fintek-cir: process a full RX buffer instead of overflowing it
63644a8b70da media: rc: Ensure registered is cleared in error path
144ce635f8cc media: rc: Ensure that rc_unregister_device() does not free input device
006ad1a97ab7 nvmem: core: Fix OOB read for bit offsets of more than one byte
fce1dd31b185 power: supply: sbs-battery: disable polling before supply teardown
2ea5385758a7 phy: core: Fix race-condition between _of_phy_get() and try_module_get()
b3d771544f7d resource: report a devm_request_resource() conflict under the lock
733552f8c5f5 spi: spi-pci1xxxx: quiesce DMA engines on transfer timeout
c792858491ee ufs: use u64 for directory size in ufs_last_byte
e7e89759445e usb: gadget: fix refcount underflow in gadgetfs_bind() error path
26dc15da08f1 wifi: mt76: mt7996: unlink TWT flow if the MCU rejects the agreement
49e05c8d3d8f wifi: ath9k: delete channel-context timers on deinit
e64707d07fcd xen-blkfront: unbind irq before tearing down ring and shadow requests
0f332cce4d59 serial: core: shut down initialized port on removal
a79de0e5e66b scsi: dc395x: sync the waiting_timer before freeing the host
325da0365ffa mm: khugepaged: fix folio is used after folio_put/unlock()
590f48b56443 mm/slab: sample slab_state once in kmem_cache_destroy()
e848c0bd189b media: s5p-mfc: use timer_shutdown_sync() for the self-rearming watchdog
98e3df13c9fd media: redrat3: fix UAF in probe error path leaving rc device registered
1711d758ede7 media: microchip-isc: take a reference on the parsed endpoints
9fa70d75ab03 media: microchip-csi2dc: fix async notifier leak on probe error path
12d0222809f9 media: marvell: mcam: stop DMA and cancel s_bh_work before freeing DMA buffers
49a0623994a1 media: imx-jpeg: cancel timeout worker when streaming stops
d02a2ed05737 media: gspca: use vb2_video_unregister_device() on disconnect
cbe537c64b8f media: cx23885: unregister DVB bus when SP2 CI setup fails
4ab2c987fd15 KVM: PPC: Book3S HV: Add SRCU protection for virtual-mode HPT hcalls
881ec3e0d29a iommu/arm-smmu-v3: Disable the impl before disabling the SMMU on shutdown
35096f62ca37 iomap: don't resubmit an ioend after ->writeback_submit() failed
2efcf743664a io_uring/io-wq: save worker type before dropping its reference
1b7b31f0d4bb HID: hiddev: keep state alive through disconnect unlock
e1b124226d55 genirq: Move interrupt thread exit_work object to irqaction
a6deaadd460a genirq: Defer kfree(irqaction) until irq_thread_dtor() finishes
abc9c0f4f850 fs/proc/task_mmu: pin mm_users in do_pagemap_scan()
1e13b8957510 fbdev: udlfb: don't rebuild the mode list while the framebuffer is in use
3b0be34d9d1e fbdev: atmel_lcdfb: Prevent FIFO work after removal
aa0be226ff22 drm/panthor: Fix TOCTOU race between GROUP_REGISTERED check and erase
d5cc1f1333d4 Bluetooth: hci_vhci: Pin module for debugfs file operations
2ff55599528d ASoC: amd: ps: fix snd_acp63_remove() teardown ordering
5cb07a5941b1 ALSA: pcmtest: handle multiple wraps in random capture fill
af2b590be8fe ALSA: emux: Fix UAF of soundfont zones at note-on
04d11c4db269 ALSA: control: Fix UAF in snd_ctl_elem_add() on card disconnect
b33aedc99e3c rust: rcpufreq_dt: add module alias
822d6761cdea rust: cpufreq: reject NULL from cpufreq_cpu_get()
dc1744584b2b rust: configfs: fix data offset calculation for subsystem callbacks
c6112b0a1627 rust: block: require `Sync` for `Operations::QueueData`
11c13964153d rust: block: fix `Send` bound for `GenDisk`
964002cb55d9 rust: bitmap: restrict bitmap length to at most i32::MAX
d2af35f84f51 objtool/rust: add one more `noreturn` Rust function for Rust 1.101.0
d655ef174056 klist: avoid accesses after waking klist_remove()
9250253c0ad5 HID: wacom: Write shared touch initial status only once
c93698167e8d HID: wacom: Setup SW_MUTE_DEVICE according to the order of input registration
321da540c4a2 HID: wacom: Redesign shared sibling data lifecycle
ac81120321a9 HID: wacom: Fix Use-After-Free in wacom_bamboo_pad
ef74a8a685e2 HID: wacom: Fix Use-After-Free in wacom_intuos_pad
1df501b62a2f HID: wacom: Advertise SW_MUTE_DEVICE capability prior to registration
24d9994e439f HID: wacom: Use hdev->product in wacom_setup_touch_input_capabilities
bd30e2b60e81 s390/zcrypt: Fix out-of-bounds ptr advance in cca_query_crypto_facility()
043da311673c s390/signal: Fix incorrect return address in signal frame
0917637564e9 s390/probes: Fix wrong opcode for cgrb fixup
3a4da9347371 s390/kprobes: Prevent kprobes on instructions with exception table entry
333a1435802c s390/extable: Fix mvcos instruction decoding
ca06a46b6289 s390/cpum_cf: Check session mask before cpu offline
3bcce6db5940 drm/msm: Fix vm_bo use-after-free in with_vm_locks()
59eac6863eed ata: sata_fsl: Fix use-after-free of host_priv on probe() failure
fd0dd0ee82ef ASoC: audio-graph-card2: Fix use-after-free in audio_graph2_link_c2c()
174b4b90ec67 apparmor: fix a use-after-free in aa_lookupn_ns()
1108d9a51c91 mm/hugetlb: fix use-after-free of a new anon folio
8b87fd23be5a mm/hugetlb: fix use-after-free in hugetlb_mfill_atomic_pte()
c33165bb785c media: imon: fix use-after-free in display_close via dev_dbg
e9deece85062 media: hackrf: fix use-after-free in hackrf_alloc_urbs() error path
2344922abe2a media: cx23885: Fix use-after-free in cx23885_finidev due to race condition
95a1f45a82e5 media: au0828: fix use-after-free in bulk_timeout timer on disconnect
70825b251e5f lockd: Fix use-after-free in nlmsvc_retry_blocked
2b61008c9f88 landlock: Fix superblock use-after-free in release_inode()
439c23b897c8 iommufd: Fix event queue release use-after-free
6324f087caf8 nvmet-fc: fix use-after-free in nvmet_fc_ls_create_connection()
506c066da8fb nvmet: fix use-after-free of the old registrant in nvmet_pr_preempt()
ff2c27583cf9 platform/x86/amd: hfi: Fix a use-after-free when unloading the driver
48157350b24a rapidio: mport_cdev: fix use-after-free in mport_mm_close()
e5388f15d595 RDMA/irdma: avoid use-after-free in icrdma_remove
8069935474b1 smb: client: fix use-after-free in cifs_ses_add_channel()
6c4c12b0fadc smb: client: fix use-after-free infoleak via the readdir resume name
b5e5d035abd1 spmi: Fix potential use-after-free by grabbing of_node reference
3c3b40165022 SUNRPC: fix netns use-after-free in write_gssp()
ac7558126767 wifi: b43: fix use-after-free in b43_bcma_remove()
41f968434a72 x86/ioperm: Prevent NULL dereference on theoretical missing IO bitmap
8519fc07a486 KVM: VMX: Synthesize nested EPT violation GVA_IS_VALID/GVA_TRANSLATED bits
3b4df5414b99 KVM: x86: Tell ->inject_page_fault() whether or a fault came from hardware
8a803deb2c7f KVM: x86/mmu: pass PFERR_GUEST_PAGE/FINAL_MASK to kvm_translate_gpa
42a44fe738f6 Revert "Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU"
eff110e062a5 Revert "Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU"
d3d5560fb755 cgroup: serialize migrations of newly forked processes
3d0d2b4ad54f vlan: restore HW VLAN tag insertion with reorder_hdr off
b3b56e95f6fa tcp: Fix potential UAF in reqsk_timer_handler().
e8aa0ac634f0 ksmbd: validate security descriptor offsets before pointer arithmetic
fb743d9cb66e ksmbd: use u8 for SMB2 oplock level values
4f5ec4b0e9a8 ksmbd: return end of file for reads past a named stream's data
06a751809ebd ksmbd: reserve space for the UTF-16 terminator in stream info
22464634d240 ksmbd: preserve unreadable named streams on open
9582dc3a3178 ksmbd: ignore network devices of other namespaces
93566781118c ksmbd: fix parent dentry lifetime in directory enumeration
4f238380ea38 ksmbd: fix overflow in dacloffset bounds check in build_sec_desc()
93cb902b0ca0 ksmbd: fix OOB read and cross-share confusion in ksmbd_validate_name_reconnect()
24455d79b91b ksmbd: fix extended session security negotiation for raw NTLMSSP
99a9db401d16 ksmbd: avoid restoring only in-memory EOF after allocation change
be28566c8264 ksmbd: accept share config responses from ksmbd-tools before 3.5.3
d85edc8f06ee backlight: qcom-wled: Fix WLED3 brightness register stride
e9bff555cc77 backlight: qcom-wled: Fix unbalanced OVP IRQ enable at probe
8eee3226bccd backlight: qcom-wled: Fix NULL pointer dereference in wled_remove()
cf41ae5149f1 backlight: lm3630a: Cancel delayed work before destroying workqueue
f204bb7c5d10 Drivers: hv: vmbus: Bounds check the shared ring buffer indices
d4bded35edf8 driver core: fix parent lock use-after-free on USB disconnect
890096a9e7c2 driver core: Limit the messages on a refused uevent
4a9a39ef6da4 driver core: take parent lock on deferred probe
2f1111eb40d7 net/sched: act_ife: do not consume the inner header on egress
a3486bfb9d09 net/sched: fix packet reordering on requeue
fc55d92ae6a4 net/sched: sch_teql: fix use-after-free on lower qdisc drop
87d636b30288 net/sched: sch_teql: fix slaves_lock IRQ deadlock
cdffcb89d844 net/sched: cls_flower: avoid stale mask references after delete
5d3e01de3120 net/sched: cls_bpf: accept dev-bound programs on shared blocks
6cf00e646dc3 RISC-V: KVM: Fix double-free of sdata in kvm_pmu_clear_snapshot_area()
b97686f15851 drm/amdgpu/uvd3.1: Fix checking whether UVD firmware keyselect was already set
b20c4193a425 tracing: Fix NULL dereference when copying keys for a field variable
9876738cd08e tracing: Bound histogram expression strings with seq_buf
69c4a13c6587 tracing: Return ERR_PTR() from expr_str()
4cb2b85da2bd tracing: Use __free() for expr_str() buffer
232c6e8486c7 tracing: Fix fully-qualified variable reference printing in histograms
febee5fb9164 ntfs3: free replaced mount options after a grace period
4aef6ceb4d6a ipc: drop the mqueue mount with kern_unmount() on setup failure
73309ca08e71 ipc: create_ipc_ns: drop mqueue mount on sysctl setup failure
16c95870c95f accel/rocket: search every core slot when looking up a scheduler
5684a6c24c0d drm/amd/display: guard dc_sink dereferences in MST mode validation
81a1c7eba334 drm/amdgpu/gmc12: properly pass flush_type to gmc_v12_0_flush_vm_hub()
84cc155bf4cd drm/amdgpu: remove gart_window_lock usage from gmc v12
bdb5784531b2 drm/amd/display: Fix fast updates on DCE 6.x
352c5f5b995e tools/power turbostat: Read complete CPU lists
850d8d4b2715 smb: client: require stable pages for signed connections
7448dcaaf747 smb: client: only require read lease for size-extending zero range
e97dac26ed2c smb: client: drain and invalidate before server-side copy/clone
7beb2f2a5802 smb: client: discard post-EOF pagecache when extending a file via clone range
0f79506b3673 smb: client: clear post-EOF pagecache when extending a file via truncate
2fc1ffb15efd ALSA: hda/realtek: Add micmute LED quirk for Acer Swift SFG16-72
6faf87bc7331 ALSA: hda/realtek: add quirk for Acer Nitro ANV15-51
5d06e2f861d6 KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded
f2bd7cf6a83e KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN
d4f2168ee910 net/sched: act_ct: remove 'add_helper' dead code
908bc440a285 KVM: x86: Fill kvm_run exit fields in common get_nested_state_pages() error paths
59d30bdc3dd6 smb: client: delete compound mids on send failure before unlock
3c97f7cb6c48 drm/amdkfd: Avoid integer underflow in EOP ring size calculation.
9e8f43579f84 drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc
2f16636913db drm/amdkfd: Guard m->cp_hqd_eop_control setting by q->eop_ring_buffer_size
2548c31f3a19 xfs: don't cross reference rmapbt with bitmaps if they're incomplete
9044683dfdc4 RISC-V: KVM: Fix sdata leak and stale snapshot_addr in snapshot_set_shmem
969825a50f58 RISC-V: KVM: Release unused page after MMU invalidation
19b0188d0263 smb: client: fix fattr leaking on wsl_to_fattr() failure
b057eb6ab800 selftests: ublk: install test_common.sh and trace/ scripts
59d9b928e7a9 selftests: ublk: increase timeout to 150 seconds
5531d09ec91c selftests: ublk: add utility to get block device metadata size
c70f93046f59 selftests/ublk: fix Makefile to rebuild on header changes
6ba19e15b3e1 drm/amd/pm: fix gpu metrics energy accumulator for smu 13.0.0/13.0.7
d521b90533d0 hwmon: (asus_rog_ryujin) Synchronize HID command and report handling
49cc6d5c00a7 hwmon: (asus_rog_ryujin) Validate HID report lengths
e32756e2f58a hwmon: (asus_rog_ryujin) Add per-device configuration
ac3f7cc23265 hwmon: (asus_rog_ryujin) Rely on subsystem locking
2f0a57ff8467 smb: client: fix WSL reparse point uid/gid override
bd958a567974 smb: client: fix uid/gid override in getattr with posix extensions
5802a9fda4ce mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ
949748d82794 MIPS: Fix HOTPLUG_PARALLEL dependency
4b24a1cbb107 s390/crypto: Fix handling of EBUSY in PAES when req is pushed to crypto engine
6c3e51e44834 s390/crypto: Fix use of mutex in atomic context in PAES
e97fcd8b6598 s390/crypto: Fix return code handling at skcipher_walk_done in PAES algorithms
06a76084f3e5 s390/crypto: Replace cond_resched() with msleep(1)
46345b99ee5d LoongArch: KVM: Fix resource leak in kvm_loongarch_env_init() error path
b46e041ff516 LoongArch: KVM: Add unregister helpers for the KVM interrupt devices
18c77e2bd13c drm/amd/display: Remove const Qualifier From Non-Pointer Fields
ebc73f622313 drm/amd/display: add const qualifiers to watermark params struct
04a1c2898d47 drm/amd/display: Update P-state naming for clarity.
dab4a7fc7be2 drm/amd/display: DML2.1 Reintegration
39a2c4e5e606 thunderbolt: Make the DP tunnel activation callback mandatory
fc1fc874ceed ipv6: udp: Create exceptions before socket matching
d269ed9fff52 riscv: hwprobe: initialize pair->value in hwprobe_one_pair()
79345a5d14b8 smb: client: reject SetEA requests that do not fit the request buffer
c9c29481d5d4 mm/migrate_device: clear stale mapping after freeing swapcache
fa75d22453e5 mm/kmemleak: report RCU-tasks quiescent states during the scan
8eaaabd4e935 mm/kmemleak: stop the task stack scan early when interrupted
b396167a7e21 rust: cfi: disable function merging if CFI is enabled
81648c2440fd LoongArch: Expand module virtual address space to 2GB
79d5f84e63a5 nfsd: use test_and_clear_bit for somebody_reclaimed to prevent lost update
5f8e8c06c53f nfsd: dedup nfs4_client_to_reclaim inserts
c7427dc319d3 LoongArch: KVM: Set vcpu->cpu before IN_GUEST_MODE is set
f26957f88034 LoongArch: KVM: Deliver interrupt after IN_GUEST_MODE is set
01a4c00041be LoongArch: KVM: Check kvm_request_pending() in kvm_late_check_requests()
bbac028f2e9c i3c: master: Fix potential UAF in i3c_device_uevent()
215bf2a69844 mm/page_alloc: don't spin_trylock() when disallowed in free_one_page()
d7e0602fe5a4 HID: input: read battery capacity from its actual report offset
fb59d3c60513 mm/migrate: use huge_ptep_get() in remove_migration_pte()
be58823c0e2c KVM: x86: Always initialize EFER reserved bits on vendor initialization
59c7c68ec4de drm/xe/display: skip FORCE_WC and vm_bound check for external dma-bufs
7d38a96a9327 irqchip/gic-v5: Fix standalone IRSes OF probe
59a6d8eda1c5 dt-bindings: interrupt-controller: gicv5: Relax IRS properties constraints
db0f1d03fbd1 sctp: auth: discard auth_chunk when skb_clone fails
8ced68fe293a netfilter: ctnetlink: do not expose expectation DEAD flag
f540bf1291a9 netfilter: nf_conntrack_expect: add and use nf_ct_expect_related_pair()
bc6b1da681ab netfilter: nf_conntrack_expect: use conntrack GC to reap expectations
af17c2ffde0b xfs: fix integer overflow problem when setting large free areas
66b8f5bfc592 wwan: wwan_hwsim: Pin module for debugfs file operations
df713b82b4b9 udf: fix return value for non-recorded-allocated extents in udf_map_block()
85a8777c7ec5 thunderbolt: Do not RPM complete unrelated subtrees on unplug
d764d3f28a38 ocfs2: publish the filecheck owner before adding sysfs attributes
f5e973e238ba ocfs2: pin owning modules for open debugfs files
1c77b387fc30 ocfs2: drain quorum work before removing the cluster
912327bb4cfd ocfs2/dlm: drain join handlers before releasing module text
f43a5d7b665c nfsd: fix race between client_info_show() and free_client()
00c0c940c1c8 net: usb: pegasus: do not advance rx_skb->data on dropped frames
f9af5772ff0e net: ipv4: add zero check for snd_cwnd_clamp
8e2fc3941b40 media: go7007: only set audio_enabled if go7007_snd_init() succeeded
dc0072c1b40f media: em28xx: reject audio endpoint with zero packet size
324d30da90f2 media: cx88: Disable PCI device on MPEG initialization failure
04a04953b482 libceph: bound mon_command ack decode to front len
c93505aa0b29 kcsan: Avoid division by zero in kcsan_prandom_u32_max()
068d3950e718 kcov: ignore an out-of-range comparison count in write_comp_data()
61adcab593ff fuse: don't BUG when the copy buffer is exhausted
49d7c1beac38 ceph: fail readdir when the MDS reply carries no dirfrag
37c957fbc8ac blk-crypto: fix NULL deref and UAF in __blk_crypto_evict_key()
277157864856 ARM: 9524/1: mm: align hugetlb mappings to the huge page size
5259a82b1ac1 media: em28xx: use video_unregister_device for radio_dev
5712414af239 Revert "namei: don't reveal overmounted entries in refwalk"
ebb9d776e297 nbcon/reboot: Switch NBCON consoles into the emergency mode in emergency_restart()
781ced4acf43 regmap: Remove debugfs before cache teardown
4c6e3d81f8d4 RISC-V: errata: Add SiFive MAL-9092 workaround
b213051fc40b drm/amdgpu/gfx11: set KMD_QUEUE for kernel gfx queues
771bdf5dd8b1 drm/amdgpu/gfx12: set KMD_QUEUE for kernel gfx queues
4de130f28ae8 ALSA: usb-audio: Add native DSD support for Cambridge Audio streamers
c1e50fa372a8 ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg3xxx (103c:8bfd)
ba06038fba12 spi: cadence-qspi: Fix status polling with octal DTR chips
60f0adc41d88 ALSA: hda/realtek: Add ALC235 support for headset mode
13c12f98618d ALSA: hda/realtek: Add quirk for ASRock NUC BOX-358H
96e38c6a49f5 net: usb: qmi_wwan: add Rolling Wireless RN947R
0ec1ea7f38d6 usb: mtu3: Fix double dereference in TP_printk
a6c911aa993b ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 14-dv1001TU
b639fb18ad69 ALSA: hda/realtek: Fix speakers on ASUS PM3406CHA
022127b8df54 ALSA: hda/realtek: Add quirk for Acer Nitro AN515-45
3b75fa0871d3 ALSA: hda/realtek: Add mute LED quirk for HP Victus 15-fb2xxx
14d1a67641d3 ALSA: hda/realtek: Add quirk for HP ENVY 13-aq1xxx
634410e63635 ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-ec1xxx
359096b8ff07 ALSA: hda/realtek: Add quirk for Lenovo ThinkBook G8+
1e2dd3f061e0 ALSA: hda/realtek: Add quirk for Lenovo ThinkBook 16p Gen 3 ARH (21EK)
888a43640be3 ALSA: usb-audio: Add mixer mapping for MSI MAG B850M MORTAR WIFI
654906c34da2 ALSA: hda/realtek: Limit internal mic boost on HP Pavilion 15 (103c:2164)
0ce65d3accd6 docs: update the unmount propagation rule
bf4fde54d928 nvme-tcp: delay nvme_tcp_reclassify_socket()
93449e64cdee ASoC: Intel: bytcr_rt5651: Add quirk for Chuwi Hi8 with generic DMI strings
2a6254baab5c HID: Intel-thc-hid: Intel-quicki2c: Fix buffer overflow
c6e94c4f3102 HID: Intel-thc-hid: Intel-quickspi: Fix buffer overflow
874ef161d968 HID: universal-pidff: Add support for Turtle Beach VelocityOne Race
a66633b2171a ASoC: amd: yc: Add DMI quirk for Lenovo V15 G6 ARP
43d6e9c812ed sfc: add X4D PF support
257610f2b6d8 gpio: mvebu: keep resume masks within the irqchip cache
88b0f77c6126 ASoC: amd: yc: Add Lenovo ThinkPad E16 Gen 2 (21JN) to quirks
2c7a144e9e07 scsi: devinfo: Add BLIST_SKIP_IO_HINTS for EMC Symmetrix
7e2fa3109c1f HID: roccat: fix locking in roccat_connect() and roccat_disconnect()
7076e590e98f nvme-fc: do not warn on controller removal race
bd351a436690 HID: elecom: Add support for ELECOM M-XT4DRBK (018E)
0b034e308564 HID: i2c-hid: add reset quirk for Lenovo Yoga Slim 7x Gen 11 keyboard
aac2603cd829 HID: i2c-hid: Add i2c-hid-quirk-bad-input-size quirk for 0911:5288 device
3f89968d6aee regmap: irq: Free the irqdomain we create
aa8d2e53bee5 ksmbd: handle allocated range queries on dense files
6938950bd00a netfilter: tproxy: use DEBUG_NET_WARN_ON_ONCE for protocol fallbacks
f08a043321aa ceph: fix use-after-dereference of NULL ci in __ceph_remove_cap()
e3b41c907cb3 ASoC: amd: acp-config: Add HVY-WXX9/M1060 DMI quirk
2aeb9dce7d76 ALSA: hda/conexant: Always enable the headset-mic pin on plugin
1fa62b20936a ceph: do not cache negative dentries for snapped directories
d2176dd74e28 ASoC: amd: acp3x-es83xx: Add HVY-WXX9/M1060 DMI quirk
498f2b22fb4a ALSA: usb-audio: Skip mixer creation on M-Audio Venom
f71c9aa7c0d0 tpm: atmel: depend on X86
115270245d39 tpm: tpm_tis_spi: fix nodef CR50 tpm_tis_spi_resume is null
a9b39298d6db HID: multitouch: Fix stale MT slots when contact count drops to zero
cd95f97f3cd2 HID: i2c-hid: Add a quirk for a Cirque I2C device.
18f4f406663b ASoC: amd: yc: Add DMI entry for Alienware m18 R1 AMD
ce5368025a42 fuse: zero the partial EOF page when extending a file
74460c60c40e ALSA: hda/realtek: Add quirk for Lenovo IdeaPad Slim 3 15ABR8
d1687e52368c net: stmmac: fix device node reference leaks in stmmac_mtl_setup()
14222a8d5629 powercap: intel_rapl: Fix kernel panic during PMU unbind
582a89109ad9 fbcon: Fix KASAN slab-out-of-bounds Read in fbcon_prepare_logo
855236abde29 net: ethernet: mtk_wed: increase WED v2 WDMA RESV_BUFF to 0x80
c3d7738b2665 docs: block: fix dead http link in blk-mq.rst
0337af8a6c39 scsi: snic: Fix SCSI host leak on workqueue allocation failure
15f26d38bcf5 ALSA: usb-audio: Add iD14 MkI to monitor-mix volume quirk
75e1a1c2738a ALSA: hda/realtek: Fix ALC700 audio on Intel Hades Canyon
e0414672a687 f2fs: avoid setting SBI_NEED_FSCK on transient resize failure
167b5e23acf6 ACPI: button: Add DMI quirk for Razer Blade Pro 17 early 2020 lid switch
59f9c4989e6a sched_ext/scx_flatcg: expire cached hweights on weight changes
b78a4334a892 ksmbd: enable TCP keepalive for accepted connections
890a3b249d46 fbdev: platinumfb: add error checking for ioremap calls
a4467fbe4114 fbdev: maxine: fix 64-bit build error
c63885314e5b i2c: imx-lpi2c: properly unwind resources on probe failure
5c54d87cbe63 spi: loongson: pm: add .freeze .poweroff .thaw .restore
48e991d80a20 rtc: brcmstb-waketimer: add missing MODULE_DEVICE_TABLE()
889c7d21115a rtc: ds1307: fix RX8130 wakeup alarm WADA bit for day-of-month mode
c6e3c175c3ff ASoC: rt712-sdca: Pull high JD2 to prevent from entering TV mode
c4726cf942f0 virtio_ring: fix infinite loop in virtnet_poll_cleantx when device is broken
60ae1e266f40 PCI: vmd: Add Nova Lake (NVL) and Dunlow (DNL) Device IDs
b330ab215f28 rtc: ab-eoz9: add missing MODULE_DEVICE_TABLE()
cfc695ac470d virtio_balloon: warn on failed buffer add in tell_host()
085c485d4952 ALSA: usb-audio: Add MIN_MUTE quirk for Creative Sound Blaster Play! 3
b34f1cc7838e vdpa/mlx5: roll back MR update after VQ setup failure
ad008eeee1e9 drm/radeon: fix internal display on iMac11, 1 (RV770/DCE3.1)
848b8e33af21 vdpa_sim: hold iommu_lock across dma_unmap passthrough transition
f65a37638f23 ASoC: codec: max98926: fixup invert setup mask
2c6395235c3c platform/x86: thinkpad_acpi: Fix fan speed reporting on Edge E330
504309a6d934 platform/x86: msi-ec: Add MSI Katana GF76 11UEK EC firmware
6a5808b62103 NFSv4/flexfiles: report cancelled I/O as a layout error
b486934bcabd net: stmmac: use dma_addr_t for DMA addresses
628874afc85e NFSv4: pin the superblock for active state owners
eb8a4524d32e ALSA: hda: Add Lisuan HDMI controller and codec support
d44771126e54 NFS: Verify symlink inode before caching target
085a1eb885f1 smb: server: Free session data in user_session.c with kfree_sensitive()
7b3f00649f04 ksmbd: notify parent directory leases on child create
290e5d72744c pNFS: honor clora_changed when recalling a layout
b6534d1bd7de smb: server: Make sure that passkey is not leaked on the heap in user_config.c
2b24e1a49f97 ksmbd: honor client signing-required in all modes
3a728c25f714 ksmbd: reject blocking compound lock requests
010ebd24940f ksmbd: fix AsyncId zeroed before use in smb2_lock() cancel response
394898ff40cd ksmbd: fix SMB2 byte-range lock end offset
6cdc0ac0c455 ALSA: hda/realtek: Fix mute LED for HP Victus 15-fa1xxx (MB 8C3F)
bbcfc51648fb smb/server: cancel async requests when closing connection
d5eaa5dc2d91 ksmbd: report actual xattr value length in stream enumeration
1ffa534cbaa0 ksmbd: skip fallocate for SMB2_CREATE_ALLOCATION_SIZE on a stream handle
1373a9aba9ee ksmbd: allow FSCTL_SET_SPARSE without input buffer
752103a26dc1 ksmbd: honor byte-range locks for zero data
d4b647621230 ksmbd: handle empty QUERY_ALLOCATED_RANGES output
ca4bc2ab7e74 ksmbd: return buffer too small for short security queries
0adca6c5265c ksmbd: fix off-by-one rejecting minimal COPYCHUNK query-limits request
b0b3a3f35df6 ksmbd: reject SMB3.1.1 binding with mismatched cipher
a5f2f2779999 ksmbd: fix durable handle v2 default timeout units (60 -> 60000)
ea8bcc916892 ksmbd: allow I/O on directory named streams
8b47ffa04762 ksmbd: preserve access denied status for copychunk
8db0eab85a89 ksmbd: protect private extended attributes
220e3f51071b crypto: keembay - use crypto_memneq() to compare CCM AEAD tags
567499907e17 libbpf: Fix ring buffer consumer loop on 32-bit position wrap
80cb14cc834a crypto: sa2ul - use crypto_memneq() to compare AEAD tag
9bfa6187948e crypto: keembay - use crypto_memneq() to compare GCM AEAD tags
fa2697301e7e gre: fix ERSPAN o_flags race/corruption in xmit and fill_info
edff0fa7834a exfat: keep FITRIM within the requested range
524a770828a3 drm/virtio: reclaim pending vbufs before tearing down vqs
72e4aeb3b6e7 HID: amd_sfh: Serialize access to the shared emp2 pointer
9f38adcea4f3 ALSA: usb-audio: Rename the Audient iD14 monitor mix volume control
89e76d0fc8d2 xhci: include all root port children in recovery prevention on link error
d80451f7f980 ALSA: hda/intel: Add sanity check for BAR0 size
9409d38fdde0 PCI: Avoid saving config space state if inaccessible
6def7dd96f04 ipmi: Fix leak in __ipmi_bmc_register
c2d18aa64816 soundwire: dmi-quirks: Disable ghost Realtek on Asus ROG Zephyrus Duo
14ecf77177cb regulator: fan53555: Add support for FAN53555BUC23X type
fe976b0e3c8a hfsplus: validate extent record length before writing it back
2ed996cb5d14 ALSA: hda/conexant: Add mute LED quirk for HP ProBook 440 G5
340894cf9332 alpha: run the remote RTC access in a worker, not an IPI callback
f360874df64b nvme: ratelimit the completion-path messages driven by device data
9c5a037acdec nfc: nxp-nci: Add remove on IRQ error
d72106a40a55 nfc: mrvl: spi: Unregister dev on allocation fail
8f22f2b887fc iommu/amd: Fix missing CMD_COMPLETE_PPR response for invalid PPR requests
7c42cf55b15f selftests: net: reuseport_bpf_numa: consider cpuless numa node
092924978789 apparmor: fix auditing of mount binary data
2f99cf389f72 tap: fix incorrect variable used for USO check in set_offload()
852e06e77d7e nvme-tcp: look up host_iface in the current netns
42a29688f693 docs: cgroup-v2: fix stale "io" controller introduction
9407cfd34fe2 selftests/net: fin_ack_lat: fix latency threshold typo
def617fb6150 nvmet: passthru: fix OOB reads when parsing ns id descriptor list
1f8ddae24633 perf/x86: Free hybrid state on PMU init failure
5db10037b9c1 perf/x86: Unregister PMI handler on PMU init failure
ad47c1a09474 ALSA: usx2y: Stop clearing urb->hcpriv before submission
1b8a5b21ef8d iommu/vt-d: Fix CACHE_TAG_NESTING_DEVTLB polluting shared variables in flush loop
01f4a7eeedac fbdev: udlfb: validate vendor descriptor items
8b9b1c171baf fbdev: omap2: dsi: do not copy isr table
8020e4ad1c59 RISC-V: perf: fix resource cleanup on driver probe failure
38c960fb5b83 riscv: kprobes: Prevent probes in breakpoint handlers
2c6e0e562259 net: dsa: mt7530: check CORE_PLL_GROUP4 access in mt7531_setup()
77eed1651eb6 net: pcs: mtk-lynxi: check regmap reads in mtk_pcs_lynxi_get_state()
f3cd9a1d3828 net: dsa: mt7530: check bus->read() error in core_rmw()
851a01505ed7 Bluetooth: hci_event: fix out-of-bounds read in LE PA report reassembly
7723752655f2 net: dsa: mt7530: error out on failed PHY_IAC command writes
9f8852db6036 Bluetooth: hci_sync: Disable legacy instance's ext adv before setup snapshot
cb2e19575267 Bluetooth: fix BT dependency for submodules
3fb4a0376b4e Bluetooth: hci_bcsp: validate received packet lengths
6594a73c6b1b Bluetooth: btrsi: Move set_bt_context after successful HCI registration
ea138f7a5a69 ALSA: hda/realtek: Add quirk for Acer Nitro ANV16-42 headset mic
1e475880c031 ALSA: hda/conexant: Add pin config quirk for Huawei Matebook
5af0fb2f2579 ALSA: hda/realtek: Fix speakers on ASUS ROG Zephyrus G14 GA403UM
5c462ae71213 ALSA: hda/realtek: Fix headset mic on ASUS Vivobook S14 S5406SA
bb3502307a71 ACPI: APEI: Handle repeated SEA error storms
9bf8e5566430 drm/amd: Add DCN6 register headers
d9ce845629cf btrfs: fix memory barrier order in reloc_root_is_dead()
ada5c75dd93f Bluetooth: bfusb: validate received block boundaries
ef01d3ea451a Bluetooth: btnxpuart: Fix use-after-free in probe error path
3e4e7a9907a1 Bluetooth: hci_nokia: validate firmware packet bounds
8a184070477c Bluetooth: btusb: Add support for 1357:c123 Realtek 8852BE device
f8b6ea70abc0 Bluetooth: btusb: Add USB ID 13d3:3625 for MediaTek MT7922
147d899c7b98 selftests/ftrace: Force C locale in ftracetest
7f8a0b026513 tools/lib/thermal: Fix misplaced extern "C" closing brace
7419a8dfa09f md: add cond_resched() to md_do_sync()'s skip path
2c2a8cf8dd4b md: skip bitmap accounting for empty write ranges
ae07a0c35544 md/raid5: reject zero-sector reshape chunks
2f7ad98de370 ALSA: hda/realtek: Enable mute LEDs on HP Spectre x360 16-aa0xxx
bb8625b38c5c ext4: guard against NULL s_group_info in ext4_get_group_info
28332e8aae84 HID: rmi: check report length before trimming sentinel bytes
db1e5bd4ee8e drm/amd/pm: derive stable PPT limits from PPTable
b6d0b00a2963 arm64: mm: fix accidental linear mapping of no-map reserved memory
dab4eb4a2135 wifi: rsi: Fix types to appease CFI
31b92853b9b3 soundwire: dmi-quirks: Disable ghost Realtek on Asus Zenbook Duo
de8256a63ba2 opp: Use clk_get_optional() to avoid leaving opp_table->clk as an error pointer
a5da12211b98 ALSA: hda/realtek: Limit mic boost on Positivo N15RPE-S
bc32b9880d1b ALSA: hda/realtek: Enable mute LED on HP Laptop 15-dy0xxx
ee78a5c533af xsk: account ring allocations to memcg
24dd15e91fa6 net: usb: cdc_ether: add quirk for AMI BMC stale link events
3b34ca885168 net: stmmac: raise TX completion interrupt at the end of an xmit burst
eb5702c3a407 wifi: mt76: mt7603: file buffered frames under the TID reported to mac80211
f02d25d753df ACPI: video: force native backlight on Acer Nitro AN515-46
795698c7f08f ALSA: hda/realtek: Add mute LED support for HP Pavilion 15-eh2xxx
de4d87d5b5ab s390/dasd: Snapshot intrc before freeing the request block
f302c2ce5e78 kconfig: abort rather than loop for ever on EOF
2c4825a78bf4 net/rds: unpin MR pages with unpin_user_pages_dirty_lock()
3ae57d5de915 net/rds: fix rds_message leak in the rds_send_xmit() drop path
d27f95e1d8e1 net/rds: hold the socket while an rds_mr references it
6e016448a0dc net/rds: don't use unpin_user_pages_dirty_lock() from atomic context
6802944b2bca HID: intel-ish-hid: ignore post-init ENUM_DEVICES from firmware
d8152a70f694 HID: quirks: add ALWAYS_POLL quirk for AULA Mini 60 HE Pro Dongle
799f11584060 HID: quirks: Add ALWAYS_POLL quirk for Beitong BTP-KP20D dongle
d191b5ca149b HID: logitech-hidpp: Add support for G502 X Plus USB mouse
70c6c25f1fdc ALSA: hda/realtek: Add quirk for ASUS VivoBook M515DA/X515DAP
0a03dd1d896b wifi: wilc1000: validate monitor transmit frame headers
cbbef3c7d07c wifi: brcmfmac: validate msgbuf flowring IDs before use
cc03f779a328 wifi: brcmfmac: Set DMA direction for msgbuf packet IDs
853afa74a0a8 wifi: mt76: mt7603: restore hardware PS buffering after a service period
f1a8ab40a5a2 wifi: mt76: mt7603: fix U-APSD service period termination
fe0126804871 wifi: mt76: set the EOSP bit in the QoS header of the last released frame
562b8dae6459 wifi: mt76: mt7615: fix NULL deref in mt7615_mac_set_rates
b9ba943727cc ASoC: SOF: Intel: mtl: Power down DSP if it is left enabled in pre_fw_run()
2ab864e23245 wifi: ath11k: fix resource leak on error in ext IRQ setup
25fbd6996775 perf: marvell: Cancel CN10K DDR PMU hrtimer on device remove
4da920688df0 netfilter: nf_tables: call skb_valid_dst() before skb_dst()
0c6d33329960 netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets
7b592201c265 wifi: mt76: wed: fix kernel panic on non-DBDC MT7986
f39060120cf8 wifi: mt76: mt7603: add 0x7592 EEPROM chip ID
c16fe00dc2fd wifi: mt76: mt7921: fix memory leak when skb_linearize fails in mcu rx event
44081a569fb6 wifi: mt76: mt7915: configure noise floor reporting on reset
5470927c67dc wifi: mt76: mt76x02: report rx FCS errors to mac80211
3b45fe35f1c0 wifi: mt76: mt7603: free beacon SKB on error
9bc5063c5123 virtio_console: take a kref in find_port_by_vq() to fix port UAF
b64510df5898 nvmem: brcm_nvram: fix out-of-bounds access on malformed flash data
6983cdcd9e47 nvmem: brcm_nvram: reject empty NVRAM partition
10a665862bfe romfs: detect hard link cycles
b7e89e2fa8f1 md/raid5: complete discard bios while reshape is active
50d94323e855 regulator: rt6245: Restore state on enable failure
1a23e121c92e mfd: axp20x: Preserve other control bits when powering off
6a81aedf497a ALSA: hda/realtek: add missing error checks for COEF index reads in alc269
937f704f4bfc mfd: ipaq-micro: Fix out-of-bounds stack read in ipaq_micro_str
f732a202ae1c fs/ntfs3: Fix memory leak in indx_find_sort()
2728611a9cc5 ALSA: hda/realtek: add missing NULL check for codec->bus->pci
ed7d338c57cd exfat: free new directory cluster if zeroing fails
ff69fd262ed1 soc: mediatek: add missing MODULE_DEVICE_TABLE()
2c6749d443ac drm/panel-edp: Add BOE NE140QDM-NX2
0d96af6c34ca s390/mm: Fix handling of vmalloc area in do_secure_storage_access()
020be4f6fa04 s390/mm: Add missing mm check to do_secure_storage_access()
ad0976d2cc58 platform/x86: dell-smbios-wmi: Fix chardev resource management
7ad1c9970678 drm/msm: Fix barriers accessing ctx vm
94e9beb9f07e drm/msm: Move nr_cmds initialization
53b20af866fa ALSA: hda/conexant: Add NULL check for dc_mode_path
521f9dcf2e26 exfat: clean up new entry on add entry failure
f10cfe517a15 arm64/runtime-const: Use aarch64_insn_patch_text_nosync() for patching
a5c18f62c897 drm/amd/display: Fix rounding errors in CalculatePrefetchSchedule
a5bc8c907c9f drm/amdkfd: Fix signal reset event
b42b5fcf47c7 scsi: smartpqi: Add new PCI device-ids
27577bc864c7 i2c: qup: Propagate clock enable failures
47aa1638074e ata: ata_generic: Don't store pci_device_id
39985760acd2 clk: clocking-wizard: fix clock difference detection
91b9c9cc4066 clk: tegra: support 48MHz clock for pll_p_out1
409acb7efcbf clk: mediatek: mt6735-vencsys: add missing MODULE_DEVICE_TABLE()
1d6ad628f553 clk: mediatek: mt6735-vdecsys: add missing MODULE_DEVICE_TABLE()
fe6152b31967 media: cx88: fix memory leak in cx8802_register_driver() error path
7554cd67a402 clk: imx: imx8qxp-lpcg: add missing MODULE_DEVICE_TABLE()
a2ec55a40da2 clk: imx: imx8qxp: add missing MODULE_DEVICE_TABLE()
9438ed031075 iommu/tegra241-cmdqv: Rate-limit the error ISR's log message
5bcbc5dfb8bb remoteproc: Force shutdown during device removal
3243737978f3 exfat: write moved entry before removing source
ea0a6f62eb58 udf: bound lengthAllocDescs from unallocated space entry
65bd51927d8d udf: Fix bh leak for unallocated space entries
cb0f7456d550 scsi: ibmvfc: free ibmvfc_target allocations with mempool_free
d2cf7dd54f2f scsi: ibmvfc: check for NULL evt in implicit LOGO and target delete path
1b2f849cd572 iommu/rockchip: Clear stale page faults before enabling stall
ebf377dcba5f hsi: omap_ssi: remove debugfs on port creation failure
ec6a78f9541a pinctrl: npcm8xx: move GPIO IRQ setup into request_resources
3046577a2587 pinctrl: npcm8xx: fix debounce register selection
6ea28cfe3424 pinctrl: npcm8xx: clear pending GPIO events during init
d00d165f4cc4 pinctrl: npcm8xx: enable RMII outputs from RMII groups
9c9d79cf6b58 firmware: imx: scu: manage mailbox channels and global handle
a77dc10cccc2 platform/x86: int1092: Fix info leak in parse_package()
2715ac3f0b8e fs/ntfs3: load ATTR_BITMAP run extents from $MFT extension records
cd64f6c8f944 fs/ntfs3: fix lseek EINVAL on sparse/compressed files with 64-bit clusters
a664da9f549d ntfs3: fix info-leak in ntfs_rename()
2a793f20a7e7 fs/ntfs3: reserve NUL byte when converting UTF-16 names
1affb82f1830 PCI/portdrv: Allow probing even without child services
49a49271d6a3 ntfs3: initialize err in attr_wof_frame_info
493f39b7fe97 soc: ixp4xx: qmgr: add missing MODULE_DEVICE_TABLE()
7460497fe7df drm/etnaviv: force flush on power register ops
4ae6749e2962 ata: pata_ep93xx: fix PIO fallback when DMA init fails
7a4e9be7b7d1 bitops: make the *_bit_le functions use unsigned long
3a2b86ccf13e ext4: use FGP_WRITEBEGIN for tail block zeroing
e860ffebadc9 ext4: check return value of ext4_get_block() in ext4_load_tail_bh()
a51500c4d9ac wifi: ath12k: fix scan command endianness on big endian
213ba5c52564 wifi: ath10k: trigger hardware recovery upon rx failures
e05a1a4ca1db wifi: ath11k: validate regulatory capability phy_id
d4ffdd817e43 net: libwx: disable TX VLAN offload for packets with >2 VLAN tags
823403820ab1 iommu/qcom: Publish pgtbl_ops before releasing init_mutex
79b547ff77c3 thermal: intel: int340x: clean up RFIM groups on DVFS failure
f8cd002bb33e iommu/qcom: Enable clocks before hardware access in qcom_iommu_ctx_probe()
34e6afb88d02 iommu/qcom: Check pm_runtime_resume_and_get() return in probe
6a0f6531a327 drm/panel: simple: Add Kyocera tcg070wvlq panel
4061582141c0 iommu/arm-smmu-qcom: Add SM8450 MDSS compatible
7a56475bb968 ext4: reject mount if clusters/inodes per group are not 8-aligned
131d675880a8 wifi: cfg80211: include cf1 offset when sending chandef
b3bec69dd24d riscv, bpf: Add support for BPF_MOVSX in RV32 JIT
da882736cbed power: reset: piix4-poweroff: add missing MODULE_DEVICE_TABLE()
71d4ef0a0b27 net: prestera: ignore duplicate RIF destruction events
9fd6abedac79 net: sfp: add quirk for HORACO copper SFP+ module
16b873971b92 power: supply: cros_pchg: unregister EC notifier
5a83f9996792 riscv, bpf: Add support for BPF_SDIV and BPF_SMOD in RV32 JIT
04f44f6885a5 ACPI: sysfs: Properly map BERT and CCEL data to their ACPI tables
a6caf23bbbd0 wifi: mac80211_hwsim: clear PMSR request state on abort
6e0ea620b219 wifi: mac80211: ibss: read deauth reason_code after frame length check
6166f19a6995 ext4: set EXT4_STATE_NO_EXPAND in ext4_evict_inode
72b2bf559243 PCI: vmd: Handle BUS_RESTRICT_CFG value 3 for Arrow Lake-HX
dc40b64d04f8 ext4: reduce max cluster size to match documented 256MB limit
745d9352ec80 platform/x86/amd/pmc: Add T14 Gen2 AMD (20XL) to s2idle quirk list
c3023181ec3e ACPI: battery: Sanitise model_number by dropping unprintable characters
45083910bc25 ACPI: FPDT: validate table and record lengths
c9aacd7db813 ALSA: hda: Check snd_hda_power_pm construct error before executing verb
996766054b88 platform/x86: asus-nb-wmi: map ProArt key (0x8b) to KEY_PROG3
5e1f73e1c34d drm/panel: panel-edp: Adjust T8 timing for AUO B116XAK01.6 and B140XTK02.4
5f9d81c7144f media: go7007: s2250: propagate control I/O failures
c023ae2228cf media: dvb-core: fix feed leak on failed DMX_ADD_PID
b571ade3a064 wifi: iwlwifi: mvm: ignore sync frames when sync is disabled
9e458e80d21d wifi: iwlwifi: mld: drop connection on D3 resume failure
d2554d9bd3ec wifi: iwlwifi: mld: validate wake packet crypto overhead
b7e3bcd3b2a1 drm/msm/adreno: Add support for A704 GPU
5528da68628d driver core: attribute_container: Unwind device_add() on attr failure
6f244ea2fafa PCI: switchtec: Add Microchip PCI1008 to NTB DMA alias quirk
a1474ca79993 PCI: switchtec: Add Microchip PCI1008 device ID
62a24f902e8c misc: ibmvmc: reject oversized inbound messages
97193b096581 ipack: ipoctal: add rwsem to guard against TOCTOU in remove path
61d91a89e136 misc: ibmvmc: release send buffer on write errors
afcf127aa07d greybus: manifest: validate string descriptor header
bc01e7408d8a misc: rp1: clear chained IRQ handlers on teardown
e1a03a65162b misc: hpilo: validate device queue entries before use
fc586ea54410 misc: genwqe: handle a first DMA address of zero
cfe59571ce97 misc: bcm-vk: validate write size before allocation
833c44918f91 comedi: pcmuio: Add sanity check to interrupt handler
52e7dfa88e39 comedi: pcm816: Fix sanity check in interrupt handler
7fbcd6f65358 comedi: pcmmio: Add sanity check to interrupt handler
7beb6ca2f3ff comedi: aio_iiro_16: Add sanity check to interrupt handler
ce0aea8f724b comedi: pcm711: Fix sanity check in interrupt handler
83b49a8dacfc comedi: dt2811: Fix sanity check in interrupt handler
27c6696abcce comedi: das6402: Add sanity check to interrupt handler
9fbe69c3ba2a comedi: quatech_daqp_cs: Fix sanity check in interrupt handler
1b077ad73af7 comedi: pcm818: Fix sanity check in interrupt handler
6c5a43d797ad comedi: ni_at_a2150: Fix sanity check in interrupt handler
a7300663fa0e comedi: ni_atmio16d: Add sanity check to interrupt handler
1b432b801385 uio: sercos3: add missing MODULE_DEVICE_TABLE()
55836402fc51 USB: misc: uss720: Fix leak in get_1284_register
7277d38c00bd usb: misc: cypress_cy7c63: check result of IO
148fcb7faf16 usb: musb: host: clear stale RX interrupt on three-strikes error
3c09eb8edc59 media: cec/core: drop cec_post_state_event call
5bb38ddc4ddf media: cec: tegra_cec: don't break off msg on NACK
c643f5567089 scsi: qla2xxx: Handle INTx not connected while passing through
c91060db4f4a wifi: iwlwifi: mld: Do not cleanup FW state when the device is dead
c7d73393a9e5 wifi: iwlwifi: mld: support aborting an ongoing ftm request
47e3a46c3c98 gpu: host1x: Wait for timeout worker completion on channel free
cc9422f6caee tools/lib/api: Fix potential double-free from fdarray__grow()
bca5f8ecbeaf wifi: iwlwifi: mld: cancel wiphy work before freeing wiphy
7ee63a67d2da wifi: iwlwifi: mvm: reset the smart fifo state upon FW stop
38c0dfbd44dd ASoC: cs35l56: Add support for CS35L62 for SoundWire
30d81bbb6239 wifi: iwlwifi: mld: reset the driver state upon firmware recovery
3da9cb696cee remoteproc: core: cancel crash_handler work in rproc_add() error path
3eae2410216a wifi: iwlwifi: mld: validate D3_END notif size
46403a03d416 wifi: iwlwifi: validate UEFI reduced-power SKU TLV length
5133a95f4109 wifi: iwlwifi: support TTL platform device ID
528b299318ee wifi: iwlwifi: validate PNVM SKU TLV length
d9754d77182f remoteproc: qcom: Check subdev start status in rproc_stop()
660cb7f6dafb media: go7007: avoid undefined shifts in MPEG-4 headers
1f000ae86851 media: cx18: stop VBI start-code scan before short tail
2579f03aad93 media: ivtv: stop VBI start-code scan before short tail
39ef93ceb83b media: i2c: ov8865: Program the sensor on stream start
2e7b5b3b6688 drm/etnaviv: check MMUv2 status after reset
80d182edba4f drm/etnaviv: check all modules for idle after reset
57a0b2edcd5f media: i2c: ov8865: Drop the runtime PM usage count on stream failure
25e807780416 nvme: clamp FDP nruhsd to allocated RUH status descriptor count
c9513f41be7e iwlwifi: dvm: add missing cleaup for on error path
155ae5908007 nvme: bound ns descriptor header and body to identify buffer
b2fd3bc65516 hfs: validate catalog CNIDs before instantiating inodes
2fcd643f0e3a soundwire: intel_auxdevice: Add cs42l44 to wake_capable_list
45d447061229 soundwire: dmi-quirks: add a global ghost list
d6c7e4fa4fcc drm/xe: only resume exec queues that were actually suspended
aeb724dae9a7 media: em28xx: use vb2_video_unregister_device
fbc2053fc89c media: em28xx: requeue buffers if start_streaming fails
3b9bfc463b2f media: em28xx: dev_info->pr_info since dev has been freed
3909eaa26344 mmc: rtsx_usb_sdmmc: suppress false CD after init timeout
8879a96ba07d pmdomain: qcom: rpmhpd: Skip retention by default
4a1ce4307f09 gpio: vf610: add missing MODULE_DEVICE_TABLE()
7823cf4f9bc9 crypto: keembay - add missing MODULE_DEVICE_TABLE()
edd239bf397f pinctrl: sx150x: add missing MODULE_DEVICE_TABLE()
d0fa85e36496 USB: gadget: inode: fix mm lifetime handling
4fba239be911 usb_string_copy: Use kzalloc() to avoid leaking old data
099d34863a4c usb: gadget: u_audio: clean up capture endpoint on feedback failure
6997b82a2a26 usb: fsl_qe_udc: check qe_alloc_request() failure in ch9getstatus()
e8ba98b981a7 serial: qcom_geni: Disable closing_wait for console to prevent shutdown timeout
d4b9dc0a5b4d tty: serial: pch_uart: add check for pci_get_slot()
5996913c7c04 serial: 8250: force synchronous probe for the ISA and PNP drivers
aa7c80d4e25a mmc: block: reject invalid perdev_minors before division
813a0eaf5570 media: v4l2-tpg: reduce stack usage for kasan builds
6b772df6ea8e media: cec: tegra: add missing MODULE_DEVICE_TABLE()
d638c584bdae rpmsg: char: Check for ongoing chrdev destroy
c50acb668559 PCI/ATS: Ensure pci_ats_supported() is PF-aware for VFs
6d7097c6cc34 platform/x86/amd/hsmp: Validate _DSD mailbox sub-package element count
42dcaf236bf8 ASoC: codecs: max98396: Unwind supplies on resume failure
8cc9318ac315 platform/x86/amd/hsmp: Validate ACPI UID before parsing socket index
87afe445153c bus: mhi: core: Fix sys error transition latency
21ffa516ded0 nvme: don't reference NS after unlocking in nvme_ns_head_ctrl_ioctl()
61ebae16cef3 drm/amdgpu/gfx11: WARN() rather than BUG() for invalid SDMA engine
a1a4ef16abca drm/amdgpu/atomfirmware: WARN() rather than BUG()
7bec37dbc03d ASoC: codecs: uda1342: Leave cache-only mode before syncing
e26ea9ee489f udf: avoid recursive s_alloc_mutex deadlock when freeing AED blocks
d7f0518e1bbd udf: validate extent partition references in udf_current_aext()
1e100c751450 usb: typec: mux: tusb1046: add missing MODULE_DEVICE_TABLE()
8a85caef4262 staging: rtl8723bs: fix missing unregister_netdev on sdio_alloc_irq failure
e4bde5182fa1 nvme: zns: cap zone report nr_zones by DMA buffer size
4be4e86ba5f7 nvme-auth: use crypto_memneq for DH-HMAC-CHAP response comparison
0f4def9c8171 nvme: handle positive error codes in nuse_show()
c9bfb6382c5f remoteproc: core: Full attach detach during recovery
d94ce7126853 clk: sunxi-ng: fix ccu probe clock unregister on error
2b7412064bfa mmc: dw_mmc: stop and complete DMA also in STATE_DATA_BUSY state
9978e5b0ebcb mmc: sdhci-of-ma35d1: add missing MODULE_DEVICE_TABLE()
7cc038a9c288 mmc: cqhci: fix to missed endian conversions
7228d04ae8cf mmc: moxart: report DMA completion timeout
aca5b61f01c4 gpio: sifive: add missing MODULE_DEVICE_TABLE()
f2cf823286f8 dt-bindings: arm: qcom,ids: Add SoC ID for Snapdragon SDM 850
2aa1e4219a1c RDMA/rxe: Check PDs for memory window binds
f6e8195ab2e0 soc: qcom: socinfo: Add SoC ID for SDM850
25c13a5b8151 RDMA/irdma: Suppress PF reset on HMC error
5a57301b3b2e iio: adc: max1241: add missing MODULE_DEVICE_TABLE()
323a97943fd3 block: reject block device inodes with i_rdev == 0 in lookup_bdev()
724be334c294 soc: amlogic: meson-clk-measure: remove debugfs tree
0d75eb5f52cf wifi: rtw89: wow: add QoS control field to WoWLAN ARP response for MLO
0bc19a2f4a26 wifi: rtlwifi: fix disabling of ASPM for RTL8723BE with AER flooding
a64fad3193fc wifi: rtw89: wow: only WiFi 6 chips initialize RF registers in WoWLAN mode
61b73a744e95 wifi: rtlwifi: rtl8723be: Remove unnecessary irq save/restore in hw_init()
b2f84c6f8e8a dmaengine: dw-axi-dmac: fix __le32 on set of CH_CTL_H_LLI_VALID
5b2dc86f8ad7 net: mvneta_bm: add suspend/resume support to prevent crash after resume
680154d070c4 dmaengine: pl330: remove debugfs file on teardown
329df0483984 soundwire: dmi-quirks: Disable ghost Realtek on Asus Expertbook
873f33349f3d netfilter: ebtables: bound num_counters like nentries in do_replace()
2e23f7167e4a net: usb: rtl8150: handle link status read failures
8e9b795a570b libbpf: Skip bpf_object__probe_loading() when BPF token is in use
3e96da490911 drm/panel-edp: Support MB116AS01'3 edp panel
f1be0815acc3 drm/amdkfd: add sanity check in svm_range_is_valid
35606292782d drm/amd/pm: Validate legacy hwmgr PP table offsets
d930abfdca53 drm/amd/pm: Validate Vega10 PPTable subtable bounds
269e57807b70 drm/amd/pm: Validate Tonga PPTable subtable bounds
f20fe19df5d9 drm/amd/pm: Guard VBIOS AC timing table walk
2fe60f66d6ab drm/amd/pm: Validate Tonga PowerPlay state array bounds
4487046481a5 drm/amdkfd: use node XCC count for v9 CRIU control stack restore
88b64ba96052 drm/amd/pm: Use uploaded size for legacy custom PPTable
bb556e5ff437 drm/amd/pm: Validate pp_table header before reading size
6bd63ff350e1 drm/amd/pm: Validate Vega hwmgr PowerPlay table bounds
cfb27089cf04 drm/amdgpu: add check for xcp id
cafbd6766267 drm/amdgpu: Guard reads in pcie state readout
884ffe359625 drm/amdgpu: Support some Barco AMD based graphics adapters
6441c5b430eb drm/amd/pm: validate vega10 profile mode inputs
9d34f2148207 drm/amdgpu: validate XCP topology counts before division
6d6b861cd078 drm/amdgpu: Validate ATIF buffer length before use
27eef4dcedf8 drm/amdgpu: Fix kobject cleanup in xcp sysfs
41e21fe60adf drm/amdgpu: Validate ATPX buffer length before use
66b095839f0b drm/amdgpu: Add checks to vbios fetch through ATRM
7fca266784f6 i2c: acpi: Force ELAN1300 touchpads to 100 kHz
6c65dfeb93ab netpoll: do not warn when the best-effort pool refill fails
f3433cfb30fd i2c: amd-asf: Validate firmware-reported length
e291a2ccc553 wifi: ath12k: avoid setting 320MHz support on non 6GHz band
1f80e8bbe7c2 memory: stm32_omm: initialize ret in stm32_omm_set_amcr
81673a22e1ee spi: bcmbca-hsspi: return error from failed controller suspend
8af06aa5e860 spi: nxp-fspi: disable runtime PM on probe failures
5a6dd98304fa spi: fsl-dspi: clean up after failed suspend and resume
9e93c02b6bf0 drm/panel-edp: Add BOE NE160QDM-NY1 panel
8c249f45dde8 spi: bcm63xx-hsspi: return error from failed controller suspend
5bbe145daa75 spi: bcm63xx: return error from failed controller suspend
b902b2bf21ed spi: bcm-qspi: return error from failed controller suspend
a78ed42facf1 fs/namespace: notify pollers of legacy propagation changes
00ad8fb259e9 perf/x86/intel/uncore: Fix PCI PMU cleanup on setup failure
2ff10d259445 fat: reject name longer than NAME_MAX in msdos_format_name()
0211c538cc7b perf/core: Fix kernel register info leak via hardware skid
d87eb804028e drm/sysfb: simpledrm: Validate mmap size against framebuffer size
fb4a3facba36 perf/x86/intel: Fallback to sw branch type decoding if no hw decoding
e85198f3f6b4 iio: accel: fxls8962af: clamp the device-reported FIFO sample count
ee5298ac5f2b ARM: OMAP2+: Add CFI type for omap4_finish_suspend
b220b2bb99b3 selftests/cgroup: Adjust cpu test duration based on HZ
62549edc5529 regmap: maple: Workaround for another false-positive compiler warning
709c3865ede5 ASoC: hdac_hdmi: Fix resource cleanup on probe failure
32b1dce444ac ASoC: tlv320aic26: remove keyclick sysfs file
2f5641f9740e clk: zynq: handle kasprintf() failure in periph_clk registration
69b25b97d439 spi: qpic-snand: free OOB buffer with ECC context
f6e11b1c35a6 ASoC: sma1303: remove fault-check sysfs group on remove
65f32bb18f5e irqdomain: Plug leak in irq_domain_alloc_irqs_locked() error path
41088f203293 ALSA: usb-audio: Release components on probe errors
54116b5fc4d0 media: cec: stm32: return an error when log-address wait times out
b97aa8f8ec98 ALSA: hda: Force resume if acomp notified during system suspend
8c804241ce99 ALSA: hda: Add support for Hygon family 18h model 5h HD-Audio
5073bafe7a8f w1: ds2482: add OF device match table
bd78ad6bfa95 HID: wacom: avoid copying Bluetooth input reports
c51a3ad1477c selftests/filesystems/overlayfs: fix set_layers_via_fds link error
220414ffec1b gpio: pca9570: Use I2C match data
e0f1d03b9a64 drm/amdgpu: add bounds check to prevent array overflow
9614f912f9ae drm/amdgpu: add buf length check
d09f84813b4a drm/radeon: avoid double free in r600 DPM cleanup
95437a990377 drm/amd/display: fix max dispclk_khz/dppclk_khz double 1000
7a8c7e9212c3 drm/amdgpu: Gate debugfs MMIO access on kernel lockdown
29000475b125 drm/amd/pm: Validate OD DPM triples before mutating tables
86229fb46575 drm/amdgpu/mes_v12_0: use mes schedule pipe for legacy queues on unified MES
0c42724fcbcd drm/panel-edp: Add BOE NV116WH2-M30, BOE NT116WHM-N21, BOE NV116FH1-M31, BOE NV116FH1-M30
350761e9892f drm/virtio: abort virtqueue wait on device removal to avoid hung task
d65d52d6370e drm/rockchip: dw_hdmi: Use resume_early pm ops for system suspend
862d9268f40a ALSA: line6: Clear prev_fbuf on capture buffer release
aff15e1f648e net: bonding: move bond_should_notify_peers, e.g. into rtnl lock block
024b63ae8c6a net: bonding: use workqueue to make sure peer notify updated in lacp mode
0160184fbf89 coredump: prevent TIF_NOTIFY_SIGNAL from interrupting coredumps
64f2a38a1658 fork: don't create io threads once PF_POSTCOREDUMP is set
c3b9c90f32c5 fork: move the coredump and exec checks into create_io_thread()
4e023a26c613 exec: cancel io_uring requests before de_thread()
e6223dfe62a2 hwmon: (lm90) Rely on subsystem locking
1a1ed9ba4386 kbuild: link-vmlinux.sh: improve detection of third pass requirement
220705d57438 platform: cznic: turris-omnia-mcu: Add missing MODULE_DEVICE_TABLE()
fb1e15ddd94c iio: hid-sensor: als: scale each channel individually
62be46110a2c mm: vmscan: fix dirty folios throttling on cgroup v1 for MGLRU
49675f7bc0e1 ksmbd: wait for negotiation before receiving another PDU
1c623e3cbf43 net: skbuff: propagate shared-frag marker in skb_zerocopy()