Changelog
in Linux kernel
6.18.53
9p:
invalidate readdir buffer on seek
9p:
use kvzalloc for readdir buffer
accel/amdxdna:
Remove __counted_by from struct amdxdna_cmd_chain
accel/ivpu:
Limit firmware log name prints to field size
accel/ivpu:
Validate firmware log buffer metadata
accel/ivpu:
Validate full buffer range in ivpu_to_cpu_addr
accel/qaic:
Address potential out-of-bounds read in resp_worker()
ACPI:
PCI: Clear _DEP dependencies after PCI root bridge attach
ACPI:
scan: Honor _DEP for ACPI0016 PCI/CXL host bridge
ACPICA:
add boundary checks in acpi_ps_get_next_field()
ACPICA:
add boundary checks in two places
ACPICA:
Add package limit checks in parser functions
ACPICA:
Add validation for node in acpi_ns_build_normalized_path()
ACPICA:
Enhance buffer validation in acpi_ut_walk_aml_resources()
ACPICA:
Enhance OEM ID and Table ID validation in acpi_ex_load_table_op()
ACPICA:
Fix condition check in acpi_ps_parse_loop()
ACPICA:
Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op)
ACPICA:
Fix NULL pointer dereference in acpi_ns_custom_package()
ACPICA:
Fix use-after-free in acpi_ds_terminate_control_method()
ACPICA:
Improve argument parsing in acpi_ps_get_next_simple_arg()
ACPICA:
Prevent adding invalid references
ACPICA:
validate byte_count in acpi_ps_get_next_package_length()
ACPICA:
validate handler object type in two places
af_packet:
Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header().
af_unix:
Return immediately when manage_oob() returns NULL for 0-length buffer.
af_unix:
Unlink scc_entry in unix_del_edge().
af_unix:
Update last skb marker in manage_oob().
affs:
handle set_blocksize failures
afs:
Clear stale peer app data after address list changes
afs:
Fix double-unmap of directory block
afs:
Fix incorrect free in candidate cleanup in afs_lookup_server()
afs:
Fix missing kunmap in afs_dir_search_bucket()
ALSA:
caiaq: Decoupling ep1_in_urb in caiaq dev
ALSA:
caiaq: Fix potential double-free at error path
ALSA:
ctxfi: Fix CA20K2 S/PDIF passthrough
ALSA:
dummy: Report a change when one capture switch channel moves
ALSA:
es18xx: check control allocation before private data setup
ALSA:
hda/ca0132: add QUIRK_GENERIC path for Gigabyte GA-Z170X-Gaming G1
ALSA:
hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10
ALSA:
hda/realtek - Add quirk for HP Victus 15-fa0xxx (MB 8A50)
ALSA:
hda/realtek: Add HDA_CODEC_QUIRK for Samsung 750XBE/730XBE
ALSA:
hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx
ALSA:
hda/realtek: Add mute LED quirk for HP Victus 16-e0xxx (MB 88ED)
ALSA:
hda/realtek: Add quirk for ASUS VivoBook X509DAP
ALSA:
hda/realtek: Add quirk for HP 255 15.6 inch G9 Notebook PC
ALSA:
hda/realtek: Add quirk for HP EliteBook 830 G8 (8AB8) to enable mute LEDs
ALSA:
hda/realtek: Add quirk for HP Pavilion x360
ALSA:
hda/realtek: Add quirk for HP Victus 16-e0xxx (88EE) to enable mute LED
ALSA:
hda/realtek: Add quirk for Lenovo Xiaoxin 14 GT
ALSA:
hda/realtek: Add quirk for Lenovo Yoga 7 16IAP7
ALSA:
hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IRH8
ALSA:
hda/realtek: ALC882: Fixup for Clevo P775TM1
ALSA:
hda/realtek: Fix speakers on MECHREVO WUJIE Series
ALSA:
hda: Add Lenovo Legion 7i 16IAX7 17AA3874 quirk
ALSA:
hda: cs35l41: imply SERIAL_MULTI_INSTANTIATE
ALSA:
hda: cs35l56: Fail if wmfw file is missing
ALSA:
hda: Report a change when only the channel status bytes move
ALSA:
hda: restore MFG widget enumeration after core split
ALSA:
ice1724: Fix blocking open for independent surround PCMs
ALSA:
pcm: Serialize PCM mmap with buffer reallocation to fix page UAF
ALSA:
seq: oss: Reject reads that cannot fit the next event
ALSA:
seq: Remove arbitrary prioq insertion limit
ALSA:
ump: do not touch legacy_rmidi before it exists
ALSA:
us122l: Prevent write upgrades for read mappings
ALSA:
usb-audio: Add dB map quirk for Razer Barracuda X 2.4
ALSA:
usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless
ALSA:
usb-audio: Add quirk flags for SC13A
ALSA:
usb-audio: Add quirk for Corsair Virtuoso (later revision)
ALSA:
usb-audio: Add quirk for Novation Mininova
ALSA:
usb-audio: Add quirk for YAMAHA CDS3000
ALSA:
usb-audio: caiaq: validate EP1 reply lengths
ALSA:
usb-audio: Propagate write errors in generic mixer put callbacks
ALSA:
usbusx2y: fix in04_last array size mismatch with in04_buf
ALSA:
usbusx2y: validate URB actual_length in interrupt callback
ALSA:
usx2y: Drain pending US-428 pipe-4 output commands
apparmor:
propagate -ENOMEM correctly in unpack_table
arm64/daifflags:
Make local_daif_*() helpers __always_inline
arm64:
fixmap: Allow 256K early_ioremap() at any offset
arm64:
kprobes: Allow reentering kprobes while single-stepping
arm64:
panic from init_IRQ if IRQ handler stacks cannot be allocated
arm64:
trans_pgd: clone only the linear map that exists at runtime
ARM:
9484/1: enable interrupts when unhandled user faults are triggered
ARM:
ensure interrupts are enabled in __do_user_fault()
ARM:
tegra: p880: Lower CPU thermal limit
ARM:
tegra: tf600t: Invert accelerometer calibration matrix
ASoC:
ab8500: Correct digital interface format setup
ASoC:
ab8500: Repair the DAPM capture graph
ASoC:
ab8500: Reset the audio block before configuring it
ASoC:
ab8500: Validate and program TDM slots correctly
ASoC:
amd: renoir: fix disable_pdm_interrupts() to clear mask bits
ASoC:
amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table
ASoC:
amd: yc: Add DMI quirk for HP Victus Laptop 16-e1xxx
ASoC:
amd: yc: Add DMI quirk for HyperX OMEN Gaming Laptop 16-ap1xxx
ASoC:
amd: yc: fix memory leak in acp6x_pdm_dma_close()
ASoC:
bcm: bcm63xx: Publish the OF module aliases
ASoC:
codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive
ASoC:
codecs: pcm3168a: Prevent regulator double-disable in S4
ASoC:
codecs: rk3328: Use managed GPIO and clock helpers
ASoC:
fsl-asoc-card: reduce WM8904 PLL ratio to meet frequency limit
ASoC:
fsl_micfil: balance mclk enable/disable
ASoC:
Intel: avs: Allow the topology to carry NHLT data
ASoC:
Intel: avs: Clean up the bus when fetching ML caps fails
ASoC:
Intel: avs: Do not ignore -ENOENT when loading a topology
ASoC:
Intel: avs: Fix unbalanced module reference count
ASoC:
Intel: avs: Honor NHLT override when setting up a path
ASoC:
Intel: avs: Refactor and fix init_config access
ASoC:
Intel: catpt: Complete coredump handling
ASoC:
Intel: sof_sdw: Add quirks for new Dell laptops
ASoC:
Intel: sof_sdw: append dai type to dai link name unconditionally
ASoC:
Intel: SST: Publish the PCI module aliases
ASoC:
mediatek: mt8365-afe-pcm: fix possible NULL-pointer dereferences in mt8365_afe_suspend()
ASoC:
meson: aiu: Validate written enum values
ASoC:
mt6351: Publish the OF module alias
ASoC:
qcom: q6apm: return error code to consumers on failures
ASoC:
rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt
ASoC:
rockchip: rockchip_pdm: Reorder clock enable sequence
ASoC:
rockchip: spdif: Restore regcache cache-only mode on sync failure
ASoC:
rt5645: Perform the initial jack detect at probe
ASoC:
rt712-sdca: reset codec at io_init to fix silent headphone
ASoC:
sprd: validate compress buffer sizes against fixed allocations
ASoC:
sti: initialize IRQ lock before requesting IRQ
ASoC:
tas2781: Update default register address to TAS2563
ASoC:
ti: omap3pandora: update board check to use DT compatible
ASoC:
topology: Check PCM and DAI name strings before use
ASoC:
ux500: Allow repeated MSP prepare calls
ASoC:
ux500: Correct MSP frame and bit clock setup
ASoC:
ux500: Deassert the MSP reset during probe
ASoC:
ux500: Fix MSP stream lifecycle handling
ASoC:
ux500: Program the MSP FIFO watermarks
ASoC:
ux500: Propagate MSP setup errors
ASoC:
ux500: Remove obsolete PRCMU QoS calls
ASoC:
ux500: Request the MSP MMIO resource
ASoC:
ux500: Validate MSP DAI configuration
ata:
ahci: fail probe if BAR too small for claimed ports
ata:
libata-core: Disable LPM on some WD drives
ata:
libata-core: Disable LPM on WD Green 2.5 480GB
ata:
libata-core: Disable LPM on WDC WD141KFGX-68FH9N0
ata:
libata-pmp: add JMicron JMS562 quirk
befs:
handle set_blocksize failures
bfs:
handle set_blocksize failures
bitfield:
wire __bf_shf to __builtin_ctzll
blk-cgroup:
fix leaks and online flag on radix_tree_insert failure
blk-cgroup:
protect iterating blkgs with blkcg->lock in blkcg_print_stat()
Bluetooth:
btintel: bound firmware ID by TLV length
Bluetooth:
btintel: validate version TLV value lengths
Bluetooth:
btintel_pcie: Add 50 ms delay before MAC init on BlazarIW
Bluetooth:
btintel_pcie: Clear automask on spurious interrupts
Bluetooth:
btintel_pcie: fix tx_handle bounds off-by-one
Bluetooth:
btintel_pcie: validate packet_len before skb_put_data
Bluetooth:
btmtk: Declare MT7920 (MT7961 1a) Bluetooth firmware
Bluetooth:
btmtk: Disable remote wakeup for MT7922/MT7925
Bluetooth:
btqcomsmd: destroy RPMsg endpoints before freeing hci_dev
Bluetooth:
btrtl: Add the support for RTL8761CUV
Bluetooth:
btrtl: Don't leak return code when parsing firmware format v2
Bluetooth:
btusb: Add Mercusys MA530 for Realtek RTL8761BUV
Bluetooth:
btusb: Add Realtek RTL8922AE VID/PID 0bda/d922
Bluetooth:
btusb: Add Realtek RTL8922AE VID/PID 0bda/d923
Bluetooth:
btusb: Add support for Intel Lizard Peak 2 (0x8087:0x0040)
Bluetooth:
btusb: Add support for TP-Link TL-UB250
Bluetooth:
btusb: Fix leaked runtime PM reference in btusb_reset
Bluetooth:
btusb: Fix UAF of btusb_data by rx_work
Bluetooth:
btusb: mediatek: Fix leaked runtime PM reference in reset
Bluetooth:
btusb: MT7922: Add VID/PID 0e8d/223c
Bluetooth:
btusb: MT7925: Add VID/PID 0e8d/8c38
Bluetooth:
hci_core: Fix race condition during device registration
Bluetooth:
hci_mrvl: Fix wrong return value check of wait_on_bit_timeout()
Bluetooth:
hci_sysfs: Fix NULL pointer dereference in device_del()
Bluetooth:
ISO: fix malformed ISO_END/CONT handling
Bluetooth:
L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM
Bluetooth:
L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan
Bluetooth:
L2CAP: fix out-of-bounds write in l2cap_ecred_connect
Bluetooth:
L2CAP: validate connectionless PSM length
Bluetooth:
RFCOMM: validate skb length in rfcomm_recv_frame
bnxt:
fix head underflow on XDP head-grow
bnxt_en:
Don't free the live ring's TPA state on queue restart failure
bnxt_en:
Handle buffer allocation failure in bnxt_rx_ring_reset()
bnxt_en:
Only restore LRO if the device supports TPA
bnxt_en:
Propagate RX ring init failures in bnxt_init_nic()
bnxt_en:
Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc()
bonding:
alb: fix uninitialized transport header access in alb_determine_nd()
bonding:
do not clear curr_active_slave prematurely when releasing all slaves
bonding:
use skb_cow_head() in bond_do_alb_xmit() and rlb_arp_xmit()
bootconfig:
Fix integer overflow in initrd size check
bpf:
Check ancestor frames for rbtree callbacks
bpf:
Don't predict JMP32 pointer vs zero comparisons
bpf:
Fix NULL-ptr-deref in btf_var_show()
bpf:
Fix NULL-ptr-deref when showing a void BTF type
bpf:
Fix REG INVARIANTS VIOLATION on speculative pointer arithmetic
bpf:
Guard __get_user acesss with access_ok for uprobe_multi data
bpf:
Mark bpf_btf_find_by_name_kind() as sleepable
bpf:
Mark faultable stack helpers as sleepable
bpf:
Mark sched_process_wait argument as nullable
bpf:
Mark signal tracepoint siginfo arguments as scalar
bpf:
Mask pseudo pointer values in verifier logs
bpf:
NUL-terminate replaced sysctl value
bpf:
Only enforce 8 frame call stack limit for all-static stacks
bpf:
Print breakdown of insns processed by subprogs
bpf:
reject BPF_PSEUDO_FUNC reference to the main program
bpf:
Reject legacy packet loads from callbacks
bpf:
Reject non-scalar bpf_loop iteration counts
bpf:
Reject redirect helpers without a bpf_net_context
bpf:
Reject resilient lock operations in rbtree callbacks
bpf:
Reject tail calls directly from callback frames
bpf:
Reject untrusted allocated-object pointers
bpf:
Report maximum combined stack depth
bpf:
Require MEM_PERCPU for percpu kptr stores
bpf:
share several utility functions as internal API
bpf:
Track verifier instruction stats for each subprogram
bpftool:
Pass host flags to bootstrap libbpf
bpftool:
Strip all -Wformat* flags from bootstrap libbpf build
bridge:
Add missing READ_ONCE() annotations around FDB destination port
bridge:
Do not suppress ARP probes and DAD NS unconditionally
btrfs:
balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk()
btrfs:
detach failed sprout device from transaction update list
btrfs:
do not force reloc root creation during qgroup_account_snapshot()
btrfs:
fix reloc root cleanup in merge_reloc_roots()
btrfs:
fix the possible bioc_list memory leak during error
btrfs:
fix transaction use-after-free in raid stripe insertion
btrfs:
fix use-after-free on reloc root after error in insert_dirty_subvol()
btrfs:
only account delalloc bytes for regular file inodes in btrfs_getattr()
btrfs:
protect sb_write_pointer() with invalidate lock
btrfs:
restore active device pointers after failed sprout
btrfs:
return proper negative error code for update_raid_extent_item()
btrfs:
scrub: report the failing sector's address, not the stripe base
btrfs:
send: fix lost error return value in will_overwrite_ref()
btrfs:
tree-checker: validate INODE_REF's namelen
btrfs:
tree-checker: validate names in ROOT_REF and ROOT_BACKREF
btrfs:
use lockless read in nr_cached_objects shrinker callback
btrfs:
use on-disk uuid for s_uuid in temp_fsid mounts
btrfs:
zoned: finish active block group cleanup if call_zone_finish() fails
btrfs:
zstd: fix lost wakeup when waiting for a workspace
bus:
fsl-mc: wait for the MC firmware to complete its boot
bus:
mhi: host: pci_generic: Round up nr_irqs to power of two
cachefiles:
Fix double fput
cachefiles:
Fix potential UAF/KASAN warning
char/nvram:
Remove redundant nvram_mutex
cifs:
Fix support for creating SFU fifo
cifs:
Fix support for creating SFU socket
cifs:
validate idmap key payload length
clk:
clk-axi-clkgen: Add support versal timings
clk:
keystone: don't cache clock rate
clk:
qcom: clk-rpmh: Make all VRMs optional
clk:
renesas: cpg-mssr: Add number of clock cells check
clk:
samsung: exynos850: mark APM I3C clocks as critical
clk:
samsung: exynos990: Fix PERIC0/1 USI clock types
clk:
socfpga: agilex: implement l3_main_free_clk
configfs:
pin the symlink target's dirent instead of chasing ->ci_dentry
configfs:
unhash the dentry before dropping the item in rmdir
configfs_depend_prep():
pass configfs_dirent instead of dentry
coresight:
Disable source helpers in coresight_disable_path()
coresight:
perf: Retrieve path and source from event data
coresight:
platform: defer connection counter increment until alloc succeeds
cpufreq:
initialize policy rwsem before sysfs publication
cpufreq:
zero-initialize policy cpumask before sysfs publication
crypto:
atmel-ecc - add support for atecc608b
crypto:
atmel-sha204a - remove sysfs group before hwrng
crypto:
ccp - Fix possible deadlock in SEV init failure path
crypto:
ecc - Unbreak the build on arm with CONFIG_KASAN_STACK=y
crypto:
ixp4xx - fix buffer chain unwind on allocation failure
crypto:
omap - add omap_des_unregister_algs helper
crypto:
x86/aria - add missing vzeroupper in AVX-512 code
crypto:
x86/aria - add missing vzeroupper in AVX2 code
cxl/region:
Validate partition index before array access
devlink:
Add port-level resource registration infrastructure
devlink:
Refactor resource functions to be generic
dibs:
change dibs_class to a const struct
dibs:
Remove reset of static vars in dibs_init()
dibs:
Unregister dibs_class after error
dlm:
add usercopy whitelist to dlm_cb cache
dm-raid:
only requeue bios when dm is suspending
dm/amdgpu:
fix malformed link_settings debugfs output
dmaengine:
altera-msgdma: Use memcpy_toio for descriptor FIFO writes
dmaengine:
dw-axi-dmac: fix PM for system sleep and channel alloc
Documentation/hwmon:
Document hwmon_notify_event()
Documentation:
hwmon: replace full-width colon by a standard ASCII colon
dpaa2-switch:
fix handling of NAPI on the remove path
dpaa2-switch:
fix the error path in dpaa2_switch_rx()
dpaa2-switch:
rework FDB management on the bridge leave path
driver core:
Avoid warning when removing a device while its supplier is unbinding
driver core:
Replace dev->can_match with dev_can_match()
drivers/of:
validate live-tree string properties before string use
drivers/of:
validate status properties in reconfig state changes
Drivers:
hv: vmbus: add VTL2 redirect connection ID
drm/adp:
Drop the select of the nonexistent CONFIG_DRM_KMS_DMA_HELPER
drm/amd/display:
Avoid DPMS-on for phantom stream
drm/amd/display:
Check for sharpening case when calculating max vtaps for scaler
drm/amd/display:
Find link encoder for flexible DIG mapping cases
drm/amd/display:
Fix CRC open failure during active rendering
drm/amd/display:
Fix DPMS using partially updated pipe context
drm/amd/display:
Honor Broadcast RGB for BT.2020 RGB output
drm/amd/display:
Initialize dsc_caps to 0
drm/amd/display:
Propagate HDMI RGB quantization selectability
drm/amd/display:
Rebuild InfoFrames on output color space changes
drm/amd/display:
Set gpuvm min page size to 4K on dcn35/36
drm/amd/pm/si:
Don't schedule thermal work when queue isn't initialized
drm/amd/pm/si:
Fix updating clock limits from power states
drm/amd/pm:
bound pp_dpm_set_pp_table() memcpy
drm/amd/pm:
Check SMUv13.0.6/12 metrics integrity
drm/amd/ras:
Fix CPER ring debugfs read overflow
drm/amd/ras:
reset CPER ring on corrupt entry size
drm/amdgpu/pm:
fix SmartShift bias sysfs store PM refcount on parse error
drm/amdgpu/ras:
add ras_suspend callback and use it for cp_ecc_error_irq
drm/amdgpu/userq:
fix struct drm_amdgpu_info_device padding for 32bit compile
drm/amdgpu/userq:
pin mqd and fw object bo to avoid eviction
drm/amdgpu:
add a helper to calculate ring distance
drm/amdgpu:
add first record offset check
drm/amdgpu:
avoid force-completing uninitialized UVD rings
drm/amdgpu:
avoid integer overflow in VA range check
drm/amdgpu:
Bound GPIO I2C table entry count from VBIOS
drm/amdgpu:
cap ATOM command table nesting depth
drm/amdgpu:
check and drop invalid bad page records
drm/amdgpu:
fix buffer overflow during vBIOS update
drm/amdgpu:
Fix missing unwind in amdgpu_ib_schedule() error path
drm/amdgpu:
flush pending RCU callbacks on module unload
drm/amdgpu:
harden FRU PIA parsing with bounded helpers
drm/amdgpu:
Make amdgpu_vm_flush() non-failing in submission path
drm/amdgpu:
plumb timedout fence through to force completion
drm/amdgpu:
Prefer ROM BAR for default VGA device
drm/amdgpu:
reorder IB schedule sequence
drm/amdgpu:
skip gfx switch_power_profile during GPU reset
drm/amdgpu:
use atomic operation to achieve lockless serialization
drm/amdgpu:
Use system unbound workqueue for soft IH ring
drm/amdgpu:
validate and share PSP fw_pri_buf copies via psp_copy_fw
drm/amdgpu:
validate RAS EEPROM tbl_size before record count
drm/amdkfd:
Check bounds for allocate_sdma_queue restore_sdma_id
drm/amdkfd:
Check bounds on allocate_doorbell
drm/amdkfd:
check find_first_zero_bit before __set_bit on kfd->doorbell_bitmap
drm/amdkfd:
Fix OOB memory exposure in get_wave_state()
drm/amdkfd:
fix SMI event cross-process information leak
drm/amdkfd:
fix UAF race in destroy_queue_cpsch
drm/amdkfd:
Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl
drm/amdkfd:
Properly acquire queue buffers in CRIU restore
drm/amdkfd:
Unwind debug trap enable on copy_to_user failure
drm/arm/komeda:
fix error handling for clk_prepare_enable() and callers
drm/arm/malidp:
use clk_bulk API in runtime PM resume and suspend
drm/bridge:
tc358768: Enforce input bus flags via atomic_check
drm/bridge:
tc358768: Set pre_enable_prev_first for reverse order
drm/bridge:
ti-sn65dsi83: Fix error handling in sn65dsi83_reset_work()
drm/cirrus-qemu:
Validate BAR0 size during probe
drm/dp:
Add DSC virtual DPCD quirk for Realtek MST branch device
drm/drm_exec:
fix up contended obj when num_objects is 0
drm/gem:
Consider GEM object reclaimable if shrinking fails
drm/gma500:
return errors from Oaktrail HDMI I2C reads
drm/gud:
Add RCade Display Adapter VID/PID pair
drm/gud:
validate GUD_ROTATION_0 is present in supported rotations
drm/i915:
Fix memory leak in query_perf_config_list()
drm/imagination:
Don't timeout job if its fence has been signaled
drm/imagination:
Populate FW common context ID before passing to the FW
drm/logicvc:
Drop the select of the nonexistent CONFIG_DRM_KMS_DMA_HELPER
drm/mediatek:
dsi: Add compatible for mt8167-dsi
drm/nouveau/bios:
skip the IFR header if present
drm/nouveau/gsp:
add SEC2 to GA100 chip table
drm/pagemap:
dma-unmap pages before handling migration errors
drm/panel-edp:
Add AUO B133HAN06.6 and BOE NV133FHM-N4F V8.0
drm/panel-edp:
Add AUO B140XTN07.5, AUO B140HAK03.5, AUO B116XTN02.3, AUO B140XTK02.4, AUO B140HAN07.7
drm/panel-edp:
Add BOE NT140WHM-N4T, BOE NT140WHM-T05, BOE NV140FHM-N40
drm/panel-edp:
Add CSW PNB601LS1-2 and LGD LP116WHA-SPB1
drm/panel-edp:
Add LG LP129WT232166 panel
drm/panel/tdo-tl070wsh30:
Use refcounted allocation in place of devm_kzalloc()
drm/panel:
Enable GPIOLIB for panels which uses functions from it
drm/panel:
jadard-jd9365da-h3: set prepare_prev_first
drm/panel:
simple: Add AM-1280800W8TZQW-T00H
drm/panic:
clean new `clippy::needless_range_loop` lint for Rust 1.100.0
drm/rockchip:
analogix_dp: fix unchecked bound endpoint name length
drm/rockchip:
dw_dp: Select DRM_BRIDGE_CONNECTOR
drm/rockchip:
rk3066_hdmi: Add missing Kconfig selects
drm/sched:
Create a fake device for KUnit tests
drm/ttm:
Drop tt->restore after successful restore
drm/ttm:
Fix bo resource use-after-free
drm/ttm:
Tidy usage of local variables a little bit
drm/vc4:
hvs/v3d: Fix null dereference in unbind
drm/virtio:
Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create()
drm/virtio:
use the DMA API for resource backing on Xen
drm/xe/guc:
Add support for NO_RESPONSE_BUSY in CTB
drm/xe/i2c:
Keep the i2c controller always enabled
drm/xe/oa:
Remove sysfs entry on idr_alloc failure in xe_oa_add_config_ioctl()
drm/xe:
Fix null pointer dereference in devcoredump cleanup
drm/xe:
Flush LSC untyped L1 dataport cache after rcs/ccs batches
drm:
renesas: rzg2l_mipi_dsi: Fix deassert/assert of CMN_RSTB signal
drm:
rz-du: Ensure correct suspend/resume ordering with VSP
drop_monitor:
fix size calculations for 64-bit attributes
drop_monitor:
perform u64_stats updates under IRQ-disabled section
e1000e:
limit endianness conversion to boundary words
EDAC/altera:
Use ECC manager compatible to select A10/S10 IRQ layout
EDAC/altera:
Use parent device for devres in altr_portb_setup()
EDAC/device_sysfs:
Use kstrtouint() for poll_msec to prevent truncation
EDAC/igen6:
Fix channel address decode for non-hash mode
EDAC/igen6:
Fix channel selection hash
EDAC/igen6:
Fix interleave boundary condition
erofs:
add missing buf->off in erofs_bread()
erofs:
add sysfs feature entry for xattr prefixes
erofs:
disable LZ4 rolling decompression for now
erofs:
preserve LZMA decoders on resize failure
erofs:
separate plain and compressed filesystems formally
eth:
ice: don't dereference pointers from TP_printk()
eth:
mlx5: fix macsec dependency
eth:
nfp: bound the ntuple rule dump by the caller's buffer size
eth:
nfp: drop the replaced rule from the list when reprogramming fails
exec:
do_close_on_exec() before taking exec_update_lock
exfat:
fix handling of damaged volume in exfat_create_upcase_table()
exit:
hold a reference to thread_pid across proc_flush_pid
f2fs:
accurately adjust free_sections during free_segment_range
f2fs:
embed f2fs_gc_kthread in f2fs_sb_info
f2fs:
fix to reclaim space in f2fs_allocate_pinning_section()
f2fs:
limit recovery filename logging to stored length
f2fs:
reject setattr size changes on large folio files
f2fs:
validate inline dentry name lengths before conversion
f2fs:
validate MOVE_RANGE destination size
fbcon:
don't suspend/resume when vc is graphics mode
fbdev:
pm2fb: unwind WC setup on probe failure
fbdev:
vfb: defer cleanup until the last reference
firmware:
arm_scmi: Validate BASE_ERROR_EVENT payload size
firmware:
arm_scmi: Validate SENSOR_UPDATE payload size
firmware:
stratix10-svc: change get provision data to async SMC call
firmware:
stratix10-svc: fix FCS SMC call kernel-doc
fou:
Fix use-after-free in fou_create()
freevxfs:
don't BUG() on unknown typed-extent type
fs/ntfs3:
preserve non-DOS attribute bits in system.dos_attrib
fs/ntfs3:
validate index entry key bounds
fs:
autofs: fix memory leak in autofs_fill_super()
fs:
don't return -EINVAL for successful nested thaw
function_graph:
Use the saved entry's size when reprinting it
fuse:
set ff->flock only on success
fwctl/bnxt_en:
Move common definitions to include/linux/bnxt/
genetlink:
pin family module during policy dump
genirq/manage:
Make NMI cleanup RT safe
genirq/proc:
Size interrupt directory names for 10-digit interrupt numbers
gfs2:
fix quota init duplicate scan
gfs2:
move quota_init qc iterator increment
gfs2:
page poisoning fix
gpib:
Suppress setting END on error from NI_USB dongle
gpio:
dwapb: Mask interrupts at hardware initialization
gpio:
pisosr: Read "ngpios" as u32
gpio:
usbio: Add ACPI device-id for NVL platforms
hfs:
rework hfsplus_readdir() logic
hfsplus:
fix issue of direct writes beyond end-of-file
hfsplus:
rework hfsplus_readdir() logic
HID:
bpf: Add Huion Inspiroy Frego M button quirk
HID:
hidpp: fix potential UAF in hidpp_connect_event()
HID:
multitouch: Fix Yoga Book 9 14IAH10 touchscreen misclassification
HID:
multitouch: Honor ContactCount for Yoga Book 9 to suppress ghost contacts
host1x:
bus: Fix missing ops null check in error teardown
hpfs:
handle set_blocksize failures
hsr:
broadcast netlink notifications in the device's net namespace
hwmon:
(adt7462) Add of_match_table to support devicetree
hwmon:
(applesmc) fix key backlight workqueue leak on register failure
hwmon:
(aspeed-pwm-tacho) Propagate reset deassert errors
hwmon:
(chipcap2) fix channels in humidity alarm notifications
hwmon:
(corsair-cpro) Create debugfs entries after hwmon registration
hwmon:
(corsair-cpro) Remove debugfs entries when probe fails
hwmon:
(corsair-psu) Fix linear11 calculation
hwmon:
(dell-smm) Add Dell Latitude 7530 to fan control whitelist
hwmon:
(gpio-fan) Fix use-after-free in alarm work
hwmon:
(gpio-fan) take fan_data->lock in gpio_fan_shutdown()
hwmon:
(ina2xx) Acquire hwmon_lock in shunt_resistor_show()
hwmon:
(ina2xx) Decouple in0 and curr1 alarms
hwmon:
(ina2xx) Parameterize ina2xx_data in ina226_alert_read()
hwmon:
(ina2xx) Rely on subsystem locking
hwmon:
(ina2xx) Replace masks with enum in alert functions
hwmon:
(ltc4282) Make sure clk_init_data is fully initialized
hwmon:
(nct6694) do not expose enable on DTIN temperature channels
hwmon:
(pmbus) Clear generic status alarms with CLEAR_FAULTS
hwmon:
(pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i
hwmon:
(raspberrypi) Fix delayed-work teardown race
hwmon:
(sht4x) Add missing locks
hwmon:
(sht4x) Fix return value from heater_enable_store()
hwmon:
(sht4x) Rely on subsystem locking
hwmon:
Fix potential UAF in pec_store
i2c:
designware: Global register definitions
i2c:
smbus: reject oversized block transfers in the common path
i3c:
master: svc: Prevent IRQ storm from false SLVSTART on NPCM845
i3c:
mipi-i3c-hci: Tolerate i3c_master_add_i3c_dev_locked() failures in DAA
ice:
add missing xa_destroy for sched_node_ids
ice:
pass the return value of skb_checksum_help()
idpf:
account for VLAN header when parsing RSC packet header
idpf:
disable DIM work before freeing q_vectors
idpf:
Fix kernel-doc descriptions to avoid warnings
idpf:
introduce idpf_q_vec_rsrc struct and move vector resources to it
idpf:
introduce local idpf structure to store virtchnl queue chunks
ieee802154:
6lowpan: fix NULL dereference in lowpan_newlink
ieee802154:
cc2520: fix FIFOP work use-after-free
ieee802154:
hwsim: serialize pib updates to fix double-free
igmp:
convert struct ip_sf_list to RCU
iio:
accel: mma8452: switch to non-devm request_threaded_irq()
iio:
adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind
iio:
adc: rtq6056: add i2c_device_id support
iio:
light: stk3310: Deal with the ps interrupt issue in PM
ima:
return error early if file xattr cannot be changed
inet:
frags: invalidate queues before flushing them
init/main:
read bootconfig header with get_unaligned_le32()
integrity:
Check for NULL returned by asymmetric_key_public_key
io_uring/net:
don't overconsume buffers when using MSG_TRUNC
io_uring/net:
let io_recv_buf_select return the length of the buffer region
io_uring/rw:
end write accounting from ->ki_complete
iomap:
don't make REQ_POLLED imply REQ_NOWAIT
iommu/amd:
Add NUMA node affinity for IOMMU log buffers
iommu/amd:
Do not reallocate GA log buffers on resume
iommu/amd:
Fix premature break in init_iommu_one() again
iommu/arm-smmu-v3:
Disable implementations during devm teardown
iommu/riscv:
Add command queue lock
iommu/riscv:
Disable SADE
iommu/rockchip:
disable fetch dte time limit
iommu/s390:
Fix NULL dereference in iova_to_phys() with ZPCI_TABLE_TYPE_RFX
iommu:
arm-smmu-qcom: Ensure smmu is powered up in set_ttbr0_cfg
ionic:
use netif_txq_maybe_stop() in ionic_tx()
ip6_gre:
check tunnel info before xmit in ip6gre_tunnel_xmit
ipmi:
si: Use platform_get_irq_optional() to retrieve interrupt
ipmr:
account multicast table and route memory
ipv4:
fib: bound automatic table ID allocation
ipv4:
fib: Don't dump dying fib_info in fib_leaf_notify().
ipv6:
addrconf: fix temp address generation after prefix deprecation
ipv6:
fix fib6 walker UAF on seq stop
ipv6:
flowlabel: cap duplicate leases per socket
ipv6:
mcast: fix RCU list diversion in ip6_mc_del1_src()
ipv6:
mcast: use copy-on-write RCU updates in ip6_mc_source()
ipv6:
null-check fib6_node before accessing in __ip6_del_rt_siblings()
ipv6:
sr: restore network header before routing and forwarding
ipv6:
use READ_ONCE() for bindv6only default in inet6_create()
ipvs:
fix reversed sequence option serialization
ipvs:
reject invalid states in connection template sync records
irqchip/gic-v4:
Don't advertise VLPIs if no ITS is probed
irqchip/gic-v5:
Immediately exec priority drop following activate
irqchip/gic-v5:
Preserve ICC_CR0_EL1 state
isofs:
handle set_blocksize failures
jfs:
handle set_blocksize failures
kcsan:
Silence -Wmaybe-uninitialized when calling __kcsan_check_access()
ksmbd:
align SMB2 oplock break ack handling
ksmbd:
apply create security descriptor first
ksmbd:
break RH leases before delete-on-close
ksmbd:
deny renaming directory with open children
ksmbd:
don't hold ci->m_lock while waiting for a lease break ack
ksmbd:
find bound sessions during reauthentication
ksmbd:
Fix acl.sd_buf memory leak and invalid sd_size error handling
ksmbd:
fix credit charge calculation for SMB2 QUERY_INFO
ksmbd:
fix lease break and ack state handling
ksmbd:
fix n.data memory leak in ksmbd_vfs_set_dos_attrib_xattr
ksmbd:
fix sd_ndr.data memory leak in ksmbd_vfs_set_sd_xattr
ksmbd:
mark invalid session responses as signed
ksmbd:
preserve VFS inherited POSIX ACL mask
ksmbd:
prevent out-of-bounds reads in share config responses
ksmbd:
propagate DACL parsing errors
ksmbd:
rate limit unmapped SID errors
ksmbd:
remove stale channels from all sessions on teardown
ksmbd:
start file id allocation at 1
ksmbd:
treat read-control opens as stat opens only for leases
ksmbd:
treat unnamed DATA stream as base file
ksmbd:
use connection ClientGUID for lease lookup
ksmbd:
use memcmp() to compare ClientGUIDs
ksmbd:
validate SID namespace before mapping IDs
ksmbd:
validate SMB2 lease create contexts
KVM:
PPC: Book3S HV: Set irqfd->producer only on success
l2tp:
fix tunnel and session refcount leak on seq_file release
landlock:
Add access_mask_subset() helper
landlock:
Clarify documentation for the IOCTL access right
landlock:
Fix use-after-free of the source's parent directory
landlock:
Transpose the layer masks data structure
landlock:
Use mem_is_zero() in is_layer_masks_allowed()
leds:
pca9532: Don't stop blinking for non-zero brightness
leds:
st1202: Validate pattern input before stopping the sequence
leds:
trigger: gpio: Use GPIOD_FLAGS_BIT_NONEXCLUSIVE
leds:
uleds: Return -EFAULT on copy_to_user() failure
libbpf:
Add __NR_bpf definition for LoongArch
libbpf:
Also reset {insn,data}_cur on realloc failure
Linux:
Linux 6.18.53
locking/lockdep:
Invalidate stale class_cache entries for zapped classes
mac802154:
fix use-after-free of sdata via queued RX frames
mailbox:
imx: Add a channel shutdown field
mailbox:
imx: use devm_of_platform_populate()
mailbox:
imx: Use devm_pm_runtime_enable()
mailbox:
Make mbox_send_message() return error code when tx fails
md/raid10:
fix writes_pending and barrier reference leaks on discard failures
md/raid5:
account discard IO
md/raid5:
let stripe batch bm_seq comparison wrap-safe
media:
as102: do not rely on id table address comparison
media:
chips-media: wave5: Add range checks for dec_output_info
media:
chips-media: wave5: Add timeout while stop_streaming
media:
chips-media: wave5: Fix Reports from Kernel Lock Validator
media:
chips-media: wave5: Release m2m_ctx after Instance Removed from List
media:
dm1105: fix missing error check for dma_alloc_coherent
media:
em28xx-video: fix missing res_free() on init_usb_xfer failure
media:
hevc: add bounded tile-count helpers
media:
imon: Add iMON VFD HID OEM v1.2 key mappings
media:
iris: turn platform data into constants
media:
mediatek: vcodec: bound AV1 tile-start copy to the array capacity
media:
platform: cros-ec: Add Kulnex and Moxoe to the match table
media:
qcom: camss: avoid format string warning
media:
qcom: camss: vfe-340: Proper client handling
media:
qcom: iris: fix runtime PM reference leaks
media:
rc: mceusb: Add support for 04eb:e033
media:
remove conditional return with no effect
media:
v4l2-common: Always register clock with device-specific name
media:
v4l2-ctrls: validate AV1 tile counts
media:
v4l2-ctrls: validate HEVC tile counts
media:
v4l2-h264: Fix memcmp() size in B1 reference list comparison
media:
verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity
media:
verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer
media:
verisilicon: rockchip: reject AV1 frames exceeding the tile capacity
media:
video-i2c: use vb2_video_unregister_device on driver removal
mfd:
db8500-prcmu: Fold dbx500 header into db8500
mfd:
rsmu: Add 8a34002 support
mfd:
tps65219: Make poweroff handler conditional on system-power-controller
minix:
handle set_blocksize failures
mips:
cps: Assemble jr.hb with an R2 ISA level
misc:
amd-sbi: Add null check for devm_kasprintf()
mlxsw:
spectrum_ptp: Fix napi_gro_receive() call from GC workqueue context
mm/damon/core:
avoid infinite kdamond_merge_regions() internal loop
mmc:
core: Add validation for host-provided max_segs
mmc:
davinci: avoid NULL deref of host->data in IRQ handler
mmc:
davinci: fix mmc_add_host order in probe
mmc:
renesas_sdhi: Add OF entry for RZ/G2E SoC
mmc:
renesas_sdhi: Add OF entry for RZ/G2N SoC
mptcp:
avoid unneeded actions on subflow reset
mptcp:
close race between scheduler and state change
mptcp:
do not reschedule the RTX timer for fallback sockets
mptcp:
fix bad accounting in __mptcp_subflow_push_pending()
mptcp:
move the stale logic out of retrans scheduler
mptcp:
options: handle MPC data + csum reqd + no csum
mptcp:
pm: kernel: drop pending ADD_ADDR when removing ID0
mptcp:
pm: reset retrans_time when ADD_ADDR entry is reused
mptcp:
pm: userspace: fix address ID overflow
mptcp:
prevent race between disconnect() and rtx
mptcp:
remove unneeded READ_ONCE() annotation
mptcp:
subflow: no need to copy thmac during ulp_clone
mptcp:
syncookies: remember the request backup flag
net/micrel:
Fix typos in micrel driver code comments
net/mlx5:
E-Switch, align disable sequence with switchdev-to-legacy transition
net/mlx5:
E-Switch, prevent mc_list repopulation during vport disable
net/mlx5:
E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put
net/mlx5:
HWS, Check if device is down while polling for completion
net/mlx5:
HWS, Handle destroying table that has a miss table
net/mlx5:
LAG, use local tracker to update active ports
net/mlx5:
Register SF resource on PF port representor
net/mlx5:
Relax capability check for eswitch query paths
net/mlx5:
Switch vport HCA cap helpers to kvzalloc
net/mlx5e:
Fix ETS zero BW reporting when one TC holds 100%
net/mlx5e:
Fix missing FEC mode mapping for RS_544_514_INTERLEAVED_QUAD
net/mlx5e:
Fix setting RS FEC after remapping
net/mlx5e:
Fix use-after-free race in sample_restore_put()
net/mlx5e:
Keep HW timestamp stats monotonic across reconfiguration
net/mlx5e:
Move representor vnic reporter to eswitch devlink port
net/mlx5e:
Verify unique vhca_id count instead of range
net/rds:
acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()
net/rds:
acquire the fastpath locks in rds_conn_shutdown()
net/rds:
clear cp_flags bits individually in rds_conn_path_reset()
net/rds:
don't let rds_conn_shutdown() consume a concurrent drop
net/rds:
Don't sleep inside rds_ib_conn_path_shutdown
net/rds:
fix tcp stream corruption with large pages
net/rds:
tcp: don't force RDS_CONN_RESETTING over a concurrent shutdown
net/rds:
use clear_bit_unlock() in release_refill()
net/rds:
use wq_has_sleeper() in release_in_xmit()
net/sched:
act_api: budget all shared attributes in notify skbs
net/sched:
act_api: fix skb sizing and action leak on reoffload delete
net/sched:
act_api: release all action references on NEWACTION failure
net/sched:
act_api: size the RTM_GETACTION reply from the actions
net/sched:
act_csum: don't mangle UDP tunnel GSO packets
net/sched:
cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain().
net/sched:
cls_route: Fix in-place replace
net/sched:
cls_route: free emptied bucket on filter move
net/sched:
cls_route: Reject handle aliasing
net/sched:
cls_u32: fix duplicate handle when node ID pool is exhausted
net/sched:
defer qdisc freeing after failed creation
net/sched:
drr: clamp quantum in change class
net/sched:
dualpi2: clamp psched_mtu at all call sites
net/sched:
ets: clamp quantum in parse and fallback paths
net/sched:
fq_pie: clamp quantum in change path
net/sched:
hhf: clamp quantum in change and init paths
net/sched:
pie: clamp psched_mtu in pie_drop_early
net/sched:
sch_drr: make cl->quantum lockless
net/sched:
sfq: clamp quantum in change path
net:
airoha: enable RX_DONE interrupt for RX queue 31
net:
airoha: Reserve RX headroom to avoid skb reallocation
net:
amd-xgbe: discard rx packets with bad FCS
net:
appletalk: fix NULL pointer dereference in aarp_send_ddp()
net:
au1000: move free_irq out of the close-time spinlocked section
net:
bcmasp: clear txcb->last before writing each descriptor
net:
bcmasp: fix tx_spb_ring_full() checking same slot cnt times
net:
bridge: mcast: properly convert mglist to rcu
net:
bridge: remove stale rcu_barrier() in br_multicast_dev_del()
net:
bridge: use option bits for CFM/MRP frame handlers
net:
cap tx_queue_len at S16_MAX to prevent oversized ring allocations
net:
cpsw_new: unregister devlink on port registration failure
net:
drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD
net:
dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size
net:
dsa: lantiq_gswip: fix GSWIP_MDIO_PHY_FCONTX_EN value
net:
dsa: mt7530: add EN7528 support
net:
dsa: mt7530: populate lpi_interfaces to fix EEE support
net:
dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size
net:
dsa: mv88e6xxx: define .pot_clear() for 6321
net:
dsa: mv88e6xxx: enable .rmu_disable() for 6320 family
net:
dsa: mv88e6xxx: fix number of g1 interrupts for 6320 family
net:
dsa: qca8k: Add support for force mode for fixed link topology
net:
dsa: realtek: rtl8365mb: add support for RTL8367SB
net:
dsa: sja1105: flower: reject cross-chip redirect
net:
dsa: tag_brcm: legacy FCS: request needed tailroom
net:
ethernet: cortina: Count dropped frames as NAPI work
net:
ethernet: cortina: Count RX descriptors for freeq refill
net:
ethernet: cortina: Count RX drops once per frame
net:
ethernet: cortina: Finish RX updates before NAPI completion
net:
ethernet: cortina: Fix budget accounting
net:
ethernet: cortina: No mapping is a dropped rx
net:
ethernet: mtk_eth_soc: avoid writing to ESW registers on MT7628
net:
ethernet: mtk_eth_soc: fix supported_interface set after phylink_create
net:
ethernet: mtk_eth_soc: populate lpi_interfaces to fix EEE support
net:
ethernet: oa_tc6: Add the OA_TC6_ prefix to standard registers
net:
ethernet: oa_tc6: Disable tx queues on fatal error
net:
ethernet: oa_tc6: Export standard defined registers
net:
ethernet: oa_tc6: Fix for the wrong data type
net:
ethernet: oa_tc6: Handle the OA TC6 SPI protected mode
net:
ethernet: oa_tc6: Improve the error recovery
net:
ethernet: oa_tc6: Interrupt is active low, level triggered.
net:
ethernet: oa_tc6: Protect skb pointer used by two different kernel instances
net:
ethtool: cmis_cdb: hold instance lock for ops locked devices
net:
gro: Fix nesting of TCP GSO SKBs in skb_gro_receive_list()
net:
hinic: fix mailbox segment buffer overflow
net:
hns3: improve the unused_tuple parameter setting
net:
hso: fix TIOCMIWAIT race
net:
hsr: enable promiscuous mode on interlink port with fwd offload
net:
hsr: require valid EOT supervision TLV
net:
ibm: emac: fix unchecked platform_get_irq return value
net:
ibm: emac: mal: fix potential system hang in mal_remove()
net:
ibm: emac: Reserve VLAN header in MJS limit
net:
icmp: avoid invalid transport header access in icmp_send tracepoint
net:
iptunnel: fix stale transport header during tunnel decapsulation
net:
ipv4: Fix UDP length overflow with PMTU discover and big MTU
net:
ipv6: Clamp to IP6_MAX_MTU in ip6_dst_mtu_maybe_forward
net:
ipv6: Fix UDP length overflow with PMTU discover and big MTU
net:
ks8851: Fix receiver error in 100BASE-TX mode following software power-down
net:
lan966x: restore RX state on reload failure
net:
macb: destroy the phylink instance on the probe error path
net:
macb: fix NULL pointer dereference on unbind with fixed-link
net:
macb: initialize PTP state before registering clock
net:
macb: put the "mdio" child node reference on success
net:
macb: rename bp->sgmii_phy field to bp->phy
net:
macb: Replace open-coded implementation with napi_schedule()
net:
macb: unify device pointer naming convention
net:
macb: Use netif_napi_add_tx() instead of netif_napi_add() for TX NAPI
net:
mana: Clear RDMA teardown and suspend state in mana_rdma_probe()
net:
mana: hardening: Reject zero max_num_queues from MANA_QUERY_VPORT_CONFIG
net:
mana: Reserve extra CQ slot for the fence completion CQE
net:
mana: restore the XDP program pointer when pre-allocation fails
net:
mctp: i3c: serialize probe with bus removal
net:
microchip: sparx5: clean up PSFP resources on flower setup failure
net:
mpls: clear inner_protocol when the last label is popped
net:
napi: Skip last poll when arming gro timer in busy poll
net:
net_failover: Fix the deadlock in net_failover_slave_name_change()
net:
openvswitch: fix use-after-free of the flow table mask array
net:
phy: dp83867: handle the active-high LED polarity mode
net:
phy: dp83td510: handle the active-high LED polarity mode
net:
phy: mediatek-ge: disable EEE on the MT7530 PHY
net:
phy: motorcomm: use device properties for firmware tuning
net:
qrtr: fix node refcount leak on ctrl packet alloc failure
net:
reject oversized tx_queue_len at netlink parse time
net:
Remove conflicting altnames for dying netns in __dev_change_net_namespace().
net:
sfp: add quirk for OEM 2.5G optical modules
net:
stmmac: add stmmac_tso_header_size()
net:
stmmac: add TSO check for header length
net:
stmmac: fix TSO support when some channels have TBS available
net:
stmmac: fix TX descriptor availability check for TSO traffic
net:
stmmac: initialize ptp_lock at probe time
net:
stmmac: reconfigure RX packet parser table in stmmac_hw_setup() after reset
net:
stmmac: xgmac2: disable RBUE in default RX interrupt mask
net:
sun4i-emac: fix missing of_node_put() for phy_node
net:
thunderx: fix PTP device ref leak in nicvf_probe()
net:
txgbe: fix phylink leak on AML init failure
net:
usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow
net:
usb: pegasus: don't rely on id table pointer arithmetic
net:
usb: qmi_wwan: add MeiG SRM813Q
net:
wwan: t7xx: Add delay between MD and SAP suspend
netconsole:
take target_cleanup_list_lock in drop_netconsole_target()
netfilter:
cttimeout: detach dataplane timeout policy and repurpose refcount
netfilter:
cttimeout: prevent UAF during module unload
netfilter:
ip6_tables: set F_PROTO when proto value is nonzero
netfilter:
ipset: mark the rcu locked areas properly
netfilter:
nf_conntrack: use get_unaligned_be32() in tcp_sack()
netfilter:
nf_conntrack_expect: zero at allocation time
netfilter:
nf_conntrack_sip: fix OOB read in sip_skip_whitespace()
netfilter:
nf_log: unregister loggers before per-net teardown
netfilter:
nfnetlink_log: cope with concurrent instance destruction
netfilter:
nfnetlink_log: wait for rcu grace period before freeing pernet state
netfilter:
report NLM_F_DUMP_FILTERED when all is filtered out
netfs:
break unbuffered write when netfs_alloc_subrequest() fails
netfs:
Fix barriering when walking subrequest list
netfs:
Fix decision whether to disallow write-streaming due to fscache use
netfs:
Fix error vs transferred passed to ->ki_complete()
netfs:
Fix i_size update for partial transfer
netfs:
Fix subreq ref leak
netfs:
Fix unbuffered/DIO write partial transfer error return
netfs:
Fix uninitialized return value in netfs_unbuffered_write()
netlabel:
fix IPv6 unlabeled address add error handling
nexthop:
Initialize extack in remove_nh_grp_entry()
NFS:
fix eof updates after NFSv4.2 fallocate/zero-range
ns:
add __ns_ref_read()
ns:
rename to exit_nsproxy_namespaces()
ntfs3:
fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e()
ntfs3:
handle set_blocksize failures
nvme-core:
align fabrics_q teardown with admin_q in nvme_free_ctrl
nvme-fc:
Do not cancel requests in io target before it is initialized
nvme-rdma:
fix -EIO cleanup order in queue_rq
nvme-tcp:
defer TLS inline send to io_work
nvme:
refresh multipath head zoned limits from path limits
nvme:
remove stale namespaces by NSID range during scan
nvme:
validate FDP configuration descriptor sizes
nvmet-rdma:
fix queue leak when connect backlog is exceeded
octeontx2-af:
Fix limiting SRIOV VF count logic
octeontx2-af:
fix PF/CGX debugfs PCI bus lookup
octeontx2-af:
mcs: Clear stale X2P calibration state before calibration
octeontx2-pf:
reset HTB scheduler topology before freeing queues
omfs:
handle set_blocksize failures
openvswitch:
fix wrong flag value in get_ipv6_ext_hdrs()
OPP:
of: Fix potential multiplication overflow when calculating freq
PCI/proc:
Fix race between pci_proc_init() and pci_bus_add_device()
PCI/sysfs:
Add CAP_SYS_ADMIN check to __resource_resize_store()
PCI/sysfs:
Use kstrtobool() to parse the ROM attribute input
PCI:
altera: Protect root bus removal with rescan lock
PCI:
Avoid FLR for MediaTek MT7925 WiFi
PCI:
Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems
PCI:
intel-gw: Enable clock before PHY init
PCI:
iproc: Protect root bus removal with rescan lock
PCI:
mediatek: Protect root bus removal with rescan lock
PCI:
plda: Protect root bus removal with rescan lock
PCI:
rockchip: Protect root bus removal with rescan lock
PCI:
Stop setting cached power state to 'unknown' on unbind
PCI:
switchtec: Add Gen6 Device IDs
PCI:
Wait for device readiness after D3hot -> D0uninitialized transition
pds_core:
don't release PCI regions for VFs on reset
pds_core:
fix cmd_regs access racing BAR unmap on reset
pds_core:
quiesce DMA before freeing resources
perf powerpc-vpadtl:
Fix raw_size of DTL samples
perf symbol:
Do not use debug file as the binary type
perf/core:
Allow list_del during perf_event_overflow()
perf/core:
Skip empty AUX records with only format flags
perf/ftrace:
Fix WARNING in __unregister_ftrace_function
perf/x86/intel/ds:
Factor out PEBS group processing code to functions
perf/x86/intel/uncore:
Guard against invalid box control address
perf/x86/intel:
Correct pt_regs->flags update for PEBS path
perf/x86/intel:
Prevent drain_pebs() reentry
perf:
Fix addr_filter_ranges lifetime
perf:
RISC-V: check cpu_hw_evt before dereference in overflow IRQ
perf:
RISC-V: store available counter mask as bitmap
perf:
RISC-V: use BIT_ULL for u64 overflow masks
phonet:
check register_netdevice_notifier() error in phonet_device_init()
phy:
qcom: m31-eusb2: Make USB repeater optional
pinctrl:
mediatek: common-v1: bypass pinctrl GPIO layer in set GPIO direction
pinctrl:
mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction
pinctrl:
renesas: rzg2l: Add SR register cache for PM suspend/resume
pinctrl:
renesas: rzg2l: Handle RZ/V2H(P) IOLH configuration in PM cache
pinctrl:
renesas: rzv2m: Use -ENOTSUPP instead of -EOPNOTSUPP
platform/chrome:
Resolve kb_wake_angle visibility race
platform/x86:
dell-laptop: add Inspiron N5110 to touchpad LED quirk table
platform/x86:
intel-hid: Add HP ProBook x360 440 G1 to button_array_table
platform/x86:
msi-ec: Add support for MSI Pulse GL66 12th Gen
platform/x86:
sel3350-platform: Retain LED state on load and unload
powercap:
intel_rapl: Fix memory leak in rapl_add_package_cpuslocked()
powerpc/eeh:
Fix recursive locking on devices without EEH sensitive driver
powerpc/fadump:
Add timeout to RTAS busy-wait loops
powerpc/kexec_file:
Use inclusive range checks for excluded memory
powerpc/kexec_file:
Use inclusive range checks in add_usable_mem()
powerpc/ps3:
Fix repository.c build failure
powerpc/pseries:
Ensure vpa,slb_shadow & dtl are unregistered during crash
powerpc:
pci-ioda: Fix the stale irq chip reference
ppc/fadump:
invoke kmsg_dump in fadump panic path
ppp:
ppp_async: simplify tty disc_data access
ppp:
ppp_synctty: simplify tty disc_data access
ppp_async:
drop the errored frame instead of resetting its headroom
ppp_synctty:
ensure a writeable skb header
printk/nbcon:
Change nbcon_irq_work to IRQ_WORK_LAZY
psp:
validate IPv4 header fields in psp_dev_rcv()
ptp:
ocp: add shutdown callback
pwm:
mediatek: set mt7628 pwm45_fixup flag to false
qnx4:
handle set_blocksize failures
RAS/AMD/ATL, EDAC/amd64:
Only load ATL when needed
raw:
annotate disconnect-side IPv4 match writers
rcu-tasks:
Fix possible boot-time tests failed for the call_rcu_tasks()
RDMA/bnxt_re:
Proper rollback if the ioremap fails
RDMA/counter:
Fix num_counters leak on bind_qp failure in alloc_and_bind()
RDMA/irdma:
Fix typo in SQ completions generation
RDMA/irdma:
Replace waitqueue and flag with completion
RDMA/mlx5:
Create ODP EQ for non-pinned dmabuf MRs
RDMA/mlx5:
Fix state and counter desync on loopback enable failure
RDMA/mlx5:
Use QP port when decoding responder CQEs
RDMA/rtrs-srv:
Fix integer underflow in process_read and process_write
RDMA/umem:
Be careful about boundary conditions in ib_umem_find_best_pgsz()
RDMA/umem:
Make ib_umem_is_contiguous() safe on 32 bit
rds:
annotate data-race around rs_seen_congestion
rds:
filter RDS_INFO_* getsockopt by caller's netns
Reapply "bnxt_en:
bring back rtnl_lock() in the bnxt_open() path"
reboot:
fix cad_pid use-after-free race
regulator:
core: clamp voltage constraints before applying apply_uV
regulator:
da9121: Use subvariant ids in the I2C table
Revert "arm64:
dts: qcom: kodiak: Fix the PCIe iommu-map entries"
Revert "arm64:
dts: qcom: lemans: Fix the PCIe iommu-map entries"
Revert "arm64:
dts: qcom: qcs6490-rb3gen2: Fix the PCIe iommu-map entries"
Revert "arm64:
dts: qcom: sar2130p: Fix the PCIe iommu-map entries"
Revert "arm64:
dts: qcom: sc8180x: Fix the PCIe iommu-map entries"
Revert "arm64:
dts: qcom: sdm845: Fix the PCIe iommu-map entries"
Revert "arm64:
dts: qcom: sm8150: Fix the PCIe iommu-map entries"
Revert "arm64:
dts: qcom: sm8250: Fix the PCIe iommu-map entries"
Revert "arm64:
dts: qcom: sm8350: Fix the PCIe iommu-map entries"
Revert "arm64:
dts: qcom: sm8450: Fix the PCIe iommu-map entries"
Revert "arm64:
dts: qcom: sm8550: Fix the PCIe iommu-map entries"
Revert "arm64:
dts: qcom: sm8650: Fix the PCIe iommu-map entries"
Revert "arm64:
dts: qcom: sm8750: Fix the PCIe iommu-map entries"
Revert "arm64:
dts: qcom: talos: Fix the PCIe iommu-map entries"
Revert "riscv:
Reset pmm when PR_TAGGED_ADDR_ENABLE is not set"
Revert:
"f2fs: check in-memory block bitmap"
ring-buffer:
Acquire the lock with irqsave in rb_wake_up_waiters()
ring-buffer:
Check resize_disabled before publishing the new subbuf order
riscv:
panic if IRQ handler stacks cannot be allocated
rtase:
Fix flow control configuration
rtc:
aspeed: add AST2700 compatible
rtc:
bq32000: add delay between RTC reads
rtc:
cmos: Use platform_get_irq_optional() in cmos_platform_probe()
rtc:
mv: add suspend/resume support for wakeup
rust:
allow `clippy::as_underscore` in the generated bindings
rust:
allow `unknown_lints` in generated bindings for Rust < 1.88
s390/boot:
Avoid IPL parameter append past command line
s390/boot:
Fix physical memory search range
s390/cio:
Purge based on the cdev's online status
s390/crypto:
Fix handling of EBUSY in PHMAC when req is pushed to crypto engine
s390/crypto:
Fix missing cra_flags in paes_s390
s390/crypto:
Fix missing scrub of temp buffers with AES ctr and gcm algorithm
s390/crypto:
Fix missing scrub of temp buffers with PAES algorithm
s390/crypto:
Fix skcipher_walk return code handling in aes_s390
s390/crypto:
Fix use of mutex in atomic context
s390/crypto:
Fix wrong return code to engine in asynch callbacks
s390/crypto:
Map EBUSY to EIO when key conversion fails repeatedly
s390/diag324:
Preserve -EBUSY return code
s390/ipl:
Fix NULL deref in dump_reipl without re-IPL parm block
s390/ipl:
Fix NULL deref in kdump without re-IPL parm block
s390/ism:
folio_put() after error
s390/qeth:
allow bridgeport queries despite OS_MISMATCH
s390/time:
Use jiffies instead of jiffies_64
s390/vtime:
Use __this_cpu_read() / get rid of READ_ONCE()
s390/zcore:
Removed unused variables
sched/core:
Call wq_worker_tick() for the execution context
sched/eevdf:
Fix augmented max_slice
sched/eevdf:
Fix rb augmented with multi fields
sched/fair:
Reject misfit pulls onto busy SMT siblings on asym-capacity
sched/rt,dl:
Skip migrate-disabled tasks when picking a push candidate
sched:
Account cgroup CPU time to the execution context
sched:
Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr()
sched_ext:
Fix nonexistent field in sched-ext.rst example
sched_ext:
Fix timer pinning and return value in scx_central
sched_ext:
Fix vtime delta loss in scx_flatcg cgroup migration
sched_ext:
Update demo schedulers and selftests to use scx_bpf_task_set_dsq_vtime()
scripts/mksysmap:
drop the MODULE_INFO() symbols from kallsyms
scripts/mksysmap:
fix escape of '$' in the __pi_ pattern
scripts/sorttable:
Mark long_size as __maybe_unused
scripts:
modpost: detect and report truncated buf_printf() output
scsi:
bfa: Reduce kernel stack usage in bfa_fcs_lport_fdmi_build_portattr_block()
scsi:
core: Do not block on tag allocation in scsi_eh_lock_door()
scsi:
mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add()
scsi:
mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add()
scsi:
mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues()
scsi:
pm8001: Reject firmware update in fatal error state
scsi:
pm8001: Reject non-fatal dump when controller is crashed
scsi:
qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size
scsi:
qla2xxx: Clamp max_npiv_vports to VP_CTRL bitmap capacity
scsi:
qla2xxx: Fix 64G link speed reporting in get_data_rate
scsi:
qla2xxx: Fix queue teardown NULL dma_free and bitmap locking
scsi:
qla2xxx: Fix soft lockup polling continuation IOCB signature
scsi:
qla2xxx: Fix use-after-free of qpair work on queue teardown
scsi:
qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path
scsi:
qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock
scsi:
qla2xxx: Skip vport under deletion in report ID acquisition
scsi:
qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error
scsi:
qla2xxx: Use memset_io() to clear QLAFX00 request ring slot
scsi:
qla2xxx: Use ring-slot helpers in __qla2x00_alloc_iocbs
scsi:
qla2xxx: Validate BSG request_len before reading vendor_cmd[]
scsi:
qla2xxx: Zero dport diagnostics buffer to avoid info leak
scsi:
target: iscsi: Fix hang for aborted WRITE_PENDING commands
sctp:
fix a TOCTOU race in SCTP_CMD_TIMER_START
sctp:
fix err_chunk memory leaks in INIT handling
sctp:
fix soft lockup from unpadded ASCONF-ACK parameter iteration
sctp:
Unwind address notifier registration on failure
selftests/alsa:
Fix the step check for INTEGER controls
selftests/bpf:
Fix flaky bpf_nf test when random NAT port is 0
selftests/cgroup:
Fix cg_run_in_subcgroups ignoring arg parameter
selftests/powerpc/tm:
Fix tcheck() reading uninitialised CR value
selftests:
mptcp: fix an UAF in mptcp_connect.c
serial:
8250: fix possible ISR soft lockup
serial:
8250_port: recognize UPIO_AU
smb/client:
fix data corruption in emulated insert range
smb/client:
fix integer truncation in collapse range
smb/client:
fix security flag calculation when setting security descriptors
smb/client:
flush dirty data before punching a hole
smb/client:
mark file sparse before emulating insert range
smb/client:
validate new EOF for insert range
smb/client:
validate new EOF for zero range
smb/client:
zero-initialize stack-allocated cifs_open_info_data
smb:
client: avoid leaking refcount in cifs_queue_oplock_break()
smb:
client: avoid leaking refcount when cifs_sb_tlink() fails
smb:
client: bound dirent name against end of SMB response in cifs_filldir
smb:
client: fail DACL rewrite when the new DACL exceeds 64K
smb:
client: fix file type corruption in cifs_reparse_point_to_fattr()
smb:
client: fix file type corruption in posix_reparse_to_fattr()
smb:
client: fix file type corruption in wsl_to_fattr()
smb:
client: fix heap overflow in DACL owner/group rewrite
smb:
client: fix one-byte OOB read in smb2_parse_native_symlink()
smb:
client: fix races in cifsd thread creation
smb:
client: fix UBSAN array-index-out-of-bounds in smb2_copychunk_range
smb:
client: pin DFS superblock in iterator callback
smb:
client: refactor ACL setting control flow in id_mode_to_cifs_acl()
smb:
client: reject short READ responses in CIFSSMBRead()
smb:
client: reject userspace cifs.idmap descriptions
smb:
client: transport: Fix debug printing in __release_mid()
smb:
client: use atomic_t for mnt_cifs_flags
smb:
move copychunk definitions to common/smb2pdu.h
soc/tegra:
fuse: Register nvmem lookups at probe
soundwire:
dmi-quirks: Disable ghost Realtek devices
soundwire:
intel: Move suspend tracking from trigger to pm suspend
soundwire:
intel_auxdevice: Add cs42l43b to wake_capable_list
soundwire:
only handle alert events when the peripheral is attached
soundwire:
validate DT compatible before parsing it
sparc64:
uprobes: add missing break
sparc:
Disable compat support with LLD
spi:
Add NULL check for spi_get_device_id() in spi_get_device_match_data()
spi:
core: Abort active target transfer on controller suspend
spi:
dw-dma: Wait for controller idle before completing Tx
spi:
dw-mmio: Add ACPI ID LECA0002 for LECARC SoCs
spi:
dw: fix wrong RX_SAMPLE_DLY setting after resume
spi:
spi-qcom-qspi: Fix incomplete error handling in runtime PM
spi:
tegra210-quad: Allocate DMA memory for DMA engine
spi:
xilinx: let transfers timeout in case of no IRQ
staging:
fbtft: make dirty_lock IRQ-safe
sunvdc:
unmap LDC cookies when the descriptor send fails
tcp:
introduce icsk->icsk_keepalive_timer
tcp:
remove icsk->icsk_retransmit_timer
tcp:
rename icsk_timeout() to tcp_timeout_expires()
tcp:
use GFP_ATOMIC in tcp_send_active_reset()
tee:
optee: Allow MT_NORMAL_TAGGED shared memory
thermal/drivers/qcom/tsens:
Atomic temperature read with hardware-guided retries
thermal/drivers/tegra/soctherma:
Switch to devm cooling device registration
thermal:
sysfs: switch to use scnprintf() to suppress truncation warning
thunderbolt:
Avoid reserved fields in path config space for USB4 routers
thunderbolt:
Don't access path config space on Lane 1 adapters in tb_switch_reset_host()
thunderbolt:
Don't create multiple DMA tunnels on firmware connection manager
thunderbolt:
Don't disable lane adapter if XDomain lane bonding isn't possible
thunderbolt:
Improve multi-display DisplayPort tunnel allocation
thunderbolt:
Increase timeout for Configuration Ready bit
thunderbolt:
Keep the domain reference while processing hotplug
thunderbolt:
Keep XDomain reference during the lifetime of a service
thunderbolt:
Release request if tb_cfg_request() fails in __tb_xdomain_response()
thunderbolt:
Set tb->root_switch to NULL when domain is stopped
thunderbolt:
Verify PCIe adapter in detect state before tunnel setup
thunderbolt:
Verify Router Ready bit is set after router enumeration
tick/broadcast:
Plug clockevents replacement race
tipc:
Dont send random pad bytes in RESET/ACTIVATE messages
tipc:
fix integer overflow in tipc_recvmsg() and tipc_recvstream()
tipc:
fix NULL deref in tipc_named_node_up() on empty publication list
tls:
Flush backlog before waiting for a new record
tls:
reject the combination of TLS and sockmap
tools/bootconfig:
Fix integer overflow and truncation in size checks
tools/nolibc:
avoid call to wcslen() in _start_c() inserted by clang
tracing/probes:
Fix use-after-free on field name/type of events with multiple probes
tracing/user_events:
Don't destroy fields when event removal fails
tracing:
Add boot-time backup of persistent ring buffer
tracing:
Disable KCOV instrumentation for trace_irqsoff.o
tracing:
Fix memory corruption from a "STACKTRACE" histogram key
tracing:
Fix memory corruption from the histogram stacktrace modifier
tracing:
Fix to avoid creating trace instances with duplicate names
tracing:
Free histogram the field rejected for a bad modifier
tracing:
Free histogram the var ref when its initialization fails
tracing:
Free histogram var refs regardless of how often they are referenced
tracing:
Keep the entry count when the histogram stats allocation fails
tracing:
Let histogram values keep the percent and graph modifiers
tracing:
Merge struct event_trigger_ops into struct event_command
tracing:
Remove get_trigger_ops() and add count_func() from trigger ops
tracing:
Restore :mod: trailer after parsing in ftrace_set_clr_event()
tracing:
Set the trace clock before registering the histogram trigger
tracing:
Take the reference before publishing the named histogram trigger
tracing:
Undo the registration when enabling the histogram trigger fails
tty:
serial: 8250: protect against NULL uart->port.dev in register
tunnels:
Drop stale dst when building an ICMP error for PMTUD
ufs:
create the root dentry after loading cylinder metadata
ufs:
do not treat unreadable directory blocks as empty
ufs:
validate cylinder group metadata before caching it
USB:
cdc-acm: start bulk-IN polling when ALWAYS_POLL_CTRL is set
usb:
core: hcd: fix possible deadlock in rh control transfers
usb:
gadget: aspeed_udc: avoid past-the-end iterator in dequeue
usb:
gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log
usb:
gadget: udc: skip pullup() if already connected
usb:
host: add ARCH_AIROHA in XHCI MTK dependency
usb:
serial: spcp8x5: don't store usb_device_id
usb:
usbtmc: don't store usb_device_id
usb:
xhci: Improve Soft Retries after short transfers
usb:
xhci: remove legacy 'num_trbs_free' tracking
usb:
xusbatm: don't rely on id table pointer arithmetic
usbip:
vhci_hcd: fix NULL deref in status_show_vhci
vdpa/ifcvf:
handle dev_set_name() failure in ifcvf_vdpa_dev_add()
vdpa/octeon_ep:
Use 4 bytes for mailbox signature
vdpa:
ifcvf: Put device on unsupported feature error
vdpa:
solidrun: Free IRQs after request failure
vdpa_sim_blk:
reject out-of-range sector starts
vdpa_sim_net:
check TX pull result before RX copy
vhost-scsi:
flush backend after device ioctls
vhost-vdpa:
don't install the eventfd_ctx_fdget() error in config_ctx
vhost-vdpa:
protect config_ctx from being freed under the config callback
vhost/vdpa:
reject VRING_NUM larger than device max
virt:
acrn: Fix irqfd use-after-free during eventfd shutdown
virtio-fs:
avoid double-free on failed queue setup
virtio-pci:
return IRQ_HANDLED after non-zero ISR
virtio:
fix use-after-free in unregister_virtio_device()
virtio_console:
do not free control-out buffers on remove
virtio_input:
reset device if input_register_device() fails
virtio_input:
stop callbacks before unregistering input device
virtio_mmio:
disable IRQ wake before free_irq
vsock:
use sk_acceptq_is_full() helper in all transports
vxlan:
initialize _md in vxlan_xmit_one()
vxlan:
mdb: Fix use-after-free in vxlan_mdb_remote_src_del()
vxlan:
reject dynamic fdb entries that reference a nexthop id
watchdog:
fix hrtimer start when pretimeout is zero
watchdog:
imx7ulp_wdt: Keep WDOG running until A55 enters WFI on i.MX94
watchdog:
lenovo_se10_wdt: Add support for SE10 Gen 2 platform
watchdog:
lenovo_se10_wdt: Fix use-after-free and resource leak risk
watchdog:
msc313e: Avoid division by zero
watchdog:
msc313e: Enable clock before accessing hardware registers
watchdog:
msc313e: Fix clock leak and spurious timer in settimeout()
watchdog:
msc313e: Fix NULL pointer dereference in PM callbacks
watchdog:
msc313e: Fix spurious reset on suspend
watchdog:
msc313e: Fix undefined behavior
watchdog:
msc313e: Sync timeout value if WDT was running at boot
watchdog:
sunxi_wdt: preserve boot-enabled watchdog
wifi:
ath11k: cancel SSR work items during PCI shutdown
wifi:
ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi
wifi:
ath12k: Prevent incorrect vif chanctx switch when handling multi-radio contexts
wifi:
ath9k: Obtain system GPIOS from descriptors
wifi:
ath9k_htc: don't store usb_device_id
wifi:
cfg80211: harden cfg80211_defragment_element()
wifi:
cfg80211: reject duplicate wiphy cipher suite entries
wifi:
cfg80211: validate assoc response length before status and IE access
wifi:
cfg80211: validate IEs in cfg80211_wext_siwgenie()
wifi:
cfg80211: validate rx/tx MLME callback frame lengths before access
wifi:
iwlwifi: acpi: validate WGDS table revision index
wifi:
iwlwifi: add support for AX231
wifi:
iwlwifi: bound aligned TLV advance in FW parser
wifi:
iwlwifi: fix the access to CNVR TOP registers
wifi:
iwlwifi: mld: call iwl_mld_free_ap_early_key() for AP only
wifi:
iwlwifi: mld: disallow puncturing in US/CA for WH
wifi:
iwlwifi: mld: don't WARN on WoWLAN suspend w/o netdetect
wifi:
iwlwifi: mld: honor BSS_CHANGED_BEACON_ENABLED
wifi:
iwlwifi: mld: keep healthy link on EMLSR missed beacon exit
wifi:
iwlwifi: mld: purge async notifications upon nic error
wifi:
iwlwifi: mvm: add a check on the tid coming from the firmware
wifi:
iwlwifi: mvm: fix a possible underflow
wifi:
iwlwifi: mvm: fix an off-by-1 boundary check
wifi:
iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif
wifi:
iwlwifi: mvm: fix P2P-Device binding handling
wifi:
iwlwifi: mvm: fix sched scan IE sizing
wifi:
iwlwifi: mvm: parse beacon notif per layout
wifi:
iwlwifi: mvm: validate mac_link_id in session protect notif
wifi:
iwlwifi: mvm: validate sta_id in BA window status notif
wifi:
iwlwifi: mvm: validate TX_CMD response layout
wifi:
iwlwifi: pcie: add two LNL PCI IDs
wifi:
iwlwifi: pcie: fix ACPI DSM check
wifi:
iwlwifi: pcie: null RX pointers after free
wifi:
iwlwifi: Transition to basic uAPSD with MAC_PM_POWER_TABLE API VER_3
wifi:
libertas: reject short monitor TX frames
wifi:
libipw: fix key index receive bound checks
wifi:
mac80211: always allow transmitting null-data on TXQs
wifi:
mac80211: avoid out-of-bounds access in monitor
wifi:
mac80211: clarify beacon parsing with MBSSID/EMA
wifi:
mac80211: don't call ieee80211_handle_reconfig_failure when not needed
wifi:
mac80211: explicitly disable FTM responder on AP stop
wifi:
mac80211: ibss: wait for in-flight TX on disconnect
wifi:
mac80211: unify link STA removal in vif link removal
wifi:
mac80211: use chandef in ieee80211_get_sta_bw()
wifi:
mac80211: validate deauth frame length before reason access
wifi:
mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO
wifi:
mt76: mt7921: skip unknown CLC firmware records
wifi:
mt76: mt7921: validate CLC firmware records
wifi:
mt76: mt7925: add 320MHz bandwidth to bss_rlm_tlv
wifi:
mt76: mt7925: add Netgear A8500 USB device ID
wifi:
mt76: mt7925: handle 320MHz bandwidth in RXV and TXS
wifi:
mt76: mt7925: populate EHT 320MHz MCS map in sta_rec
wifi:
mt76: transform aspm_conf for pci_disable_link_state
wifi:
mwifiex: replace one-element arrays with flexible array members
wifi:
nl80211: check link is beaconing for color change
wifi:
nl80211: Increase ie_len size to prevent truncated IEs in new peer notifications
wifi:
nl80211: reject beacons with bad HE operation
wifi:
ralink: RT2X00: init EEPROM properly
wifi:
rsi: avoid reading TKIP MIC keys for non-TKIP ciphers
wifi:
rsi: validate beacon length before fixed buffer copy
wifi:
rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result()
wifi:
rtw89: 8851bu: add Mercusys MA60XNB (2c4e:0128)
wifi:
rtw89: disable CSI STBC for VHT 160MHz
wifi:
rtw89: disable HTC field in AP mode
wifi:
rtw89: pci: enable LTR based on pcie control register
wifi:
rtw89: phy: check length before parsing PHY status IE
wifi:
rtw89: suspend DIG when remain-on-channel
workqueue:
reject watchdog thresholds that overflow jiffies
x86/alternatives:
Exclude text poking against change_page_attr()
x86/amd_node:
Avoid divide by zero on virtualized systems
x86/amd_node:
Fix PCI device reference counting in amd_smn_init()
x86/amd_node:
Fix potential NULL pointer dereference
x86/cfi:
Fix FineIBT hash offset in cfi_get_func_hash()
x86/itmt:
Don't make ITMT enablement depend on debugfs
x86/microcode/AMD:
Move the no-revision fixup to get_patch_level()
x86/mm/pat:
Acquire init_mm read lock on attribute changes to avoid UAF
x86/mm/pat:
Acquire init_mm write lock on collapse to avoid UAF
x86/mm/pat:
Allocate split page tables as kernel page tables
x86/mm/pat:
Convert split_large_page() to use ptdescs
x86/mm/pat:
Don't gate cpa_lock on debug_pagealloc_enabled()
x86/mm:
Fix and document DEBUG_PAGEALLOC
x86/mm:
Fix user-space data loss with MADV_FREE and THP
x86/topology:
Add missing struct declaration and attribute dependency
xdrgen:
Fix union declarations
xen/front-pgdir-shbuf:
free grant reference head on errors
xen/gntalloc:
validate grant count before allocation
xfs:
actually check internal-rtdev fields in the superblock
xfs:
actually recover intended file sizes in xfs_xmi_item_recover_intent
xfs:
advance the findparent inode scan cursor while holding ILOCK
xfs:
bail out on bitmap errors in xrep_agfl_fill
xfs:
compute dquot checksum after resetting dd_lsn in repair
xfs:
count escaped corruption errors in scrub stats
xfs:
cross-reference the rtgroup superblock extent, not block
xfs:
destroy seen inode bitmap when we fail to add a dirpath
xfs:
don't leak dqacct if rhashtable insertion fails
xfs:
don't leak new_bp if xfs_btree_bload_drop_buf fails
xfs:
don't modify file attributes or poke fsnotify for dry runs
xfs:
don't spin forever on zero-length dirents when salvaging them
xfs:
fix backwards mergeability logic in refcount scrubber
xfs:
fix backwards skipping logic in xrep_quota_block
xfs:
fix bnobt repair space reservation disposal failure
xfs:
fix exchange-range reflink flag clearing issue with INO1_WRITTEN
xfs:
fix name string recording in slowpath pptr tracepoints
xfs:
fix parent rec lookup initialization in xrep_metapath_unlink
xfs:
fix reclaimed page accounting in xfs_buf_free
xfs:
fix replaying dirent removals into the temporary directory
xfs:
fix rtrefcount btree block counting in scrub
xfs:
fix rtrmap cross-referencing elision logic
xfs:
fix short ifork reaping computation in xreap_bmapi_binval
xfs:
fix the rtrmap and rtrefcount _maxlevels_ondisk functions
xfs:
fix unit conversions in per_binval computation
xfs:
fix xfs_rtrmapbt_mem_cursor for non-rmap filesystems
xfs:
initialise args->total for parent pointer updates
xfs:
initialise error in xfs_defer_finish_one()
xfs:
log the tempip after we convert it to extents format
xfs:
make the rtsummary repair fix the file size too
xfs:
preserve owner on in-memory btree creation
xfs:
release alleged child inode on metapath unlink error
xfs:
report healthy filesystem events in scrub stats
xfs:
report nonexistent parents as a filesystem corruption
xfs:
reset parent pointer args before each dir tree unlink repair
xfs:
signal inode btree xref error if get_rec returns an error
xfs:
snapshot old AGFL before rewriting it
xfs:
snapshot scrub stats when rendering them
xfs:
strengthen the "is cow staging" helpers in scrub
xfs:
truncate quota file correctly when repairing quota file
xfs:
use the rtgroup extent count to find rtrefcount gaps
xhci:
Prevent queuing new commands if xhci is inaccessible
xprtrdma:
Add request-pool slack for delayed recycling