Changelog in Linux kernel 7.3.4

fault-inject: fix dentry leak

fbcon: Include font geometry in the rotated font cache

fbcon: Rebuild rotated font buffer on font change

fbcon: Retry rotated font allocation after failure

fbdev: atmel_lcdfb: fix list_first_entry() on possibly empty modelist in probe

fbdev: bitblit: Fix glyph clipping when fbcon pans

fbdev: core: Initialize modelist in framebuffer_alloc()

fbdev: kyro: Release WC setup on registration failure

fbdev: nvidia: Release write-combining handle on probe failure

fbdev: sh_mobile_lcdc: check for fb_deferred_io_init() error

fbdev: sh_mobile_lcdcfb: Restore the per-overlay sysfs attributes

fbdev: smscufx: check for fb_deferred_io_init() error

fbdev: ssd1307fb: check for fb_deferred_io_init() error

fbdev: udlfb: check for fb_deferred_io_init() error

fbdev: xen-fbfront: check for fb_deferred_io_init() error

firewire: core: fix source bus ID detection for AT context in big-endian systems

floppy: don't store a stack buffer in timeout_message

floppy: return the drive state flags from the 32-bit FDGETDRVSTAT

fork: honor task_struct's declared alignment

fpga: Fix of_fpga_mgr_get() reference in fpga_mgr_lock() docs

fs/ntfs3: bound CreateAttribute asize against record_size in do_action

fs/ntfs3: bound DeleteAttribute asize against rec->used in do_action

fs/ntfs3: fix integer overflow in find_log_rec() causing OOB read

fs/ntfs3: reject an oversized resident attribute on the inline iomap path

fs: don't fail __d_obtain_alias() for unlinked inodes

fs: don't lose inodes that another LRU walker is isolating

fs: let backing files inherit FMODE_NONOTIFY from the user file

fs: make sure to call fsnotify_inoderemove() only once when inode is dead

fs: rotate inodes whose page cache could not be dropped

fs: skip copy_file_range write limits when there is no data

fs_pin: publish pins with RCU list helpers

fscrypt: Fix missing barrier in fscrypt_find_mode_key()

fsverity: Be more careful with return value of ->get_verity_descriptor()

fsverity: Explicitly require FMODE_READ to retrieve hashes

fsverity: hoist statx reporting of fs-verity flag

fsverity: Tell LSMs about signature only after verity is enabled

fuse: don't drop destination page cache on a zero byte copy reply

fuse: don't launder folios of a bad inode

fuse: don't shorten the folio descriptor at LLONG_MAX

fuse: fix copy_file_range reply handling race

fuse: fix GCC 8 build with CONFIG_PROFILE_ALL_BRANCHES

genirq/kexec: Do not take the bus lock of an interrupt chip on the crash path

gfs2: fix the escaped block copy in gfs2_before_commit()

gfs2: reject invalid inode sizes

gpio: davinci: Clear interrupt status in every bank on suspend

gpio: pca953x: Handle direction register read errors in IRQ paths

gpio: pca953x: Preserve wakeup accounting on parent IRQ failure

gpiolib: cdev: don't set GPIOD_FLAG_IS_OUT

gpiolib: don't report -ENOMEM for a requested line without a label

gpiolib: Free chip resources when allocating the label fails

gve: fix out-of-bounds read in gve_get_flow_rule_entry()

hte: tegra194-test: shut down timer before GPIO release

hte: tegra194: Initialize slice locks before registering chip

hwmon: (acpi_power_meter) Fix 18.45 TW bug

hwmon: (coretemp) Fix handling of isolated SMT siblings

hwmon: (coretemp) Refresh the temperature on the first read

hwmon: (coretemp) Return -ENODATA for invalid temperature readings

hwmon: (corsair-cpro) Make wait_input_report_lock IRQ safe

hwmon: (gigabyte_waterforce) reject short input reports

hwmon: (lm70) Fix rounding of negative temperatures

hwmon: (lm95245) Fix negative temperature conversion

hwmon: (mcp9982) Update the interval cache only after successful writes

hwmon: (sht3x) Return the consumed count for heater writes

hwmon: (sht4x) Fix jiffies wraparound in heater-ready check

hwmon: (sht4x) Reject incomplete heater command transfers

hwmon: (tmp102) Fix jiffies wraparound in conversion-ready check

hwmon: (tmp108) Fix jiffies wraparound in conversion-ready check

hwrng: amd - report partial reads in non-blocking mode

hwrng: ba431 - fix reported byte count

hwrng: core - reject unknown RNG names

i2c: acpi: Fix adapter reference leak in i2c_acpi_new_device_by_fwnode()

i2c: designware: queue only one read command for block reads

i2c: mt7621: fix copying uninitialized kernel stack with reduced page_len

i3c: master: adi: free the IRQ before unregistering the master

i3c: master: Fix out-of-bounds read in DMA bounce buffer setup

i3c: mipi-i3c-hci-pci: Set drvdata before creating LTR sysfs attribute

i3c: mipi-i3c-hci: Bounce short reads irrespective of the IOMMU

IB/hfi1: Shutdown self-rearming timers before freeing

iio: accel: adis16201: fix channel order for buffer mode

iio: accel: adxl313: reject devices without match data

iio: accel: adxl372: reject devices without match data

iio: accel: adxl380: reject devices without match data

iio: accel: kxcjk-1013: Disable autosuspend on remove

iio: accel: mma9551: disable autosuspend on remove

iio: accel: mma9553: disable autosuspend on remove

iio: accel: sca3000: reject devices without match data

iio: adc: ad4080: enable address ascension for chip identification

iio: adc: ad7192: reject devices without match data

iio: adc: ad7606: reject devices without match data

iio: adc: ad7768-1: reject devices without match data

iio: adc: at91-sama5d2: disable autosuspend on remove

iio: adc: max11205: reject devices without match data

iio: adc: max14001: add missing MODULE_DEVICE_TABLE macro

iio: adc: mcp3911: reject devices without match data

iio: adc: stm32: fix minimum sampling time values

iio: adc: ti-adc128s052: validate SPI match data

iio: adc: ti-ads1018: reject devices without match data

iio: adc: ti-ads1100: Fix incorrect reading when datarate changed in single mode

iio: adc: ti-ads131m02: reject devices without match data

iio: adc: ti-ads7950: validate SPI match data

iio: amplifiers: ad8366: reject devices without match data

iio: dac: ad5755: validate SPI match data

iio: dac: mcp47feb02: Avoid unjustified probe error on missing label

iio: dac: mcp47feb02: Fix gain field initialization for active channels

iio: dac: mcp47feb02: Increase EEPROM Programming Write Cycle Time

iio: dac: mcp47feb02: initialize dac_data field in channel data struct at probe

iio: dac: mcp47feb02: Return len when disabling EEPROM store

iio: dac: mcp4821: reject devices without match data

iio: frequency: adf4377: reject devices without match data

iio: imu: adis16400: validate SPI match data

iio: imu: inv_icm42600: fix odr change not caught in certain cases

iio: imu: inv_icm42600: force accel odr change when switching power mode

iio: light: apds9306: fix default sampling frequency definition

iio: light: isl29028: fix runtime PM reference leak on error paths

iio: light: ltr501: Power down chip if request irq fails

iio: potentiometer: x9250: reject devices without match data

iio: pressure: bmp280: validate SPI match data

iio: pressure: dps310: fix CFG_REG bit definitions

inet: frags: prevent acceptance of partially authenticated reassembly

inet: reject unhashed sockets during established lookups

init/bootconfig: pass init arguments in documented order

init: fix early boot crash with bare hostname parameter

Input: always accept EV_SYN in input_event()

Input: xpad - add GameSir Nova Lite support

iomap: don't lose a failed direct I/O bio's error when zeroing the tail

iomap: don't lose a fiemap iteration error when emitting the last extent

iomap: don't mark unwritten parts of a folio uptodate

iomap: keep large chunks from defeating the bio cap

iommu/amd: Don't allocate kdump device table from DMA32

iommu/amd: Program device table when kdump reuse fails

iommu/arm-smmu-v3-iommufd: Reject unsupported bits in invalidation commands

iommu/dma: Catch scatterlist length overflows

iommu/vt-d: Avoid out-of-range shift in qi_desc_dev_iotlb_pasid()

iommufd: Keep dmabuf PFNs MMIO when filling another domain

iommufd: Reject a zero-length dirty bitmap request

iommupt: Do not allow PTEs to be split when dirty logging

iov_iter: fix NULL deref in iov_iter_alignment()

ipc, msg: Account msg_msg allocations with GFP_KERNEL_ACCOUNT again

ipc/mqueue: release notification resources during inode eviction

ipc/shm: fix RSS accounting for hugetlb shared memory

ipmr, ip6mr: validate packets injected into the register vif on xmit

ipmr: drop packets with unknown ingress VIF

ipmr: fully initialize the synthetic IP header in ipmr_get_route()

ipmr: only copy pktinfo to cache reports

ipv6: defrag: orphan skb before queuing

ipv6: do not restart DAD for a dead ifaddr

ipv6: initialize temporary ifaddr before publication

ipv6: remove ifaddr from hash during ifdown list cleanup

ipv6: serialize address publication with device teardown

irqchip/atmel-aic[5]: Disable interrupts in the irq_pm_shutdown() callbacks

irqchip/gic-v3-its: Don't clamp nvecs to zero when id_bits is 32

irqchip/imx-intmux: Fix runtime PM teardown on remove

irqchip/irq-msi-lib: Free wired MSI descriptors

irqchip/jcore-aic: Fix lost IPIs on SMP

irqchip/mchp-eic: Fix clock reference leak in mchp_eic_probe()

irqchip/renesas-rzv2h: Preserve TIEN state in rzv2h_tint_set_type()

irqchip/riscv-imsic: Report successful hardware retrigger

isofs: fix Rock Ridge CE extent validation on multisession media

ixgbe: reserve TX timestamp after skb preparation

jbd2: don't advance j_fc_off before the buffer is recorded

kbuild: AutoFDO: Update split machine function argument for upstream rename

kgdb: Fix buffer overflow in the 'M' and 'X' packet handlers

kgdb: Fix buffer overflow in the 'm' packet handler

kgdb: Fix buffer overflow in the qRcmd packet handler

kho: do not reserve scratch memory in the kdump kernel

kobject: fix out-of-bounds access in kobject_action_type()

KVM: arm64: Fix MMFR0 TGRAN advertisement for pVMs

KVM: arm64: Move IN_GUEST_MODE ahead of state being loaded

KVM: arm64: Move OUTSIDE_GUEST_MODE publication past context being saved

KVM: arm64: nv: Move L2->L1 switch on interrupt early

KVM: arm64: Pin the host vCPU before adjusting its PC under pKVM

KVM: arm64: Prevent 64-bit overflow when computing hyp clock rate

KVM: arm64: ptdump: Check the page tables aren't freed when accessing

KVM: arm64: ptdump: Fix shadow ptdump sleep-in-atomic-context problem

KVM: arm64: Sanitise ID_AA64MMFR3_EL1.S1P[IO]E

KVM: arm64: Set HCR_EL2.BSU to Inner Shareable for guests

KVM: arm64: timers: Compute an offset-applied CVAL from the current count

KVM: arm64: Turn vcpu->arch.pause into a counter

KVM: arm64: Validate the host vCPU's VM before reading it under pKVM

KVM: arm64: vgic-its: Don't map an LPI from more than one event

KVM: arm64: vgic-v3: Roll back assignments from the new region

KVM: arm64: vgic-v3: Undo assignment on iodev registration failure

l2tp: snapshot sequencing state when building transmit headers

leds: ktd2692: Pass context to regulator cleanup

lib/842: reject output overflows from index and short data

lib/842: require a complete history block for repeat templates

lib/buildid: reject file offsets that do not fit in pgoff_t

lib/cmdline: fix get_options() count and overflow with large ranges

lib/decompress_bunzip2: fix off-by-one in run-length bounds check

lib/plist: fix plist_requeue() corrupting order in the last bucket

lib: decompress_bunzip2: fix integer overflow in run-length decoding

libceph: Fix multiple unsafe decodes in ceph_oloc_decode()

libceph: fix out-of-bounds reads from repeated CRUSH bucket entries

libceph: Fix unsafe decode in ceph_redirect_decode()

libceph: initialize CRUSH choose argument weights

libceph: only set read_from_replica on read requests

libceph: reject an initial monmap with no monitors

libceph: reject mismatched CRUSH weight-set sizes

Linux: Linux 7.3.4

listmount: don't wrap around with a U64_MAX cursor

listns: don't wrap around with a U64_MAX cursor

LoongArch: Call cpu_final_simd() with pure_initcall()

LoongArch: Don't init & online empty nodes

LoongArch: Fix architectural naming typo for CSR_FWPS_SKIP

LoongArch: Fix bitmask corruption in update_bp_registers()

LoongArch: Fix one-shot limitation for perf hardware breakpoints

LoongArch: Fix perf hardware breakpoint failure via installation

LoongArch: Only send SIGTRAP signal if necessary in do_watch()

LoongArch: Remove arch-specific __smp_mb__{before,after}_atomic()

LoongArch: Remove redundant call in update_bp_registers()

LoongArch: Use pa_to_nid()/nid_to_addrbase() rather than hard-code

loop: check for read-write open mode on LOOP_SET_STATUS in lo_compat_ioctl()

m68k: dmasound: Keep the Q40 IRQ handler registered

m68k: Fix seccomp filtering on ColdFire and 68000

macvlan: fix passthru promiscuity accounting while down

mailbox: altera: shut down RX polling timer on channel teardown

mailbox: bcm74110: Cap rx_svc_init_list growth to prevent PMC-induced OOM

mailbox: mtk-cmdq: Fix runtime PM leak in cmdq_mbox_flush()

mailbox: qcom-ipcc: Guard against NULL con_priv in send_data()

md/raid5: fix NULL pointer dereference in raid5_free_percpu

md/raid5: track disks array size to fix extra_page leak on error paths

md/raid5: validate payload size before calculating payload_len

md: don't hand out the array before md_alloc() has added mddev->kobj

md: validate bblog_size when loading v1.x badblocks metadata

media: adv7180: Initialize mutex before ancillary clients

media: adv748x: Fix endpoint reference leaks on probe failure

media: adv7604: avoid negative array index in log_status when cp_read fails

media: amphion: drain message work before releasing core state

media: amphion: fix runtime PM imbalance on probe failure

media: amphion: prevent unbind while video instances are open

media: atmel-isi: release unregistered video device on remove

media: au0828: Fix media device leak in au0828_usb_probe()

media: au0828: Free URBs when starting DVB streaming fails

media: cec: extron: clear response tail before dispatch

media: chips-media: wave5: Balance runtime PM on encoder close errors

media: chips-media: wave5: Check decoder qbuf runtime resume

media: chips-media: wave5: Handle polling IRQ thread failure

media: cx18: Disable PCI device on probe failure

media: cx231xx-audio: drain wq_trigger before audio fini

media: cx231xx: Fix cleanup path on failure

media: cx231xx: preserve I2C transfer length

media: cx88: Specify rc type at rc_allocate_type()

media: em28xx: fix double free in em28xx_alloc_urbs

media: em28xx: fix inverted tuner capability check for VBI device

media: ene_ir: Ensure teardown is done in the correct order

media: exynos4-is: Fix a race between s_stream(0) and the interrupt handler

media: go7007: bound EZ-USB I2C transfers to the usb_buf size

media: go7007: unregister the I2C adapter on USB probe failure

media: hantro: disable runtime PM before hardware teardown

media: hantro: Harden MPEG-2 control access against NULL

media: hws: report measured colorimetry

media: hws: Wait for IRQ handler before returning buffers

media: i2c: alvium-csi2: balance runtime PM usage count on remove

media: i2c: cvs: Add sensor node in bound callback

media: i2c: cvs: Get the wake IRQ without claiming the GPIO

media: i2c: og01a1b: power off sensor on remove

media: i2c: ov2735: fix power cleanup on remove

media: i2c: ov5647: fix power cleanup on remove

media: i2c: ov8856 : remove ACPI node bypass mechanism

media: i2c: ov8856: fix debug message to report actual CSI-2 lane count

media: i2c: tc358743: add missing color-space strings

media: imagination: Fix value clamping in calculate_qp_tables

media: imx-jpeg: finish the job on device_run() error paths

media: imx219: Account for rate_factor in control steps

media: imx219: Account rate_factor in setting upper exposure limit

media: imx219: The horizontal blanking step is 8

media: ir-hix5hd2: Ensure rdev is setup before interrupts are enabled

media: ir_toy: Validate the maximum tx carrier

media: iris: avoid bit depth validation for capture formats

media: iris: Fix bus_info prefix in VIDIOC_QUERYCAP

media: iris: Fix frame interval enumeration for non-divisor framerates

media: iris: Fix iova allocation from restrict region

media: iris: Fix power-off ordering to disable power domain after clocks

media: iris: reset AHB bridge before enabling HW mode

media: m2m-deinterlace: fix default capture field

media: mali-c55: add padding to mali_c55_params_ccm structure

media: mali-c55: Check the parameters buffer address before copying

media: mali-c55: Check the statistics buffer address before filling

media: mali-c55: fail power-on when safe stop times out

media: mali-c55: Free the ISP control handler on unregister

media: mali-c55: Ignore disconnected queues when checking readiness

media: marvell-cam: fix unmet dependency for VIDEO_MMP_CAMERA

media: marvell: manage the MMP camera clock provider

media: mediatek: jpeg: Avoid context access after job finish

media: mediatek: jpeg: retry HW selection after successful wait

media: mediatek: vcodec: destroy core workqueue on remove

media: mediatek: vpu: free IRQ before destroying watchdog workqueue

media: mediatek: vpu: release reserved memory on remove

media: meson-ir-tx: Ensure clock is disabled on unbind

media: meson-ir-tx: Ensure probe error is propagated

media: meson-ir-tx: Ensure rc_free_device() is called on unbind

media: meson-ir-tx: Prevent divide by zero in meson_irtx_prepare_pulse()

media: meson: vdec: size capture planes from the aligned canvas

media: microchip-isc: disable histogram and flush AWB work on teardown

media: microchip-isc: do not touch WB registers when not streaming

media: microchip-isc: don't sleep in the clk .is_enabled callback

media: microchip-isc: fix awb_mutex and lock lifecycle

media: microchip-isc: fix PM runtime leak in AWB work handler

media: microchip-isc: synchronize the IRQ before disabling clocks on stop

media: mtk-jpeg: Fix runtime PM leak in mtk_jpegdec_worker()

media: mtk-jpeg: Fix runtime PM leak in mtk_jpegenc_worker()

media: nuvoton: npcm-video: quiesce VCD IRQ before teardown

media: pci: hws: only init channels the device actually has

media: platform: mtk-mdp3: Fix device reference leak in mdp_comp_init()

media: pvrusb2: Fix USB parent device leak in class_dev_create()

media: qcom: camss: Add "gcc_axi_hf" to 8775p VFE lite clock lists

media: qcom: camss: vfe-17x: Fix write master buffer done being dropped

media: qcom: camss: vfe-17x: Fix write master selection for RDI lines

media: qcom: camss: vfe: Fix VFE reset while another line is streaming

media: rc: Add missing locking for keymap

media: rc: Replace open coded krealloc() for keymap

media: redrat3: Ensure all urbs are suspended

media: redrat3: Ensure we don't read beyond the end of the packet

media: redrat3: Error path leaves device in transmitting state

media: renesas: rzv2h-ivc: manage runtime PM with devres

media: require two-byte Cypress type 04 records

media: rkvdec: do not destroy borrowed SRAM pool

media: rockchip: rga: fix rotation on rev0 hardware

media: rockchip: rga: quiesce IRQ before releasing m2m state

media: rtl28xxu: fix SDR platform device leak

media: saa7134: Specify rc type at rc_allocate_type()

media: saa7146: Initialize interrupt lock before requesting IRQ

media: serial_ir: Fix race condition where timer can be re-armed

media: sti: delta: use unaligned accessors for MJPEG SOF fields

media: stm32: csi: correct remote pad retrieval

media: stm32: csi: unregister async notifier on cleanup

media: streamzap: Add missing rc_unregister_device()

media: stv0900: bound DiSEqC reply length to msg[] size

media: stv090x: bound DiSEqC reply length to msg[] size

media: sunxi-cir: Ensure no more interrupts can occur before free

media: synopsys: hdmirx: fetch colordepth before calculating pixelclock

media: synopsys: hdmirx: use request_any_context_irq() for 5V detection IRQ

media: tw686x: fix V4L2 device lifetime on probe failure

media: tw68: balance PCI enable on cleanup

media: uvcvideo: Fix NULL deref on events for uninitialized controls

media: v4l2-common: Fix P010 format info

media: v4l2-ctrls: default HEVC SPS chroma format to 4:2:0

media: v4l2-ctrls: do nothing if controls[0] == NULL in cluster functions

media: v4l2-isp: reject zero-sized parameter blocks

media: venus: Fix iova allocation from restrict region

media: verisilicon: rockchip: Fix leaks in init

media: vicodec: fix NULL deref on oversized frame

media: vicodec: fix out-of-bounds write on under-rounded coded dimensions

media: vicodec: make encoder CAPTURE dimensions read-only

media: vicodec: zero-initialize stateful decoder heap buffers

media: vidtv: fix frontend reference leak on unbind

media: vidtv: fix uaf in vidtv_bridge_on_new_pkts_avail

media: vim2m: keep transaction buffer count stable while streaming

media: vimc: sensor: fix pixel_rate type to resolve do_div() warning

media: vivid: cancel svid ctrl work on release

media: vivid: round the height down to the vertical subsampling factor

media: vpif_capture: Fix i2c adapter reference leak in vpif_probe()

media: vpif_display: Fix i2c adapter reference leak in vpif_probe()

mei: vsc: Fix packet CRC computed over pointer size

memory: brcmstb_dpfe: Bounds check DCPU-supplied MSG_ARG_COUNT

memory: brcmstb_dpfe: Fix out-of-bounds access due to DCPU offset

memory: renesas-rpc-if: Mark XSPI_CDD1BUF0 as volatile

memory: stm32_omm: fix child clock leak on set_amcr() error path

mfd: ab8500: Fix child device leaks on probe failure

mfd: bq257xx: Mark self-modifying BQ25792 registers volatile

mfd: da903x: Cancel IRQ work during teardown

mfd: Fix MAX77705 dependency on regmap

mfd: tps65217: Check return value when masking interrupt sources

mfd: tps65217: Fix NULL pointer dereference on IRQ init failure

mfd: tps65217: Use devres for IRQ domain and wake teardown

mfd: twl-core: Unregister the auxiliary platform device on unbind

mfd: wcd934x: Fix NULL pointer dereference on IRQ probe deferral

mfd: wcd934x: set DMA mask on parent to silence "DMA mask not set"

microblaze: don't clobber r3/r4 restored by rt_sigreturn

microblaze: Fix MB_MANAGER build with older binutils

microblaze: preserve the MSR carry flags across signals

microblaze: reserve the ABI argument-home area in the signal frame

microblaze: restore the ABI argument home area below pt_regs (PTO)

MIPS: mm: align hugetlb mappings in arch_get_unmapped_area()

MIPS: mm: do not write a huge TLB entry when the probe misses

misc: fastrpc: Allocate entire reserved memory for Audio PD in probe

misc: fastrpc: fix double-free in fastrpc_map_attach() error path

misc: issei: Fix issei architecture deps

misc: tifm: don't clear dev->driver in tifm_device_remove()

mlxsw: Initialize register query payloads

mm/alloc_tag: account for reserved tag ids in the kernel tag check

mm/damon/core: charge only the part of a region the filter left

mm/damon/core: copy nid for eligible_mem_bp damos quota goal commit

mm/damon/core: filter out damos address filter-split failed region

mm/damon/core: handle extreme memory state in damon_get_node_mem_bp()

mm/damon/core: handle extreme memory state in get_in_active_mem_bp()

mm/damon/core: handle extreme memory state in get_node_memcg_used_bp()

mm/damon/core: handle uninitialized damos_quota_goal->last_psi_total

mm/damon/core: keep the temporal tuner quota over an unmeasured PSI round

mm/damon/core: preserve the quota passed to damon_new_scheme()

mm/damon/core: prevent size quota overflow in the temporal goal tuner

mm/damon/core: skip applying scheme if region split for quota fails

mm/damon/paddr: respect folio end for DAMOS actions except STAT

mm/damon/paddr: respect folio end for DAMOS_STAT

mm/damon/sysfs-schemes: read sysfs_filter->addr_range only once

mm/damon/sysfs: set next refresh jiffies per sysfs context

mm/damon/tests/core-kunit: test committing psi goal to psi goal

mm/damon/vaddr: respect folio end for DAMOS_MIGRATE_{HOT,COLD}

mm/damon/vaddr: respect folio end for DAMOS_STAT

mm/execmem: free ROX cache chunks only when they span an entire vm area

mm/huge_memory: do not touch frozen folios in deferred_split_isolate()

mm/huge_memory: skip zone device folios in madvise_free_huge_pmd()

mm/hugetlb: account migration target folio in per-node NR_HUGETLB vmstat

mm/hugetlb: charge folios to the target mm's memcg

mm/hugetlb: don't clear the resv_map of a VMA whose lock is held

mm/hugetlb: don't leave a uffd-wp marker when zapping an RWP entry

mm/hugetlb: fix endless write fault on a leftover uffd bit

mm/hugetlb: fix subpool minimum reservation rollback

mm/hugetlb: tolerate uffd bits set without uffd for PROT_NONE PTEs

mm/hugetlb: tolerate UFFD_WP markers outside uffd-wp VMAs

mm/hugetlb: unmap the page where the other VMA maps it

mm/hugetlb_cgroup: move per-node usage on cgroup reparenting

mm/hugetlb_cgroup: move per-node usage on cross node migration

mm/ksm: mark migration stores with WRITE_ONCE()

mm/list_lru: don't copy stale shrinker id from non-memcg-aware shrinkers

mm/madvise: add cond_resched() in THP branch of madvise_cold_or_pageout_pte_range()

mm/madvise: atomically clear the young bit on THP MADV_COLD

mm/madvise: reclaim isolated folios if PTE restart fails

mm/madvise: skip zone device folios in cold/pageout PMD range

mm/madvise: use folio_trylock() in the cold/pageout PMD split

mm/madvise: use vm_normal_folio_pmd() in cold/pageout PMD range

mm/memcg: clear folio memcg after changing per memcg stats

mm/memcg: migrate per-node hugetlb lruvec stat together with hugetlb folio

mm/memcontrol: fix data-race on reading jiffies_64

mm/memcontrol: fix stuck FLUSHING_CACHED_CHARGE bit on isolated cpus

mm/memfd: fix hugetlb reservation accounting in error paths

mm/memory: constrain generic_access_phys() to page boundary

mm/mempolicy: apply bind policies against the scoped allocation zone

mm/mempolicy: skip zone device folios when queueing folios

mm/mempolicy: take a cpuset cookie for the interleave node count

mm/mempolicy: use vm_normal_folio_pmd() in queue_folios_pmd()

mm/mglru: fix ineffective memory protection for non-kswapd reclaim

mm/mlock: use a long for the page count in mlock_fixup()

mm/mremap: correctly uncharge accountable VMAs in error path

mm/mremap: fix calling fixup_hugetlb_reservations() on the wrong VMA

mm/mremap: populate calculated fields in vrm state correctly

mm/nommu: reject wrapping ranges in access_remote_vm()

mm/page_alloc: count guard pages as free again when their buddy merges

mm/page_alloc: do not boost watermarks in kdump capture kernels

mm/page_counter: avoid integer overflow in effective_protection()

mm/page_isolation: fix UBSAN shift-out-of-bounds warning

mm/page_isolation: guard compound_order() against racing

mm/page_table_check: skip zero pages

mm/page_vma_mapped: continue past nonmatching huge PMDs

mm/percpu: account full object size for percpu memory allocations

mm/shmem: don't release a swapin-error marker as a swap entry

mm/shmem: report RCU-tasks quiescent states while undoing a range

mm/swap: fix swap_cache_get_folio() returning a folio that left the swap cache

mm/truncate: fix the zeroing end of pagecache_isize_extended()

mm/vma: avoid broken uffd merge on mremap

mm/vma: don't leak the commit charge on mmap failure

mm/vmscan: reclaim every zone in per-node proactive reclaim

mm/zswap: enable zswap_ever_enabled in zswap_pool_create()

mm/zswap: publish the initial pool with list_add_rcu()

mm: disallow ioremap'ing ordinary RAM in generic_access_phys()

mm: hugetlb: drop refcount before freeing on memcg charge failure

mm: hugetlb: return -ENOSPC on memcg charge failure

mm: memcg: redirect stats updates of dying memcgs for all hierarchies

mm: memcg: reparent non-hierarchical lruvec stats on cgroup v2

mm: memcg: skip the RCU lock when the memcg is not dying

mm: memcontrol: raise MEMCG_MAX for charges that fail without reclaiming

mm: multi-gen LRU: fix NULL lruvec->pgdat deref with memcg disabled on cmdline

mm: page_alloc: make defrag_mode retries follow the promoted order

mm: vmscan: don't count per-node proactive reclaim as memory pressure

mm: workingset: use lruvec_page_state_local() to count lru pages

mount: refuse setns() with a shared fs_struct again

mptcp: fix MP_CAPABLE token migration when cloning reqsk

mptcp: fix subflow bitfield misuse

mptcp: reset msk state on early connect failure

mshv_vtl: reject poll files with multiple waitqueues

mtd: amd76xrom: Fix PCI device reference leak in amd76xrom_init_one()

mtd: Call get_wunit() on the master partition

mtd: cfi_cmdset_0002: cap the write-buffer chunk at 256 bytes on an x8 device

mtd: maps: l440gx: Fix double put of the ISA bridge in init_l440gx()

mtd: maps: l440gx: Fix double put of the PM device in init_l440gx()

mtd: maps: pci: balance PCI enable on cleanup

mtd: mtdsuper: Fix MTD device reference leak in mtd_get_sb()

mtd: parsers: qcom: fix offset/size overflow on large partitions

mtd: rawnand: atmel: Fix MCK clock leak in atmel_nand_controller_init()

mtd: rawnand: ndfc: use devm_platform_ioremap_resource()

mtd: rawnand: nuvoton: fix clock cleanup on probe failure

mtd: rawnand: qcom: fix read location register usage in config_nand_cw_read()

mtd: rawnand: sunxi: fix free OOB section offsets

mtd: rawnand: sunxi: reject ECC maximization on small pages

mtd: spi-nor: sfdp: check the length of the SCCR map

mtd: spi-nor: sfdp: check the length of the xSPI Profile 1.0 table

mtd: spi-nor: Unprepare legacy controllers upon RWW wait interruption

net/packet: check TX_RING fragments before memory accounting

net/rds: ib: don't enable IRQs in rds_ib_conn_free()

net/smc: queue the copied chunk when smc_tx_sendmsg() faults

net: bgmac: enable interrupts only after NAPI is ready

net: erspan: set lltx to avoid sch_direct_xmit deadlock

net: gro: don't chain linear parts larger than gso_size into frag_list

net: hisilicon: hisi_femac: Stop the receiver before releasing the RX ring

net: limit priority VLAN untag depth

net: skbuff: don't BUG() on a bad csum_start in skb_copy_and_csum_dev()

net: unix: reject negative max_dgram_qlen values

net: usb: pegasus: check rx pkt_len against the received length

net: wwan: iosm: validate msg_head before indexing msg_ring

netdev: Hide the netdev_priv() origin from GCC in netdev_from_priv()

netdevsim: reject cls_bpf programs bound to another device

netfilter: ctnetlink: fix inverted IPv6 address match in dump filter

netfilter: nf_reject: initialize IPCB at inet ingress

nilfs2: clear dirty flag on bdev buffers on log write failure

nilfs2: fix checkpoint root lifetime on sysfs errors

nilfs2: fix deadlock between nilfs_evict_inode() and find_inode()

nilfs2: force clear dirty state when restoring from the shadow map

nilfs2: ignore non-fatal signals during synchronous log write wait

nilfs2: validate directory position after llseek in readdir

ns: don't add init_ipc_ns and init_net without namespace support

nstree: don't end listns() at an inactive namespace

ntfs3: bound index head insertions by buffer capacity

ntfs3: fix mapping pairs bounds check for alignment

ntfs3: reject empty iomap before reading its LCN

ntfs: add a runlist merge that leaves the source runlist to the caller

ntfs: avoid truncate and writeback deadlock

ntfs: balance the $MFT runlist lock in data extension error paths

ntfs: check the dirty-state commit on remount and unmount

ntfs: do not clear the volume dirty bit during sync

ntfs: do not map a vcn as a hole when its runlist lookup failed

ntfs: do not map an unmappable runlist fragment as a hole

ntfs: do not turn an unmappable runlist fragment into delalloc on write

ntfs: do not use a stale runlist pointer when undoing $MFT extension

ntfs: fail remount on sync errors and keep the dirty bit on SB_FORCE

ntfs: fail the mount when $MFT needs its own extent records

ntfs: fail the mount when $MFT's data size exceeds its allocation

ntfs: fix kmap_local leak in ntfs_check_logfile()

ntfs: fix kunmap_local() of advanced pointers in check_mft_mirror()

ntfs: fix volume flag update races

ntfs: flush the block device when syncing a directory

ntfs: hold the runlist lock while expanding a non-resident attribute

ntfs: include the final partial cluster in sync writes

ntfs: mount hibernated volumes read-only regardless of errors=

ntfs: NULL vol->vol_ino in the load_system_files() error teardown

ntfs: persist the dirty state after the final put_super() commits

ntfs: read MFT writeback bounds under size_lock

ntfs: report block device flush failures from fsync

ntfs: roll back the ACL xattr commit when the WSL mode update fails

ntfs: serialize raw MFT updates against folio writeback

ntfs: set the volume dirty bit unconditionally on metadata changes

ntfs: sync the volume dirty bit with the recorded error state

ntfs: track direct MFT writes until BIO completion

ntfs: trigger page_mkwrite for native 4Kn size extension

ntfs: use fatal_signal_pending() for fallocate interruption checks

ntfs: use sync flag for direct MFT writes

ntfs: validate attribute-list sizes before allocation

ntfs: validate the MFT I/O geometry

ntfs: wait for attribute folio writeback before update

ntfs: write MFT folios through mapped I/O units

ntfs: write MFT mirror data in mapped I/O units

ntfs: write MFT records through containing I/O units

nvme-auth: fail when the controller does not authenticate itself

nvme-rdma: don't complete a request after a bogus remote invalidation

nvme-tcp: fix io_work priority inversion when send_mutex is held

nvme-tcp: start error recovery when read_sock fails

nvme-tcp: validate the TLS handshake timeout

nvme: bound FDP config log reads to the received buffer

nvme: make the DH-HMAC-CHAP secret attributes readable by root only

nvmem: rockchip-otp: Serialize reads

nvmet-auth: fix error handling on CHALLENGE failure

nvmet-fc: only send read data for successful commands

nvmet-fc: Tear down the association when the admin queue allocation fails

nvmet-rdma: fix out-of-bounds write in nvmet_rdma_map_sgl_inline()

nvmet-rdma: reject short connection requests

nvmet-tcp: validate the TLS handshake timeout

nvmet: Finish the blk plug when integrity allocation fails

nvmet: fix preempt of another registrant by the reservation holder

nvmet: free the bvec on file namespace range errors

nvmet: Free the old negotiation state when restarting authentication

nvmet: pci-epf: report transport errors in command completions

nvmet: pci-epf: require SGLs to match the command data length

nvmet: require authentication before property set

nvmet: take subsys->lock while force-reconnecting in nvmet_subsys_attr_qid_max_store()

nvmet: zns: don't leak stale memory in zone management receive

ocfs2/cluster: initialize heartbeat regions before publishing them

ocfs2/cluster: remove zero-address nodes from IP tree on teardown

ocfs2: deal with legacy signed dir index name hash values

ocfs2: deal with legacy signed xattr name hash values

ocfs2: exit recovery thread on mount error path

ocfs2: fix array out of bound access in __ocfs2_find_path()

ocfs2: free replay slots in ocfs2_recovery_exit()

ocfs2: read the xattr entry hash before defragmenting the bucket

ocfs2: reserve metadata for a new xattr block and its value tree

ocfs2: reserve value tree metadata when moving an xattr into the inode

ocfs2: restrict OCFS2_INVALID_SLOT suballoc slot to system inodes

ocfs2: skip uninitialized lockres in ocfs2_mark_lockres_freeing()

ocfs2: snapshot the dentry name while tracing file release

ocfs2: update xattr count before moving bucket entries

ocfs2: use the stored hash when checking xattr bucket collision

panic: allow force_cpu redirect from an NMI

panic: fix redirect CPU race in panic_try_force_cpu()

panic: fix va_list reuse in panic_try_force_cpu()

panic: flatten nmi_panic control flow

panic: kill the "buffer unavailable" redirect fallback

panic: restore variable arguments to nmi_panic()

parisc: eisa_enumerator: Fix out-of-bounds reads of the EEPROM buffer

PCI/AER: Fix memory leak in aer_recover_queue() on kfifo buffer overflow

PCI/DOE: Fix double free of a duplicate feature's sysfs name

PCI/PM: Restore BARs after powering up during enumeration

PCI/pwrctrl: generic: Fix leaking array from of_regulator_bulk_get_all()

PCI/pwrctrl: Only destroy devices created by pwrctrl core

PCI/sysfs: Pass the device name length in UTF-16 code units

PCI: aspeed: Fix clk and PHY leak in aspeed_pcie_port_init() error paths

PCI: Avoid D3 on PLX PEX 8532/8533/8548 downstream ports

PCI: Disable MSI for ULi M1575 EHCI controller

PCI: endpoint: pci-epf-vntb: Manage virtual NTB and PCI bus lifetime

PCI: imx6: Avoid dereferencing a NULL clock name

PCI: pciehp: Make 'pciehp_poll_mode' parameter read-only

PCI: qcom-ep: Deinitialize endpoint on remove

PCI: qcom: Only check bridge nodes for PERST# GPIOs

PCI: rcar-gen4: Limit Max_Read_Request_Size to 256 Bytes

PCI: rockchip-ep: Do not attempt 5.0 GT/s retraining

PCI: rockchip-host: Do not attempt 5.0 GT/s retraining

PCI: rockchip: Drive at 2.5 GT/s, error other speeds

PCI: rzg3s: Disable refclk on probe failure

PCI: rzg3s: Fix IRQ domain initialization error handling

PCI: rzg3s: Propagate platform_get_irq_byname() errors

PCI: Set supported_speeds in set_pcie_port_type()

PCI: Skip Target Speed quirk on clamped ports with no link

PCI: vmd: Flush DMA writes before handling MSI on Arrow Lake

PCI: vmd: Flush DMA writes before handling MSI on Meteor Lake

PCI: xilinx-xdma: Fix device node reference leak in xilinx_pl_dma_pcie_init_irq_domain()

peci: aspeed: Initialize state before requesting IRQ

peci: npcm: Initialize state before requesting IRQ

perf loongarch: Fix discarded const qualifier in _get_field()

perf machine: Fix NULL deref in thread__resolve_callchain_sample()

perf powerpc-vpadtl: Fix off-by-one in auxtrace_info minimum size check

perf python: Free the parse error entries when parsing fails

perf: xgene: initialize lock before requesting IRQ

phy: apple: atc: Support DUMMY PIPEHANDLER state in configure_pipehandler

pidfs: don't let PIDFD_GET_INFO miss a reaped task

pinctrl: renesas: rzt2h: Fix reading pin value in IRQ function

pinctrl: renesas: rzt2h: Fix used_irqs indexing in clear path

pinctrl: renesas: rzt2h: Restore correct pin mode on IRQ free

pinctrl: renesas: rzt2h: Setup IRQ in .irq_{request,release}_resources()

pinctrl: stm32: Fix fwnode reference leak in stm32_gpiolib_register_bank()

platform/x86/amd/pmc: Fix RTC reference leak in amd_pmc_verify_czn_rtc()

platform/x86/amd/pmf: Add AMDI0112 ACPI ID

platform/x86/amd/pmf: Fix power_supply refcount leak in amd_pmf_get_battery_prop()

platform/x86/amd/pmf: Validate the APTS state index

platform/x86/amd: hfi: Fix out-of-bounds reads when parsing ranking data

platform/x86/amd: Stop counting intermediate cycles with metrics table

platform/x86/intel-uncore-freq: Continue restoring limits on resume

platform/x86/intel/pmt: Block mmap when callback is present

platform/x86/intel/vsec: Fix inverted walk_header() test in get_features()

platform/x86/tuxedo: Fix keyboard LED map ordering

platform/x86: asus-wmi: fix screenpad power state detection

platform/x86: asus-wmi: fix TUF keyboard power state shutdown naming

platform/x86: asus-wmi: fix unclear usage of bd->props.power

platform/x86: asus-wmi: Serialize WMI method evaluations with a mutex

platform/x86: hp-bioscfg: allow clearing current_password

platform/x86: hp-bioscfg: fix 16-byte heap overflow for empty auth token

platform/x86: hp-bioscfg: fix non-ASCII truncation in hp_get_string_from_buffer()

platform/x86: hp-bioscfg: fix OOB reads in hp_get_string_from_buffer()

platform/x86: hp-bioscfg: fix slab-out-of-bounds write in hp_convert_hexstr_to_str()

platform/x86: hp-bioscfg: NUL-terminate the SPM auth token

platform/x86: hp-bioscfg: return -E2BIG from validate_password_input()

platform/x86: hp-wmi: fix heap OOB read and memory corruption in hp_wmi_perform_query()

platform/x86: int3472: Fix uninitialised variable warning

platform/x86: int3472: Increase handshake GPIO delay to 200 ms

platform/x86: lenovo-wmi-capdata: Do not stop the AC notifier chain on error

platform/x86: oxpec: Fix Apex charge limit control

platform/x86: simatic-ipc: fix platform device leak on registration failure

PM: CPU: Restore synchronize_rcu() to cpu_pm_unregister_notifier()

PM: EM: allocate the cpumask for every perf domain

posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() signal path

posix-timers: Accept NULL clock_getres() output in stubs

posix-timers: Report zero remaining time for disarmed SIGEV_NONE timers

power: supply: ab8500_fg: Accept status from supplied power

power: supply: ab8500_fg: Report sub-percent charge changes

power: supply: bq27xxx: Ensure poll work is cancelled on remove

power: supply: bq27xxx: synchronize work cancellation on suspend

power: supply: core: Honor supplied-from with CONFIG_OF=y

power: supply: cros_charge-control: restore EC state on resume

power: supply: generic-adc-battery: fix status with no supplier

power: supply: ltc2941: Fix of_node reference leak in ltc294x_i2c_probe()

power: supply: qcom_battmgr: Notify charger supplies of online changes

power: supply: qcom_smbx: fix float voltage selector

power: supply: qcom_smbx: include base when petting watchdog

power: supply: qcom_smbx: notify battery overvoltage recovery

power: supply: qcom_smbx: set the charge enable after software control

power: supply: qcom_smbx: test battery health status bits

power: supply: qcom_smbx: validate battery float voltage

powerpc/bpf: fix alignment of long branch trampoline address

powerpc/bpf: fix buffer overflow in JIT for large BPF programs

powerpc/pseries/iommu: Add TCEs for 16GB pages when RAM is pre-mapped

powerpc64/bpf: fix percpu private stack leak on JIT failure

ppp: fix stale pointer access after pskb_may_pull in ppp_ccp_peek

pppoe: delete session hash entries by pointer match

pps: generators: stop the generator on unregister

proc/task_mmu: handle special PMDs in clear_refs and pagemap

proc: don't let an entry below /proc//net be a mountpoint

pseries/plpks: clear SED key data after use

pseries/plpks: clear sensitive buffers in wrapping operations

pseries/plpks: clear sensitive PLPKS buffers

pseries/plpks: clear signed update authentication buffer

pseries/plpks: fix error code for wrapping key reads

pseries/plpks: fix error handling in plpks_read_var()

pseries/plpks: fix self-reference in plpks_var initializer

pseries/plpks: hide wrapping_features when unsupported

pseries/plpks: validate input to plpks_signed_update_var()

pwm: tiehrpwm: Clear period on disable to allow reconfiguration

r8152: Use BMSR to detect the link state

raid6: add missing vzeroupper to AVX-512 code

raid6: add missing vzeroupper to AVX2 code

RDMA/uverbs: Fix uobject leak in DMABUF release

RDS/IB: validate receive fragment completions

rds: fix out-of-bounds conn_path walks via handshake exthdrs

regulator: core: Fix c_rdev reference leak in regulator_resolve_coupling()

regulator: core: Fix coupled regulators reference leak on removal

regulator: core: Fix rdev reference leak in regulator_resolve_supply()

regulator: rt6190: Fix runtime PM imbalance in rt6190_out_enable()

remoteproc: elf_loader: Bound the section header table

resource: fix lost wakeup when waiting for a muxed region

Revert "Input: matrix_keypad - force switch rows to input mode"

Revert "net: advertise TCP MSS from the configured MTU, not the learned PMTU"

Revert "serial: 8250_port: Drop duplicate NULL check"

ring-buffer: Take cpus_read_lock() when changing the subbuf order

RISC-V: KVM: Fix IPI delivery for out-of-order vcpu_id

riscv: cfi: Bounds check restore token before swap

riscv: cfi: Only write envcfg CSR when task is current

riscv: dts: spacemit: k3: fix IMSIC num-guest-ids

riscv: mm: exclude invalid THP PMDs from page table check

rtc: cmos: Disable ACPI RTC event before handling it

rtc: cmos: Honor explicit use_acpi_alarm parameter value

rtc: pcf8563: pass the driver data to the alarm interrupt handler

rust: dma: declare cfi_encoding for dma_data_direction

rust: hrtimer: declare cfi_encoding for hrtimer_restart

rust: irq: declare cfi_encoding for irqreturn

sched/cache: Honor asym packing over cache aware scheduling on hybrid systems

sched/fair: Reset NUMA fault locality after scan period update

sched: fix stale get_pref_llc() stub for !CONFIG_SCHED_CACHE

sched_ext: Don't leave balance callbacks queued across a pick retry

sched_ext: Don't queue balance callbacks from a core-sched pick

sched_ext: Reset runnable_at when a task leaves its scheduler

scsi: handle out-of-range SG_SET_TIMEOUT values

scsi: libiscsi_tcp: Prevent R2T range check overflow

scsi: sd: Mark the disk dead if runtime resume fails in sd_remove()

scsi: ufs: bsg: Clear the reply buffer before use

scsi: ufs: bsg: Complete the job on error

scsi: ufs: bsg: Reject UIC commands with a non-zero result byte

scsi: ufs: bsg: Validate request_len before accessing request

scsi: ufs: core: Add a helper for clearing hba->outstanding_reqs

scsi: ufs: core: Clear stale UIC result byte before peer DME retries

scsi: ufs: core: Do not release a reserved request in ufshcd_abort()

scsi: ufs: core: Fix a deadlock between clock scaling and device commands

scsi: ufs: core: Fix double completion in ufshcd_clear_lu_cmds()

scsi: ufs: core: Fix double release in ufshcd_eh_timed_out()

scsi: ufs: core: Remove an always-false WARN_ONCE()

scsi: ufs: core: Remove completed-without-interrupt path in ufshcd_abort()

sctp: hold transport reference across connect wait

seccomp: restore knotif->state when SECCOMP_ADDFD_FLAG_SEND is interrupted

selftests/core: fix unshare_test with large fs.nr_open

selftests/filesystems: Fix idmapped_tmpfile layer dir ownership

selftests/landlock: Fix snprintf truncation checks in test files

serial: 8250_exar: store the GPIO platform device in struct exar8250

serial: 8250_lpss: do not touch uninitialized line in ehl_serial_exit()

serial: 8250_omap: set priv->line before enabling the IRQ

serial: amba-pl011: honour delay_rts_before_send for every write

serial: amba-pl011: keep transmitter enabled when disabling RS485

serial: pmac_zilog: push received data to the port that received it

serial: sc16is7xx: declare MCR and IER as volatile registers

serial: sc16is7xx: fix data corruption due to unexpected xon/xoff

sh: intc: Sort the prio and sense lists after filling them

sh: maple: Use the matching IRQ cookie when invoking free_irq()

signalfd: don't dequeue the forced fatal signals

slimbus: messaging: fix leaked PM vote on tid allocation failure

soc: fsl: cpm1: tsa: Fix clock leak in tsa_of_parse_tdms()

soc: fsl: dpio: Fix cleanup on IRQ registration failure

soc: fsl: dpio: Free the IRQ before releasing the I/O object

soc: loongson: loongson2_pm: Fix build warnings for 32BIT

soc: qcom: geni-se: Fix endian conversion for serial_protocol comparison

soc: qcom: geni-se: Fix fw_end computed before round-up; propagate size to caller

soc: qcom: geni-se: Fix write to read-only firmware buffer

soc: qcom: geni-se: Widen fw_size to u32 to prevent wrap-around

soc: qcom: pmic_glink: Fix device access from worker during suspend

soc: samsung: exynos-pmu: fix error paths in cpuhotplug/idle states setup

speakup: Fix NULL pointer dereference on VT switch + selection

spi: amd: fix len==0 underflow and FIFO overflow

spi: amd: validate FIFO usage before executing message

spi: atmel-quadspi: balance runtime PM and pclk across system sleep

spi: bcm-qspi: reject oversized dummy bytes in mspi exec_mem_op

spi: bcm2835: fix device_node reference leak in bcm2835_spi_setup()

spi: cadence-xspi: fix stack buffer overflow in the Marvell b0 path

spi: cadence-xspi: reject SDMA transfers larger than the requested length

spi: ch341: handle transfers without a TX or RX buffer

spi: jcore: fix divide-by-zero when speed_hz is zero

spi: ljca: Don't require data in write replies

spi: ljca: validate the response length before copying the data

spi: npcm-fiu: limit UMA data_size to the 16-byte staging buffer

spi: spi-qpic-snand: publish the ECC context to snandc->qspi

spi: stm32: fix double free of SRAM buffer on MDMA fallback

spi: zynq-qspi: fix address buffer corruption and support 4-byte address

splice: avoid stale f_pos writeback on error

stackdepot: stop preallocating after the final pool

staging: greybus: uart: fix racy TIOCMIWAIT implementation

staging: media: av7110: fix corrupted BER reporting in sp8870

staging: media: av7110: fix sp8870 initialization failure state

staging: media: imx: csc-scaler: fix ipu_image_convert_run leak on queue error

staging: rtl8723bs: fix RX buffer OOB write from device-reported length

statmount: don't copy the reserved empty string past the buffer

svcrdma: Grant credits from the clamped sc_max_requests

tcp: check congestion control restriction first

tcp: fix reordering addition overflow in MTU probing

tcp: limit tcp_tso_rtt_log to a valid shift count

tg3: Invert restart quirk logic to restrict SNP power-down bypass

thermal: intel: int340x: Fix temperature selection around 0 C

thermal: intel: powerclamp: Reject invalid window_size values

tick/nohz: Reevaluate the tick for kicks flushed outside hardirq

time/namespace: Fix overflow when converting absolute deadlines

timekeeping: Require permission to set auxiliary clocks

timekeeping: Update offsets on sequence counter retry in ktime_get_update_offsets_now()

timers/itimer: Keep a nonzero value at CPU timer expiry

tipc: fix broadcast sender hang on last acker departure

tmpfs: fix unicode_map leaks in casefold option handling

tools/dma: fix building from the top level with O=

tpm: fix zero-length read discarding the pending response

tpm: tpm2_probe: propagate transport errors

tpm: tpm_nsc: fix NULL pointer dereference on init failure

tpm: tpm_nsc: stop using the cleanup callback as dev.release

tracing/remotes: Fix TRACE_REMOTE build when TRACING=n

ublk: keep a canceled FETCH round canceling until the server is gone

ublk: let STOP_DEV cancel the server's commands before its release

ublk: mark the batch fetch command cancelable before linking it

ublk: mark the io command cancelable before publishing it

ublk: pin module while release work is pending

ublk: reset the FETCH round in release also without a disk

ublk: reset the FETCH round under ub->mutex

ucount: take the rlimit reference before checking the limit

udf: Make sure there's enough space for LVID implementation use field

udf: validate the device specification EA before using it

USB: cdc-acm: add VeriFone VX820 device ID

USB: cdc-acm: fix urb leak on disconnect

usb: core: don't set drvdata to NULL in usb_unbind_interface()

usb: fotg210: validate endpoint index in ep0 handlers

USB: gadgetfs: do not WARN about excessively large memory allocations

usb: octeon-hcd: keep SOF interrupts while a pipe needs them

usb: octeon-hcd: release the USB block when initialization fails

USB: quirks: add USB_QUIRK_WINDOWS_CONFIG_REQ_SIZE for GameSir G7 SE

USB: serial: option: add Rolling Wireless RN947R

USB: serial: option: add support for ASR 1286:4e3c modem

USB: serial: sierra: fix urb leak on write completion

USB: serial: usb_wwan: fix urb leak on disconnect

usb: typec: ucsi: ccg: Validate altmode index in GET_CURRENT_CAM response

usb: typec: ucsi: Skip CAM query when partner has no alt modes

usb: typec: ucsi_ccg: Add retry mechanism in ccg_read

usb: xhci-pci: Add AMD 600 series to xhci-pci-prom21

usb: xhci: Fix bounce buffer overflow

userfaultfd: fix UFFDIO_MOVE livelock on large folio with extra references

userns: don't drop the exec securebits

veth: fix stale peer max_mtu on XDP program replacement

vfio/mlx5: Fix boundary check in set_report_output()

vfio/pci: Restore 8-byte ioeventfd support

virtio_fs: read the vring size under virtio_fs_mutex in ->get_tree

virtiofs: validate fixed-output response length

wifi: ath11k: Fix possible memory leak in ath11k_dp_srng_setup()

wifi: ath12k: validate MAC/PHY capability count before saving

wifi: brcmsmac: Adjust txpwrindex value in nphy_ipa_rxcal_gaintbl_2GHz

wifi: mac80211: queue frames while off-channel

wifi: mt76: fix memory leak in USB TX path

wifi: mt76: Fix of_node reference leak in mt76_get_rate_power_limits()

wifi: mt76: move the channel survey when the channel changes

wifi: mt76: mt7615: cancel reset work during unregister

wifi: mt76: mt7615: do not tear down BSS/STA state for monitor vifs

wifi: mt76: mt7615: restore DBDC state after ext PHY failure

wifi: mt76: mt76x02: validate TX-status rate index before mac80211 handoff

wifi: mt76: mt7925: cancel mlo_pm_work on the USB stop path

wifi: mt76: mt792x: fix negative errno truncation in offload capability

wifi: mt76: mt792x: fix UAF in SDIO TX path when out of memory

wifi: mt76: mt7996: fix PCI device reference leak in mt7996_pci_init_hif2()

wifi: mt76: take rcu_read_lock in the USB/SDIO tx completion path

wifi: rtw88: fix out-of-bounds CAM write when key table is full

wifi: rtw89: 8851b: fix swapped DPK channel/bandwidth backup fields

wifi: rtw89: cap firmware section_num before parsing

wifi: rtw89: fix IE length passed to cfg80211_find_ie() in WoW AKM

wifi: rtw89: usb: shorten the RX aggregation hold on RTL8922AU over USB 3

writeback: clear old wb dirty state after inode switches

writeback: keep cleanup_offline_cgwb()'s scan out of syncs

writeback: reset dirtied_when when switching wbs

x86/bugs: Fix CONFIG_MITIGATION_RETPOLINE=n mitigation reporting

x86/bugs: Mitigate TSA on AMD Zen5

x86/mm/pat: Use pr_warn() for early W^X warnings

xen-blkfront: Fix IO race during unplug

xen-netback: Fix XenBus connection failure cleanup

xen-netback: Zero out sring pointers on unmap

xen-pciback: Fix pcistub_device ref leak in pcistub_get_gsi_from_sbdf()

xen/gntdev: Fix gntdev_dmabuf ref leak in dmabuf_exp_wait_released()

xen/gntdev: prevent private mappings from becoming writable

xen/pcifront: check that an AER callback exists before calling it

xen/privcmd: Only claim ioreqs matching an ioeventfd

xfarray: don't crash when sorting if array element crosses a folio

xhci: Prevent invalid vdev dereference during sideband unregister

xor: add missing vzeroupper to AVX code

xprtrdma: prevent disconnect feedback during endpoint teardown

xprtrdma: trim head iovec when the payload arrives via a Write chunk

xsk: restore UMEM flags after failed pool assignment

zram: fix idle age_sec underflow in idle_store()