-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 29 Sep 2025 13:28:35 +0200 Source: linux Architecture: source Version: 5.10.244-1 Distribution: bullseye-security Urgency: high Maintainer: Debian Kernel Team <[email protected]> Changed-By: Ben Hutchings <[email protected]> Closes: 1040901 1109891 Changes: linux (5.10.244-1) bullseye-security; urgency=high . * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.238 - ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset - drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill() (CVE-2025-37930) - amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload - wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() (CVE-2025-37990) - dm-integrity: fix a warning on invalid table line - dm: always update the array size in realloc_argv on success - [amd64] iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid (CVE-2025-37927) - [x86] iommu/vt-d: Apply quirk_iommu_igfx for 8086:0044 (QM57/QS57) - tracing: Fix oob write in trace_seq_to_buffer() (CVE-2025-37923) - net/sched: act_mirred: don't override retval if we already lost the skb (CVE-2024-26739) - net/mlx5: E-Switch, Initialize MAC Address for Default GID - net/mlx5: Remove return statement exist at the end of void function - net/mlx5: E-switch, Fix error handling for enabling roce - net_sched: drr: Fix double list add in class with netem as child qdisc (CVE-2025-37915) - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CVE-2025-37890) - net_sched: ets: Fix double list add in class with netem as child qdisc (CVE-2025-37914) - net_sched: qfq: Fix double list add in class with netem as child qdisc (CVE-2025-37913) - net: ipv6: fix UDPv6 GSO segmentation with NAT - bnxt_en: Fix ethtool -d byte order for 32-bit values - nvme-tcp: fix premature queue removal and I/O failover - net: lan743x: Fix memleak issue when GSO enabled (CVE-2025-37909) - [arm*] net: fec: ERR007885 Workaround for conventional TX - [armhf] PCI: imx6: Skip controller_id generation logic for i.MX7D - of: module: add buffer overflow check in of_modalias() (CVE-2024-38541) - [arm64] Revert "drm/meson: vclk: fix calculation of 59.94 fractional rates" (regression in 5.10.219) - [arm*] irqchip/gic-v2m: Add const to of_device_id - [arm*] irqchip/gic-v2m: Mark a few functions __init - [arm*] irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() (CVE-2025-37819) - [arm*] usb: chipidea: ci_hdrc_imx: use dev_err_probe() - [arm*] usb: chipidea: ci_hdrc_imx: implement usb_phy_init() error handling - dm: fix copying after src array boundaries - scsi: target: Fix WRITE_SAME No Data Buffer crash (CVE-2022-21546) - openvswitch: Fix unsafe attribute parsing in output_userspace() (CVE-2025-37998) - can: gw: use call_rcu() instead of costly synchronize_rcu() - rcu/kvfree: Add kvfree_rcu_mightsleep() and kfree_rcu_mightsleep() - can: gw: fix RCU/BH usage in cgw_create_job() - netfilter: ipset: fix region locking in hash types (CVE-2025-37997) - [armhf] net: dsa: b53: allow leaky reserved multicast - [armhf] net: dsa: b53: fix VLAN ID for untagged vlan on bridge leave - [armhf] net: dsa: b53: fix learning on VLAN unaware bridges - [x86] Input: synaptics - enable InterTouch on Dynabook Portege X30-D - [x86] Input: synaptics - enable InterTouch on Dynabook Portege X30L-G - [x86] Input: synaptics - enable InterTouch on Dell Precision M3800 - [x86] Input: synaptics - enable SMBus for HP Elitebook 850 G1 - [x86] Input: synaptics - enable InterTouch on TUXEDO InfinityBook Pro 14 v5 - iio: adc: ad7606: fix serial register access - iio: adis16201: Correct inclinometer channel resolution - iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo (CVE-2025-37970) - iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo (CVE-2025-37969) - [armhf] usb: uhci-platform: Make the clock really optional - xenbus: Use kref to track req lifetime (CVE-2025-37949) - module: ensure that kobject_put() is safe for module type kobjects (CVE-2025-37995) - ocfs2: switch osb->disable_recovery to enum - ocfs2: implement handshaking with ocfs2 recovery thread - ocfs2: stop quota recovery before disabling quotas - [arm*] usb: host: tegra: Prevent host controller crash when OTG port is used - usb: typec: tcpm: delay SNK_TRY_WAIT_DEBOUNCE to SRC_TRYWAIT transition - usb: typec: ucsi: displayport: Fix NULL pointer access (CVE-2025-37994) - USB: usbtmc: use interruptible sleep in usbtmc_read - usb: usbtmc: Fix erroneous get_stb ioctl error returns - usb: usbtmc: Fix erroneous wait_srq ioctl return - usb: usbtmc: Fix erroneous generic_read ioctl return - types: Complement the aligned types with signed 64-bit one - [arm*] drm/panel: simple: Update timings for AUO G101EVN010 - nvme: unblock ctrl state transition for firmware update - do_umount(): add missing barrier before refcount checks in sync case - [x86] platform/x86: asus-wmi: Fix wlan_ctrl_by_user detection - iio: adc: ad7768-1: Fix insufficient alignment of timestamp. - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (CVE-2025-38024) - nfs: handle failure of nfs_get_lock_context in unlock path (CVE-2025-38023) - net_sched: Flush gso_skb list too during ->change() (CVE-2025-37992) - [arm64] net: cadence: macb: Fix a possible deadlock in macb_halt_tx. (CVE-2025-38094) - qlcnic: fix memory leak in qlcnic_sriov_channel_cfg_cmd() - NFSv4/pnfs: Reset the layout state after a layoutreturn - [arm64] ACPI: PPTT: Fix processor subtable walk - [x86] ALSA: es1968: Add error handling for snd_pcm_hw_constraint_pow2() - [arm*] phy: Fix error handling in tegra_xusb_port_init - wifi: mt76: disable napi on driver removal (CVE-2025-38009) - [arm64] dmaengine: ti: k3-udma: Add missing locking (CVE-2025-38005) - [x86] clocksource/i8253: Use raw_spinlock_irqsave() in clockevent_i8253_disable() - [arm*] ASoC: q6afe-clocks: fix reprobing of the driver (CVE-2021-47037) - [x86] drm/vmwgfx: Fix a deadlock in dma buf fence polling (CVE-2024-43863) - usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group (CVE-2024-35790) - usb: typec: fix potential array underflow in ucsi_ccg_sync_control() (CVE-2024-53203) - usb: typec: fix pm usage counter imbalance in ucsi_ccg_sync_control() - btrfs: don't BUG_ON() when 0 reference count at btrfs_lookup_extent_info() (CVE-2024-46751) - netfilter: nf_tables: pass nft_chain to destroy function, not nft_ctx - netfilter: nf_tables: wait for rcu grace period on net_device removal - netfilter: nf_tables: do not defer rule destruction via call_rcu - ice: arfs: fix use-after-free when freeing @rx_cpu_rmap (CVE-2022-49063) - scsi: target: iscsi: Fix timeout on deleted connection (CVE-2025-38075) - dma-mapping: avoid potential unused data compilation warning - cgroup: Fix compilation issue due to cgroup_mutex not being exported - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() - mailbox: use error ret code of of_parse_phandle_with_args() - fbcon: Use correct erase colour for clearing in fbcon - fbdev: core: tileblit: Implement missing margin clearing for tileblit - NFSv4: Treat ENETUNREACH errors as fatal for state recovery - SUNRPC: rpc_clnt_set_transport() must not change the autobind setting - SUNRPC: rpcbind should never reset the port to the value '0' - [arm64] thermal/drivers/qoriq: Power down TMU on system suspend - dql: Fix dql->limit value when reset. - pNFS/flexfiles: Report ENETDOWN as a connection error - libnvdimm/labels: Fix divide error in nd_label_data_init() (CVE-2025-38072) - [x86] mmc: host: Wait for Vdd to settle on card power off - [arm64] i2c: qup: Vote for interconnect bandwidth to DRAM - i2c: pxa: fix call balance of i2c->clk handling routines - btrfs: avoid linker error in btrfs_find_create_tree_block() - btrfs: send: return -ENAMETOOLONG when attempting a path that is too long - ext4: reorder capability check last - scsi: st: Tighten the page format heuristics with MODE SELECT - scsi: st: ERASE does not change tape location - tcp: reorganize tcp_in_ack_event() and tcp_count_delivered() - dm: restrict dm device size to 2^63-512 bytes - [x86] xen: Add support for XenServer 6.1 platform device - posix-timers: Add cond_resched() to posix_timer_add() search loop - netfilter: conntrack: Bound nf_conntrack sysctl writes - [arm64] mm: Check PUD_TYPE_TABLE in pud_bad() - [arm64] tegra: p2597: Fix gpio for vdd-1v8-dis regulator - tcp: bring back NUMA dispersion in inet_ehash_locks_alloc() - [arm*] rtc: ds1307: stop disabling alarms on probe - [armhf] tegra: Switch DSI-B clock parent to PLLD on Tegra114 - dm cache: prevent BUG_ON by blocking retries on failed device resumes (CVE-2025-38066) - orangefs: Do not truncate file size (CVE-2025-38065) - drm/amdgpu: Do not program AGP BAR regs under SRIOV in gfxhub_v1_0.c - media: cx231xx: set device_caps for 417 (CVE-2025-38044) - [armhf] net: ethernet: ti: cpsw_new: populate netdev of_node - net: pktgen: fix mpls maximum labels list parsing - ipv4: fib: Move fib_valid_key_len() to rtm_to_fib_config(). - [arm64] clk: imx8mp: inform CCF of maximum frequency of clocks - [armhf] hwmon: (gpio-fan) Add missing mutex locks - [arm64] PCI: brcmstb: Expand inbound window size up to 64GB - [arm64] PCI: brcmstb: Add a softdep to MIP MSI-X driver - net/mlx5: Avoid report two health errors on same syndrome - [amd64] drm/amdkfd: KFD release_work possible circular locking - [arm64] net: xgene-v2: remove incorrect ACPI_PTR annotation - bonding: report duplicate MAC address in all situations - [x86] nmi: Add an emergency handler in nmi_desc & use it in nmi_shootdown_cpus() - cpuidle: menu: Avoid discarding useful information - libbpf: Fix out-of-bound read - scsi: mpt3sas: Send a diag reset if target reset fails - wifi: rtw88: Fix rtw_init_vht_cap() for RTL8814AU - wifi: rtw88: Fix rtw_init_ht_cap() for RTL8814AU - wifi: rtw88: Fix rtw_desc_to_mcsrate() to handle MCS16-31 - net: pktgen: fix access outside of user given buffer in pktgen_thread_write() (CVE-2025-38061) - [x86] EDAC/ie31200: work around false positive build warning - [armhf] can: c_can: Use of_property_present() to test existence of DT property - eth: mlx4: don't try to complete XDP frames in netpoll - PCI: Fix old_size lower bound in calculate_iosize() too - ACPI: HED: Always initialize before evged - net/mlx5: Modify LSB bitmask in temperature event to include only the first bit - net/mlx5: Apply rate-limiting to high temperature warning - ASoC: ops: Enforce platform maximum on initial value - ASoC: soc-dai: check return value at snd_soc_dai_set_tdm_slot() - pinctrl: devicetree: do not goto err when probing hogs in pinctrl_dt_to_map - media: v4l: Memset argument to 0 before calling get_mbus_config pad op - net/mlx4_core: Avoid impossible mlx4_db_alloc() order value - phy: core: don't require set_mode() callback for phy_get_mode() to work - drm/amd/display: Initial psr_version with correct setting - net/mlx5: Extend Ethtool loopback selftest to support non-linear SKB - net/mlx5e: set the tx_queue_len for pfifo_fast - net/mlx5e: reduce rep rxq depth to 256 for ECPF - ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure(). - wifi: rtw88: Fix download_firmware_validate() for RTL8814AU - [arm64] hwmon: (xgene-hwmon) use appropriate type for the latency value - vxlan: Annotate FDB data races (CVE-2025-38037) - scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine - scsi: st: Restore some drive settings after reset - drm/ast: Find VBIOS mode from regular display size - bpftool: Fix readlink usage in get_fd_type - [x86] perf/amd/ibs: Fix perf_ibs_op.cnt_mask for CurCnt - wifi: rtw88: Don't use static local variable in rtw8822b_set_tx_power_index_by_rate - drm: Add valid clones check - [arm*] pinctrl: meson: define the pull up/down resistor value as 60 kOhm - [x86] ASoC: Intel: bytcr_rt5640: Add DMI quirk for Acer Aspire SW3-013 - [x86] ALSA: hda/realtek: Add quirk for HP Spectre x360 15-df1xxx - nvmet-tcp: don't restore null sk_state_change (CVE-2025-38035) - btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (CVE-2025-38034) - xenbus: Allow PVH dom0 a non-local xenstore - __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (CVE-2025-38058) - xfrm: Sanitize marks before insert - bridge: netfilter: Fix forwarding of fragmented packets - [arm*] net: dwmac-sun8i: Use parsed internal PHY address instead of 1 - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (CVE-2025-38000) - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CVE-2025-38052) - crypto: algif_hash - fix double free in hash_accept (CVE-2025-38079) - padata: do not leak refcount in reorder_work (CVE-2025-38031) - can: bcm: add locking for bcm_op runtime updates (CVE-2025-38004) - can: bcm: add missing rcu read protection for procfs content (CVE-2025-38003) - ALSA: pcm: Fix race of buffer access at PCM OSS layer (CVE-2025-38078) - llc: fix data loss when reading from a socket in llc_ui_recvmsg() - drm/edid: fixed the bug that hdr metadata was not reset - memcg: always call cond_resched() after fn() - mm/page_alloc.c: avoid infinite retries caused by cpuset race - [arm64] spi: spi-fsl-dspi: restrict register range for regmap access - [arm64] spi: spi-fsl-dspi: Halt the module after a new message transfer - [arm64] spi: spi-fsl-dspi: Reset SR flags before sending a new message - [x86] drm/i915/gvt: fix unterminated-string-initialization warning - smb: client: Fix use-after-free in cifs_fill_dirent (CVE-2025-38051) - smb: client: Reset all search buffer pointers when releasing buffer - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (CVE-2025-38001) - coredump: fix error handling for replace_fd() - pid: add pidfd_prepare() - fork: use pidfd_prepare() - coredump: hand a pidfd to the usermode coredump helper (dependency for fixing CVE-2025-4598 in systemd) - HID: quirks: Add ADATA XPG alpha wireless mouse support - nfs: don't share pNFS DS connections between net namespaces - [x86] platform/x86: thinkpad_acpi: Support also NEC Lavie X1475JAS - spi: spi-sun4i: fix early activation - tpm: tis: Double the timeout B to 4s - [x86] platform/x86: fujitsu-laptop: Support Lifebook S2110 hotkeys - [x86] platform/x86: thinkpad_acpi: Ignore battery threshold change event notification - xen/swiotlb: relax alignment requirements - [arm64] perf/arm-cmn: Initialise cmn->cpu earlier https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.239 - [arm64] pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs > 31 - [arm64] pinctrl: armada-37xx: set GPIO output value before setting direction - [x86] acpi-cpufreq: Fix nominal_freq units to KHz in get_max_boost_ratio() - usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE - usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device - usb: usbtmc: Fix timeout value in get_stb - [x86] thunderbolt: Do not double dequeue a configuration request (CVE-2025-38174) - netfilter: nft_socket: fix sk refcount leaks (CVE-2024-46855) - gfs2: gfs2_create_inode error handling fix - perf/core: Fix broken throttling when max_samples_per_tick=1 - [x86] cpu: Sanitize CPUID(0x80000000) output - [arm*] crypto: marvell/cesa - Handle zero-length skcipher requests (CVE-2025-38173) - [arm*] crypto: marvell/cesa - Avoid empty transfer descriptor - crypto: lrw - Only add ecb if it is not already there - crypto: xts - Only add ecb if it is not already there - [arm64] crypto: sun8i-ce - move fallback ahash_request to the end of the struct - [amd64] EDAC/skx_common: Fix general protection fault (CVE-2025-38298) - [x86] mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() - ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions" - [x86] drm/vmwgfx: Add seqno waiter for sync_files - [arm*] firmware: psci: Fix refcount leak in psci_dt_init - [arm*] drm/tegra: rgb: Fix the unbound reference count - [arm64] firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES - wifi: ath11k: fix node corruption in ar->arvifs list (CVE-2025-38293) - f2fs: fix to do sanity check on sbi->total_valid_block_count (CVE-2025-38163) - [armhf] net: ncsi: Fix GCPS 64-bit member variables - wifi: rtw88: do not ignore hardware read error during DPK - f2fs: clean up w/ fscrypt_is_bounce_page() - netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (CVE-2025-38161) - [arm*] clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (CVE-2025-38160) - libbpf: Use proper errno value in nlattr - [armhf] pinctrl: at91: Fix possible out-of-boundary access (CVE-2025-38286) - bpf: Fix WARN() in get_bpf_raw_tp_regs (CVE-2025-38285) - wifi: ath9k_htc: Abort software beacon handling if disabled (CVE-2025-38157) - netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy - vfio/type1: Fix error unwind in migration dirty bitmap allocation - netfilter: nft_tunnel: fix geneve_opt dump - net: usb: aqc111: fix error handling of usbnet read calls (CVE-2025-38153) - net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy - calipso: Don't call calipso functions for AF_INET sk. (CVE-2025-38147) - net: openvswitch: Fix the dead loop of MPLS parse (CVE-2025-38146) - net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames - f2fs: use d_inode(dentry) cleanup dentry->d_inode - f2fs: fix to correct check conditions in f2fs_cross_rename - [arm64] dts: imx8mm-beacon: Fix RTC capacitive load - Squashfs: check return result of sb_min_blocksize (CVE-2025-38415) - nilfs2: add pointer check for nilfs_direct_propagate() - nilfs2: do not propagate ENOENT error from nilfs_btree_propagate() - [arm64] bus: fsl-mc: fix double-free on mc_dev (CVE-2025-38313) - [arm64] dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou - [armhf] soc: aspeed: lpc: Fix impossible judgment condition - [armhf] soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() (CVE-2025-38145) - fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (CVE-2025-38312) - perf ui browser hists: Set actions->thread before calling do_zoom_thread() - backlight: pm8941: Add NULL check in wled_configure() (CVE-2025-38143) - perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3 - perf tests switch-tracking: Fix timestamp comparison - perf record: Fix incorrect --user-regs comments - nfs: clear SB_RDONLY before getting superblock - nfs: ignore SB_RDONLY when remounting nfs - [arm64] dmaengine: ti: Add NULL check in udma_probe() (CVE-2025-38138) - PCI/DPC: Initialize aer_err_info before using it - rtc: Fix offset calculation for .start_secs < 0 - [arm*] usb: renesas_usbhs: Reorder clock handling and power management in probe (CVE-2025-38136) - [armhf] serial: Fix potential null-ptr-deref in mlb_usio_probe() (CVE-2025-38135) - iio: adc: ad7124: Fix 3dB filter frequency reading - vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl() - net: stmmac: platform: guarantee uniqueness of bus_id - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt - net: tipc: fix refcount warning in tipc_aead_encrypt (CVE-2025-38273) - net/mlx4_en: Prevent potential integer overflow calculating Hz - Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION - ice: create new Tx scheduler nodes for new queues only - [x86] vmxnet3: correctly report gso type for UDP tunnels - PM: sleep: Fix power.is_suspended cleanup for direct-complete devices - do_change_type(): refuse to operate on unmounted/not ours mounts (CVE-2025-38498) - pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id() - Input: synaptics-rmi4 - convert to use sysfs_emit() APIs - Input: synaptics-rmi - fix crash with unsupported versions of F34 - ath10k: add atomic protection for device recovery - ath10k: prevent deinitializing NAPI twice - ath10k: snoc: fix unbalanced IRQ enable in crash recovery - scsi: iscsi: Fix incorrect error path labels for flashnode operations - net_sched: sch_sfq: fix a potential crash on gso_skb handling (CVE-2025-38115) - i40e: return false from i40e_reset_vf if reset is in progress - i40e: retry VFLR handling if there is ongoing VF reset - tcp: factorize logic into tcp_epollin_ready() - bpf: Clean up sockmap related Kconfigs - net: Rename ->stream_memory_read to ->sock_is_readable - net: Fix TOCTOU issue in sk_is_readable() (CVE-2025-38112) - macsec: MACsec SCI assignment for ES = 0 - net: mdio: C22 is now optional, EOPNOTSUPP if not provided - net/mdiobus: Fix potential out-of-bounds read/write access (CVE-2025-38111) - net/mlx5: Ensure fw pages are always allocated on same NUMA - net/mlx5: Fix return value when searching for existing flow group - net_sched: prio: fix a race in prio_tune() (CVE-2025-38083) - net_sched: red: fix a race in __red_change() (CVE-2025-38108) - net_sched: tbf: fix a race in tbf_change() - sch_ets: make est_qlen_notify() idempotent - net_sched: ets: fix a race in ets_qdisc_change() (CVE-2025-38107) - fs/filesystems: Fix potential unsigned integer underflow in fs_name() - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (CVE-2025-38352) - [x86] boot/compressed: prefer cc-option for CFLAGS additions - kbuild: Update assembler calls to use proper flags and language target - kbuild: Add KBUILD_CPPFLAGS to as-option invocation - usb: Flush altsetting 0 endpoints before reinitializating them after reset. - [arm64] xen/arm: call uaccess_ttbr0_enable for dm_op hypercall - [x86] iopl: Cure TIF_IO_BITMAP inconsistencies (CVE-2025-38100) - calipso: unlock rcu before returning -EAFNOSUPPORT - net: usb: aqc111: debug info before sanitation - tcp: tcp_data_ready() must look at SOCK_DONE - configfs: Do not override creating attribute file failure in populate_attrs() - [arm*] crypto: marvell/cesa - Do not chain submitted requests - gfs2: move msleep to sleepable context - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() - wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() (CVE-2025-38348) - nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request (CVE-2025-38430) - nfsd: Initialize ssc before laundromat_work to prevent NULL dereference (CVE-2025-38231) - jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (CVE-2025-38337) - wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723 - media: cxusb: no longer judge rbuf when the write fails (CVE-2025-38229) - media: gspca: Add error handling for stv06xx_read_sensor() - media: v4l2-dev: fix error handling in __video_register_device() - [arm64] media: venus: Fix probe error handling - media: videobuf2: use sgtable-based scatterlist wrappers - media: vidtv: Terminating the subsequent process of initialization failure (CVE-2025-38227) - media: vivid: Change the siize of the composing (CVE-2025-38226) - [armhf] 9447/1: arm/memremap: fix arch_memremap_can_ram_remap() - [armhf] omap: pmic-cpcap: do not mess around without CPCAP or OMAP4 - bus: mhi: host: Fix conflict between power_up and SYSERR - [x86] ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 (CVE-2025-38336) - [arm64] bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device - ext4: inline: fix len overflow in ext4_prepare_inline_data (CVE-2025-38222) - ext4: fix calculation of credits for extent tree modification - ext4: factor out ext4_get_maxbytes() - ext4: ensure i_size is smaller than maxbytes - Input: ims-pcu - check record size in ims_pcu_flash_firmware() (CVE-2025-38428) - f2fs: prevent kernel warning due to negative i_nlink from corrupted image (CVE-2025-38219) - f2fs: fix to do sanity check on sit_bitmap_size (CVE-2025-38218) - NFC: nci: uart: Set tty->disc_data only in success path (CVE-2025-38416) - fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var (CVE-2025-38214) - [arm64] clk: meson-g12a: add missing fclk_div2 to spicc - ipc: fix to protect IPCS lookups using RCU (CVE-2025-38212) - mm: fix ratelimit_pages update error in dirty_ratio_handler() - [armhf] mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk - [armhf] mtd: nand: sunxi: Add randomizer configuration before randomizer enable - dm-mirror: fix a tiny race condition - ftrace: Fix UAF when lookup kallsym after ftrace disabled (CVE-2025-38346) - net: ch9200: fix uninitialised access during mii_nway_restart (CVE-2025-38086) - [x86] uio_hv_generic: Use correct size for interrupt and monitor pages - PCI: Fix lock symmetry in pci_slot_unlock() - iio: imu: inv_icm42600: Fix temperature calculation - iio: adc: ad7606_spi: fix reg write value mask - ACPICA: fix acpi operand cache leak in dswstate.c (CVE-2025-38345) - clocksource: Fix the CPUs' choice in the watchdog per CPU verification - ACPICA: Avoid sequence overread in call to strncmp() - ACPICA: fix acpi parse and parseext cache leaks (CVE-2025-38344) - power: supply: bq27xxx: Retrieve again when busy - ACPICA: utilities: Fix overflow check in vsnprintf() - PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() - drm/amdgpu/gfx6: fix CSIB handling - sunrpc: update nextcheck time when adding new cache entries - [arm*] drm/bridge: analogix_dp: Add irq flag IRQF_NO_AUTOEN instead of calling disable_irq() - exfat: fix double free in delayed_free (CVE-2025-38206) - [arm64] drm/msm/hdmi: add runtime PM calls to DDC transfer function - media: uapi: v4l: Fix V4L2_TYPE_IS_OUTPUT condition - drm/amd/display: Add NULL pointer checks in dm_force_atomic_commit() - [arm64] drm/msm/a6xx: Increase HFI response timeout - drm/amdgpu/gfx10: fix CSIB handling - media: uapi: v4l: Change V4L2_TYPE_IS_CAPTURE condition - drm/amdgpu/gfx7: fix CSIB handling - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() - jfs: fix array-index-out-of-bounds read in add_missing_indices (CVE-2025-38204) - sunrpc: fix race in cache cleanup causing stale nextcheck time - ext4: prevent stale extent cache entries caused by concurrent get es_cache - drm/amdgpu/gfx8: fix CSIB handling - drm/amdgpu/gfx9: fix CSIB handling - jfs: Fix null-ptr-deref in jfs_ioc_trim (CVE-2025-38203) - [arm64] drm/msm/dpu: don't select single flush for active CTL blocks - [amd64] drm/amdkfd: Set SDMA_RLCx_IB_CNTL/SWITCH_INSIDE_IB - [arm*] media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() (CVE-2025-38237) - [arm64] thermal/drivers/qcom/tsens: Update conditions to strictly evaluate for IP v2+ - cpufreq: Force sync policy boost with global boost on sysfs update - [arm64] net: macb: Check return value of dma_set_mask_and_coherent() - tipc: use kfree_sensitive() for aead cleanup - emulex/benet: correct command version selection in be_cmd_get_stats() - wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R - sctp: Do not wake readers in __sctp_write_space() - net: dlink: add synchronization for stats update - tcp: always seek for minimal rtt in tcp_rcv_rtt_update() - tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows - ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT - net: atlantic: generate software timestamp just before the doorbell - [arm64] pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name() - [arm64] pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction() - [arm64] pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction() - [arm64] pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() - net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info - wifi: mac80211: do not offer a mesh path if forwarding is disabled - [arm*] clk: rockchip: rk3036: mark ddrphy as critical - scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands - [amd64] iommu/amd: Ensure GA log notifier callbacks finish running before module unload - vxlan: Do not treat dst cache initialization errors as fatal - software node: Correct a OOB check in software_node_get_reference_args() (CVE-2025-38342) - scsi: lpfc: Use memcpy() for BIOS version (CVE-2025-38332) - sock: Correct error checking condition for (assign|release)_proto_idx() - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (CVE-2025-38200) - [armhf] watchdog: da9052_wdt: respect TWDMIN - [arm64] bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value - [armhf] OMAP2+: Fix l4ls clk domain handling in STANDBY - [arm*] tee: Prevent size calculation wraparound on 32-bit kernels - [armhf] Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first" - [x86] platform/x86: dell_rbu: Fix list usage (CVE-2025-38197) - [x86] platform/x86: dell_rbu: Stop overwriting data buffer - drivers/rapidio/rio_cm.c: prevent possible heap overwrite (CVE-2025-38090) - jffs2: check that raw node were preallocated before writing summary (CVE-2025-38194) - jffs2: check jffs2_prealloc_raw_node_refs() result in few other places (CVE-2025-38328) - [x86] scsi: storvsc: Increase the timeouts to storvsc_timeout - selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len - atm: Revert atm_account_tx() if copy_from_iter_full() fails. (CVE-2025-38190) - HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (CVE-2025-38103) - ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card - [x86] ALSA: hda/intel: Add Thinkpad E15 to PM deny list - [x86] ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged - hugetlb: unshare some PMDs when splitting VMAs - mm/hugetlb: unshare page tables during VMA split, not before (CVE-2025-38084) - mm: hugetlb: independent PMD page table shared count (CVE-2024-57883) - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (CVE-2025-38085) - drm/nouveau/bl: increase buffer size to avoid truncate warning - [armhf] hwmon: (occ) Add new temperature sensor type - [armhf] hwmon: (occ) Add soft minimum power cap attribute - [armhf] hwmon: (occ) Rework attribute registration for stack usage - [armhf] hwmon: (occ) fix unaligned accesses - aoe: clean device rq_list in aoedev_downdev() (CVE-2025-38326) - net: ice: Perform accurate aRFS flow match - wifi: carl9170: do not ping device which has failed to load firmware (CVE-2025-38420) - mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (CVE-2025-38324) - atm: atmtcp: Free invalid length skb in atmtcp_c_send(). (CVE-2025-38185) - tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior - tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (CVE-2025-38184) - calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). (CVE-2025-38181) - net: atm: add lec_mutex (CVE-2025-38323) - net: atm: fix /proc/net/atm/lec handling (CVE-2025-38180) - [armhf] dts: am335x-bone-common: Add GPIO PHY reset on revision C3 board - [armhf] dts: am335x-bone-common: Increase MDIO reset deassert time - [armhf] dts: am335x-bone-common: Increase MDIO reset deassert delay to 50ms - [arm64] insn: Add barrier encodings - [arm64] move AARCH64_BREAK_FAULT into insn-def.h - [arm64] insn: add encoders for atomic operations - [arm64] insn: Add support for encoding DSB - [arm64] proton-pack: Expose whether the platform is mitigated by firmware - [arm64] errata: Assume that unknown CPUs _are_ vulnerable to Spectre BHB - [arm64] errata: Add KRYO 2XX/3XX/4XX silver cores to Spectre BHB safe list - [arm64] errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists - [arm64] errata: Add missing sentinels to Spectre-BHB MIDR arrays - [arm64] proton-pack: Expose whether the branchy loop k value - [arm64] spectre: increase parameters that can be used to turn off bhb mitigation individually - [arm64] bpf: Add BHB mitigation to the epilogue for cBPF programs (CVE-2025-37948) - [arm64] bpf: Only mitigate cBPF programs loaded by unprivileged users (CVE-2025-37963) - [arm64] proton-pack: Add new CPUs 'k' values for branch mitigation - net/ipv4: fix type mismatch in inet_ehash_locks_alloc() causing build failure - net: Fix checksum update for ILA adj-transport - bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE - rtc: Improve performance of rtc_time64_to_tm(). Add tests. - rtc: Make rtc_time64_to_tm() support dates before 1970 - net_sched: sch_sfq: annotate data-races around q->perturb_period - net_sched: sch_sfq: handle bigger packets - net_sched: sch_sfq: don't allow 1 packet limit (CVE-2024-57996) - net_sched: sch_sfq: use a temporary work area for validating configuration - net_sched: sch_sfq: move the limit validation - mm/huge_memory: fix dereferencing invalid pmd migration entry (CVE-2025-37958) - [armhf] hwmon: (occ) Fix P10 VRM temp sensors - perf: Fix sample vs do_exit() (CVE-2025-38424) - [arm64] ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (CVE-2025-38320) - bpf: fix precision backtracking instruction iteration - scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.240 - cifs: Fix cifs_query_path_info() for Windows NT servers - NFSv4.2: fix listxattr to return selinux security label - mailbox: Not protect module_put with spin_lock_irqsave - md/md-bitmap: fix dm-raid max_write_behind setting - bcache: fix NULL pointer in cache_set_flush() (CVE-2025-38263) - iio: pressure: zpa2326: Use aligned_s64 for the timestamp - [arm*] usb: common: usb-conn-gpio: use a unique name for usb connector device - usb: Add checks for snprintf() calls in usb_alloc_dev() - usb: cdc-wdm: avoid setting WDM_READ for ZLP-s - usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode - ALSA: hda: Ignore unsol events for cards being shut down - ALSA: hda: Add new pci id for AMD GPU display HD audio controller - ceph: fix possible integer overflow in ceph_zero_objects() - ovl: Check for NULL d_inode() in ovl_dentry_upper() - [x86] VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF (CVE-2023-53259) - [x86] VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify (CVE-2025-38102) - fs/jfs: consolidate sanity checking in dbMount - jfs: validate AG parameters in dbMount() to prevent crashes (CVE-2025-38230) - [armhf] media: omap3isp: use sgtable-based scatterlist wrappers - f2fs: don't over-report free space or inodes in statvfs - RDMA/core: Use refcount_t instead of atomic_t on refcount of iwcm_id_private - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (CVE-2025-38211) - [x86] uio: uio_hv_generic: use devm_kzalloc() for private data alloc - [x86] Drivers: hv: vmbus: Fix duplicate CPU assignments within a device - [x86] Drivers: hv: Rename 'alloced' to 'allocated' - [x86] Drivers: hv: vmbus: Add utility function for querying ring size - [x86] uio_hv_generic: Query the ringbuffer size for device - [x86] uio_hv_generic: Align ring size to system page - net_sched: sch_sfq: reject invalid perturb period (CVE-2025-38193) - i2c: tiny-usb: disable zero-length read messages - i2c: robotfuzz-osif: disable zero-length read messages - atm: clip: prevent NULL deref in clip_push() (CVE-2025-38251) - ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() (CVE-2025-38249) - attach_recursive_mnt(): do not lock the covering tree when sliding something under it - libbpf: Fix null pointer dereference in btf_dump__free on allocation failure - wifi: mac80211: fix beacon interval calculation overflow - vsock/uapi: fix linux/vm_sockets.h userspace compilation errors - atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). (CVE-2025-38245) - Bluetooth: L2CAP: Fix L2CAP MTU negotiation - dm-raid: fix variable in journal device check - btrfs: update superblock's device bytes_used when dropping chunk - HID: wacom: fix memory leak on kobject creation failure - HID: wacom: fix memory leak on sysfs attribute creation failure - HID: wacom: fix kobject reference count leak - [arm*] drm/tegra: Assign plane type before registration - [arm*] drm/tegra: Fix a possible null pointer dereference (CVE-2025-38363) - drm/udl: Unregister device before cleaning up on disconnect - [amd64] drm/amdkfd: Fix race in GWS queue scheduling - [amd64] PCI: hv: Do not set PCI_COMMAND_MEMORY to reduce VM boot time - [arm64] Restrict pagetable teardown to avoid false warning - rtc: cmos: use spin_lock_irqsave in cmos_interrupt - [x86] vsock/vmci: Clear the vmci transport packet properly when initializing it (CVE-2025-38403) - mmc: sdhci: Add a helper function for dump register in dynamic debug mode - usb: typec: altmodes/displayport: do not index invalid pin_assignments (CVE-2025-38391) - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (CVE-2025-38387) - nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (CVE-2025-38400) - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (CVE-2025-38393) - scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() - scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() - scsi: ufs: core: Fix spelling of a sysfs attribute name - RDMA/mlx5: Fix CC counters query for MPV - btrfs: fix missing error handling when searching for inode refs during log replay - [armhf] drm/exynos: fimd: Guard display clock control with runtime PM calls - [arm64] spi: spi-fsl-dspi: Clear completion counter before initiating transfer - [x86] drm/i915/gt: Fix timeline left held on VMA alloc error (CVE-2025-38389) - amd-xgbe: align CL37 AN sequence as per databook - enic: fix incorrect MTU comparison in enic_change_mtu() - rose: fix dangling neighbour pointers in rose_rt_device_down() (CVE-2025-38377) - nui: Fix dma_mapping_error() check - net/sched: Always pass notifications when child class becomes empty (CVE-2025-38350) - [i386] ALSA: sb: Force to disable DMAs once when DMA mode is changed - scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (CVE-2025-38399) - wifi: mac80211: drop invalid source address OCB frames - wifi: ath6kl: remove WARN on bad firmware input (CVE-2025-38406) - ACPICA: Refuse to evaluate a method if arguments are missing (CVE-2025-38386) - rcu: Return early if callback is not specified - regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (CVE-2025-38395) - mtk-sd: Prevent memory corruption from DMA map failure (CVE-2025-38401) - [armhf] drm/v3d: Disable interrupts before resetting the GPU (CVE-2025-38371) - RDMA/mlx5: Fix vport loopback for MPV device - flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes - NFSv4/flexfiles: Fix handling of NFS level errors in I/O - btrfs: propagate last_unlink_trans earlier when doing a rmdir - btrfs: use btrfs_record_snapshot_destroy() during rmdir - [arm64] dpaa2-eth: rename dpaa2_eth_xdp_release_buf into dpaa2_eth_recycle_buf - [arm64] dpaa2-eth: Update dpni_get_single_step_cfg command - [arm64] dpaa2-eth: Update SINGLE_STEP register access - [arm64] net: dpaa2-eth: rearrange variable in dpaa2_eth_get_ethtool_stats - [arm64] dpaa2-eth: fix xdp_rxq_info leak - Logitech C-270 even more broken - usb: typec: displayport: Fix potential deadlock (CVE-2025-38404) - [x86] ACPI: PAD: fix crash in exit_round_robin() (CVE-2024-49935) - media: uvcvideo: Return the number of processed controls - media: uvcvideo: Send control events for partial succeeds - media: uvcvideo: Rollback non processed entities on error - staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() - [arm*] drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (CVE-2025-38467) - perf: Revert to requiring CAP_SYS_ADMIN for uprobes (CVE-2025-38466) - fix proc_sys_compare() handling of in-lookup dentries - netlink: Fix wraparounds of sk->sk_rmem_alloc. (CVE-2025-38465) - tipc: Fix use-after-free in tipc_conn_close(). (CVE-2025-38464) - vsock: Fix transport_{g2h,h2g} TOCTOU (CVE-2025-38462) - vm_sockets: Add flags field in the vsock address data structure - vm_sockets: Add VMADDR_FLAG_TO_HOST vsock flag - af_vsock: Set VMADDR_FLAG_TO_HOST flag on the receive path - af_vsock: Assign the vsock transport considering the vsock address flags - vsock: Fix transport_* TOCTOU (CVE-2025-38461) - vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` - net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap - net: phy: smsc: Fix link failure in forced mode with Auto-MDIX - atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (CVE-2025-38460) - atm: clip: Fix memory leak of struct clip_vcc. (CVE-2025-38546) - atm: clip: Fix infinite recursive call of clip_push(). (CVE-2025-38459) - atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (CVE-2025-38458) - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CVE-2025-38457) - fs/proc: do_task_stat: use __for_each_thread() - rxrpc: Fix oops due to non-existence of prealloc backlog struct (CVE-2025-38514) - [amd64] Mitigate Indirect Target Selection (CVE-2024-28956): + Documentation: x86/bugs/its: Add ITS documentation + x86/bhi: Define SPEC_CTRL_BHI_DIS_S + x86/its: Enumerate Indirect Target Selection (ITS) bug + x86/alternatives: Introduce int3_emulate_jcc() + x86/alternatives: Teach text_poke_bp() to patch Jcc.d32 instructions + x86/its: Add support for ITS-safe indirect thunk + x86/alternative: Optimize returns patching + x86/alternatives: Remove faulty optimization + x86/its: Add support for ITS-safe return thunk + x86/its: Fix undefined reference to cpu_wants_rethunk_at() + x86/its: Enable Indirect Target Selection mitigation + x86/its: Add "vmexit" option to skip mitigation on some CPUs + x86/modules: Set VM_FLUSH_RESET_PERMS in module_alloc() + x86/its: Use dynamic thunks for indirect branches + x86/its: Fix build errors when CONFIG_MODULES=n + x86/its: FineIBT-paranoid vs ITS - [x86] mce/amd: Fix threshold limit reset - [x86] mce: Don't remove sysfs if thresholding sysfs init fails - [x86] mce: Make sure CMCI banks are cleared during shutdown on Intel - [arm64] pinctrl: qcom: msm: mark certain pins as invalid for interrupts (CVE-2025-38516) - drm/sched: Increment job count before swapping tail spsc queue (CVE-2025-38515) - usb: gadget: u_serial: Fix race condition in TTY wakeup (CVE-2025-38448) - ethernet: atl1: Add missing DMA mapping error checks and count errors - netlink: Fix rmem check in netlink_broadcast_deliver(). - netlink: make sure we allow at least one dump skb - [x86] Input: xpad - add support for Amazon Game Controller - [x86] Input: xpad - add VID for Turtle Beach controllers - [x86] Input: xpad - support Acer NGR 200 Controller - dma-buf: fix timeout handling in dma_resv_wait_timeout v2 - wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (CVE-2025-38513) - md/raid1: Fix stack memory use after return in raid1_reshape (CVE-2025-38445) - net: appletalk: Fix device refcount leak in atrtr_create() (CVE-2025-38542) - net: phy: microchip: limit 100M workaround to link-down events on LAN88xx - bnxt_en: Fix DCB ETS validation - bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (CVE-2025-38439) - [x86] atm: idt77252: Add missing `dma_map_error()` - net: usb: qmi_wwan: add SIMCom 8230C composition - vt: add missing notification when switching back to text mode - HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY - HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (CVE-2025-38540) - Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID - vhost-scsi: protect vq->log_used with vq->mutex (CVE-2025-38074) - [i386] mm: Disable hugetlb page table sharing on 32-bit - [x86] Mitigate Transient Scheduler Attacks (CVE-2024-36350, CVE-2024-36357): - x86/bugs: Rename MDS machinery to something more generic - x86/bugs: Add a Transient Scheduler Attacks mitigation - KVM: x86: add support for CPUID leaf 0x80000021 - KVM: SVM: Advertise TSA CPUID bits to guests - x86/process: Move the buffer clearing before MONITOR - rseq: Fix segfault on registration when rseq_cs is non-zero (CVE-2025-38067) https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.241 - [arm64] phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (CVE-2025-38535) - USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition - USB: serial: option: add Foxconn T99W640 - USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI - usb: gadget: configfs: Fix OOB read on empty string write (CVE-2025-38497) - [armhf] i2c: stm32: fix the device used for the DMA map - [x86] thunderbolt: Fix bit masking in tb_dp_port_set_hops() - [x86] Input: xpad - set correct controller type for Acer NGR200 - [i386] pch_uart: Fix dma_sync_sg_for_device() nents value - HID: core: ensure the allocated report buffer can contain the reserved report ID (CVE-2025-38495) - HID: core: ensure __hid_request reserves the report ID as the first byte - HID: core: do not bypass hid_hw_raw_request (CVE-2025-38494) - phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() - af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() - af_packet: fix soft lockup issue caused by tpacket_snd() - [armhf] dmaengine: nbpfaxi: Fix memory corruption in probe() (CVE-2025-38538) - isofs: Verify inode mode when loading from disk - memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() - [arm*] mmc: bcm2835: Fix dma_unmap_sg() nents value - [x86] mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models - [armhf] soc: aspeed: lpc-snoop: Cleanup resources in stack-order - [armhf] soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (CVE-2025-38487) - iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] - iio: adc: max1363: Reorder mode_list[] entries - [i386] comedi: pcl812: Fix bit shift out of bounds (CVE-2025-38530) - [i386] comedi: aio_iiro_16: Fix bit shift out of bounds (CVE-2025-38529) - [i386] comedi: das16m1: Fix bit shift out of bounds (CVE-2025-38483) - [i386] comedi: das6402: Fix bit shift out of bounds (CVE-2025-38482) - [x86] comedi: Fix some signed shift left operations - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (CVE-2025-38480) - comedi: Fix initialization of data for instructions that write to subdevice (CVE-2025-38478) - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CVE-2025-38477) - rpl: Fix use-after-free in rpl_do_srh_inline(). (CVE-2025-38476) - hwmon: (corsair-cpro) Validate the size of the received input buffer (CVE-2025-38548) - usb: net: sierra: check for no status endpoint (CVE-2025-38474) - Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (CVE-2025-38473) - Bluetooth: SMP: If an unallowed command is received consider it a failure - Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout - Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU - net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (CVE-2025-38470) - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (CVE-2025-38468) - usb: hub: fix detection of high tier USB3 devices behind suspended hubs - usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm - usb: hub: Fix flushing of delayed work used for post resume purposes - [arm*] usb: musb: Add and use inline functions musb_{get,set}_state - [arm*] usb: musb: fix gadget state on disconnect - [arm64] usb: dwc3: qcom: Don't leave BCR asserted - [arm64] ASoC: fsl_sai: Force a software reset when starting in consumer mode - mm/vmalloc: leave lazy MMU mode on PTE mapping error - virtio-net: ensure the received length does not exceed allocated size (CVE-2025-38375) - [arm*] xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS - regulator: core: fix NULL dereference on unbind due to stale coupling data (CVE-2025-38668) - RDMA/core: Rate limit GID cache warning messages - i40e: Add rx_missed_errors for buffer exhaustion - i40e: report VF tx_dropped with tx_errors instead of tx_discards - net: appletalk: Fix use-after-free in AARP proxy probe (CVE-2025-38666) - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class - [arm64] net: hns3: refine the struct hane3_tc_info - [arm64] net: hns3: fixed vf get max channels bug - [arm64] i2c: qup: jump out of the loop in case of timeout (CVE-2025-38671) - [x86] ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx - e1000e: disregard NVM checksum on tgp when valid checksum bit is not set - e1000e: ignore uninitialized checksum word on tgp - gve: Fix stuck TX queue for DQ queue format - nilfs2: reject invalid file types when reading inodes (CVE-2025-38663) - [amd64] x86/bugs: Fix use of possibly uninit value in amd_check_tsa_microcode() - comedi: comedi_test: Fix possible deletion of uninitialized timers - ALSA: hda: Add missing NVIDIA HDA codec IDs - [arm*] usb: chipidea: add USB PHY event - [armhf] usb: phy: mxs: disconnect line when USB charger is attached - fs_context: fix parameter name in infofc() macro - hfsplus: remove mutex_lock check in hfsplus_free_extents (CVE-2025-38650) - ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask() - ASoC: ops: dynamically allocate struct snd_ctl_elem_value - staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (CVE-2025-38612) - pps: fix poll support - [armhf] dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface - [arm64] dts: imx8mm-beacon: Fix HS400 USDHC clock speed - cpufreq: Initialize cpufreq-based frequency-invariance later - cpufreq: Init policy->rwsem before it may be possibly used - [arm*] drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (CVE-2025-38608) - bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure - wifi: rtl818x: Kill URBs before clearing tx status queue (CVE-2025-38604) - wifi: iwlwifi: Fix memory leak in iwl_mvm_init() - iwlwifi: Add missing check for alloc_ordered_workqueue (CVE-2025-38602) - wifi: ath11k: clear initialized flag for deinit-ed srng lists (CVE-2025-38601) - tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range - drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value - netfilter: nf_tables: adjust lockdep assertions handling - net/sched: Restrict conditions for adding duplicating netems to qdisc tree (CVE-2025-38553) - net_sched: act_ctinfo: use atomic64_t for three counters - xen/gntdev: remove struct gntdev_copy_batch from stack - wifi: rtl8xxxu: Fix RX skb size for aggregation disabled - mwl8k: Add missing check after DMA map - wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() - Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" - wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE - can: kvaser_usb: Assign netdev.dev_port based on device channel index - netfilter: xt_nfacct: don't assume acct name is null-terminated (CVE-2025-38639) - vrf: Drop existing dst reference in vrf_ip6_input_dst - [arm64] PCI: rockchip-host: Fix "Unexpected Completion" log message - [arm*] crypto: marvell/cesa - Fix engine load inaccuracy - mtd: fix possible integer overflow in erase_xfer() - [armhf] clk: davinci: Add NULL check in davinci_lpsc_clk_register() (CVE-2025-38635) - [arm*] pinctrl: sunxi: Fix memory leak on krealloc failure - [arm64] crypto: inside-secure - Fix `dma_unmap_sg()` nents value - crypto: ccp - Fix crash when rebind ccp device for ccp.ko (CVE-2025-38581) - [armhf] clk: sunxi-ng: v3s: Fix de clock definition - scsi: mvsas: Fix dma_unmap_sg() nents value - [x86] scsi: isci: Fix dma_unmap_sg() nents value - soundwire: stream: restore params when prepare ports fail - fs/orangefs: Allow 2 more characters in do_c_string() - [arm*] dmaengine: mv_xor: Fix missing check after DMA map and missing unmap - [x86] crypto: qat - fix seq_file position update in adf_ring_next() - jfs: fix metapage reference count leak in dbAllocCtl - vhost-scsi: Fix log flooding with target does not exist errors - bpf: Check flow_dissector ctx accesses are aligned - apparmor: ensure WB_HISTORY_SIZE value is a power of 2 - module: Restore the moduleparam prefix length check - [arm*] rtc: ds1307: fix incorrect maximum clock rate handling - [arm64] rtc: pcf85063: fix incorrect maximum clock rate handling - [arm*] rtc: pcf8563: fix incorrect maximum clock rate handling - f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (CVE-2025-38578) - f2fs: fix to avoid panic in f2fs_evict_inode (CVE-2025-38577) - f2fs: fix to avoid out-of-boundary access in devs.path (CVE-2025-38652) - scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume - pNFS/flexfiles: Avoid spurious layout returns in ff_layout_choose_ds_for_read - pNFS/flexfiles: don't attempt pnfs on fatal DS errors - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CVE-2025-39730) - NFSv4.2: another fix for listxattr - mm: extract might_alloc() debug check - XArray: Add calls to might_alloc() - NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY - netpoll: prevent hanging NAPI when netcons gets enabled - phy: mscc: Fix parsing of unicast frames - pptp: ensure minimal skb length in pptp_xmit() (CVE-2025-38574) - ipv6: reject malicious packets in ipv6_gso_segment() (CVE-2025-38572) - net: drop UFO packets in udp_rcv_segment() (CVE-2025-38622) - benet: fix BUG when creating VFs (CVE-2025-38569) (regression in 5.10.235) - ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() - smb: client: let recv_done() cleanup before notifying the callers. - pptp: fix pptp_xmit() error path - perf/core: Don't leak AUX buffer refcount on allocation failure - perf/core: Exit early on perf_mmap() fail (CVE-2025-38565) - perf/core: Prevent VMA split of buffer mappings (CVE-2025-38563) - net/packet: fix a race in packet_set_ring() and packet_notifier() (CVE-2025-38617) - vsock: Do not allow binding to VMADDR_PORT_ANY (CVE-2025-38618) - USB: serial: option: add Foxconn T99W709 - mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery - usb: gadget : fix use-after-free in composite_dev_cleanup() (CVE-2025-38555) - io_uring: don't use int for ABI - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (CVE-2025-38729) - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (CVE-2025-39757) - netlink: avoid infinite retry looping in netlink_unicast() (CVE-2025-38727) - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CVE-2025-38724) - NFSD: detect mismatch of file handle and delegation stateid in OPEN op - fs: Prevent file descriptor table allocations exceeding INT_MAX (CVE-2025-39756) - ACPI: processor: perflib: Fix initial _PPC limit application - ACPI: processor: perflib: Move problematic pr->performance check - udp: also consider secpath when evaluating ipsec use for checksumming - netfilter: ctnetlink: fix refcount leak on table dump (CVE-2025-38721) - sctp: linearize cloned gso packets in sctp_rcv (CVE-2025-38718) - [x86] intel_idle: Allow loading ACPI tables for any family - cpuidle: governors: menu: Avoid using invalid recent intervals data - hfs: fix slab-out-of-bounds in hfs_bnode_read() (CVE-2025-38715) - hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (CVE-2025-38714) - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (CVE-2025-38713) - hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (CVE-2025-38712) - udf: Verify partition map count - drbd: add missing kref_get in handle_write_conflicts (CVE-2025-38708) - hfs: fix not erasing deleted b-tree node issue - ata: libata-sata: Disallow changing LPM state if not supported - securityfs: don't pin dentries twice, once is enough... - usb: xhci: print xhci->xhc_state when queue_command failed - [arm64] cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag - usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default - usb: xhci: Avoid showing warnings for dying controller - usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command - usb: xhci: Avoid showing errors during surprise removal - cpufreq: Exit governor when failed to start old governor - [armhf] rockchip: fix kernel hang during smp initialization (CVE-2025-39752) - ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed - [armhf] tegra: Use I/O memcpy to write to IRAM (CVE-2025-39794) - PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() - thermal: sysfs: Return ENODATA instead of EAGAIN for reads - PM: sleep: console: Fix the black screen issue - ACPI: processor: fix acpi_object initialization - [arm64] mmc: sdhci-msm: Ensure SD card power isn't ON when card removed - ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path - [x86] bugs: Avoid warning when overriding return thunk - [x86] ASoC: hdac_hdmi: Rate limit logging on connection and disconnection - [x86] ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 - ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (CVE-2025-38706) - usb: core: usb_submit_urb: downgrade type check - [x86] pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() - [arm64] platform/chrome: cros_ec_typec: Defer probe on missing EC parent - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CVE-2025-39751) - ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop - ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros - iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement - ASoC: codecs: rt5640: Retry DEVICE_ID verification - xen/netfront: Fix TX response spurious interrupts - wifi: cfg80211: reject HTC bit for management frames - be2net: Use correct byte order and format string for TCP seq and ack_seq - et131x: Add missing check after DMA map - rcu: Protect ->defer_qs_iw_pending from data race (CVE-2025-39749) - wifi: cfg80211: Fix interface type validation - net: ipv4: fix incorrect MTU in broadcast routes - [arm64] net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() - wifi: iwlwifi: mvm: fix scan request validation - [arm*] net: fec: allow disable coalescing - drm/amd/display: Separate set_gsl from set_gsl_source_select - wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() - wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect - drm/amd/display: Fix 'failed to blank crtc!' - wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. - netmem: fix skb_frag_address_safe with unreadable skbs - wifi: iwlegacy: Check rate_idx range after addition - net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs - gve: Return error for unknown admin queue command - [armhf] net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 - [armhf] net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 - [armhf] net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 - wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() - [armhf] net: ncsi: Fix buffer overflow in fetching version id - drm/ttm: Should to return the evict error - uapi: in6: restore visibility of most IPv6 socket options - [amrhf] net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 - vhost: fail early when __vhost_add_used() fails - cifs: Fix calling CIFSFindFirst() for root path without msearch - ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (CVE-2025-38701) - scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated (CVE-2025-38700) - fs/orangefs: use snprintf() instead of sprintf() - [arm*] watchdog: dw_wdt: Fix default timeout - scsi: bfa: Double-free fix (CVE-2025-38699) - jfs: truncate good inode pages when hard link is 0 (CVE-2025-39743) - jfs: Regular file corruption check (CVE-2025-38698) - jfs: upper bound check of tree index in dbAllocAG (CVE-2025-38697) - [amd64] RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (CVE-2025-39742) - RDMA/core: reduce stack using in nldev_stat_get_doit() - scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (CVE-2025-38695) - scsi: mpt3sas: Correctly handle ATA device errors - [armhf] pinctrl: stm32: Manage irq affinity settings - media: usb: hdpvr: disable zero-length read messages - media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (CVE-2025-38694) - media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (CVE-2025-38693) - media: uvcvideo: Fix bandwidth issue for Alcor camera - md: dm-zoned-target: Initialize return variable r to avoid uninitialized use - [arm*] rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 - dm-mpath: don't print the "loaded" message if registering fails - i2c: Force DLL0945 touchpad i2c freq to 100khz - scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans - scsi: aacraid: Stop using PCI_IRQ_AFFINITY - ipmi: Use dev_warn_ratelimited() for incorrect message warnings - ipmi: Fix strcpy source and destination the same - net: phy: smsc: add proper reset flags for LAN8710A - block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (CVE-2025-39795) - pNFS: Fix stripe mapping in block/scsi layout - pNFS: Fix disk addr range check in block/scsi layout - pNFS: Handle RPC size limit for layoutcommits - pNFS: Fix uninited ptr deref in block/scsi layout (CVE-2025-38691) - [arm*] rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe - scsi: lpfc: Remove redundant assignment to avoid memory leak - ASoC: soc-dai.c: add missing flag check at snd_soc_pcm_dai_probe() - [arm64] ASoC: fsl_sai: replace regmap_write with regmap_update_bits - drm/amdgpu: fix incorrect vm flags to map bo - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CVE-2025-39760) - misc: rtsx: usb: Ensure mmc child device is active when card is present - usb: typec: ucsi: Update power_supply on power role change - comedi: fix race between polling and detaching (CVE-2025-38687) - [x86] thunderbolt: Fix copy+paste error in match_service_id() - btrfs: fix log tree replay failure due to file with 0 links and extents - mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() (CVE-2025-39737) - mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock (CVE-2025-39736) - media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (CVE-2025-38680) - media: uvcvideo: Do not mark valid metadata as invalid - serial: 8250: fix panic due to PSLVERR (CVE-2025-39724) - [x86] usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() - [arm*] usb: dwc3: meson-g12a: fix device leaks at unbind - bus: mhi: host: Fix endianness of BHI vector table - vt: keyboard: Don't process Unicode characters in K_OFF mode - vt: defkeymap: Map keycodes above 127 to K_HOLE - ext4: check fast symlink for ea_inode correctly - ext4: fix fsmap end of range reporting with bigalloc - ext4: fix reserved gdt blocks handling in fsmap - ata: libata-scsi: Fix ata_to_sense_error() status handling - wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() - wifi: ath11k: fix source ring-buffer corruption - PCI: endpoint: Fix configfs group list head handling (CVE-2025-39783) - jbd2: prevent softlockup in jbd2_log_do_checkpoint() (CVE-2025-39782) - [arm*] soc/tegra: pmc: Ensure power-domains are in a known state - media: gspca: Add bounds checking to firmware parser - [armhf] media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() - media: usbtv: Lock resolution while streaming (CVE-2025-39714) - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (CVE-2025-39713) - [arm*] media: venus: Add a check for packet size after reading from shared memory (CVE-2025-39710) - drm/amd: Restore cached power limit during resume - net, hsr: reject HSR frame if skb can't hold tag (CVE-2025-39703) - sch_htb: make htb_qlen_notify() idempotent (CVE-2025-37932) - sch_drr: make drr_qlen_notify() idempotent - sch_hfsc: make hfsc_qlen_notify() idempotent (CVE-2025-38177) - sch_qfq: make qfq_qlen_notify() idempotent - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CVE-2025-37798) - sch_htb: make htb_deactivate() idempotent - memstick: Fix deadlock by moving removing flag earlier - mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency - squashfs: fix memory leak in squashfs_fill_super - ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 - drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 - drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. - drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs - drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs - fs/buffer: fix use-after-free when call bh_read() helper (CVE-2025-39691) - move_mount: allow to add a mount into an existing group - use uniform permission checks for all mount propagation changes - ftrace: Also allocate and copy hash for reading of filter files (CVE-2025-39689) - iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() - iio: proximity: isl29501: fix buffered read on big-endian systems - usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive - USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera - usb: storage: realtek_cr: Use correct byte order for bcs->Residue - USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles - [arm*] usb: dwc3: Ignore late xferNotReady event to prevent halt timeout - f2fs: fix to do sanity check on ino and xnid (CVE-2025-38347) - iio: hid-sensor-prox: Fix incorrect OFFSET calculation - [x86] mce/amd: Add default names for MCA banks and blocks - usb: hub: avoid warm port reset during USB3 disconnect - usb: hub: Don't try to recover devices lost during warm reset. - smb: client: fix use-after-free in crypt_message when using async crypto (CVE-2025-38488) - tracing: Add down_write(trace_event_sem) when adding trace event (CVE-2025-38539) - pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov - ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (CVE-2025-38664) - drm/sched: Remove optimization that causes hang when killing dependent jobs - mm/zsmalloc.c: convert to use kmem_cache_zalloc in cache_alloc_zspage() - [x86] fpu: Delay instruction pointer fixup until after warning - ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() - net: usbnet: Avoid potential RCU stall on LINK_CHANGE event - usb: typec: fusb302: cache PD RX state - PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports - block: Make REQ_OP_ZONE_FINISH a write operation - [x86] hv_netvsc: Fix panic during namespace deletion with VF (CVE-2025-38683) - USB: cdc-acm: do not log successful probe on later errors - cdc-acm: fix race between initial clearing halt and open - comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (CVE-2025-38481) - ptp: Fix possible memory leak in ptp_clock_register() (CVE-2021-47455) - block: don't call rq_qos_ops->done_bio if the bio isn't tracked (CVE-2021-47412) - btrfs: fix deadlock when cloning inline extents and using qgroups (CVE-2021-46987) - [armhf] 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS - [arm64] dpaa2-mac: split up initializing the MAC object from connecting to it - [arm64] dpaa2-mac: export MAC counters even when in TYPE_FIXED - [arm64] dpaa2-eth: retry the probe when the MAC is not yet discovered on the bus - [arm64] dpaa2-eth: Fix device reference count leak in MAC endpoint handling - mm: drop the assumption that VM_SHARED always implies writable - mm: update memfd seal write check to include F_SEAL_WRITE - mm: reinstate ability to map write-sealed memfd mappings read-only - dma-buf: insert memory barrier before updating num_fences (CVE-2025-38095) - drm/amdgpu: handle the case of pci_channel_io_frozen only in amdgpu_pci_resume (CVE-2021-47421) - RDMA/rxe: Return CQE error if invalid lkey was supplied (CVE-2021-47076) - scsi: lpfc: Fix link down processing to address NULL pointer dereference (CVE-2021-47183) - scsi: pm80xx: Fix memory leak during rmmod (CVE-2021-47193) - NFS: Don't set NFS_INO_REVAL_PAGECACHE in the inode cache validity - NFSv4: Fix nfs4_bitmap_copy_adjust() - NFS: Create an nfs4_server_set_init_caps() function - NFS: Fix the setting of capabilities when automounting a new filesystem (CVE-2025-39798) - net/sched: sch_ets: properly init all active DRR list handles - net_sched: sch_ets: implement lockless ets_dump() - net/sched: ets: use old 'nbands' while purging unused classes (CVE-2025-38684) - mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() (CVE-2025-38681) - ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig - [arm*] scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (CVE-2025-39788) - iio: adc: ad_sigma_delta: change to buffer predisable - [arm64] soc: qcom: mdt_loader: Ensure we don't read past the ELF header (CVE-2025-39787) - [armhf] usb: musb: omap2430: fix device leak at unbind - btrfs: populate otime when logging an inode item - ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value (CVE-2022-50327) - minmax: add umin(a, b) and umax(a, b) - ext4: fix hole length calculation overflow in non-extent inodes - [arm*] platform/chrome: cros_ec: Make cros_ec_unregister() return void - [arm*] platform/chrome: cros_ec: Use per-device lockdep key - [arm*] platform/chrome: cros_ec: remove unneeded label and if-condition - [arm*] platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() - locking/barriers, kcsan: Support generic instrumentation - asm-generic: Add memory barrier dma_mb() - wifi: ath11k: fix dest ring-buffer corruption when ring is full - media: v4l2-ctrls: always copy the controls on completion - media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() - [arm*} media: venus: don't de-reference NULL pointers at IRQ time - [arm*} media: venus: hfi: explicitly release IRQ during teardown - [arm*} media: venus: Add support for SSR trigger using fault injection - [arm*} media: venus: protect against spurious interrupts during probe (CVE-2025-39709) - drm/amd/display: Don't overclock DCE 6 by 15% - f2fs: fix to avoid out-of-boundary access in dnode page (CVE-2025-38677) - [arm*] media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. - [x86] uio_hv_generic: Fix another memory leak in error handling paths (CVE-2021-47070) - dm: rearrange core declarations for extended use from dm-zone.c - dm rq: don't queue request to blk-mq during DM suspend (CVE-2021-47498) - [arm*] usb: dwc3: Remove DWC3 locking during gadget suspend/resume - [arm*] usb: dwc3: core: remove lock of otg mode during gadget suspend/ resume to avoid deadlock - [arm*] gpio: rcar: Use raw_spinlock to protect register access (CVE-2025-21912) - net: usbnet: Fix the wrong netif_carrier_on() call - compiler: remove __ADDRESSABLE_ASM{_STR,}() again - usb: xhci: Fix slot_id resource race conflict - iio: imu: inv_icm42600: change invalid data error to -EBUSY - tracing: Remove unneeded goto out logic - tracing: Limit access to parser->buffer when trace_get_user failed (CVE-2025-39683) - iio: light: as73211: Ensure buffer holes are zeroed (CVE-2025-39687) - mm/page_alloc: detect allocation forbidden by cpuset and bail out early - cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key - scsi: qla4xxx: Prevent a potential error pointer dereference (CVE-2025-39676) - [amd64] iommu/amd: Avoid stack buffer overflow from kernel cmdline (CVE-2025-38676) - mlxsw: spectrum: Forward packets with an IPv4 link-local source IP - ALSA: usb-audio: Fix size validation in convert_chmap_v3() - ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add - ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CVE-2025-39766) - net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate - ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation - netfilter: nft_reject: unify reject init and dump into nft_reject - netfilter: nft_reject_inet: allow to use reject from inet ingress - netfilter: nf_reject: don't leak dst refcount for loopback packets (CVE-2025-38732) - alloc_fdtable(): change calling conventions. https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.242 - ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (CVE-2025-39813) - scsi: core: sysfs: Correct sysfs attributes access rights - [x86] cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper (CVE-2025-39681) - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests - NFS: Fix a race when updating an existing write (CVE-2025-39697) - vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() - net: ipv4: fix regression in local-broadcast routes - Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced - atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (CVE-2025-39828) - [x86] net: dlink: fix multicast stats being counted incorrectly - net/mlx5e: Update and set Xon/Xoff upon MTU set - net/mlx5e: Update and set Xon/Xoff upon port speed set - net/mlx5e: Set local Xoff after FW update - net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts - sctp: initialize more fields in sctp_v6_from_sk() (CVE-2025-39812) - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CVE-2025-39817) - [x86] KVM: x86: use array_index_nospec with indices that come from guest (CVE-2025-39823) - HID: asus: fix UAF via HID_CLAIMED_INPUT validation (CVE-2025-39824) - HID: wacom: Add a new Art Pen 2 - HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (CVE-2025-39808) - Revert "drm/amdgpu: fix incorrect vm flags to map bo" - dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted - net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions - drm/nouveau/disp: Always accept linear modifier - [x86] ASoC: Intel: bxt_da7219_max98357a: shrink platform_id below 20 characters - [x86] ASoC: Intel: sof_rt5682: shrink platform_id names below 20 characters - [x86] ASoC: Intel: glk_rt5682_max98357a: shrink platform_id below 20 characters - [x86] ASoC: Intel: sof_da7219_max98373: shrink platform_id below 20 characters - xfs: do not propagate ENODATA disk errors into xattr code (CVE-2025-39835) https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.243 - drm/amd/display: Don't warn when missing DCE encoder caps - tee: fix NULL pointer dereference in tee_shm_put (CVE-2025-39865) - [arm64] dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro - wifi: cfg80211: fix use-after-free in cmp_bss() (CVE-2025-39864) - netfilter: conntrack: helper: Replace -EEXIST by -EBUSY - Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (CVE-2025-39860) - [x86] xirc2ps_cs: fix register access when enabling FullDuplex - [x86] mISDN: Fix memory leak in dsp_hwec_enable() - icmp: fix icmp_ndo_send address translation for reply direction - i40e: Fix potential invalid access when MAC list is empty (CVE-2025-39853) - wifi: libertas: cap SSID len in lbs_associate() - [arm64] net: thunder_bgx: add a missing of_node_put - [arm64] net: thunder_bgx: decrement cleanup index before use - ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() - ax25: properly unshare skbs in ax25_kiss_rcv() (CVE-2025-39848) - net: atm: fix memory leak in atm_register_sysfs when device_register fail - ppp: fix memory leak in pad_compress_skb (CVE-2025-39847) - ALSA: usb-audio: Add mute TLV for playback volumes on some devices - pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() (CVE-2025-39846) - wifi: mwifiex: Initialize the chan_stats array to zero - drm/amdgpu: drop hw access in non-DC audio fini - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CVE-2025-39841) - batman-adv: fix OOB read/write in network-coding decode (CVE-2025-39839) - e1000e: fix heap overflow in e1000_set_eeprom - mm/khugepaged: fix ->anon_vma race (CVE-2023-52935) - mm/slub: avoid accessing metadata when pointer is invalid in object_err() - cpufreq/sched: Explicitly synchronize limits_changed flag handling - [x86] KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer - iio: light: opt3001: fix deadlock due to concurrent flag access (CVE-2025-37968) - [arm*] gpio: pca953x: fix IRQ storm on system wake up - [x86] ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup - [x86] vmxnet3: update MTU after device quiesce - [arm64] dts: marvell: uDPU: define pinctrl state for alarm LEDs - net: phy: microchip: implement generic .handle_interrupt() callback - net: phy: microchip: remove the use of .ack_interrupt() - net: phy: microchip: force IRQ polling mode for lan88xx - [x86] ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model - [x86] pcmcia: Add error handling for add_interval() in do_validate_mem() - [arm64] clk: qcom: gdsc: Set retain_ff before moving to HW CTRL - cifs: fix integer overflow in match_server() https://www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.244 - [x86] Mitigate VMScape vulnerability (CVE-2025-40300): + Documentation/hw-vuln: Add VMSCAPE documentation + x86/vmscape: Enumerate VMSCAPE bug + x86/vmscape: Add conditional IBPB mitigation + x86/vmscape: Enable the mitigation + x86/bugs: Move cpu_bugs_smt_update() down + x86/vmscape: Warn when STIBP is disabled with SMT + x86/vmscape: Add old Intel CPUs to affected list . [ Ben Hutchings ] * Drop "Revert "xen/swiotlb: add alignment check for dma buffers"" which should not be needed after "xen/swiotlb: relax alignment requirements" * [x86] ACPI: Make ACPI_HED built-in since it can no longer be modular * Bump ABI to 36 * d/b/buildcheck.py, d/rules.real: Run buildcheck.py in setup as well * d/b/buildcheck.py: Check config of kernel to be signed * d/rules: Include target suite as an input to gencontrol.py * Generate kernel ABI name suffix automatically if not configured * d/c/defines: Delete ABI name suffix * d/salsa-ci.yml: Ignore pycodestyle error E241 * d/rules.real: Move module installation to the image build rule * certs: check-in the default x509 config file * [rt] Update to 5.10.241-rt135 * d/b/gencontrol.py: Extend the effect of $DEBIAN_KERNEL_DISABLE_INSTALLER . [ Bastian Blank ] * [arm64] Enable hyperv-daemons package. (Closes: #1109891) * Drop not needed extra step to add debug links * Sign modules using an ephemeral key: (closes: #1040901) - Set MODULE_SIG_ALL to sign all modules. - Not longer request Secure Boot signing for modules. - Don't trust Secure Boot key any longer. * Use abi name 0 for everything before unstable. * Store build time signing key encrypted. * Sign modules and support lockdown always. . [ Santiago Ruano Rincón ] * d/salsa-ci.yml: Merge the extract-source job into the build's job script * d/salsa-ci.yml: Early move orig tarballs back where they can be cached Checksums-Sha1: e7a1a7aa4cba962d829b4820c172221897376f90 209429 linux_5.10.244-1.dsc 62437e33e8b6f59ff8ef1933811a45edcd619ba7 122105040 linux_5.10.244.orig.tar.xz 63a1e8aa5e38692b019379586abd3a876759b194 1759388 linux_5.10.244-1.debian.tar.xz 925646a153347062d10e8db9c840b55ff01d42b2 6215 linux_5.10.244-1_source.buildinfo Checksums-Sha256: 00564a843655ac1f6e2fd7268177cfb858c967817ac763b5ac255892f9fb8141 209429 linux_5.10.244-1.dsc 94fe544015224ab7b5ca3b391576c0c84be3b655e5e11a49b1e7cea8aa1db6be 122105040 linux_5.10.244.orig.tar.xz 36ea2de74f287912a440239b6b612fa748fc5e5727c651d32abfb8e1359d696f 1759388 linux_5.10.244-1.debian.tar.xz ce5275a6aaa052b5b0da1f4ca93422603f41a352ef2d7c721a034907484154c0 6215 linux_5.10.244-1_source.buildinfo Files: 09ad8798a50b72267c4ee3cdc8ba802b 209429 kernel optional linux_5.10.244-1.dsc bc7934639845d35972c02a8c6fba9ad9 122105040 kernel optional linux_5.10.244.orig.tar.xz c4e63eba4dc7de076e876673360c3f09 1759388 kernel optional linux_5.10.244-1.debian.tar.xz 0c6f6252283b773c6042d5173c29c979 6215 kernel optional linux_5.10.244-1_source.buildinfo
-----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEErCspvTSmr92z9o8157/I7JWGEQkFAmjaiscACgkQ57/I7JWG EQlY/hAAnWF9AgUG9hIscyhX46QkZV7D//TTVmnjJway/TP8ZrvV2WKvwj3NMeAd hD/zP1e6+2ml/krEigA+DIjaUTtPvCQPuvKfjJRK8cM7iywrac58MSe2P0IdGPSo 8EvaPsa0WpL+0ijtW0SvBhtiVLBud3btzWYDmGEWsZ3FmsZOlU5TvOw7gAolFTLL pyduzMt4sJ8EBgmiDtupGagot5PCCFOZF777xy3PT8/Jnrq9Ov22vMMQ8dKuZQyP AMjkmPfArnt0STLxSdaag2J+Fb/mR8ufJjh5jSej5/mBrwruhGBxi15QJBEREXjy CgQCwM9dEaX7FFcvW+1XE3dhj2I2084RY/qYNwobBdLHDSME0GpovRZXNK7wucf8 KL3+FK1DX6JoY5Scod+2ipLyyrw3wlRrxF02AcibeWttwISFeAu6jZ4hxtjYwl2E CHaO9z2BLr05BtDVSIxoQBAsDVz0IO2nnPgfL9W/x/F+u+wzn/0yc0CFRx3cPOQ1 cEkGmRuK2B1AzCRc52Hbrw9IZRnU5mM0SXJ6kJOKtkcpZM6aXJ8bOuNcUTOx0huv Bgcu3ugcg9NS+LOM8kPNdekVvxN9ly93dEKErOFKQ2lniiiSXc5oVC7UwZScqTiy OQ0UwrVsC4Xwpod70P/rhWX2Ri9Zt/oiPbjFt+T388UKXsZbshU= =i9+s -----END PGP SIGNATURE-----
pgpcLo0MJ6FZE.pgp
Description: PGP signature
