Revert "arm64: mm: Don't remap pgtables for allocate vs populate"
net: dst: introduce dst->dev_rcu
net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads
ceph: fix oops due to invalid pointer for kfree() in parse_longname()
perf test: Simplify metric value validation test final report
perf test: raise limit to 20 percent for perf_stat_--bpf-counters_test
perf test bpf-counters: Add test for BPF event modifier
perf test stat_bpf_counter.sh: Stabilize the test results
mfd: tps6594: Add register definitions for TI TPS65224 PMIC
regulator: tps6594-regulator: Add TI TPS65224 PMIC regulators
regulator: tps6594-regulator: Fix the number of irqs for TPS65224 and TPS6594
perf cs-etm: Create decoders after both AUX and HW_ID search passes
nvmet-rdma: use sbitmap to replace rsp free list
arm64: dts: qcom: sc8180x-lenovo-flex-5g: move pinctrl to appropriate nodes
arm64: dts: qcom: sc8180x: Enable the power key
irqdomain: Introduce irq_domain_free()
irqdomain: Introduce irq_domain_instantiate()
irqdomain: Handle additional domain flags in irq_domain_instantiate()
irqdomain: Handle domain hierarchy parent in irq_domain_instantiate()
irqdomain: Introduce init() and exit() hooks
irqdomain: Add support for generic irq chips creation before publishing a domain
wifi: iwlwifi: mei: add support for SAP version 4
RDMA/core: Add an option to display driver-specific QPs in the rdmatool
firmware: arm_scmi: Add multiple protocols registration support
wifi: ath11k: refactor ath11k_wmi_tlv_parse_alloc()
wifi: ath11k: implement handling of P2P NoA event
rcu: Rename rcu_momentary_dyntick_idle() into rcu_momentary_eqs()
arm64: dts: qcom: sm8550: Use GIC-ITS for PCIe0 and PCIe1
arm64: dts: qcom: sm8550: Fix the msi-map entries
selftests: mm: support shmem mTHP collapse testing
selftests/bpf: Limit URLS parsing logic to actual scope in vmtest
selftests/bpf: Support local rootfs image for vmtest
selftests/bpf: Add description for running vmtest on RV64
scsi: ufs: core: Remove unnecessary wmb() after ringing doorbell
null_blk: add configfs variable shared_tags
hwmon: (emc1403) Convert to with_info API
hwmon: (emc1403) Support 11 bit accuracy
hwmon: (emc1403) Add support for EMC1428 and EMC1438.
net: hsr: Use full string description when opening HSR network device
net: hsr: Provide RedBox support (HSR-SAN)
fuse: use FUSE_ROOT_ID in fuse_get_root_inode()
selftests: mm: cow: flag vmsplice() hugetlb tests as XFAIL
ACPI: processor: idle: Remove redundant cstate check in
acpi_processor_power_init
ACPI: processor: idle: Optimize ACPI idle driver registration
ACPI: processor: idle: Move max_cstate update out of the loop
ACPI: processor: idle: Remove redundant static variable and rename cstate check
function
irqdomain: Make build work for CONFIG_GENERIC_IRQ_CHIP=n
wifi: ath11k: Fix error handling in ath11k_wmi_p2p_noa_event()
net: hsr: enable promiscuous mode on interlink port with fwd offload
net: hsr: init prune_proxy_timer sooner
net: hsr: must allocate more bytes for RedBox support
nvmet-rdma: fix queue leak when connect backlog is exceeded
net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()
net: openvswitch: fix kernel-doc warnings in internal headers
openvswitch: Fix CT limit teardown use-after-free
landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation
xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata()
netfs: Fix netfs_read_folio() to wait on writeback
mm/page_vma_mapped: use huge_ptep_get() for hugetlb
wifi: mt76: mt7996: validate default EEPROM firmware size
fsnotify: Fix stale object mask after concurrent mark updates
entry: Fix seccomp bypass after ptrace with TSYNC
fsnotify: inotify: pass mark connector to fsnotify_recalc_mask()
net: ntb_netdev: Fix TX busy and drop handling
drm/amd/display: fix division by zero in get_estimated_bw()
usb: image: mdc800: change kmalloc() to kzalloc()
ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output()
clk: qcom: gcc-mdm9607: Increase delay for USB PHY reset
media: usbtv: keep device alive while ALSA card exists
usb-storage: ene_ub6250: fix race between scan work and probe
usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns()
usb: typec: qcom-pmic: cancel reset_work on stop
usb: typec: ucsi: displayport: Fix OOB altmode array index
usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs
usb: gadget: f_midi2: fix use-after-free in string attribute show path
usb: gadget: f_midi: initialize work in f_midi_alloc()
USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()
usb: gadget: fix null pointer dereference in usb_put_function_instance()
staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr()
staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()
thermal/drivers/imx: Disable clock on runtime resume failure
thermal/drivers/qoriq: Disable clock on resume failure
ublk: clear VM_MAYWRITE on read-only ublk char device mmap
spi: bcm63xx-hsspi: disable clocks on resume failure
spi: bcm63xx: disable clock on resume failure
spi: bcmbca-hsspi: disable clocks on resume failure
spi: Fix DMA mapping ownership on partial map failure
scsi: target: iscsi: Reserve a terminator byte for the login payload
scsi: pm8001: Use rollback index when freeing MSI-X vectors
mm/damon/sysfs-schemes: kobject_del() scheme dirs
mm/damon/sysfs-schemes: kobject_del() scheme filter dirs
mm/damon/sysfs-schemes: kobject_del() scheme quota goal dirs
mm/damon/sysfs-schemes: kobject_del() scheme region dirs
mm/damon/sysfs: kobject_del() region and target (error) dirs
mm/damon/sysfs: kobject_del() target (normal), context and kdamond dirs
mm/damon: move kunit tests to tests/ subdirectory with _kunit suffix
mm/damon/core-kunit: check region count before testing in split_at()
futex: Prevent rcuwait use-after-free during requeue PI
ftrace: Synchronize the initialization of ftrace_ops
HID: rmi: fix OOB access with undersized RMI reports
HID: wacom: validate report length in wacom_intuos_pro2_bt_irq
dm: fix race when loading and unloading a table
dm: fix resume-vs-remove race
dma-direct: return struct page from dma_direct_alloc_from_pool()
dmaengine: dw-edma: Fix HDMA channel status register access
dmaengine: dw-edma: Complete descriptors before pausing
dmaengine: dw-edma: Initialize IRQ data before requesting IRQs
cpuidle: dt_idle_genpd: kfree() the original name allocation
block: flag zoned disks with GENHD_FL_NO_PART
ata: ahci: work around lost interrupts on Marvell 88SE61xx
ima: Check for ERR_PTR from dentry_path() in validate_hash_algo()
irqchip/stm32mp-exti: Fix the unit of the hwspinlock timeout
kprobes: Protect kprobe_blacklist with RCU
tcp: clear sock_ops cb flags before force-closing a child socket
Input: aiptek - validate raw macro indices before updating state
memcg: make the v1 soft limit knob inert
rtc: rzn1: Fix weekday underflow when alarm crosses month boundary
rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers
perf/x86/intel: Fix kernel address leakages in LBR stack
i2c: core: fix debugfs UAF on adapter removal
i2c: mux: Fix channel node leak on adapter add failure
arm64: mm: Fix the lockless page-table walk in show_pte()
ALSA: rawmidi: Return the error from snd_rawmidi_input_params()
ALSA: harmony: initialize locks before requesting IRQ
ALSA: pcm: Fix race between non-atomic ops and trigger-start
nvme-fabrics: fix DHCHAP secret leak on parse failure
nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails
nvme-tcp: check the data direction of a C2HData PDU
nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
nvmet-tcp: reject unsolicited H2CData PDUs
Revert "irqchip/mbigen: Fix mbigen node address layout"
mm/hugetlb: fix missing migratable flag on same-node hugetlb migration
nvdimm/btt: reject an arena whose nfree is below the lane count
parisc: eisa: Fix infinite loop when parsing invalid IRQ value
parisc: Fix alignment of asm statements in head.S
powerpc/kexec_file: Prevent kexec range truncation
powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population
powerpc/pseries: Handle and log pseries-wdt registration failures
powerpc/pseries: Move H_WATCHDOG definitions to a common header
powerpc/crash: stop watchdogs before booting kdump kernel
s390/vfio-ap: fix stale pqap_hook pointer on error in vfio_ap_mdev_set_kvm()
s390/vfio-ap: Fix stale do_remove flag across iterations in
vfio_ap_mdev_cfg_remove
s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove
s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL
s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed
s390/vfio-ap: Fix NULL deref in status_show() during queue probe
s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap
s390/vfio-ap: Fix required lock not held during update of ap_matrix_mdev object
mtd: afs: validate v2 image info bounds
mtd: mtdoops: free page bitmap when the backing MTD is removed
mtd: rawnand: validate ONFI extended parameter page sections
batman-adv: fix stale receive device on merged fragments
batman-adv: mcast: ensure unshared skb for multicast packets
batman-adv: mcast: linearize skbuff for packet generation
batman-adv: dat: avoid unaligned fault in IP extraction
batman-adv: bla: fix freeing of claims on meshif deletion
batman-adv: bla: prevent CRC corruptions after claim flush
clk: qcom: gcc-msm8916: Fix enable_reg for gcc_blsp1_sleep_clk
clk: qcom: gcc-msm8939: Fix enable_reg for gcc_blsp1_sleep_clk
clk: rockchip: rk3588: Don't change PLL rates when setting dclk_vop2_src
clk: qcom: gcc-mdm9607: Drop incorrect apss_tcu_clk_src
clk: qcom: gcc-mdm9607: Drop incorrect system_noc_bfdcd_clk_src
clk: qcom: gcc-mdm9607: Fix enable_reg for gcc_blsp1_sleep_clk
clk: qcom: gcc-mdm9607: Fix halt_reg for gcc_apss_axi_clk
clk: qcom: gcc-mdm9607: Drop incorrect BIMC PLL and related clocks
i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure
ASoC: cs35l33: drain threaded IRQ before runtime suspend
ASoC: cs35l34: drain threaded IRQ before runtime suspend
ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure
ASoC: hdac_hda: improve error logs
ASoC: hdac_hda: Fix hlink refcount leak on component registration failure
AsoC: intel: sst: fix PCI device reference leak on probe failure
ASoC: loongson: Fix error handling in ACPI property parsing
ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment
without of_node_get
iio: adc: max34408: add missing 'select REGMAP_I2C' to Kconfig
iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable
iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF
iio: chemical: sgp30: Handle IAQ thread creation failure
iio: dac: m62332: Fix regulator reference count imbalance
iio: gyro: mpu3050: fix sign of raw angular velocity readings
iio: light: cm32181: return zero after writing calibscale
iio: light: gp2ap002: Disable regulators on resume failure
iio: light: ltrf216a: fix runtime PM reference leak in error path
iio: pressure: dps310: fix NULL pointer dereference on ACPI probe
iio: pressure: mpl115: Fix runtime PM cleanup
iio: srf04: fix pm_runtime handling on probe error path
iio: temperature: hid-sensor-temperature: switch to non-devm
iio_device_register()
iio: light: opt4001: Fix power down clearing bits of the wrong register
iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem()
iio: light: opt4001: Reject integration times with a non-zero seconds part
iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask
KVM: nVMX: Always flush vpid02 on first use
KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02
KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit
KVM: nVMX: Service local TLB flushes on failed nested VM-Enter
KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU
KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock
KVM: x86: Serialize writes to disabled_quirks using kvm->lock
KVM: x86: Ensure runtime reads of disabled_quirks are resolved once
KVM: s390: Fix length check __import_wp_info()
KVM: s390: Fix memory leak in guest debug handling
KVM: s390: Fix old_data leak in guest debug error path
KVM: s390: Free guest debug data on vcpu destroy
KVM: s390: Take srcu when importing watchpoint data
KVM: s390: Zero initialize irq in reinject_machine_check
KVM: s390: pv: Fix rc/rrc offset for PVM_DUMP
KVM: s390: Restore sigset on error path
LoongArch: KVM: Free init resources if kvm_init() fails
LoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY
LoongArch: Fix acpi_package_ids[] array overflow
LoongArch: Do not select HAVE_RUST when KASAN is enabled
LoongArch: Do not save/restore percpu base register in rethook trampoline
LoongArch: Avoid preempt count underflow without probe
media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref
media: amphion: Remove obsolete frame_count check in venc_start_session
media: cec: core: Fix kmemleak due to missed rc_free_device() call
media: cec: disable delayed work before freeing an interrupted transmit
media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash
media: cec: Serialize exclusive follower delivery
media: cedrus: fix memory leak in cedrus_init_ctrls()
media: cobalt: Avoid freeing ALSA private data twice
media: cx231xx: reject geometry changes while the VBI queue is busy
media: cx23885: cancel NetUP CI work before teardown
media: em28xx: defer audio-only extension registration
media: em28xx: fix use-after-free of dev_next->devlist on disconnect
media: go7007: defer the ALSA v4l2 put until card release
media: i2c: alvium: Fix: Correct name of register in
alvium_set_ctrl_auto_exposure
media: i2c: imx415: Return test pattern write errors
media: i2c: ov02a10: fix endpoint parsing use-after-free
media: i2c: ov7740: fix use-after-destroy in remove
media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common
media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup
media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing
media: nxp: imx8-isi: Correct color map between V4L2 and ISI
media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks
media: rc: sunxi-cir: Unregister rc device on probe failure
media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak
media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure
media: s2255: bound JPEG frame size before copying into the buffer
media: s2255: check firmware size before reading trailing marker
media: saa7164: fix cleanup on resource allocation failure
media: tda18250: fix possible integer overflow
media: v4l2-async: avoid deleting unlinked ASC entry on link error
media: v4l2-ctrls: Allow unknown HDR10 white point and luminance
media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link
media: venus: fix payload size returned by parse_caps() and parse_alloc_mode()
media: venus: fix payload size calculation in parse_raw_formats()
media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure
media: vimc: fix pixel format lookup in enum_framesizes
media: zoran: Avoid freeing a registered video_device twice
scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers
scsi: qla2xxx: Bound i2c->length in I2C bsg handlers
scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check
scsi: qla2xxx: Fix Name Server logout detection on FWI2 adapters
scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()
scsi: qla2xxx: Initialize NVMe abort_work once at submission
scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config()
scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions()
scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject
scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation
scsi: qla2xxx: Serialize flash version read in reset handler
scsi: qla2xxx: Fix cs84xx use-after-free on host teardown
scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump
scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state()
scsi: qla2xxx: Fix FCE trace enable parsing in debugfs
scsi: qla2xxx: Don't query firmware state while chip is down
scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path
scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb()
scsi: qla2xxx: Quiesce response IRQ before freeing request queue
scsi: qla2xxx: Avoid double completion in async IOCB timeout
scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read
scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry()
media: chips-media: wave5: Guard bit depth check with initial_info_obtained
scsi: qla2xxx: Fix NVMe abort reference leak on repeated abort
scsi: qla2xxx: Drop vport reference under lock in report ID acquisition
scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition
scsi: qla2xxx: Use coherent DMA buffer for D_Port diagnostics
scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak
scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started
f2fs: return symlink writeback errors
f2fs: reject overlapping move range after len expansion
f2fs: use the mount idmap for the owner check in f2fs_xattr_advise_set()
f2fs: return writeback error from collapse range
f2fs: use new ioprio Macro to get ckpt thread ioprio level
f2fs: avoid NULL checkpoint thread access in sysfs
f2fs: fix to migrate all curseg types during free_segment_range
f2fs: fix i_size when pinned fallocate partially fails
f2fs: fix to off-by-one issue in f2fs_zero_post_eof_page()
f2fs: fix valid block count leak on data block allocation failure
f2fs: fix to zero post-EOF data when extending file size
drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure
drm/panel-edp: fix i2c adapter leak on probe failure
drm: fix race between partial drm_dev_register() failure and ioctl
drm/i915: Guard against NULL driver_data in i915_pci_probe()
drm/ssd130x: fix column and row end address in partial updates for ssd132x
drm/sun4i: fix refcount leak in sun4i_backend_init_sat()
drm/hibmc: Fix list of formats on the primary plane
drm/hibmc: Use drm_atomic_helper_check_plane_state()
drm/amd/display: avoid divide-by-zero in __is_lut_linear()
drm/amd/display: validate plane degamma LUT size for private color prop
drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check
drm/gud: NUL-terminate TV mode names read from the device
drm/gud: validate TV mode names before creating enum property
drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value
drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used
drm/amdgpu: check thunderbolt before switcheroo registration
drm/amdgpu: fix autosuspend cleanup during removal
drm/amdgpu: Skip accessing psp rum time db for APUs
drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT
drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore
drm/amdkfd: Reject zero-sized AQL queue allocations after size halving
drm/nouveau: remove nouveau_chan.device
drm/nouveau: remove chan->drm
drm/nouveau: unsubscribe the channel-kill event before the fence context
drm/nouveau: Use write-combined maps for coherent
drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op
drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE
drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE
afs: Fix leak of ungot volume
xhci: fix lost bounce buffers on TDs spanning several ring segments
ksmbd: zero pipe read compound padding
net/mlx5e: xsk: Fix unlocked writing to ICOSQ
nvmet-auth: Synchronize timeout work during SQ teardown
mm/damon/vaddr: drop last same folio access check optimization
mm/damon/ops-common: use nr_accesses moving sum for quota score
mm/damon/paddr: drop last same folio access check reuse optimization
mm/damon/vaddr-kunit: check region count in three_regions test
mm/damon/core-kunit: handle region split failure in filter_out()
mm/damon/tests/core-kunit: catch test failure in test_merge_regions_of()
of: unittest: Fix memory leak in unittest_data_add()
batman-adv: dat: atomically update mac addresses
batman-adv: bla: avoid CRC corruption due to parallel claim add
perf sched: Fix register_pid() overflow, strcpy, and BUG_ON
clk: meson: align gxbb_32k_clk_sel number of parents with actual count
batman-adv: fix TX priority extraction for BATADV_FORW_MCAST
mm/damon/core: skip aging from repeated aggressive merging
drm: Remove unused header in drm_dumb_buffers.c
drm: lcdif: Wait for vblank before disabling DMA
drm/v3d: Replace a global spinlock with a per-queue spinlock
drm/v3d: Store the active job inside the queue's state
drm/v3d: Clear queue->active_job when v3d_fence_create() fails
drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format
drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure
smack: fix incorrect task context in smack_msg_queue_msgrcv
smack: simplify write handlers of sysfs entries
smack: deduplicate smackfs/{direct,mapped} file_operations
smack: restrict smackfs/{direct,mapped} values to 0-255
x86/cfi: Use symmetric SYM_START and SYM_END in __CFI_TYPE()
platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count
HID: core: quiesce input in hid_hw_stop() to prevent use-after-free
HID: nintendo: Fix imu_timestamp_us double increment per report
HID: roccat: bound device-supplied profile index
soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap()
media: cec-pin: Fix event FIFO ordering
cxl/mbox: Clamp mailbox output allocation to the payload size
clk: versaclock7: Fix APLL clock leak on probe failure
clk: moxart: remove unused variables, fix refcount leak
clk: nuvoton: ma35d1: fix ignored div_u64 return values in PLL freq calculation
clk: nuvoton: ma35d1: fix PLL_CTL1_FRAC bit field width and fractional calc
clk: nuvoton: ma35d1-pll: convert from round_rate() to determine_rate()
clk: nuvoton: ma35d1: fix ma35d1_clk_pll_determine_rate logic
ASoC: rt700-sdw: always drain jack work on remove
ASoC: fsl_audmix: rework runtime PM handling in probe
clk: hisilicon: reset: Use devm_kzalloc to initialize hisi_reset_controller
ARM: imx: fix device_node refcount leak in imx_src_init()
ARM: imx: fix device_node refcount leaks in imx7_src_init()
clk: imx: scu: drop redundant init.ops variable assignment
drm/lima: call drm_mm_init() with a valid allocation range
mm/mm_init: fix incorrect node_spanned_pages
sched/fair: Fix overflow in update_tg_cfs_runnable()
perf/x86/intel/uncore: Keep PCI PMUs working when MMIO/MSR setup fails
pinctrl: bcm2835: Don't remove an unregistered GPIO chip
riscv: kexec_file: Split the loading of kernel and others
riscv: kexec_file: Fix crashk_low_res not exclude bug
media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define
media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define
perf test: Update all metrics test like metricgroups test
perf test stat_all_metrics: Ensure missing events fail test
perf tests metrics: Permission related fixes
perf test metrics: Update all metrics for possibly failing default metrics
perf test all metrics: Fully ignore Default metric failures
perf test: Do not skip when some metrics tests succeeded
perf tests: Skip metrics validation if system-wide recording lacks permission
perf test: Use sqrtloop workload to test bperf event
perf test: Fix perf stat --bpf-counters on hybrid machines
perf tests: Fix flakiness in BPF counters test on hybrid systems
perf test brstack: Speed up running test by using tr -s instead of xargs
perf tests: Harden branch stack sampling test
perf test: Refactor brstack test
perf test: Add syscall and address tests to brstack test
perf test: Extend branch stack sampling test for Arm64 BRBE
perf test: Fixes for check branch stack sampling
perf tests: Fix flakiness in branch stack sampling tests
regulator: tps6594-regulator: Constify struct tps6594_regulator_irq_type
regulator: tps6594-regulator: remove interrupt_count
regulator: tps6594-regulator: remove hardcoded buck config
regulator: tps6594-regulator: refactor variant descriptions
regulator: tps6594: Fix device node reference leaks in multiphase loop
drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup
drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup
tools/bpf/bpftool: Reset vmlinux BTF after map commands
tools/bpf/bpftool: Reset vmlinux BTF after struct_ops commands
bpf: Copy per-CPU map value padding in copy_map_value_long()
selftests/bpf: Systematically add SO_REUSEADDR in start_server_addr
selftests/bpf: Mask socket type flags in mptcpify prog
mm: add build-time option for hotplug memory default online type
UBUNTU: [Config] Rename hotplug config: remove MEMORY_HOTPLUG_DEFAULT_ONLINE,
add MHP_DEFAULT_ONLINE_TYPE_*
mm: convert memory block states (MEM_*) macros to enum
mm: change type of state in struct memory_block
mm: name the anonymous MMOP enum as enum mmop
mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug
dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure
dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA
interrupt handlers
dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe
soundwire: qcom: Fix port exhaustion check in stream_alloc_ports
iio: orientation: hid-sensor-rotation: Avoid race between callback setup and
device exposure
csky: Fix a4/a5 restoration in syscall trace path
selftests/rseq: Replace glibc-specific __GNUC_PREREQ with portable check
platform/chrome: sensorhub: Fix memory overread in ring handler
wifi: rtw89: fix HE extended capability length check
perf cs-etm: Queue context packets for frontend
perf cs-etm: Fix thread leaks on trace queue init failure
perf/x86/amd/uncore: Add group validation
hwrng: core - fix rng list on registration error
crypto: qat - cancel work on re-enable SR-IOV timeout
crypto: qat - clear AES key schedule from stack
crypto: atmel-ecc - replace min_t with min
crypto: atmel-ecc - clean up and improve ECDH comments
crypto: atmel-ecc - reject hardware ECDH without a public key
crypto: atmel-sha204a - fix heap info leak on I2C transfer failure
crypto: sa2ul - stop probe if context pool creation fails
crypto: rk3288 - fail ahash requests on HASH idle timeout
crypto: keembay - Fix AEAD unregister count in error path
nvme-apple: Use acquire/release for queue enabled state
nvmet-rdma: factor out response resource cleanup
nvmet-rdma: fix response resource leak on queue teardown
bus: ti-sysc: Fix /chosen node reference leak
PM: sleep: Fix off-by-one in wakelocks number limit check
cgroup/cpuset: Make nr_deadline_tasks an atomic_t
arm64: dts: qcom: sm7225-fairphone-fp4: Fix address in fb node name
bus: qcom-ebi2: Simplify with scoped for each OF child loop
bus: qcom-ebi2: Fix clock leak on probe failure
wifi: mac80211_hwsim: avoid NULL skb in stop queue drain
staging: greybus: audio: correct sscanf() return value check
staging: sm750fb: gate dualview dataflow using g_dualview
staging: sm750fb: Add missing Kconfig dependency
greybus: audio: bound the topology section sizes against the fetched size
staging: fbtft: Use sysfs_emit_at() to print to sysfs file
staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown
staging: octeon: fix free_irq dev_id mismatch in cvm_oct_rx_shutdown
staging: octeon: ethernet-mem: replace pr_warn with dev_warn in free functions
staging: octeon: replace pr_warn with dev_warn in fill and rx paths
staging: octeon: add missing napi_disable in cvm_oct_rx_shutdown
staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()
ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer()
selftests/bpf: Fix memory leak in msg_alloc_iov error path
selftests/bpf: Fix memory leak in msg_alloc_iov
selftests/lsm: Fix memory leak in attr_lsm_count
irqchip/gic-v3-its: Fix memleak in its_probe_one()
irqchip/gic-v3-its: Fix its node leak in gic_acpi_parse_madt_its()
selftests: timers: leap-a-day: Fix -w option and update usage comment
clocksource: Unregister subsystem on device registration failure
y2038: uapi: Use 64-bit __kernel_old_timespec::tv_nsec on x32
timekeeping: Account for monotonicity adjustment in ntp_error
clk: qcom: gdsc: propagate gdsc_check_status() errors from gdsc_poll_status
clk: qcom: gdsc: propagate gdsc_enable() failure for ALWAYS_ON domains
clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister()
arm64: dts: qcom: sc8180x-primus: Rename regulator nodes
arm64: dts: qcom: sc8180x-pmics: Add second PMC8180 GPIO
arm64: dts: qcom: sc8180x-primus: Describe the display power net
arm64: dts: qcom: sc8180x-lenovo-flex-5g: Rename regulator nodes
arm64: dts: qcom: sc8180x-lenovo-flex-5g: Describe the display power net
perf data convert json: Fix trace_seq memory leak in process_sample_event()
thermal/drivers/rcar: Fix error checking in probe()
usb: typec: ucsi: unregister debugfs entries on teardown
usb: gadget: r8a66597: avoid double free of ep0_req in probe error path
udf: Mark LVID buffer as uptodate before marking it dirty
perf dso: Fix kallsyms DSO detection with fallback logic
bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux
efi: fix stale reference to efi_recover_from_page_fault()
bpf: Fix use-after-free on mm_struct in bpf_find_vma()
bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation
iommu/mediatek-v1: Fix off-by-one in MT2701_LARB_NR_MAX
iommu/msm: Return -ENOMEM on memory allocation failure in probe
iommu/amd: Prevent SB IOAPIC from overriding IVRS validation errors
iommu/amd: Add support for Hygon family 18h model 4h IOAPIC
iommu/amd: Fix false positive in SB IOAPIC IVRS validation
leds: pca9532: Fix inverted GPIO output polarity
platform/x86: dell-privacy: Fix race condition
platform/x86: dell-wmi-base: Fix resource leak on module load failure
platform/x86: lg-laptop: Drop debug-only ACPI notify handler
platform/x86: lg-laptop: Convert ACPI driver to a platform one
remoteproc: qcom_q6v5_adsp: Fix reference leak for device node
hwspinlock: propagate errno when registering single lock
serial: ma35d1: Fix OF node reference leaks in console init
usb: gadget: configfs: fix out-of-bounds read of qw_sign
usb: ljca: bound bank_num in ljca_enumerate_gpio()
usb: gadget: aspeed_udc: check endpoint DMA allocation
USB: make single lock for all usb dynamic id lists
USB: make to_usb_driver() use container_of_const()
usb: fix UAF when probe runs concurrent to dyn ID removal
platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL
platform/surface: acpi-notify: Check ACPI companion before use
usb: mtu3: allow system suspend during active gadget connection
usb: renesas_usbhs: Fix power-off ordering on unbind
drm/panel: samsung-s6d16d0: Power off on prepare failure
perf metricgroup: Fix metric expression copy leaks
soc: qcom: rpmh-rsc: manage PM notifiers with devres
bus: qcom-ebi2: use managed resources for clocks and children
clk: qcom: camcc-sc8280xp: unregister CAMCC_GDSC_CLK
iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE
RDMA/core: Wait for RCU callbacks before unloading ib_core
RDMA/mlx5: Drain RCU callbacks during module teardown
RDMA/ipoib: Drain RCU callbacks during module teardown
RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error
state
hwrng: ks-sa - Fix runtime PM cleanup on registration failure
xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full
ALSA: hpi: Check transport errors during HPI6000 adapter initialization
pmdomain: bcm: bcm2835: handle genpd provider registration errors
misc: rtsx_usb: avoid USB I/O in runtime autosuspend
RDMA/hfi1: Preserve unit 0 on allocation failure
RDMA/hfi1: Free RX data on late probe failure
RDMA/hfi1: Stop flushing the global IB workqueue
RDMA/hfi1: Initialize debugfs after probe completes
ASoC: apple: mca: increase SERDES reset delay
isofs: fix out-of-bounds page array access on empty zisofs block
iommufd: Reorder include files
iommufd/selftest: Avoid selftest dirty bitmap size wrap
media: v4l2-async: Unregister sub-device if asc_list is empty
rpmsg: glink: remove duplicate code for rpmsg device remove
rpmsg: glink: fix deadlock in endpoint destroy during driver detach
cxl/memdev: Fix firmware upload exact-fit handling
cxl/mbox: Break poison list loop on an empty payload
cxl/pci: Honor -EPROBE_DEFER from component register setup
fs/ntfs3: Add more checks in mi_enum_attr (part 2)
fs/ntfs3: Mark inode as bad as soon as error detected in mi_enum_attr()
fs/ntfs3: fix KMSAN uninit-value in ni_create_attr_list
fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()
hfsplus: validate thread record before delete key rebuild
wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate
firmware: arm_scmi: Publish channel state before callbacks
firmware: arm_scmi: Unregister device notifier before IDR teardown
firmware: arm_scmi: Use dev_err_probe to bail out
firmware: arm_scmi: Avoid non-constant printk format strings
firmware: arm_scmi: Clean up channels on setup failure
firmware: arm_scmi: Free transport channel on IDR failure
firmware: arm_scmi: Avoid IDR updates while cleaning channels
firmware: arm_scmi: Reject out of range DT protocol IDs
firmware: arm_scmi: Use channel ID for transport teardown
firmware: arm_scmi: Protect device request lookup with RCU
firmware: arm_scmi: Drop handle on protocol bind failures
firmware: arm_scmi: Unwind TX receiver mailbox setup failure
libnvdimm/labels: Bound the on-media label size before the shift
dax: read holder_ops once in dax_holder_notify_failure()
cpufreq: spear: Fix an IS_ERR() vs NULL bug in spear1340_set_cpu_rate()
PCI: xgene: Drop XGENE_PCIE_IP_VER_UNKN
PCI: xgene: Drop unnecessary OF node reference
irqchip/renesas-irqc: Fix generic interrupt chip leak on remove
media: i2c: rdacm21: Fix missing media_entity_cleanup()
drm/amd/display: Remove unused-but-set variable hubp from
cpufreq: intel_pstate: Fix setting minimum P-state at init time
cpufreq: schedutil: Fix self-contradictory comment in sugov_iowait_apply()
remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdev
drm/bridge: tc358767: clamp the reported AUX read size to the request
arm64: dts: qcom: msm8996-xiaomi-gemini: Fix up ti,drv2604 enable GPIO
arm64: dts: qcom: sm8250: sort out Iris power domains
arm64: dts: qcom: sm8250: correct frequencies in the Iris OPP table
perf jevents: Add more components to the metric sorting order
wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs
wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser
wifi: iwlwifi: mei: check SAP message length before reading it
wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments
wifi: iwlwifi: mei: pass correct argument to function
gpu: host1x: Fix offset calculation in trace_write_gather
gpu: host1x: Avoid stack over-read in debug output helpers
drm/msm/a6xx: Fix stale rpmh votes after suspend
crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping
ACPI: processor: idle: Expand _LPI package sanity checks
usb: gadget: f_uac1_legacy: remove broken string configfs attributes
tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64
UDF symlink pathComponent header OOB read
uio: Fix stale info pointer in failed registration path
accessibility: speakup: Fix incorrect string length computation in
report_char_chartab_status()
speakup: keyhelp: guard letter_offsets possible out-of-range indexing
misc: bcm-vk: Use acquire/release for msgq_inited
misc: rtsx: add missing write register handling
misc: ad525x_dpot: use driver core groups for sysfs files
cacheinfo: don't propagate DT/ACPI error when arch supplies info (arm64)
ppdev: prevent overflow when setting port timeout
ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove
char: xilinx_hwicap: unregister class on init errors
vfio/pci: clear vdev->msi_perm after freeing it on init failure
mtd: mtdswap: Avoid freeing registered blktrans device twice
mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition()
perf ui hists: Fix uninitialized stack memory free on pstack allocation failure
software node: Fix software_node_get_reference_args() with index -1
driver core: soc: Unregister bus on early device registration failure
drm/msm/a6xx: Fix RBBM_CLOCK_CNTL3_TP0 value in a730_hwcg
dmaengine: dw-edma: Terminate all descriptors without callbacks
dmaengine: dw-edma: Serialize abort state updates
dmaengine: dw-edma: Serialize channel state checks
dmaengine: dw-edma: Clear stale requests on termination
ASoC: meson: Keep link pointers valid on realloc failure
phy: starfive: Fix runtime PM cleanup in JH7110 DPHY RX probe
arm64: dts: amlogic: meson-axg: Add missing nand_rb0 pin to nand_all_pins
arm64: dts: amlogic: meson-axg-s400: enable mipi_pcie_analog_dphy for PCIe
RDMA/hfi1: Propagate sdma_txinit_ahg() errors
RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[]
RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters
kcsan: avoid unintended access checking in NMIs
selftests/bpf: Silence array bounds warning in global_map_resize
irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc()
RDMA/nldev: validate dynamic counter attribute length
ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer
ACPI: processor: validate MADT IOAPIC entry bounds
ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root
ext4: fix circular lock dependency in ext4_ext_migrate
ext4: fix out-of-bounds read in ext4_read_inline_dir()
ext4: skip extra isize expansion during mount to prevent deadlock
libbpf: Search /lib64 and /lib in resolve_full_path()
riscv, bpf: Fix memory leak in bpf_jit_free
ACPI: battery: Adjust charging status validation check
RDMA/srpt: Pass the mapped task attribute to target_init_cmd()
PCI: j721e: Fix incorrect max_lanes for J7200
RDMA/erdma: Fix CEQ tasklet use-after-free on removal
RDMA/restrack: Fix typos in the comments
RDMA/nldev: Fix locking when accessing mr->pd
RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations
RDMA/core: Fix use after free in ib_query_qp()
RDMA/core: Fix potential use after free in ib_destroy_cq_user()
RDMA/core: Fix potential use after free in ib_destroy_srq_user()
RDMA/core: Fix potential use after free in counter_release()
RDMA/core: Add driver APIs pre_destroy_cq() and post_destroy_cq()
RDMA/core: Fix potential use after free in ib_free_cq()
RDMA/core: Fix potential use after free in ib_dealloc_pd_user()
firmware: arm_scmi: Fix requested device removal race
iommu/qcom: Remove sysfs device on probe failure path
iommu/qcom: Fix inverted fault report check in qcom_iommu_fault()
thermal: intel: int3400: clean up ODVP on probe failures
ext4: drain in-flight DIO before buffered write fallback
wifi: ath6kl: avoid buffer overreads in WMI event handlers
wifi: ath12k: Correctly copy the hint BSSID in WMI scan request
wifi: ath11k: Correctly copy the hint BSSID in WMI scan request
wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx()
wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx()
RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap
ext4: fix buffer_head leak in ext4_init_orphan_info
ext4: check dir entry fits before reading the hash trailer in ext4_search_dir()
ARM: dts: allwinner: a10: Fix PMU interrupt
ACPI: CPPC: Add IS_OPTIONAL_CPC_REG macro to judge if a cpc_reg is optional
ACPI: CPPC: Optimize cppc_get_perf()
ACPI: CPPC: Rename cppc_get_perf() to cppc_get_reg_val()
ACPI: CPPC: Add cppc_set_reg_val()
ACPI: CPPC: Refactor register value get and set ABIs
ACPI: CPPC: Modify cppc_get_auto_sel_caps() to cppc_get_auto_sel()
cpufreq/amd-pstate: Toggle auto_sel in active mode on shared memory systems
firmware: arm_scmi: Roll back partial protocol table registration
firmware: arm_scmi: Unrequest devices if driver registration fails
perf cs-etm: Flush thread stacks after decoder reset
perf cs-etm: Avoid truncating AUX buffer sizes to int
xfrm: Fix skb double-free in xfrm_dev_direct_output()
RDMA/erdma: Probe the erdma RoCEv2 device
RDMA/erdma: Add GID table management interfaces
RDMA/erdma: Add the erdma_query_pkey() interface
RDMA/erdma: Add address handle implementation
RDMA/erdma: Add erdma_modify_qp_rocev2() interface
RDMA/erdma: Refactor the code of the modify_qp interface
RDMA/erdma: Add the query_qp command to the cmdq
RDMA/erdma: Fix incorrect response returned from query_qp
RDMA/erdma: Support non-sleeping erdma_post_cmd_wait()
RDMA/erdma: complete object teardown when the destroy command fails
PM: hibernate: Fix memory leak in snapshot_write_next() error path
leds: pca9532: Fix phantom device registration on missing hardware
drm/tve200: add OF module alias for autoloading
netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet
fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init
arm64: dts: rockchip: Fix Gru WLAN sideband interrupt
ARM: lpc32xx: only run SoC init on LPC32xx hardware
selftests/bpf: Fix incorrect error checking for pthread_create
selftests/bpf: Fix memory leak on subtest_states reallocation
cxl/region: Fix use-after-free in find_pos_and_ways() error path
pinctrl: mediatek: Add EINT support for multiple addresses
pinctrl: mediatek: Fix the invalid conditions
pinctrl: mediatek: eint: Fix invalid pointer dereference for v1 platforms
pinctrl: mediatek: free EINT resources on unbind
tools/build: Add bpftool-skeletons feature test
tools/build: Allow versioning of all LLVM tools defined in Makefile.include
power: supply: sbs-battery: Use a per-device serial number buffer
scsi: ufs: debugfs: Reserve space for a string terminator
crypto: keembay - Initialize completion before requesting IRQ
crypto: keembay - publish OF module alias for OCS AES/SM4
RDMA/mlx5: Fix integer overflow of user QP buffer size
isofs: release zisofs block pointer buffer head
spi: bitbang: Follow renaming of SPI "master" to "controller"
spi: ppc4xx: Fix fallout from rename in struct spi_bitbang
spi: oc-tiny: switch to managed controller allocation
w1: ds2482: Fix signedness bug in ds2482_w1_triplet()
remoteproc: core: Drop redundant initialization of 'ret' in rproc_shutdown()
remoteproc: Allow shutdown of crashed processors
remoteproc: core: Attach rproc asynchronously in rproc_add() path via
schedule_work()
remoteproc: Prevent crash handling to race with rproc_del()
staging: rtl8723bs: use kfree_sensitive() for key material
fs/ntfs3: reject restart table growth beyond U16_MAX entries
RDMA/efa: Fix PBL chunk length computation
arm64: dts: allwinner: sun50i-a64-pinephone: Fix mpu6050 mount matrix
clk: tegra: tegra124-emc: put EMC node on register failure
clk: palmas: Manage external-control prepare with devm
clk/x86: pmc_atom: add kasprintf return value check
clk: mediatek: mt8135: Fix inverted gate control for devapc_ck
clk: rockchip: Fix the fractional part denominator on RK3588/RK3576 PLLs
nilfs2: fix infinite loop in nilfs_clean_segments()
nilfs2: prevent out-of-bounds read in super root block parsing
nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch
scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches.
RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs
** Changed in: linux (Ubuntu)
Status: Confirmed => Invalid
** Changed in: linux (Ubuntu Noble)
Importance: Undecided => Medium
** Changed in: linux (Ubuntu Noble)
Status: New => In Progress
** Changed in: linux (Ubuntu Noble)
Assignee: (unassigned) => Manuel Diewald (diewald)
** Summary changed:
- Noble update: upstream stable patchset 2026-10-07
+ Noble update: upstream stable patchset 2026-10-06
** Description changed:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
- upstream stable patchset 2026-10-07
+ upstream stable patchset 2026-10-06
+
+ Ported from the following upstream stable releases:
+ v6.6.157, v6.12.110
+
from git://git.kernel.org/
+
+ RDMA/mlx5: Send cong param changes to the resolved port mdev
+ RDMA/cxgb4: free STAG index when TPT entry write fails
+ IB/isert: reject PDUs declaring more data than was received
+ IB/isert: reject login PDUs declaring more data than was received
+ nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request
+ spi: davinci: switch to managed controller allocation
+ wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event()
+ platform/chrome: cros_ec_debugfs: Clean up console log on probe failure
+ platform/chrome: cros_ec_debugfs: Unregister panic notifier
+ wifi: rtlwifi: pci: fix error path in rtl_pci_probe()
+ bus: mhi: host: Flush the posted write after writing to
MHI_SOC_RESET_REQ_OFFSET
+ md/raid5: protect bitmap batch counters aka seq_flush/seq_write consistency
+ md/raid5-ppl: fix use-after-free in ppl_do_flush()
+ md: ensure resync is prioritized over recovery
+ md: allow removing faulty rdev during resync
+ md: rename recovery_cp to resync_offset
+ md: add a new recovery_flag MD_RECOVERY_LAZY_RECOVER
+ md: add a new helper rdev_has_badblock()
+ md/raid5: protect lockless recovery_offset accesses during reshape
+ tools/nolibc/powerpc: mark ctr and xer as clobbered by system call
+ md: recheck spare changes before starting sync
+ selftests/zram: fix kernel_gte() for POSIX sh
+ slab: simplify init_kmem_cache_nodes() error handling
+ slab: Make slub local_(try)lock more precise for LOCKDEP
+ wifi: ath12k: fix stride mismatch in mac_phy_caps_parse()
+ wifi: ath11k: fix stride mismatch in mac_phy_caps_parse()
+ rcu: Mark accesses to ->rcu_urgent_qs and ->rcu_need_heavy_qs
+ arm64: dts: qcom: msm8998: Don't pull-up I2C pins by default in sleep
+ arm64: dts: qcom: sdm632-motorola-ocean: Fix LED default trigger property
+ arm64: dts: qcom: qcs404: Fix DTBS Check errors in usb controller nodes
+ clk: qcom: gcc-qcm2290: don't park QUP RCGs upon registration
+ arm64: dts: qcom: sc8280xp-crd: Fix the pin index for misc_3p3_reg_en
+ dt-bindings: interrupt-controller: arm,gic: add ESPI and EPPI specifiers
+ firmware: qcom_scm: Add API to get waitqueue IRQ info
+ firmware: qcom: scm: Remove redundant scm argument from
qcom_scm_waitq_wakeup()
+ firmware: qcom_scm: Support multiple waitq contexts
+ firmware: qcom: scm: add trace events for the SMC call interface
+ firmware: qcom: scm: instrument SMC call path with tracepoints
+ firmware: qcom: scm: Fix NULL dereference in IRQ handler before __scm is
published
+ arm64: dts: qcom: sm8250-xiaomi-elish: correct the board ID
+ arm64: dts: qcom: sc8180x: Fix the PCIe iommu-map entries
+ arm64: dts: qcom: sdm845: Fix the PCIe iommu-map entries
+ arm64: dts: qcom: sm8150: Fix the PCIe iommu-map entries
+ arm64: dts: qcom: sm8250: Fix the PCIe iommu-map entries
+ arm64: dts: qcom: sm8350: Fix the PCIe iommu-map entries
+ arm64: dts: qcom: sm8450: Fix the PCIe iommu-map entries
+ arm64: dts: qcom: sm8550: Fix the PCIe iommu-map entries
+ arm64: dts: qcom: sm8650: add OPP table support to PCIe
+ arm64: dts: qcom: sm8650: Fix the PCIe iommu-map entries
+ power: supply: isp1704_charger: cancel work on remove
+ power: supply: sc2731_charger: cancel work on remove
+ bpf: Fix potential UAF in bpf_netns_link_update_prog
+ bpf: Fix potential UAF when reading bpf link info
+ lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone
+ clk: qcom: Return expected ENOMEM error on dynamic allocation failure
+ md/bitmap: resume array on backlog_store() error path
+ md: remove unused mddev argument from export_rdev
+ md: skip redundant raid_disks update when value is unchanged
+ md: scope memalloc_noio to allocation critical sections
+ iommu/dma: Check atomic pool allocation result directly
+ swiotlb: Preserve allocation virtual address for dynamic pools
+ i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices
+ i3c: master: Fix device_register() error path
+ md: merge mddev has_superblock into mddev_flags
+ md: merge mddev faillast_dev into mddev_flags
+ md: merge mddev serialize_policy into mddev_flags
+ md/raid1: create serial pool adding rdev to array with serialize_policy=1
+ locking/lockdep: Fix NULL pointer dereference in __lock_set_class()
+ misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe()
+ mm/treewide: replace pmd_large() with pmd_leaf()
+ misc: sgi-gru: remove interrupt-context page-table walks
+ fanotify: report full event length for FIONREAD
+ wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length
+ wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986
+ wifi: mt76: mt7925: fix msg len mismatch between driver and firmware
+ wifi: mt76: mt792x: Fix memory leak in SDIO TX path
+ wifi: mt76: mt7996: fix capability of EHT-MCS 15 in MRU
+ wifi: mt76: fix non-AQL packet accounting for MLO stations
+ wifi: mt76: mt7996: validate RX band_idx before dereferencing phys[]
+ wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset
+ wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss
+ wifi: mt76: mt7996: don't report a zero TX bitrate
+ wifi: mt76: mt7915: write RX header translation bit to the correct register
+ wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie
+ wifi: mt76: check txfree done event on the WED hw path
+ wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config
+ wifi: mt76: mt7915: unwind state on add_interface failure
+ wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV
+ wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields
+ wifi: mt76: only consume the WO drop bit on WED v2 devices
+ ACPI: processor: Unregister cpufreq notifier on init failure
+ perf: arm_spe: Make wakeup range check overflow safe
+ drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0)
+ drm/msm/dsi: Drop dev_pm_opp_set_rate(0)
+ wifi: ath11k: fix leak in ath11k_service_ready_ext_event()
+ regulator: core: use system_freezable_wq for init complete work
+ perf machine: Fix NULL parent dereference in fork event processing
+ perf machine: Guard against NULL strlist in machines__findnew()
+ perf machine: Use snprintf() for guestmount path construction
+ perf machine: Check snprintf truncation in machines__findnew()
+ perf machine: Don't abort guest map creation on first inaccessible dir
+ perf machine: Reset errno before strtol in guest kernel map creation
+ perf machine: Free scandir entries in guest kernel map creation
+ perf machine: Check snprintf truncation for guest kallsyms path
+ bpf, x86: Fix trampoline stack size for 128-bit arguments
+ wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement
+ wifi: mt76: mt7915: fix double hif2 init on the non-WED path
+ wifi: mt76: mt7915: fix ext PHY use-after-free on register error path
+ wifi: mt76: mt7915: release hif2 reference on probe IRQ failure
+ wifi: mt76: mt7996: fix reg addr remap when addr is 0
+ wifi: mt76: mt7915: fix chainmask handling for non-dbdc phys on band 1
+ wifi: mt76: mt7915: report RX chain signal for all RX paths
+ wifi: mt76: mt7925: advertise EHT 320MHz capabilities for 6GHz band
+ wifi: mt76: mt7925: Fix EHT Beamformee SS subfields to meet 802.11be minimum
+ wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump
+ iommu/arm-smmu-v3: Convert to use atomic poll timeout
+ perf/cxlpmu: Fix 64-bit write to 32-bit HDM filter register
+ wifi: mac80211: send TWT teardown to peer after setup TX failure
+ wifi: zd1211rw: reject secondary interfaces to prevent conflicts
+ wifi: mac80211: skip unused probe response countdown offsets
+ firmware: google: Add bounds checks in coreboot_table_populate()
+ firmware: coreboot: Validate table bounds
+ powerpc/smp: add NULL guard for cause_ipi in smp_muxed_ipi_message_pass
+ powerpc/irq: Fix missing r2 clobber in PCREL inline assembly
+ MIPS: ptrace: Fix syscall skipping via PTRACE_SYSCALL
+ serial: amba-pl011: unprepare console clock on unregister
+ tty: clear cdev pointer after cdev_add() failure
+ HID: i2c-hid: Refactor _DSM helper and add i2c-hid-acpi-prp0001 driver
+ HID: synchronize input before cleaning up a failed probe
+ HID: i2c-hid: Fix "(null)" output when reading report descriptor fails
+ HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure
+ HID: lg4ff: validate report length before fixed offsets
+ perf thread-stack: Fix heap buffer overflow on branch stack wrap copy
+ perf auxtrace: Fix queue grow overflow and old array leak
+ perf intel-pt: Fix off-by-one in auxtrace_info minimum size check
+ perf intel-bts: Fix off-by-one in auxtrace_info minimum size check
+ iio: light: tsl2772: fix ALS calibscale readback
+ iio: light: isl29028: return zero in write_raw() on success
+ iio: light: tsl2583: return zero in write_raw() on success
+ phonet: pep: do not write beyond optlen in getsockopt
+ blk-cgroup: skip dying blkg in blkcg_activate_policy()
+ block/blk-stat: drain per-cpu callback stats over possible CPUs
+ block/blk-iocost: collect per-cpu latency stats over possible CPUs
+ block/kyber-iosched: flush per-cpu latency buckets over possible CPUs
+ ublk: check for ublk_unmap_io() returning 0
+ o2hb_region_dev_store(): avoid goto around fdget()/fdput()
+ ocfs2/cluster: keep heartbeat local node stable
+ lib/string: fix memchr_inv() for large ranges
+ pps: don't try to wait for negative timeouts in PPS_FETCH
+ pps: clients: gpio: Bypass edge's direction check when not needed
+ pps: pps-gpio: split IRQ handler into hardirq timestamper + threaded handler
+ pps-gpio: remove dead capture_clear code
+ rapidio: clear mport->net when rio_add_net() fails
+ fat: release buffer head after rebuilding parent
+ drm/omap: dsi: Do not copy isr table
+ arm64: dts: qcom: agatti: Add missing CX power domain to DISPCC
+ remoteproc: Move resource table data structure to its own header
+ remoteproc: use rsc_table_for_each_entry() in rproc_handle_resources()
+ remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()
+ bpf, cgroup: Fix invalid storage access after __cgroup_bpf_attach failed
+ selftests/mm: add new test cases to the migration test
+ ksm_tests: skip hugepage test when Transparent Hugepages are disabled
+ selftests/mm: ksm_tests: use kselftest framework
+ selftests/mm: fix ksm NUMA merge test for systems with memoryless NUMA nodes
+ selftests/mm: fix ternary operator precedence in ksm_tests
+ arm64: dts: qcom: sm7225-fairphone-fp4: Fix swapped USB QMP PHY
vdda-phy/vdda-pll supplies
+ scripts/tags.sh: Prevent binary files appearing in cscope.files
+ modpost: prevent leak when early return no suffix .o in read_symbols()
+ RDMA/erdma: Hold CQ references when processing EQ events
+ RDMA/erdma: Hold QP references for AE and CM processing
+ RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ
+ ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults
+ ocfs2: synchronize heartbeat callbacks with o2net teardown
+ drm/sun4i: vi scaler: Fix coefficient selection
+ drm/sun4i: tcon: Set output mux for DSI and LVDS
+ drm/sun4i: tcon: Drop TCON TOP device reference
+ drm/sun4i: hdmi: Don't leak sync polarity bits into packet control
+ drm/sun4i: crtc: Propagate layer initialization error
+ drm/sun4i: tcon: Drop remote endpoint reference
+ drm/sun4i: dw-hdmi: Drop TCON TOP port reference
+ drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz
+ cpufreq: imx6q: fix devres accumulation across driver rebind
+ cpufreq: imx6q: fix out-of-bounds write when probed more than once
+ IB/isert: delay the final Login Response until the session is registered
+ IB/isert: post the full-feature receive buffers after session registration
+ RDMA/siw: Fix use-after-free in siw_accept()
+ module: replace use of system_wq with system_dfl_wq
+ module: use strscpy() to copy module names in stats and dup tracking
+ module/dups: Inform duplicate requests about the result directly
+ module/dups: Fix use-after-free in kmod_dup_req lifetime handling
+ RDMA/erdma: restrict the driver to little-endian systems
+ UBUNTU: [Config] Set INFINIBAND_ERDMA to not-applicable on s390x
+ wifi: mac80211: skip default WMM setup for AP_VLAN links
+ arm64: hibernate: mask DAIF before restoring hibernated kernel
+ arm64: hibernate: Restore DAIF state on error
+ mfd: rave-sp: validate received frame payload lengths
+ mfd: iqs62x: Reject zero-length firmware records
+ drm/amdgpu/gfx6: Fixup emit_cntxcntl()
+ ext4: fix spurious message about orphan cleanup on RO fs
+ arm64: dts: ti: k3-am64: Fix MDIO clock reference for ICSSG0 node
+ phy: sunplus: fix error handling in sp_uphy_init()
+ phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table
+ perf trace-event: Fix buffer overflow in read_string()
+ drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets
+ drm/amdgpu/gfx6: Use PFP on the compute queues too
+ scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path
+ firmware_loader: do not queue completed sysfs fallback requests
+ pinctrl: rockchip: Reset the pin count when recalculating SoC data
+ hugetlbfs: release subpool on fill_super failure
+ soc: fsl: qe: check platform_driver_register() in qe_ic_of_init()
+ phy: qcom-sgmii-eth: relax order of .power_on() vs .set_mode*()
+ phy: qcom: sgmii-eth: vote for both voltage rails with correct current loads
+ phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend
+ phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend
+ phy: qcom: qmp-usb: Fix possible NULL-deref on early runtime suspend
+ md/raid5: round bitmap stripes with sector division
+ md: avoid stale clone I/O accounting timestamps
+ md/raid1: don't set array_frozen in raid1_takeover()
+ coresight: etm4x: fix wrong check of etm4x_sspcicrn_present()
+ coresight: Change syncfreq to be a u8
+ coresight: etm4x: fix underflow for usage of (nrseqstate - 1)
+ coresight: etm4x: fix leaked trace id
+ regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling
+ ACPI: video: Release PCI device reference after lookup
+ perf/x86/intel/pt: Factor out pt_config_enable()
+ perf/x86/intel/pt: Use bitwise access for PERF_HES_STOPPED
+ perf/x86/intel/pt: Fix stop/start with no update
+ sched/fair: Check CPU capacity before comparing group types during load
balance
+ Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event
+ Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855()
+ Bluetooth: btusb: refactor endpoint lookup
+ Bluetooth: btusb: Record matched usb_device_id into btusb_data
+ Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices
+ perf trace-event: Fix integer truncation in do_read() and skip()
+ scsi: sd: Fix sd_done() sense handling condition
+ btrfs: retry verity reads for not-uptodate Merkle folios
+ Bluetooth: virtio_bt: avoid OOB read of build info string
+ Bluetooth: btintel: Fix diagnostics event detection
+ Bluetooth: hci_conn: fix the SCO setup context lifetime
+ Bluetooth: hci_sync: free the advertising instance on the failure and cancel
paths
+ Bluetooth: MGMT: free the mesh send cancel command when it is cancelled
+ mmc: sdio: add MediaTek MT7902 SDIO device ID
+ Bluetooth: btmtk: add MT7902 MCU support
+ Bluetooth: btmtk: add MT7902 SDIO support
+ Bluetooth: btmtksdio: fix usage_count leak when autosuspend_delay is negative
+ Bluetooth: MSFT: validate evt_prefix_len against the response length
+ cgroup: Add bpf prog revisions to struct cgroup_bpf
+ bpf: Implement mprog API on top of existing cgroup progs
+ bpf, cgroup: Fix storage null-ptr-deref after replacing prog
+ iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes
+ iio: light: gp2ap002: re-enable irq if runtime suspend fails
+ net/sched: cls_api: fix teardown of an adopted proto on insert-race loss
+ riscv: cpufeature: Clarify ISA spec version for canonical order
+ arm64: dts: turris-mox: fix usb3 phys
+ ARM: dts: helios4: add vcc-supply to EEPROM
+ ARM: dts: helios4: add vcc-supply to GPIO expander
+ ARM: dts: helios4: add SATA regulator supplies
+ perf stat: Fix evsel_list leak in cmd_stat
+ perf synthetic-events: Fix uninitialized pthread_join
+ perf test: Introduce workloads__for_each()
+ perf test: Add a signal handler around running a test
+ perf test: Add a signal handler to kill forked child processes
+ perf test: Rename functions and variables for better clarity
+ perf test: Send list output to stdout rather than stderr
+ perf test: Support dynamic test suites with setup callback and private data
+ perf test: Fix skiplist leak in cmd_test
+ perf python: Remove python 2 scripting support
+ perf python: Add support for 'struct perf_counts_values' to return counter
data
+ perf python: Check counts_values size in set_values
+ perf synthetic-events: Fix divide by zero in perf_event__synthesize_threads
+ fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device()
+ fbdev: kyro: Validate overlay viewport coordinates
+ iommu/vt-d: Fix UCTP context table slot when copying root entries
+ m68k: Fix backtraces for non-running tasks
+ arm64: Disable KCSAN instrumentation in delay.o
+ SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6
+ sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE
+ powerpc/configs: enable CONFIG_RAS to fix EDAC support
+ phy: qcom: qmp-combo: Correct pre-emphasis table for QMP v4 DP PHYs
+ phy: qualcomm: qmp-combo: add support for SAR2130P
+ phy: qcom: qmp-combo: Add new PHY sequences for SM8750
+ phy: qcom-qmp-combo: Use regulator_bulk_data with init_load_uA for regulator
setup
+ phy: qualcomm: Update the QMP clamp register for V6
+ phy: qualcomm: qmp-combo: Update QMP PHY with Glymur settings
+ phy: qualcomm: qmp-combo: Add DP offsets and settings for Glymur platforms
+ phy: qcom: qmp-combo: Drop qmp_v4_calibrate_dp_phy
+ spi: sprd-adi: Fix probe succeeding without registering the controller
+ ASoC: qcom: q6apm: keep the graph start count in sync with the DSP
+ nvme: add reservation command's defines
+ nvme: introduce change ptpl and iekey definition
+ nvme: Add the DHCHAP maximum HD IDs
+ nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()
+ nvme-apple: Destroy the admin queue on removal
+ nvme-apple: Don't set a DMA direction for commands without a data transfer
+ nvme-apple: Never set the opcode in the NVMMU TCB
+ nvme: apple: Add Apple A11 support
+ nvme-apple: Drop the PRP null check chicken bit
+ nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns()
+ nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()
+ nvme: reject passthrough of driver-managed Set Features
+ nfc: llcp: avoid userspace overflow on invalid optlen
+ nfc: llcp: read llcp_sock->local under the socket lock in getsockopt
+ nfc: nci: fix double completion race in nci_data_exchange_complete
+ nfc: llcp: bound SNL TLV parsing to the skb and add length checks
+ nfc: pn533: hold a reference to the request skb during send_frame
+ nfc: digital: Do not dump a NULL response in command completion
+ nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing
+ ALSA: seq: Don't leak the extension cell pointer in the bounce payload
+ dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal
+ RDMA/cxgb4: Free debugfs on registration failure
+ RDMA/cma: Fix WARNING in res_to_rt
+ ice: clear the default forwarding VSI rule when releasing a VSI
+ ASoC: pxa: Use devm_clk_get_optional() for extclk clock
+ ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready
+ UBI: Preserve torture flag when rescheduling failed erasures
+ UBI: fastmap: Pass to_be_tortured when reusing old fastmap PEBs
+ ubi: Fix rollback for explicit UBI device numbers
+ mtd: ubi: Release device reference on busy detach
+ ASoC: xilinx: formatter_pcm: fix stream_data leak on open error
+ UBI: fix two issues in the ubi.mtd MODULE_PARM_DESC
+ firewire: core: add common inline functions to serialize/deserialize
asynchronous packet header
+ firewire: obsolete usage of *-objs in Makefile for KUnit test
+ firewire: core: add enumerator of self ID sequences and its KUnit test
+ firewire: ohci: add static inline functions to deserialize for Self-ID DMA
operation
+ firewire: core: add KUnit test skeleton for node tree
+ firewire: core: add KUnit tests for successful tree building
+ firewire: core: add KUnit tests for failure of tree building
+ firewire: core: consolidate port counting in build_tree()
+ firewire: core: validate parent port count before allocating nodes in
build_tree()
+ firewire: core: fix memory leak in error path of build_tree()
+ PCI/ASPM: Use pcie_capability_clear_and_set_word() for ASPM disable/restore
+ super: fix dying superblock warning messages
+ kunit: tool: fix _list_tests filtering wrong variable when list has TAP prefix
+ selftests/bpf: vmtest.sh: Preserve command quoting when running in the VM
+ spi: img-spfi: don't disable runtime PM on DMA deferred probe
+ PCI/ASPM: Cache L0s/L1 Supported so advertised link states can be overridden
+ PCI/ASPM: Disable/restore ASPM on every function for multi-function devices
+ power: supply: bd99954: Drop bad register fields
+ power: supply: bq27xxx: bq27520g4: fix REG_TTES address
+ power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address
+ power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address
+ xenbus: Unregister reboot notifier on init failure
+ s390/debug: Fix deadlock during unregister
+ clocksource/drivers/clps711x: Do not unmap clocksource MMIO
+ clocksource/drivers/armada: Unwind timer clock on init failure
+ ALSA: seq: midi: Optimize event_input locking with RCU
+ ALSA: seq: midi: Serialize input teardown with event_input
+ cgroup/cpuset: Fix spelling errors in file kernel/cgroup/cpuset.c
+ cgroup/cpuset: Remove remote_partition_check() & make update_cpumasks_hier()
handle remote partition
+ selftest/cgroup: Update test_cpuset_prs.sh to use | as effective CPUs and
state separator
+ selftest/cgroup: Clean up and restructure test_cpuset_prs.sh
+ selftests/cgroup: Preserve CPU hotplug write errors
+ x86/pkeys: Fix pkey_alloc() return value when pkeys are not supported
+ bpftool: Fix double close in map dump
+ ocfs2: fix circular locking dependency in ocfs2_init_acl()
+ Squashfs: check block offset is not negative
+ selftests/bpf: Fix for veristat file/prog filters processing
+ scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers
+ scsi: ufs: core: Remove redundant host_lock calls around UTMRLDBR
+ scsi: ufs: core: Set task state before io_schedule_timeout()
+ fs/ntfs3: fix integer overflow in MFT cluster validation
+ fs/ntfs3: reject out-of-range evcn in mi_enum_attr()
+ ALSA: core: Fix use-after-free in snd_card_do_free()
+ tracing: Remove "__attribute__()" from the type field of event format
+ tracing: Have trace_event_update_all() only handle module that is loading
+ ASoC: SOF: validate topology volume range before allocation
+ HID: multitouch: reclassify HTIX5288 to WIN_8_FORCE_MULTI_INPUT_NSMU
+ riscv, bpf: Fix missing sign-ext for signed 1-byte and 2-byte kfunc args
+ ring-buffer: Remove trace_buffer::cpus
+ ACPI: scan: fix bus ID cleanup on device_add() failures
+ bpf: Fix pending_pos walk on 32-bit ring position wrap
+ crypto: hisilicon/sec2 - fix CCM algorithm long packet failure
+ crypto: lskcipher - propagate errors from unaligned crypt
+ perf dso: Guard close() against invalid fd in dso__decompress_kmodule_path()
+ perf dso: Use stored fd error instead of stale errno in file_read() and
file_size()
+ perf dso: Guard against cache underflow on short reads in dso_cache__memcpy()
+ mailbox: rockchip: disable pclk on probe failure and unbind
+ mailbox: pcc: Always map the shared memory communication address
+ mailbox/pcc: support mailbox management of the shared buffer
+ Revert "mailbox/pcc: support mailbox management of the shared buffer"
+ mailbox: pcc: Fix command timeout due to missed interrupt
+ null_blk: use DEFINE_MUTEX for the file-scope mutex
+ null_blk: register configfs subsystem after creating default devices
+ null_blk: free global tag_set on init error path
+ null_blk: free zones array on device power-off
+ null_blk: reject per-device queue resize for shared tag set
+ null_blk: serialize configfs attribute stores with the lock
+ null_blk: serialize configfs attribute updates with device setup
+ ublk: reject non-power-of-2 zone sizes in SET_PARAMS
+ block: mtip32xx: synchronize ioctls with device removal
+ hwmon: (coretemp) Fix core_data leak on CPUs without PTS
+ hwmon: (emc1403) Rely on subsystem locking
+ hwmon: (emc1403) Drop hysteresis for low limit temperature
+ ksmbd: Do not skip lock checks for single-byte ranges
+ smb: server: fix leak of ksmbd_ipc_login_request_ext() returned buffer
+ ksmbd: validate ipc response length before dereferencing its fields
+ ksmbd: do not advertise unimplemented CA support
+ ksmbd: free preauth sessions on connection teardown
+ smb/server: fix null-ptr-deref in ksmbd_ipc_tree_connect_request()
+ smb/server: preserve error status in smb2_handle_negotiate()
+ lwt_bpf: Restore reserved headroom after xmit program
+ erofs: convert z_erofs_bind_cache() to folios
+ erofs: support unaligned encoded data
+ erofs: fix unused pcluster_pools for higher page sizes
+ bpf: Disallow bpf_{g,s}etsockopt() in cgroup UNIX getname hooks
+ m68k: nfcon: Do not call console_is_registered() in nfcon_device()
+ bpf: Reject negative optlen in cgroup getsockopt hook
+ ksmbd: disconnect on SMB3 decryption failure
+ ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size
+ smb/server: fix session leak in ksmbd_session_register()
+ nfs: replace atomic bitops sequence with clear_and_wake_up_bit helper
+ nfs: refactor pNFS functions using clear_and_wake_up_bit
+ NFSv4: remove callback IDR entry on client allocation failure
+ pnfs/blocklayout: Fix device leaks on parse failure
+ NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in
nfs4_add_lease()
+ clk: ti: use kcalloc() instead of kzalloc()
+ clk: ti: mux: resolve parent clocks by DT index, not by name
+ octeontx2-af: initialize lmac_bmap in rvu_mcs_set_lmac_bmap()
+ drm/xe: tests: fix error message in xe_migrate_sanity_test()
+ net: kcm: Hold RCU read lock while running BPF parser
+ net: dsa: b53: fix error propagation from b53_fdb_dump()
+ pppox: drain queued packets on channel handoff
+ net: hsr: free learned nodes on device setup failure
+ f2fs: fix to parse temperature correctly in f2fs_get_segment_temp()
+ f2fs:Fix incomplete search range in f2fs_get_victim when f2fs_need_rand_seg
is enabled
+ f2fs: cleanup w/ f2fs_need_rand_{blk, seg, seg_blk}
+ f2fs: fix to avoid pinfile fragment on fragment:{block, segment} mode
+ ipvs: fix integer overflow in ftp helper port/address parsing
+ vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes
+ net: dsa: mv88e6xxx: Fix PCS link check on CMODE read error
+ tls: fix RX desync on overlapping skbs
+ net: bridge: vlan: fix inverted default vlan notification
+ cuse: wait for pending RCU callbacks on module exit
+ fs/ntfs3: fix out-of-bounds read in read_log_rec_buf()
+ fs/ntfs3: validate ef->size covers the record's name and value
+ fuse: support folios in struct fuse_args_pages and fuse_copy_pages()
+ fuse: convert readdir to use folios
+ fuse: check attributes staleness on fuse_iget()
+ fuse: check for NULL root inode in fuse_fill_super_submount
+ ALSA: hda: Fix connection list comparison in proc output
+ vxlan: mdb: Fix use-after-free in vxlan_mdb_flush()
+ 8139cp: fix Rx and Tx not being disabled in cp_suspend
+ net/smc: hash socket only after full initialisation in smc_sk_init()
+ platform/x86: dell-wmi-sysman: Fix instance ID bounds
+ vsock: avoid timeout for non-blocking accept() with empty backlog
+ vsock: don't check the listener's sk_err in vsock_accept()
+ vsock: use sock_error() to consume sk_err after a failed connect
+ platform/x86: hp-bioscfg: fix password encoding bounds check
+ mlxbf-bootctl: fix the build error with FIELD_PREP()
+ bonding: initialize err for empty target lists
+ net: add missing ref_tracker_dir_exit() to alloc_netdev_mqs()
+ i3c: mipi-i3c-hci: Quieten initialization messages
+ i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc()
+ i3c: mipi-i3c-hci: Refactor PIO register initialization
+ i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode
+ virtio_balloon: disable indirect descriptors
+ vdpa_sim: fix cleanup after worker creation failure
+ vdpa/mlx5: fix wrong list iterated in add_direct_chain error path
+ rtc: pcf8563: fix clock provider leak on unbind
+ smb: client: fix request buffer leak in smb2_new_read_req()
+ rtc: zynqmp: Return optional clock lookup errors
+ irqchip/renesas-rzg2l: Fix loss of interrupt
+ i2c: ocores: Disable clock on failed resume
+ rtc: gamecube: check return value of devm_rtc_register_device()
+ prctl: fix PR_SET_MM_AUXV losing the forced AT_NULL terminator
+ clk: ti: Make sure clk_init_data is fully initialized
+ clk: visconti: Make sure clk_init_data is fully initialized
+ ALSA: core: Add scoped cleanup helper for card references
+ ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup
+ RDMA/ucma: Allow path records to exactly fit the output buffer
+ xsk: Get rid of xdp_buff_xsk::orig_addr
+ xsk: avoid double checking against rx queue being full
+ xsk: fix NULL pointer dereference in __xsk_rcv()
+ net: bridge: Reject descending VLAN tunnel ranges
+ net/sched: add get_fill_size callbacks for actions missing them
+ net: thunderbolt: Count delivered packets in rx_packets and rx_bytes
+ forcedeth: stop the tx_timeout register dump past the requested window
+ net: ipa: balance runtime PM reference on remove error
+ net: add missing ref_tracker_dir_exit() to net_passive_dec()
+ net: qlcnic: validate unified ROM sections before loading
+ inetpeer: randomize RB-tree node comparison using SipHash
+ net_sched: sch_fifo: implement lockless __fifo_dump()
+ net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue
+ net/smc: free stashed qentry before overwrite in REQ_ADD_LINK to ADD_LINK
transition
+ net/smc: free pending qentry in smc_llc_flow_stop() before memset
+ NFSv4.2: fix LAYOUTSTATS send buffer exhaustion
+ nfs: move the nfs4_data_server_cache into struct nfs_net
+ NFSv4/pnfs: key the data server cache on the NFS version
+ rtc: pcf85363: Add error checking to regmap calls in probe()
+ bnxt_en: Fix call to hardware monitoring event handler
+ scsi: qla2xxx: Fix an loop timeout test
+ erofs: Fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS default logic
+ s390: Add missing _TIF defines
+ s390: Add ARCH_HAS_PREEMPT_LAZY support
+ powerpc: Add preempt lazy support
+ mm: make DEBUG_WX depdendent on GENERIC_PTDUMP
+ mm: rename GENERIC_PTDUMP and PTDUMP_CORE
+ UBUNTU: [Config] Rename ptdump configs: GENERIC_PTDUMP->ARCH_HAS_PTDUMP,
PTDUMP_CORE->PTDUMP
+ mm/ptdump: split note_page() into level specific callbacks
+ arm64: ptdump: Make note_page_flush() range aware
+ Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN
+ Bluetooth: mgmt: fix 'hdev->discovery.uuids' NULL dereference
+ Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan
+ Bluetooth: btmtk: Mark all stub functions as inline
+ Bluetooth: btmtk: Add MT6639 (MT7927) Bluetooth support
+ Bluetooth: btmtk: Fix short read errors in btmtk_usb_reg_read()
+ Bluetooth: btmtk: Do not report success when subsys reset fails
+ Bluetooth: btmtk: Do not discard the subsystem reset timeout
+ Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX
+ Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path
+ Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop
+ gtp: add synchronize_net() in gtp_newlink() error path to prevent
use-after-free
+ net: qualcomm: rmnet: restore skb->dev on deaggregated frames
+ octeontx2-af: Fix TL3/TL2 link config ENA clearing
+ net/rds: use wq_has_sleeper() in rds_cong_map_updated()
+ cifs: fix clearing stats for fastest execution of each smb2 command
+ selftests/mm/cow: modify the incorrect checking parameters
+ selftests/mm: add helper for logging test start and results
+ selftests/mm: report unique test names for each cow test
+ selftests/mm: skip COW tmpfile cases when fallocate() is unsupported
+ maple_tree: catch race in mas_alloc_cyclic()
+ maple_tree: fix argument name in header
+ net_sched: act_skbmod: use RCU in tcf_skbmod_dump()
+ net/sched: act_skbmod: fix length calculations and avoid invalid header
warnings
+ net/sched: fq: add overflow bounds to quantum and initial quantum
+ net/sched: fq_codel: clamp default quantum and mtu
+ net/sched: sch_codel: clamp default mtu to avoid disabling CoDel
+ net/sched: fq_pie: clamp default quantum to avoid signed overflow
+ net/sched: hhf: clamp quantum before hhf_change() to avoid overflow
+ net/sched: sfq: clamp quantum to avoid signed overflow soft lockup
+ net/sched: sch_teql: restore skb->dev on the slave failure path
+ tpm: st33zp24: Return zero on status read failure
+ tpm: st33zp24: Validate locality read result
+ apparmor: Replace sprintf/strcpy with scnprintf/strscpy in aa_policy_init
+ apparmor: policy_int make sure list heads are initialized before fail path
+ ASoC: dapm: Fix off-by-one check on the second enum channel
+ ceph: revalidate ki_pos for O_APPEND writes after cap acquisition
+ libceph: validate banner payload length
+ samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-modify
+ samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify
+ net: ethernet: sun4i-emac: Fix IRQ error handling
+ net: wangxun: use BIT_ULL() to prevent shift overflow on 32-bit archs
+ net: stmmac: selftests: Pass the IP proto mask in the TC selftest
+ virtio-net: Ensure that TCP packets don't overflow gso_segs
+ netfilter: nf_tables: move hardware offload step after building the chain blob
+ netfilter: xt_cgroup: Make it independent from net_cls
+ netfilter: xt_HL: add pr_fmt and checkentry validation
+ netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited()
+ ALSA: control: Don't add invalid kcontrols to LED layer
+ selftests: arm64: add hugetlb mte tests
+ selftests/arm64: Print missing MTE TAP headers
+ selftests/arm64: Treat KSM merge_across_nodes as optional
+ net: stmmac: selftests: Check multiple MMC counters
+ net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering
+ net: stmmac: dwmac4: Account for the primary MAC address for UC filtering
+ net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering
+ net: stmmac: selftests: Account for the UC filter list for filtering tests
+ net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup
+ slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()
+ net: fec: only stop PTP if it was initialized
+ usb: atm: usbatm: fix invalid ci_range initialization
+ tcp: fix corruption of urgent data on multi-segment retransmit
+ net/sched: sch_htb: limit htb_classify inner-class filter hops
+ platform/x86: lg-laptop: Check ACPI_COMPANION() against NULL
+ pinctrl: mediatek: eint: Drop base from mtk_eint_chip_write_mask()
+ pinctrl: mediatek: Fix new design debounce issue
+ pinctrl: mediatek: common-v1: Fix EINT breakage on older controllers
+ md: keep recovery_cp in mdp_superblock_s
+ slub: Don't call lockdep_unregister_key() for immature kmem_cache.
+ ACPI: processor: Update cpuidle driver check in __acpi_processor_start()
+ fscrypt: convert bh_get_inode_and_lblk_num to use a folio
+ fscrypt: fix left shift underflow when inode->i_blkbits > PAGE_SHIFT
+ selftests/bpf: add verification for BPF_PROG_QUERY attr size boundaries
+ bpf: fix BPF_PROG_QUERY OOB write and cgroup backward compat
+ phy: qcom: qmp-combo: Add missing PLL (VCO) configuration on SM8750
+ nvme-apple: Prevent shared tags across queues on Apple A11
+ nvme-apple: Reset q->sq_tail during queue init
+ cpuset: fix warning when disabling remote partition
+ erofs: fix managed cache race for unaligned extents
+ xsk: Fix offset calculation in unaligned mode
+ Bluetooth: btmtk: hide unused btmtk_mt6639_devs[] array
+ net/sched: fq: clamp quantum and initial_quantum in change path
+ kselftest/arm64: mte: Skip the hugetlb tests if MTE not supported on such
mappings
+ kselftest/arm64: mte: Use the correct naming for tag check modes in
check_hugetlb_options.c
+ md: add helper rdev_needs_recovery()
+ md: add a new enum type sync_action
+ md: add new helpers for sync_action
+ md: factor out helper to start reshape from action_store()
+ md: replace sysfs api sync_action with new helpers
+ md: fix sync_action incorrect display during resync
+ net_sched: act_ct: use RCU in tcf_ct_dump()
+ net_sched: act_ctinfo: use RCU in tcf_ctinfo_dump()
+ net_sched: act_skbedit: use RCU in tcf_skbedit_dump()
+ net_sched: act_vlan: use RCU in tcf_vlan_dump()
+ net_sched: act_tunnel_key: use RCU in tunnel_key_dump()
+ net_sched: add back BH safety to tcf_lock
+ tools/build: Use SYSTEM_BPFTOOL for system bpftool
+ pinctrl: mediatek: common-v1: Fix error checking in mtk_eint_init()
+ ACPI: processor: Add cpuidle driver check in
acpi_processor_register_idle_driver()
+ UBUNTU: Upstream stable to v6.6.157, v6.12.110
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2169822
Title:
Noble update: upstream stable patchset 2026-10-06
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2169822/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
