Changelog in Linux kernel 6.1.178

Bluetooth: Remove BT_HS

Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready

Bluetooth: SCO: hold sk properly in sco_conn_ready

bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp()

bonding: 3ad: fix mux port state on oper down

bpf, arm64: Reject out-of-range B.cond targets

bpf, lsm: Add disabled BPF LSM hook list

bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check

bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()

bpf: Add missing access_ok call to copy_user_syms

bpf: Allow LPM map access from sleepable BPF programs

bpf: Check tail zero of bpf_prog_info

bpf: Consistently use bpf_rcu_lock_held() everywhere

bpf: Disable xfrm_decode_session hook attachment

bpf: Fix bpf_get/setsockopt to tos for ipv4-mapped ipv6 socket

bpf: Fix stack slot index in nospec checks

bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs

bpf: Reject fragmented frames in devmap

bpf: Restore sysctl new-value from 1 to 0

bpf: Run generic devmap egress prog on private skb

bpf: Tighten cgroup storage cookie checks for prog arrays

bpf: Update transport_header when encapsulating UDP tunnel in lwt

bpf: zero-initialize the fib lookup flow struct

bpftool: Use libbpf error code for flow dissector query

bridge: cfm: reject invalid CCM interval at configuration time

bridge: stp: Fix a potential use-after-free when deleting a bridge

btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC

btrfs: do not trim a device which is not writeable

btrfs: fix false IO failure after falling back to buffered write

btrfs: fix incorrect buffered IO fallback for append direct writes

btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs()

btrfs: zoned: don't account data relocation space-info in statfs free space

bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker()

bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path

bus: sunxi-rsb: Always check register address validity

can: bcm: add missing rcu list annotations and operations

can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF

can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure

can: esd_usb: kill anchored URBs before freeing netdevs

can: isotp: use unconditional synchronize_rcu() in isotp_release()

cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed

char: tlclk: fix use-after-free in tlclk_cleanup()

cifs: Add tracing for the cifs_tcon struct refcounting

cifs: after disabling multichannel, mark tcon for reconnect

cifs: fix lock ordering while disabling multichannel

cifs: Fix reacquisition of volume cookie on still-live connection

cifs: handle when server stops supporting multichannel

cifs: remove all cifs files before kill super

cifs: validate DFS referral string offsets

clk: at91: keep securam node alive while mapping it

clk: qcom: a53: Corrected frequency multiplier for 1152MHz

clk: scmi: Fix clock rate rounding

clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances

configfs: fix lockless traversals of ->s_children

configfs_lookup(): don't leave ->s_dentry dangling on failure

coresight: cti: Fix DT filter signals silently ignored

coresight: etb10: restore atomic_t for shared reading state

coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore

cpu: hotplug: Bound hotplug states sysfs output

cpu: hotplug: Preserve per instance callback errors

cpufreq: conservative: Simplify frequency limit handling

cpufreq: Documentation: fix conservative governor freq_step description

cpufreq: Documentation: fix sampling_down_factor range

cpufreq: Fix hotplug-suspend race during reboot

cpufreq: intel_pstate: Sync policy->cur during CPU offline

cpufreq: pcc: fix use-after-free and double free in _OSC evaluation

crypto: af_alg - Remove zero-copy support from skcipher and aead

crypto: algif_skcipher - force synchronous processing on trees without ctx->state

crypto: amlogic - avoid double cleanup in meson_crypto_probe()

crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents

crypto: atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0

crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A

crypto: atmel-sha204a - fix blocking and non-blocking rng logic

crypto: atmel-sha204a - Mark OF related data as maybe unused

crypto: caam - use print_hex_dump_devel to guard key hex dumps

crypto: caam - use print_hex_dump_devel to guard key hex dumps again

crypto: cavium/cpt - fix DMA cleanup using wrong loop index

crypto: ccp - Treat zero-length cert chain as query for blob lengths

crypto: crypto4xx - Remove ahash-related code

crypto: crypto4xx - Remove insecure and unused rng_alg

crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels

crypto: drbg - Fix returning success on failure in CTR_DRBG

crypto: drbg - Fix the fips_enabled priority boost

crypto: ecc - Fix carry overflow in vli multiplication

crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve

crypto: hisi-trng - Remove crypto_rng interface

crypto: hisilicon/qm - disable error report before flr

crypto: marvell/octeontx - fix DMA cleanup using wrong loop index

crypto: pcrypt - restore callback for non-parallel fallback

crypto: qat - fix restarting state leak on allocation failure

crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()

crypto: qat - validate RSA CRT component lengths

crypto: rng - Free default RNG on module exit

crypto: sun4i-ss - Remove insecure and unused rng_alg

crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1

crypto: talitos - move code in current_desc_hdr() into a standalone function

crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function

crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function

crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header

cxgb4: Fix decode strings dump for T6 adapters

cxl/test: Add check after kzalloc() memory in alloc_mock_res()

cxl/test: Fix integer overflow in mock LSA bounds checks

dax/kmem: account for partial discontiguous resource upon removal

debugobjects: Plug race against a concurrent OOM disable

device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id()

device property: initialize the remaining fields of fwnode_handle in fwnode_init()

dm era: fix NULL pointer dereference in metadata_open()

dm era: fix out-of-bounds memory access for non-zero start sector

dm thin metadata: fix metadata snapshot consistency on commit failure

dm thin metadata: fix superblock refcount leak on snapshot shadow failure

dm-bufio: fix wrong count calculation in dm_bufio_issue_discard

dm-ioctl: report an error if a device has no table

dm-log: fix a bitset_size overflow on 32bit machines

dm-stats: fix dm_jiffies_to_msec64

dm-stats: fix merge accounting

dm-verity: fix a possible NULL pointer dereference

dm-verity: increase sprintf buffer size

dm_early_create: fix freeing used table on dm_resume failure

dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK

dmaengine: Fix possible use after free

dmaengine: imx-sdma: Refine spba bus searching in probe

dmaengine: qcom: gpi: set DMA_PRIVATE capability

dmaengine: tegra: Fix burst size calculation

Documentation: proc: fix section numbering in table of contents

dpaa2-switch: fix VLAN upper check not rejecting bridge join

drbd: reject data replies with an out-of-range payload size

driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout()

driver core: Guard deferred probe timeout extension with delayed_work_pending()

driver core: Use mod_delayed_work to prevent lost deferred probe work

driver core: use READ_ONCE() for dev->driver in dev_has_sync_state()

drm/amd/display: Add missing kdoc for ALLM parameters

drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch()

drm/amdgpu: initialize irq.lock spinlock earlier

drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free

drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm

drm/amdkfd: Validate CRIU-restored IDs before idr_alloc

drm/edid: fix OOB read in drm_parse_tiled_block()

drm/hisilicon/hibmc: move display contrl config to hibmc_probe()

drm/hisilicon/hibmc: use clock to look up the PLL value

drm/msm/dp: fix HPD state status bit shift value

drm/msm/dp: Fix the ISR_* enum values

drm/nouveau/bios: specify correct display fuse register for Ampere and Ada

drm/radeon: fix memory leak in radeon_ring_restore() on lock failure

drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output()

drm/tegra: Fix iommu_map_sgtable() return value check

drm/tidss: Drop extra drm_mode_config_reset() call

dt-bindings: media: sun4i-a10-video-engine: Add interconnect properties

dt-bindings: net: renesas,ether: Drop example "ethernet-phy-ieee802.3-c22" fallback

dt-bindings: power: imx93: Add MIPI PHY power domain

EDAC/i10nm: Don't fail probing if ADXL is missing

EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info

efivarfs: expose used and total size

efivarfs: fix statfs() on efivarfs

eventpoll: don't decrement ep refcount while still holding the ep mutex

eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}()

eventpoll: fix ep_remove struct eventpoll / struct file UAF

eventpoll: kill __ep_remove()

eventpoll: move epi_fget() up

eventpoll: rename ep_remove_safe() back to ep_remove()

eventpoll: split __ep_remove()

eventpoll: use hlist_is_singular_node() in __ep_remove()

evm: terminate and bound the evm_xattrs read buffer

exfat: bound uniname advance in exfat_find_dir_entry()

ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback

f2fs: bound i_inline_xattr_size for non-inline-xattr inodes

f2fs: fix listxattr handling of corrupted xattr entries

f2fs: fix potential deadlock in f2fs_balance_fs()

f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()

f2fs: keep atomic write retry from zeroing original data

f2fs: validate orphan inode entry count

fbcon: fix NULL pointer dereference for a console without vc_data

fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe()

fbdev: carminefb: fix potential memory leak in alloc_carmine_fb()

fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()

fbdev: hecubafb: fix potential memory leak in hecubafb_probe()

fbdev: i740fb: fix potential memory leak in i740fb_probe()

fbdev: metronomefb: fix potential memory leak in metronomefb_probe()

fbdev: nvidia: fix potential memory leak in nvidiafb_probe()

fbdev: radeon: fix potential memory leak in radeonfb_pci_register()

fbdev: s3fb: fix potential memory leak in s3_pci_probe()

fbdev: sm501fb: Fix buffer errors in OF binding code

fbdev: sm712: Fix operator precedence in big_swap macro

fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe()

fbdev: tridentfb: fix potential memory leak in trident_pci_probe()

fbdev: uvesafb: fix potential memory leak in uvesafb_probe()

file: add fput() cleanup helper

firmware: arm_scmi: Fix OOB in scmi_power_name_get()

firmware: arm_scmi: Read sensor config as 32-bit value

firmware_loader: fix device reference leak in firmware_upload_register()

firmware_loader: Fix recursive lock in device_cache_fw_images()

flow_dissector: check device type before reading ETH_ADDRS

fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header()

fs/ntfs3: add bounds check to run_get_highest_vcn()

fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow

fs/ntfs3: bound attr_off in UpdateResidentValue against data_off

fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass

fs/ntfs3: bound DeleteIndexEntryAllocation memmove length

fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation}

fs/ntfs3: fix syncing wrong inode on DIRSYNC cross-directory rename

fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns

fs/ntfs3: validate lcns_follow in log_replay conversion

fs: efs: remove unneeded debug prints

fs: quota: create dedicated workqueue for quota_release_work

fsl/fman: Free init resources on KeyGen failure in fman_init()

fuse: fix device node leak in cuse_process_init_reply()

fuse: re-lock request before returning from fuse_ref_folio()

gpio-f7188x: Add support for NCT6126D version B

gpio: eic-sprd: use raw_spinlock_t in the irq startup path

gpio: htc-egpio: use managed gpiochip registration

gpio: mvebu: fail probe if gpiochip registration fails

gpio: sch: use raw_spinlock_t in the irq startup path

gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe

gpios: palmas: add .get_direction() op

gpu: host1x: Allow entries in BO caches to be freed

gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path

gpu: host1x: Fix iommu_map_sgtable() return value check

gue: validate REMCSUM private option length

hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length

hfs/hfsplus: prevent getting negative values of offset/length

hfs/hfsplus: zero-initialize buffer in hfs_bnode_read

HID: add haptics page defines

HID: appleir: fix UAF on pending key_up_timer in remove()

HID: core: Fix OOB read in hid_get_report for numbered reports

HID: letsketch: fix UAF on inrange_timer at driver unbind

HID: lg-g15: cancel pending work on remove to fix a use-after-free

HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter

HID: multitouch: fix out-of-bounds bit access on mt_io_flags

HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait()

HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads

HID: wacom: stop hardware after post-start probe failures

hwmon: (asus_atk0110) Check package count before accessing element

hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig

hwmon: (occ) unregister sysfs devices outside occ lock

hwmon: (w83627hf) remove VID sysfs files on error and remove

hwmon: (w83793) remove vrm sysfs file on probe failure

hwmon: adm1275: Prevent reading uninitialized stack

hwrng: virtio: clamp device-reported used.len at copy_data()

hwspinlock: qcom: avoid uninitialized struct members

i2c: core: fix adapter debugfs creation

i2c: core: fix adapter deregistration race

i2c: core: fix adapter registration race

i2c: core: fix hang on adapter registration failure

i2c: core: fix irq domain leak on adapter registration failure

i2c: core: fix NULL-deref on adapter registration failure

i2c: mediatek: fix WRRD for SoCs without auto_restart option

i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource()

i2c: stm32f7: truncate clock period instead of rounding it

i3c: master: Prevent reuse of dynamic address on device add failure

IB/cm: Fix av cm device leak on an error path in cm_init_av_by_path()

IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified

IB/mlx4: Fix refcount leak in add_port() error path

IB/mlx5: Don't take the rereg_mr fallback without a new translation

IB/mlx5: Properly support implicit ODP rereg_mr

ice: fix AQ error code comparison in ice_set_pauseparam()

ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs()

ieee802154: admin-gate legacy LLSEC dump operations

ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation

ieee802154: ca8210: fix cas_ctl leak on spi_async failure

ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit

ieee802154: fix kernel-infoleak in dgram_recvmsg()

ieee802154: Remove WARN_ON() in cfg802154_pernet_exit()

iio: accel: bmc150: clamp the device-reported FIFO frame count

iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error

iio: accel: mma8452: handle I2C read error(s) in mma8452_read()

iio: adc: lpc32xx: Initialize completion before requesting IRQ

iio: adc: spear: Initialize completion before requesting IRQ

iio: adc: ti-ads124s08: Return reset GPIO lookup errors

iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling

iio: chemical: scd30: Cleanup initializations and fix sign-extension bug

iio: common: st_sensors: honour channel endianness in read_axis_data

iio: event: Fix event FIFO reset race

iio: gyro: bmg160: bail out when bandwidth/filter is not in table

iio: gyro: bmg160: wait full startup time after mode change at probe

iio: hid-sensor-rotation: Fix stale or zero output when reading raw values

iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ

iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ

iio: imu: inv_icm42600: fix timestamp clock period by using lower value

iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading

iio: imu: inv_icm42600: make timestamp module chip independent

iio: imu: inv_icm42600: stabilized timestamp in interrupt

iio: imu: inv_mpu6050: fix frequency setting when chip is off

iio: imu: inv_mpu6050: use the common inv_sensors timestamp module

iio: imu: st_lsm6dsx: deselect shub page before reading whoami

iio: invensense: fix odr switching to same value

iio: invensense: fix timestamp glitches when switching frequency

iio: invensense: remove redundant initialization of variable period

iio: light: al3010: fix incorrect scale for the highest gain range

iio: light: gp2ap002: fix runtime PM leak on read error

iio: light: opt3001: fix missing state reset on timeout

iio: light: si1133: prevent race condition on timeout

iio: light: si1133: reset counter to prevent race condition

iio: light: tsl2591: return actual error from probe IRQ failure

iio: light: veml6030: fix channel type when pushing events

iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call

iio: magnetometer: ak8975: fix potential kernel stack memory leak

iio: make invensense timestamp module generic

iio: move inv_icm42600 timestamp module in common

iio: temperature: ltc2983: Fix n_wires default bypassing rotation check

iio: temperature: ltc2983: Fix reinit_completion() called after conversion start

Input: elan_i2c - prevent division by zero and arithmetic underflow

Input: goodix - clamp the device-reported contact count

Input: iforce - bound the device-reported force-feedback effect index

Input: ims-pcu - add response length checks

Input: ims-pcu - fix DMA mapping violation in line setup

Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging

Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing

Input: ims-pcu - fix race condition in reset_device sysfs callback

Input: ims-pcu - fix type confusion in CDC union descriptor parsing

Input: ims-pcu - fix use-after-free and double-free in disconnect

Input: ims-pcu - release data interface on disconnect

Input: ims-pcu - validate control endpoint type

Input: maple_keyb - set driver data before registering input device

Input: maplecontrol - set driver data before registering input device

Input: maplemouse - fix NULL pointer dereference in open()

Input: maplemouse - set driver data before registering input device

Input: mms114 - fix multi-touch slot corruption

Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count

Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count

Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure

Input: touchwin - reset the packet index on every complete packet

io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item

iommu/amd: Fix a stale comment about which legacy mode is user visible

ipv4: account for fraggap on the paged allocation path

ipv4: fib: Don't ignore error route in local/main tables.

ipv4: igmp: remove multicast group from hash table on device destruction

ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD

ipv6: fix error handling in disable_ipv6 sysctl

ipv6: fix error handling in disable_policy sysctl

ipv6: fix error handling in forwarding sysctl

ipv6: fix error handling in ignore_routes_with_linkdown sysctl

ipv6: Fix null-ptr-deref in fib6_nh_mtu_change().

ipv6: guard against possible NULL deref in __in6_dev_stats_get()

ipv6: mcast: Fix potential UAF in MLD delayed work

ipv6: mcast: Replace locking comments with lockdep annotations.

ipvs: ensure inner headers in ICMP errors are in headroom

ipvs: fix more places with wrong ipv6 transport offsets

ipvs: fix PMTU for GUE/GRE tunnel ICMP errors

ipvs: pass parsed transport offset to state handlers

ipvs: reset full ip_vs_seq structs in ip_vs_conn_new

ipvs: use parsed transport offset in SCTP state lookup

ipvs: use parsed transport offset in TCP state lookup

irqchip/crossbar: Fix parent domain resource leak

irqchip/crossbar: Use correct index in crossbar_domain_free()

irqchip/gic-v3-its: Fix OF node reference leak

irqchip/ts4800: Fix missing chained handler cleanup on remove

isofs: bound Rock Ridge symlink components to the SL record

jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit()

jiffies: Cast to unsigned long in secs_to_jiffies() conversion

jiffies: Define secs_to_jiffies()

kcm: use WRITE_ONCE() when changing lower socket callbacks

kconfig: fix potential NULL pointer dereference in conf_askvalue

KEYS: Use acquire when reading state in keyring search

ksmbd: add a permission check for FSCTL_SET_ZERO_DATA

ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY

ksmbd: add per-handle permission check to FILE_LINK_INFORMATION

ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE

ksmbd: centralize ksmbd_conn final release to plug transport leak

ksmbd: destroy async_ida in ksmbd_conn_free()

ksmbd: fix integer overflow in set_file_allocation_info()

ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc

ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation

ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger

ksmbd: fix use-after-free in same_client_has_lease()

ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL

ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE

ksmbd: require source read access for duplicate extents

ksmbd: run set info with opener credentials

ksmbd: serialize QUERY_DIRECTORY requests per file

ksmbd: track the connection owning a byte-range lock

ksmbd: use opener credentials for FSCTL mutations

KVM: arm64: vgic: Check the interrupt is still ours before migrating it

KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers

KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()

KVM: s390: pci: Fix GISC refcount leak on AIF enable failure

KVM: s390: pci: Fix handling of AIF enable without AISB

KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode

KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs

KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs

leds: uleds: Fix potential buffer overread

lib/test_meminit: use && for bools

libbpf: Fix UAF in strset__add_str()

libbpf: Harden parse_vma_segs() path parsing

libbpf: Report error when a negative kprobe offset is specified

Linux: Linux 6.1.178

llc: fix SAP refcount leak in llc_ui_autobind()

llc: fix SAP refcount leak when creating incoming sockets

lockd: Plug nlm_file leak when nlm_do_fopen() fails

lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure

LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect()

LoongArch: Report dying CPU to RCU in stop_this_cpu()

mac802154: remove interfaces with RCU list deletion

macsec: don't read an unset MAC header in macsec_encrypt()

macsec: fix promiscuity refcount leak in macsec_dev_open()

mailbox: mtk-adsp: fix UAF during device teardown

md/raid10: reset read_slot when reusing r10bio for discard

md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry

media: atomisp: Fix memory leak in atomisp_fixed_pattern_table()

media: cedrus: Fix failure to clean up hardware on probe failure

media: qcom: venus: drop extra padding in NV12 raw size calculation

media: qcom: venus: relax encoder frame/blur dimension steps on v4

media: qcom: venus: relax encoder frame/blur step size on v6

media: rockchip: rga: fix too small buffer size

media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe

media: uvcvideo: Avoid partial metadata buffers

media: uvcvideo: Fix buffer sequence in frame gaps

memstick: ms_block: reject a card that reports too many blocks

mfd: cros_ec: Delay dev_set_drvdata() until probe success

mfd: sm501: Fix reference leak on failed device registration

mfd: tps6586x: Fix OF node refcount

MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf()

MIPS: DEC: Remove do_IRQ() call indirection

MIPS: Fix big-endian stack argument fetching in o32 wrapper

MIPS: ip22-gio: fix device reference leak in probe

MIPS: ip22-gio: fix gio device memory leak

MIPS: ip22-gio: fix kfree() of static object

MIPS: mm: Fix out-of-bounds write in maar_res_walk()

mips: n64: add __iomem for writel call

mips: ralink: mt7621: add missing __iomem

mips: sched: Fix CPUMASK_OFFSTACK memory corruption

MIPS: smp: report dying CPU to RCU in stop_this_cpu()

mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace()

mm/damon/core: make charge_addr_from aware of end-address exclusivity

mm/damon/ops-common: handle extreme intervals in damon_hot_score()

mm/damon/reclaim: fix typo in damon_reclaim_timer_fn()

mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs()

mm/fake-numa: fix under-allocation detection in uniform split

mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()

mm/vmscan: flush deferred TLB before freeing large folios

mm: shrinker: fix NULL pointer dereference in debugfs

mm: shrinker: remove redundant shrinker_rwsem in debugfs operations

mm: shrinkers: fix debugfs file permissions

mmc: vub300: defer reset until cmd_mutex is unlocked

module: decompress: check return value of module_extend_max_pages()

mtd: maps: vmu-flash: fix NULL pointer dereference in initialization

mtd: mchp23k256: use SPI match data for chip caps

mtd: onenand: samsung: report DMA completion timeouts

mtd: rawnand: fix condition in 'nand_select_target()'

mtd: rawnand: fsl_ifc: return errors for failed page reads

mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout

mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout

mtd: rawnand: pl353: fix probe resource allocation

mtd: slram: remove failed entries from the device list

mtd: spi-nor: Drop duplicate Kconfig dependency

mtd: spi-nor: swp: Improve locking user experience

net, bpf: check master for NULL in xdp_master_redirect()

net/9p: fix infinite loop in p9_client_rpc on fatal signal

net/9p: fix race condition on rdma->state in trans_rdma.c

net/mlx5: Check max_macs devlink param value against max capability

net/mlx5: Fix L3 tunnel entropy refcount leak

net/mlx5e: Fix HV VHCA stats agent registration race

net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation

net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete

net/sched: act_bpf: use rcu_dereference_bh() to read the filter

net/sched: act_pedit: use NLA_POLICY for parsing 'ex' keys

net/sched: cake: reject overhead values that underflow length

net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle

net/sched: cls_bpf: prevent unbounded recursion in offload rollback

net/sched: cls_flow: Dont expose folded kernel pointers

net/sched: hhf: clear heavy-hitter state on reset

net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen

net/sched: sch_drr: annotate data-races around cl->deficit

net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen

net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats()

net/sched: sch_hfsc: Don't make class passive twice

net/sched: sch_htb: annotate data-races (I)

net/sched: sch_htb: do not change sch->flags in htb_dump()

net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked

net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF

net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants

net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket

net: af_key: initialize alg_key_len for IPComp states

net: atm: reject out-of-range traffic classes in QoS validation

net: bcmgenet: Use weighted round-robin TX DMA arbitration

net: Drop the lock in skb_may_tx_timestamp()

net: dsa: sja1105: round up PTP perout pin duration

net: dsa: tag_ksz: do not rely on skb_mac_header() in TX paths

net: ena: clean up XDP TX queues when regular TX setup fails

net: enetc: check the number of BDs needed for xdp_frame

net: fib_rules: Don't dump dying fib_rule in fib_rules_dump().

net: gianfar: dispose irq mappings on probe failure and device removal

net: ife: require ETH_HLEN to be pullable in ife_decode()

net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink

net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink

net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink

net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink

net: ipip: require CAP_NET_ADMIN in the device netns for changelink

net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes

net: ixp4xx_hss: fix duplicate HDLC netdev allocation

net: lan743x: Initialize eth_syslock spinlock before use

net: liquidio: fix BAR resource leak on PF number failure

net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check

net: mana: initialize gdma queue id to INVALID_QUEUE_ID

net: marvell: prestera: initialize err in prestera_port_sfp_bind

net: mvneta: re-enable percpu interrupt on resume

net: openvswitch: reject oversized nested action attrs

net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy

net: psample: fix info leak in PSAMPLE_ATTR_DATA

net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()

net: qualcomm: rmnet: add tx packets aggregation

net: qualcomm: rmnet: validate MAP frame length before ingress parsing

net: sit: require CAP_NET_ADMIN in the device netns for changelink

net: sparx5: unregister blocking notifier on init failure

net: sungem: fix probe error cleanup

net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()

net: usb: lan78xx: disable VLAN filter in promiscuous mode

net: usb: lan78xx: move functions to avoid forward definitions

net: usb: net1080: validate packet_len before pad-byte access in rx_fixup

net: wwan: iosm: bound device offsets in the MUX downlink decoder

net: wwan: t7xx: destroy DMA pool on CLDMA late init failure

netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()

netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp

netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump

netfilter: ebtables: module names must be null-terminated

netfilter: ebtables: terminate table name before find_table_lock()

netfilter: ebtables: Use vmalloc_array() to improve code

netfilter: ebtables: zero chainstack array

netfilter: ecache: fix inverted time_after() check

netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop

netfilter: ipset: annotate "pos" for concurrent readers/writers

netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types

netfilter: ipset: Fix data race between add and dump in all hash types

netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer()

netfilter: ipset: fix race between dump and ip_set_list resize

netfilter: nf_conncount: callers must hold rcu read lock

netfilter: nf_conncount: fix zone comparison in tuple dedup

netfilter: nf_conncount: prevent connlimit drops for early confirmed ct

netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read

netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag

netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init()

netfilter: nf_nat_sip: reload possible stale data pointer

netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst

netfilter: nf_reject: skip iphdr options when looking for icmp header

netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures

netfilter: nfnl_cthelper: apply per-class values when updating policies

netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak

netfilter: nft_synproxy: stop bypassing the priv->info snapshot

netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock

netfilter: xt_cluster: reject template conntracks in hash match

netfilter: xt_connmark: reject invalid shift parameters

netfilter: xt_nat: reject unsupported target families

netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt()

netfilter: xt_u32: reject invalid shift counts

nfsd: change nfs4_client_to_reclaim() to allocate data

nfsd: Don't reset the write verifier on a commit EAGAIN

nfsd: move name lookup out of nfsd4_list_rec_dir()

nfsd: release layout stid on setlease failure

nfsd: reset write verifier on deferred writeback errors

NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write

NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors

NFSv4/flexfiles: reject zero filehandle version count

NFSv4/pnfs: defer return_range callbacks until after inode unlock

NFSv4: include MAY_WRITE in open permission mask for O_TRUNC

nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers

NTB: epf: Avoid calling pci_irq_vector() from hardirq context

NTB: epf: Fix doorbell bitmask and IRQ vector handling

NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr()

NTB: epf: Make db_valid_mask cover only real doorbell bits

NTB: epf: Report 0-based doorbell vector via ntb_db_event()

ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head

ntfs3: cap RESTART_TABLE free-chain walker at rt->used

ntfs3: fix out-of-bounds read in decompress_lznt

nvdimm/btt: Free arena sub-allocations on discover_arenas() error path

nvdimm/btt: Free arenas on btt_init() error paths

nvdimm/btt: Handle preemption in BTT lane acquisition

nvme-multipath: fix flex array size in struct nvme_ns_head

nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks

nvmet-rdma: handle inline data with a nonzero offset

nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path

nvmet-tcp: Fix potential UAF when ddgst mismatch

nvmet-tcp: fix race between ICReq handling and queue teardown

nvmet: remove superfluous initialization

ocfs2/dlm: require a ref for locking_state debugfs open

ocfs2: add journal NULL check in ocfs2_checkpoint_inode()

ocfs2: avoid moving extents to occupied clusters

ocfs2: don't BUG_ON an invalid journal dinode

ocfs2: fix buffer head management in ocfs2_read_blocks()

ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write

ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits

ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release()

ocfs2: kill osb->system_file_mutex lock

ocfs2: rebase copied fsdlm LVB pointers in locking_state

ocfs2: reject dinodes whose i_rdev disagrees with the file type

ocfs2: reject dinodes with non-canonical i_mode type

ocfs2: reject FITRIM ranges shorter than a cluster

ocfs2: reject non-inline dinodes with i_size and zero i_clusters

ocfs2: use kzalloc for quota recovery bitmap allocation

octeontx2-af: fix VF bringup affecting PF promiscuous state

octeontx2-af: mcs: Fix unsupported secy stats read

octeontx2-pf: check DMAC extraction support before filtering

octeontx2-pf: Clear stats of all resources when freeing resources

octeontx2-pf: Fix leak of SQ timestamp buffer on teardown

octeontx2-pf: mcs: Fix mcs resources free on PF shutdown

orangefs: keep the readdir entry size 64-bit in fill_from_part()

partitions: aix: bound the pp_count scan to the ppe array

PCI/ASPM: Don't reconfigure ASPM entering low-power state

PCI: Add kerneldoc for pci_resize_resource()

PCI: altera: Do not dispose parent IRQ mapping

PCI: altera: Fix resource leaks on probe failure

PCI: Check ROM header and data structure addr before accessing

PCI: controller: Use dev_fwnode() instead of of_fwnode_handle()

PCI: endpoint: pci-epf-ntb: Add check to detect 'db_count' value of 0

PCI: endpoint: pci-epf-vntb: Add check to detect 'db_count' value of 0

PCI: Fix restoring BARs on BAR resize rollback path

PCI: Free saved list without holding pci_bus_sem

PCI: host-common: Request bus reassignment when not probe-only

PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling

PCI: Introduce named defines for PCI ROM

PCI: iproc: Restore .map_irq() for the platform bus driver

PCI: loongson: Do not ignore downstream devices on external bridges

PCI: mediatek: Convert bool to single quirks entry and bitmap

PCI: mediatek: Fix IRQ domain leak when port fails to enable

PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro

PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port()

PCI: mediatek: Use actual physical address instead of virt_to_phys()

PCI: mediatek: Use generic MACRO for TPVPERL delay

PCI: Move Resizable BAR code to rebar.c

PCI: Prevent resource tree corruption when BAR resize fails

PCI: rcar-host: Remove unused LIST_HEAD(res)

PCI: Skip Resizable BAR restore on read error

perf/x86/amd/core: Always use the NMI latency mitigation

phy: phy-can-transceiver: Check driver match and driver data against NULL

pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39

pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39

pinctrl: meson: restore non-sleeping GPIO access

pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path

platform/x86: xo15-ebook: Fix wakeup source and GPE handling

PM: sleep: Use complete() in device_pm_sleep_init()

pNFS/filelayout: fix cheking if a layout is striped

posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path

posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu()

power: supply: charger-manager: fix refcount leak in is_full_charged()

power: supply: core: fix supplied_from allocations

power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak

powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus

powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del

powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down

powerpc/pseries: fix memory leak on krealloc failure in papr_init

powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()

proc: Move fdinfo PTRACE_MODE_READ check into the inode .permission operation

proc: only bump parent nlink when registering directories

proc: protect ptrace_may_access() with exec_update_lock (FD links)

proc: protect ptrace_may_access() with exec_update_lock (part 1)

proc: rename proc_setattr to proc_nochmod_setattr

proc: use generic setattr() for /proc/$PID/net

pwm: imx27: Fix variable truncation in .apply()

qede: fix off-by-one in BD ring consumption on build_skb failure

qede: fix out-of-bounds check for cqe->len_list[]

rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc()

RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup

RDMA/hns: Fix arithmetic overflow in calc_hem_config()

RDMA/hns: Fix warning in poll cq direct mode

RDMA/irdma: Fix OOB read during CQ MR registration

RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs

RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference

RDMA/mlx5: Fix undefined shift of user RQ WQE size

RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one

RDMA/mlx5: Remove raw RSS QP restrack tracking

RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg

RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path

RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe

RDMA/siw: bound Read Response placement to the RREAD length

RDMA/srpt: fix integer overflow in immediate data length check

regulator: core: Make regulator_lock_two() logic easier to follow

regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK

regulator: ltc3676: Fix incorrect IRQSTAT bit offsets

regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()

regulator: scmi: Simplify with scoped for each OF child loop

reset: sunxi: fix memory region leak on ioremap failure

Revert "PCI/MSI: Unmap MSI-X region on error"

ring-buffer: Fix event length with forced 8-byte alignment

riscv: cacheinfo: Fix node reference leak in populate_cache_leaves

riscv: Prevent NULL pointer dereference in machine_kexec_prepare()

riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe

rpmsg: char: Fix use-after-free on probe error path

rtc: abx80x: fix the RTC_VL_CLR clearing all status flags

rtc: cmos: unregister HPET IRQ handler on probe failure

rtc: ds1307: Fix off-by-one issue with wday for rx8130

rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231

rtc: mpfs: fix counter upload completion condition

rtc: msc313: fix NULL deref in shared IRQ handler at probe

s390/monwriter: Reject buffer reuse with different data length

s390/process: Fix kernel thread function pointer type

sched/fair: Only update stats for allowed CPUs when looking for dst group

sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT

sched: restore timer_slack_ns when resetting RT policy on fork

scsi: elx: efct: Fix I/O leak on unsupported additional CDB

scsi: elx: efct: Fix refcount leak in efct_hw_io_abort()

scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path

scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup()

scsi: pm8001: Fix error code in non_fatal_log_show()

scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans"

scsi: sas: Skip opt_sectors when DMA reports no real optimization hint

scsi: sg: Report request-table problems when any status is set

scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished()

scsi: target: Bound PR-OUT TransportID parsing to the received buffer

scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE

scsi: target: Fix hexadecimal CHAP_I handling

scsi: xen: scsiback: Free the command tag on the TMR submit-failure path

scsi: xen: scsiback: Free unsubmitted command instead of double-putting it

sctp: hold socket lock when dumping endpoints in sctp_diag

sctp: validate embedded address parameter length

sctp: validate STALE_COOKIE cause length before reading staleness

security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref()

seg6: validate SRH length before reading fixed fields

selftests/bpf: Fix bpf_iter/task_vma test

selftests/mm: allow PUD-level entries in compound testcase of hmm tests

selftests/mm: clarify alternate unmapping in compaction_test

selftests/mm: fix exclusive_cow test fork() handling

selinux: check connect-related permissions on TCP Fast Open

seqlock: Change do_task_stat() to use scoped_seqlock_read()

seqlock: fix scoped_seqlock_read kernel-doc

seqlock: Introduce scoped_seqlock_read()

serial: 8250_mid: Disable DMA for selected platforms

serial: 8250_mid: Remove 8250_pci usage

serial: 8250_omap: clear rx_running on zero-length DMA completes

serial: msm: Disable DMA for kernel console UART

slimbus: Convert to platform remove callback returning void

slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership

slimbus: qcom-ngd-ctrl: Fix probe error path ordering

slimbus: qcom-ngd-ctrl: Fix up platform_driver registration

slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd

smb/client: always return a value for FS_IOC_GETFLAGS

smb/client: preserve errors from smb2_set_sparse()

smb/server: do not require delete access for non-replacing links

smb: client: Fix next buffer leak in receive_encrypted_standard()

smb: client: fix overflow in passthrough ioctl bounds check

smb: client: harden POSIX SID length parsing

smb: client: mask server-provided mode to 07777 in modefromsid

smb: client: reject overlapping data areas in SMB2 responses

smb: client: resolve SWN tcon from live registrations

smb: client: restrict implied bcc[0] exemption to responses without data area

smb: client: use kvzalloc() for megabyte buffer in simple fallocate

smb: client: use unaligned reads in parse_posix_ctxt()

smb: move smb_version_values to common/smbglob.h

smb: move some duplicate definitions to common/cifsglob.h

soc: fsl: qe: panic on ioremap() failure in qe_reset()

soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy

sparc: led: avoid trimming a newline from empty writes

spi: dw: fix wrong BAUDR setting after resume

spi: ep93xx: fix double-free of zeropage on DMA setup failure

spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync()

spi: fsl-lpspi: terminate the RX channel on TX prepare failure path

spi: rpc-if: Use correct device for hardware reinitialization on resume

spi: sh-msiof: abort transfers when reset times out

spi: uniphier: Fix completion initialization order before devm_request_irq()

spi: xilinx: use FIFO occupancy register to determine buffer size

staging: media: atomisp: reduce load_primary_binaries() stack usage

staging: most: video: avoid double free on video register failure

staging: nvec: fix use-after-free in nvec_rx_completed()

staging: rtl8723bs: core: move constants to right side in comparison

staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()

staging: rtl8723bs: Fix indentation issues

staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop

staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop

staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()

staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop

staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()

staging: rtl8723bs: fix OOB write in HT_caps_handler()

staging: rtl8723bs: Fix space issues

staging: rtl8723bs: fix spaces around binary operators

staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()

staging: vme_user: bound slave read/write to the kern_buf size

staging: vme_user: fix location monitor leak in fake bridge

staging: vme_user: fix location monitor leak in tsi148 bridge

sysfs: clamp show() return value in sysfs_kf_read()

tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)

thermal: hwmon: Fix critical temperature attribute removal

thermal: intel: Fix dangling resources on thermal_throttle_online() failure

time: Fix off-by-one in compat settimeofday() usec validation

tipc: fix out-of-bounds read in broadcast Gap ACK blocks

tipc: fix UAF in tipc_l2_send_msg()

tipc: prevent snt_unacked underflow on CONN_ACK

tipc: reject inverted service ranges from peer bindings

tipc: require net admin for TIPCv2 netlink mutators

tools lib api: Fix filename__write_int() writing uninitialized stack data

tools lib api: Fix missing null termination in filename__read_int/ull()

tools lib api: Fix mount_overload() snprintf truncation and toupper range

tools/mm/slabinfo: fix total_objects attribute name

tools/power/x86/intel-speed-select: Harden daemon pidfile open

tools/virtio: Add dma sync api for virtio test

tools/virtio: check mmap return value in vringh_test

tpm: fix event_size output in tpm1_binary_bios_measurements_show

tpm: Make the TPM character devices non-seekable

tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat()

tracing/events: Fix to check the simple_tsk_fn creation

tracing/probes: Fix double addition of offset for @+FOFFSET

tracing: eprobe: read the complete FILTER_PTR_STRING pointer

tracing: Prevent out-of-bounds read in glob matching

tracing: probes: fix typo in a log message

treewide: Switch/rename to timer_delete[_sync]()

udf: validate free block extents against the partition length

udf: validate sparing table length as an entry count, not a byte count

udf: validate VAT header length against the VAT inode size

udmabuf: fix DMA direction mismatch in release_udmabuf()

usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()

usb: cdc_acm: Add quirk for Uniden BC125AT scanner

usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()

USB: chaoskey: Fix slab-use-after-free in chaoskey_release()

USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub

usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume()

usb: dwc3: run gadget disconnect from sleepable suspend context

usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler

usb: gadget: f_fs: initialize reset_work at allocation time

usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile

usb: gadget: function: rndis: add length check for header

usb: gadget: function: rndis: add length check to response query

usb: gadget: udc: Fix use-after-free in gadget_match_driver

usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control()

usb: host: max3421: Reject hub port requests for non-existent ports

USB: idmouse: fix use-after-free on disconnect race

USB: iowarrior: fix use-after-free on disconnect

usb: iowarrior: remove inherent race with minor number

USB: ldusb: fix use-after-free on disconnect race

USB: legousbtower: fix use-after-free on disconnect race

USB: misc: uss720: unregister parport on probe failure

usb: mtu3: unmap request DMA on queue failure

USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD

USB: serial: digi_acceleport: fix broken rx after throttle

USB: serial: digi_acceleport: fix hard lockup on disconnect

USB: serial: digi_acceleport: fix write buffer corruption

USB: serial: keyspan_pda: fix information leak

USB: serial: option: add Telit Cinterion FE990D50 compositions

usb: sl811-hcd: disable controller wakeup on remove

USB: storage: include US_FL_NO_SAME in quirks mask

usb: typec: anx7411: use devm_pm_runtime_enable()

usb: typec: class: drop PD lookup reference

usb: typec: tcpm: Fix VDM type for Enter Mode commands

usb: typec: tcpm: Validate SVID index in svdm_consume_modes()

usb: typec: ucsi: cancel pending work on system suspend

usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove

usb: typec: ucsi: Invert DisplayPort role assignment

usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode

USB: ulpi: fix memory leak on registration failure

USB: usb-storage: ene_ub6250: restore media-ready check

usb: xhci: Fix sleep in atomic context in xhci_free_streams()

usbip: tools: support SuperSpeedPlus devices

usbip: vudc: fix NULL deref in vep_dequeue()

usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup()

userfaultfd: gate must_wait writability check on pte_present()

vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter

vduse: hold vduse_lock across IDR lookup in open path

vduse: Requeue failed read to send_list head

veth: fix NAPI leak in XDP enable error path

vfio/mlx5: Fix racy bitfields and tighten struct layout

vfio/pci: Latch disable_idle_d3 per device

vfio/pci: Release the VGA arbiter client on register_device() failure

vfio/pci: Use a private flag to prevent power state change with VFs

vfio/pci: Use bitfield for struct vfio_pci_core_device flags

vhost/net: complete zerocopy ubufs only once

vhost/vdpa: validate virtqueue index in mmap and fault paths

virtio-mmio: fix device release warning on module unload

virtio-net: fix len check in receive_big()

virtio_net: disable cb when NAPI is busy-polled

virtio_net: Support dynamic rss indirection table size

virtio_ring: fix syncs DMA memory with different direction

virtio_ring: introduce dma map api for virtqueue

virtio_ring: introduce dma sync api for virtqueue

virtio_ring: introduce virtqueue_set_dma_premapped()

vmalloc: fix NULL pointer dereference in is_vm_area_hugepages()

vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().

watchdog: apple: Add "apple,t8103-wdt" compatible

watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH

watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure

watchdog: unregister PM notifier on watchdog unregister

wifi: ath9k: fix OOB access from firmware tx status queue ID

wifi: cfg80211: fix grammar in MLO group key error message

wifi: mac80211: fix memory leak in ieee80211_register_hw()

wifi: mac80211: free ack status frame on TX header build failure

wifi: mt76: fix argument to ieee80211_is_first_frag()

wifi: mwifiex: fix permanently busy scans after multiple roam iterations

wifi: rt2x00: avoid full teardown before work setup in probe

wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer

wifi: wcn36xx: fix heap overflow from oversized firmware HAL response

wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication

wifi: wcn36xx: fix OOB read from short trigger BA firmware response

workqueue: drop spurious '*' from print_worker_info() fn declaration

writeback: Avoid contention on wb->list_lock when switching inodes

writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount()

writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()

writeback: Fix use after free in inode_switch_wbs_work_fn()

X.509: Fix validation of ASN.1 certificate header

x86/boot: Reject too long acpi_rsdp= values

x86/boot: Validate console=uart8250 baud rate to fix early boot hang

x86/mm: Fix check/use ordering in switch_mm_irqs_off()

x86/platform/olpc: xo15: Drop wakeup source on driver removal

xen/gntdev: fix error handling in ioctl

xfrm: add new packet offload flag

xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[]

xfrm: Support crypto offload for inbound IPv6 ESP packets not in GRO path

xfrm: use compat translator only for u64 alignment mismatch

xfrm: Use the XFRM_GRO to indicate a GRO call on input

xfrm: validate selector family and prefixlen during match

xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink

xfs: fail recovery on a committed log item with no regions

xfs: fix unreachable BIGTIME check in dquot flush validation

xfs: resample the data fork mapping after cycling ILOCK

xfs: use null daddr for unset first bad log block

xprtrdma: Avoid 250 ms delay on backlog wakeup

xprtrdma: Check frwr_wp_create() during connect

xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot

xprtrdma: Decouple req recycling from RPC completion

xprtrdma: Document and assert reply-handler invariants

xprtrdma: Fix bcall rep leak and unbounded peek

xprtrdma: Post receive buffers after RPC completion

xprtrdma: Remove temp allocation of rpcrdma_rep objects

xprtrdma: Repost Receive buffers for malformed replies

xprtrdma: Resize reply buffers before reposting receives

xprtrdma: Return sendctx slot after Send preparation failure

xprtrdma: Sanitize the reply credit grant after parsing

xprtrdma: Use sendctx DMA state for Send signaling