Changelog
in Linux kernel
6.12.112
9p:
Fix v9fs_issue_write() to update i_size and remote_i_size
af_packet:
fix integer overflow in prb_calc_retire_blk_tmo()
ALSA:
6fire: Clean ups with guard()
ALSA:
6fire: fix OOB write from device-reported iso length
ALSA:
bcd2000: Fix race between rawmidi and disconnect
ALSA:
core: Fix potential UAF after asynchronous card release
ALSA:
hda/ext: preserve PPLCCTL bits when clearing reset
ALSA:
hda/realtek: Add StarFighter HDA SSID
ALSA:
hda/realtek: Limit Star Labs internal mic boost
ALSA:
hda: trace PCM open only after assigning a stream
ALSA:
pcm: set timer->private_data before registering the PCM timer
ALSA:
usb-audio: Clamp implicit feedback packet count to URB capacity
ALSA:
usb-audio: Optimize the copy of packet sizes for implicit fb handling
ALSA:
usb: 6fire: Avoid embedded URBs
ALSA:
virtio: reset device before deleting virtqueues
arm64/boot:
Disable trapping of PMZR_EL0 writes to EL2
arm64:
dts: renesas: r8a779f0: Set UFS lane count
arm64:
hibernate: clone only the linear map that exists at runtime
arm64:
hibernate: pass HVC_SET_VECTORS args to the resume hvc
arm64:
io: Reject non-user protection in ioremap_prot()
arm64:
percpu: Fix LSE operations on {8,16}-bit types
arm64:
percpu: Fix this_cpu_and() mask generation
arm64:
percpu: Fix this_cpu_write() casting
arm64:
Use load LSE atomics for the non-return per-CPU atomic operations
ARM:
socfpga: select the PL310 erratum 753970 workaround
ASoC:
Add codec_ch_mask to snd_soc_dai_link_ch_map
ASoC:
codecs: aw88261: only check PLL and clock state at power-up
ASoC:
codecs: aw88261: reduce log spam
ASoC:
codecs: rt712-sdca-dmic: fix uninitialized stream_config->type
ASoC:
hdmi-codec: Report a change when the channel status moves
ASoC:
Rename snd_soc_dai_link_ch_map.ch_mask to cpu_ch_mask
ASoC:
soc-pcm: Apply snd_soc_dai_link_ch_map.codec_ch_mask to codec params
ASoC:
tegra210_mixer: sort the register default table
ASoC:
tegra: Fix the MIXER enable default value
ASoC:
ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments
ata:
libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY
ata:
libahci_platform: Fix device reference leak in ahci_platform_get_resources()
ata:
libata-scsi: bound the ATA passthru sense descriptor writes
autofs:
fix sbi->pipe file reference leak in autofs_kill_sb()
Bluetooth:
bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough
Bluetooth:
btintel_pcie: fix off-by-one bounds check in RX submit
Bluetooth:
btintel_pcie: validate device-supplied DMA indices
Bluetooth:
btmtk: fix wrong status for short WMT FUNC_CTRL events
Bluetooth:
btmtksdio: Fix PM runtime reference leak in shutdown
Bluetooth:
btusb: fix NXP IW610 composite device handling
Bluetooth:
coredump: Quiesce dump work on unregister
Bluetooth:
eir: validate service data length before reading UUID
Bluetooth:
hci_codec: validate vendor codec count length
Bluetooth:
hci_conn: fix CIS hold ownership on reuse
Bluetooth:
hci_core: Fix queuing tx_work after workqueue is drained
Bluetooth:
hci_core: Print number of packets in conn->data_q
Bluetooth:
hci_sock: reject out-of-range OCF values
Bluetooth:
hci_sock: validate event length before filtering
Bluetooth:
hci_sync: Serialize local codec list cleanup
Bluetooth:
ISO: balance the parent hold in hci_bind_bis()
Bluetooth:
ISO: Fix parent socket leak in iso_conn_ready()
Bluetooth:
ISO: set BT_LISTEN before requesting a BIG sync
Bluetooth:
L2CAP: validate frame length before control and FCS access
Bluetooth:
mgmt: Dequeue pending mesh_send_sync entries on cancel
Bluetooth:
mgmt: fix race in read_unconf_index_list()
Bluetooth:
RFCOMM: avoid socket lock inversion in listener cleanup
Bluetooth:
RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO
Bluetooth:
RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()
Bluetooth:
SMP: reject Security Request over BR/EDR
bna:
prevent IOC timer rearm during teardown
bnxt:
fix memory leak in bnxt_queue_mem_alloc error cases
bnxt_en:
Do not set EOP on RX AGG BDs on 5760X chips
bnxt_en:
Don't free the live ring's TPA state on queue restart failure
bnxt_en:
Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc()
bonding:
crypto offload enabled, non-offload slave failover, rekey failed
bootconfig:
Fix integer overflow in initrd size check
bootconfig:
Fix negative seeks on 32-bit with LFS enabled
bpf, arm64:
set up the frame pointer for the exception callback
bpf, sockmap:
Fix self-redirect copied_seq double-counting
bpf, sockmap:
Reject max_entries > INT_MAX in sock_map_alloc
bpf:
Avoid soft lockup in __htab_map_lookup_and_delete_batch()
bpf:
Bail out early in __htab_map_lookup_and_delete_elem()
bpf:
Bound ownership depth through local kptrs and graph roots
bpf:
Check params size before reading reserved fields
bpf:
Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL
bpf:
Factor out htab_elem_value helper()
bpf:
Fix bounds check for skb-backed dynptrs
bpf:
Fix bpf_skb_change_tail wrt csum partial skbs
bpf:
Fix bpf_sock context code generation
bpf:
Fix BSWAP 32 and 16 on MIPS64
bpf:
Fix divide-by-zero in btf_struct_walk()
bpf:
Fix immediate JMP JEQ/JNE on MIPS32
bpf:
Fix out-of-bounds read of rtt_min in sock_ops
bpf:
Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()
bpf:
Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk
bpf:
Register dtor for freeing special fields
bpf:
Reject dev-bound-only programs on other devices
bpf:
Reject key-less BTF for hash maps
bpf:
Remove migrate_{disable|enable} in ->map_for_each_callback
bpf:
Restrict CO-RE poisoning to relocatable instructions
bpf:
Skip unsettled links in link iterator
bridge:
check llc_mac_hdr_init() return value in br_send_bpdu()
btrfs:
abort transaction on failure to update inode for hole punching and reflinking
btrfs:
take commit root semaphore when iterating in mark_block_group_to_copy()
btrfs:
tree-checker: print dev extent offset in error message
cgroup/pids:
Restore pids.events notifications in local mode
cgroup:
selftests: Move memcontrol specific helpers out of common cgroup_util.c
cifs:
Fix server use-after-free in cifs_chan_skip_or_disable()
cifs:
Fix specification of function pointers
clk:
qcom: Fix test_ctl_hi field for DEFAULT_EVO PLLs
clk:
scpi: bound-check DVFS index in scpi_dvfs_recalc_rate
compiler_types:
Move lock checking attributes to compiler-context-analysis.h
configfs:
pin the symlink target's dirent instead of chasing ->ci_dentry
configfs:
unhash the dentry before dropping the item in rmdir
Linux:
configfs:get_target() - release path as soon as we grab configfs_item reference
dma-buf:
dma-heap: don't publish fd before copy_to_user() succeeds
dma-coherent:
report a failed reserved memory assignment
dma-coherent:
Warn if OF reserved memory is beyond current coherent DMA mask
dmaengine:
Add devm_dma_request_chan()
dmaengine:
Fix device kref underflow in dma_chan_put()
dmaengine:
fix use-after-free in dma_chan_put() and dma_release_channel()
dmaengine:
mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg()
dmaengine:
sprd: Fix runtime PM reference leak in probe
dmaengine:
sun6i: fix non-atomic read of DMA position registers
dmaengine:
sun6i: fix undefined behaviour in sun6i_dma_tx_status
dmaengine:
ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn()
dmaengine:
wait for RCU readers before releasing dma_device
dmaengine:
xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA
dmaengine:
xilinx_dma: Fix hardware buffer descriptor reuse order
docs:
s390/pci: Improve and update PCI documentation
Documentation:
tracing: Add documentation about eprobes
dpll:
use exact lookup for reference sync pin id
driver core:
Add device probe log helper dev_warn_probe()
drm/amd/display:
Bump frame warning limit for clang builds of dml
drm/amd/display:
Fix dc stream excess put in dm_update_crtc_state()
drm/amd/display:
Set gpuvm min page size to 4K on dcn35/36
drm/amdgpu/umsch:
remove vpe test from umsch
drm/amdgpu:
add a helper to calculate ring distance
drm/amdgpu:
avoid force-completing uninitialized UVD rings
drm/amdgpu:
check ras and obj before dereference
drm/amdgpu:
Failed to check various return code
drm/amdgpu:
Fix acpi device leak in amdgpu_acpi_enumerate_xcc()
drm/amdgpu:
Fix last_update fence leak in amdgpu_vm_init()
drm/amdgpu:
Fix missing unwind in amdgpu_ib_schedule() error path
drm/amdgpu:
fix rmmio iounmap skipped on device removal
drm/amdgpu:
Fix runtime PM leak in amdgpu_debugfs_test_ib_show()
drm/amdgpu:
Fix vmid_wait fence leak in amdgpu_ring_init()
drm/amdgpu:
hold a runtime PM reference for P2P dma-buf attachments
drm/amdgpu:
plumb timedout fence through to force completion
drm/amdgpu:
use GFP_NOWAIT for memory allocations
drm/bridge:
samsung-dsim: fix TE GPIO lifetime for host attach
drm/bridge:
tc358768: Enforce input bus flags via atomic_check
drm/client:
fix restore of partially initialized client
drm/client:
Pass force parameter to client restore
drm/gud:
fix out-of-bounds write in gud_plane_atomic_check()
drm/i915/dp_mst:
Fix configuring FEC for a disconnected stream
drm/i915/mst:
add mst sub-struct to struct intel_dp
drm/i915/psr:
Add new SU area calculation helper to apply workarounds
drm/i915/psr:
Clear stale sel fetch enable bits on sel fetch disable
drm/i915:
fix incorrect RCU teardown order
drm/imagination:
clamp freelist reconstruction requests
drm/imagination:
Fix page count for page table for map() interface
drm/imagination:
Propagate map failures correctly from pvr_mmu_map_sgl()
drm/msm/adreno:
fix autosuspend cleanup during teardown
drm/msm/dpu:
clear pending peripheral flush state
drm/msm/dsi:
round the byte clock rate after reparenting to the PHY PLL
drm/msm/hdmi_phy:
fix runtime PM cleanup on probe failure
drm/nouveau/clk:
don't clobber reclock status when restoring volt/fan
drm/nouveau/clk:
fix list cursor use after loop in nvkm_clk_ustate_update
drm/nouveau/disp/r535:
Add scanline position support + head state support
drm/nouveau/disp:
don't reject HDMI config on cards without SCDC
drm/nouveau/uvmm:
fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM
drm/nouveau:
don't bump pin count on failed re-pin in nouveau_bo_pin_locked()
drm/nouveau:
fix autosuspend cleanup during teardown
drm/nouveau:
Fix bridge reference leak in nv1a_ram_new()
drm/nouveau:
fix double-free in nvif_vmm_dtor
drm/nouveau:
Fix gem reference leak in validate_init()
drm/nouveau:
Fix runtime PM leak in nouveau_connector_detect()
drm/nouveau:
RCU-free the scheduler-containing nouveau_sched
drm/sysfb:
ofdrm: Fix integer overflow in fb_size calculation
drm/sysfb:
ofdrm: Fix is_avivo() constant comparison bug
drm/sysfb:
simpledrm: Improve framebuffer-size validation
drm/sysfb:
simpledrm: Improve panel-size validation
drm/sysfb:
simpledrm: Improve stride validation
drm/vc4:
Use managed KMS polling to fix UAF on unbind
drm/virtio:
fix memory leak of fence event on execbuffer failure
drm/virtio:
fix NULL pointer dereference on fence allocation failure
drm/virtio:
fix object leak in virtio_gpu_resource_create_ioctl()
drm/virtio:
fix object leak when drm_gem_handle_create() fails
drm/virtio:
fix object leaks in virtio_gpu_resource_create_blob_ioctl()
drm/virtio:
release the GEM object on virtio_gpu_vram_create() errors
drm/xe/vm:
nuke PTs only after unlinking contested VMAs
drm/xe:
Flush LSC untyped L1 dataport cache after rcs/ccs batches
drm/xe:
Limit sg segment size to PAGE_SIZE on Xen PV
drm:
add drm_memory_stats_is_zero
drm:
Fix drm_pending_vblank_event leak in error path for out_fence_ptr
drop_monitor:
fix out-of-bounds write in reset_per_cpu_data()
drop_monitor:
synchronize tracepoint unregistration on error path
EDAC/altera:
Use ECC manager compatible to select A10/S10 IRQ layout
EDAC/altera:
Use parent device for devres in altr_portb_setup()
erofs:
add sysfs feature entry for xattr prefixes
erofs:
fix large folio race in erofs_fscache_req_complete
esp:
downgrade zerocopy managed frags before mutating skb frags
eth:
bnxt: store rx buffer size per queue
eth:
fbnic: Handle maximum standalone channels
eth:
fbnic: Set AW_FLUSH_MODE alongside AW_FLUSH when flushing the mailbox
exec:
Cleanup POSIX timers right after de_thread()
f2fs:
accurately adjust free_sections during free_segment_range
f2fs:
Convert clear_node_page_dirty() to clear_node_folio_dirty()
f2fs:
convert F2FS_I_SB to sbi in f2fs_setattr()
f2fs:
dirty directory inodes on mtime/ctime update
f2fs:
don't allow unaligned truncation to smaller/equal size on pinned file
f2fs:
embed f2fs_gc_kthread in f2fs_sb_info
f2fs:
fix dentry folio leak in find_in_level
f2fs:
fix to avoid potential section-unaligned pinfile
f2fs:
fix to clear dirty flag on folio in error path
f2fs:
limit recovery filename logging to stored length
f2fs:
validate MOVE_RANGE destination size
firmware:
arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS
firmware:
qcom_scm: Rename peripheral as pas_id
firmware:
sysfb: Move bpp-depth calculation into screen_info helper
fou:
reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT
fs/ntfs3:
use d_instantiate_new() in ntfs_create_inode() and murder syzbot's "WARNING in do_new_mount" saga
fsl/fman:
Fix clk reference leak in read_dts_node()
ftrace:
Take trace_array reference before accessing its ftrace_ops
futex:
Provide rt_mutex_.*_schedule() equivalents for futex scheduling
genetlink:
pin family module during policy dump
genetlink:
report the real command id for dump-only ops in policy dumps
gpio:
arizona: Fix runtime PM leak in arizona_gpio_direction_out()
gpio:
cdev: fix kernel stack leak to user-space in error path
gpio:
tps65219: Fix GPIO input value reads
gpio:
virtuser: skip free_irq when no IRQ is installed
gpio:
zynq: fix runtime PM leak on request error path
HID:
alps: fix use-after-free on input2 registration failure
HID:
alps: unregister DualPoint Stick input device on remove
HID:
amd_sfh: Validate PCI BAR size before mapping
HID:
asus: fortify keyboard handshake
HID:
bpf: fix __hid_bpf_hw_check_params report length
HID:
elecom: fix bus type for M-XGL20DLBK
HID:
hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM
HID:
logitech-hidpp: fix race condition when accessing stale stack pointer
HID:
quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard
HID:
wacom: fix OOB read in wacom_wac_pen_serial_enforce()
hwmon:
(hp-wmi-sensors) Fix use-after-free in fungible_show()
hwmon:
(pmbus/core) increase number of phases and add new mask
hwmon:
(pmbus/tps53679) Fix TPS53676 phase page decoding
hwmon:
(pmbus/tps53679) Select page 0 for single-page TPS53676
hwmon:
(pwm-fan) Stop RPM timer before freeing tach data
hwmon:
(w83791d) remove fan/pwm 4-5 sysfs group on remove
hwmon:
(w83793) release probe data through kref
hwrng:
drivers - Switch back to struct platform_driver::remove()
hwrng:
stm32 - Fix runtime PM cleanup on registration failure
i2c:
at91: release DMA channels on remove and probe error
i2c:
atr: fix dangling adapter pointer on add failure
i2c:
imx: disable autosuspend on remove
i2c:
imx: release DMA channels on probe error
i2c:
mxs: fix DMA channel leak on probe error
i2c:
qcom-cci: fix device_node refcount leak in cci_probe()/cci_remove()
i2c:
qcom-cci: Remove the unused variable cci_clk_rate
i2c:
qcom-cci: Stop complaining about DT set clock rate
i2c:
qcom-geni: Fix hardcoded clock index in SE_GENI_CLK_SEL
i3c:
master: Do not treat master device as a duplicate target
i3c:
master: Fix use-after-free of master->this
IB/hfi1:
Fix the PIO_CRED credit-return mmap
IB/hfi1:
Resolve the credit-return buffer through the send context's node
IB/IPoIB:
Avoid restoring OPER_UP after multicast flush
IB/iser:
reject a remote invalidation of an unregistered direction
IB/isert:
wait for deferred control PDU completions before releasing the connection
IB/mlx4:
Fix use-after-free on pkey sysfs registration failure
idpf:
disable DIM work before freeing q_vectors
idpf:
Fix kernel-doc descriptions to avoid warnings
idpf:
introduce idpf_q_vec_rsrc struct and move vector resources to it
Input:
adp5588-keys - cache GPIO state before registering the gpiochip
Input:
atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026
Input:
cyttsp5 - clamp the HID report size before memcpy
Input:
evdev - zero absinfo before partial copy in EVIOCSABS
Input:
hp_sdc - shut down kicker timer on module exit
Input:
i8042 - add quirk for Acer Aspire Go 15 AG15-42P
Input:
rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()
Input:
soc_button_array - check btns_desc->package.count
Input:
soc_button_array - fix MS Surface Pro 11 probe failure
Input:
synaptics - disable InterTouch on ThinkPad T440p (board id 2722)
Input:
synaptics-rmi4 - fix GPF in suspend and resume when unbound
Input:
trackpoint - fix the inertia attribute name in the ABI document
Input:
xpad - add support for Azeron devices
Input:
xpad - add support for Victrix Pro BFG Controller
Input:
xpad - fix PDP Marvel Xbox 360 controller
Input:
zero ff_effect before compat copy in input_ff_effect_from_user
io_uring/net:
don't overconsume buffers when using MSG_TRUNC
io_uring/rw:
end write accounting from ->ki_complete
io_uring/waitid:
avoid siginfo copy during ring teardown
io_uring/waitid:
have io_waitid_complete() remove wait queue entry
iommu/msm:
Unwind probe state on registration failure
iommu/msm:
Use helper function devm_clk_get_prepared()
iommufd:
Fix UAF in selftest IOPF reporting
iommufd:
Pass @pasid through the device attach/replace path
ip6_gre:
Call ip6erspan_tunnel_unlink_md() in ip6erspan_changelink().
ip_gre:
Reject enabling collect metadata through changelink
ipe:
fix use-after-free when auditing a newly loaded policy
ipe:
protect the dm-verity root hash with RCU
ipmr:
account multicast table and route memory
ipv4:
icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup
ipv6:
do not let ipv6_find_hdr() return an offset past the packet end
ipv6:
Fix dst leak for uncached routes.
ipv6:
flowlabel: cap duplicate leases per socket
ipv6:
Honor oif when choosing nexthop for locally generated traffic
ipv6:
make ipv6_pinfo.saddr_cache a boolean
ipv6:
mcast: Don't hold RTNL for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP.
ipv6:
mcast: Don't hold RTNL for IPV6_DROP_MEMBERSHIP and MCAST_LEAVE_GROUP.
ipv6:
mcast: Don't hold RTNL for MCAST_ socket options.
ipv6:
mcast: use copy-on-write RCU updates in ip6_mc_source()
ipv6:
mcast: Use in6_dev_get() in ipv6_dev_mc_dec().
ipv6:
Move ipv6_fl_list from ipv6_pinfo to inet_sock.
ipv6:
reorganise struct ipv6_pinfo
ipv6:
Select best matching nexthop object in fib6_table_lookup()
ipv6:
sr: enforce exact attribute length for SEG6_ATTR_DST
ipv6:
xfrm: use full sockets in local error paths
ipvs:
revalidate ihl before icmp_send
KEYS:
encrypted: fix integer overflow of datablob_len
keys:
fix lost wakeup when reaping a dead key type
keys:
translate request_key_auth pid for the reading procfs instance
KEYS:
trusted: Fix tpm2_load_cmd() boundary check
kselftest/arm64:
Fix size of thread_data values for pthread_join()
ksmbd:
fix partial file information responses
ksmbd:
fix partial normalized name responses
ksmbd:
keep compound responses on query info errors
ksmbd:
return buffer overflow for partial filesystem info
KVM:
arm64: Fix FGT mapping for HFGITR_EL2.nGCSEPP
KVM:
arm64: Fix spurious warning for benign stage 2 teardown race
KVM:
arm64: Return -EINVAL for an empty SMCCC filter range at base 0
KVM:
arm64: vgic-its: Add stronger type-checking to the ITS entry sizes
KVM:
arm64: vgic-its: Free the caches when GITS_BASER changes
KVM:
arm64: vgic-its: Skip unreachable devices instead of failing the save
KVM:
Don't treat reserved xarray entries as having memory attributes
KVM:
Ensure memory attributes xarray nodes are accounted to the caller's memcg
KVM:
PPC: Book3S HV: fix secure device page leak on uv_page_in() failure
KVM:
PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid()
KVM:
s390: Fix IRQ injection with SIGP Stop and Store Status
KVM:
s390: Zero initialize data structures for inject_pfault_token
KVM:
x86/mmu: Dynamically allocate shadow MMU's hashed page list
KVM:
x86/mmu: Split kvm_mmu_zap_all_fast() into "front" and "back" halves
KVM:
x86/pmu: Move Intel PMU global MSRs to intel_is_valid_msr()
KVM:
x86: Check EFER validity on KVM_SET_SREGS*
KVM:
x86: Disallow EFER.LME and EFER.LMA if long mode is not supported
KVM:
x86: Extract REGS and SREGS runtime sync code to helpers
KVM:
x86: Move the bulk of register specific code from x86.c to regs.c
KVM:
x86: Rename __{g,s}et_sregs2() => kvm_vcpu_ioctl_x86_{g,s}et_sregs2()
landlock:
Clarify documentation for the IOCTL access right
landlock:
Fix TCP Fast Open connection bypass
landlock:
Fix use-after-free of the source's parent directory
libbpf:
Reject truncated ldimm64 CO-RE relocations
Linux:
Linux 6.12.112
llc:
fix skb UAF and leaks on llc_mac_hdr_init() failure
llc:
reserve device headroom for allocated frames
lockd:
fix swapped arguments in nlmsvc_match_ip()
mctp:
route: iterate socket tag list in mctp_lookup_prealloc_tag()
media:
chips-media: wave5: Add timeout while stop_streaming
media:
i2c: imx355: Replace client->dev usage
media:
imx355: Avoid calling imx355_power_off twice in error path
media:
rkvdec: Propagate platform_get_irq() errors
media:
video-i2c: fix buffer queue ordering
memstick:
ms_block: destroy io_queue workqueue on removal
MIPS:
Octeon: apply USB FDT fixups also when USB is modular
mm/damon/vaddr:
avoid hw-driven pte updates during damon_hugetlb_mkold()
mm/huge_memory:
use folio's memcg inside __folio_split()
mm/hugetlb:
create hstate_is_gigantic_no_runtime helper
mm/hugetlb:
do not dissolve gigantic pages without runtime support
mm/hugetlb:
fix surplus pages in dissolve_free_huge_page()
mm/hugetlb:
keep max_huge_pages when dissolving surplus folios
mm/hugetlb:
preserve mremap address delta when skipping page tables
mm/mlock:
use the IRQ-safe accessor for NR_MLOCK in __munlock_folio()
mm/mremap:
reset unfaulted VMA page offset for MREMAP_DONTUNMAP
mm/rmap:
allocate anon_vma_chain objects unlocked when possible
mm/rmap:
fix missing barrier between anon_vma init and vma->anon_vma publish
mm:
fix incorrect vm_flags usage when checking allowable orders for tmpfs
mm:
memblock: show all region flags in debugfs
mmc:
core: Cancel SDIO IRQ work before freeing host
mmc:
core: Fix OF node reference leak on card add failure
mmc:
hsq: Fix use-after-free in retry work
mmc:
mmci: Fix use-after-free in busy-timeout work
mmc:
mxcmmc: cancel data work and watchdog on remove
mmc:
rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260
mmc:
sdhci-of-aspeed: Remove children before releasing SDC resources
mmc:
sdhci_am654: Clear ITAPDLY on tuning failure
mmc:
sdhci_am654: Fallback to DT-provided itap delay on DDR50 tuning failure
mmc:
sdhci_am654: Move tuning_loop to local variable
mmc:
sdhci_am654: Reset command and data lines on failed tuning
mmc:
sdio_uart: fix xmit_fifo leak when the port table is full
mmc:
sh_mmcif: initialize IRQ-thread mutex before requesting interrupt
mmc:
spi: reset bytes_xfered before retrying CRC failures
mmc:
via-sdmmc: cancel card-detect work on remove
mptcp:
do not reschedule the RTX timer for fallback sockets
mptcp:
pm: drop match in userspace_pm_append_new_local_addr
mptcp:
pm: kernel: drop pending ADD_ADDR when removing ID0
mptcp:
pm: rename add_entry structure to add_addr
mptcp:
pm: reset retrans_time when ADD_ADDR entry is reused
mptcp:
pm: use for_each_subflow helper
mptcp:
pm: userspace: fix address ID overflow
mptcp:
return sk_wait_data() errors from recvmsg()
mptcp:
use sock_kmemdup for address entry
mtd:
rawnand: pl353: Add message about ECC mode
mtd:
rawnand: pl353: Fix debug prints
mtd:
rawnand: pl353: Make sure we use the monolithic helpers for raw accesses
net/mlx5:
Bridge, don't fail switchdev events of sibling eswitch ports
net/mlx5:
Bridge, don't fail unlink of untracked/unsupported peer ports
net/mlx5:
devcom, Base component size on linked devices
net/mlx5:
Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()
net/mlx5e:
advertise MACsec offload only when supported
net/mlx5e:
do not HW-GRO coalesce small frames
net/mlx5e:
SHAMPO, Always calculate page size
net/packet:
avoid truncating TPACKET_V3 private size
net/packet:
clear RX owner on VNET header error
net/sched:
act_api: release tail references on DELACTION failure
net/sched:
act_ct: avoid modifying shared unconfirmed ct entry
net/sched:
act_ct: don't WARN on benign flow_offload_alloc() failure
net/sched:
act_ct: fix helper UAF due to extensions realloc
net/sched:
act_gate: budget the per-entry list in get_fill_size
net/sched:
cls_u32: fix manual hash table handle IDR aliasing
net/sched:
hhf: cap hh_flows_limit at change time
net/sched:
reject IDR error pointers when deleting actions
net/sched:
sch_hfsc: bound the classify inner-filter walk with a drift budget
net/sched:
sch_teql: fix shadowed err in __teql_resolve()
net/smc:
Address spelling errors
net/smc:
fix UAF on lgr list traversal in smcr_port_err()
net/smc:
stop killed, freed and out_of_sync sharing a byte
net:
arp: terminate device name before lookup
net:
atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read
net:
atl1c: fix soft lockup on out-of-range tpd_cons read
net:
atl1e: fix soft lockup on out-of-range hw_next_to_clean read
net:
bcmgenet: allow return of power up status
net:
bcmgenet: do not skip WoL power up on GENET V1
net:
bcmgenet: fix 64-bit RTNL stats reading in ethtool on 32-bit systems
net:
bcmgenet: initialize u64 stats seq counter for all queues
net:
bcmgenet: mask DMA_TIMEOUT_MASK when reading DMA_RING0_TIMEOUT
net:
bcmgenet: move bcmgenet_power_up into resume_noirq
net:
bcmgenet: validate Ethernet address in bcmgenet_set_mac_addr
net:
bridge: mdb: restart port group walk after deletion
net:
bridge: mst: move switchdev call outside rcu
net:
bridge: use option bits for CFM/MRP frame handlers
net:
cpsw: Execute ndo_set_rx_mode callback in a work queue
net:
cpsw_new: Execute ndo_set_rx_mode callback in a work queue
net:
dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621
net:
ena: fix MMIO read buffer leak on probe failure
net:
ena: Remove autopolling mode
net:
ethernet: cortina: Ack RX overrun interrupt correctly
net:
ethernet: mtk_eth_soc: unregister net_devices in case of probe failure
net:
ethernet: stmmac: dwmac-rk: fix bulk clock leak when the PHY clock fails
net:
ethernet: ti: netcp: fix pm_runtime usage counter leak on error
net:
fddi: skfp: fix NULL deref when setting the MAC address while down
net:
gue: reject invalid REMCSUM offsets
net:
hisilicon: hns_dsaf_mac: fix mdio device leak in hns_mac_register_phy()
net:
ipconfig: bound DHCP option construction
net:
ipconfig: Remove outdated comment and indent code block
net:
lan743x: fix RX checksum use-after-free
net:
lock the socket in sock_gettstamp()
net:
macb: fix ordering around PTP timestamp read
net:
macb: initialize PTP state before registering clock
net:
macb: Replace open-coded implementation with napi_schedule()
net:
macb: unify device pointer naming convention
net:
macb: Use netif_napi_add_tx() instead of netif_napi_add() for TX NAPI
net:
mvpp2: prevent buffer overflow in page_pool allocation
net:
netsec: fix device_node reference leak on phy_np
net:
openvswitch: conntrack: avoid modifying shared unconfirmed ct entry
net:
openvswitch: conntrack: fix helper UAF due to extensions realloc
net:
openvswitch: conntrack: remove 'add_helper' dead code
net:
page_pool: rename page_pool_alloc_netmem to *_netmems
net:
pcs: xpcs: fix clock reference leak on xpcs_init_clks failure
net:
phy: mediatek: do not report link and per-speed LED rules together
net:
skbuff: do not leave stale header offsets after pskb_carve()
net:
skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()
net:
stmmac: do not overwrite phc_index when no PTP clock is registered
net:
stmmac: dwmac4: Use the correct bufzise when the len is exactly 8K
net:
stmmac: propagate FPE preemption-class mapping errors
net:
stmmac: selftests: Capture all packets for vlan checks
net:
stmmac: selftests: Check the dev->features for S-TAG offload testing
net:
stmmac: selftests: Support running selftests on DSA conduits
net:
tls: fix silent data drop under pipe back-pressure
net:
usb: catc: bound the RX packet length in catc_rx_done()
net:
usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist
net:
usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs()
net:
usb: sr9700: include receive overhead in the length check
net:
wwan: mhi_wwan_mbim: check skb_copy_bits() return value
net:
wwan: mhi_wwan_mbim: guard against a cyclic NDP chain
net:
wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb()
net:
xfrm: reject unrepresentable espintcp transport headers
net:
xps: reject an out of range traffic class
netfilter:
ctnetlink: fix suspicious RCU usage in expect_iter_name
netfilter:
cttimeout: detach dataplane timeout policy and repurpose refcount
netfilter:
cttimeout: prevent UAF during module unload
netfilter:
flowtable: hold reference on ct until flow is released
netfilter:
flowtable: publish HW_DEAD after worker is done
netfilter:
ip6t_rpfilter: reject routes without inet6_dev
netfilter:
ip6t_rt: fix zero-address non-strict match out-of-bounds read
netfilter:
nf_tables: join hook list via splice_list_rcu() in commit phase
netfilter:
nf_tables: Simplify chain netdev notifier
netfilter:
nf_tables: skip expired catchall elements on insert and delete
netfilter:
nf_tables: Tolerate chains with no remaining hooks
netfilter:
nfnetlink_queue: hold nfnl mutex in event notifier
netfilter:
nft_nat: fully initialise new_addr in netmap setup
netfilter:
nft_synproxy: use the family-aware checksum helper
netmem:
add a couple of page helper wrappers
nfc:
fix use-after-free in nfc_get_local_general_bytes
nfc:
llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()
nfc:
llcp: fix -ENOMEM on connect with zero-length service name
nfc:
llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()
nfc:
llcp: Fix race condition in accept_queue lifecycle
nfc:
llcp: fix sdreq TLV list leak on parse/alloc/send failure
nfc:
llcp: fix slab-out-of-bounds reads when logging service names
nfc:
llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap()
nfc:
nfcmrvl: validate helper command length before pull
nfc:
pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()
nfc:
port100: reject frames whose declared length exceeds the received data
nfc:
st21nfca: validate ISO15693 inventory length
nfc:
st21nfca: validate received frame size
nfc:
virtual_ncidev: Add missing ioctl compat handler
nfp:
hold IPsec RX state under the XArray lock
nvdimm:
pmem: keep PREFLUSH before data writes
nvdimm:
preserve flush callback -ENOMEM
nvdimm:
virtio_pmem: always wake -ENOSPC waiters
nvdimm:
virtio_pmem: refcount requests for token lifetime
nvdimm:
virtio_pmem: stop allocating child flush bio
nvdimm:
virtio_pmem: use READ_ONCE()/WRITE_ONCE() for wait flags
nvme:
add missing SRCU grace period in error path
nvme:
all namespaces in a subsystem must adhere to a common atomic write size
nvme:
fix atomic write size validation
nvme:
refactor the atomic write unit detection
nvme:
revert the cross-controller atomic write size validation
nvme:
skip the zoned limits update if the zone info query failed
ocfs2:
make ocfs2_calc_xattr_init() return void
octeontx2-af:
Fix memory scaling limitation in SR-IOV mode
openvswitch:
avoid reallocating confirmed conntrack labels
packet:
use ubuf_info completion for TX_RING packets
page_pool:
disable sync for cpu for dmabuf memory provider
PCI:
Allow per function PCI slots to fix slot reset on s390
PCI:
Fix BAR resize for devices on a root bus
PCI:
Fix Resizable BAR restore order
PCI:
Introduce PCI_SLOT_PLACEHOLDER constant for slot_nr placeholder value
PCI:
of_property: Omit bus properties without a subordinate bus
PCI:
starfive: Fix resource leaks on error paths in host_init()
PCI:
starfive: Use regulator APIs to control the 3v3 power supply of PCIe slots
perf test:
Change all remaining #!/bin/sh to #!/bin/bash
perf/arm-cmn:
Fix wp_dev_sel2 setting for multi-DTM configurations
perf/aux:
Allocate non-contiguous AUX pages by default
perf/core:
Fix NULL pmu_ctx passed to pmu->sched_task()
perf/core:
Run sched_task() for PMUs with only CPU-wide events
perf/x86/intel:
Don't pointlessly context switch DS_AREA (and PEBS config) if PEBS is unused
perf/x86/intel:
Don't write PEBS_ENABLED on host<=>guest xfers if CPU has PEBS isolation, to fix stuck PEBS_ENABLED
perf/x86/intel:
Ensure KVM guest PEBS path doesn't set unwanted PERF_GLOBAL_CTRL bits
perf/x86/intel:
Fix GRT PEBS load/store direction for latency events, to fix sample classification
perf/x86/intel:
Make @data a mandatory param for intel_guest_get_msrs()
perf/x86/intel:
Remove anythread_deprecated bit from perf_capabilities
perf/x86/intel:
Remove incorrect LionCove PEBS data-source constraints
perf/x86/intel:
Update event constraints and cache_extra_regsfor ADL
perf/x86/intel:
Update event constraints and cache_extra_regsfor LNL
phy:
mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow
phy:
mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting
phy:
renesas: rcar-gen3-usb2: Avoid long delay in atomic context
pidfd:
hold exec_update_lock around namespace ioctl
pinctrl:
meson: Fix typo in s4 group name
pinctrl:
single: free the IRQ on domain creation failure
pinctrl:
sunxi: keep a shadow copy of the data register output latches
platform/x86/amd/pmc:
Define enum for S2D/PMC msg_port and add helper function
platform/x86/amd/pmc:
Fix LPS0 and debugfs leaks when STB init fails
platform/x86/amd/pmc:
Move STB block into amd_pmc_s2d_init()
platform/x86/amd/pmc:
Move STB functionality to a new file for better code organization
platform/x86/amd/pmc:
Propagate SMU errors and validate S2D address
platform/x86/amd/pmc:
Restore msg_port on amd_stb_s2d_init() error paths
platform/x86:
int1092: Fix potential memory leak in sar_probe()
platform/x86:
intel_sar: Check ACPI_HANDLE() against NULL
platform/x86:
ISST: Check for admin capability for write commands
platform/x86:
ISST: Validate max level for set feature
platform/x86:
think-lmi: Fix certificate thumbprint sysfs output
platform/x86:
think-lmi: Fix current password length check
platform/x86:
think-lmi: improve check if BIOS account security enabled
power:
sequencing: don't call .post_enable() if pwrseq_unit_enable() failed
power:
sequencing: fix NULL-pointer dereference in pwrseq_device_register()
power:
sequencing: fix NULL-pointer dereference in pwrseq_unit_new()
power:
supply: ab8500_fg: fix use-after-free on remove
power:
supply: ab8500_fg: Remove redundant dev_err()/dev_err_probe()
power:
supply: qcom_battmgr: fix use-after-free
powerpc/iommu:
Fix the overflow validation in iommu_tce_check_ioba
pppoatm:
ensure a writable skb header and linear data
rculist:
add list_splice_rcu() for private lists
RDMA/core:
fix refcount bug in iwpm_get_nlmsg_request()
RDMA/core:
Reject unregistering netdevs in ib_get_eth_speed
RDMA/efa:
Keep admin queues alive while IRQ is registered
RDMA/efa:
Keep EQ resources alive while IRQ is registered
RDMA/irdma:
Enforce local fence for IB_WR_REG_MR
RDMA/mad:
Fix receive buffer leak when PKey enforcement fails
RDMA/rtrs-clt:
Fix CQ pool leak when connect is interrupted
RDMA/rxe:
Fix integer overflow in mr_check_range() leading to OOB access
RDMA/rxe:
insert mcg into mcg_tree only after rxe_mcast_add() succeeds
RDMA/rxe:
validate access flags before swapping the MR's PD
RDMA/siw:
Bound fragmented header copies by the remaining length
RDMA/siw:
Clear association under lock if siw_qp_modify fails in siw_accept
RDMA/ucma:
Serialize join and leave on copy_to_user failure
rds:
ib: Clear the sg list when mapping an MR fails
rds:
ib: use rds_conn_drop() on protocol version mismatch
reboot:
fix cad_pid use-after-free race
remoteproc:
pas: Replace metadata context with PAS context structure
remoteproc:
qcom: pas: Guard dtb metadata release with dtb_pas_id check
remoteproc:
qcom_q6v5_adsp: Fix iommu_unmap() usage
Revert "hwmon:
(emc1403) Drop hysteresis for low limit temperature"
Revert "hwmon:
(emc1403) Rely on subsystem locking"
ring-buffer:
Add helper functions for allocations
ring-buffer:
Allow splice reads on static buffers
ring-buffer:
Fix subbuf resize race with ring_buffer_alloc_read_page()
ring-buffer:
Make cpu_buffer::free_page a buffer_data_read_page
ring-buffer:
Show persistent buffer dropped events in trace_pipe file
RISC-V:
KVM: Fix HSM hart status error propagation
RISC-V:
KVM: Fix null pointer dereference in kvm_riscv_aia_imsic_rw_attr()
RISC-V:
KVM: Fix perf-backed counter accounting across stop and read
RISC-V:
KVM: Preserve firmware counter value across stop/start
RISC-V:
KVM: Report snapshot write failure to the guest
RISC-V:
KVM: Serialize IMSIC attributes with vCPU migration
RISC-V:
KVM: Synchronize hrtimer callback during teardown
rose:
cancel neighbour timers in rose_neigh_put() before freeing
rose:
clear neighbour pointer after rose_neigh_put() in state machines
rose:
drop CALL_REQUEST in loopback timer when device is not running
rose:
fix dev_put() leak in rose_loopback_timer()
rose:
fix netdev double-hold in rose_make_new()
rose:
fix netdev double-hold in rose_rx_call_request()
rose:
fix notifier unregistered too early in rose_exit()
rose:
fix race between loopback timer and module removal
rose:
guard rose_neigh_put() against NULL in timer expiry
rose:
hold loopback neighbour reference across timer callback
rtc:
rzn1: Handle unset alarm weekday in rzn1_rtc_read_alarm
s390/boot:
Add sized_strscpy() to enable strscpy() usage
s390/boot:
Avoid IPL parameter append past command line
s390/cio:
Check pmcw.dnv before pmcw.ena in I/O entry points
s390/cio:
Fix cio_update_schib() to not cache invalid schib
s390/cio:
Fix NULL pointer dereference in ccw_device_get_util_str()
s390/cio:
Guard PMCW field accesses with dnv check
s390/cmf:
Fix virtual vs physical address confusion
s390/debug:
Do not register views for failed static debug areas
s390/debug:
Fix NULL pointer dereference in debug_info_copy()
s390/pci/docs:
Fix sriov_numvfs attribute name
s390/vfio-ap:
fix KVM GISC and page leak when queue removed from host config
s390/vfio-ap:
Fix missing lock required to access list of ap_matrix_mdev objects
sched/core:
Make core-sched flips wait for in-flight selections
sched:
Rework prev_balance() to avoid stale prev references
scsi:
core: Validate MODE SENSE lengths in scsi_cdl_enable()
scsi:
fnic: Fix missed link-up when critical IRQ targets offline CPU
scsi:
libiscsi_tcp: Check the data direction of a Data-In PDU
scsi:
megaraid_sas: Protect megasas_get_ctrl_info() in megasas_resume()
scsi:
qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size
scsi:
qla2xxx: Clamp max_npiv_vports to VP_CTRL bitmap capacity
scsi:
qla2xxx: Fix 64G link speed reporting in get_data_rate
scsi:
qla2xxx: Fix queue teardown NULL dma_free and bitmap locking
scsi:
qla2xxx: Fix soft lockup polling continuation IOCB signature
scsi:
qla2xxx: Fix the ql2xfc2target parameter description
scsi:
qla2xxx: Fix use-after-free of qpair work on queue teardown
scsi:
qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path
scsi:
qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock
scsi:
qla2xxx: Skip vport under deletion in report ID acquisition
scsi:
qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error
scsi:
qla2xxx: Use memset_io() to clear QLAFX00 request ring slot
scsi:
qla2xxx: Use ring-slot helpers in __qla2x00_alloc_iocbs
scsi:
qla2xxx: Validate BSG request_len before reading vendor_cmd[]
scsi:
qla2xxx: Zero dport diagnostics buffer to avoid info leak
scsi:
sd_zbc: Reject disks with too many zones
sctp:
avoid livelock while updating retransmit path
sctp:
discard the rest of the packet on a stale-cookie error
sctp:
hold asoc or transport before mod_timer() in timer handlers
seg6:
set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation
selftests/ftrace:
Fix unique symbol check in kprobe_non_uniq_symbol.tc
selftests/landlock:
Add disconnected leafs and branch test suites
selftests/landlock:
Add missing connect(minimal AF_UNSPEC) test
selftests/landlock:
Add test for TCP fast open
selftests/landlock:
Add tests for access through disconnected paths
selftests/landlock:
Add tests for whiteout object creation
selftests/nci:
Fix out-of-bounds store on thread join
selftests:
cgroup: give the O_TMPFILE open in get_temp_fd() a mode
selftests:
nci: Correct pthread_create return value check
selftests:
nci: Fix uninitialized family ID on missing attribute
selinux:
always fill AVC decision in avc_has_perm_noaudit()
selinux:
preserve user SID across nested backing files
selinux:
recheck intermediate backing files on mprotect()
smb/client:
fix security flag calculation when setting security descriptors
smb/client:
send lease break ACKs thru correct session for multiuser mounts
smb:
client: cancel reconnect work in clean_demultiplex_info()
smb:
client: clean up failed cached directory opens
smb:
client: fail DACL rewrite when the new DACL exceeds 64K
smb:
client: fix busy dentry warning on unmount after DIO
smb:
client: fix create context out-of-bounds reads
smb:
client: fix missing iov bounds check in parse_posix_sids()
smb:
client: fix missing lower-bound check on DFS referral string offsets
smb:
client: fix next_buffer UAF and NextCommand bounds in compound PDUs
smb:
client: fix OOB struct field reads in move_smb2_ea_to_cifs()
smb:
client: fix potential OOB read in smb3_enum_snapshots()
smb:
client: fix reparse buffer bounds in cifs_query_reparse_point()
smb:
client: fix rlist race and missing initialization
smb:
client: fix server->total_read for compound encrypted PDUs
smb:
client: fix smbd_connection leak on cifs_get_tcp_session() error
smb:
client: fix unaligned access in WSL reparse point parser
smb:
client: fix use-after-free of iface in cifs_try_adding_channels()
smb:
client: refactor ACL setting control flow in id_mode_to_cifs_acl()
smb:
client: reject short Next offsets in parse_server_interfaces()
smb:
client: validate POSIX create context length
smb:
mark the new channel addition log as informational log with cifs_info
sock:
add sock_kmemdup helper
soundwire:
cadence_master: wait and cancel cdns->work before clock stop
spi:
spi-zynqmp-gqspi: stop the controller on shutdown
squashfs:
Add dictionary size range check to prevent shift-out-of-bounds
staging:
rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()
staging:
rtl8723bs: fix spacing around operators
staging:
sm750fb: fix mono image source stride mismatch in lynxfb_ops_imageblit()
sunvdc:
fix -EIO issue due to lack of retries
super:
make iterate_supers_type() deletion-safe
swiotlb:
use the adjusted address for the highmem page lookup
sysctl:
move the "cad_pid" entry from pid_table[] to kern_reboot_table[]
tcp:
do not let tcp_rmem be set below 4096
tcp:
Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv().
tcp:
exclude old ACKs from tcp fast path
tcp:
fix use-after-free of retransmit_skb_hint in tcp_send_synack()
tcp:
introduce icsk->icsk_keepalive_timer
tcp:
prevent collapsing skbs across boundary in rtx queue
tcp:
Skip cond_resched() in inet_csk_listen_stop() under BPF context
tg3:
clean up PHYLIB resources on probe failure
tg3:
use random MAC address when tg3_get_device_address fails
thermal:
gov_step_wise: Fix stale mitigation vote with non-zero lower bounds
tipc:
Fix a data race on mon->peer_cnt in mon_timeout()
tipc:
reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow
tools/bootconfig:
Cleanup bootconfig footer size calculations
tools/bootconfig:
Fix integer overflow and truncation in size checks
tracing/probes:
Fix anon_stack check for unnamed bitfields in btf_find_struct_member
tracing/probes:
Fix BTF kflag check for anonymous struct member access
tracing:
Clean up use of trace_create_maxlat_file()
tracing:
Constify struct event_trigger_ops
tracing:
Fix memory corruption from a "STACKTRACE" histogram key
tracing:
Merge struct event_trigger_ops into struct event_command
tracing:
Move d_max_latency out of CONFIG_FSNOTIFY protection
tracing:
Remove get_trigger_ops() and add count_func() from trigger ops
tracing:
Set the trace clock before registering the histogram trigger
tracing:
Take the reference before publishing the named histogram trigger
tracing:
Take trace_array reference when opening a tracer options file
tracing:
Take trace_array reference when opening options file
tracing:
Undo the registration when enabling the histogram trigger fails
udf:
Fix data loss when converting inline inodes to out of line
udf:
Move udf_map_block() up
usb:
cdns3: rename hibernated argument of role->resume() to lost_power
usb:
cdnsp: fix wakeup from S3 after controller context loss
usb:
dwc3: clear forceRM when issuing EndTransfer
usb:
dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition
usb:
dwc3: gadget: Reinitiate stream for all host NoStream behavior
usb:
gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers()
usb:
storage: realtek_cr: fix use-after-free on disconnect
usb:
typec: tcpm: constrain TCPM_SOURCING_VBUS event handling
usb:
typec: tcpm: fix debug accessory mode detection for sink ports
veth:
manage XDP program pointers during channel resize
virtio-mmio:
Remove virtqueue list from mmio device
virtio_mmio:
disable IRQ wake before free_irq
virtio_net:
copy zerocopy frags in start_xmit without NAPI
vlan:
ensure sufficient headroom in vlan_dev_hard_header()
vlan:
require the MAC header to be present in __vlan_insert_inner_tag()
vrf:
Stop corrupting skb->csum when capturing CHECKSUM_COMPLETE packets
vxlan:
use one headroom snapshot for neighbour replies
watchdog:
da9063: fix suspend/resume handling of HW_RUNNING watchdog
watchdog:
digicolor: Avoid division by zero
watchdog:
msc313e: Fix premature reset during timeout update
watchdog:
msc313e: Propagate error code in resume()
watchdog:
rtd119x: Avoid division by zero
watchdog:
sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init()
watchdog:
starfive-wdt: Fix runtime PM leak in starfive_wdt_pm_start()
wifi:
ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all()
wifi:
brcmfmac: fix lost 802.1x TX completion wakeup
wifi:
brcmsmac: fix UAF in brcms_free_timer()
wifi:
cfg80211: add option for vif allowed radios
wifi:
cfg80211: check IP header size in cfg80211_classify8021d()
wifi:
cfg80211: don't filter by BSS type when removing stale entries
wifi:
cfg80211: don't get the radio mask for netdev-less wdevs
wifi:
cfg80211: expose cfg80211_chandef_get_width()
wifi:
cfg80211: only group hidden BSSes with beacon entries
wifi:
cfg80211: skip regulatory for punctured subchannels
wifi:
iwlegacy: fix broadcast stations deallocation
wifi:
libertas_tf: fix UAF in lbtf_free_adapter()
wifi:
libipw: reject TKIP frames without a full MIC
wifi:
libipw: reject too-short association responses
wifi:
libipw: reject too-short beacon and probe responses
wifi:
mac80211: abort chanswitch when leaving a mesh
wifi:
mac80211: add HE 6 GHz capability in the scan elems len
wifi:
mac80211: avoid WARN in set_bitrate_mask when sdata not in driver
wifi:
mac80211: don't access the TSF of a down interface
wifi:
mac80211: don't allow injecting frames wider than the chanctx
wifi:
mac80211: don't allow link changes when iface is down
wifi:
mac80211: don't offload TC setup on AP_VLAN interfaces
wifi:
mac80211: don't RCU-dereference the mesh CSA settings we just set
wifi:
mac80211: don't start a ROC while scanning
wifi:
mac80211: don't warn when an IBSS has no channel to scan
wifi:
mac80211: mesh: release the channel if start fails
wifi:
mac80211: mesh: reset the CSA state when leaving
wifi:
mac80211: refuse to make a monitor active when it has no queue
wifi:
mac80211: require a peer station for TDLS setup confirm
wifi:
mac80211: reset state when starting AP fails
wifi:
mac80211: reset the AP_VLAN tailroom counter on ifdown
wifi:
mac80211: set up the TX info early to fix failure paths
wifi:
mac80211: suppress chanctx warning for debugfs reset
wifi:
mac80211: track MU-MIMO configuration on disabled interfaces
wifi:
mac80211: unlist vifs when their netdev is unregistered
wifi:
mac80211: use vif radio mask to limit ibss scan frequencies
wifi:
mac80211_hwsim: don't hand frames to mac80211 while stopping
wifi:
mt76: mt7915: bound the device EEPROM address before the EFUSE copy
wifi:
mt76: mt7915: set correct background radar capability
wifi:
mt76: mt7996: bound the device EEPROM address before the EFUSE copy
wifi:
mwifiex: bound the pairwise-cipher OUI walk to the IE length
wifi:
mwifiex: fix IRQ leak using wrong index in MSI-X error path
wifi:
mwifiex: prevent authentication frame length truncation
wifi:
mwifiex: validate action frame fixed fields
wifi:
mwifiex: validate scan response extents
wifi:
p54: require a full exp_if record in PDR_INTERFACE_LIST
wifi:
p54: validate curve data length in the calibration curve converters
wifi:
rsi: fix heap OOB write on key removal
wifi:
rtw88: Fix the random "error beacon valid" messages for USB
wifi:
rtw88: TX QOS Null data the same way as Null data
wifi:
rtw89: cleanup unused rtwdev::roc_work
wifi:
rtw89: Hide some errors when the device is unplugged
wifi:
rtw89: pci: add .shutdown callback to stop rfkill polling on reboot
wifi:
virt_wifi: don't transfer operstate before register
wifi:
virt_wifi: free skb when disconnected
wifi:
wcn36xx: Fix potential use-after-free in TX ack timer teardown
wifi:
wilc1000: fix out-of-bounds read in P2P public action frames
wifi:
wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext()
wifi:
wlcore: release runtime PM ref on regdomain config failure
workqueue:
Fix NULL current_pwq deref in flush dependency check
writeback:
bound cleanup_offline_cgwb() rescans by rotating scanned inodes
writeback:
report a Tasks-RCU quiescent state per cgwb drain pass
x86/fred:
Reconstruct the #GP context for rejected INT instructions
x86/mce:
Fix hardware debug register corruption on task migration
x86/microcode/intel:
Reject problematic loading on Granite Rapids systems
x86/PCI:
Disable enhanced atomics on AMD NBIO 7.7 and 7.11
xfrm:
add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()
xfrm:
avoid RCU warnings around the per-netns netlink socket
xfrm:
fix compat ALLOCSPI request use-after-free
xfrm:
Fix dev use-after-free in xfrm async resumption
xfrm:
Refactor xfrm_input lock to reduce contention with RSS
xfrm:
save input state data before secpath resets
xfrm:
serialize state GC with device state flush
xfrm:
use hlist_del_init_rcu for state_cache and state_cache_input
xfs:
check di_forkoff correctly in scrub
xfs:
check padding field in xfs_ioc_commit_range
xfs:
don't assert when XFS_SCRUB_TYPE_HEALTHY scans return corruption
xfs:
don't call xfs_exchange_range_finish for a dry run
xfs:
don't stash removename operations with unknown ftype
xfs:
fix attr fork block count checks in xrep_inode_blockcounts
xfs:
fix backwards mergeability logic in refcount scrubber
xfs:
fix blockgc group quota scanning when usrquota isn't enforced
xfs:
fix short ifork reaping computation in xreap_bmapi_binval
xfs:
fix under-reservation of blocks when repairing sf directories
xfs:
release orphanage dir inode if chown fails
xfs:
remove the i_ino field in struct xfs_inode
xfs:
report healthy filesystem events in scrub stats
xfs:
strengthen the "is cow staging" helpers in scrub
xfs:
use correct jiffies comparison function in xchk_maybe_relax
xhci:
Cleanup Candence controller PCI device and vendor ID usage
xsk:
Use a 32-bit compare in xsk_map_gen_lookup