Changelog
in Linux kernel
6.18.42
accel/amdxdna:
Fix use-after-free of mm_struct in job scheduler
accel/amdxdna:
reject command submission on devices without a submit op
accel/ivpu:
Fix wrong register read in LNL failure diagnostics
afs:
Fix afs_edit_dir_remove() to get, not find, block 0
ALSA:
hda/realtek: Fix speakers on Lunnen Ground 14
ALSA:
hda: codecs: hdmi: disable keep-alive before audio format change
ALSA:
hda: cs35l41: validate and free ACPI mute object
ALSA:
seq: close a re-opened queue timer in the destructor
ALSA:
timer: don't re-enter an instance callback that is still running
ALSA:
timer: drain a slave's callback before its master detaches it
ALSA:
usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC
amd-xgbe:
fix MAC_AUTO_SW handling in CL37 AN
amt:
fix use-after-free in AMT delayed works
amt:
make the head writable before rewriting the L2 header
amt:
re-read skb header pointers after every pull
arm64:
Correct value returned by ESR_ELx_FSC_ADDRSZ_nL()
arm64:
dts: qcom: correct RBR opp entry
arm64:
dts: qcom: hamoa: Fix OPP tables for all DisplayPort controllers
arm64:
make huge_ptep_get handled unaligned addresses
arm64:
syscall: Ensure saved x0 is kept in-sync with tracer updates
arm64:
tegra: Fix CPU compatible string to cortex-a78ae on Tegra234
arm64:
tegra: Remove fallback compatible for GPCDMA
ASoC:
amd: ps: disable MSI on resume in ACP PCI driver
ASoC:
amd: ps: fix wrong ACP version string in pci_request_regions()
ASoC:
amd: ps: replace bitwise OR with logical OR in IRQ return check
ASoC:
bt-sco: fix duplicate DAPM widget names for wideband DAI
ASoC:
cs35l56: Don't use devres to unregister component
ASoC:
cs35l56: Fix potential probe() deadlock
ASoC:
cs35l56: Use complete_all() to signal init_completion
ASoC:
cs42l43: Correct report for forced microphone jack
ASoC:
fsl: imx-card: Skip sysclk reset for active DAIs in shutdown
ASoC:
fsl_sai: Fix spurious BCLK on resume by clearing BYP
ASoC:
meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop
ASoC:
sun4i-codec: Set quirks.playback_only for H616 codec
ASoC:
tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup
ASoC:
tas2781: bound firmware description string parsing
ata:
libata-core: Reject an invalid concurrent positioning ranges count
ata:
sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered
ata:
sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts
ata:
sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning
ata:
sata_dwc_460ex: use platform_get_irq()
audit:
fix recursive locking deadlock in audit_dupe_exe()
audit:
use 'unsigned int' instead of 'unsigned'
audit:
widen ino fields to u64
binfmt_elf_fdpic:
only honour the first PT_INTERP
binfmt_misc:
set have_execfd only once the interpreter is opened
Bluetooth:
btusb: validate Realtek vendor event length
Bluetooth:
hci_qca: Clear memdump state on invalid dump size
Bluetooth:
hci_sync: extend conn_hash lookup critical sections
Bluetooth:
hci_sync: Protect UUID list traversal
Bluetooth:
mgmt: fix locking in unpair_device/disconnect_sync
Bluetooth:
mgmt: hold reference for hci_conn in mgmt_pending_cmds
Bluetooth:
MGMT: revalidate LOAD_CONN_PARAM queued update
Bluetooth:
qca: fix NVM tag length underflow in TLV parser
Bluetooth:
RFCOMM: Fix session UAF in set_termios
bonding:
fix devconf_all NULL dereference when IPv6 is disabled
bootconfig:
fix NULL-pointer arithmetic in xbc_snprint_cmdline()
bootconfig:
move xbc_snprint_cmdline() to lib/bootconfig.c
bpf, sockmap:
Fix cork use-after-free in tcp_bpf_sendmsg()
bpf, sockmap:
Reject unhashed UDP sockets on sockmap update
bpf:
Fix ld_{abs,ind} failure path analysis in subprogs
bpf:
Fix same-register dst/src OOB read and pointer leak in sock_ops
bpf:
tcp: fix double sock release on batch realloc
btrfs:
declare btrfs_ioctl_search_args_v2::buf as __u8
btrfs:
don't propagate EXTENT_FLAG_LOGGING to split extent maps
btrfs:
fallback to transaction csum tree on a commit root csum miss
btrfs:
fix root leak if its reloc root is unexpected in merge_reloc_roots()
btrfs:
fix u32 to s64 type conversion in dirty_metadata_bytes accounting
btrfs:
free mapping node on duplicate reloc root insert
btrfs:
reject free space cache with more entries than pages
btrfs:
use bool type for btrfs_path members used as booleans
can:
bcm: add locking when updating filter and timer values
can:
bcm: add missing device refcount for CAN filter removal
can:
bcm: extend bcm_tx_lock usage for data and timer updates
can:
bcm: fix CAN frame rx/tx statistics
can:
bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()
can:
bcm: fix stale rx/tx ops after device removal
can:
bcm: track a single source interface for ANYDEV timeout/throttle ops
can:
bcm: validate frame length in bcm_rx_setup() for RTR replies
can:
j1939: fix lockless local-destination check
can:
raw: add locking for raw flags bitfield
cdrom:
fix stack out-of-bounds read in CDROMVOLCTRL
ceph:
fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()
ceph:
fix refcount leak in ceph_readdir()
ceph:
fix writeback_count leak in write_folio_nounlock()
comedi:
comedi_parport: deal with premature interrupt
cpufreq:
Make cpufreq_update_pressure() fall back to cpuinfo.max_freq
cred:
add kernel_cred() helper
cred:
add scoped_with_kernel_creds()
crypto:
tegra - Don't touch bo refcount in host1x bo pin/unpin
cxl/pci:
Remove CXL VH handling in CONFIG_PCIEAER_CXL conditional blocks from core/pci.c
cxl/pci:
Remove unnecessary CXL Endpoint handling helper functions
cxl/pci:
Remove unnecessary CXL RCH handling helper functions
cxl:
Fix CXL_HEADERLOG_SIZE to match RAS Capability size
dm-verity-fec:
fix reading parity bytes split across blocks (take 3)
dm-verity-fec:
fix the size of dm_verity_fec_io::erasures
dm-verity-fec:
replace {MAX,MIN}_RSN with {MIN,MAX}_ROOTS
dm-verity:
fix buffer overflow in FEC calculation
dm:
avoid leaking the caller's thread keyring via the table device file
dmaengine:
dw-edma-pcie: Reject devices without driver data
dmaengine:
dw-edma: Fix confusing cleanup.h syntax
dmaengine:
sh: rz-dmac: Move interrupt request after everything is set up
dpaa2-eth:
put MAC endpoint device on disconnect
dpaa2-switch:
put MAC endpoint device on disconnect
dpll:
fix NULL pointer dereference in dpll_msg_add_pin_ref_sync()
drivers/virt:
pkvm: Fix end calculation in mmio_guard_ioremap_hook()
drm/amd/amdgpu:
disable ASPM on VI if pcie dpm is disabled
drm/amd/display:
consolidate DCN vblank/flip handling onto vupdate_no_lock
drm/amd/display:
dce100: skip non-DP stream encoders for DP MST
drm/amd/display:
detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference
drm/amd/display:
Fix backlight max_brightness to match exported range
drm/amd/display:
Fix DTB DTO updates breaking live pixel rate sources
drm/amd/display:
Fix flip-done timeouts on mode1 reset
drm/amd/display:
Fix missing DCE check in dm_gpureset_toggle_interrupts()
drm/amd/display:
Force PWM backlight on Lenovo Legion 5 15ARH05
drm/amd/display:
Handle struct drm_plane_state.ignore_damage_clips
drm/amd/display:
set new_stream to NULL after release
drm/amd/pm/ci:
Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X)
drm/amd/pm:
fix amdgpu_pm_info power display units
drm/amd/pm:
fix smu13 power limit range calculation
drm/amd/pm:
fix smu14 power limit range calculation
drm/amd/pm:
make pp_features read-only when scpm is enabled
drm/amdgpu/gfx10:
replace BUG_ON() with WARN_ON()
drm/amdgpu/gfx11:
replace BUG_ON() with WARN_ON()
drm/amdgpu/gfx12:
replace BUG_ON() with WARN_ON()
drm/amdgpu/gfx8:
drop unecessary BUG_ON()
drm/amdgpu/gfx9.4.3:
replace BUG_ON() with WARN_ON()
drm/amdgpu/gfx9:
Fix Ring and IB test fail after mode2
drm/amdgpu/gfx9:
replace BUG_ON() with WARN_ON()
drm/amdgpu/gfx:
fix cleaner shader IB buffer overflow
drm/amdgpu/jpeg:
fix jpeg_v4_0_3_is_idle detection
drm/amdgpu/jpeg:
fix jpeg_v5_0_1_is_idle detection
drm/amdgpu/sdma4.4.2:
replace BUG_ON() with WARN_ON()
drm/amdgpu/sdma5.0:
replace BUG_ON() with WARN_ON()
drm/amdgpu/sdma5.2:
replace BUG_ON() with WARN_ON()
drm/amdgpu/sdma6.0:
replace BUG_ON() with WARN_ON()
drm/amdgpu/sdma7.0:
replace BUG_ON() with WARN_ON()
drm/amdgpu/soc24:
reset dGPU if suspend got aborted
drm/amdgpu/uvd:
Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2)
drm/amdgpu/uvd:
Place VCPU BO only in VRAM for UVD 4.x and older
drm/amdgpu/vce:
fix integer overflow in image size
drm/amdgpu/vcn4:
avoid rereading IB param length
drm/amdgpu:
check amdgpu_vm_bo_find() result in GET_MAPPING_INFO
drm/amdgpu:
Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge
drm/amdgpu:
Fix amdgpu_bo_move() when old_mem and new_mem are both GTT
drm/amdgpu:
fix aperture mapping leak
drm/amdgpu:
fix bo->pin leaking in amdgpu_bo_create_reserved
drm/amdgpu:
fix check in amdgpu_hmm_invalidate_gfx
drm/amdgpu:
fix division by zero with invalid uvd dimensions
drm/amdgpu:
fix lifetime issue of amdgpu_vm_get_task_info_pasid()
drm/amdgpu:
fix resource leak on ACP reset timeout
drm/amdgpu:
Fix VFCT bus number matching with soft filter
drm/amdgpu:
invoke pm_genpd_remove() before freeing genpd
drm/amdgpu:
Release VFCT ACPI table reference
drm/amdgpu:
validate CP_GFX_SHADOW chunk size in CS pass1
drm/amdkfd:
Check bounds in allocate_event_notification_slot
drm/amdkfd:
Check bounds on CRIU restore queue type and mqd size
drm/amdkfd:
fix 32-bit overflow in CWSR total size calculation
drm/amdkfd:
Use kvcalloc to allocate arrays
drm/bridge:
cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS()
drm/displayid:
fix Tiled Display Topology ID size
drm/dp/mst:
fix buffer overflows in sideband chunk accumulation
drm/dp/mst:
fix OOB reads in remote DPCD/I2C sideband reply parsers
drm/dp/mst:
fix OOB reads on 2-byte fields in sideband reply parsers
drm/dp_mst:
Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe()
drm/gfx10:
Program DB_RING_CONTROL
drm/gpusvm:
Fix MM reference leak in drm_gpusvm_range_evict
drm/i915/bios:
range check LFP Data Block panel_type2
drm/i915/gem:
Add missing nospec on parallel submit slot
drm/i915/gem:
Do not leak siblings[] on proto context error
drm/i915/gem:
Fix NULL deref in I915_CONTEXT_PARAM_SSEU
drm/i915/gt:
use correct selftest config symbol
drm/i915/hdcp:
check streams[] bounds before overflow
drm/i915/hdcp:
require monotonically increasing seq_num_v
drm/i915/mst:
limit DP MST ESI service loop
drm/i915/selftests:
Fix GT PM sort comparators
drm/i915/wm:
clear the plane ddb_y entries on plane disable
drm/i915:
Return NULL on error in active_instance
drm/imagination:
acquire vm_ctx->lock before mapping memory to GPU VM
drm/imagination:
Count paired job fence as dependency in prepare_job()
drm/imagination:
Fit paired fragment job in the correct CCCB
drm/imagination:
Fix double call to drm_sched_entity_fini()
drm/imagination:
fix error checking of pvr_vm_context_lookup()
drm/imagination:
Fix user array stride in pvr_set_uobj_array()
drm/nouveau/acr:
fix missing nvkm_done() in error path of nvkm_acr_oneinit()
drm/nouveau:
fix reversed error cleanup order in ucopy functions
drm/panel:
s6e3ha8: fix unmet dependency on DRM_DISPLAY_HELPER
drm/panthor:
Check debugfs GEM lock initialization
drm/panthor:
return error on truncated firmware
drm/radeon:
fix r100_copy_blit for large BOs
drm/rockchip:
analogix_dp: Add missing error check for platform_get_resource()
drm/rockchip:
cdn-dp: add missing check in cdn_dp_config_video()
drm/sysfb:
Avoid possible truncation with calculating visible size
drm/sysfb:
Avoid truncating maximum stride
drm/sysfb:
Do not page-align visible size of the framebuffer
drm/sysfb:
Return errno code from drm_sysfb_get_visible_size()
drm/tests:
shmem: Set DMA mask to 64-bit in drm_gem_shmem
drm/tidss:
Fix missing drm_bridge_add() call
drm/ttm:
Account for NULL and handle pages in ttm_pool_backup
drm/v3d:
Reach the GMP through the hub registers on V3D 7.x
drm/vc4:
Prevent shader BO mappings from becoming writable
drm/vc4:
Shut down BO cache timer before teardown
drm/virtio:
bound EDID block reads to the response buffer
drm/virtio:
Don't detach GEM from a non-created context
drm/virtio:
fix deadlock in display_info_cb by removing hotplug from dequeue worker
drm/vmwgfx:
Validate vmw_surface_metadata::array_size
drm/xe/i2c:
Allow per domain unique id
drm/xe/sa:
Shadow buffer support in the sub-allocator pool
drm/xe/uapi:
Reject coh_none PAT index for CPU_ADDR_MIRROR
drm/xe/vf:
Fix VF CCS attach/detach race with in-flight BO moves
drm/xe/vf:
Shadow buffer management for CCS read/write operations
drm/xe/vm:
Fix SVM leak on resv obj alloc failure in xe_vm_create()
drm/xe/wopcm:
fix WOPCM size for LNL+
drm/xe:
Allow the caller to pass guc_buf_cache size
drm/xe:
Fix PTE index in xe_vm_populate_pgtable() for chunked binds
drm/xe:
Hold a dma-buf reference for imported BOs
drm/xe:
Return error on non-migratable faults requiring devmem
drm:
drop lib from header search path.
drm:
renesas: rzg2l_mipi_dsi: Increase reset deassertion delay
drm:
renesas: rzg2l_mipi_dsi: Move rzg2l_mipi_dsi_set_display_timing()
exec:
fix unsigned loop counter wrap in transfer_args_to_stack()
firewire:
net: Fix fragmented datagram reassembly
firmware:
arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation
firmware:
arm_ffa: Fix NULL dereference in ffa_partition_info_get()
firmware:
arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit()
firmware:
arm_ffa: Respect firmware advertised RX/TX buffer size limits
firmware:
arm_scmi: Rate-limit queue-full warnings in IRQ context
firmware:
stratix10-svc: fix memory leaks and list corruption bugs
fs/proc/task_mmu:
fix make_uffd_wp_huge_pte() prot-update race
fs/resctrl:
Fix use-after-free during unmount
fs/resctrl:
Move allocation/free of closid_num_dirty_rmid[]
fs/resctrl:
Move RMID initialization to first mount
fs/resctrl:
Split L3 dependent parts out of __mon_event_count()
fs/super:
fix emergency thaw double-unlock of s_umount
fs:
preserve ACL_DONT_CACHE state in forget_cached_acl()
fscrypt:
Add missing superblock check in find_or_insert_direct_key()
fscrypt:
Avoid dynamic allocation in fscrypt_get_devices()
ftrace:
Add global mutex to serialize trace_parser access
fuse-uring:
fix race between registration and connection abortion
fuse:
fix writeback array overflow when max_pages is one
geneve:
require CAP_NET_ADMIN in the device netns for changelink
gpu/buddy:
bail out of try_harder when alignment cannot be honoured
gpu:
Fix uninitialized buddy for built-in drivers
gpu:
host1x: Fix use-after-free in host1x_bo_clear_cached_mappings
gpu:
Move DRM buddy allocator one level up (part two)
gtp:
check skb_pull_data() return in gtp1u_send_echo_resp()
gtp:
parse extension headers before reading inner protocol
gve:
fix Rx queue stall on alloc failure
hinic:
remove unused ethtool RSS user configuration buffers
hwmon:
(asus-ec-sensors) add missed handle for ENOMEM
hwmon:
(asus-ec-sensors) fix EC read intervals
hwmon:
(asus-ec-sensors) fix looping over banks while reading from EC
hwmon:
(corsair-cpro) Stop device IO before calling hid_hw_stop
hwmon:
(corsair-psu) Stop device IO before calling hid_hw_stop
hwmon:
(gigabyte_waterforce) Stop device IO before calling hid_hw_stop
hwmon:
(nzxt-kraken3) Stop device IO before calling hid_hw_stop
hwmon:
(nzxt-smart2) Stop device IO before calling hid_hw_stop
hwmon:
occ: validate poll response sensor blocks
i3c:
mipi-i3c-hci: Fix handling of shared IRQs during early initialization
i3c:
mipi-i3c-hci: Fix Hot-Join NACK
IB/mad:
Drop unmatched RMPP responses before reassembly
ice:
allow creating VFs when !CONFIG_ICE_SWITCHDEV
ice:
fix LAG recipe to profile association
ice:
fix PTP Call Trace during PTP release
ice:
prevent tstamp ring allocation for non-PF VSI types
ice:
reject out-of-range ptype in ice_parser_profile_init
ice:
use READ_ONCE() to access cached PHC time
ila:
reload IPv6 header after pskb_may_pull in checksum adjust
Input:
ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()
Input:
ims-pcu - fix logic error in packet reset
intel_th:
fix MSC output device reference leak
io_uring/rw:
fix missing ERESTARTSYS conversion in read paths
iomap:
correct the range of a partial dirty clear
iomap:
fix out-of-bounds bitmap_set() with zero-length range
iommu/amd:
Bound the early ACPI HID map
iommu/amd:
Wait for completion instead of returning early in iommu_completion_wait()
iommu/intel:
Fix out-of-bounds memset in dmar_latency_disable()
iommu/vt-d:
Disallow SVA if page walk is not coherent
ipv4:
fib: free fib_alias with kfree_rcu() on insert error path
ipv4:
icmp: fill flow parameters in icmp_route_lookup decoy lookup
ipv6:
Change allocation flags to match rcu_read_lock section requirements
kho:
make sure scratch size is always aligned by CMA_MIN_ALIGNMENT_BYTES
ksmbd:
bound DACL dedup walk to copied ACEs
ksmbd:
defer destroy_previous_session() until after NTLM authentication
ksmbd:
pin conn during async oplock break notification
ksmbd:
restore DACL size on check_add_overflow() to avoid malformed ACL
ksmbd:
validate ACE size against SID sub-authorities
ksmbd:
validate compound request size before reading StructureSize2
ksmbd:
validate num_subauth when copying ACE in set_ntacl_dacl
KVM:
nVMX: Hide shadow VMCS right after VMCLEAR
KVM:
SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug
KVM:
x86/mmu: Fix use-after-free on vendor module reload
KVM:
x86: Check for invalid/obsolete root *after* making MMU pages available
KVM:
x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN
landlock:
Account all audit data allocations to user space
landlock:
Fix formatting
libceph:
bound get_version reply decode to front len
libceph:
Fix multiplication overflow in decode_new_up_state_weight()
libceph:
guard missing CRUSH type name lookup
libceph:
refresh auth->authorizer_buf{,_len} after authorizer update
libceph:
Reject monmaps advertising zero monitors
libceph:
reject zero bucket types in crush_decode
libceph:
remove debugfs files before client teardown
Linux:
Linux 6.18.42
LoongArch:
Fix address space mismatch in kexec command line lookup
LoongArch:
Fix oops during single-step debugging
LoongArch:
Move jump_label_init() before parse_early_param()
LoongArch:
Retrieve CPU package ID from PPTT when available
mac802154:
hold an interface reference across the scan worker
mac802154:
llsec: reject frames shorter than the authentication tag
mctp:
check register_netdevice_notifier() error in mctp_device_init()
mctp:
serial: handle zero-length frames to prevent rx buffer overflow
media:
airspy: Return queued buffers on start_streaming() failure
media:
amlogic-c3: Add validations for ae and awb config
media:
aspeed: fix missing of_reserved_mem_device_release() on probe failure
media:
cec: seco: unregister adapter on IR probe failure
media:
cedrus: clean up media device on probe failure
media:
cedrus: Fix missing cleanup in error path
media:
cedrus: skip invalid H.264 reference list entries
media:
chips-media: wave5: Move src_buf Removal to finish_encode
media:
cx231xx: fix devres lifetime
media:
cx23885: add ioremap return check and cleanup
media:
i2c: alvium: fix critical pointer access in alvium_ctrl_init
media:
imx219: Fix maximum frame length in lines
media:
intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for overlapping ranges
media:
iris: Fix use IRQF_NO_AUTOEN when requesting the IRQ
media:
marvell-cam: fix missing pci_disable_device() on remove
media:
meson: vdec: Fix memory leak in error path of vdec_open
media:
msi2500: Return queued buffers on start_streaming() failure
media:
nuvoton: npcm-video: fix error handling in npcm_video_init()
media:
nuvoton: npcm-video: fix memory leaks in probe and remove
media:
nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe
media:
nxp: imx8-isi: Clean up already-initialized pipes on probe failure
media:
nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path
media:
nxp: imx8-isi: Fix potential out-of-bounds issues
media:
nxp: imx8-isi: Fix scale factor calculation for hardware rounding
media:
pci: dm1105: Free allocated workqueue
media:
pwc: Drain fill_buf on start_streaming() failure
media:
pwc: Return queued buffers on start_streaming() failure
media:
qcom: camss: Fix RDI streaming for CSID 680
media:
qcom: camss: Fix RDI streaming for CSID GEN2
media:
qcom: camss: Fix RDI streaming for CSID GEN3
media:
radio-si476x: Unregister v4l2_device on probe failure
media:
rtl2832: fix use-after-free in rtl2832_remove()
media:
rtl2832_sdr: Return queued buffers on start_streaming() failure
media:
rzg2l-cru: Skip ICnMC configuration when ICnSVC is used
media:
saa7134: Fix a possible memory leak in saa7134_video_init1
media:
stm32-dcmipp: Return queued buffers on start_streaming() failure
media:
stm32: dcmi: unregister notifier on probe failure
media:
sun4i-csi: Return queued buffers on start_streaming() failure
media:
synopsys: hdmirx: Fix HPD lane hold time
media:
tegra-video: vi: fix invalid u32 return value in format lookup
media:
ti: vpe: unwind v4l2 device registration on probe error
media:
v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete()
media:
v4l2-ctrls: validate HEVC active reference counts
media:
v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor()
media:
v4l2-subdev: Fail {enable,disable}_streams and s_streaming nicely
media:
vb2: use ssize_t for vb2_read/vb2_write
media:
verisilicon: Export only needed pixels formats
media:
vidtv: fix reference leak on failed device registration
media:
vimc: fix reference leak on failed device registration
media:
vivid: add vivid_update_reduced_fps()
media:
vivid: check for vb2_is_busy() when toggling caps
media:
vivid: fix cleanup bugs in vivid_init()
media:
vpif_capture: fix OF node reference imbalance
mei:
bus: access mei_device under device_lock on cleanup
misc:
nsm: only unlock nsm_dev on post-lock error paths
misc:
nsm: pin the module while the device is open
mm/damon/core:
disallow overlapping input ranges for damon_set_regions()
mm/damon/core:
validate ranges in damon_set_regions()
mm/huge_memory:
set PG_has_hwpoisoned only after new folio head is established
mm/kmemleak:
fix checksum computation for per-cpu objects
mm/sparse-vmemmap:
fix vmemmap accounting underflow
mmc:
vub300: fix use-after-free on probe failure
mmc:
vub300: rename probe error labels
mpls:
fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n
mptcp:
decrement subflows counter on failed passive join
mptcp:
only set DATA_FIN when a mapping is present
mptcp:
pm: userspace: fix use-after-free in get_local_id
mtd:
fix double free and WARN_ON in add_mtd_device() error paths
mtd:
maps: vmu-flash: fix fault in unaligned fixup
mtd:
mtdswap: remove debugfs stats file on teardown
mtd:
nand: mtk-ecc: stop on ECC idle timeouts
net/af_iucv:
fix NULL deref in afiucv_hs_callback_syn()
net/iucv:
fix use-after-free of a severed iucv_path
net/iucv:
take a reference on the socket found in afiucv_hs_rcv()
net/mlx5:
E-Switch, fix zero num_dest in prio_tag egress vlan rule
net/mlx5:
Fix MCIA register buffer overflow on 32 dword reads
net/mlx5:
Refactor EEPROM query error handling to return status separately
net/mlx5e:
Fix NULL pointer dereference in ioctl module EEPROM query
net/mlx5e:
Reject unsupported CB Shaper TSA in ETS validation
net/mlx5e:
Report zero bandwidth for non-ETS traffic classes
net/mlx5e:
Use sender devcom for MPV master-up
net/packet:
avoid fanout hook re-registration after unregister
net/sched:
act_tunnel_key: Defer dst_release to RCU callback
net/x25:
fix use-after-free in x25_kill_by_neigh()
net:
airoha: Fix DMA direction for NPU mailbox buffer
net:
airoha: fix ETS channel derivation in airoha_tc_setup_qdisc_ets()
net:
airoha: Fix potential use-after-free in airoha_ppe_deinit()
net:
bridge: vlan: fix vlan range dumps starting with pvid
net:
Call net_enable_timestamp() before failure in sk_clone().
net:
dpaa: fix mode setting
net:
dropreason: add SKB_DROP_REASON_RECURSION_LIMIT
net:
gre: fix lltx regression for GRE tunnels with SEQ/CSUM
net:
gro: fix double aggregation of flush-marked skbs
net:
hip04: fix RX buffer leak on build_skb failure
net:
hsr: fix memory leak on slave unregistration by removing synced VLANs
net:
ipa: fix SMEM state handle leaks in SMP2P init
net:
ipv6: fix dif and sdif mismatch in raw6_icmp_error
net:
mana: Optimize irq affinity for low vcpu configs
net:
mana: Validate the packet length reported by the NIC
net:
mctp i3c: clean up notifier and buses if driver register fails
net:
pcs: xpcs: fix SGMII state reading
net:
phy: marvell: fix return code
net:
plumb drop reasons to __dev_queue_xmit()
net:
qrtr: ns: Raise node count limit to 512
net:
qrtr: restrict socket creation to the initial network namespace
net:
slip: serialize receive against buffer reallocation
net:
stmmac: cores: remove many xxx_SHIFT definitions
net:
stmmac: enable the MAC on link up for all supported speeds
net:
stmmac: fix dwmac4 transmit performance regression
net:
stmmac: fix l3l4 filter rejecting unsupported offload requests
net:
stmmac: intel: skip SerDes reconfig when rate is unchanged
net:
stmmac: remove xstats.pcs_* members
net:
stmmac: reset residual action in L3L4 filters on delete
net:
stmmac: socfpga: Add hardware supported cross-timestamp
net:
stmmac: socfpga: Agilex5 EMAC platform configuration
net:
stmmac: socfpga: Enable TBS support for Agilex5
net:
stmmac: xgmac: fix l4 filter port overwrite on register update
net:
txgbe: fix FDIR filter leak on remove
netfilter:
nf_conntrack_sip: remove net variable shadowing
netfilter:
nf_conntrack_sip: validate skb_dst() before accessing it
netfilter:
nf_tables: remove register tracking infrastructure
netfilter:
nf_tables: revert commit_mutex usage in reset path
netfilter:
nft_counter: serialize reset with spinlock
netfilter:
nft_fib: reject fib expression on the netdev egress hook
netfilter:
nft_quota: use atomic64_xchg for reset
netlink:
specs: rt-link: convert bridge port flag attributes to u8
nexthop:
initialize extack in nh_res_bucket_migrate()
nfp:
Check resource mutex allocation
NFSD:
pass nfsd_file to nfsd_iter_read()
objtool/rust:
add one more `noreturn` Rust function for Rust 1.99.0
octeontx2-af:
cn10k: restrict VF LMTLINE sharing to its own PF
octeontx2-af:
validate body pcifunc in rvu_mbox_handler_rep_event_notify
octeontx2-pf:
tc: fix egress ratelimiting
octeontx2-vf:
set TC flower flag on MCAM entry allocation
openvswitch:
fix GSO userspace truncation underflow
ovl:
add override_creds cleanup guard extension for overlayfs
ovl:
check access to copy_file_range source with src mounter creds
ovl:
fix trusted xattr escape prefix matching
ovl:
port ovl_copyfile() to cred guard
ovl:
use linked upper dentry in copy-up tmpfile
ovpn:
avoid putting unrelated P2P peer on socket release
ovpn:
fix peer refcount leak in TCP error paths
ovpn:
fix use after free in unlock_ovpn()
ovpn:
hold peer before scheduling keepalive work
ovpn:
use monotonic clock for peer keepalive timeouts
pds_core:
check for workqueue allocation failure
pds_core:
fix auxiliary device add/del races
pds_core:
fix deadlock between reset thread and remove
pds_core:
fix use-after-free on workqueue during remove
pds_core:
order completion reads after the ownership check
pds_core:
reject component parameter in legacy firmware update
pds_core:
yield the CPU while waiting for the adminq to drain
phonet:
pep: fix use-after-free in pep_get_sb()
pinctrl:
renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP
platform/loongarch:
laptop: Explicitly reset bl_powered state when suspend
platform/x86/intel-uncore-freq:
Fix current_freq_khz after CPU hotplug
pmdomain:
imx93-blk-ctrl: convert to devm_* only
pmdomain:
imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI
powerpc/85xx:
Add fsl,ifc to common device ids
powerpc/time:
Prepare to stop elapsing in dynticks-idle
powerpc/vtime:
Initialize starttime at boot for native accounting
ppp:
annotate concurrent dev->stats accesses
ppp:
annotate data races in ppp_generic
ppp:
defer channel free to an RCU grace period to fix pppol2tp RX UAF
ppp:
don't store tx skb in the fastpath
ppp:
enable TX scatter-gather
pppoe:
reload header pointer after dev_hard_header()
proc:
Fix broken error paths for namespace links
ptp:
netc: explicitly clear TMR_OFF during initialization
ptp:
ptp_s390: Add missing facility check
raw:
annotate lockless match fields in raw_v4_match()
rbd:
Reset positive result codes to zero in object map update path
RDMA/cma:
Fix hardware address comparison length in netevent callback
RDMA/erdma:
initialize ret for empty receive WR lists
RDMA/hns:
Fix potential integer overflow in mhop hem cleanup
RDMA/irdma:
Prevent overflows in memory contiguity checks
RDMA/irdma:
Prevent rereg_mr for non-mem regions
RDMA/irdma:
Prevent user-triggered null deref on QP create
RDMA/irdma:
Remove redundant legacy_mode checks
RDMA/mana_ib:
initialize err for empty send WR lists
RDMA/siw:
publish QP after initialization
RDMA/umem:
Add pinned revocable dmabuf import interface
rds:
drop incoming messages that cross network namespace boundaries
rds:
tcp: unregister sysctl before tearing down listen socket
regulator:
mt6358: use regmap helper to read fixed LDO calibration
remoteproc:
xlnx: Check remote core state
Revert "arm64:
syscall: Ensure saved x0 is kept in-sync with tracer updates"
Revert "drm/amd/display:
Add missing kdoc for ALLM parameters"
rhashtable:
clear stale iter->p on table restart
RISC-V:
KVM: Serialize virtual interrupt pending state updates
riscv:
hwprobe: Avoid uninitialized read in hwprobe_get_cpus()
rtase:
Workaround for TX hang caused by hardware packet parsing
rust:
allow `clippy::unwrap_or_default` globally
rust:
allow `suspicious_runtime_symbol_definitions` lint for Rust >= 1.98
rust:
device: avoid trailing ; in printing macros
rust:
time: fix as_micros_ceil() to round correctly for negative Delta
rust_binder:
only print failure if error has source
rxrpc:
fix io_thread race in rxrpc_wake_up_io_thread()
s390/checksum:
Fix csum_partial() without vector facility
s390/ptff:
Export ptff_function_mask[]
sched/ext:
Avoid null ptr traversal when ->put_prev_task() is called with NULL next
sched_ext:
Don't warn on core-sched forced idle in put_prev_task_scx()
scsi:
core: wake eh reliably when using scsi_schedule_eh
sctp:
auth: verify auth requirement when auth_chunk is NULL
sctp:
avoid auth_enable sysctl UAF during netns teardown
sctp:
close UDP tunnel sockets during netns teardown
sctp:
don't free the ASCONF's own transport in DEL-IP processing
sctp:
fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid
sctp:
fix auth_hmacs array size in struct sctp_cookie
sctp:
validate stream count in sctp_process_strreset_inreq()
selftests/alsa:
Fix memory leak in find_controls error path
selftests/bpf:
Add tests for ld_{abs,ind} failure path in subprogs
selftests/bpf:
Adjust verifier_map_ptr for the map's excl field
selftests/bpf:
Keep verifier_map_ptr exercising ops pointer access
selftests/net:
ovpn: fix getaddrinfo memory leak in ovpn_parse_remote()
selftests:
af_unix: add USER_NS config
selftests:
drv-net: increase timeout
selftests:
ntsync: correct CONFIG_NTSYNC name
selftests:
openvswitch: add config file
selftests:
ovpn: add IPV6 and VETH configs
selftests:
ovpn: increase timeout
seqlock:
Allow KASAN to fail optimizing
seqlock:
Allow UBSAN_ALIGNMENT to fail optimizing
seqlock:
Cure some more scoped_seqlock() optimization fails
serial:
8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms
serial:
sc16is7xx: implement gpio get_direction() callback
smb/client:
handle overlapping allocated ranges in fallocate
smb:
client: handle STATUS_STOPPED_ON_SYMLINK responses without a symlink target
smb:
client: validate DFS referral PathConsumed
soreuseport:
Clear sk_reuseport_cb before failure in sk_clone().
staging:
rtl8723bs: fix inverted HT40 secondary channel offset
staging:
rtl8723bs: fix OOB reads in rtw_get_wps_ie()
SUNRPC:
Add helpers to convert xdr_buf byte ranges to scatterlists
sunrpc:
allocate a separate bvec array for socket sends
SUNRPC:
Return an error from xdr_buf_to_bvec() on overflow
super:
fix emergency thaw deadlock on frozen block devices
tcp:
challenge ACK for non-exact RST in SYN-RECEIVED
tcp:
fix TIME_WAIT socket reference leak on PSP policy failure
tcp:
initialize standalone TCP-AO response padding
tipc:
clear sock->sk on the failed-insert path in tipc_sk_create()
tipc:
fix infinite loop in __tipc_nl_compat_dumpit
tipc:
fix u16 MTU truncation in media and bearer MTU validation
tls:
device: push pending open record on splice EOF
tracing/eprobe:
Fix exact system name matching in eprobe_dyn_event_match()
tracing/probes:
Avoid temporary buffer truncation in trace_probe_match_command_args()
tracing/probes:
Fix potential underflow in LEN_OR_ZERO macro
tracing/probes:
Prevent out-of-bounds write in __trace_probe_log_err()
tracing:
Fix context switch counter truncation
tracing:
Fix mmiotrace possible NULL dereferencing of hiter->dev
tracing:
Fix resource leak on mmiotrace trace_pipe close
tracing:
Fix union collision of module and refcnt for dynamic events
ublk:
wait on ublk_dev_ready() instead of ub->completion
udmabuf:
Ensure to perform cache synchronisation in begin_cpu_udmabuf()
uio_hv_generic:
Bind to FCopy device by default
usb:
atm: ueagle-atm: reject descriptors that confuse probe and disconnect
usb:
chipidea: fix usage_count leak when autosuspend_delay is negative
usb:
core: port: Deattach Type-C connector on component unbind
usb:
core: sysfs: add lock to bos_descriptors_read()
usb:
gadget: dummy_hcd: prevent fifo_req reuse during giveback
usb:
gadget: f_midi: cancel pending IN work before freeing the midi object
usb:
gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb()
usb:
gadget: f_tcm: synchronize delayed set_alt with teardown
USB:
gadget: fsl-udc: fix dev_printk() device
USB:
gadget: fsl-udc: fix device name leak on probe failure
usb:
gadget: printer: fix infinite loop in printer_read()
USB:
gadget: snps-udc: fix device name leak on probe failure
usb:
gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown
usb:
gadget: uvc: clamp SEND_RESPONSE length to the response buffer
usb:
musb: omap2430: Do not put borrowed of_node in probe
USB:
serial: ftdi_sio: add support for E+H FXA291
USB:
serial: io_edgeport: cap received transmit credits
USB:
serial: keyspan_pda: fix data loss on receive throttling
USB:
serial: option: add TDTECH MT5710-CN
USB:
storage: add NO_ATA_1X quirk for Longmai USB Key
usb:
typec: ucsi: Add duplicate detection to nvidia registration path
usb:
typec: ucsi: Detect and skip duplicate altmodes from buggy firmware
usb:
xhci-pci: Limit VIA VL805 DMA addressing to 36 bits
VDUSE:
avoid leaking information to userspace
vduse:
remove unused vaddr parameter of vduse_domain_free_coherent
vduse:
return internal vq group struct as map token
vduse:
take out allocations from vduse_dev_alloc_coherent
vhost-net:
fix TX stall when vhost owns virtio-net header
vmxnet3:
fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets
vsock/virtio:
collapse receive queue under memory pressure
vxlan:
mdb: Fix source list corruption on a failed replace
vxlan:
require CAP_NET_ADMIN in the device netns for changelink
wan:
wanxl: Only reset hardware after BAR mapping
watchdog:
airoha: Prevent division by zero when clock frequency is zero
watchdog:
pretimeout: Fix UAF in watchdog_unregister_governor()
watchdog:
s32g_wdt: remove incorrect options in watchdog_info struct
wifi:
at76c50x-usb: avoid length underflow in at76_guess_freq()
wifi:
ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin
wifi:
ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get()
wifi:
ath11k: fix refcount leak in ath11k_ahb_fw_resources_init()
wifi:
ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET
wifi:
ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET
wifi:
ath6kl: fix OOB access from firmware ADDBA window size
wifi:
ath6kl: fix OOB read from firmware IE lengths in connect event
wifi:
ath6kl: fix OOB read from firmware num_msg in TX complete handler
wifi:
ath6kl: fix use-after-free in aggr_reset_state()
wifi:
ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request
wifi:
brcmfmac: fix 802.1X-SHA256 call trace warning
wifi:
brcmfmac: initialize SDIO data work before cleanup
wifi:
brcmfmac: make release_scratchbuffers idempotent
wifi:
brcmfmac: set F2 blocksize to 256 for BCM43752
wifi:
carl9170: bound memcpy length in cmd callback to prevent OOB read
wifi:
carl9170: fix buffer overflow in rx_stream failover path
wifi:
carl9170: fix OOB read from off-by-two in TX status handler
wifi:
cfg80211: bound element ID read when checking non-inheritance
wifi:
cfg80211: cancel sched scan results work on unregister
wifi:
cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock
wifi:
cfg80211: derive S1G beacon TSF from S1G fields
wifi:
cfg80211: Fix an error handling path in cfg80211_wext_siwscan()
wifi:
cfg80211: reject unsupported PMSR FTM location requests
wifi:
cfg80211: validate PMSR FTM preamble range
wifi:
cfg80211: validate PMSR measurement type data
wifi:
ipw2100: fix potential memory leak in ipw2100_pci_init_one()
wifi:
iwlwifi: fix pointer arithmetic in iwl_add_mcc_to_tas_block_list
wifi:
iwlwifi: mvm: fix read in wake packet notification handler
wifi:
iwlwifi: mvm: validate SAR GEO response payload size
wifi:
iwlwifi: validate payload length in iwl_pnvm_complete_fn
wifi:
libertas: fix memory leak in helper_firmware_cb()
wifi:
mac80211: avoid non-S1G AID fallback for S1G assoc
wifi:
mac80211: defer link RX stats percpu free to RCU
wifi:
mac80211: fix fils_discovery double free on alloc failure
wifi:
mac80211: fix unsol_bcast_probe_resp double free on alloc failure
wifi:
mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock
wifi:
mac80211: recalculate TIM when a station enters power save
wifi:
mac80211: tear down new links on vif update error path
wifi:
mac80211_hwsim: clamp virtio RX length before skb_put
wifi:
mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv()
wifi:
mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses
wifi:
mt76: mt7915: guard HE capability lookups
wifi:
mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses
wifi:
mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses
wifi:
mt76: mt7925: fix crash in reset link replay
wifi:
mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv()
wifi:
mt76: mt7925: guard link STA in decap offload
wifi:
mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap()
wifi:
mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht()
wifi:
mwifiex: bound uAP association event IEs to the event buffer
wifi:
mwifiex: fix freeze for 60 seconds caused by request_firmware
wifi:
mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper
wifi:
nl80211: constrain MBSSID TX link ID range
wifi:
nl80211: free RNR data on MBSSID mismatch
wifi:
nl80211: validate nested MBSSID IE blobs
wifi:
p54: validate RX frame length in p54_rx_eeprom_readback()
wifi:
wilc1000: validate assoc response length before subtracting header
x86,fs/resctrl:
Rename some L3 specific functions
x86,fs/resctrl:
Rename struct rdt_mon_domain and rdt_hw_mon_domain
x86/boot/compressed:
Disable jump tables
xfrm6:
clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()
xfrm:
clear mode callbacks after failed mode setup
xfrm:
fix stale skb->prev after async crypto steals a GSO segment
xfrm:
iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags()
xfrm:
policy: preallocate inexact bins before xfrm_hash_rebuild reinsert
xfrm:
propagate -EINPROGRESS from validate_xmit_xfrm()
xfrm:
reject optional IPTFS templates in outbound policies
xfs:
don't replace the wrong part of the cow fork
xprtrdma:
Clear receive-side ownership pointers on release