Changelog in Linux kernel 6.18.63

fault-inject: fix dentry leak

fbdev: atmel_lcdfb: fix list_first_entry() on possibly empty modelist in probe

fbdev: bitblit: Fix glyph clipping when fbcon pans

fbdev: kyro: Release WC setup on registration failure

fbdev: sh_mobile_lcdc: check for fb_deferred_io_init() error

fbdev: smscufx: check for fb_deferred_io_init() error

fbdev: ssd1307fb: check for fb_deferred_io_init() error

fbdev: udlfb: check for fb_deferred_io_init() error

fbdev: xen-fbfront: check for fb_deferred_io_init() error

firewire: core: fix source bus ID detection for AT context in big-endian systems

floppy: don't store a stack buffer in timeout_message

floppy: return the drive state flags from the 32-bit FDGETDRVSTAT

fork: honor task_struct's declared alignment

fpga: Fix of_fpga_mgr_get() reference in fpga_mgr_lock() docs

fs/ntfs3: bound CreateAttribute asize against record_size in do_action

fs/ntfs3: bound DeleteAttribute asize against rec->used in do_action

fs/ntfs3: fix integer overflow in find_log_rec() causing OOB read

fs: don't fail __d_obtain_alias() for unlinked inodes

fs: let backing files inherit FMODE_NONOTIFY from the user file

fs: make sure to call fsnotify_inoderemove() only once when inode is dead

fs: skip copy_file_range write limits when there is no data

fs_pin: publish pins with RCU list helpers

fscrypt: Fix missing barrier in fscrypt_find_mode_key()

fsverity: Be more careful with return value of ->get_verity_descriptor()

fsverity: hoist statx reporting of fs-verity flag

fuse: don't drop destination page cache on a zero byte copy reply

fuse: don't launder folios of a bad inode

fuse: fix copy_file_range reply handling race

genirq/kexec: Do not take the bus lock of an interrupt chip on the crash path

gfs2: fix the escaped block copy in gfs2_before_commit()

gpio: davinci: Clear interrupt status in every bank on suspend

gpio: pca953x: Handle direction register read errors in IRQ paths

gpiolib: cdev: don't set GPIOD_FLAG_IS_OUT

gpiolib: don't report -ENOMEM for a requested line without a label

gpiolib: Free chip resources when allocating the label fails

gve: fix out-of-bounds read in gve_get_flow_rule_entry()

hte: tegra194-test: shut down timer before GPIO release

hte: tegra194: Initialize slice locks before registering chip

hwmon: (acpi_power_meter) Fix 18.45 TW bug

hwmon: (coretemp) Fix handling of isolated SMT siblings

hwmon: (coretemp) Refresh the temperature on the first read

hwmon: (corsair-cpro) Make wait_input_report_lock IRQ safe

hwmon: (gigabyte_waterforce) reject short input reports

hwmon: (lm95245) Fix negative temperature conversion

hwmon: (sht3x) Return the consumed count for heater writes

hwmon: (sht4x) Fix jiffies wraparound in heater-ready check

hwmon: (sht4x) Reject incomplete heater command transfers

hwrng: amd - report partial reads in non-blocking mode

hwrng: ba431 - fix reported byte count

hwrng: core - reject unknown RNG names

i2c: acpi: Fix adapter reference leak in i2c_acpi_new_device_by_fwnode()

i2c: designware: queue only one read command for block reads

i2c: mt7621: fix copying uninitialized kernel stack with reduced page_len

i3c: master: adi: free the IRQ before unregistering the master

i3c: master: Fix out-of-bounds read in DMA bounce buffer setup

i3c: mipi-i3c-hci: Bounce short reads irrespective of the IOMMU

IB/hfi1: Shutdown self-rearming timers before freeing

iio: accel: adis16201: fix channel order for buffer mode

iio: accel: adxl313: reject devices without match data

iio: accel: adxl380: reject devices without match data

iio: accel: kxcjk-1013: Disable autosuspend on remove

iio: accel: mma9551: disable autosuspend on remove

iio: accel: mma9553: disable autosuspend on remove

iio: adc: ad7606: reject devices without match data

iio: adc: at91-sama5d2: disable autosuspend on remove

iio: adc: max11205: reject devices without match data

iio: adc: mcp3911: reject devices without match data

iio: adc: stm32: fix minimum sampling time values

iio: adc: ti-adc128s052: validate SPI match data

iio: adc: ti-ads1100: Fix incorrect reading when datarate changed in single mode

iio: dac: ad5755: validate SPI match data

iio: frequency: adf4377: reject devices without match data

iio: imu: adis16400: validate SPI match data

iio: imu: inv_icm42600: fix odr change not caught in certain cases

iio: imu: inv_icm42600: force accel odr change when switching power mode

iio: light: apds9306: fix default sampling frequency definition

iio: potentiometer: x9250: reject devices without match data

iio: pressure: bmp280: validate SPI match data

inet: reject unhashed sockets during established lookups

init/bootconfig: pass init arguments in documented order

init: fix early boot crash with bare hostname parameter

Input: always accept EV_SYN in input_event()

Input: xpad - add GameSir Nova Lite support

iomap: don't lose a fiemap iteration error when emitting the last extent

iommu/amd: Don't allocate kdump device table from DMA32

iommu/amd: Program device table when kdump reuse fails

iommu/dma: Catch scatterlist length overflows

iommu/vt-d: Avoid out-of-range shift in qi_desc_dev_iotlb_pasid()

iommufd: Reject a zero-length dirty bitmap request

iov_iter: fix NULL deref in iov_iter_alignment()

ipc, msg: Account msg_msg allocations with GFP_KERNEL_ACCOUNT again

ipc/mqueue: release notification resources during inode eviction

ipc/shm: fix RSS accounting for hugetlb shared memory

ipmr: fully initialize the synthetic IP header in ipmr_get_route()

ipv6: defrag: orphan skb before queuing

ipv6: do not restart DAD for a dead ifaddr

ipv6: initialize temporary ifaddr before publication

ipv6: remove ifaddr from hash during ifdown list cleanup

ipv6: serialize address publication with device teardown

irqchip/atmel-aic[5]: Disable interrupts in the irq_pm_shutdown() callbacks

irqchip/gic-v3-its: Don't clamp nvecs to zero when id_bits is 32

irqchip/imx-intmux: Fix runtime PM teardown on remove

irqchip/irq-msi-lib: Free wired MSI descriptors

irqchip/mchp-eic: Fix clock reference leak in mchp_eic_probe()

irqchip/riscv-imsic: Report successful hardware retrigger

isofs: fix Rock Ridge CE extent validation on multisession media

ixgbe: reserve TX timestamp after skb preparation

jbd2: don't advance j_fc_off before the buffer is recorded

kbuild: AutoFDO: Update split machine function argument for upstream rename

kgdb: Fix buffer overflow in the 'M' and 'X' packet handlers

kgdb: Fix buffer overflow in the 'm' packet handler

kgdb: Fix buffer overflow in the qRcmd packet handler

kobject: fix out-of-bounds access in kobject_action_type()

KVM: arm64: Fix MMFR0 TGRAN advertisement for pVMs

KVM: arm64: Move IN_GUEST_MODE ahead of state being loaded

KVM: arm64: Move OUTSIDE_GUEST_MODE publication past context being saved

KVM: arm64: Set HCR_EL2.BSU to Inner Shareable for guests

KVM: arm64: Turn vcpu->arch.pause into a counter

KVM: arm64: Validate the host vCPU's VM before reading it under pKVM

KVM: arm64: vgic-v3: Roll back assignments from the new region

KVM: arm64: vgic-v3: Undo assignment on iodev registration failure

KVM: guest_memfd: Gracefully handle xarray errors when binding a memslot

KVM: VMX: Formally define KVM's "0xdead" exit reason used for failed VM-Enter

leds: ktd2692: Pass context to regulator cleanup

lib/842: reject output overflows from index and short data

lib/842: require a complete history block for repeat templates

lib/buildid: reject file offsets that do not fit in pgoff_t

lib/decompress_bunzip2: fix off-by-one in run-length bounds check

lib/plist: fix plist_requeue() corrupting order in the last bucket

lib: decompress_bunzip2: fix integer overflow in run-length decoding

libceph: Fix multiple unsafe decodes in ceph_oloc_decode()

libceph: fix out-of-bounds reads from repeated CRUSH bucket entries

libceph: Fix unsafe decode in ceph_redirect_decode()

libceph: only set read_from_replica on read requests

libceph: reject an initial monmap with no monitors

libceph: reject mismatched CRUSH weight-set sizes

Linux: Linux 6.18.63

listmount: don't wrap around with a U64_MAX cursor

LoongArch: Call cpu_final_simd() with pure_initcall()

LoongArch: Fix architectural naming typo for CSR_FWPS_SKIP

LoongArch: Fix bitmask corruption in update_bp_registers()

LoongArch: Fix perf hardware breakpoint failure via installation

LoongArch: Only send SIGTRAP signal if necessary in do_watch()

LoongArch: Remove arch-specific __smp_mb__{before,after}_atomic()

LoongArch: Remove redundant call in update_bp_registers()

LoongArch: Use pa_to_nid()/nid_to_addrbase() rather than hard-code

loop: check for read-write open mode on LOOP_SET_STATUS in lo_compat_ioctl()

m68k: dmasound: Keep the Q40 IRQ handler registered

macvlan: fix passthru promiscuity accounting while down

mailbox: altera: shut down RX polling timer on channel teardown

mailbox: bcm74110: Cap rx_svc_init_list growth to prevent PMC-induced OOM

mailbox: mtk-cmdq: Fix runtime PM leak in cmdq_mbox_flush()

mailbox: qcom-ipcc: Guard against NULL con_priv in send_data()

md/raid5: fix NULL pointer dereference in raid5_free_percpu

md/raid5: track disks array size to fix extra_page leak on error paths

md/raid5: validate payload size before calculating payload_len

md: don't hand out the array before md_alloc() has added mddev->kobj

md: validate bblog_size when loading v1.x badblocks metadata

media: adv7180: Initialize mutex before ancillary clients

media: adv7604: avoid negative array index in log_status when cp_read fails

media: amphion: drain message work before releasing core state

media: amphion: fix runtime PM imbalance on probe failure

media: amphion: prevent unbind while video instances are open

media: atmel-isi: release unregistered video device on remove

media: au0828: Fix media device leak in au0828_usb_probe()

media: au0828: Free URBs when starting DVB streaming fails

media: cec: extron: clear response tail before dispatch

media: chips-media: wave5: Balance runtime PM on encoder close errors

media: chips-media: wave5: Check decoder qbuf runtime resume

media: chips-media: wave5: Handle polling IRQ thread failure

media: cx18: Disable PCI device on probe failure

media: cx231xx-audio: drain wq_trigger before audio fini

media: cx231xx: Fix cleanup path on failure

media: cx231xx: preserve I2C transfer length

media: em28xx: fix double free in em28xx_alloc_urbs

media: ene_ir: Ensure teardown is done in the correct order

media: exynos4-is: Fix a race between s_stream(0) and the interrupt handler

media: go7007: bound EZ-USB I2C transfers to the usb_buf size

media: go7007: unregister the I2C adapter on USB probe failure

media: hantro: disable runtime PM before hardware teardown

media: hantro: Harden MPEG-2 control access against NULL

media: i2c: alvium-csi2: balance runtime PM usage count on remove

media: i2c: ov2735: fix power cleanup on remove

media: i2c: ov8856 : remove ACPI node bypass mechanism

media: i2c: ov8856: fix debug message to report actual CSI-2 lane count

media: i2c: tc358743: add missing color-space strings

media: imagination: Fix value clamping in calculate_qp_tables

media: imx-jpeg: finish the job on device_run() error paths

media: ir-hix5hd2: Ensure rdev is setup before interrupts are enabled

media: ir_toy: Validate the maximum tx carrier

media: iris: Fix bus_info prefix in VIDIOC_QUERYCAP

media: iris: Fix frame interval enumeration for non-divisor framerates

media: m2m-deinterlace: fix default capture field

media: marvell-cam: fix unmet dependency for VIDEO_MMP_CAMERA

media: marvell: manage the MMP camera clock provider

media: mediatek: jpeg: retry HW selection after successful wait

media: mediatek: vcodec: destroy core workqueue on remove

media: mediatek: vpu: free IRQ before destroying watchdog workqueue

media: mediatek: vpu: release reserved memory on remove

media: meson-ir-tx: Ensure clock is disabled on unbind

media: meson-ir-tx: Ensure probe error is propagated

media: meson-ir-tx: Ensure rc_free_device() is called on unbind

media: meson-ir-tx: Prevent divide by zero in meson_irtx_prepare_pulse()

media: meson: vdec: size capture planes from the aligned canvas

media: microchip-isc: disable histogram and flush AWB work on teardown

media: microchip-isc: do not touch WB registers when not streaming

media: microchip-isc: don't sleep in the clk .is_enabled callback

media: microchip-isc: fix awb_mutex and lock lifecycle

media: microchip-isc: fix PM runtime leak in AWB work handler

media: microchip-isc: synchronize the IRQ before disabling clocks on stop

media: mtk-jpeg: Fix runtime PM leak in mtk_jpegdec_worker()

media: mtk-jpeg: Fix runtime PM leak in mtk_jpegenc_worker()

media: nuvoton: npcm-video: quiesce VCD IRQ before teardown

media: platform: mtk-mdp3: Fix device reference leak in mdp_comp_init()

media: pvrusb2: Fix USB parent device leak in class_dev_create()

media: qcom: camss: Add "gcc_axi_hf" to 8775p VFE lite clock lists

media: qcom: camss: vfe-17x: Fix write master buffer done being dropped

media: qcom: camss: vfe-17x: Fix write master selection for RDI lines

media: qcom: camss: vfe: Fix VFE reset while another line is streaming

media: redrat3: Ensure all urbs are suspended

media: redrat3: Ensure we don't read beyond the end of the packet

media: rtl28xxu: fix SDR platform device leak

media: saa7146: Initialize interrupt lock before requesting IRQ

media: serial_ir: Fix race condition where timer can be re-armed

media: sti: delta: use unaligned accessors for MJPEG SOF fields

media: stm32: csi: correct remote pad retrieval

media: stm32: csi: unregister async notifier on cleanup

media: streamzap: Add missing rc_unregister_device()

media: stv0900: bound DiSEqC reply length to msg[] size

media: stv090x: bound DiSEqC reply length to msg[] size

media: sunxi-cir: Ensure no more interrupts can occur before free

media: synopsys: hdmirx: fetch colordepth before calculating pixelclock

media: synopsys: hdmirx: use request_any_context_irq() for 5V detection IRQ

media: tw686x: fix V4L2 device lifetime on probe failure

media: tw68: balance PCI enable on cleanup

media: uvcvideo: Fix NULL deref on events for uninitialized controls

media: v4l2-common: Fix P010 format info

media: v4l2-ctrls: do nothing if controls[0] == NULL in cluster functions

media: venus: Fix iova allocation from restrict region

media: verisilicon: rockchip: Fix leaks in init

media: vicodec: fix NULL deref on oversized frame

media: vicodec: fix out-of-bounds write on under-rounded coded dimensions

media: vicodec: make encoder CAPTURE dimensions read-only

media: vicodec: zero-initialize stateful decoder heap buffers

media: vidtv: fix frontend reference leak on unbind

media: vidtv: fix uaf in vidtv_bridge_on_new_pkts_avail

media: vim2m: keep transaction buffer count stable while streaming

media: vivid: cancel svid ctrl work on release

media: vivid: round the height down to the vertical subsampling factor

media: vpif_capture: Fix i2c adapter reference leak in vpif_probe()

media: vpif_display: Fix i2c adapter reference leak in vpif_probe()

mei: vsc: Fix packet CRC computed over pointer size

memory: brcmstb_dpfe: Bounds check DCPU-supplied MSG_ARG_COUNT

memory: brcmstb_dpfe: Fix out-of-bounds access due to DCPU offset

memory: renesas-rpc-if: Mark XSPI_CDD1BUF0 as volatile

memory: stm32_omm: fix child clock leak on set_amcr() error path

mfd: da903x: Cancel IRQ work during teardown

mfd: Fix MAX77705 dependency on regmap

mfd: tps65217: Check return value when masking interrupt sources

mfd: tps65217: Fix NULL pointer dereference on IRQ init failure

mfd: tps65217: Use devres for IRQ domain and wake teardown

mfd: wcd934x: Fix NULL pointer dereference on IRQ probe deferral

mfd: wcd934x: set DMA mask on parent to silence "DMA mask not set"

microblaze: don't clobber r3/r4 restored by rt_sigreturn

microblaze: Fix MB_MANAGER build with older binutils

microblaze: preserve the MSR carry flags across signals

microblaze: reserve the ABI argument-home area in the signal frame

microblaze: restore the ABI argument home area below pt_regs (PTO)

MIPS: mm: align hugetlb mappings in arch_get_unmapped_area()

MIPS: mm: do not write a huge TLB entry when the probe misses

mm/alloc_tag: account for reserved tag ids in the kernel tag check

mm/damon/core: charge only the part of a region the filter left

mm/damon/core: handle extreme memory state in damon_get_node_mem_bp()

mm/damon/paddr: respect folio end for DAMOS actions except STAT

mm/damon/paddr: respect folio end for DAMOS_STAT

mm/damon/sysfs-schemes: read sysfs_filter->addr_range only once

mm/damon/sysfs: set next refresh jiffies per sysfs context

mm/damon/vaddr: respect folio end for DAMOS_STAT

mm/execmem: free ROX cache chunks only when they span an entire vm area

mm/hugetlb: account migration target folio in per-node NR_HUGETLB vmstat

mm/hugetlb: don't clear the resv_map of a VMA whose lock is held

mm/hugetlb: fix subpool minimum reservation rollback

mm/hugetlb_cgroup: move per-node usage on cgroup reparenting

mm/hugetlb_cgroup: move per-node usage on cross node migration

mm/ksm: mark migration stores with WRITE_ONCE()

mm/madvise: add cond_resched() in THP branch of madvise_cold_or_pageout_pte_range()

mm/madvise: atomically clear the young bit on THP MADV_COLD

mm/madvise: reclaim isolated folios if PTE restart fails

mm/madvise: use folio_trylock() in the cold/pageout PMD split

mm/memory: constrain generic_access_phys() to page boundary

mm/mempolicy: apply bind policies against the scoped allocation zone

mm/mempolicy: take a cpuset cookie for the interleave node count

mm/mlock: use a long for the page count in mlock_fixup()

mm/mremap: correctly uncharge accountable VMAs in error path

mm/mremap: fix calling fixup_hugetlb_reservations() on the wrong VMA

mm/mremap: populate calculated fields in vrm state correctly

mm/nommu: reject wrapping ranges in access_remote_vm()

mm/page_alloc: count guard pages as free again when their buddy merges

mm/page_alloc: do not boost watermarks in kdump capture kernels

mm/page_isolation: fix UBSAN shift-out-of-bounds warning

mm/page_isolation: guard compound_order() against racing

mm/page_table_check: skip zero pages

mm/percpu: account full object size for percpu memory allocations

mm/shmem: report RCU-tasks quiescent states while undoing a range

mm/swap: fix swap_cache_get_folio() returning a folio that left the swap cache

mm/truncate: fix the zeroing end of pagecache_isize_extended()

mm/truncate: look up the end-edge straddler by index

mm/vmscan: reclaim every zone in per-node proactive reclaim

mm/zswap: enable zswap_ever_enabled in zswap_pool_create()

mm/zswap: publish the initial pool with list_add_rcu()

mm: disallow ioremap'ing ordinary RAM in generic_access_phys()

mm: khugepaged: fix swap entry value to folio_pfn()

mm: memcontrol: raise MEMCG_MAX for charges that fail without reclaiming

mm: multi-gen LRU: fix NULL lruvec->pgdat deref with memcg disabled on cmdline

mm: vmscan: don't count per-node proactive reclaim as memory pressure

mount: refuse setns() with a shared fs_struct again

mptcp: fix subflow bitfield misuse

mptcp: hold MP_JOIN msk ref when cloning reqsk

mptcp: reset msk state on early connect failure

mtd: amd76xrom: Fix PCI device reference leak in amd76xrom_init_one()

mtd: Call get_wunit() on the master partition

mtd: cfi_cmdset_0002: cap the write-buffer chunk at 256 bytes on an x8 device

mtd: maps: l440gx: Fix double put of the ISA bridge in init_l440gx()

mtd: maps: l440gx: Fix double put of the PM device in init_l440gx()

mtd: maps: pci: balance PCI enable on cleanup

mtd: mtdsuper: Fix MTD device reference leak in mtd_get_sb()

mtd: parsers: qcom: fix offset/size overflow on large partitions

mtd: rawnand: atmel: Fix MCK clock leak in atmel_nand_controller_init()

mtd: rawnand: nuvoton: fix clock cleanup on probe failure

mtd: rawnand: qcom: fix read location register usage in config_nand_cw_read()

mtd: rawnand: sunxi: reject ECC maximization on small pages

mtd: spi-nor: sfdp: check the length of the SCCR map

mtd: spi-nor: sfdp: check the length of the xSPI Profile 1.0 table

mtd: spi-nor: Unprepare legacy controllers upon RWW wait interruption

net/packet: check TX_RING fragments before memory accounting

net/rds: ib: don't enable IRQs in rds_ib_conn_free()

net/smc: queue the copied chunk when smc_tx_sendmsg() faults

net: gro: don't chain linear parts larger than gso_size into frag_list

net: hisilicon: hisi_femac: Stop the receiver before releasing the RX ring

net: limit priority VLAN untag depth

net: skbuff: don't BUG() on a bad csum_start in skb_copy_and_csum_dev()

net: unix: reject negative max_dgram_qlen values

net: usb: pegasus: check rx pkt_len against the received length

net: wwan: iosm: validate msg_head before indexing msg_ring

netdevsim: reject cls_bpf programs bound to another device

netfilter: ctnetlink: fix inverted IPv6 address match in dump filter

netfilter: nf_reject: initialize IPCB at inet ingress

nilfs2: clear dirty flag on bdev buffers on log write failure

nilfs2: fix checkpoint root lifetime on sysfs errors

nilfs2: fix deadlock between nilfs_evict_inode() and find_inode()

nilfs2: force clear dirty state when restoring from the shadow map

nilfs2: ignore non-fatal signals during synchronous log write wait

nilfs2: validate directory position after llseek in readdir

ntfs3: bound index head insertions by buffer capacity

ntfs3: fix mapping pairs bounds check for alignment

nvme-auth: fail when the controller does not authenticate itself

nvme-rdma: don't complete a request after a bogus remote invalidation

nvme-tcp: fix io_work priority inversion when send_mutex is held

nvme-tcp: start error recovery when read_sock fails

nvme: bound FDP config log reads to the received buffer

nvme: make the DH-HMAC-CHAP secret attributes readable by root only

nvmet-auth: fix error handling on CHALLENGE failure

nvmet-auth: serialize access to DH-HMAC-CHAP state to fix UAF

nvmet-fc: only send read data for successful commands

nvmet-fc: Tear down the association when the admin queue allocation fails

nvmet-rdma: reject short connection requests

nvmet: Finish the blk plug when integrity allocation fails

nvmet: fix preempt of another registrant by the reservation holder

nvmet: free the bvec on file namespace range errors

nvmet: Free the old negotiation state when restarting authentication

nvmet: pci-epf: report transport errors in command completions

nvmet: pci-epf: require SGLs to match the command data length

nvmet: replace use of system_wq with system_percpu_wq

nvmet: require authentication before property set

nvmet: take subsys->lock while force-reconnecting in nvmet_subsys_attr_qid_max_store()

nvmet: zns: don't leak stale memory in zone management receive

ocfs2/cluster: initialize heartbeat regions before publishing them

ocfs2/cluster: remove zero-address nodes from IP tree on teardown

ocfs2: deal with legacy signed dir index name hash values

ocfs2: deal with legacy signed xattr name hash values

ocfs2: exit recovery thread on mount error path

ocfs2: free replay slots in ocfs2_recovery_exit()

ocfs2: read the xattr entry hash before defragmenting the bucket

ocfs2: reserve metadata for a new xattr block and its value tree

ocfs2: reserve value tree metadata when moving an xattr into the inode

ocfs2: restrict OCFS2_INVALID_SLOT suballoc slot to system inodes

ocfs2: skip uninitialized lockres in ocfs2_mark_lockres_freeing()

ocfs2: snapshot the dentry name while tracing file release

ocfs2: use the stored hash when checking xattr bucket collision

panic: flatten nmi_panic control flow

parisc: eisa_enumerator: Fix out-of-bounds reads of the EEPROM buffer

PCI/AER: Fix memory leak in aer_recover_queue() on kfifo buffer overflow

PCI/DOE: Fix double free of a duplicate feature's sysfs name

PCI/PM: Restore BARs after powering up during enumeration

PCI/sysfs: Pass the device name length in UTF-16 code units

PCI: Avoid D3 on PLX PEX 8532/8533/8548 downstream ports

PCI: Disable MSI for ULi M1575 EHCI controller

PCI: pciehp: Make 'pciehp_poll_mode' parameter read-only

PCI: qcom-ep: Deinitialize endpoint on remove

PCI: rockchip-ep: Do not attempt 5.0 GT/s retraining

PCI: rockchip-host: Do not attempt 5.0 GT/s retraining

PCI: rockchip: Drive at 2.5 GT/s, error other speeds

PCI: Set supported_speeds in set_pcie_port_type()

PCI: Skip Target Speed quirk on clamped ports with no link

PCI: xilinx-xdma: Fix device node reference leak in xilinx_pl_dma_pcie_init_irq_domain()

peci: aspeed: Initialize state before requesting IRQ

peci: npcm: Initialize state before requesting IRQ

perf loongarch: Fix discarded const qualifier in _get_field()

perf machine: Fix NULL deref in thread__resolve_callchain_sample()

perf powerpc-vpadtl: Fix off-by-one in auxtrace_info minimum size check

perf: xgene: initialize lock before requesting IRQ

pinctrl: stm32: Fix fwnode reference leak in stm32_gpiolib_register_bank()

platform/x86/amd/pmc: Fix RTC reference leak in amd_pmc_verify_czn_rtc()

platform/x86/amd/pmf: Fix power_supply refcount leak in amd_pmf_get_battery_prop()

platform/x86/amd/pmf: Validate the APTS state index

platform/x86/amd: hfi: Fix out-of-bounds reads when parsing ranking data

platform/x86/amd: Stop counting intermediate cycles with metrics table

platform/x86/intel-uncore-freq: Continue restoring limits on resume

platform/x86/intel/pmt: Block mmap when callback is present

platform/x86/intel/vsec: Fix inverted walk_header() test in get_features()

platform/x86/tuxedo: Fix keyboard LED map ordering

platform/x86: asus-wmi: fix screenpad power state detection

platform/x86: asus-wmi: fix TUF keyboard power state shutdown naming

platform/x86: asus-wmi: fix unclear usage of bd->props.power

platform/x86: hp-bioscfg: allow clearing current_password

platform/x86: hp-bioscfg: fix 16-byte heap overflow for empty auth token

platform/x86: hp-bioscfg: fix non-ASCII truncation in hp_get_string_from_buffer()

platform/x86: hp-bioscfg: fix OOB reads in hp_get_string_from_buffer()

platform/x86: hp-bioscfg: fix slab-out-of-bounds write in hp_convert_hexstr_to_str()

platform/x86: hp-bioscfg: NUL-terminate the SPM auth token

platform/x86: hp-bioscfg: return -E2BIG from validate_password_input()

platform/x86: hp-wmi: fix heap OOB read and memory corruption in hp_wmi_perform_query()

platform/x86: int3472: Fix uninitialised variable warning

platform/x86: oxpec: Fix Apex charge limit control

platform/x86: simatic-ipc: fix platform device leak on registration failure

PM: CPU: Restore synchronize_rcu() to cpu_pm_unregister_notifier()

posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() signal path

power: supply: ab8500_fg: Accept status from supplied power

power: supply: ab8500_fg: Report sub-percent charge changes

power: supply: bq27xxx: Ensure poll work is cancelled on remove

power: supply: bq27xxx: synchronize work cancellation on suspend

power: supply: core: Honor supplied-from with CONFIG_OF=y

power: supply: cros_charge-control: restore EC state on resume

power: supply: generic-adc-battery: fix status with no supplier

power: supply: qcom_battmgr: Notify charger supplies of online changes

power: supply: qcom_smbx: fix float voltage selector

power: supply: qcom_smbx: include base when petting watchdog

power: supply: qcom_smbx: notify battery overvoltage recovery

power: supply: qcom_smbx: set the charge enable after software control

power: supply: qcom_smbx: test battery health status bits

power: supply: qcom_smbx: validate battery float voltage

ppp: fix stale pointer access after pskb_may_pull in ppp_ccp_peek

pps: generators: don't use the driver's info after unregister

pps: generators: stop the generator on unregister

proc: don't let an entry below /proc//net be a mountpoint

pseries/plpks: clear SED key data after use

pseries/plpks: clear sensitive PLPKS buffers

pseries/plpks: clear signed update authentication buffer

pseries/plpks: fix error handling in plpks_read_var()

pseries/plpks: validate input to plpks_signed_update_var()

pwm: tiehrpwm: Clear period on disable to allow reconfiguration

r8152: Use BMSR to detect the link state

RDS/IB: validate receive fragment completions

regulator: core: Fix c_rdev reference leak in regulator_resolve_coupling()

regulator: core: Fix coupled regulators reference leak on removal

regulator: core: Fix rdev reference leak in regulator_resolve_supply()

regulator: rt6190: Fix runtime PM imbalance in rt6190_out_enable()

remoteproc: elf_loader: Bound the section header table

resource: fix lost wakeup when waiting for a muxed region

Revert "Input: matrix_keypad - force switch rows to input mode"

Revert "net: advertise TCP MSS from the configured MTU, not the learned PMTU"

ring-buffer: Take cpus_read_lock() when changing the subbuf order

RISC-V: KVM: Fix IPI delivery for out-of-order vcpu_id

riscv: mm: exclude invalid THP PMDs from page table check

rtc: cmos: Disable ACPI RTC event before handling it

rtc: pcf8563: pass the driver data to the alarm interrupt handler

rust: bitmap: fix intra-doc link

rust: dma: declare cfi_encoding for dma_data_direction

rust: hrtimer: declare cfi_encoding for hrtimer_restart

rust: irq: declare cfi_encoding for irqreturn

sched/fair: Reset NUMA fault locality after scan period update

scsi: libiscsi_tcp: Prevent R2T range check overflow

scsi: ufs: bsg: Clear the reply buffer before use

scsi: ufs: bsg: Complete the job on error

scsi: ufs: core: Clear stale UIC result byte before peer DME retries

scsi: ufs: core: Remove an always-false WARN_ONCE()

scsi: ufs: core: Remove completed-without-interrupt path in ufshcd_abort()

sctp: hold transport reference across connect wait

seccomp: restore knotif->state when SECCOMP_ADDFD_FLAG_SEND is interrupted

selftests/core: fix unshare_test with large fs.nr_open

serial: 8250_exar: store the GPIO platform device in struct exar8250

serial: 8250_lpss: do not touch uninitialized line in ehl_serial_exit()

serial: 8250_omap: set priv->line before enabling the IRQ

serial: amba-pl011: honour delay_rts_before_send for every write

serial: amba-pl011: keep transmitter enabled when disabling RS485

serial: pmac_zilog: push received data to the port that received it

sh: intc: Sort the prio and sense lists after filling them

sh: maple: Use the matching IRQ cookie when invoking free_irq()

signalfd: don't dequeue the forced fatal signals

slimbus: messaging: fix leaked PM vote on tid allocation failure

soc: fsl: cpm1: tsa: Fix clock leak in tsa_of_parse_tdms()

soc: fsl: dpio: Fix cleanup on IRQ registration failure

soc: fsl: dpio: Free the IRQ before releasing the I/O object

soc: qcom: geni-se: Fix endian conversion for serial_protocol comparison

soc: qcom: geni-se: Fix fw_end computed before round-up; propagate size to caller

soc: qcom: geni-se: Fix write to read-only firmware buffer

soc: qcom: geni-se: Widen fw_size to u32 to prevent wrap-around

soc: samsung: exynos-pmu: fix error paths in cpuhotplug/idle states setup

speakup: Fix NULL pointer dereference on VT switch + selection

spi: amd: fix len==0 underflow and FIFO overflow

spi: amd: validate FIFO usage before executing message

spi: bcm-qspi: reject oversized dummy bytes in mspi exec_mem_op

spi: bcm2835: fix device_node reference leak in bcm2835_spi_setup()

spi: cadence-xspi: fix stack buffer overflow in the Marvell b0 path

spi: ch341: handle transfers without a TX or RX buffer

spi: jcore: fix divide-by-zero when speed_hz is zero

spi: ljca: Don't require data in write replies

spi: ljca: validate the response length before copying the data

spi: npcm-fiu: limit UMA data_size to the 16-byte staging buffer

spi: spi-qpic-snand: publish the ECC context to snandc->qspi

spi: stm32: fix double free of SRAM buffer on MDMA fallback

spi: zynq-qspi: fix address buffer corruption and support 4-byte address

splice: avoid stale f_pos writeback on error

stackdepot: stop preallocating after the final pool

staging: greybus: uart: fix racy TIOCMIWAIT implementation

staging: media: av7110: fix corrupted BER reporting in sp8870

staging: media: av7110: fix sp8870 initialization failure state

staging: media: imx: csc-scaler: fix ipu_image_convert_run leak on queue error

staging: rtl8723bs: fix protected RX frame validation in decrypt path

staging: rtl8723bs: fix RX buffer OOB write from device-reported length

staging: rtl8723bs: fix spacing around operators in rtw_recv.c

statmount: don't copy the reserved empty string past the buffer

svcrdma: Grant credits from the clamped sc_max_requests

tcp: accecn: unset ECT if receive or send ACE=0 in AccECN negotiaion

tcp: check congestion control restriction first

tcp: fix reordering addition overflow in MTU probing

tcp: limit tcp_tso_rtt_log to a valid shift count

tcp: Remove timeout arg from reqsk_timeout().

thermal: intel: int340x: Fix temperature selection around 0 C

thermal: intel: powerclamp: Reject invalid window_size values

time/namespace: Fix overflow when converting absolute deadlines

timekeeping: Update offsets on sequence counter retry in ktime_get_update_offsets_now()

timers/itimer: Keep a nonzero value at CPU timer expiry

tipc: fix broadcast sender hang on last acker departure

tmpfs: fix unicode_map leaks in casefold option handling

tpm: fix zero-length read discarding the pending response

tpm: tpm_nsc: fix NULL pointer dereference on init failure

tpm: tpm_nsc: stop using the cleanup callback as dev.release

ublk: pin module while release work is pending

ublk: reset the FETCH round in release also without a disk

ublk: reset the FETCH round under ub->mutex

ucount: take the rlimit reference before checking the limit

udf: Make sure there's enough space for LVID implementation use field

USB: cdc-acm: add VeriFone VX820 device ID

USB: cdc-acm: fix urb leak on disconnect

usb: fotg210: validate endpoint index in ep0 handlers

USB: gadgetfs: do not WARN about excessively large memory allocations

USB: quirks: add USB_QUIRK_WINDOWS_CONFIG_REQ_SIZE for GameSir G7 SE

USB: serial: option: add Rolling Wireless RN947R

USB: serial: option: add support for ASR 1286:4e3c modem

USB: serial: sierra: fix urb leak on write completion

USB: serial: usb_wwan: fix urb leak on disconnect

usb: typec: ucsi: ccg: Validate altmode index in GET_CURRENT_CAM response

usb: typec: ucsi_ccg: Add retry mechanism in ccg_read

usb: xhci: Fix bounce buffer overflow

userfaultfd: fix UFFDIO_MOVE livelock on large folio with extra references

userns: don't drop the exec securebits

veth: fix stale peer max_mtu on XDP program replacement

vfio/mlx5: Fix boundary check in set_report_output()

virtio_fs: read the vring size under virtio_fs_mutex in ->get_tree

virtio_net: atomically disable rx mode work

wifi: ath11k: Fix possible memory leak in ath11k_dp_srng_setup()

wifi: ath12k: validate MAC/PHY capability count before saving

wifi: brcmsmac: Adjust txpwrindex value in nphy_ipa_rxcal_gaintbl_2GHz

wifi: mt76: fix memory leak in USB TX path

wifi: mt76: Fix of_node reference leak in mt76_get_rate_power_limits()

wifi: mt76: mt7615: cancel reset work during unregister

wifi: mt76: mt7615: do not tear down BSS/STA state for monitor vifs

wifi: mt76: mt7615: restore DBDC state after ext PHY failure

wifi: mt76: mt76x02: validate TX-status rate index before mac80211 handoff

wifi: mt76: mt7925: cancel mlo_pm_work on the USB stop path

wifi: mt76: mt792x: fix UAF in SDIO TX path when out of memory

wifi: mt76: mt7996: fix PCI device reference leak in mt7996_pci_init_hif2()

wifi: rtw88: fix out-of-bounds CAM write when key table is full

wifi: rtw89: 8851b: fix swapped DPK channel/bandwidth backup fields

wifi: rtw89: cap firmware section_num before parsing

wifi: rtw89: fix IE length passed to cfg80211_find_ie() in WoW AKM

writeback: clear old wb dirty state after inode switches

writeback: reset dirtied_when when switching wbs

x86/bugs: Fix CONFIG_MITIGATION_RETPOLINE=n mitigation reporting

x86/bugs: Mitigate TSA on AMD Zen5

x86/mm/pat: Use pr_warn() for early W^X warnings

xen-blkfront: Fix IO race during unplug

xen-netback: Fix XenBus connection failure cleanup

xen-netback: Zero out sring pointers on unmap

xen-pciback: Fix pcistub_device ref leak in pcistub_get_gsi_from_sbdf()

xen/gntdev: prevent private mappings from becoming writable

xen/pcifront: check that an AER callback exists before calling it

xen/privcmd: Only claim ioreqs matching an ioeventfd

xhci: Prevent invalid vdev dereference during sideband unregister

xprtrdma: prevent disconnect feedback during endpoint teardown

xprtrdma: trim head iovec when the payload arrives via a Write chunk

xsk: restore UMEM flags after failed pool assignment