[ubuntu/resolute-security] linux 7.0.0-28.28 (Accepted)
Andy Whitcroft
apw at canonical.com
Mon Jul 20 06:30:10 UTC 2026
linux (7.0.0-28.28) resolute; urgency=medium
* resolute/linux: 7.0.0-28.28 -proposed tracker (LP: #2157520)
* Backport ASoC SDCA, AMD SoundWire, and RT722 audio fixes (LP: #2154418)
- ASoC: amd: acp-sdw-legacy: rename the dmic component name
- SAUCE: ASoC: rt722-sdca: add FU06 Playback Switch for speaker mute
control
* MIPI camera of a BBG809N3A_B sensor SKU of the DELL Pro 14 Premium PA14260
renders upside-down (LP: #2155837)
- SAUCE: media: ipu-bridge: correct platform handling for DELL Pro 14
Premium PA14260
* resolute ubuntu_kernel_selftests:seccomp_build test compilation issue
(LP: #2154174)
- SAUCE: selftests/seccomp fix compilation issue for amd64
* [Ubuntu 26.04] Severe Performance Degradation on kernel 7.0.0-15
(LP: #2154748)
- s390: Remove GENERIC_LOCKBREAK Kconfig option
- UBUNTU [Config]: Remove GENERIC_LOCKBREAK in s390x
* Fix no sound output device on Dell GhostRider PTL no camera SKU
(LP: #2156559)
- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally
* Fix no audio from right built-in speaker on HP ZBook with TAS2781
amplifier (LP: #2156556)
- ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block
data processing
* Installer fails internally with a RSync error due to page fault
(LP: #2150640)
- ovl: keep err zero after successful ovl_cache_get()
* Internal display black screen on Intel Lunar Lake with eDP panel
(LP: #2156312)
- drm/i915/alpm: Allow LOBF only for platform that have Always on VRR TG
* Thunderbolt DP tunnel torn down during boot with LUKS Full Disk Encryption
(LP: #2155096)
- SAUCE: thunderbolt: Defer DP tunnel teardown until display driver is
ready
* watchdog: lenovo_se10_wdt: Add SE10 Gen 2 support (LP: #2154715)
- watchdog: lenovo_se10_wdt: Add support for SE10 Gen 2 platform
- watchdog: lenovo_se10_wdt: Fix use-after-free and resource leak risk
* [Ubuntu 26.04] KVM: IBM Test Accelerator for Z (TAZ) not working properly
(LP: #2153159)
- KVM: s390: only deliver service interrupt with payload
- KVM: s390: vsie: Allow non-zarch guests
- KVM: s390: vsie: Disable some bits when in ESA mode
- KVM: s390: vsie: Accommodate ESA prefix pages
- KVM: s390: Add KVM capability for ESA mode guests
* ubuntu_bpf failed to build on Resolute (error: expected ‘:’, ‘,’, ‘;’, ‘}’
or ‘__attribute__’ before ‘__counted_by’) (LP: #2150071)
- tools/headers: Regenerate stddef.h to fix BPF selftests
* ubuntu_bpf: FTBFS with clang 23 / gcc 15 (LP: #2154343)
- selftests/bpf: Fix const qualifier warning in fexit_bpf2bpf.c
* ALSA: hda/tas2781 Audio Fix for the front-right speacker (LP: #2149770)
- ALSA: hda/tas2781: Fix sound abnormal issue on some SPI device
* Fix bad audio record quality when volume above 50% on Framework PTL
(LP: #2153155)
- ALSA: hda/realtek: fix mic boost on Framework PTL
* Patchset for TUXEDO devices (LP: #2152570)
- drm/i915/vbt: Add edp pipe joiner enable/disable bits
- drm/i915/dp: Avoid joiner for eDP if not enabled in VBT
- drm/amd/display: Add Idle state manager(ISM)
- drm/i915/backlight: Remove try_vesa_interface
- drm/i915/backlight: Use intel_panel variable instead of intel_connector
- drm/i915/backlight: Take luminance_set into account for VESA backlight
- drm/i915/backlight: Check luminance_set when disabling PWM via AUX VESA
backlight
- drm/i915/backlight: Short circuit intel_dp_aux_supports_hdr_backlight
- drm/i915/backlight: Update debug log during backlight setup
- drm/i915/backlight: Check if VESA backlight is possible
- drm/i915/backlight: Provide clear description on how backlight level is
controlled
- drm/i915/backlight: Fix VESA backlight possible check condition
* Resolute update: v7.0.12 upstream stable release (LP: #2156636)
- Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size
- ACPI: button: Fix ACPI GPE handler leak during removal
- ACPI: button: Enable wakeup GPEs for ACPI buttons at probe time
- xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit
- net/sched: sch_sfb: Replace direct dequeue call with peek and
qdisc_dequeue_peeked
- bcache: fix uninitialized closure object
- nfc: llcp: Fix use-after-free in llcp_sock_release()
- nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()
- xfrm: Check for underflow in xfrm_state_mtu
- nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems
- tools/bootconfig: Fix buf leaks in apply_xbc
- HID: remove duplicate hid_warn_ratelimited definition
- kunit: fix use-after-free in debugfs when using kunit.filter
- accel/rocket: fix UAF via dangling GEM handle in create_bo
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable
- netfilter: xt_cpu: prefer raw_smp_processor_id
- netfilter: ebtables: fix OOB read in compat_mtw_from_user
- netfilter: nf_tables: fix dst corruption in same register operation
- vsock: keep poll shutdown state consistent
- net: netlink: fix sending unassigned nsid after assigned one
- net: netlink: don't set nsid on local notifications
- net/smc: Do not re-initialize smc hashtables
- net/iucv: fix locking in .getsockopt
- scsi: core: Run queues for all non-SDEV_DEL devices from
scsi_run_host_queues
- scsi: scsi_debug: Add missing newline in scsi_debug_device_reset()
- ipv4: free net->ipv4.sysctl_local_reserved_ports after
unregister_net_sysctl_table()
- ALSA: hda: cs35l56: Fix system name string leaks
- ALSA: pcm: oss: Fix setup list UAF on proc write error
- ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors
- net/mlx5: HWS: Reject unsupported remove-header action
- net: hsr: fix potential OOB access in supervision frame handling
- accel/ivpu: prevent uninitialized data bug in debugfs
- gpio: mxc: fix irq_high handling
- drm/i915/aux: use polling when irqs are unavailable
- net: Avoid checksumming unreadable skb tail on trim
- ethtool: rss: avoid modifying the RSS context response
- ethtool: rss: add missing errno on RSS context delete
- ethtool: rss: fix falsely ignoring indir table updates
- ethtool: rss: fix indir_table and hkey leak on get_rxfh failure
- ethtool: rss: fix hkey leak when indir_size is 0
- ethtool: rss: avoid device context leak on reply-build failure
- ethtool: module: call ethnl_ops_complete() on module flash errors
- ethtool: module: avoid leaking a netdev ref on module flash errors
- ethtool: module: avoid racy updates to dev->ethtool bitfield
- ethtool: module: check fw_flash_in_progress under rtnl_lock
- ethtool: module: fix cleanup if socket used for flashing multiple
devices
- ethtool: cmis: require exact CDB reply length
- ethtool: cmis: fix u16-to-u8 truncation of msleep_pre_rpl
- ethtool: cmis: validate start_cmd_payload_size from module
- ethtool: cmis: validate fw->size against start_cmd_payload_size
- cxl/test: Update mock dev array before calling platform_device_add()
- blk-mq: reinsert cached request to the list
- tunnels: load network headers after skb_cow() in
iptunnel_pmtud_build_icmp[v6]()
- vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()
- tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()
- ksmbd: fix FSCTL permission bypass by adding a permission check for
FSCTL_SET_SPARSE
- ASoC: codecs: simple-mux: Fix enum control bounds check
- drm/xe: Restore IDLEDLY regiter on engine reset
- Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()
- bonding: refuse to enslave CAN devices
- bridge: Fix sleep in atomic context in netlink path
- bridge: Fix sleep in atomic context in sysfs path
- ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES
- ethtool: tsconfig: fix reply error handling
- ethtool: linkstate: fix unbalanced ethnl_ops_complete() on PHY lookup
error
- ethtool: pse-pd: fix missing ethnl_ops_complete()
- ethtool: tsconfig: fix missing ethnl_ops_complete()
- ethtool: tsinfo: fix uninitialized stats on the by-PHC path
- ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on prepare failure
- ethtool: strset: fix header attribute index in ethnl_req_get_phydev()
- ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during
fallback
- ethtool: eeprom: add more safeties to EEPROM Netlink fallback
- ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
- net/sched: Revert "net/sched: Restrict conditions for adding duplicating
netems to qdisc tree"
- net/sched: fix packet loop on netem when duplicate is on
- net: Introduce skb tc depth field to track packet loops
- net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loop
- net/sched: act_mirred: Fix blockcast recursion bypass leading to stack
overflow
- net/sched: act_mirred: Fix return code in early mirred redirect error
paths
- net: hibmcge: disable Relaxed Ordering to fix RX packet corruption
- net: hibmcge: move dma_rmb() after dma_sync_single_for_cpu() in RX path
- net/handshake: Use spin_lock_bh for hn_lock
- nvme-tcp: store negative errno in queue->tls_err
- net/handshake: Pass negative errno through handshake_complete()
- net/handshake: hand off the pinned file reference to accept_doit
- net/handshake: Take a long-lived file reference at submit
- net/handshake: Drain pending requests at net namespace exit
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime
- dpll: zl3073x: add die temperature reporting for supported chips
- dpll: export __dpll_device_change_ntf() for use under dpll_lock
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work
- Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success
- Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
- Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close
- Bluetooth: hci_sync: Reset device counters in hci_dev_close_sync()
- gpio: adnp: fix flow control regression caused by scoped_guard()
- gpio: virtuser: Fix uninitialized data bug in
gpio_virtuser_direction_do_write()
- gpio: rockchip: convert bank->clk to devm_clk_get_enabled()
- gpio: rockchip: teardown bugs and resource leaks
- net: mana: Add NULL guards in teardown path to prevent panic on attach
failure
- net: mana: Skip redundant detach on already-detached port
- sctp: fix race between sctp_wait_for_connect and peeloff
- net: pcs: pcs-mtk-lynxi: fix bpi-r3 serdes configuration
- vsock/virtio: bind uarg before filling zerocopy skb
- ipv6: fix possible infinite loop in rt6_fill_node()
- ipv6: fix possible infinite loop in fib6_select_path()
- net: skbuff: fix pskb_carve leaking zcopy pages
- Revert "ipv6: preserve insertion order for same-scope addresses"
- Revert "x86/fpu: Refine and simplify the magic number check during
signal return"
- drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register
- drm/i915/psr: Read Intel DPCD workaround register
- drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used
- iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer
- iio: imu: adis16550: fix stack leak in trigger handler
- iio: pressure: bmp280: fix stack leak in bmp580 trigger handler
- usb: typec: ucsi: ccg: reject firmware images without a ':' record
header
- usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers
- usb: typec: tcpm: bound altmode_desc[] per iteration in
svdm_consume_modes()
- usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload
VDO
- usb: typec: altmodes/displayport: validate count before reading Status
Update VDO
- usb: typec: wcove: don't write past struct pd_message in
wcove_read_rx_buffer()
- usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT
- usb: typec: ucsi: validate connector number in ucsi_connector_change()
- USB: serial: safe_serial: fix memory corruption with small endpoint
- media: rc: igorplugusb: fix control request setup packet
- Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free()
- USB: serial: cypress_m8: fix memory corruption with small endpoint
- HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse
- Bluetooth: btusb: Allow firmware re-download when version matches
- mm/vmalloc: do not trigger BUG() on BH disabled context
- hpfs: fix a crash if hpfs_map_dnode_bitmap fails
- mm/damon/sysfs-schemes: delete tried region in regions_rmdirs()
- ipc: limit next_id allocation to the valid ID range
- mm: memcontrol: propagate NMI slab stats to memcg vmstats
- mm/migrate_device: fix pgtable leak in migrate_vma_insert_huge_pmd_page
- memfd: deny writeable mappings when implying SEAL_WRITE
- zram: fix use-after-free in zram_writeback_endio
- mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one
- auxdisplay: line-display: fix OOB read on zero-length message_store()
- smb: client: fix uninitialized variable in smb2_writev_callback
- Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()
- Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn
- Bluetooth: HIDP: fix missing length checks in hidp_input_report()
- Bluetooth: ISO: fix UAF in iso_recv_frame
- Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock
- Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate()
- Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM loading
- Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync
- Input: xpad - fix out-of-bounds access for Share button
- parport: Fix race between port and client registration
- rust_binder: Avoid holding lock when dropping delivered_death
- rust_binder: avoid calling pending_oneway_finished() on TF_UPDATE_TXN
- USB: cdc-acm: Fix bit overlap and move quirk definitions to header
- KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor
- KVM: arm64: PMU: Preserve AArch32 counter low bits
- KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC
- KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use
- KVM: SEV: Ignore Port I/O requests of length '0'
- KVM: SEV: Use the size of the PSC header as the minimum size for PSC
requests
- KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0
- KVM: SEV: Compute the correct max length of the in-GHCB scratch area
- KVM: SEV: Check PSC request indices against the actual size of the
buffer
- KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer
- KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc()
- gpio: shared: undo the vote of the proxy on GPIO free
- gpio: shared: fix deadlock on shared proxy's parent removal
- gpio: shared: fix lockdep false positive by removing unneeded lock
- Disable -Wattribute-alias for clang-23 and newer
- iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux
- iio: adc: npcm: fix unbalanced clk_disable_unprepare()
- iio: dac: ad3530r: Fix AD3531/AD3531R powerdown mode strings
- iio: dac: max5821: fix return value check in powerdown sync
- iio: dac: ad5686: fix ref bit initialization for single-channel parts
- iio: dac: ad5686: fix input raw value check
- iio: dac: ad5686: acquire lock when doing powerdown control
- iio: dac: ad5686: fix powerdown control on dual-channel devices
- iio: adc: mt6359: fix unchecked return value in mt6358_read_imp
- iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw
- iio: adc: ad4695: Fix call ordering in offload buffer postenable
- iio: adc: nxp-sar-adc: fix division by zero in write_raw
- iio: adc: nxp-sar-adc: Avoid division by zero
- iio: adc: nxp-sar-adc: zero-initialize dma_slave_config
- iio: gyro: itg3200: fix i2c read into the wrong stack location
- iio: gyro: adis16260: fix division by zero in write_raw
- iio: ssp_sensors: cancel delayed work_refresh on remove
- iio: temperature: tsys01: fix broken PROM checksum validation
- iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL
- iio: light: veml6070: Fix resource leak in probe error path
- iio: Fix iio_multiply_value use in iio_read_channel_processed_scale
- iio: chemical: mhz19b: reject oversized serial replies
- iio: chemical: scd30: fix division by zero in write_raw
- iio: light: cm3323: fix reg_conf not being initialized correctly
- iio: buffer: hw-consumer: fix use-after-free in error path
- iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf()
- USB: serial: omninet: fix memory corruption with small endpoint
- usb: cdns3: gadget: fix request skipping after clearing halt
- usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy
acquisition failure
- usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently
leaks the runtime PM usage counter across bind/unbind cycles
- usb: dwc2: Fix use after free in debug code
- Input: elan_i2c - validate firmware size before use
- i2c: davinci: fix division by zero on missing clock-frequency
- x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines
- wireguard: send: append trailer after expanding head
- bpf: sockmap: fix tail fragment offset in bpf_msg_push_data
- macsec: fix replay protection at XPN lower-PN wrap
- ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()
- ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params
- octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify
- ipv6: exthdrs: refresh nh after handling HAO option
- ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().
- ipv6: validate extension header length before copying to cmsg
- xfrm: input: hold netns during deferred transport reinjection
- l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname
- ip6: vti: Use ip6_tnl.net in vti6_changelink().
- net: skbuff: fix missing zerocopy reference in pskb_carve helpers
- spi: spi-mem: avoid mutating op template in spi_mem_supports_op()
- HID: wacom: Fix OOB write in wacom_hid_set_device_mode()
- iommu, debugobjects: avoid gcc-16.1 section mismatch warnings
- nfc: hci: fix out-of-bounds read in HCP header parsing
- xfrm: route MIGRATE notifications to caller's netns
- xfrm: ipcomp: Free destination pages on acomp errors
- xfrm: ah: use skb_to_full_sk in async output callbacks
- ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware 2417
- ALSA: firewire-motu: Protect register DSP event queue positions
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without
direction check
- ASoC: qcom: q6asm-dai: close stream only when running
- ASoC: qcom: q6asm-dai: do not set stream state in event and trigger
callbacks
- xfrm: esp: restore combined single-frag length gate
- ALSA: hda/realtek: Fix speaker output on ASUS ROG Strix G615LP
- xfrm: iptfs: reset runtime state when cloning SAs
- dma-buf: fix UAF in dma_buf_fd() tracepoint
- Input: xpad - add "Nova 2 Lite" from GameSir
- Input: xpad - add support for ASUS ROG RAIKIRI II
- ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops
- misc: rp1: Send IACK on IRQ activate to fix kdump/kexec
- Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem
- Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490
- dt-bindings: usb: Fix EIC7700 USB reset's issue
- comedi: comedi_test: fix check for valid scan_begin_src in
waveform_ai_cmdtest()
- comedi: comedi_test: Fix limiting of convert_arg in
waveform_ai_cmdtest()
- counter: Fix refcount leak in counter_alloc() error path
- tty: serial: pch_uart: add check for dma_alloc_coherent()
- tty: serial: samsung: Remove redundant port lock acquisition in rx
helpers
- uio: uio_pci_generic_sva: fix double free of devm_kzalloc() memory
- usb: chipidea: core: convert ci_role_switch to local variable
- usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval
- usb: dwc3: xilinx: fix error handling in zynqmp init error paths
- usb: musb: omap2430: Fix use-after-free in omap2430_probe()
- USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub
controllers
- usb: storage: Add quirks for PNY Elite Portable SSD
- usbip: vudc: Fix use after free bug in vudc_remove due to race condition
- usb: usbtmc: check URB actual_length for interrupt-IN notifications
- usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize
- usb: typec: tipd: Fix error code in tps6598x_probe()
- usb: typec: tcpm: improve handling of DISCOVER_MODES failures
- usb: typec: ucsi: Check if power role change actually happened before
handling
- usb: typec: ucsi: Don't update power_supply on power role change if not
connected
- USB: serial: option: add MeiG SRM813Q
- USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL
- USB: serial: belkin_sa: validate interrupt status length
- USB: serial: cypress_m8: validate interrupt packet headers
- USB: serial: digi_acceleport: fix memory corruption with small endpoints
- USB: serial: keyspan: fix missing indat transfer sanity check
- USB: serial: mxuport: fix memory corruption with small endpoint
- USB: serial: mct_u232: fix memory corruption with small endpoint
- USB: serial: mct_u232: fix missing interrupt-in transfer sanity check
- usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind
- usb: gadget: net2280: Fix double free in probe error path
- usb: gadget: f_hid: fix device reference leak in hidg_alloc()
- usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling
- usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports
- usb: gadget: f_fs: copy only received bytes on short ep0 read
- usb: gadget: f_fs: serialize DMABUF cancel against request completion
- thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()
- thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow
- thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()
- scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker
- scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32
- scsi: target: iscsi: Fix CRC overread and double-free in
iscsit_handle_text_cmd()
- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf
- scsi: target: iscsi: Validate CHAP_R length before base64 decode
- drm/hyperv: validate resolution_count and fix WIN8 fallback
- drm/hyperv: validate VMBus packet size in receive callback
- drm/gem: fix race between change_handle and handle_delete
- drm/i915/color: Fix HDR pre-CSC LUT programming loop
- drm/i915/psr: Block DC states on vblank enable when Panel Replay
supported
- drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable
- drm/i915: Fix potential UAF in TTM object purge
- drm/amd/pm/si: Disregard vblank time when no displays are connected
- serial: altera_jtaguart: handle uart_add_one_port() failures
- serial: qcom-geni: fix UART_RX_PAR_EN bit position
- serial: qcom_geni: fix kfifo underflow when flush precedes DMA
completion IRQ
- serial: sh-sci: fix memory region release in error path
- serial: zs: Fix swapped RI/DSR modem line transition counting
- serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma
- drm/amdkfd: fix NULL pointer bug in svm_range_set_attr
- drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger
- drm/amdkfd: Check for pdd drm file first in CRIU restore path
- drm/amdgpu: fix lock leak on ENOMEM in AMDGPU_GEM_OP_GET_MAPPING_INFO
- drm/amdgpu: fix calling VM invalidation in amdgpu_hmm_invalidate_gfx
- drm/amdgpu: fix amdgpu_hmm_range_get_pages
- drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO
- serial: dz: Fix bootconsole message clobbering at chip reset
- serial: dz: Fix bootconsole handover lockup
- serial: dz: Convert to use a platform device
- serial: zs: Fix bootconsole handover lockup
- serial: zs: Switch to using channel reset
- serial: zs: Convert to use a platform device
- serial: core: introduce guard(uart_port_lock_check_sysrq_irqsave)
- serial: 8250: dispatch SysRq character in serial8250_handle_irq()
- serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq()
- platform/x86/intel/vsec: Refactor base_addr handling
- platform/x86/intel/vsec: Make driver_data info const
- platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery
- rxrpc: Fix RESPONSE packet verification to extract skb to a linear
buffer
- ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP Envy X360 15-fh0xxx
- ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP 16 Piston OmniBook
X
- arm64: tlb: Flush walk cache when unsharing PMD tables
- i2c: tegra: make tegra_i2c_mutex_unlock() return void
- hwmon: (pmbus) Add support for guarded PMBus lock
- hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read with
pmbus_lock
- hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock
- net: phy: micrel: fix LAN8814 QSGMII soft reset
- xhci: tegra: Fix ghost USB device on dual-role port unplug
- mailbox: Fix NULL message support in mbox_send_message()
- usb: core: Fix SuperSpeed root hub wMaxPacketSize
- tools: ynl: add scope qualifier for definitions
- Linux 7.0.12
* Resolute update: v7.0.12 upstream stable release (LP: #2156636) //
CVE-2026-46318
- Revert "mm/hugetlbfs: update hugetlbfs to use mmap_prepare"
* Resolute update: v7.0.12 upstream stable release (LP: #2156636) //
CVE-2026-46322
- tun: free page on build_skb failure in tun_xdp_one()
* Resolute update: v7.0.12 upstream stable release (LP: #2156636) //
CVE-2026-46320
- tap: free page on error paths in tap_get_user_xdp()
* Resolute update: v7.0.12 upstream stable release (LP: #2156636) //
CVE-2026-46321
- tun: free page on short-frame rejection in tun_xdp_one()
* CVE-2026-46316 // CVE-2026-46317
- KVM: arm64: Reassign nested_mmus array behind mmu_lock
* CVE-2026-46316
- KVM: arm64: vgic-its: Drop the translation cache reference only for the
erased entry
- KVM: arm64: Take the SRCU lock for page table walks in fault injection
and AT emulation
* Resolute update: v7.0.11 upstream stable release (LP: #2156390)
- iommu/amd: Fix illegal cap/mmio access in IOMMU debugfs
- iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs
- ksmbd: close durable scavenger races against m_fp_list lookups
- ata: libata-scsi: improve readability of ata_scsi_qc_issue()
- ata: libata-scsi: do not use the deferred QC feature for ATA_DEFER_PORT
- ata: libata-scsi: do not use the deferred QC feature on PMPs with CBS
- ata: libata-scsi: do not needlessly defer commands when using PMP with
FBS
- sysfs: don't remove existing directory on update failure
- mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break()
- ksmbd: fix null pointer dereference in compare_guid_key()
- ksmbd: fix null pointer dereference in proc_show_files()
- ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow
- ksmbd: validate SID in parent security descriptor during ACL inheritance
- regulator: tps65219: fix irq_data.rdev not being assigned
- x86/mm: Disable broadcast TLB flush when PCID is disabled
- scripts/gdb: mm: cast untyped symbols in x86_page_ops
- smb: client: require net admin for CIFS SWN netlink
- smb: client: protect tc_count increment in
smb2_find_smb_sess_tcon_unlocked()
- smb: client: use data_len for SMB2 READ encrypted folioq copy
- smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close
- hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX
- ALSA: ua101: Reject too-short USB descriptors
- ALSA: pcm: Don't setup bogus iov_iter for silencing
- ALSA: asihpi: Fix potential OOB array access at reading cache
- ALSA: scarlett2: Allow flash writes ending at segment boundary
- ACPI: battery: Fix system wakeup on critical battery status
- efi: Allocate runtime workqueue before ACPI init
- spi: amd: Set correct bus number in ACPI probe path
- io_uring/waitid: clear waitid info before copying it to userspace
- drivers/base/memory: fix memory block reference leak in poison
accounting
- ipv6: ioam: refresh hdr pointer before ioam6_event()
- mm/memory: fix spurious warning when unmapping device-private/exclusive
pages
- mm: fix __vm_normal_page() to handle missing support for
pmd_special()/pud_special()
- mm/memory_hotplug: fix memory block reference leak on remove
- mm/page_alloc: fix initialization of tags of the huge zero folio with
init_on_free
- mm/migrate_device: fix spinlock leak in migrate_vma_insert_huge_pmd_page
- selftests/mm: run_vmtests.sh: fix destructive tests invocation
- mm/damon: fix damos_stat tracepoint format for sz_applied
- net: wwan: iosm: fix potential memory leaks in ipc_imem_init()
- Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()
- Bluetooth: ISO: drop ISO_END frames received without prior ISO_START
- Bluetooth: bnep: Fix UAF read of dev->name
- Bluetooth: hci_uart: fix UAFs and race conditions in close and init
paths
- Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer
- Bluetooth: hci_qca: Convert timeout from jiffies to ms
- Bluetooth: MGMT: validate Add Extended Advertising Data length
- Bluetooth: serialize accept_q access
- phonet/pep: disable BH around forwarded sk_receive_skb()
- net: bcmgenet: keep RBUF EEE/PM disabled
- net: devmem: reject dma-buf bind with non-page-aligned size or SG length
- net: phy: skip EEE advertisement write when autoneg is disabled
- net: hsr: defer node table free until after RCU readers
- net/mlx5e: Fix use-after-free in mlx5e_tx_reporter_timeout_recover
- net: ifb: report ethtool stats over num_tx_queues
- net: pse-pd: fix sign on -ENOENT check in of_load_pse_pis()
- netfilter: ip6t_hbh: reject oversized option lists
- netfilter: nf_queue: hold bridge skb->dev while queued
- netfilter: ipset: stop hash:* range iteration at end
- net: ethtool: fix NULL pointer dereference in phy_reply_size
- net: ethtool: phy: avoid NULL deref when PHY driver is unbound
- ACPI: driver: Check ACPI_COMPANION() against NULL during probe
- sched_ext: Fix missing warning in scx_set_task_state() default case
- sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path
- l2tp: use list_del_rcu in l2tp_session_unhash
- qed: fix double free in qed_cxt_tables_alloc()
- ring-buffer: Fix reporting of missed events in iterator
- ring-buffer: Flush and stop persistent ring buffer on panic
- wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb
- ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()
- selftests: mptcp: drop nanoseconds width specifier
- mptcp: pm: fix ADD_ADDR timer infinite retry on option space
insufficient
- vsock/vmci: fix UAF when peer resets connection during handshake
- vsock/virtio: reset connection on receiving queue overflow
- ice: fix VF queue configuration with low MTU values
- wifi: ath11k: clear shared SRNG pointer state on restart
- wifi: iwlwifi: mvm: fix driver-set TX rates on old devices
- wifi: iwlwifi: mld: stop TX during firmware restart
- ipv4: raw: reject IP_HDRINCL packets with ihl < 5
- ixgbevf: fix use-after-free in VEPA multicast source pruning
- rbd: eliminate a race in lock_dwork draining on unmap
- mptcp: do not drop partial packets
- mptcp: reset rcv wnd on disconnect
- lsm: hold cred_guard_mutex for lsm_set_self_attr()
- octeontx2-af: CGX: add bounds check to cgx_speed_mbps index
- octeontx2-pf: fix double free in rvu_rep_rsrc_init()
- igc: fix potential skb leak in igc_fpe_xmit_smd_frame()
- ice: fix locking around wait_event_interruptible_locked_irq
- ice: fix setting promisc mode while adding VID filter
- ice: restore PTP Rx timestamp config after ethtool set-channels
- wifi: cfg80211: advance loop vars in cfg80211_merge_profile()
- af_unix: Fix UAF read of tail->len in unix_stream_data_wait()
- wifi: mac80211: consume only present negotiated TTLM maps
- octeontx2-pf: avoid double free of pool->stack on AQ init failure
- cifs: Fix busy dentry used after unmounting
- tracing: Do not call map->ops->elt_free() if elt_alloc() fails
- ASoC: codecs: pcm512x: fix null-ptr dereference in
pcm512x_overclock_xxx_put()
- arm64: probes: Handle probes on hinted conditional branch instructions
- KVM: arm64: vgic-its: Reject restored DTE with out-of-range
num_eventid_bits
- KVM: arm64: vgic: Free private_irqs when init fails after allocation
- KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h (erratum
#1235)
- riscv: kvm: return SBI_ERR_FAILURE for pmu_snapshot_set_shmem() when OOM
- riscv: kvm: return SBI_ERR_FAILURE for pmu_event_info() when OOM
- virt: sev-guest: Explicitly leak pages in unknown state
- i2c: tegra: fix pm_runtime leak on mutex_lock failure
- drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe
- spi: qup: fix error pointer deref after DMA setup failure
- phy: exynos5-usbdrd: fix USB 2.0 HS PHY tuning values for Exynos7870
- phy: tegra: xusb: Fix per-pad high-speed termination calibration
- phy: qcom-qmp-ufs: Fix kaanapali PHY PLL lock failure after SM8650 G4
fix
- phy: qcom: edp: Unify generic DP/eDP swing and pre-emphasis tables
- phy: qcom: edp: Add eDP/DP mode switch support
- phy: qcom: edp: Fix AUX_CFG8 programming for DP mode
- scsi: isci: Fix use-after-free in device removal path
- spi: ep93xx: fix error pointer deref after DMA setup failure
- spi: sprd: fix error pointer deref after DMA setup failure
- spi: ti-qspi: fix use-after-free after DMA setup failure
- mm/slub: hold cpus_read_lock around flush_rcu_sheaves_on_cache()
- RDMA/siw: Reject MPA FPDU length underflow before signed receive math
- s390/cio: Restore GFP_DMA for CHSC allocation
- s390/pai: Disable duplicate read of kernel PAI counter value
- s390/pai: Fix missing PAI counter increments under heavy load
- fwctl: pds: Validate RPC input size before parsing
- LoongArch: kprobes: Use larch_insn_text_copy() to patch instructions
- LoongArch: Remove unused code to avoid build warning
- cpufreq: intel_pstate: Use correct scaling factor on Raptor Lake-E
- device property: set fwnode->secondary to NULL in fwnode_init()
- drm/i915/display: Copy color pipeline from plane in the primary joiner
pipe
- drm/msm: Fix shrinker deadlock
- drm/v3d: Fix use-after-free of CPU job query arrays on error path
- drm/v3d: Release indirect CSD GEM reference on CPU job free
- drm/virtio: use uninterruptible resv lock for plane updates
- drm/xe/multi_queue: Fix secondary queue error case
- drm/amdgpu/vpe: Force collaborate sync after TRAP
- drm/bridge: it66121: acquire reset GPIO in probe
- drm/bridge: megachips: remove bridge when irq request fails
- drm/amd/display: Fix integer overflow in bios_get_image()
- drm/amd/display: Validate GPIO pin LUT table size before iterating
- drm/amd/display: Validate payload length and link_index in
dc_process_dmub_aux_transfer_async
- batman-adv: v: stop OGMv2 on disabled interface
- batman-adv: tvlv: abort OGM send on tvlv append failure
- batman-adv: tvlv: reject oversized TVLV packets
- batman-adv: iv: recover OGM scheduling after forward packet error
- batman-adv: mcast: fix use-after-free in orig_node RCU release
- batman-adv: clear current gateway during teardown
- batman-adv: dat: handle forward allocation error
- batman-adv: fix fragment reassembly length accounting
- batman-adv: fix tp_meter counter underflow during shutdown
- batman-adv: frag: disallow unicast fragment in fragment
- batman-adv: bla: fix report_work leak on backbone_gw purge
- batman-adv: bla: avoid double decrement of bla.num_requests
- batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface
- batman-adv: tp_meter: avoid use of uninit sender vars
- batman-adv: tp_meter: directly shut down timer on cleanup
- batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown
- batman-adv: tp_meter: fix race condition in send error reporting
- batman-adv: tp_meter: avoid role confusion in tp_list
- batman-adv: tt: fix TOCTOU race for reported vlans
- batman-adv: tt: reject oversized local TVLV buffers
- batman-adv: tt: avoid empty VLAN responses
- batman-adv: tt: fix negative last_changeset_len
- batman-adv: tt: fix negative tt_buff_len
- batman-adv: tt: prevent TVLV entry number overflow
- hwmon: (pmbus/adm1266) seed timestamp from the real-time clock
- hwmon: (pmbus/adm1266) reject implausible blackbox record_count
- hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer
- hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized
buffer
- hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR
- hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in
get_multiple
- hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe()
- hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe()
- hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO
accessors
- pinctrl: mediatek: moore: implement gpio_chip::get_direction()
- pinctrl: qcom: ipq4019: mark gpio as a GPIO pin function
- arm64: dts: renesas: r8a78000: Fix SCIF brg_int clocks
- ARM: dts: renesas: genmai: Drop superfluous cells
- ARM: dts: renesas: rskrza1: Drop superfluous cells
- pinctrl: renesas: rzg2l: Fix incorrect PUPD register offset for high
pins during suspend/resume
- pinctrl: renesas: rzg2l: Fix SMT register cache handling
- pinctrl: meson: amlogic-a4: fix deadlock issue
- pinctrl: qcom: Fix GPIO to PDC wake irq map for qcs615
- kho: skip KHO for crash kernel
- mm/memfd_luo: report error when restoring a folio fails mid-loop
- HID: intel-thc-hid: Intel-quickspi: Fix some error codes
- HID: uclogic: Fix regression of input name assignment
- firmware: arm_ffa: Check for NULL FF-A ID table while driver
registration
- firmware: arm_ffa: Skip free_pages on RX buffer alloc failure
- firmware: arm_ffa: Fix per-vcpu self notifications handling in workqueue
- firmware: arm_ffa: Unregister bus notifier on teardown for FF-A v1.0
- riscv: errata: Fix bitwise vs logical AND in MIPS errata patching
- riscv: Fix register corruption from uninitialized cregs on error
- riscv: mm: Fixup no5lvl failure when vaddr is invalid
- kunit: config: Enable KUNIT_DEBUGFS by default
- kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS
- pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150
- firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies
- firmware: arm_ffa: Keep framework RX release under lock
- firmware: arm_ffa: Validate framework notification message layout
- firmware: arm_ffa: Align RxTx buffer size before mapping
- firmware: arm_ffa: Snapshot notifier callbacks under lock
- firmware: arm_ffa: Fix sched-recv callback partition lookup
- ARM: integrator: Fix early initialization
- ALSA: hda: cs35l56: Put ACPI device after setting companion
- ALSA: hda: cs35l41: Put ACPI device on missing physical node
- btrfs: tracepoints: fix sleep while in atomic context in
btrfs_sync_file()
- netfilter: x_tables: allow initial table replace without emitting audit
log message
- netfilter: x_tables: allocate hook ops while under mutex
- netfilter: x_tables: unregister the templates first
- netfilter: x_tables: add and use xt_unregister_table_pre_exit
- netfilter: x_tables: add and use xtables_unregister_table_exit
- netfilter: ebtables: move to two-stage removal scheme
- netfilter: ebtables: close dangling table module init race
- netfilter: x_tables: close dangling table module init race
- netfilter: bridge: eb_tables: close module init race
- netfilter: nf_conntrack_expect: restore helper propagation via
expectation
- kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist()
- test_kprobes: clear kprobes between test runs
- tcp: Fix imbalanced icsk_accept_queue count.
- net: napi: Avoid gro timer misfiring at end of busypoll
- net: shaper: Reject reparenting of existing nodes
- idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init()
- ice: fix setting RSS VSI hash for E830
- ice: fix locking in ice_dcb_rebuild()
- ice: dpll: fix rclk pin state get for E810
- ice: dpll: fix misplaced header macros
- net: lan966x: avoid unregistering netdev on register failure
- net: ti: icssm-prueth: fix eth_ports_node leak in probe
- phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register
access
- phy: spacemit: Remove incorrect clk_disable() in spacemit_usb2phy_init()
- NFSD: Fix infinite loop in layout state revocation
- ASoC: sdw_utils: Add quirk to ignore RT712 CODEC_MIC
- ASoC: sdw_utils: Add quirk to ignore RT721 CODEC_MIC
- fprobe: Fix unregister_fprobe() to wait for RCU grace period
- fs/statmount: fix slab out-of-bounds write in statmount_mnt_idmap
- fs: Fix return in jfs_mkdir and orangefs_mkdir
- irqchip/ath79-cpu: Remove unused function
- fs: fix forced iversion increment on lazytime timestamp updates
- ublk: reject max_sectors smaller than PAGE_SECTORS in parameter
validation
- nsfs: fix wrong error code returned for pidns ioctls
- irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT
- nvme: fix bio leak on mapping failure
- nvme-pci: fix use-after-free in nvme_free_host_mem()
- zonefs: handle integer overflow in zonefs_fname_to_fno
- tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key().
- ASoC: SOF: amd: Fix error code handling in psp_send_cmd()
- powerpc: 82xx: fix uninitialized pointers with free attribute
- powerpc: fix dead default for GUEST_STATE_BUFFER_TEST
- powerpc/hv-gpci: fix preempt count leak in sysfs show paths
- netfs: Fix cancellation of a DIO and single read subrequests
- netfs: Fix missing locking around retry adding new subreqs
- netfs: Fix missing barriers when accessing stream->subrequests
locklessly
- netfs: Fix netfs_read_to_pagecache() to pause on subreq failure
- netfs: Fix potential for tearing in ->remote_i_size and ->zero_point
- netfs: Fix zeropoint update where i_size > remote_i_size
- netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call
- netfs: Fix overrun check in netfs_extract_user_iter()
- netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes
gone
- netfs: Defer the emission of trace_netfs_folio()
- netfs: Fix streaming write being overwritten
- netfs: Fix potential deadlock in write-through mode
- netfs: Fix read-gaps to remove netfs_folio from filled folio
- netfs: Fix write streaming disablement if fd open O_RDWR
- netfs: Fix early put of sink folio in netfs_read_gaps()
- netfs: Fix leak of request in netfs_write_begin() error handling
- netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages()
- netfs: Fix partial invalidation of streaming-write folio
- netfs: Fix folio->private handling in netfs_perform_write()
- netfs: Fix netfs_read_folio() to wait on writeback
- netfs, afs: Fix write skipping in dir/link writepages
- afs: Fix the locking used by afs_get_link()
- net: ethernet: cortina: Make RX SKB per-port
- net: ethernet: cortina: Drop half-assembled SKB
- net: ethernet: cortina: Carry over frag counter
- net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference
- wifi: ath11k: fix error path leaks in some WMI WOW calls
- wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm()
- wifi: ath10k: skip WMI and beacon transmission when device is wedged
- net: shaper: flip the polarity of the valid flag
- net: shaper: fix trivial ordering issue in net_shaper_commit()
- net: shaper: reject duplicate leaves in GROUP request
- net: shaper: set ret to -ENOMEM when genlmsg_new() fails in group_doit
- net: shaper: fix undersized reply skb allocation in GROUP command
- net: shaper: enforce singleton NETDEV scope with id 0
- net: shaper: reject QUEUE scope handle with missing id
- block: don't overwrite bip_vcnt in bio_integrity_copy_user()
- block: recompute nr_integrity_segments in blk_insert_cloned_request
- HID: quirks: really enable the intended work around for appledisplay
- block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user()
- accel/qaic: Add overflow check to remap_pfn_range during mmap
- net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint
- ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics
- drm/msm/dpu: fix UV scanlines calculation for YUV UBWC formats
- drm/msm/dpu: Fix Kaanapali CWB register configuration
- drm/msm/dsi: don't dump registers past the mapped region
- drm/msm/dpu: don't mix devm and drmm functions
- block: rename struct gendisk zone_wplugs_lock field
- block: allow submitting all zone writes from a single context
- block: fix handling of dead zone write plugs
- selftests: ublk: cap nthreads to kernel's actual nr_hw_queues
- x86/mce: Restore MCA polling interval halving
- Documentation: intel_pstate: Fix description of asymmetric packing with
SMT
- drm/msm: Fix GMEM_BASE for A650
- drm/msm/a6xx: Add soft fuse detection support
- drm/msm/adreno: Fix a reference leak in a6xx_gpu_init()
- drm/msm/adreno: fix userspace-triggered crash on a2xx-a4xx
- drm/msm/a6xx: Restore sysprof_active
- drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN
- drm/msm/a6xx: Check kzalloc return in a8xx_hfi_send_perf_table
- ASoC: intel: sof_sdw: Prepare for configuration without a jack
- ASoC: sdw_utils: cs42l43: allow spk component names to be combined
- ASoC: sdw_utils: Check speaker component string allocation
- riscv: Docs: fix unmatched quote warning
- powerpc/time: Remove redundant preempt_disable|enable() calls from
arch_irq_work_raise()
- net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot
- net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring
- net: tls: prevent chain-after-chain in plain text SG
- net: phy: DP83TC811: add reading of abilities
- ovpn: tcp - use cached peer pointer in ovpn_tcp_close()
- ovpn: respect peer refcount in CMD_NEW_PEER error path
- ovpn: fix race between deleting interface and adding new peer
- cifs: client: stage smb3_reconfigure() updates and restore ctx on
failure
- phy: apple: atc: Fix typec switch/mux leak on unbind
- gcc-plugins: Always define CONST_CAST_GIMPLE and CONST_CAST_TREE
- x86/xen: Fix xen_e820_swap_entry_with_ram()
- vfio/pci: Check BAR resources before exporting a DMABUF
- ovpn: disable BHs when updating device stats
- tls: Preserve sk_err across recvmsg() when data has been copied
- net/mlx5: Do not restore destination-less TC rules
- net/mlx5: Skip disabled vports when setting max TX speed
- scsi: sd: Fix return code handling in sd_spinup_disk()
- ASoC: codecs: fs210x: fix possible buffer overflow
- iommupt: Directly call iommupt's unmap_range()
- iommupt: Avoid rewalking during map
- iommu: Fix loss of errno on map failure for classic ops
- iommu: Fix up map/unmap debugging for iommupt domains
- iommu: Handle unmap error when iommu_debug is enabled
- iommupt: Check for missing PAGE_SIZE in the pgsize_bitmap
- iommupt: Fix the end_index calculation in __map_range_leaf()
- ALSA: scarlett2: Add missing error check when initialise Autogain Status
- ALSA: hda/ca0132: Disable auto-detect on manual output select
- cachefiles: Fix error return when vfs_mkdir() fails
- io_uring/net: punt IORING_OP_BIND async if it needs file create
- vsock/virtio: fix zerocopy completion for multi-skb sends
- btrfs: check for subvolume before deleting squota qgroup
- btrfs: fix squota accounting during enable generation
- ASoC: amd: acp-sdw-legacy: check CPU DAI name before logging
- spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache()
- netfilter: nft_inner: release local_lock before re-enabling softirqs
- ALSA: hda/realtek: Use ALC287_FIXUP_TXNW2781_I2C for ASUS Strix Gxx5
- drm/msm/snapshot: fix dumping of the unaligned regions
- hwmon: (lm90) Stop work before releasing hwmon device
- hwmon: (lm90) Add lock protection to lm90_alert
- wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is
disabled
- wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it
- dma-mapping: move dma_map_resource() sanity check into debug code
- drm/gem: Make the GEM LRU lock part of drm_device
- drm/xe/gsc: Fix double-free of managed BO in error path
- drm/xe/vf: Fix signature of print functions
- drm/xe/pf: Fix CFI failure in debugfs access
- drm/xe: Consolidate workaround entries for Wa_14019988906
- drm/xe: Consolidate workaround entries for Wa_18033852989
- drm/xe: Define and use MCR version of COMMON_SLICE_CHICKEN1
- drm/xe/tuning: Apply windower hardware filtering setting on Xe3 and Xe3p
- drm/xe: Define and use MCR version of COMMON_SLICE_CHICKEN4
- wifi: ath11k: fix peer resolution on rx path when peer_id=0
- wifi: ath12k: fix EHT TX MCS limitation due to wrong 20 MHz-only parsing
- drm/mediatek: mtk_hdmi_ddc_v2: Fix non-static global variable
- drm/mediatek: mtk_hdmi_v2: Fix non-static global variable
- drm/mediatek: mtk_cec: Fix non-static global variable
- drm/mediatek: mtk_hdmi_ddc: Fix non-static global variable
- io_uring: propagate array_index_nospec opcode into req->opcode
- srcu: Don't queue workqueue handlers to never-online CPUs
- cgroup/rstat: validate cpu before css_rstat_cpu() access
- net/mlx5e: xsk: Fix unlocked writing to ICOSQ
- cifs: Fix undefined variables
- ice: ptp: serialize E825 PHY timer start with PTP lock
- ice: ptp: use primary NAC semaphore on E825
- igc: set tx buffer type for SMD frames
- drm/i915/dp: Fix readback for target_rr in Adaptive Sync SDP
- phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp swing config
- kbuild: pacman-pkg: make "rc" releases adhere to pacman versioning
scheme
- net: dsa: mt7530: fix FDB entries not aging out with short timeout
- net: dsa: mt7530: preserve VLAN tags on trapped link-local frames
- net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer
- platform/surface: aggregator_registry: omit battery & AC nodes on
Surface Laptop 7
- platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL
- platform/x86: hp_accel: Check ACPI_COMPANION() against NULL
- platform/x86: intel-hid: Check ACPI_HANDLE() against NULL
- platform/x86: intel_sar: Check ACPI_HANDLE() against NULL
- platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL
- platform/x86: uniwill-laptop: Properly initialize charging threshold
- platform/x86: uniwill-laptop: Accept charging threshold of 0
- platform/x86: uniwill-laptop: Fix behavior of "force" module param
- platform/x86: asus-armoury: fix mini-LED mode get/set on MODE2 devices
- ASoC: soc-utils: Add missing va_end in snd_soc_ret()
- drm/amdgpu: Align amdgpu_gtt_mgr entries to TLB size on Tahiti (v2)
- drm/amdgpu/vce1: Check that the GPU address is < 128 MiB
- drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets
- RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port
- RDMA/rtrs: Fix use-after-free in path file creation cleanup
- bridge: mcast: Fix a possible use-after-free when removing a bridge port
- net: phy: honor eee_disabled_modes in phy_support_eee()
- net: phy: honor eee_disabled_modes in phy_advertise_eee_all()
- net: airoha: Fix NPU RX DMA descriptor bits
- pds_core: fix error handling in pdsc_devcmd_wait
- pds_core: fix debugfs_lookup dentry leak and error handling
- erofs: fix managed cache race for unaligned extents
- erofs: harden h_shared_count in erofs_init_inode_xattrs()
- erofs: fix metabuf leak in inode xattr initialization
- wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs
- wifi: mac80211: fix MLE defragmentation
- wifi: mac80211: fix multi-link element inheritance
- wifi: wilc1000: fix dma_buffer leak on bus acquire failure
- ALSA: seq: Serialize UMP output teardown with event_input
- cgroup: rstat: relax NMI guard after switch to try_cmpxchg
- tracing: Avoid NULL return from hist_field_name() on truncation
- Bluetooth: hci_sync: Fix not setting mask for
HCI_EVT_LE_ALL_REMOTE_FEATURES_COMPLETE
- Bluetooth: btintel_pcie: Fix incorrect MAC access programming
- Bluetooth: btmtk: fix urb->setup_packet leak in error paths
- udp: gso: Fix handling checksum in __udp_gso_segment
- udp: Fix UDP length on last GSO_PARTIAL segment
- net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA
- net: shaper: annotate the data races
- net: shaper: rework the VALID marking (again)
- crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks
- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg
- net: ag71xx: check error for platform_get_irq
- bpf, skmsg: fix verdict sk_data_ready racing with ktls rx
- tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction
- net: stmmac: eswin: fix HSP CSR init ordering after clock enable
- net: stmmac: eswin: clear TXD and RXD delay registers during
initialization
- net: stmmac: eswin: correct RGMII delay granularity to 20 ps
- net: stmmac: eswin: validate RGMII delay values
- gpio: cdev: check if uAPI v2 config attributes are correctly zeroed
- gpio: aggregator: fix a potential use-after-free
- gpio: aggregator: stop using dev-sync-probe
- gpio: aggregator: remove the software node when deactivating the
aggregator
- gpio: aggregator: lock device when calling device_is_bound()
- ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove()
- drm/xe/oa: Fix exec_queue leak on width check in stream open
- ASoC: cs-amp-lib: Fix wrong sizeof() in
_cs_amp_set_efi_calibration_data()
- ASoC: cs-amp-lib: Fix missing dput() after debugfs_lookup()
- selftests: net: Fix checksums in xdp_native
- nvme-pci: fix dma_vecs leak on p2p memory
- nvme-pci: fix dma mapping leak on data setup error
- octeontx2-af: npc: Fix allmulticast skip logic for LBK and SDP VFs
- net: mana: validate rx_req_idx to prevent out-of-bounds array access
- tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR
- net: airoha: Disable GDM2 forwarding before configuring GDM2 loopback
- pds_core: ensure null-termination for firmware version strings
- net: enetc: fix missing error code when pf->vf_state allocation fails
- io_uring/nop: pass all errors to userspace
- blk-mq: pop cached request if it is usable
- ksmbd: fix durable reconnect error path file lifetime
- LoongArch: kprobes: Fix handling of fatal unrecoverable recursions
- block: avoid use-after-free in disk_free_zone_resources()
- Documentation: laptops: Update documentation for uniwill laptops
- platform/x86: uniwill-laptop: Do not enable the charging limit even when
forced
- drm/msm: Restore second parameter name in purge() and evict()
- security/keys: fix missed RCU read section on lookup
- Linux 7.0.11
* Resolute update: v7.0.10 upstream stable release (LP: #2156385)
- blk-cgroup: wait for blkcg cleanup before initializing new disk
- md: suppress spurious superblock update error message for dm-raid
- fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START
- fs/mbcache: cancel shrink work before destroying the cache
- md/raid1: fix the comparing region of interval tree
- fs: fix archiecture-specific compat_ftruncate64
- drbd: Balance RCU calls in drbd_adm_dump_devices()
- loop: fix partition scan race between udev and loop_reread_partitions()
- block: fix zones_cond memory leak on zone revalidation error paths
- nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty()
- blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current()
- pstore/ram: fix resource leak when ioremap() fails
- erofs: include the trailing NUL in FS_IOC_GETFSLABEL
- md: fix array_state=clear sysfs deadlock
- ublk: reset per-IO canceled flag on each fetch
- blk-wbt: remove WARN_ON_ONCE from wbt_init_enable_default()
- erofs: handle 48-bit blocks/uniaddr for extra devices
- md: remove unused static md_wq workqueue
- md: wake raid456 reshape waiters before suspend
- dcache: permit dynamic_dname()s up to NAME_MAX
- btrfs: fix the inline compressed extent check in inode_need_compress()
- btrfs: fix deadlock between reflink and transaction commit when using
flushoncommit
- btrfs: do not reject a valid running dev-replace
- OPP: debugfs: Use performance level if available to distinguish between
rates
- OPP: Move break out of scoped_guard in dev_pm_opp_xlate_required_opp()
- ACPI: x86: cmos_rtc: Clean up address space handler driver
- ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver
- devres: fix missing node debug info in devm_krealloc()
- thermal/drivers/spear: Fix error condition for reading st,thermal-flags
- debugfs: check for NULL pointer in debugfs_create_str()
- debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str()
- soundwire: debugfs: initialize firmware_file to empty string
- amd-pstate: Fix memory leak in amd_pstate_epp_cpu_init()
- amd-pstate: Update cppc_req_cached in fast_switch case
- cpufreq: Pass the policy to cpufreq_driver->adjust_perf()
- PCI: use generic driver_override infrastructure
- platform/wmi: use generic driver_override infrastructure
- vdpa: use generic driver_override infrastructure
- s390/cio: use generic driver_override infrastructure
- s390/ap: use generic driver_override infrastructure
- bus: fsl-mc: use generic driver_override infrastructure
- locking/mutex: Rename mutex_init_lockep()
- locking/mutex: Fix wrong comment for CONFIG_DEBUG_LOCK_ALLOC
- irqchip/irq-pic32-evic: Address warning related to wrong printf()
formatter
- hrtimer: Avoid pointless reprogramming in __hrtimer_start_range_ns()
- hrtimer: Reduce trace noise in hrtimer_start()
- locking: Fix rwlock and spinlock lock context annotations
- signal: Fix the lock_task_sighand() annotation
- ww-mutex: Fix the ww_acquire_ctx function annotations
- perf/amd/ibs: Account interrupt for discarded samples
- perf/amd/ibs: Preserve PhyAddrVal bit when clearing PhyAddr MSR
- perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler
- x86/tdx: Fix the typo in TDX_ATTR_MIGRTABLE
- rust: sync: atomic: Remove bound `T: Sync` for `Atomic::from_ptr()`
- sparc64: vdso: Link with -z noexecstack
- scripts/gdb: timerlist: Adapt to move of tk_core
- locking: Fix rwlock support in <linux/spinlock_up.h>
- sched/topology: Compute sd_weight considering cpuset partitions
- x86/irqflags: Preemptively move include paravirt.h directive where it
belongs
- sched/topology: Fix sched_domain_span()
- irqchip/renesas-rzg2l: Fix error path in rzg2l_irqc_common_probe()
- ASoC: Intel: avs: Check maximum valid CPUID leaf
- ASoC: Intel: avs: Include CPUID header at file scope
- x86/vdso: Clean up remnants of VDSO32_NOTE_MASK
- firmware: dmi: Correct an indexing error in dmi.h
- fs/resctrl: Report invalid domain ID when parsing io_alloc_cbm
- sched: Make class_schedulers avoid pushing current, and get rid of
proxy_tag_curr()
- sched/rt: Skip group schedulable check with rt_group_sched=0
- wifi: ath11k: fix memory leaks in beacon template setup
- wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt()
- wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished
irq_prepare_bcn_tasklet
- bpf: test_run: Fix the null pointer dereference issue in
bpf_lwt_xmit_push_encap
- wifi: ath12k: account TX stats only when ACK/BA status is present
- wifi: ath12k: Fix legacy rate mapping for monitor mode capture
- selftests/bpf: Handle !CONFIG_SMC in bpf_smc.c
- wifi: ieee80211: fix definition of EHT-MCS 15 in MRU
- dpaa2: add independent dependencies for FSL_DPAA2_SWITCH
- [Config] Disable CONFIG_FSL_DPAA2_SWITCH on armhf and ppc64el
- dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n
- s390/bpf: Zero-extend bpf prog return values and kfunc arguments
- powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy
- powerpc/64s: Fix unmap race with PMD migration entries
- module: Fix freeing of charp module parameters when CONFIG_SYSFS=n
- wifi: libertas: use USB anchors for tracking in-flight URBs
- wifi: libertas: don't kill URBs in interrupt context
- bpf: Do not allow deleting local storage in NMI
- selftests/nolibc: fix test_file_stream() on musl libc
- selftests/nolibc: Fix build with host headers and libc
- tools/nolibc/printf: Change variables 'c' to 'ch' and 'tmpbuf[]' to
'outbuf[]'
- tools/nolibc/printf: Move snprintf length check to callback
- tools/nolibc: MIPS: fix clobbers of 'lo' and 'hi' registers on different
ISAs
- tools/nolibc: avoid -Wundef warning for __STDC_VERSION__
- wifi: mt76: mt7996: fix the behavior of radar detection
- wifi: mt76: mt7996: fix iface combination for different chipsets
- wifi: mt76: mt7996: Set mtxq->wcid just for primary link
- wifi: mt76: mt7996: Reset mtxq->idx if primary link is removed in
mt7996_vif_link_remove()
- wifi: mt76: mt7996: Switch to the secondary link if the default one is
removed
- wifi: mt76: mt7996: Clear wcid pointer in mt7996_mac_sta_deinit_link()
- wifi: mt76: mt7996: Reset ampdu_state state in case of failure in
mt7996_tx_check_aggr()
- wifi: mt76: mt7921: Reset ampdu_state state in case of failure in
mt76_connac2_tx_check_aggr()
- wifi: mt76: mt7925: Fix incorrect MLO mode in firmware control
- wifi: mt76: mt7615: fix use_cts_prot support
- wifi: mt76: mt7915: fix use_cts_prot support
- wifi: mt76: mt7925: prevent NULL pointer dereference in
mt7925_tx_check_aggr()
- wifi: mt76: mt7925: prevent NULL vif dereference in
mt7925_mac_write_txwi
- wifi: mt76: mt7996: fix FCS error flag check in RX descriptor
- wifi: mt76: mt7921: Place upper limit on station AID
- wifi: mt76: Fix memory leak destroying device
- wifi: mt76: mt7996: Fix NPU stop procedure
- wifi: mt76: npu: Add missing rx_token_size initialization
- wifi: mt76: mt7925: drop puncturing handling from BSS change path
- wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync
- wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req()
- wifi: mt76: mt7925: fix tx power setting failure after chip reset
- wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync
- wifi: mt76: fix deadlock in remain-on-channel
- wifi: mt76: fix backoff fields and max_power calculation
- arm64: cpufeature: Make PMUVer and PerfMon unsigned
- bpf: Switch CONFIG_CFI_CLANG to CONFIG_CFI
- wifi: mt76: mt7996: fix wrong DMAD length when using MAC TXP
- wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event
- wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work()
- wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work()
- wifi: mt76: mt7921: fix 6GHz regulatory update on connection
- wifi: mt76: mt7996: Add missing CHANCTX_STA_CSA property
- wifi: mt76: mt7996: Remove link pointer dependency in
mt7996_mac_sta_remove_links()
- wifi: mt76: mt7996: Decrement sta counter removing the link in
mt7996_mac_reset_sta_iter()
- wifi: mt76: fix multi-radio on-channel scanning
- wifi: mt76: support upgrading passive scans to active
- wifi: mt76: mt7996: fix RRO EMU configuration
- bpf: Fix refcount check in check_struct_ops_btf_id()
- selftests/bpf: Fix sockmap_multi_channels reliability
- bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path
- bpf: Fix variable length stack write over spilled pointers
- arm_mpam: Ensure in_reset_state is false after applying configuration
- arm_mpam: Reset when feature configuration bit unset
- bpf,arc_jit: Fix missing newline in pr_err messages
- wifi: rtw89: phy: fix uninitialized variable access in
rtw89_phy_cfo_set_crystal_cap()
- drivers/vfio_pci_core: Change PXD_ORDER check from switch case to
if/else block
- r8152: fix incorrect register write to USB_UPHY_XTAL
- selftests/tracing: Fix to make --logdir option work again
- selftests/tracing: Fix to check awk supports non POSIX strtonum()
- powerpc/crash: fix backup region offset update to elfcorehdr
- powerpc/crash: Update backup region offset in elfcorehdr on memory
hotplug
- bpf: Fix abuse of kprobe_write_ctx via freplace
- macvlan: annotate data-races around port->bc_queue_len_used
- bpf: Use copy_map_value_locked() in alloc_htab_elem() for BPF_F_LOCK
- bpf: Fix stale offload->prog pointer after constant blinding
- net: ethernet: ti-cpsw:: rename soft_reset() function
- net: ethernet: ti-cpsw: fix linking built-in code to modules
- wifi: brcmfmac: Fix error pointer dereference
- wifi: mac80211: handle VHT EXT NSS in ieee80211_determine_our_sta_mode()
- bpf: Drop task_to_inode and inet_conn_established from lsm sleepable
hooks
- bpf: Prefer vmlinux symbols over module symbols for unqualified kprobes
- wifi: ath10k: fix station lookup failure during disconnect
- bpf: Fix linked reg delta tracking when src_reg == dst_reg
- net: dropreason: add SKB_DROP_REASON_RECURSION_LIMIT
- net: plumb drop reasons to __dev_queue_xmit()
- net: qdisc_pkt_len_segs_init() cleanup
- net: pull headers in qdisc_pkt_len_segs_init()
- arm64: entry: Don't preempt with SError or Debug masked
- ACPI: AGDI: fix missing newline in error message
- arm64: kexec: Remove duplicate allocation for trans_pgd
- bpf: Propagate error from visit_tailcall_insn
- bpf: Fix ld_{abs,ind} failure path analysis in subprogs
- bpf: Remove static qualifier from local subprog pointer
- mptcp: better mptcp-level RTT estimator
- bpf: Fix use-after-free in offloaded map/prog info fill
- macsec: Support VLAN-filtering lower devices
- net: bcmgenet: fix off-by-one in bcmgenet_put_txcb
- net: bcmgenet: fix leaking free_bds
- net: bcmgenet: fix racing timeout handler
- net: airoha: Add dma_rmb() and READ_ONCE() in airoha_qdma_rx_process()
- eth: fbnic: Use wake instead of start
- netfilter: xt_socket: enable defrag after all other checks
- netfilter: nft_fwd_netdev: check ttl/hl before forwarding
- bpf: fix mm lifecycle in open-coded task_vma iterator
- bpf: switch task_vma iterator from mmap_lock to per-VMA locks
- bpf: return VMA snapshot from task_vma iterator
- bpf: Fix RCU stall in bpf_fd_array_map_clear()
- net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf
- net: airoha: Fix FE_PSE_BUF_SET configuration if PPE2 is available
- bpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars
- selftests/bpf: fix __jited_unpriv tag name
- net/sched: cls_fw: fix NULL dereference of "old" filters before change()
- net/sched: act_ct: Only release RCU read lock after ct_ft
- selftests: netfilter: nft_tproxy.sh: adjust to socat changes
- net: mana: Use pci_name() for debugfs directory naming
- net: mana: Move current_speed debugfs file to mana_init_port()
- net: airoha: Add missing RX_CPU_IDX() configuration in
airoha_qdma_cleanup_rx_queue()
- net_sched: fix skb memory leak in deferred qdisc drops
- bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops
- bpf: Allow instructions with arena source and non-arena dest registers
- selftests/bpf: Fix reg_bounds to match new tnum-based refinement
- net/rds: Optimize rds_ib_laddr_check
- net/rds: Restrict use of RDS/IB to the initial network namespace
- bpf: Fix OOB in pcpu_init_value
- ppp: require CAP_NET_ADMIN in target netns for unattached ioctls
- net: ipa: Fix programming of QTIME_TIMESTAMP_CFG
- net: ipa: Fix decoding EV_PER_EE for IPA v5.0+
- dt-bindings: net: dsa: nxp,sja1105: make spi-cpol optional for sja1110
- net: phy: fix a return path in get_phy_c45_ids()
- net/mlx5e: Fix features not applied during netdev registration
- net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic()
- net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registers
- net: fix skb_ext_total_length() BUILD_BUG_ON with
CONFIG_GCOV_PROFILE_ALL
- bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb
- Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds
MTU
- Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error
- Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp
- Bluetooth: SCO: check for codecs->num_codecs == 1 before assigning to
sco_pi(sk)->codec
- net: phy: qcom: at803x: Use the correct bit to disable extended next
page
- udp: Force compute_score to always inline
- tcp: Don't set treq->req_usec_ts in cookie_tcp_reqsk_init().
- sctp: fix missing encap_port propagation for GSO fragments
- sctp: disable BH before calling udp_tunnel_xmit_skb()
- selftests/namespaces: remove unused utils.h include from
listns_efault_test
- net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master
- net: airoha: Fix VIP configuration for AN7583 SoC
- net: airoha: Add missing PPE configurations in airoha_ppe_hw_init()
- drm/panel: ilitek-ili9882t: Select DRM_DISPLAY_DSC_HELPER
- selftests/futex: Fix incorrect result reporting of futex_requeue test
item
- drm/komeda: fix integer overflow in AFBC framebuffer size check
- dma-fence: Fix sparse warnings due __rcu annotations
- drm/gpusvm: Fix unbalanced unlock in drm_gpusvm_scan_mm()
- drm/virtio: Allow importing prime buffers when 3D is enabled
- ASoC: soc-compress: use function to clear symmetric params
- PCI/TPH: Allow TPH enable for RCiEPs
- PCI: endpoint: pci-epf-vntb: Fix MSI doorbell IRQ unwind
- PCI: endpoint: pci-epf-test: Don't free doorbell IRQ unless requested
- PCI: endpoint: pci-ep-msi: Fix error unwind and prevent double alloc
- drm/sun4i: mixer: Fix layer init code
- drm/sun4i: backend: fix error pointer dereference
- drm/xe: Consolidate workaround entries for Wa_14019877138
- drm/xe: Consolidate workaround entries for Wa_14019386621
- drm/xe/xe2_hpg: Drop invalid workaround Wa_15010599737
- gpu: nova-core: gsp: use empty slices instead of [0..0] ranges
- gpu: nova-core: gsp: fix improper handling of empty slot in cmdq
- drm/amdkfd: Removed commented line for MQD queue priority
- PCI: imx6: Fix device node reference leak in imx_pcie_probe()
- crypto: inside-secure/eip93 - fix register definition
- ASoC: sti: Return errors from regmap_field_alloc()
- ASoC: sti: use managed regmap_field allocations
- dm cache: fix null-deref with concurrent writes in passthrough mode
- dm cache: fix write path cache coherency in passthrough mode
- dm cache: fix write hang in passthrough mode
- dm cache policy smq: fix missing locks in invalidating cache blocks
- dm cache: fix concurrent write failure in passthrough mode
- dm cache: fix dirty mapping checking in passthrough mode switching
- dm-mpath: don't stop probing paths at presuspend
- drm/amd/ras: Fix type size of remainder argument
- dt-bindings: mmc: dwcmshc-sdhci: Fix resets array validation
- drm/amdgpu: GFX12.1 scratch memory limit up to 57-bit
- platform/chrome: chromeos_tbmc: Drop wakeup source on remove
- gpu: nova-core: use checked arithmetic in FWSEC firmware parsing
- gpu: nova-core: create falcon firmware DMA objects lazily
- gpu: nova-core: falcon: rename load parameters to reflect DMA dependency
- gpu: nova-core: firmware: fix and explain v2 header offsets computations
- PCI: dwc: ep: Fix MSI-X Table Size configuration in
dw_pcie_ep_set_msix()
- PCI: dwc: ep: Mirror the max link width and speed fields to all
functions
- PCI: dwc: Perform cleanup in the error path of dw_pcie_resume_noirq()
- dm cache metadata: fix memory leak on metadata abort retry
- dm log: fix out-of-bounds write due to region_count overflow
- iopoll: fix function parameter names in read_poll_timeout_atomic()
- drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier
in atomic_enable()
- drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to
drm_bridge_funcs
- drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge
atomic check
- spi: nxp-xspi: Use reinit_completion() for repeated operations
- spi: nxp-fspi: Use reinit_completion() for repeated operations
- spi: fsl-qspi: Use reinit_completion() for repeated operations
- spi: axiado: Remove redundant pm_runtime_mark_last_busy() call
- media: i2c: og01a1b: Fix V4L2 subdevice data initialization on probe
- media: synopsys: VIDEO_DW_MIPI_CSI2RX should depend on ARCH_ROCKCHIP
- [Config] VIDEO_DW_MIPI_CSI2RX depends on ARCH_ROCKCHIP
- drm/amd/pm: Fix xgmi max speed reporting
- spi: atcspi200: fix mutex initialization order
- selftests/sched_ext: Add missing error check for exit__load()
- drm/v3d: Handle error from drm_sched_entity_init()
- drm/sun4i: Fix resource leaks
- crypto: inside-secure/eip93 - register hash before authenc algorithms
- PCI: rzg3s-host: Fix reset handling in probe error path
- PCI: rzg3s-host: Reorder reset assertion during suspend
- dt-bindings: PCI: renesas,r9a08g045s33-pcie: Fix naming properties
- iommu/riscv: Add IOTINVAL after updating DDT/PDT entries
- iommu/riscv: Skip IRQ count check when using MSI interrupts
- iommu/riscv: Add missing GENERIC_MSI_IRQ
- iommu/riscv: Stop polling when CQCSR reports an error
- drm/amdkfd: Update queue properties for metadata ring
- drm/amd/ras: Fix NULL deref in ras_core_ras_interrupt_detected()
- drm/amdgpu: Add default case in DVI mode validation
- regulator: dt-bindings: fp9931: Make vin-supply property as required
- regulator: fp9931: Fix handling of mandatory "vin" supply
- drm/amd/ras: Fix NULL deref in ras_core_get_utc_second_timestamp()
- drm/amdgpu: Drop redundant queue NULL check in hang detect worker
- drm/amdgpu: Remove dead negative offset check in
amdgpu_virt_init_critical_region()
- dm init: ensure device probing has finished in dm-mod.waitfor=
- fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build
break
- crypto: simd - reject compat registrations without __ prefixes
- crypto: tegra - Disable softirqs before finalizing request
- crypto: atmel-aes - guard unregister on error in atmel_aes_register_algs
- padata: Remove cpu online check from cpu add and removal
- padata: Put CPU offline callback in ONLINE section to allow failure
- PCI: dwc: rcar-gen4: Change EPC BAR alignment to 4K as per the
documentation
- accel/amdxdna: fix missing newline in pr_err message
- drm/amd/ras: Remove redundant NULL check in pending bad-bank list
iteration
- drm/amdgpu/gfx10: look at the right prop for gfx queue priority
- drm/amdgpu/gfx11: look at the right prop for gfx queue priority
- spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo
- PCI: sky1: Fix missing cleanup of ECAM config on probe failure
- drm/imagination: Switch reset_reason fields from enum to u32
- iommu/tegra241-cmdqv: Set supports_cmd op in tegra241_vcmdq_hw_init()
- iommu/tegra241-cmdqv: Update uAPI to clarify HYP_OWN requirement
- drm/msm: add missing MODULE_DEVICE_ID definitions
- drm/msm/dpu: fix mismatch between power and frequency
- drm/msm/dsi: add the missing parameter description
- drm/msm/dpu: don't try using 2 LMs if only one DSC is available
- drm/msm/dsi: fix bits_per_pclk
- drm/msm/dsi: fix hdisplay calculation for CMD mode panel
- drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0
- ASoC: rockchip: rockchip_sai: Set slot width for non-TDM mode
- tools/sched_ext: scx_pair: fix pair_ctx indexing for CPU pairs
- drm/panel: sharp-ls043t1le01: make use of prepare_prev_first
- drm/panel: simple: Correct G190EAN01 prepare timing
- PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion
support
- PCI: Prevent shrinking bridge window from its required size
- PCI: Fix premature removal from realloc_head list during resource
assignment
- crypto: hisilicon/sec2 - prevent req used-after-free for sec
- PCI: Fix alignment calculation for resource size larger than align
- iommu/riscv: Fix signedness bug
- ALSA: core: Validate compress device numbers without dynamic minors
- drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths
- ASoC: amd: acp: update dmic_num logic for acp pdm dmic
- drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled
- drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs
- drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock
- drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0
- drm/amd/pm/ci: Clear EnabledForActivity field for memory levels
- drm/amd/pm/ci: Fill DW8 fields from SMC
- drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board
- drm/amdgpu/uvd4.2: Don't initialize UVD 4.2 when DPM is disabled
- PCI/DPC: Log AER error info for DPC/EDR uncorrectable errors
- hwmon: (aspeed-g6-pwm-tach): remove redundant driver remove callback
- ALSA: hda/realtek: fix bad indentation for alc269
- ALSA: hda/realtek: fix code style (ERROR: else should follow close brace
'}')
- ASoC: SOF: Intel: hda: Place check before dereference
- drm/msm/vma: Avoid lock in VM_BIND fence signaling path
- drm/msm/a6xx: Add missing aperture_lock init
- drm/msm: Reject fb creation from _NO_SHARE objs
- drm/msm: Fix VM_BIND UNMAP locking
- drm/msm/a6xx: Fix HLSQ register dumping
- drm/msm/shrinker: Fix can_block() logic
- drm/msm/a6xx: Fix dumping A650+ debugbus blocks
- drm/msm/a6xx: Use barriers while updating HFI Q headers
- drm/msm/a8xx: Fix the ticks used in submit traces
- drm/msm/a6xx: Switch to preemption safe AO counter
- drm/msm/a6xx: Correct OOB usage
- drm/msm/adreno: Implement gx_is_on() for A8x
- drm/msm/a6xx: Fix gpu init from secure world
- ALSA: hda/cmedia: Remove duplicate pin configuration parsing
- pmdomain: ti: omap_prm: Fix a reference leak on device node
- pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe()
- PM: domains: De-constify fields in struct dev_pm_domain_attach_data
- drm/msm/dpu: drop INTF_0 on MSM8953
- ASoC: fsl_micfil: Add access property for "VAD Detected"
- ASoC: fsl_micfil: Fix event generation in hwvad_put_enable()
- ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode()
- ASoC: fsl_micfil: Fix event generation in micfil_range_set()
- ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state()
- ASoC: fsl_micfil: Fix event generation in micfil_quality_set()
- ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put()
- ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put()
- ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits()
- ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits()
- ASoC: fsl_easrc: Change the type for iec958 channel status controls
- iommu/amd: Fix clone_alias() to use the original device's devid
- iommu/riscv: Remove overflows on the invalidation path
- ASoC: qcom: qdsp6: topology: check widget type before accessing data
- PCI: dwc: Fix type mismatch for kstrtou32_from_user() return value
- crypto: qat - disable 4xxx AE cluster when lead engine is fused off
- crypto: qat - disable 420xx AE cluster when lead engine is fused off
- crypto: qat - fix compression instance leak
- crypto: qat - fix type mismatch in RAS sysfs show functions
- crypto: iaa - fix per-node CPU counter reset in rebalance_wq_table()
- crypto: qat - use swab32 macro
- ALSA: hda: Notify IEC958 Default PCM switch state changes
- ASoC: rsnd: Fix potential out-of-bounds access of component_dais[]
- PCI: Enable AtomicOps only if Root Port supports them
- PCI: imx6: Keep Root Port MSI capability with iMSI-RX to work around
hardware bug
- PCI: aspeed: Fix IRQ domain leak on platform_get_irq() failure
- dt-bindings: PCI: imx6q-pcie: Fix maxItems of clocks and clock-names
- PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found
- gpu: nova-core: bitfield: fix broken Default implementation
- selftests/mm: skip migration tests if NUMA is unavailable
- Documentation: fix a hugetlbfs reservation statement
- Docs/admin-guide/mm/damn/lru_sort: fix intervals autotune parameter name
- Docs/mm/damon/index: fix typo: autoamted -> automated
- zram: do not permit params change after init
- selftest: memcg: skip memcg_sock test if address family not supported
- gpu: nova-core: remove redundant `.as_ref()` for `dev_*` print
- gpu: nova-core: fix missing colon in SEC2 boot debug message
- ALSA: scarlett2: Add missing sentinel initializer field
- ASoC: qcom: audioreach: explicitly enable speaker protection modules
- ASoC: SOF: compress: return the configured codec from get_params
- PCI/NPEM: Set LED_HW_PLUGGABLE for hotplug-capable ports
- tools/sched_ext: Fix off-by-one in scx_sdt payload zeroing
- ASoC: soc-component: re-add pcm_new()/pcm_free()
- ASoC: amd: name back to pcm_new()/pcm_free()
- ASoC: amd: ps: fix the pcm device numbering for acp pdm dmic
- ALSA: usb-audio: qcom: Fix incorrect type in enable_audio_stream
- PCI: tegra194: Fix polling delay for L2 state
- PCI: tegra194: Increase LTSSM poll time on surprise link down
- PCI: tegra194: Disable LTSSM after transition to Detect on surprise link
down
- PCI: tegra194: Don't force the device into the D0 state before L2
- PCI: tegra194: Disable PERST# IRQ only in Endpoint mode
- PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-
select"
- PCI: tegra194: Disable direct speed change for Endpoint mode
- PCI: tegra194: Set LTR message request before PCIe link up in Endpoint
mode
- PCI: tegra194: Allow system suspend when the Endpoint link is not up
- PCI: tegra194: Free up Endpoint resources during remove()
- PCI: tegra194: Use DWC IP core version
- PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well
- PCI: tegra194: Disable L1.2 capability of Tegra234 EP
- PCI: tegra194: Fix CBB timeout caused by DBI access before core power-on
- drm/fb-helper: Fix a locking bug in an error path
- PCI: cadence: Add flags for disabling ASPM capability for broken Root
Ports
- PCI: sg2042: Avoid L0s and L1 on Sophgo 2042 PCIe Root Ports
- ASoC: SDCA: Fix cleanup inversion in class driver
- spi: rzv2h-rspi: Fix invalid SPR=0/BRDV=0 clock configuration
- spi: mtk-snfi: unregister ECC engine on probe failure and remove()
callback
- ALSA: sc6000: Keep the programmed board state in card-private data
- dm cache: fix missing return in invalidate_committed's error path
- sched_ext: Track @p's rq lock across set_cpus_allowed_scx ->
ops.set_cpumask
- sched_ext: Fix ops.cgroup_move() invocation kf_mask and rq tracking
- spi: cadence-qspi: Revert the filtering of certain opcodes in ODTR
- crypto: jitterentropy - replace long-held spinlock with mutex
- ALSA: usb-audio: Exclude Scarlett 18i20 1st Gen from SKIP_IFACE_SETUP
- ALSA: hda/realtek - fixed speaker no sound update
- gfs2: Call unlock_new_inode before d_instantiate
- fanotify: avoid/silence premature LSM capability checks
- fanotify: call fanotify_events_supported() before path_permission() and
security_path_notify()
- fuse: fix uninit-value in fuse_dentry_revalidate()
- ktest: Avoid undef warning when WARNINGS_FILE is unset
- ktest: Honor empty per-test option overrides
- ktest: Run POST_KTEST hooks on failure and cancellation
- vfio: selftests: fix crash in vfio_dma_mapping_mmio_test
- rtla/utils: Fix resource leak in set_comm_sched_attr()
- tools/rtla: Generate optstring from long options
- rtla: Fix segfault on multiple SIGINTs
- vfio: selftests: Build tests on aarch64
- gfs2: less aggressive low-memory log flushing
- quota: Fix race of dquot_scan_active() with quota deactivation
- vfio: unhide vdev->debug_root
- gfs2: add some missing log locking
- gfs2: prevent NULL pointer dereference during unmount
- efi/capsule-loader: fix incorrect sizeof in phys array reallocation
- ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine
- arm64: dts: mediatek: mt8365: Describe infracfg-nao as a pure syscon
- ARM: dts: mediatek: mt7623: fix efuse fallback compatible
- memory: tegra124-emc: Fix dll_change check
- memory: tegra30-emc: Fix dll_change check
- arm64: dts: imx8-apalis: Fix LEDs name collision
- arm64: dts: imx91-11x11-evk: change usdhc tuning step for eMMC and SD
- riscv: dts: spacemit: pcie: fix missing power regulator
- arm64: dts: mediatek: mt7988a-bpi-r4pro: fix model string
- arm64: dts: rockchip: Make Jaguar PCIe-refclk pin use pull-up config
- arm64: dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO
(M.2 W_DISABLE1)
- iommufd: vfio compatibility extension check for noiommu mode
- arm64: dts: qcom: sm6125-xiaomi-ginkgo: Remove board-id
- arm64: dts: qcom: sm6125-xiaomi-ginkgo: Correct reserved memory ranges
- arm64: dts: qcom: sm6125-xiaomi-ginkgo: Remove extcon
- arm64: dts: qcom: sm6125-xiaomi-ginkgo: Fix reserved gpio ranges
- arm64: dts: qcom: qcs6490-rubikpi3: Use lt9611 DSI Port B
- arm64: dts: qcom: talos: Add missing clock-names to GCC
- arm64: dts: ti: k3-am62l: include WKUP_UART0 in wakeup peripheral window
- arm64: dts: mediatek: mt6795: Fix gpio-ranges pin count
- arm64: dts: mediatek: mt7981b: Fix gpio-ranges pin count
- arm64: dts: mediatek: mt7986a: Fix gpio-ranges pin count
- iommufd/selftest: Fix page leaks in mock_viommu_{init,destroy}
- arm64: dts: imx8mp-kontron: Fix touch reset configuration on DL devices
- arm64: dts: imx8mp-kontron: Drop vmmc-supply to fix SD card on SMARC
eval carrier
- arm64: dts: imx8mp-hummingboard-pulse/cubox-m: fix vmmc gpio polarity
- arm64: dts: imx8mp-hummingboard-pulse: fix mini-hdmi dsi port reference
- ARM: dts: BCM5301X: Drop extra NAND controller compatible
- arm64: dts: qcom: msm8953-xiaomi-vince: correct wled ovp value
- arm64: dts: qcom: msm8937-xiaomi-land: correct wled ovp value
- arm64: dts: qcom: msm8953-xiaomi-daisy: fix backlight
- firmware: qcom_scm: don't opencode kmemdup
- soc: qcom: ubwc: disable bank swizzling for Glymur platform
- arm64: dts: rockchip: Fix Bluetooth stability on LCKFB TaiShan Pi
- Revert "arm64: dts: rockchip: add SPDIF audio to Beelink A1"
- arm64: dts: rockchip: Correct Fan Supply for Gameforce Ace
- arm64: dts: rockchip: Correct Joystick Axes on Gameforce Ace
- soc: qcom: ocmem: make the core clock optional
- soc: qcom: ocmem: register reasons for probe deferrals
- soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available
- riscv: dts: spacemit: drop incorrect pinctrl for combo PHY
- arm64: dts: rockchip: Fix RK3562 EVB2 model name
- arm64: dts: rockchip: Add mphy reset to ufshc node
- bus: rifsc: fix RIF configuration check for peripherals
- arm64: dts: qcom: arduino-imola: fix faulty spidev node
- Revert "UBUNTU: SAUCE: arm64: dts: add missing denali-oled.dtb to
Makefile"
- arm64: dts: qcom: add missing denali-oled.dtb to Makefile
- arm64: dts: qcom: hamoa: correct Iris corners for the MXC rail
- arm64: dts: qcom: lemans: correct Iris corners for the MXC rail
- arm64: dts: qcom: monaco: correct Iris corners for the MXC rail
- arm64: dts: qcom: sm8550: correct Iris corners for the MXC rail
- arm64: dts: qcom: sm8650: correct Iris corners for the MXC rail
- arm64: dts: qcom: sm8750: correct Iris corners for the MXC rail
- arm64: dts: qcom: kaanapali: Fix GIC_ITS range length
- arm64: dts: qcom: milos: Fix GIC_ITS range length
- arm64: dts: qcom: sm8450: Fix GIC_ITS range length
- arm64: dts: qcom: sm8550: Fix GIC_ITS range length
- arm64: dts: qcom: sm8650: Fix GIC_ITS range length
- arm64: dts: qcom: sm8750: Fix GIC_ITS range length
- arm64: dts: qcom: sm8550: Fix xo clock supply of platform SD host
controller
- arm64: dts: qcom: sm8650: Fix xo clock supply of SD host controller
- arm64: dts: qcom: hamoa: Fix xo clock supply of platform SD host
controller
- arm64: dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes
- arm64: dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes
- arm64: dts: qcom: sm8650: Enable UHS-I SDR50 and SDR104 SD card modes
- arm64: dts: qcom: sm7225-fairphone-fp4: Fix conflicting bias pinctrl
- arm64: dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered
during boot
- arm64: dts: qcom: msm8917-xiaomi-riva: Fix board-id for all bootloader
- arm64: dts: ti: k3-am62p5-sk: Disable MMC1 internal pulls on data pins
- arm64: dts: ti: k3-am62l3-evm: Disable MMC1 internal pulls on data pins
- arm64: dts: ti: k3-am62-lp-sk: Enable internal pulls for MMC0 data pins
- arm64: dts: ti: k3-am62-verdin: Fix SPI_1 GPIO CS pinctrl label
- arm64: dts: freescale: imx8mp-tqma8mpql-mba8mp-ras314: fix UART1 RTS/CTS
muxing
- arm64: dts: imx91: Remove TMU's superfluous sensor ID
- arm64: dts: imx8mp-kontron: Fix boot order for PMIC and RTC
- arm64: dts: imx8dxl-evk: Use audio-graph-card2 for wm8960-2 and wm8960-3
- arm64: dts: imx8mp-evk: Specify ADV7535 register addresses
- arm64: dts: lx2160a: change i2c0 (iic1) pinmux mask to one bit
- arm64: dts: lx2160a: remove duplicate pinmux nodes
- arm64: dts: lx2160a: rename pinmux nodes for readability
- arm64: dts: lx2160a: add sda gpio references for i2c bus recovery
- arm64: dts: lx2160a: change zeros to hexadecimal in pinmux nodes
- arm64: dts: lx2160a: complete pinmux for rcwsr12 configuration word
- arm64: dts: imx8qm-mek: switch Type-C connector power-role to dual
- arm64: dts: imx8qxp-mek: switch Type-C connector power-role to dual
- soc/tegra: cbb: Set ERD on resume for err interrupt
- soc/tegra: cbb: Fix incorrect ARRAY_SIZE in fabric lookup tables
- soc/tegra: cbb: Fix cross-fabric target timeout lookup
- arm64: tegra: Fix RTC aliases
- soc/tegra: pmc: Add kerneldoc for reboot notifier
- soc/tegra: pmc: Correct function names in kerneldoc
- soc/tegra: pmc: Add kerneldoc for wake-up variables
- unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts()
failure
- ocfs2/dlm: validate qr_numregions in dlm_match_regions()
- ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison
- soc: qcom: llcc: fix v1 SB syndrome register offset
- soc: qcom: aoss: compare against normalized cooling state
- arm64: dts: qcom: milos: Add missing CX power domain to GCC
- arm64: dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP
- ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX
- arm64/xor: fix conflicting attributes for xor_block_template
- lib: kunit_iov_iter: fix memory leaks
- ARM: dts: imx27-eukrea: replace interrupts with interrupts-extended
- firmware: arm_ffa: Use the correct buffer size during RXTX_MAP
- fwctl: Fix class init ordering to avoid NULL pointer dereference on
device removal
- ocfs2: fix listxattr handling when the buffer is full
- ocfs2: validate bg_bits during freefrag scan
- ocfs2: validate group add input before caching
- dmaengine: dw-axi-dmac: fix Alignment should match open parenthesis
- dmaengine: dw-axi-dmac: Remove unnecessary return statement from void
function
- phy: apple: apple: Use local variable for ioremap return value
- soundwire: bus: demote UNATTACHED state warnings to dev_dbg()
- soundwire: Intel: test bus.bpt_stream before assigning it
- dmaengine: mxs-dma: Fix missing return value from
of_dma_controller_register()
- soundwire: cadence: Clear message complete before signaling waiting
thread
- tracing: move __printf() attribute on __ftrace_vbprintk()
- tracing: Rebuild full_name on each hist_field_name() call
- hte: tegra194: remove Kconfig dependency on Tegra194 SoC
- [Config] Enable CONFIG_HTE_TEGRA194 on armhf
- remoteproc: xlnx: Fix sram property parsing
- stop_machine: Fix the documentation for a NULL cpus argument
- remoteproc: imx_rproc: Check return value of regmap_attach_dev() in
imx_rproc_mmio_detect_mode()
- ima: check return value of crypto_shash_final() in boot aggregate
- HID: asus: make asus_resume adhere to linux kernel coding standards
- HID: asus: do not abort probe when not necessary
- workqueue: devres: Add device-managed allocate workqueue
- power: supply: max77705: Drop duplicated IRQ error message
- power: supply: max77705: Free allocated workqueue and fix removal order
- mtd: physmap_of_gemini: Fix disabled pinctrl state check
- ima_fs: Correctly create securityfs files for unsupported hash algos
- dt-bindings: interrupt-controller: arm,gic-v3: Fix EPPI range
- mtd: spi-nor: core: correct the op.dummy.nbytes when check read
operations
- mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation
- mtd: spi-nor: micron-st: add SNOR_CMD_PP_8_8_8_DTR sfdp fixup for
mt35xu512aba
- mtd: spi-nor: swp: check SR_TB flag when getting tb_mask
- mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path
- mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions
- cxl/pci: Check memdev driver binding status in cxl_reset_done()
- mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob
- mtd: spinand: winbond: Clarify when to enable the HS bit
- HID: usbhid: fix deadlock in hid_post_reset()
- ext4: fix miss unlock 'sb->s_umount' in extents_kunit_init()
- ext4: call deactivate_super() in extents_kunit_exit()
- ext4: fix the error handling process in extents_kunit_init).
- ext4: fix possible null-ptr-deref in extents_kunit_exit()
- ext4: fix possible null-ptr-deref in mbt_kunit_exit()
- bpf, arm64: Reject out-of-range B.cond targets
- bpf, arm64: Fix off-by-one in check_imm signed range check
- bpf, arm64: Remove redundant bpf_flush_icache() after pack allocator
finalize
- bpf, riscv: Remove redundant bpf_flush_icache() after pack allocator
finalize
- bpf, sockmap: Fix af_unix iter deadlock
- bpf, sockmap: Fix af_unix null-ptr-deref in proto update
- bpf, sockmap: Take state lock for af_unix iter
- bpf: Fix precedence bug in convert_bpf_ld_abs alignment check
- bpf: Fix NULL deref in map_kptr_match_type for scalar regs
- bpf: allow UTF-8 literals in bpf_bprintf_prepare()
- libbpf: Prevent double close and leak of btf objects
- bpf: Validate node_id in arena_alloc_pages()
- bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT
- perf trace: Fix IS_ERR() vs NULL check bug
- dt-bindings: pinctrl: marvell,armada3710-xb-pinctrl: add missing items
keyword
- pinctrl: pinctrl-pic32: Fix resource leak
- perf trace: Avoid an ERR_PTR in syscall_stats
- pinctrl: microchip-mssio: Fix missing return in probe
- perf test type profiling: Remote typedef on struct
- pinctrl: cy8c95x0: remove duplicate error message
- pinctrl: cy8c95x0: Unify messages with help of dev_err_probe()
- pinctrl: cy8c95x0: Avoid returning positive values to user space
- perf branch: Avoid incrementing NULL
- perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE
trace
- pinctrl: pinconf-generic: Fully validate 'pinmux' property
- pinctrl: realtek: Fix function signature for config argument
- pinctrl: abx500: Fix type of 'argument' variable
- pinctrl: renesas: rzg2l: Fix save/restore of {IOLH,IEN,PUPD,SMT}
registers
- tools build: Correct link flags for libopenssl
- perf lock: Fix option value type in parse_max_stack
- perf stat: Fix opt->value type for parse_cache_level
- memblock: reserve_mem: fix end caclulation in
reserve_mem_release_by_name()
- perf stat: Fix crash on arm64
- perf tools: Fix module symbol resolution for non-zero .text sh_addr
- perf test: Fix ratio_to_prev event parsing test
- perf test: Skip perf data type profiling tests for s390
- perf expr: Return -EINVAL for syntax error in expr__find_ids()
- perf metrics: Make common stalled metrics conditional on having the
event
- ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure
- ipmi: ssif_bmc: fix message desynchronization after truncated response
- ipmi: ssif_bmc: change log level to dbg in irq callback
- perf cgroup: Update metric leader in evlist__expand_cgroup
- pinctrl: sophgo: pinctrl-sg2042: Fix wrong module description
- pinctrl: sophgo: pinctrl-sg2044: Fix wrong module description
- perf maps: Fix fixup_overlap_and_insert that can break sorted by name
order
- perf maps: Fix copy_from that can break sorted by name order
- perf util: Kill die() prototype, dead for a long time
- i3c: master: dw-i3c: Fix missing reset assertion in remove() callback
- i3c: master: dw-i3c: Balance PM runtime usage count on probe failure
- i3c: master: renesas: Fix memory leak in renesas_i3c_i3c_xfers()
- i3c: dw: Fix memory leak in dw_i3c_master_i3c_xfers()
- i3c: master: adi: Fix error propagation for CCCs
- i3c: mipi-i3c-hci: fix IBI payload length calculation for final status
- fs/ntfs3: prevent uninitialized lcn caused by zero len
- backlight: sky81452-backlight: Check return value of
devm_gpiod_get_optional() in sky81452_bl_parse_dt()
- platform/surface: surfacepro3_button: Drop wakeup source on remove
- leds: lgm-sso: Remove duplicate assignments for priv->mmap
- usb: typec: Fix error pointer dereference
- tty: hvc_iucv: fix off-by-one in number of supported devices
- usb: typec: ps883x: Fix Oops at unbind
- platform/x86: panasonic-laptop: Fix OPTD notifier registration and
cleanup
- platform/x86: barco-p50-gpio: normalize return value of gpio_get
- fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()
- mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata()
- nfs/blocklayout: Fix compilation error (`make W=1`) in
bl_write_pagelist()
- sunrpc: Kill RPC_IFDEBUG()
- sunrpc: Fix compilation error (`make W=1`) when dprintk() is no-op
- NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg
- nfsd: use dynamic allocation for oversized NFSv4.0 replay cache
- RDMA/umem: Use consistent DMA attributes when unmapping entries
- greybus: raw: fix use-after-free on cdev close
- greybus: raw: fix use-after-free if write is called after disconnect
- platform/x86: asus-wmi: adjust screenpad power/brightness handling
- platform/x86: asus-wmi: fix screenpad brightness range
- tty: serial: ip22zilog: Fix section mispatch warning
- fs/ntfs3: terminate the cached volume label after UTF-8 conversion
- platform/x86: hp-wmi: fix ignored return values in fan settings
- platform/x86: hp-wmi: avoid cancel_delayed_work_sync from work handler
- platform/x86: hp-wmi: use mod_delayed_work to reset keep-alive timer
- platform/x86: hp-wmi: fix u8 underflow in gpu_delta calculation
- platform/x86: hp-wmi: add locking for concurrent hwmon access
- platform/x86: dell_rbu: avoid uninit value usage in packet_size_write()
- platform/x86: dell-wmi-sysman: bound enumeration string aggregation
- RDMA/core: Prefer NLA_NUL_STRING
- platform/x86: hp-wmi: fix fan table parsing
- dt-bindings: clock: qcom: Add GCC video axi reset clock for Glymur
- clk: qcom: gcc-glymur: Add video axi clock resets for glymur
- clk: qcom: dispcc-glymur: use RCG2 ops for DPTX1 AUX clock source
- clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source
- clk: renesas: r9a09g057: Fix ordering of module clocks array
- clk: renesas: r9a09g056: Fix ordering of module clocks array
- clk: sunxi-ng: sun55i-a523-r: Add missing r-spi module clock
- scsi: sg: Fix sysctl sg-big-buff register during sg_init()
- scsi: sg: Resolve soft lockup issue when opening /dev/sgX
- clk: qcom: dispcc-sc8280xp: remove CLK_SET_RATE_PARENT from
byte_div_clk_src dividers
- clk: qcom: dispcc-glymur: Fix DSI byte clock rate setting
- clk: qcom: dispcc-kaanapali: Fix DSI byte clock rate setting
- clk: qcom: dispcc-milos: Fix DSI byte clock rate setting
- clk: qcom: dispcc-sm4450: Fix DSI byte clock rate setting
- clk: qcom: dispcc[01]-sa8775p: Fix DSI byte clock rate setting
- clk: renesas: r9a09g057: Remove entries for WDT{0,2,3}
- scsi: target: core: Fix integer overflow in UNMAP bounds check
- scsi: ufs: rockchip,rk3576-ufshc: dt-bindings: Add new mphy reset item
- dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs
- clk: qcom: gcc-sc8180x: Add missing GDSCs
- clk: qcom: gcc-sc8180x: Use retention for USB power domains
- clk: qcom: gcc-sc8180x: Use retention for PCIe power domains
- clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk
- clk: qcom: dispcc-sm8250: Enable parents for pixel clocks
- clk: imx: imx6q: Fix device node reference leak in pll6_bypassed()
- clk: imx: imx6q: Fix device node reference leak in
of_assigned_ldb_sels()
- clk: imx8mq: Correct the CSI PHY sels
- um: Fix potential race condition in TLB sync
- x86/um: fix vDSO installation
- clk: qoriq: avoid format string warning
- clk: xgene: Fix mapping leak in xgene_pllclk_init()
- clk: spacemit: ccu_mix: fix inverted condition in ccu_mix_trigger_fc()
- f2fs: avoid reading already updated pages during GC
- printk_ringbuffer: Fix get_data() size sanity check
- clk: qcom: gdsc: Fix error path on registration of multiple pm
subdomains
- lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug()
- f2fs: fix data loss caused by incorrect use of nat_entry flag
- f2fs: fix to preserve previous reserve_{blocks,node} value when remount
- scsi: hpsa: Enlarge controller and IRQ name buffers
- drm/amd/display: Fix parameter mismatch in panel self-refresh helper
- clk: qcom: gcc-x1e80100: Keep GCC USB QTB clock always ON
- clk: visconti: pll: initialize clk_init_data to zero
- f2fs: allow empty mount string for Opt_usr|grp|projjquota
- f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show()
- drm/i915/wm: Verify the correct plane DDB entry
- virt: arm-cca-guest: fix error check for RSI_INCOMPLETE
- crypto: eip93 - fix hmac setkey algo selection
- crypto: sa2ul - Fix AEAD fallback algorithm names
- crypto: ccp - copy IV using skcipher ivsize
- sh: Include <linux/io.h> in dac.h
- erofs: unify lcn as u64 for 32-bit platforms
- tools: hv: Fix cross-compilation
- Drivers: hv: vmbus: fix hyperv_cpuhp_online variable shadowing
- arm64: dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT
- arm64: dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT
- arm64: dts: imx8mp-navqp: Correct PAD settings for PMIC_nINT
- arm64: dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT
- arm64: dts: imx8mp-edm-g: Correct PAD settings for PMIC_nINT
- arm64: dts: imx8mp-aristainetos3a-som-v1: Correct PAD settings for
PMIC_nINT
- arm64: dts: imx8mp-nitrogen-som: Correct PAD settings for PMIC_nINT
- arm64: dts: imx8mp-sr-som: Correct PAD settings for PMIC_nINT
- arm64: dts: imx8mp-ultra-mach-sbc: Correct PAD settings for PMIC_nINT
- arm64: dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT
- arm64: dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for
PMIC_nINT
- PCMCIA: Fix garbled log messages for KERN_CONT
- reset: amlogic: t7: Fix null reset ops
- arm64: dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT
- arm64: dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT
- arm64: dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT
- arm64: dts: marvell: armada-37xx: use 'usb2-phy' in USB3 controller's
phy-names
- pwm: stm32: Fix rounding issue for requests with inverted polarity
- net/sched: act_mirred: fix wrong device for mac_header_xmit check in
tcf_blockcast_redir
- macvlan: fix macvlan_get_size() not reserving space for
IFLA_MACVLAN_BC_CUTOFF
- net/sched: sch_cake: fix NAT destination port not being updated in
cake_update_flowkeys
- nexthop: fix IPv6 route referencing IPv4 nexthop
- net: airoha: Wait for NPU PPE configuration to complete in
airoha_ppe_offload_setup()
- net/sched: taprio: fix use-after-free in advance_sched() on schedule
switch
- net: dsa: remove redundant netdev_lock_ops() from conduit ethtool ops
- net: enetc: correct the command BD ring consumer index
- net: enetc: fix NTMP DMA use-after-free issue
- ksmbd: fix use-after-free in smb2_open during durable reconnect
- tcp: move tp->chrono_type next tp->chrono_stat[]
- tcp: inline tcp_chrono_start()
- tcp: annotate data-races in tcp_get_info_chrono_stats()
- tcp: add data-race annotations around tp->data_segs_out and
tp->total_retrans
- tcp: add data-races annotations around tp->reordering, tp->snd_cwnd
- tcp: annotate data-races around tp->snd_ssthresh
- tcp: annotate data-races around tp->delivered and tp->delivered_ce
- tcp: add data-race annotations for TCP_NLA_SNDQ_SIZE
- tcp: annotate data-races around tp->bytes_sent
- tcp: annotate data-races around tp->bytes_retrans
- tcp: annotate data-races around tp->dsack_dups
- tcp: annotate data-races around tp->reord_seen
- tcp: annotate data-races around tp->srtt_us
- tcp: annotate data-races around tp->timeout_rehash
- tcp: annotate data-races around (tp->write_seq - tp->snd_nxt)
- tcp: annotate data-races around tp->plb_rehash
- ice: fix 'adjust' timer programming for E830 devices
- ice: update PCS latency settings for E825 10G/25Gb modes
- ice: fix double-free of tx_buf skb
- ice: fix PHY config on media change with link-down-on-close
- ice: fix ICE_AQ_LINK_SPEED_M for 200G
- ice: fix race condition in TX timestamp ring cleanup
- ice: fix potential NULL pointer deref in error path of
ice_set_ringparam()
- i40e: don't advertise IFF_SUPP_NOFCS
- iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2
- e1000e: Unroll PTP in probe error handling
- ipv6: fix possible UAF in icmpv6_rcv()
- af_unix: Drop all SCM attributes for SOCKMAP.
- sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks
- pppoe: drop PFC frames
- net/mlx5: Fix HCA caps leak on notifier init failure
- net: airoha: Fix possible TX queue stall in airoha_qdma_tx_napi_poll()
- netfilter: nft_osf: restrict it to ipv4
- netfilter: conntrack: remove sprintf usage
- netfilter: xtables: restrict several matches to inet family
- netfilter: nat: use kfree_rcu to release ops
- ipvs: fix MTU check for GSO packets in tunnel mode
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check
- net/sched: sch_dualpi2: drain both C-queue and L-queue in
dualpi2_change()
- arm64: dts: amlogic: meson-axg: Add missing cache information to cpu0
- arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number
- vfio/pci: Clean up DMABUFs before disabling function
- pwm: atmel-tcb: Cache clock rates and mark chip as atomic
- ksmbd: destroy tree_conn_ida in ksmbd_session_destroy()
- ksmbd: destroy async_ida in ksmbd_conn_free()
- ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open
- ksmbd: scope conn->binding slowpath to bound sessions only
- net: validate skb->napi_id in RX tracepoints
- bnge: fix initial HWRM sequence
- bnge: remove unsupported backing store type
- sctp: fix sockets_allocated imbalance after sk_clone()
- net/rds: zero per-item info buffer before handing it to visitors
- ice: fix timestamp interrupt configuration for E825C
- ice: perform PHY soft reset for E825C ports at initialization
- ice: fix ready bitmap check for non-E822 devices
- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g
- net_sched: sch_hhf: annotate data-races in hhf_dump_stats()
- net/sched: sch_pie: annotate data-races in pie_dump_stats()
- net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats()
- net/sched: sch_red: annotate data-races in red_dump_stats()
- net/sched: sch_sfb: annotate data-races in sfb_dump_stats()
- net: airoha: Move ndesc initialization at end of airoha_qdma_init_tx()
- net: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue()
- net: dsa: realtek: rtl8365mb: fix mode mask calculation
- net: airoha: Move ndesc initialization at end of
airoha_qdma_init_rx_queue()
- net: airoha: Rework the code flow in airoha_remove() and in
airoha_probe() error path
- net: airoha: Add size check for TX NAPIs in airoha_qdma_cleanup()
- net: mana: Init link_change_work before potential error paths in probe
- net: mana: Init gf_stats_work before potential error paths in probe
- net: mana: Guard mana_remove against double invocation
- net: mana: Don't overwrite port probe error with add_adev result
- net: mana: Fix EQ leak in mana_remove on NULL port
- vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting
- virtio_net: sync rss_trailer.max_tx_vq on queue_pairs change via
VQ_PAIRS_SET
- nfp: fix swapped arguments in nfp_encode_basic_qdr() calls
- tcp: send a challenge ACK on SEG.ACK > SND.NXT
- tipc: fix double-free in tipc_buf_append()
- vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll()
- nstree: fix func. parameter kernel-doc warnings
- eventpoll: use hlist_is_singular_node() in __ep_remove()
- eventpoll: split __ep_remove()
- eventpoll: kill __ep_remove()
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}()
- eventpoll: move epi_fget() up
- fs/adfs: validate nzones in adfs_validate_bblk()
- rtc: abx80x: Disable alarm feature if no interrupt attached
- kbuild: builddeb - avoid recompiles for non-cross-compiles
- tools/power turbostat: Fix AMD RAPL regression on big systems
- fbdev: offb: fix PCI device reference leak on probe failure
- tools/power turbostat: Fix unrecognized option '-P'
- tools/power turbostat: Fix --cpu-set 0 regression on HT systems
- tools/power turbostat: Fix --cpu-set 1 regression on HT systems
- kbuild: Never respect CONFIG_WERROR / W=e to fixdep
- mailbox: mtk-vcp-mailbox: Fix the return value in mtk_vcp_mbox_xlate()
- mailbox: mtk-cmdq: Fix CURR and END addr for task insert case
- mailbox: mailbox-test: free channels on probe error
- sched/psi: fix race between file release and pressure write
- cgroup/rdma: fix integer overflow in rdmacg_try_charge()
- cgroup/cpuset: record DL BW alloc CPU for attach rollback
- mailbox: add sanity check for channel array
- mailbox: mailbox-test: handle channel errors consistently
- mailbox: mailbox-test: don't free the reused channel
- mailbox: mailbox-test: initialize struct earlier
- mailbox: mailbox-test: make data_ready a per-instance variable
- fsnotify: fix inode reference leak in fsnotify_recalc_mask()
- btrfs: fix bytes_may_use leak in move_existing_remap()
- btrfs: fix bytes_may_use leak in do_remap_reloc_trans()
- btrfs: don't clobber errors in add_remap_tree_entries()
- btrfs: fix double-decrement of bytes_may_use in
submit_one_async_extent()
- tracing: branch: Fix inverted check on stat tracer registration
- nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers
- netfilter: nf_tables: use list_del_rcu for netlink hooks
- rculist: add list_splice_rcu() for private lists
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit
phase
- netfilter: nf_tables: add hook transactions for device deletions
- nvme-pci: fix missed admin queue sq doorbell write
- drm/amdgpu: avoid double drm_exec_fini() in userq validate
- drm/amdgpu/gmc: Fix AMDGPU_GART_PLACEMENT_LOW to not overlap with VRAM
- drm/amd/pm: fix missing fine-grained dpm table flag on aldebaran
- drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG
- drm/amdgpu/uvd3.1: Don't validate the firmware when already validated
- drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2)
- drm/amdgpu: Only send RMA CPER when threshold is exceeded
- netfilter: xt_policy: fix strict mode inbound policy matching
- netfilter: nf_conntrack_sip: don't use simple_strtoul
- spi: rzv2h-rspi: Fix silent failure in clock setup error path
- ASoC: amd: acp: Add DMI quirk for Valve Steam Deck OLED
- ASoC: SOF: Intel: add an empty adr_link
- spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ
- ASoC: tas2764: Mark die temp register as volatile
- ASoC: tas2770: Fix order of operations for temperature calculation
- drm/sysfb: ofdrm: fix PCI device reference leaks
- drm/color-mgmt: Typo s/R332/RGB332/
- arm64/scs: Fix potential sign extension issue of advance_loc4
- spi: spi-mem: Add a packed command operation
- mtd: spinand: Add support for packed read data ODTR commands
- mtd: spinand: winbond: Set the packed page read flag to W35N02/04JW
- mtd: spinand: winbond: Fix ODTR write VCR on W35NxxJW
- ACPICA: Provide #defines for EINJV2 error types
- ACPI: APEI: EINJ: Fix EINJV2 memory error injection
- cdrom, scsi: sr: propagate read-only status to block layer via
set_disk_ro()
- spi: axiado: replace usleep_range() with udelay() in IRQ path
- netdevsim: zero initialize struct iphdr in dummy sk_buff
- net/sched: netem: fix probability gaps in 4-state loss model
- net/sched: netem: fix queue limit check to include reordered packets
- net/sched: netem: only reseed PRNG when seed is explicitly provided
- net/sched: netem: validate slot configuration
- net/sched: netem: fix slot delay calculation overflow
- net/sched: netem: check for negative latency and jitter
- net: airoha: fix BQL imbalance in TX path
- net: airoha: stop net_device TX queue before updating CPU index
- net: airoha: fix typo in function name
- net: airoha: Do not wake all netdev TX queues in
airoha_qdma_wake_netdev_txqs()
- net: airoha: Do not read uninitialized fragment address in
airoha_dev_xmit()
- net/sched: sch_choke: annotate data-races in choke_dump_stats()
- net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats()
- vrf: Fix a potential NPD when removing a port from a VRF
- net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()
- net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit
- spi: amlogic-spisg: initialize completion before requesting IRQ
- NFC: trf7970a: Ignore antenna noise when checking for RF field
- net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind
- neigh: let neigh_xmit take skb ownership
- tcp: make probe0 timer handle expired user timeout
- netpoll: fix IPv6 local-address corruption
- ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams
- sched/fair: Fix wakeup_preempt_fair() vs delayed dequeue
- sched/fair: Clear rel_deadline when initializing forked entities
- net: mctp i2c: check length before marking flow active
- md/raid1,raid10: don't fail devices for invalid IO errors
- md: add fallback to correct bitmap_ops on version mismatch
- md: factor bitmap creation away from sysfs handling
- md/md-bitmap: split bitmap sysfs groups
- md/md-bitmap: add a none backend for bitmap grow
- s390/mm: Fix phys_to_folio() usage in do_secure_storage_access()
- net: phy: dp83869: fix setting CLK_O_SEL field.
- drm/amd/display: properly handle family setting for early GC 11.5.4
- drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings
- drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings
- drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings
- drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring
- drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring
- drm/amdgpu/vcn: set no_user_fence for VCN v4.0.5 enc ring
- drm/amdgpu/vcn: set no_user_fence for VCN v5.0.0 enc ring
- drm/amdgpu/vcn: set no_user_fence for VCN v5.0.1 enc ring
- drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring
- drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring
- drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring
- drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring
- drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring
- drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.5 ring
- drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.0 ring
- drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.1 ring
- drm/amdgpu/jpeg: set no_user_fence for JPEG v5.3.0 ring
- drm/amd/pm: Add fine grained flag to SMU v13.0.6
- io_uring/napi: cap busy_poll_to 10 msec
- ASoC: cs35l56: Fix illegal writes to OTP_MEM registers
- net: psp: check for device unregister when creating assoc
- net: psp: require admin permission for dev-set and key-rotate
- ASoC: codecs: ab8500: Fix casting of private data
- netfilter: skip recording stale or retransmitted INIT
- sctp: discard stale INIT after handshake completion
- net/sched: sch_cake: annotate data-races in cake_dump_stats() (I)
- net/sched: sch_cake: annotate data-races in cake_dump_stats() (II)
- net/sched: sch_cake: annotate data-races in cake_dump_stats() (III)
- net/sched: sch_cake: annotate data-races in cake_dump_stats() (IV)
- net/sched: sch_cake: annotate data-races in cake_dump_stats() (V)
- netconsole: return count instead of strnlen(buf, count) from store
callbacks
- netconsole: avoid clobbering userdatum value on truncated write
- netconsole: propagate device name truncation in dev_name_store()
- netconsole: restore userdatum value on update_userdata() failure
- ALSA: hda/conexant: Fix missing error check for jack detection
- ALSA: hda: cs35l56: Fix uninitialized value in cs35l56_hda_read_acpi()
- ALSA: hda/tas2781: Fix incorrect bit update for non-book-zero or book 0
pages >1
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup
- drm/amd/display: Allow embedded connectors without DDC
- drm/amd/display: Allow DCE link encoder without AUX registers
- drm/amd/display: Allow constructing DCE6 link encoder without DDC
- drm/amd/display: Allow constructing DCE8 link encoder without DDC
- drm/amd/display: Read EDID from VBIOS embedded panel info
- drm/amd/display: Use EDID from VBIOS embedded panel info
- drm/xe: Use XE_WEDGED_MODE_UPON_ANY_HANG_NO_RESET enum instead of magic
number
- drm/xe: Drop registration of guc_submit_wedged_fini from
xe_guc_submit_wedge()
- drm/xe/debugfs: Correct printing of register whitelist ranges
- drm/xe: Fix potential NULL deref in
xe_exec_queue_tlb_inval_last_fence_put_unlocked
- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()
- drm/xe/eustall: Fix drm_dev_put called before stream disable in close
- drm/xe/gsc: Fix BO leak on error in query_compatibility_version()
- drm/xe/xelp: Fix Wa_18022495364
- net: airoha: Do not return err in ndo_stop() callback
- bonding: print churn state via netlink
- bonding: 3ad: implement proper RCU rules for port->aggregator
- page_pool: fix memory-provider leak in page_pool_create_percpu() error
path
- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING
- iavf: stop removing VLAN filters from PF on interface down
- iavf: wait for PF confirmation before removing VLAN filters
- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler
- ice: fix NULL pointer dereference in ice_reset_all_vfs()
- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw
- ice: fix missing SMA pin initialization in DPLL subsystem
- ice: fix SMA and U.FL pin state changes affecting paired pin
- ice: fix missing dpll notifications for SW pins
- dpll: export __dpll_pin_change_ntf() for use under dpll_lock
- ice: add dpll peer notification for paired SMA and U.FL pins
- net: tls: fix strparser anchor skb leak on offload RX setup failure
- sfc: fix error code in efx_devlink_info_running_versions()
- net/sched: cls_flower: revert unintended changes
- kselftest/arm64: Include <asm/ptrace.h> for user_gcs definition
- arm64: Reserve an extra page for early kernel mapping
- futex: Drop CLONE_THREAD requirement for private default hash alloc
- PCI: Initialize temporary device in new_id_store()
- workqueue: fix devm_alloc_workqueue() va_list misuse
- net/sched: sch_pie: annotate more data-races in pie_dump_stats()
- sched/fair: Fix wakeup_preempt_fair() for not waking up task
- crypto: af_alg - Cap AEAD AD length to 0x80000000
- i40e: Cleanup PTP pins on probe failure
- workqueue: Fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path
- net: ena: PHC: Fix potential use-after-free in get_timestamp
- cgroup/cpuset: Reset DL migration state on can_attach() failure
- netfilter: nf_conntrack_sip: get helper before allocating expectation
- audit: fix incorrect inheritable capability in CAPSET records
- net: ena: PHC: Check return code before setting timestamp output
- cgroup/dmem: Return -ENOMEM on failed pool preallocation
- idpf: fix double free and use-after-free in aux device error paths
- cgroup/cpuset: Reserve DL bandwidth only for root-domain moves
- Revert "ACPI: CPPC: Adjust debug messages in amd_set_max_freq_ratio() to
warn"
- netfilter: nft_ct: fix missing expect put in obj eval
- net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled
- audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV
- cgroup/cpuset: Return only actually allocated CPUs during partition
invalidation
- KVM: x86: Swap the dst and src operand for MOVNTDQA
- KVM: Reject wrapped offset in kvm_reset_dirty_gfn()
- KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer
arithmetic
- KVM: x86: Fix Xen hypercall tracepoint argument assignment
- HID: pass the buffer size to hid_report_raw_event
- HID: core: introduce hid_safe_input_report()
- rseq: Revert to historical performance killing behaviour
- rseq: Implement read only ABI enforcement for optimized RSEQ V2 mode
- rseq: Reenable performance optimizations conditionally
- HID: core: Fix size_t specifier in hid_report_raw_event()
- ata: libata-scsi: fix requeue of deferred ATA PASS-THROUGH commands
- media: staging: imx: configure src_mux in csi_start
- Bluetooth: btmtk: accept too short WMT FUNC_CTRL events
- nvme-apple: Reset q->sq_tail during queue init
- smb/client: fix possible infinite loop and oob read in symlink_data()
- drm/loongson: Use managed KMS polling
- drm: Replace old pointer to new idr
- drm/bridge: imx8qxp-pxl2dpi: avoid ERR_PTR with device_node cleanup
- drm/i915/dp: Fix VSC dynamic range signaling for RGB formats
- drm/amd/display: Wrap DCN32 phantom-plane allocation in
DC_RUN_WITH_PREEMPTION_ENABLED
- drm/ttm: Fix ttm_bo_swapout() infinite LRU walk on swapout failure
- platform/x86: intel: Move debugfs register before creating devices
- platform/x86: lenovo-wmi-helpers: Move gamezone enums to wmi-helpers
- platform/x86: lenovo-wmi-helpers: Fix memory leak in
lwmi_dev_evaluate_int()
- platform/x86: lenovo-wmi-other: Balance IDA id allocation and free
- platform/x86: lenovo-wmi-other: Balance component bind and unbind
- platform/x86: lenovo-wmi-other: Zero initialize WMI arguments
- platform/x86: lenovo-wmi-other: Fix tunable_attr_01 struct members
- platform/x86: lenovo-wmi-other: Add Attribute ID helper functions
- platform/x86: lenovo-wmi-other: Limit adding attributes to supported
devices
- accel/rocket: Fix prep_bo ioctl leaking positive return from
dma_resv_wait_timeout()
- ALSA: hda/realtek: Add mute LED quirk for HP Pavilion Laptop 16-ag0xxx
- ALSA: hda/realtek: Add quirk for Samsung Galaxy Book5 360 headphone
- ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans
- ALSA: usb-audio: Bound MIDI endpoint descriptor scans
- ALSA: usb-audio: qcom: Check offload mapping failures
- btrfs: only release the dirty pages io tree after successful writes
- ceph: fix a buffer leak in __ceph_setxattr()
- ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size
- ceph: put folios not suitable for writeback
- io-wq: check that the predecessor is hashed in io_wq_remove_pending()
- iommu/amd: Bounds-check devid in __rlookup_amd_iommu()
- x86/kexec: Push kjump return address even for non-kjump kexec
- xfs: fix memory leak on error in xfs_alloc_zone_info()
- virt: sev-guest: Do not use host-controlled page order in cleanup path
- powerpc/warp: Fix error handling in pika_dtm_thread
- netfs: fix error handling in netfs_extract_user_iter()
- nfsd: fix GET_DIR_DELEGATION when VFS leases are disabled
- nfsd: fix file change detection in CB_GETATTR
- nfsd: update mtime/ctime on CLONE in presense of delegated attributes
- nfsd: update mtime/ctime on COPY in presence of delegated attributes
- irqchip/riscv-imsic: Clear interrupt move state during CPU offlining
- irqchip/meson-gpio: Use the correct register in
meson_s4_gpio_irq_set_type()
- irqchip/gic-v5: Move LPI allocation into the LPI domain
- irqchip/gic-v5: Support range allocation for LPIs
- irqchip/gic-v5: Allocate ITS parent LPIs as a range
- libceph: Fix potential out-of-bounds access in osdmap_decode()
- libceph: Fix potential null-ptr-deref in decode_choose_args()
- libceph: Fix potential out-of-bounds access in __ceph_x_decrypt()
- libceph: Fix potential out-of-bounds access in crush_decode()
- libceph: handle rbtree insertion error in decode_choose_args()
- iommu/vt-d: Disable DMAR for Intel Q35 IGFX
- iommu/vt-d: Fix oops due to out of scope access
- iommu/vt-d: Avoid NULL pointer dereference or refcount corruption
- iommu: Fix NULL group->domain dereference in pci_dev_reset_iommu_done()
- iommu: Replace per-group resetting_domain with per-gdev blocked flag
- iommu: Fix WARN_ON in __iommu_group_set_domain_nofail() due to reset
- iommu: Fix pasid attach in pci_dev_reset_iommu_prepare/done()
- iommu: Fix nested pci_dev_reset_iommu_prepare/done()
- iommu: Fix ATS invalidation timeouts during __iommu_remove_group_pasid()
- drm/i915: skip __i915_request_skip() for already signaled requests
- drm/panfrost: Fix wait_bo ioctl leaking positive return from
dma_resv_wait_timeout()
- drm/xe/dma-buf: handle empty bo and UAF races
- drm/xe/dma-buf: fix UAF with retry loop
- drm/ttm: Fix ttm_bo_shrink() infinite LRU walk on backup failure
- drm/ttm: Convert -EAGAIN from dmem_cgroup_try_charge to -ENOSPC
- drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup
- drm/gma500/oaktrail_lvds: fix hang on init failure
- drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init
- arm_mpam: Fix monitor instance selection when checking for hardware NRDY
- arm_mpam: Pretend that NRDY is always hardware managed
- arm_mpam: Improve check for whether or not NRDY is hardware managed
- arm_mpam: Fix false positive assert failure during mpam_disable()
- arm_mpam: Check whether the config array is allocated before destroying
it
- eventfs: Simplify code using guard()s
- eventfs: Use list_add_tail_rcu() for SRCU-protected children list
- smb: client: Use FullSessionKey for AES-256 encryption key derivation
- spi: sifive: Simplify clock handling with devm_clk_get_enabled()
- spi: sifive: fix controller deregistration
- tracefs: Removed unused 'ret' variable in eventfs_iterate()
- workqueue: Annotate alloc_workqueue_va() with __printf(1, 0)
- selftests/bpf: Remove test_access_variable_array
- netfs: Fix potential uninitialised var in netfs_extract_user_iter()
- Linux 7.0.10
* Resolute update: v7.0.10 upstream stable release (LP: #2156385) //
CVE-2026-45846
- bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst()
* Resolute update: v7.0.10 upstream stable release (LP: #2156385) //
CVE-2026-45845
- net/sched: taprio: fix NULL pointer dereference in class dump
* Resolute update: v7.0.10 upstream stable release (LP: #2156385) //
CVE-2026-45844
- netfilter: arp_tables: fix IEEE1394 ARP payload parsing
* Resolute update: v7.0.10 upstream stable release (LP: #2156385) //
CVE-2026-46242
- eventpoll: fix ep_remove struct eventpoll / struct file UAF
* Resolute update: v7.0.10 upstream stable release (LP: #2156385) //
CVE-2026-45843
- slip: bound decode() reads against the compressed packet length
* Resolute update: v7.0.10 upstream stable release (LP: #2156385) //
CVE-2026-45842
- slip: reject VJ receive packets on instances with no rstate array
* Resolute update: v7.0.10 upstream stable release (LP: #2156385) //
CVE-2026-45841
- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO
* Resolute update: v7.0.10 upstream stable release (LP: #2156385) //
CVE-2026-45840
- openvswitch: cap upcall PID array size and pre-size vport replies
* Resolute update: v7.0.10 upstream stable release (LP: #2156385) //
CVE-2026-45839
- bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec()
* Resolute update: v7.0.10 upstream stable release (LP: #2156385) //
CVE-2026-45838
- bpf: fix end-of-list detection in cgroup_storage_get_next_key()
* Resolute update: v7.0.9 upstream stable release (LP: #2156006)
- Linux 7.0.8
- HID: pidff: Fix integer overflow in pidff_rescale
- media: uvcvideo: Enable VB2_DMABUF for metadata stream
- drm/msm/hdmi: Fix wrong CTRL1 register used in writing info frames
- media: rzv2h-ivc: Avoid double job scheduling
- media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0
- media: rzv2h-ivc: Write AXIRX_PIXFMT once
- media: rzv2h-ivc: Fix FM_STOP register write
- media: rzv2h-ivc: Fix concurrent buffer list access
- media: mali-c55: Initialize the ISP in enable_streams()
- media: mali-c55: Fix Iridix bypass macros
- media: renesas: vsp1: Fix NULL pointer deref on module unload
- media: renesas: vin: Fix RAW8 (again)
- media: i2c: ov8856: free control handler on error in
ov8856_init_controls()
- media: dt-bindings: rockchip,vdec: Add alternative reg-names order for
RK35{76,88}
- media: dt-bindings: rockchip,vdec: Mark reg-names required for
RK35{76,88}
- media: chips-media: wave5: fix a potential memory leak in
wave5_vdi_init()
- media: chips-media: wave5: add missing spinlock protection for
send_eos_event()
- media: chips-media: wave5: add missing spinlock protection for
handle_dynamic_resolution_change()
- arm64: dts: freescale: imx95-toradex-smarc: fix PMIC_SD2_VSEL label
position
- drm/gpusvm: Allow device pages to be mapped in mixed mappings after
system pages
- drm/gpusvm: Force unmapping on error in drm_gpusvm_get_pages
- spi: bcm63xx: fix controller deregistration
- spi: atmel: fix controller deregistration
- arm64: dts: lx2160a-cex7/lx2162a-sr-som: fix usd-cd & gpio pinmux
- regulator: mt6357: fix OF node reference imbalance
- spi: st-ssc4: fix controller deregistration
- regulator: max77650: fix OF node reference imbalance
- media: ti: vpe: Add missing v4l2_device_unregister in vip_remove()
- media: rc: streamzap: Error handling in probe
- media: i2c: imx283: Enter full standby when stopping streaming
- regulator: bq257xx: fix OF node reference imbalance
- regulator: rk808: fix OF node reference imbalance
- media: videobuf2: Set vma_flags in vb2_dma_sg_mmap
- media: mali-c55: Fully reset the ISP configuration
- media: intel/ipu6: fix error pointer dereference
- media: i2c: imx283: Fix hang when going from large to small resolution
- regulator: act8945a: fix OF node reference imbalance
- regulator: s2dos05: fix OF node reference imbalance
- regulator: bd9571mwv: fix OF node reference imbalance
- spi: lantiq-ssc: fix controller deregistration
- spi: meson-spicc: fix controller deregistration
- spi: qup: fix controller deregistration
- arm64: dts: ti: k3-am69-aquila-clover: Fix DP regulator enable GPIO
- spi: at91-usart: fix controller deregistration
- media: ipu-bridge: Add upside-down sensor DMI quirk for Dell XPS 13 9340
and XPS 14 9440
- spi: amlogic-spisg: fix controller deregistration
- spi: aspeed-smc: fix controller deregistration
- drm/colorop: Preserve bypass value in duplicate_state()
- drm/atomic: Add affected colorops with affected planes
- platform/x86: hp-wmi: Ignore backlight and FnLock events
- vsock/virtio: fix MSG_PEEK ignoring skb offset when calculating bytes to
copy
- arm64: dts: broadcom: bcm2712-d-rpi-5-b: add fixes for
pinctrl/pinctrl_aon
- arm64: dts: broadcom: bcm2712-d-rpi-5-b: update uart10 interrupt
- media: pci: zoran: fix potential memory leak in zoran_probe()
- media: dib8000: avoid division by 0 in dib8000_set_dds()
- media: i2c: imx412: Assert reset GPIO during probe
- media: staging: imx: request mbus_config in csi_start
- media: i2c: ov08d10: fix image vertical start setting
- media: i2c: ov08d10: fix runtime PM handling in probe
- media: omap3isp: drop the use count of v4l2 pipeline
- media: iris: fix QCOM_MDT_LOADER dependency
- media: qcom: camss: Fix csid clock configuration for sa8775p
- media: qcom: camss: Fix csid IRQ offset for sa8775p
- media: qcom: iris: increase H265D_MAX_SLICE to fix H.265 decoding on
SC7280
- media: venus: fix QCOM_MDT_LOADER dependency
- media: iris: Fix dma_free_attrs() size in iris_hfi_queues_init()
- media: iris: switch to hardware mode after firmware boot
- media: qcom: camss: Add missing clocks for VFE lite on sa8775p
- spi: mxs: fix controller deregistration
- spi: mt65xx: fix controller deregistration
- spi: dln2: fix controller deregistration
- spi: s3c64xx: fix controller deregistration
- spi: fsl-espi: fix controller deregistration
- spi: omap2-mcspi: fix controller deregistration
- spi: pic32: fix controller deregistration
- spi: ep93xx: fix controller deregistration
- spi: mtk-nor: fix controller deregistration
- spi: pl022: fix controller deregistration
- spi: sh-hspi: fix controller deregistration
- spi: bcmbca-hsspi: fix controller deregistration
- spi: coldfire-qspi: fix controller deregistration
- spi: npcm-pspi: fix controller deregistration
- spi: cavium-thunderx: fix controller deregistration
- spi: pic32-sqi: fix controller deregistration
- spi: sprd: fix controller deregistration
- spi: sh-msiof: fix controller deregistration
- spi: slave-mt27xx: fix controller deregistration
- spi: img-spfi: fix controller deregistration
- spi: mpfs: fix controller deregistration
- spi: octeon: fix controller deregistration
- spi: imx: fix runtime pm leak on probe deferral
- spi: mxic: fix controller deregistration
- spi: orion: fix controller deregistration
- spi: orion: fix runtime pm leak on unbind
- spi: orion: fix clock imbalance on registration failure
- spi: cadence: fix controller deregistration
- spi: cadence-quadspi: fix controller deregistration
- spi: cadence: fix unclocked access on unbind
- spi: cadence: fix clock imbalance on probe failure
- spi: cadence-quadspi: fix runtime pm disable imbalance on probe failure
- spi: cadence-quadspi: fix clock imbalance on probe failure
- spi: cadence-quadspi: fix runtime pm and clock imbalance on unbind
- drm/colorop: Fix blob property reference tracking in state lifecycle
- drm/imx: parallel-display: Prefer bus format set via legacy "interface-
pix-fmt" DT property
- drm/msm: always recover the gpu
- drm/v3d: Reject empty multisync extension to prevent infinite loop
- drm/i915/psr: Init variable to avoid early exit from et alignment loop
- drm/amd/display: fix math_mod() using arg1 instead of arg2
- drm/amd: Add missing firmware declaration for PSP v15.0.0
- drm/amdgpu: Use NBIF offset for register RCC_STRAP0_RCC_DEV0_EPF0_STRAP0
.
- drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count.
- drm/amdgpu: gate VM CPU HDP flush on reset lock
- drm/amd/pm: fix incorrect FeatureCtrlMask setting on smu v14.0.x
- drm/amdkfd: Add upper bound check for num_of_nodes
- drm/amdgpu/vce: Prevent partial address patches
- drm/amd/display: Change dither policy for 10 bpc output back to
dithering
- drm/appletbdrm: Use kvzalloc for big allocations
- drm/amdgpu: Avoid reset in AMDGPU unload path for APUs with GFX V11 and
higher.
- drm/udl: Increase GET_URB_TIMEOUT
- drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked()
- drm/xe/bo: Fix bo leak on unaligned size validation in
xe_bo_init_locked()
- drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise
- drm/radeon: add missing revision check for CI
- drm/amdgpu: zero-initialize GART table on allocation
- drm/exynos: remove bridge when component_add fails
- drm/amdgpu/userq: fix access to stale wptr mapping
- drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds
- drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ
- drm/bridge: tda998x: Use __be32 for audio port OF property pointer
- drm/sti: remove bridge when sti_hda component_add fails
- drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds
- drm/amdkfd: Make all TLB-flushes heavy-weight
- drm/amdgpu/pm: add missing revision check for CI
- drm/amdgpu/pm: align Hawaii mclk workaround with radeon
- arm64: dts: qcom: kodiak: Fix PCIe1 PHY ref clock voting
- arm64: dts: qcom: lemans: Correct QUP interrupt numbers
- arm64: dts: ti: k3-am62a7-sk: Fix pin name in comment from M19 to N22
- arm64: dts: ti: k3-am69-aquila-dev: Fix DP regulator enable GPIO
- batman-adv: tp_meter: fix tp_num leak on kmalloc failure
- sched_ext: Use HK_TYPE_DOMAIN_BOOT to detect isolcpus= domain isolation
- usb: typec: tcpm: reset internal port states on soft reset AMS
- io_uring/zcrx: use guards for locking
- io_uring/zcrx: warn on freelist violations
- kho: fix error handling in kho_add_subtree()
- EDAC/versalnet: Refactor memory controller initialization and cleanup
- spi: uniphier: Simplify clock handling with devm_clk_get_enabled()
- spi: uniphier: fix controller deregistration
- cgroup: Increment nr_dying_subsys_* from rmdir context
- sched_ext: Skip tasks with stale task_rq in bypass_lb_cpu()
- perf build: fix "argument list too long" in second location
- mm/vma: do not try to unmap a VMA if mmap_prepare() invoked from mmap()
- vsock/virtio: fix length and offset in tap skb for split packets
- drm/amdgpu/vcn3: Avoid overflow on msg bound check
- drm/amdgpu/vcn4: Avoid overflow on msg bound check
- Linux 7.0.9
* Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
CVE-2026-46214
- vsock/virtio: fix accept queue count leak on transport mismatch
* Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
CVE-2026-46207
- vsock/virtio: fix empty payload in tap skb for non-linear buffers
* Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
CVE-2026-46234
- vsock: fix buffer size clamping order
* Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
CVE-2026-46223
- cgroup: Defer css percpu_ref kill on rmdir until cgroup is depopulated
* Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
CVE-2026-46221
- EDAC/versalnet: Fix device name memory leak
* Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
CVE-2026-46231
- batman-adv: bla: put backbone reference on failed claim hash insert
* Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
CVE-2026-46233
- batman-adv: bla: only purge non-released claims
* Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
CVE-2026-46212
- batman-adv: bla: prevent use-after-free when deleting claims
* Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
CVE-2026-46238
- batman-adv: stop caching unowned originator pointers in BAT IV
* Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
CVE-2026-46208
- batman-adv: stop tp_meter sessions during mesh teardown
* Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
CVE-2026-46206
- batman-adv: reject new tp_meter sessions during teardown
* Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
CVE-2026-46198
- batman-adv: fix integer overflow on buff_pos
* Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
CVE-2026-46227
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in
SCTP_SENDALL
* Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
CVE-2026-46220
- drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission
* Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
CVE-2026-46215
- drm: Set old handle to NULL before prime swap in change_handle
* Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
CVE-2026-46201
- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import()
* Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
CVE-2026-46224
- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure
* Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
CVE-2026-46197
- drm/amdkfd: validate SVM ioctl nattr against buffer size
* Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
CVE-2026-46209
- drm/gem: Fix inconsistent plane dimension calculation in
drm_gem_fb_init_with_funcs()
* Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
CVE-2026-46230
- drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg
* Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
CVE-2026-46199
- drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg
* Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
CVE-2026-46204
- drm/amdgpu/vcn4: Prevent OOB reads when parsing IB
* Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
CVE-2026-46218
- drm/amdgpu: Add bounds checking to ib_{get,set}_value
* Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
CVE-2026-46229
- drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure
* Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
CVE-2026-46211
- drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata()
* Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
CVE-2026-46203
- spi: cadence-quadspi: fix unclocked access on unbind
* Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
CVE-2026-46219
- spi: mpc52xx: fix use-after-free on unbind
* Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
CVE-2026-46200
- spi: mpc52xx: fix controller deregistration
* Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
CVE-2026-46241
- spi: mpc52xx: fix use-after-free on registration failure
* Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
CVE-2026-46225
- spi: rspi: fix controller deregistration
* Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
CVE-2026-46226
- spi: fsl: fix controller deregistration
* Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
CVE-2026-46228
- spi: ch341: fix devres lifetime
* Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
CVE-2026-46216
- drm/xe/hdcp: Add NULL check for media_gt in
intel_hdcp_gsc_check_status()
* Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
CVE-2026-46210
- media: iris: fix use-after-free of fmt_src during MBPF check
* Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
CVE-2026-46240
- media: iris: Fix use-after-free in iris_release_internal_buffers()
* Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
CVE-2026-46235
- media: saa7164: add ioremap return checks and cleanups
* Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
CVE-2026-46222
- media: rockchip: rkcif: Add missing MUST_CONNECT flag to pads
* Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
CVE-2026-46239
- media: i2c: ov5647: Fix runtime PM refcount leak in s_ctrl
* Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
CVE-2026-46236
- media: rc: xbox_remote: heed DMA restrictions
* Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
CVE-2026-46205
- staging: media: atomisp: Disallow all private IOCTLs
* Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
CVE-2026-46202
- HID: appletb-kbd: run inactivity autodim from workqueues
* Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
CVE-2026-46213
- HID: appletb-kbd: fix UAF in inactivity-timer cleanup path
* Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
CVE-2026-46232
- HID: playstation: Clamp num_touch_reports
* Resolute update: v7.0.7 upstream stable release (LP: #2155988)
- ACPI: arm64: cpuidle: Tolerate platforms with no deep PSCI idle states
- ACPI: scan: Use acpi_dev_put() in object add error paths
- ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO
- ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug
- ACPI: video: force native backlight on HP OMEN 16 (8A44)
- iommufd: Fix a race with concurrent allocation and unmap
- wifi: mt76: mt7925: fix incorrect TLV length in CLC command
- spi: rockchip: fix controller deregistration
- ksmbd: rewrite stop_sessions() with restartable iteration
- flow_dissector: do not dissect PPPoE PFC frames
- smb: client/smbdirect: fix MR registration for coalesced SG lists
- wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr
- wifi: mt76: mt7925: fix incorrect length field in txpower command
- wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work
- wifi: ath5k: do not access array OOB
- ALSA: usb-audio: midi2: Restart output URBs on resume
- ALSA: usb-audio: Fix UAC3 cluster descriptor size check
- usb: dwc3: Move GUID programming after PHY initialization
- USB: omap_udc: DMA: Don't enable burst 4 mode
- USB: serial: option: add Telit Cinterion LE910Cx compositions
- usb: typec: tcpm: fix debug accessory mode detection for sink ports
- ALSA: hda: cs35l56: Propagate ASP TX source control errors
- ALSA: hda/realtek: Fix speaker silence after S3 resume on Xiaomi Mi
Laptop Pro 15
- ALSA: firewire-tascam: Do not drop unread control events
- ALSA: core: Serialize deferred fasync state checks
- ALSA: seq: Fix UMP group 16 filtering
- powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o
- x86/efi: Restore IRQ state in EFI page fault handler
- xfrm: provide message size for XFRM_MSG_MAPPING
- selinux: fix avdcache auditing
- selinux: don't reserve xattr slot when we won't fill it
- selinux: shrink critical section in sel_write_load()
- selinux: prune /sys/fs/selinux/checkreqprot
- selinux: prune /sys/fs/selinux/disable
- selinux: prune /sys/fs/selinux/user
- selinux: allow multiple opens of /sys/fs/selinux/policy
- io_uring/kbuf: support min length left for incremental buffers
- io_uring/tw: serialize ctx->retry_llist with ->uring_lock
- LoongArch: KVM: Fix missing EMULATE_FAIL in kvm_emu_mmio_read()
- rust: drm: gem: clean up GEM state in init failure case
- rust: allow `clippy::collapsible_match` globally
- rust: allow `clippy::collapsible_if` globally
- rust: pin-init: internal: move alignment check to `make_field_check`
- spi: syncuacer: fix controller deregistration
- spi: sun4i: fix controller deregistration
- spi: zynq-qspi: fix controller deregistration
- spi: ti-qspi: fix controller deregistration
- spi: sun6i: fix controller deregistration
- spi: tegra114: fix controller deregistration
- spi: zynqmp-gqspi: fix controller deregistration
- spi: tegra20-sflash: fix controller deregistration
- spi: s3c64xx: fix NULL-deref on driver unbind
- staging: rtl8723bs: os_dep: avoid NULL pointer dereference in
rtw_cbuf_alloc
- staging: vme_user: fix root device leak on init failure
- KVM: arm64: Fix kvm_vcpu_initialized() macro parameter
- arm64: signal: Preserve POR_EL0 if poe_context is missing
- mm/hugetlb_cma: round up per_node before logging it
- LoongArch: Fix SYM_SIGFUNC_START definition for 32BIT
- LoongArch: KVM: Compile switch.S directly into the kernel
- mptcp: pm: ADD_ADDR rtx: skip inactive subflows
- perf/x86/intel: Improve validation and configuration of ACR masks
- selftests/rseq: Don't run tests with runner scripts outside of the
scripts
- rseq: Set rseq::cpu_id_start to 0 on unregistration
- rseq: Protect rseq_reset() against interrupts
- rseq: Don't advertise time slice extensions if disabled
- selftests/rseq: Make registration flexible for legacy and optimized mode
- selftests/rseq: Skip tests if time slice extensions are not available
- selftests/rseq: Validate legacy behavior
- selftests/rseq: Expand for optimized RSEQ ABI v2
- pseries/papr-hvpipe: Fix race with interrupt handler
- pseries/papr-hvpipe: Fix & simplify error handling in papr_hvpipe_init()
- pseries/papr-hvpipe: Fix the usage of copy_to_user()
- net: libwx: use request_irq for VF misc interrupt
- netpoll: pass buffer size to egress_dev() to avoid MAC truncation
- ovl: fix verity lazy-load guard broken by fsverity_active() semantic
change
- parisc: Fix IRQ leak in LASI driver
- x86/efi: Fix graceful fault handling after FPU softirq changes
- hwmon: (ltc2992) Clamp threshold writes to hardware range
- hwmon: (ltc2992) Fix u32 overflow in power read path
- clk: rk808: fix OF node reference imbalance
- hwmon: (corsair-psu) Close HID device on probe errors
- af_unix: Reject SIOCATMARK on non-stream sockets
- arm64/fpsimd: ptrace: zero target's fpsimd_state, not the tracer's
- pmdomain: mediatek: fix use-after-free in
scpsys_get_bus_protection_legacy()
- block: fix zone write plug removal
- block: only read from sqe on initial invocation of blkdev_uring_cmd()
- cifs: abort open_cached_dir if we don't request leases
- cifs: change_conf needs to be called for session setup
- extcon: ptn5150: handle pending IRQ events during system resume
- gpio: of: clear OF_POPULATED on hog nodes in remove path
- hv: Select CONFIG_SYSFB only for CONFIG_HYPERV_VMBUS
- hv_sock: fix ARM64 support
- hv_sock: Report EOF instead of -EIO for FIN
- hv_sock: Return -EIO for malformed/short packets
- spi: microchip-core-qspi: fix controller deregistration
- spi: microchip-core-spi: fix controller deregistration
- tracefs: Fix default permissions not being applied on initial mount
- udf: reject descriptors with oversized CRC length
- x86/boot/e820: Re-enable BIOS fallback if e820 table is empty
- thermal: core: Free thermal zone ID later during removal
- thermal/drivers/sprd: Fix temperature clamping in
sprd_thm_temp_to_rawdata
- thermal/drivers/sprd: Fix raw temperature clamping in
sprd_thm_rawdata_to_temp
- spi: topcliff-pch: fix controller deregistration
- spi: topcliff-pch: fix use-after-free on unbind
- tracing/fprobe: Avoid kcalloc() in rcu_read_lock section
- tracing/fprobe: Remove fprobe from hash in failure path
- tracing/fprobe: Unregister fprobe even if memory allocation fails
- tracing/probes: Limit size of event probe to 3K
- tracing/fprobe: Check the same type fprobe on table as the unregistered
one
- clk: imx: imx8-acm: fix flags for acm clocks
- clk: microchip: mpfs-ccc: fix out of bounds access during output
registration
- cpuidle: powerpc: avoid double clear when breaking snooze
- ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk
table
- ASoC: ES8389: convert to devm_clk_get_optional() to get clock
- ASoC: fsl_easrc: fix comment typo
- ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error
- ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop
- ASoC: qcom: q6apm: remove child devices when apm is removed
- btrfs: do not mark inode incompressible after inline attempt fails
- dm: don't report warning when doing deferred remove
- dm: fix a buffer overflow in ioctl processing
- dm-verity-fec: correctly reject too-small FEC devices
- dm-verity-fec: correctly reject too-small hash devices
- dm-verity-fec: fix corrected block count stat
- dm-verity-fec: fix the size of dm_verity_fec_io::erasures
- isofs: validate Rock Ridge CE continuation extent against volume size
- iommufd: Fix return value of iommufd_fault_fops_write()
- iommu/vt-d: Block PASID attachment to nested domain with dirty tracking
- iommu/arm-smmu-v3: Add a missing dma_wmb() for hitless STE update
- lib/crc: tests: Make crc_kunit test only the enabled CRC variants
- lib/scatterlist: fix temp buffer in extract_user_to_sg()
- nvme-apple: drop invalid put of admin queue reference count
- nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free
- pmdomain: core: Fix detach procedure for virtual devices in genpd
- psp: strip variable-length PSP header in psp_dev_rcv()
- s390/debug: Reject zero-length input in debug_input_flush_fn()
- s390/debug: Reject zero-length input before trimming a newline
- KVM: x86: Do IRR scan in __kvm_apic_update_irr even if PIR is empty
- mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values
- mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values
- mm/damon/stat: detect and use fresh enabled value
- PCI: Update saved_config_space upon resource assignment
- PCI/AER: Clear only error bits in PCIe Device Status
- PCI/AER: Stop ruling out unbound devices as error source
- PCI/ASPM: Fix pci_clear_and_set_config_dword() usage
- power: supply: max17042: avoid overflow when determining health
- perf/x86/intel: Always reprogram ACR events to prevent stale masks
- perf/x86/intel: Disable PMI for self-reloaded ACR events
- perf/x86/intel: Enable auto counter reload for DMR
- RDMA/ionic: bound node_desc sysfs read with %.64s
- RDMA/ionic: Fix typo in format string
- remoteproc: imx_rproc: Fix NULL vs IS_ERR() bug in imx_rproc_addr_init()
- remoteproc: k3: Fix NULL vs IS_ERR() bug in k3_reserved_mem_init()
- sched_ext: idle: Recheck prev_cpu after narrowing allowed mask
- sched_ext: Use dsq->first_task instead of list_empty() in
dispatch_enqueue() FIFO-tail
- selftests: mptcp: check output: catch cmd errors
- selftests: mptcp: pm: restrict 'unknown' check to pm_nl_ctl
- mptcp: fastclose msk when linger time is 0
- mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure
- mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure
- mptcp: sockopt: set timestamp flags on subflow socket, not msk
- mptcp: sockopt: increase seq in mptcp_setsockopt_all_sf
- mptcp: fix rx timestamp corruption on fastopen
- mptcp: pm: prio: skip closed subflows
- mptcp: pm: kernel: reset fullmesh counter after flush
- mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0
- mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker
- mptcp: pm: ADD_ADDR rtx: return early if no retrans
- f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode()
- f2fs: fix false alarm of lockdep on cp_global_sem lock
- f2fs: fix fiemap boundary handling when read extent cache is incomplete
- f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage
- f2fs: fix incorrect file address mapping when inline inode is unwritten
- f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks()
- f2fs: fix uninitialized kobject put in f2fs_init_sysfs()
- f2fs: refactor f2fs_move_node_folio function
- f2fs: fix inline data not being written to disk in writeback path
- KVM: arm64: Wake-up from WFI when iqrchip is in userspace
- KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value
- KVM: arm64: Fix initialisation order in __pkvm_init_finalise()
- KVM: arm64: Fix FEAT_SPE_FnE to use PMSIDR_EL1.FnE, not PMSVer
- KVM: arm64: Fix FEAT_Debugv8p9 to check DebugVer, not PMUVer
- LoongArch: KVM: Cap KVM_CAP_NR_VCPUS by KVM_CAP_MAX_VCPUS
- LoongArch: KVM: Fix "unreliable stack" for kvm_exc_entry
- LoongArch: KVM: Fix HW timer interrupt lost when inject interrupt by
software
- LoongArch: KVM: Move unconditional delay into timer clear scenery
- LoongArch: KVM: Use kvm_set_pte() in kvm_flush_pte()
- LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup
- mmc: core: Adjust MDT beyond 2025
- mmc: core: Add quirk for incorrect manufacturing date
- mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs
- crypto: qat - fix indentation of macros in qat_hal.c
- crypto: qat - fix firmware loading failure for GEN6 devices
- hfsplus: fix held lock freed on hfsplus_fill_super()
- 8021q: use RCU for egress QoS mappings
- printk: add print_hex_dump_devel()
- crypto: caam - guard HMAC key hex dumps in hash_digest_key
- net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY()
- rust: pin-init: fix incorrect accessor reference lifetime
- Linux 7.0.7
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-43490
- ksmbd: validate inherited ACE SID length
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46174
- x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op
cache
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46110
- net: stmmac: Prevent NULL deref when RX memory exhausted
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46153
- 8021q: delete cleared egress QoS mappings
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46169
- hfsplus: fix uninit-value by validating catalog record size
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46188
- octeon_ep_vf: add NULL check for napi_build_skb()
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-45837
- bpf: Fix use-after-free in arena_vm_close on fork
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46156
- LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang()
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46147
- KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu()
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46175
- f2fs: fix fsck inconsistency caused by FGGC of node block
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46194
- f2fs: fix node_cnt race between extent node destroy and writeback
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46170
- mptcp: pm: ADD_ADDR rtx: free sk if last
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46158
- mptcp: pm: ADD_ADDR rtx: always decrease sk refcount
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46168
- mptcp: fix scheduling with atomic in timestamp sockopt
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46189
- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46133
- RDMA/rxe: Reject unknown opcodes before ICRC processing
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46114
- RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46127
- RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp()
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46176
- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46178
- RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq()
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46181
- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46145
- RDMA/mana: Validate rx_hash_key_len
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46117
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46126
- RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss()
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46144
- RDMA/mana: Fix error unwind in mana_ib_create_qp_rss()
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46141
- powerpc/xive: fix kmemleak caused by incorrect chip_data lookup
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46183
- mm/damon/sysfs-schemes: protect path kfree() with damon_sysfs_lock
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46121
- mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46131
- KVM: x86: check for nEPT/nNPT in slow flush hypercalls
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46139
- smb: client: use kzalloc to zero-initialize security descriptor buffer
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46105
- scsi: mpt3sas: Limit NVMe request size to 2 MiB
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46171
- riscv: kvm: fix vector context allocation leak
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46112
- RDMA/hns: Fix unlocked call to hns_roce_qp_remove()
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46165
- openvswitch: vport: fix self-deadlock on release of tunnel ports
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46161
- md/raid10: fix divide-by-zero in setup_geo() with zero far_copies
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-43492
- lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl()
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46124
- isofs: validate block number from NFS file handle in isofs_export_iget
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46130
- dm-verity-fec: fix reading parity bytes split across blocks (take 3)
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46106
- eventfs: Hold eventfs_mutex and SRCU when remount walks events
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46107
- dm-thin: fix metadata refcount underflow
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46160
- btrfs: fix missing last_unlink_trans update when removing a directory
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46164
- btrfs: fix double free in create_space_info_sub_group() error path
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46129
- btrfs: fix double free in create_space_info() error path
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46159
- btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to
info-leak
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46143
- ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46148
- spi: microchip-core-qspi: control built-in cs manually
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46192
- spi: microchip-core-qspi: don't attempt to transmit during emulated
read-only dual/quad operations
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46162
- ice: fix double free in ice_sf_eth_activate() error path
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46273
- ibmveth: Disable GSO for packets with small MSS
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46191
- fbcon: Avoid OOB font access if console rotation fails
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46134
- platform/chrome: cros_ec_typec: Init mutex in Thunderbolt registration
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-43495
- net: wwan: t7xx: validate port_count against message length in
t7xx_port_enum_msg_handler
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-43502
- net/rds: handle zerocopy send cleanup before the message is queued
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46120
- ip6_gre: Use cached t->net in ip6erspan_changelink().
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46142
- net: libwx: fix VF illegal register access
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46118
- pseries/papr-hvpipe: Fix null ptr deref in
papr_hvpipe_dev_create_handle()
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46182
- pseries/papr-hvpipe: Prevent kernel stack memory leak to userspace
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46184
- sound: ua101: fix division by zero at probe
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-43498
- accel/ivpu: Disallow re-exporting imported GEM objects
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46132
- net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in
rtnl_fill_vfinfo
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46190
- mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show()
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46150
- fanotify: fix false positive on permission events
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-45836
- Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb()
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-45834
- Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-45835
- Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb()
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46138
- Bluetooth: hci_event: Fix OOB read and infinite loop in
hci_le_create_big_complete_evt
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46111
- Bluetooth: hci_conn: fix potential UAF in create_big_sync
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46140
- Bluetooth: btmtk: validate WMT event SKB length before struct access
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46186
- Bluetooth: virtio_bt: validate rx pkt_type header length
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46123
- Bluetooth: virtio_bt: clamp rx length before skb_put
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46104
- selinux: use sk blob accessor in socket permission helpers
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46193
- xfrm: ah: account for ESN high bits in async callbacks
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46172
- ipv6: xfrm6: release dst on error in xfrm6_rcv_encap()
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46116
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46154
- sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46157
- ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46109
- usb: ulpi: fix memory leak on ulpi_register() error paths
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46146
- ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3()
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46167
- usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46151
- usb: usblp: fix heap leak in IEEE 1284 device ID via short response
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46180
- wifi: brcmfmac: Fix potential use-after-free issue when stopping
watchdog task
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46122
- wifi: b43: enforce bounds check on firmware key index in b43_rx()
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46125
- wifi: mac80211: remove station if connection prep fails
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46166
- wifi: mac80211: use safe list iteration in radar detect work
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46187
- wifi: rsi: fix kthread lifetime race between self-exit and external-stop
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46152
- wifi: mac80211: drop stray 'static' from fast-RX rx_result
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46163
- wifi: b43legacy: enforce bounds check on firmware key index in RX path
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46136
- wifi: mt76: mt7921: fix a potential clc buffer length underflow
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46173
- exit: prevent preemption of oopsing TASK_DEAD task
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-43496
- net/sched: sch_red: Replace direct dequeue call with peek and
qdisc_dequeue_peeked
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46113
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46179
- ASoC: SOF: Don't allow pointer operations on unconfigured streams
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46196
- tracepoint: balance regfunc() on func_add() failure in
tracepoint_add_func()
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-43497
- fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46108
- ipmi:si: Return state to normal if message allocation fails
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46128
- ipmi: Check event message buffer response for bad data
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46177
- ipmi: Add limits to event and receive message requests
* Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
CVE-2026-46149
- scsi: target: configfs: Bound snprintf() return in
tg_pt_gp_members_show()
* Ubuntu 26.04 linux kernel has non-functional nova-core GPU driver enabled,
conflicting with nouveau (LP: #2150845)
- [Config] Disable NOVA_CORE
* CVE-2026-46244
- netfilter: nft_inner: Fix IPv6 inner_thoff desync
* CVE-2026-46137
- mptcp: pm: ADD_ADDR rtx: allow ID 0
- mptcp: pm: ADD_ADDR rtx: fix potential data-race
* CVE-2026-46185
- smb/client: fix out-of-bounds read in symlink_data()
* CVE-2026-46195
- smb: client: validate dacloffset before building DACL pointers
* CVE-2026-46289
- lib/scatterlist: fix length calculations in extract_kvec_to_sg
* CVE-2026-46119
- libceph: Fix slab-out-of-bounds access in auth message processing
* CVE-2026-46135
- nvmet-tcp: fix race between ICReq handling and queue teardown
* CVE-2026-46155
- smb/client: fix out-of-bounds read in smb2_compound_op()
* CVE-2026-46115
- block: add pgmap check to biovec_phys_mergeable
* CVE-2026-46243
- smb: client: reject userspace cifs.spnego descriptions
Date: 2026-06-20 23:42:11.349059+00:00
Changed-By: Mehmet Basaran <mehmet.basaran at canonical.com>
Signed-By: Andy Whitcroft <apw at canonical.com>
https://launchpad.net/ubuntu/+source/linux/7.0.0-28.28
-------------- next part --------------
Sorry, changesfile not available.
More information about the Resolute-changes
mailing list