0xn0l

📂 /home/bagno/mail/bagno-company.com/jagonzalez/cur

✎ EDIT: 1789987071.M153688P2131961.ambar.servidorlinux16.com,S=597087,W=607316:2,S ← BACK

Envelope-to: jagonzalez@bagno-company.com
Delivery-date: Mon, 21 Sep 2026 07:37:51 -0300
To: jagonzalez@bagno-company.com
Subject: [storagecentral.bagno.company.com] 76 package update(s) available
MIME-Version: 1.0
Content-type: text/plain; charset=UTF-8
Content-transfer-encoding: 8bit
Message-Id: <20260921103743.887FC7A04EF@storagecentral.bagno.company.com>
Date: Mon, 21 Sep 2026 07:37:43 -0300 (-03)
From: root <soporte@bagno-company.com>

apticron report [Mon, 21 Sep 2026 07:37:23 -0300]
========================================================================

apticron has detected that some packages need upgrading on:

storagecentral.bagno.company.com 
	[ 192.168.1.70 ]

The following packages are currently pending an upgrade:

base-files 12.4+deb12u15
	bash 5.2.15-2+b13
	btrfs-progs 6.2-1+deb12u2
	busybox 1:1.35.0-4+deb12u1+b1
	chrony 4.3-2+deb12u3
	clamav-base 1.4.3+dfsg-1~deb12u2
	clamav-daemon 1.4.3+dfsg-1~deb12u2
	clamav-freshclam 1.4.3+dfsg-1~deb12u2
	clamdscan 1.4.3+dfsg-1~deb12u2
	dirmngr 2.2.40-1.1+deb12u2
	distro-info-data 0.58+deb12u7
	dpkg 1.21.23
	gnupg 2.2.40-1.1+deb12u2
	gnupg-l10n 2.2.40-1.1+deb12u2
	gnupg-utils 2.2.40-1.1+deb12u2
	gpg 2.2.40-1.1+deb12u2
	gpg-agent 2.2.40-1.1+deb12u2
	gpgconf 2.2.40-1.1+deb12u2
	gpgsm 2.2.40-1.1+deb12u2
	gpgv 2.2.40-1.1+deb12u2
	gpg-wks-client 2.2.40-1.1+deb12u2
	gpg-wks-server 2.2.40-1.1+deb12u2
	grub2-common 2.06-13+deb12u2
	grub-common 2.06-13+deb12u2
	grub-pc 2.06-13+deb12u2
	grub-pc-bin 2.06-13+deb12u2
	intel-microcode 3.20251111.1~deb12u1
	libbytes-random-secure-perl 0.29-4~deb13u1~deb12u1
	libc6 2.36-9+deb12u14
	libcap2 1:2.66-4+deb12u3+b1
	libcap2-bin 1:2.66-4+deb12u3+b1
	libc-bin 2.36-9+deb12u14
	libc-l10n 2.36-9+deb12u14
	libclamav12 1.4.3+dfsg-1~deb12u2
	libcurl3-gnutls 7.88.1-10+deb12u15
	libcurl4 7.88.1-10+deb12u15
	libglib2.0-0 2.74.6-2+deb12u9
	libgraphite2-3 1.3.14-1+deb12u1
	libhtml-parser-perl 3.81-1+deb12u1
	libnss-myhostname 252.39-1~deb12u2
	libnss-resolve 252.39-1~deb12u2
	libnss-systemd 252.39-1~deb12u2
	libpam0g 1.5.2-6+deb12u2
	libpam-modules 1.5.2-6+deb12u2
	libpam-modules-bin 1.5.2-6+deb12u2
	libpam-runtime 1.5.2-6+deb12u2
	libpython3.11 3.11.2-6+deb12u8
	libpython3.11-minimal 3.11.2-6+deb12u8
	libpython3.11-stdlib 3.11.2-6+deb12u8
	libsystemd0 252.39-1~deb12u2
	libsystemd-shared 252.39-1~deb12u2
	libudev1 252.39-1~deb12u2
	libxml2 2.9.14+dfsg-1.3~deb12u6
	libxml-libxml-perl 2.0207+dfsg+really+2.0134-1+deb12u1
	libxslt1.1 1.1.35-1+deb12u4
	linux-image-6.12.95+deb12-amd64 6.12.95-1~bpo12+1
	linux-image-amd64 6.12.95-1~bpo12+1
	locales 2.36-9+deb12u14
	login 1:4.13+dfsg1-1+deb12u2
	openmediavault 7.7.24-7
	openssh-client 1:9.2p1-2+deb12u10
	openssh-server 1:9.2p1-2+deb12u10
	openssh-sftp-server 1:9.2p1-2+deb12u10
	passwd 1:4.13+dfsg1-1+deb12u2
	python3.11 3.11.2-6+deb12u8
	python3.11-minimal 3.11.2-6+deb12u8
	python3-xmltodict 0.13.0-1.1~deb12u1
	rsync 3.2.7-1+deb12u6
	sed 4.9-1+deb12u1
	sudo 1.9.13p3-1+deb12u4
	systemd 252.39-1~deb12u2
	systemd-resolved 252.39-1~deb12u2
	systemd-sysv 252.39-1~deb12u2
	tzdata 2026b-0+deb12u1
	udev 252.39-1~deb12u2
	wireless-regdb 2026.05.30-1~deb12u1

========================================================================

Package Details:

apt-listchanges: Leyendo lista de cambios...
apt-listchanges: Changelogs
---------------------------

--- Cambios de busybox ---
busybox (1:1.35.0-4+deb12u1) bookworm; urgency=high

* Non-maintainer upload by the LTS Team.
  * Import/Backport patches for:
    - CVE-2022-48174 - stack overflow (Closes: #1059049)
    - CVE-2023-42363 - use-after-free (Closes: #1059050)
    - CVE-2023-42364 - use-after-free (Closes: #1059051)
      This patch also covers CVE-2023-42365 (Closes: #1059052)

-- Tobias Frost <tobi@debian.org>  Mon, 02 Mar 2026 07:59:41 +0100

--- Cambios de gnupg2 (dirmngr gnupg gnupg-l10n gnupg-utils gpg gpg-agent gpgconf gpgsm gpgv gpg-wks-client gpg-wks-server) ---
gnupg2 (2.2.40-1.1+deb12u2) bookworm; urgency=high

* Address four issues from https://gpg.fail, including:
    + Fix CVE-2025-68973 (Closes: #1124221)
    + Avoid potential downgrade to SHA1 in 3rd party key signatures.
    + Error out on unverified output for non-detached signatures.
    + Do not use a default when asking for another output filename.
  * d/control: Point Vcs-Git to the correct branch

-- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Thu, 01 Jan 2026 15:54:00 +0100

--- Cambios de intel-microcode ---
intel-microcode (3.20251111.1~deb12u1) bookworm; urgency=medium

* Backport to bookworm
  * debian/rules: revert use of /usr/lib/firmware for deb12

-- Henrique de Moraes Holschuh <hmh@debian.org>  Sat, 22 Nov 2025 22:51:21 -0300

intel-microcode (3.20251111.1) unstable; urgency=high

* New upstream microcode datafile 20251111 (closes: #1120589)
    - Fixes for unspecified functional issues on several Intel, Intel
      Core and Intel Xeon processor models.
    - Fixes errata RPL070/ADL083/LNL047/ALR054/SPR154/EMR147:
      REP SCASB, REP CMPSB may return incorrect results when racing
      memory access with another core or thread, on Raptor Lake, Arrow
      Lake, Lunar Lake, 4th/5th gen Xeon Scalable and maybe other
      processor models
  * New microcodes:
    + sig 0x000a06e1, pf_mask 0x97, 2025-06-27, rev 0x1000273, size 1635328
  * Updated microcodes:
    + sig 0x000806f8, pf_mask 0x87, 2025-05-29, rev 0x2b000650, size 593920
    + sig 0x000806f7, pf_mask 0x87, 2025-05-29, rev 0x2b000650
    + sig 0x000806f6, pf_mask 0x87, 2025-05-29, rev 0x2b000650
    + sig 0x000806f5, pf_mask 0x87, 2025-05-29, rev 0x2b000650
    + sig 0x000806f4, pf_mask 0x87, 2025-05-29, rev 0x2b000650
    + sig 0x000806f8, pf_mask 0x10, 2025-05-29, rev 0x2c000410, size 625664
    + sig 0x000806f6, pf_mask 0x10, 2025-05-29, rev 0x2c000410
    + sig 0x000806f5, pf_mask 0x10, 2025-05-29, rev 0x2c000410
    + sig 0x000806f4, pf_mask 0x10, 2025-05-29, rev 0x2c000410
    + sig 0x00090672, pf_mask 0x07, 2025-10-12, rev 0x003d, size 226304
    + sig 0x00090675, pf_mask 0x07, 2025-10-12, rev 0x003d
    + sig 0x000b06f2, pf_mask 0x07, 2025-10-12, rev 0x003d
    + sig 0x000b06f5, pf_mask 0x07, 2025-10-12, rev 0x003d
    + sig 0x000b06f6, pf_mask 0x07, 2025-10-12, rev 0x003d
    + sig 0x000b06f7, pf_mask 0x07, 2025-10-12, rev 0x003d
    + sig 0x000906a3, pf_mask 0x80, 2025-10-12, rev 0x043a, size 224256
    + sig 0x000906a4, pf_mask 0x80, 2025-10-12, rev 0x043a
    + sig 0x000906a4, pf_mask 0x40, 2025-06-13, rev 0x000b, size 119808
    + sig 0x000a06d1, pf_mask 0x95, 2025-07-23, rev 0x10003f0, size 1670144
    + sig 0x000a06d1, pf_mask 0x20, 2025-08-29, rev 0xa000124, size 1642496
    + sig 0x000a06f3, pf_mask 0x01, 2025-07-30, rev 0x3000382, size 1534976
    + sig 0x000b0671, pf_mask 0x32, 2025-10-08, rev 0x0132, size 219136
    + sig 0x000b0674, pf_mask 0x32, 2025-10-08, rev 0x0132
    + sig 0x000b06a2, pf_mask 0xe0, 2025-10-08, rev 0x6133, size 224256
    + sig 0x000b06a3, pf_mask 0xe0, 2025-10-08, rev 0x6133
    + sig 0x000b06a8, pf_mask 0xe0, 2025-10-08, rev 0x6133
    + sig 0x000b06d1, pf_mask 0x80, 2025-08-28, rev 0x0125, size 80896
    + sig 0x000b06e0, pf_mask 0x19, 2025-05-16, rev 0x001e, size 139264
    + sig 0x000c0662, pf_mask 0x82, 2025-06-30, rev 0x011a, size 90112
    + sig 0x000c06a2, pf_mask 0x82, 2025-06-30, rev 0x011a
    + sig 0x000c0652, pf_mask 0x82, 2025-06-30, rev 0x011a
    + sig 0x000c0664, pf_mask 0x82, 2025-06-30, rev 0x011a
    + sig 0x000c06f2, pf_mask 0x87, 2025-05-29, rev 0x210002c0, size 564224
    + sig 0x000c06f1, pf_mask 0x87, 2025-05-29, rev 0x210002c0
  * source: update symlinks to reflect id of the latest release, 20251111

-- Henrique de Moraes Holschuh <hmh@debian.org>  Thu, 13 Nov 2025 12:48:02 -0300

--- Cambios de libxml2 ---
libxml2 (2.9.14+dfsg-1.3~deb12u6) bookworm; urgency=high

* Non-maintainer upload.
  * Fix CVE-2026-0989: Specially crafted or overly complex schemas can cause
    excessive recursion during parsing, which may lead to stack exhaustion and
    application crashes. The parser now enforces a limit on inclusion depth
    when resolving nested `<include>` directives; the limit defaults to 1000
    and can be modified at runtime with the env variable `RNG_INCLUDE_LIMIT`.
    (Closes: #1125691)
  * Fix CVE-2026-0990: `xmlCatalogXMLResolveURI()` will recurse infinitely if
    a catalog has a URI delegate referencing itself, eventually resulting in a
    call stack overflow. (Closes: #1125695)
  * Fix CVE-2026-0992: Denial of Service vulnerability due to uncontrolled
    resource consumption when processing XML catalogs containing repeated
    `<nextCatalog>` elements pointing to the same downstream catalog.
    (Closes: #1125696)
  * Fix CVE-2025-8732: When a catalog file contains a CATALOG directive
    pointing to itself, `xmlExpandCatalog()` and `xmlParseSGMLCatalog()`
    recursively call each other without bounds until stack overflow.
  * Fix CVE-2026-1757: Memory leak issue in the command parsing logic of the
    xmllint interactive shell.
  * Fix unit tests for CVE-2025-49794 and -49796.
  * Backport some more upstream changes from v2.15.2:
    + Fix memory leak of prefix in `xmlTextWriterStartElementNS()`.
    + Mitigate use-after-free issue in `xmlRelaxNGValidateValue()`.
    + Fix memory leak in `xmlTextWriterStartAttributeNS()`.
    + Schematron: Fix additional memory leaks on error paths.
    + Catalog: Fix stack overflow from self-referencing SGML CATALOG entries.

-- Guilhem Moulin <guilhem@debian.org>  Sun, 07 Jun 2026 17:53:53 +0200

libxml2 (2.9.14+dfsg-1.3~deb12u5) bookworm; urgency=high

* Non-maintainer upload.
  * Fix CVE-2025-9714: Denial of service vulnerability via uncontrolled
    recursion in XPath evaluation.
  * Amend d/p/CVE-2025-7425.patch to better reflect the original fix.

-- Guilhem Moulin <guilhem@debian.org>  Sat, 11 Oct 2025 14:41:17 +0200

--- Cambios de linux-signed-amd64 (linux-image-6.12.95+deb12-amd64 linux-image-amd64) ---
linux-signed-amd64 (6.12.95+1~bpo12+1) bookworm-backports; urgency=medium

* Sign kernel from linux 6.12.95-1~bpo12+1

* Rebuild for bookworm-backports

-- Ben Hutchings <benh@debian.org>  Sun, 05 Jul 2026 20:26:27 +0200

linux (6.12.95-1) trixie-security; urgency=high

* New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.95
    - wifi: mt76: mt7921: avoid undesired changes of the preset regulatory
      domain
    - wifi: mt76: mt7921: fix a potential scan no APs
    - wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync
      (CVE-2026-53101)
    - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios (CVE-2026-53167)
    - gpiolib: Extract gpiochip_choose_fwnode() for wider use
    - gpiolib: Remove redundant assignment of return variable
    - gpio: Fix resource leaks on errors in gpiochip_add_data_with_key()
      (CVE-2026-31732)
    - io_uring/net: Avoid msghdr on op_connect/op_bind async data
    - drm/xe/display: fix oops in suspend/shutdown without display
      (CVE-2026-53142)
    - [arm64] drm/v3d: Store the active job inside the queue's state
    - [arm64] drm/v3d: Skip CSD when it has zeroed workgroups (CVE-2026-53139)
    - eventpoll: use hlist_is_singular_node() in __ep_remove()
    - eventpoll: split __ep_remove()
    - eventpoll: kill __ep_remove()
    - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}()
    - eventpoll: rename ep_remove_safe() back to ep_remove()
    - eventpoll: move epi_fget() up
    - eventpoll: fix ep_remove struct eventpoll / struct file UAF
      (CVE-2026-46242)
    - iio: light: bh1780: fix PM runtime leak on error path (CVE-2026-43355)
    - net: Drop the lock in skb_may_tx_timestamp() (CVE-2026-43216)
    - Reapply "selftest/ptp: update ptp selftest to exercise the gettimex
      options"
    - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING
    - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP
    - debugobjects: Do not fill_pool() if pi_blocked_on
    - debugobjects: Dont call fill_pool() in early boot hardirq context
    - RDMA/bnxt_re: zero shared page before exposing to userspace
    - i2c: stub: Reject I2C block transfers with invalid length
    - [amd64] agp/amd64: Fix broken error propagation in agp_amd64_probe()
      (CVE-2026-53325)
    - bpf: Reject sleepable kprobe_multi programs at attach time
      (CVE-2026-43010)
    - ACPI: scan: Use async schedule function in acpi_scan_clear_dep_fn()
    - regulator: core: fix locking in regulator_resolve_supply() error path
    - dlm: prevent NPD when writing a positive value to event_done
      (CVE-2025-23131)
    - xfs: remove the expr argument to XFS_TEST_ERROR
    - xfs: fix error returns in CoW fork repair
    - Revert "net: bonding: fix use-after-free in bond_xmit_broadcast()"
    - net: bonding: add broadcast_neighbor option for 802.3ad
    - bonding: add support for per-port LACP actor priority
    - bonding: print churn state via netlink
    - bonding: 3ad: implement proper RCU rules for port->aggregator
      (CVE-2026-52975)
    - net: bonding: fix use-after-free in bond_xmit_broadcast() (CVE-2026-31419)
    - bonding: fix NULL pointer dereference in actor_port_prio setting
    - staging: rtl8723bs: fix buffer over-read in rtw_update_protection
      (CVE-2026-53179)
    - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()
      (CVE-2026-53341)
    - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs
    - hv: utils: handle and propagate errors in kvp_register
    - locking/mutex: Remove wakeups from under mutex::wait_lock
    - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued
    - phonet: Pass ifindex to fill_addr().
    - phonet: Pass net and ifindex to phonet_address_notify().
    - net: phonet: free phonet_device after RCU grace period (CVE-2026-53157)
    - rxrpc: Fix the ACK parser to extract the SACK table for parsing
      (CVE-2026-53151)
    - fuse: re-lock request before replacing page cache folio
    - ftrace: Update the mcount_loc check of skipped entries
    - ftrace: Have ftrace pages output reflect freed pages
    - ftrace: Do not over-allocate ftrace memory
    - ftrace: Test mcount_loc addr before calling ftrace_call_addr()
    - ftrace: Check against is_kernel_text() instead of kaslr_offset()
    - net: ipv6: Make udp_tunnel6_xmit_skb() void
    - sctp: disable BH before calling udp_tunnel_xmit_skb() (CVE-2026-53070)
    - iio: light: veml6075: add bounds check to veml6075_it_ms index
    - iio: adc: ti-ads1298: add bounds check to pga_settings index
    - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent
      vcs_write
    - [arm64] serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero
    - ksmbd: reject non-VALID session in compound request branch
    - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
    - virtiofs: fix UAF on submount umount
    - [amd64] KVM: x86: Fix shadow paging use-after-free due to unexpected role
      (CVE-2026-53359)
    - [amd64] KVM: x86/mmu: Ensure hugepage is in by slot before checking max
      mapping level
    - Revert "PCI: qcom: Advertise Hotplug Slot Capability with no Command
      Completion support"
    - [amd64] KVM: SEV: Ignore MMIO requests of length '0'
    - [amd64] KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+
    - [amd64] KVM: SEV: Ignore Port I/O requests of length '0'
    - batman-adv: tp_meter: keep unacked list in ascending ordered
    - batman-adv: tp_meter: initialize dup_acks explicitly
    - batman-adv: tp_meter: initialize dec_cwnd explicitly
    - batman-adv: tp_meter: avoid window underflow
    - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd
    - batman-adv: tp_meter: fix fast recovery precondition
    - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection
    - batman-adv: tp_meter: add only finished tp_vars to lists
    - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE
    - batman-adv: prevent ELP transmission interval underflow
    - batman-adv: tp_meter: initialize last_recv_time during init
    - batman-adv: ensure bcast is writable before modifying TTL
    - batman-adv: fix (m|b)cast csum after decrementing TTL
    - batman-adv: frag: ensure fragment is writable before modifying TTL
    - batman-adv: frag: avoid underflow of TTL
    - batman-adv: v: prevent OGM aggregation on disabled hardif
    - batman-adv: tp_meter: restrict number of unacked list entries
    - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE
    - batman-adv: tp_meter: prevent parallel modifications of last_recv
    - batman-adv: tp_meter: handle overlapping packets
    - batman-adv: tt: don't merge change entries with different VIDs
    - batman-adv: tt: track roam count per VID
    - batman-adv: dat: prevent false sharing between VLANs
    - batman-adv: tvlv: enforce 2-byte alignment
    - batman-adv: tvlv: avoid race of cifsnotfound handler state
    - ipv6: account for fraggap on the paged allocation path (CVE-2026-53362)
    - fs: constify file ptr in backing_file accessor helpers
    - lsm: add backing_file LSM hooks
    - selinux: fix overlayfs mmap() and mprotect() access checks
    - inet: add indirect call wrapper for getfrag() calls
    - ipv4: account for fraggap on the paged allocation path
    - ntfs3: reject direct userspace writes to reserved $LX* xattrs
    - [amd64] KVM: SEV: Move sev_free_vcpu() down below sev_es_unmap_ghcb()
    - [amd64] KVM: SEV: Unmap and unpin the GHCB as needed on vCPU free
    - af_unix: Set gc_in_progress to true in unix_gc(). (CVE-2026-53361)
    - mtd: spi-nor: macronix: Add post_sfdp fixups for Quad Input Page Program
    - mtd: spi-nor: macronix: add support for mx66{l2, u1}g45g
    - mac802154: llsec: add skb_cow_data() before in-place crypto
    - net: skmsg: preserve sg.copy across SG transforms
    - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink
    - apparmor: mediate the implicit connect of TCP fast open sendmsg
    - apparmor: fix use-after-free in rawdata dedup loop
    - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share
      BAR
    - fbdev: fix use-after-free in store_modes()
    - kernel/fork: clear PF_BLOCK_TS in copy_process()
    - block: invalidate cached plug timestamp after task switch
    - err.h: use __always_inline on all error pointer helpers
    - KEYS: fix overflow in keyctl_pkey_params_get_2()
    - keys: Pin request_key_auth payload in instantiate paths
    - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S
    - wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer
    - wifi: ath11k: fix warning when unbinding
    - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor
    - wifi: rtw88: increase TX report timeout to fix race condition
    - wifi: rtw88: usb: fix memory leaks on USB write failures
    - wifi: iwlwifi: mvm: fix race condition in PTP removal
    - f2fs: validate compress cache inode only when enabled
    - f2fs: fix to round down start offset of fallocate for pin file
    - f2fs: validate ACL entry sizes in f2fs_acl_from_disk()
    - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()
    - f2fs: keep atomic write retry from zeroing original data
    - block: Avoid mounting the bdev pseudo-filesystem in userspace
    - bpf: use kvfree() for replaced sysctl write buffer
    - exfat: fix potential use-after-free in exfat_find_dir_entry()
    - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with
      get_unaligned()
    - gfs2: fix use-after-free in gfs2_qd_dealloc
    - [arm64] pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()
    - hdlc_ppp: sync per-proto timers before freeing hdlc state
    - blk-cgroup: fix UAF in __blkcg_rstat_flush()
    - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done
    - pNFS: Fix use-after-free in pnfs_update_layout()
    - fpga: region: fix use-after-free in child_regions_with_firmware()
    - rpmsg: char: Fix use-after-free on probe error path
    - ocfs2: reject oversized group bitmap descriptors
    - 9p: avoid putting oldfid in p9_client_walk() error path
    - [amd64] KVM: x86: hyper-v: Bound the bank index when querying sparse banks
    - [amd64] KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path
    - power: reset: linkstation-poweroff: fix use-after-free in the
      linkstation_poweroff_init()
    - [riscv64] mm: Extract helper mark_new_valid_map()
    - [riscv64] kfence: Call mark_new_valid_map() for kfence_unprotect()
    - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in
      fb_videomode_to_var
    - fbdev: modedb: fix a possible UAF in fb_find_mode()
    - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode
    - i2c: core: fix adapter registration race
    - NFSD: Fix SECINFO_NO_NAME decode error cleanup
    - nfsd: fix posix_acl leak on SETACL decode failure
    - nfsd: check get_user() return when reading princhashlen
    - nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race
    - nfsd: reset write verifier on deferred writeback errors
    - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
    - NFS: Prevent resource leak in nfs_alloc_server()
    - ksmbd: fix out-of-bounds read in smb_check_perm_dacl()
    - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails
    - drivers/base/memory: set mem->altmap after successful device registration
    - Documentation: ioctl-number: Fix linuxppc-dev mailto link
    - Documentation: ioctl-number: Extend "Include File" column width
    - [amd64] crypto: qat - Replace kzalloc() + copy_from_user() with
      memdup_user()
    - [amd64] crypto: qat - Return pointer directly in adf_ctl_alloc_resources
    - [amd64] crypto: qat - remove unused character device and IOCTLs
    - net/tcp-ao: fix use-after-free of key in del_async path
    - locking: rtmutex: Fix wake_q logic in task_blocks_on_rt_mutex
    - net: bonding: update the slave array for broadcast mode
    - bonding: annotate data-races arcound churn variables
    - bonding: do not set usable_slaves for broadcast mode

[ Salvatore Bonaccorso ]
  * net/netfilter: Enable NETFILTER_NETLINK_HOOK as module (Closes: #1139686)
  * [rt] Refresh "locking/rt: Annotate unlock followed by lock for sparse."

[ Uwe Kleine-König ]
  * [amd64] Enable CONFIG_PINCTRL_CS42L43 and CONFIG_SPI_CS42L43 explicitly
    (Closes: #1136179)

-- Salvatore Bonaccorso <carnil@debian.org>  Sat, 04 Jul 2026 20:24:27 +0200

linux (6.12.94-1~bpo12+1) bookworm-backports; urgency=medium

* Rebuild for bookworm-backports

-- Ben Hutchings <benh@debian.org>  Sun, 21 Jun 2026 22:18:31 +0200

linux (6.12.94-1) trixie-security; urgency=high

* New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.91
    - io_uring/kbuf: use mem_is_zero()
    - blk-cgroup: wait for blkcg cleanup before initializing new disk
    - fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START
    - fs/mbcache: cancel shrink work before destroying the cache
    - md/raid1: fix the comparing region of interval tree
    - drbd: Balance RCU calls in drbd_adm_dump_devices()
    - loop: fix partition scan race between udev and loop_reread_partitions()
    - nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty()
    - blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current()
    - pstore/ram: fix resource leak when ioremap() fails
    - md: wake raid456 reshape waiters before suspend
    - btrfs: pass struct btrfs_inode to clone_copy_inline_extent()
    - btrfs: fix deadlock between reflink and transaction commit when using
      flushoncommit
    - [amd64] ACPI: x86: cmos_rtc: Clean up address space handler driver
    - [amd64] ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver
    - devres: fix missing node debug info in devm_krealloc()
    - thermal/drivers/spear: Fix error condition for reading st,thermal-flags
    - debugfs: check for NULL pointer in debugfs_create_str()
    - debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str()
    - soundwire: debugfs: initialize firmware_file to empty string
    - PCI: use generic driver_override infrastructure
    - platform/wmi: use generic driver_override infrastructure
    - [s390x] cio: use generic driver_override infrastructure
    - bus: fsl-mc: use generic driver_override infrastructure
    - irqchip/irq-pic32-evic: Address warning related to wrong printf()
      formatter
    - hrtimers: Update the return type of enqueue_hrtimer()
    - hrtimer: Avoid pointless reprogramming in __hrtimer_start_range_ns()
    - hrtimer: Reduce trace noise in hrtimer_start()
    - locking: Fix rwlock support in <linux/spinlock_up.h>
    - firmware: dmi: Correct an indexing error in dmi.h
    - wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt()
    - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished
      irq_prepare_bcn_tasklet
    - bpf: test_run: Fix the null pointer dereference issue in
      bpf_lwt_xmit_push_encap
    - dpaa2: add independent dependencies for FSL_DPAA2_SWITCH
    - dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n
    - [s390x] bpf: Zero-extend bpf prog return values and kfunc arguments
    - params: Replace __modinit with __init_or_module
    - module: Fix freeing of charp module parameters when CONFIG_SYSFS=n
    - wifi: mt76: mt7921: Reset ampdu_state state in case of failure in
      mt76_connac2_tx_check_aggr()
    - wifi: mt76: mt7925: Fix incorrect MLO mode in firmware control
    - wifi: mt76: mt7615: fix use_cts_prot support
    - wifi: mt76: mt7915: fix use_cts_prot support
    - wifi: mt76: mt7925: prevent NULL pointer dereference in
      mt7925_tx_check_aggr()
    - wifi: mt76: mt7925: prevent NULL vif dereference in mt7925_mac_write_txwi
    - wifi: mt76: mt7996: fix FCS error flag check in RX descriptor
    - wifi: mt76: mt7921: Place upper limit on station AID
    - [arm64] cpufeature: Make PMUVer and PerfMon unsigned
    - wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event
    - wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work()
    - wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work()
    - wifi: mt76: mt7921: fix 6GHz regulatory update on connection
    - bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path
    - bpf: Fix variable length stack write over spilled pointers
    - bpf,arc_jit: Fix missing newline in pr_err messages
    - wifi: rtw89: phy: fix uninitialized variable access in
      rtw89_phy_cfo_set_crystal_cap()
    - r8152: fix incorrect register write to USB_UPHY_XTAL
    - [powerpc*] crash: fix backup region offset update to elfcorehdr
    - [powerpc*] crash: Update backup region offset in elfcorehdr on memory
      hotplug
    - macvlan: annotate data-races around port->bc_queue_len_used
    - bpf: fix end-of-list detection in cgroup_storage_get_next_key()
    - bpf: Fix stale offload->prog pointer after constant blinding
    - wifi: brcmfmac: Fix error pointer dereference
    - wifi: mac80211: handle VHT EXT NSS in ieee80211_determine_our_sta_mode()
    - bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks
    - bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec()
    - wifi: ath10k: fix station lookup failure during disconnect
    - ACPI: AGDI: fix missing newline in error message
    - [arm64] kexec: Remove duplicate allocation for trans_pgd
    - net: bcmgenet: fix off-by-one in bcmgenet_put_txcb
    - net: bcmgenet: add bcmgenet_has_* helpers
    - net: bcmgenet: move DESC_INDEX flow to ring 0
    - net: bcmgenet: support reclaiming unsent Tx packets
    - net: bcmgenet: switch to use 64bit statistics
    - net: bcmgenet: fix racing timeout handler
    - eth: fbnic: Use wake instead of start
    - netfilter: xt_socket: enable defrag after all other checks
    - netfilter: nft_fwd_netdev: check ttl/hl before forwarding
    - bpf: fix mm lifecycle in open-coded task_vma iterator
    - bpf: switch task_vma iterator from mmap_lock to per-VMA locks
    - bpf: return VMA snapshot from task_vma iterator
    - bpf: Fix RCU stall in bpf_fd_array_map_clear()
    - net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf
    - bpf: Relax scalar id equivalence for state pruning
    - bpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars
    - net/sched: act_ct: Only release RCU read lock after ct_ft
    - net: airoha: Implement BQL support
    - net: airoha: Add missing RX_CPU_IDX() configuration in
      airoha_qdma_cleanup_rx_queue()
    - bpf: Allow instructions with arena source and non-arena dest registers
    - net/rds: Optimize rds_ib_laddr_check
    - net/rds: Restrict use of RDS/IB to the initial network namespace
    - bpf: Fix OOB in pcpu_init_value
    - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls
    - net: ipa: Fix programming of QTIME_TIMESTAMP_CFG
    - net: ipa: Fix decoding EV_PER_EE for IPA v5.0+
    - dt-bindings: net: dsa: nxp,sja1105: make spi-cpol optional for sja1110
    - net: phy: fix a return path in get_phy_c45_ids()
    - net/mlx5e: Fix features not applied during netdev registration
    - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic()
    - bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb
    - Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU
    - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error
    - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER
    - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp
    - Bluetooth: SCO: check for codecs->num_codecs == 1 before assigning to
      sco_pi(sk)->codec
    - net: phy: qcom: at803x: Use the correct bit to disable extended next page
    - ipv4: udp: fix typos in comments
    - ipv6: udp: fix typos in comments
    - udp: Force compute_score to always inline
    - tcp: Don't set treq->req_usec_ts in cookie_tcp_reqsk_init().
    - sctp: fix missing encap_port propagation for GSO fragments
    - net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master
    - drm/komeda: fix integer overflow in AFBC framebuffer size check
    - ASoC: SOF: ipc3: Use standard dev_dbg API
    - ASoC: add symmetric_ prefix for dai->rate/channels/sample_bits
    - ASoC: soc-compress: use function to clear symmetric params
    - drm/sun4i: backend: fix error pointer dereference
    - ASoC: sti: Return errors from regmap_field_alloc()
    - ASoC: sti: use managed regmap_field allocations
    - dm cache: fix null-deref with concurrent writes in passthrough mode
    - dm cache: fix write path cache coherency in passthrough mode
    - dm cache: fix write hang in passthrough mode
    - dm cache policy smq: fix missing locks in invalidating cache blocks
    - dm cache: fix concurrent write failure in passthrough mode
    - dm cache: support shrinking the origin device
    - dm cache: fix dirty mapping checking in passthrough mode switching
    - platform/chrome: chromeos_tbmc: Drop wakeup source on remove
    - PCI: endpoint: Align pci_epc_set_msix(), pci_epc_ops::set_msix() nr_irqs
      encoding
    - PCI: dwc: ep: Fix MSI-X Table Size configuration in dw_pcie_ep_set_msix()
    - PCI: dwc: Invoke post_init in dw_pcie_resume_noirq()
    - PCI: dwc: Perform cleanup in the error path of dw_pcie_resume_noirq()
    - dm cache metadata: fix memory leak on metadata abort retry
    - dm log: fix out-of-bounds write due to region_count overflow
    - drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in
      atomic_enable()
    - drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to
      drm_bridge_funcs
    - drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge
      atomic check
    - spi: spi-nxp-fspi: enable runtime pm for fspi
    - spi: nxp-fspi: Use reinit_completion() for repeated operations
    - spi: fsl-qspi: Use reinit_completion() for repeated operations
    - media: i2c: og01a1b: Replace client->dev usage
    - media: i2c: og01a1b: Fix V4L2 subdevice data initialization on probe
    - drm/v3d: Handle error from drm_sched_entity_init()
    - drm/sun4i: Fix resource leaks
    - drm/amdgpu: Add default case in DVI mode validation
    - dm init: ensure device probing has finished in dm-mod.waitfor=
    - fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build
      break
    - crypto: tegra - finalize crypto req on error
    - crypto: tegra - Transfer HASH init function to crypto engine
    - crypto: tegra - Reserve keyslots to allocate dynamically
    - crypto: tegra - Disable softirqs before finalizing request
    - crypto: atmel - Use unregister_{aeads,ahashes,skciphers}
    - crypto: atmel-aes - guard unregister on error in atmel_aes_register_algs
    - padata: Remove cpu online check from cpu add and removal
    - padata: Put CPU offline callback in ONLINE section to allow failure
    - PCI: dwc: rcar-gen4: Change EPC BAR alignment to 4K as per the
      documentation
    - drm/amdgpu/gfx10: look at the right prop for gfx queue priority
    - drm/amdgpu/gfx11: look at the right prop for gfx queue priority
    - spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo
    - drm/imagination: Switch reset_reason fields from enum to u32
    - iommu/tegra241-cmdqv: Set supports_cmd op in tegra241_vcmdq_hw_init()
    - [arm64] drm/msm/dpu: fix mismatch between power and frequency
    - [arm64] drm/msm/dsi: add the missing parameter description
    - [arm64] drm/msm/dsi: fix bits_per_pclk
    - [arm64] drm/msm/dsi: fix hdisplay calculation for CMD mode panel
    - [arm64] drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0
    - drm/panel: sharp-ls043t1le01: make use of prepare_prev_first
    - drm/panel: simple: Correct G190EAN01 prepare timing
    - PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion
      support
    - ALSA: core: Validate compress device numbers without dynamic minors
    - drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled
    - drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs
    - drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock
    - drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0
    - drm/amd/pm/ci: Clear EnabledForActivity field for memory levels
    - drm/amd/pm/ci: Fill DW8 fields from SMC
    - drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board
    - drm/amdgpu: add amdgpu_device reference in ip block
    - drm/amdgpu: update the handle ptr in dump_ip_state
    - drm/amdgpu: update the handle ptr in early_init
    - drm/amdgpu/uvd4.2: Don't initialize UVD 4.2 when DPM is disabled
    - hwmon: Switch back to struct platform_driver::remove()
    - hwmon: (aspeed-g6-pwm-tach): remove redundant driver remove callback
    - ALSA: hda/realtek: fix code style (ERROR: else should follow close brace
      '}')
    - [amd64] ASoC: SOF: Intel: hda: Place check before dereference
    - [arm64] drm/msm/a6xx: Fix HLSQ register dumping
    - [arm64] drm/msm/shrinker: Fix can_block() logic
    - [arm64] drm/msm/a6xx: Fix dumping A650+ debugbus blocks
    - [arm64] drm/msm/a6xx: Use barriers while updating HFI Q headers
    - pmdomain: ti: omap_prm: Fix a reference leak on device node
    - pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe()
    - PM: domains: De-constify fields in struct dev_pm_domain_attach_data
    - ASoC: fsl_micfil: Add access property for "VAD Detected"
    - ASoC: fsl_micfil: Fix event generation in hwvad_put_enable()
    - ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode()
    - ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state()
    - ASoC: fsl_micfil: Fix event generation in micfil_quality_set()
    - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put()
    - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put()
    - ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits()
    - ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits()
    - ASoC: fsl_easrc: Change the type for iec958 channel status controls
    - [amd64] iommu/amd: Remove protection_domain.dev_cnt variable
    - [amd64] iommu/amd: xarray to track protection_domain->iommu list
    - [amd64] iommu/amd: Do not detach devices in domain free path
    - [amd64] iommu/amd: Reduce domain lock scope in attach device path
    - [amd64] iommu/amd: Rearrange attach device code
    - [amd64] iommu/amd: Convert dev_data lock from spinlock to mutex
    - [amd64] iommu/amd: Introduce helper function to update 256-bit DTE
    - [amd64] iommu/amd: Introduce helper function get_dte256()
    - [amd64] iommu/amd: Fix clone_alias() to use the original device's devid
    - [arm64] ASoC: qcom: qdsp6: topology: check widget type before accessing
      data
    - crypto: qat - introduce fuse array
    - crypto: qat - disable 4xxx AE cluster when lead engine is fused off
    - crypto: qat - disable 420xx AE cluster when lead engine is fused off
    - crypto: qat - fix type mismatch in RAS sysfs show functions
    - crypto: qat - use swab32 macro
    - ASoC: rsnd: Fix potential out-of-bounds access of component_dais[]
    - PCI: Enable AtomicOps only if Root Port supports them
    - PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found
    - Documentation: fix a hugetlbfs reservation statement
    - ALSA: scarlett2: Add missing sentinel initializer field
    - ASoC: SOF: compress: return the configured codec from get_params
    - PCI/NPEM: Set LED_HW_PLUGGABLE for hotplug-capable ports
    - PCI: tegra194: Fix polling delay for L2 state
    - PCI: tegra194: Increase LTSSM poll time on surprise link down
    - PCI: tegra194: Disable LTSSM after transition to Detect on surprise link
      down
    - PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in
      tegra_pcie_downstream_dev_to_D0()
    - PCI: tegra194: Don't force the device into the D0 state before L2
    - PCI: tegra194: Disable PERST# IRQ only in Endpoint mode
    - PCI: tegra194: Use devm_gpiod_get_optional() to parse
      "nvidia,refclk-select"
    - PCI: tegra194: Disable direct speed change for Endpoint mode
    - PCI: tegra194: Set LTR message request before PCIe link up in Endpoint
      mode
    - PCI: tegra194: Allow system suspend when the Endpoint link is not up
    - PCI: tegra194: Free up Endpoint resources during remove()
    - PCI: tegra194: Use DWC IP core version
    - PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well
    - PCI: tegra194: Fix CBB timeout caused by DBI access before core power-on
    - spi: mtk-snfi: unregister ECC engine on probe failure and remove()
      callback
    - ALSA: sc6000: Keep the programmed board state in card-private data
    - dm cache: fix missing return in invalidate_committed's error path
    - crypto: jitterentropy - replace long-held spinlock with mutex
    - ALSA: hda/realtek - fixed speaker no sound update
    - gfs2: Call unlock_new_inode before d_instantiate
    - net/socket.c: switch to CLASS(fd)
    - fdget(), trivial conversions
    - fanotify: call fanotify_events_supported() before path_permission() and
      security_path_notify()
    - quota: Fix race of dquot_scan_active() with quota deactivation
    - gfs2: add some missing log locking
    - gfs2: prevent NULL pointer dereference during unmount
    - efi/capsule-loader: fix incorrect sizeof in phys array reallocation
    - ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine
    - [arm64] dts: mediatek: mt8365: Describe infracfg-nao as a pure syscon
    - memory: tegra124-emc: Fix dll_change check
    - memory: tegra30-emc: Fix dll_change check
    - [arm64] dts: imx8-apalis: Fix LEDs name collision
    - [arm64] dts: rockchip: Make Jaguar PCIe-refclk pin use pull-up config
    - [arm64] dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO
      (M.2 W_DISABLE1)
    - iommufd: vfio compatibility extension check for noiommu mode
    - [arm64] dts: mediatek: mt6795: Fix gpio-ranges pin count
    - [arm64] dts: mediatek: mt7981b: Fix gpio-ranges pin count
    - [arm64] dts: mediatek: mt7986a: Fix gpio-ranges pin count
    - [arm64] dts: qcom: msm8953-xiaomi-vince: correct wled ovp value
    - [arm64] dts: qcom: msm8953-xiaomi-daisy: fix backlight
    - [arm64] dts: rockchip: Fix Bluetooth stability on LCKFB TaiShan Pi
    - [arm64] dts: rockchip: Correct Fan Supply for Gameforce Ace
    - [arm64] dts: rockchip: Correct Joystick Axes on Gameforce Ace
    - [arm64] soc: qcom: ocmem: make the core clock optional
    - [arm64] soc: qcom: ocmem: register reasons for probe deferrals
    - [arm64] soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available
    - bus: rifsc: fix RIF configuration check for peripherals
    - [arm64] dts: qcom: sm8450: Fix GIC_ITS range length
    - [arm64] dts: qcom: sm8550: Fix GIC_ITS range length
    - [arm64] dts: qcom: sm8650: Fix GIC_ITS range length
    - [arm64] dts: qcom: sm8550: Fix xo clock supply of platform SD host
      controller
    - [arm64] dts: qcom: sm8650: Fix xo clock supply of SD host controller
    - [arm64] dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes
    - [arm64] dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes
    - [arm64] dts: qcom: sm8650: Enable UHS-I SDR50 and SDR104 SD card modes
    - [arm64] dts: qcom: sm7225-fairphone-fp4: Fix conflicting bias pinctrl
    - [arm64] dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered
      during boot
    - [arm64] dts: ti: k3-am62p5-sk: Disable MMC1 internal pulls on data pins
    - [arm64] dts: ti: k3-am62-lp-sk: Enable internal pulls for MMC0 data pins
    - [arm64] dts: ti: k3-am62-verdin: Fix SPI_1 GPIO CS pinctrl label
    - [arm64] dts: freescale: imx8mp-tqma8mpql-mba8mp-ras314: fix UART1 RTS/CTS
      muxing
    - [arm64] dts: lx2160a: change i2c0 (iic1) pinmux mask to one bit
    - [arm64] dts: lx2160a: remove duplicate pinmux nodes
    - [arm64] dts: lx2160a: rename pinmux nodes for readability
    - [arm64] dts: lx2160a: add sda gpio references for i2c bus recovery
    - [arm64] dts: lx2160a: change zeros to hexadecimal in pinmux nodes
    - [arm64] dts: lx2160a: complete pinmux for rcwsr12 configuration word
    - [arm64] dts: imx8qm-mek: switch Type-C connector power-role to dual
    - [arm64] dts: imx8qxp-mek: switch Type-C connector power-role to dual
    - soc/tegra: cbb: Set ERD on resume for err interrupt
    - unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure
    - ocfs2/dlm: validate qr_numregions in dlm_match_regions()
    - ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison
    - soc: qcom: llcc: fix v1 SB syndrome register offset
    - [arm64] soc: qcom: aoss: compare against normalized cooling state
    - [arm64] dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP
    - [arm64] xor: fix conflicting attributes for xor_block_template
    - firmware: arm_ffa: Use the correct buffer size during RXTX_MAP
    - ocfs2: fix listxattr handling when the buffer is full
    - ocfs2: validate bg_bits during freefrag scan
    - ocfs2: validate group add input before caching
    - dmaengine: dw-axi-dmac: Remove unnecessary return statement from void
      function
    - soundwire: bus: demote UNATTACHED state warnings to dev_dbg()
    - dmaengine: mxs-dma: Fix missing return value from
      of_dma_controller_register()
    - soundwire: cadence: Clear message complete before signaling waiting thread
    - tracing: Rebuild full_name on each hist_field_name() call
    - hte: tegra194: remove Kconfig dependency on Tegra194 SoC
    - remoteproc: xlnx: Fix sram property parsing
    - ima: check return value of crypto_shash_final() in boot aggregate
    - HID: asus: make asus_resume adhere to linux kernel coding standards
    - HID: asus: do not abort probe when not necessary
    - mtd: physmap_of_gemini: Fix disabled pinctrl state check
    - ima_fs: don't bother with removal of files in directory we'll be removing
    - ima_fs: get rid of lookup-by-dentry stuff
    - ima_fs: Correctly create securityfs files for unsupported hash algos
    - dt-bindings: interrupt-controller: arm,gic-v3: Fix EPPI range
    - mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations
    - mtd: spi-nor: sfdp: introduce smpt_read_dummy fixup hook
    - mtd: spi-nor: sfdp: introduce smpt_map_id fixup hook
    - mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation
    - mtd: spi-nor: swp: check SR_TB flag when getting tb_mask
    - mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path
    - mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions
    - cxl/pci: Check memdev driver binding status in cxl_reset_done()
    - mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob
    - HID: usbhid: fix deadlock in hid_post_reset()
    - ext4: fix possible null-ptr-deref in mbt_kunit_exit()
    - [arm64] bpf, arm64: Fix off-by-one in check_imm signed range check
    - bpf, sockmap: Fix af_unix iter deadlock
    - bpf, sockmap: Fix af_unix null-ptr-deref in proto update
    - bpf, sockmap: Take state lock for af_unix iter
    - bpf: Fix precedence bug in convert_bpf_ld_abs alignment check
    - bpf: Fix NULL deref in map_kptr_match_type for scalar regs
    - bpf: allow UTF-8 literals in bpf_bprintf_prepare()
    - bpf: Validate node_id in arena_alloc_pages()
    - bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT
    - pinctrl: pinctrl-pic32: Fix resource leak
    - pinctrl: cy8c95x0: remove duplicate error message
    - pinctrl: cy8c95x0: Unify messages with help of dev_err_probe()
    - pinctrl: cy8c95x0: Avoid returning positive values to user space
    - perf branch: Avoid incrementing NULL
    - perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace
    - pinctrl: realtek: Fix function signature for config argument
    - pinctrl: abx500: Fix type of 'argument' variable
    - pinctrl: renesas: rzg2l: Fix save/restore of {IOLH,IEN,PUPD,SMT} registers
    - perf lock: Fix option value type in parse_max_stack
    - perf stat: Fix opt->value type for parse_cache_level
    - perf tools: Fix module symbol resolution for non-zero .text sh_addr
    - perf expr: Return -EINVAL for syntax error in expr__find_ids()
    - ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure
    - ipmi: ssif_bmc: fix message desynchronization after truncated response
    - ipmi: ssif_bmc: change log level to dbg in irq callback
    - perf evsel: Add alternate_hw_config and use in evsel__match
    - perf tool_pmu: Factor tool events into their own PMU
    - perf python: Add parse_events function
    - perf cgroup: Update metric leader in evlist__expand_cgroup
    - perf maps: Fix copy_from that can break sorted by name order
    - perf util: Kill die() prototype, dead for a long time
    - reset: replace boolean parameters with flags parameter
    - reset: Add devres helpers to request pre-deasserted reset controls
    - i3c: master: dw-i3c: Fix missing reset assertion in remove() callback
    - i3c: dw: Fix memory leak in dw_i3c_master_i3c_xfers()
    - i3c: mipi-i3c-hci: fix IBI payload length calculation for final status
    - backlight: sky81452-backlight: Check return value of
      devm_gpiod_get_optional() in sky81452_bl_parse_dt()
    - platform/surface: surfacepro3_button: Drop wakeup source on remove
    - leds: lgm-sso: Remove duplicate assignments for priv->mmap
    - tty: hvc_iucv: fix off-by-one in number of supported devices
    - platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup
    - mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata()
    - nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist()
    - [amd64] platform/x86: asus-wmi: adjust screenpad power/brightness handling
    - [amd64] platform/x86: asus-wmi: fix screenpad brightness range
    - tty: serial: ip22zilog: Fix section mispatch warning
    - fs/ntfs3: terminate the cached volume label after UTF-8 conversion
    - [amd64] platform/x86: dell_rbu: avoid uninit value usage in
      packet_size_write()
    - [amd64] platform/x86: dell-wmi-sysman: bound enumeration string
      aggregation
    - RDMA/core: Prefer NLA_NUL_STRING
    - clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source
    - scsi: sg: Fix sysctl sg-big-buff register during sg_init()
    - scsi: sg: Resolve soft lockup issue when opening /dev/sgX
    - clk: qcom: dispcc-sc8280xp: remove CLK_SET_RATE_PARENT from
      byte_div_clk_src dividers
    - clk: qcom: dispcc-sm4450: Fix DSI byte clock rate setting
    - scsi: target: core: Fix integer overflow in UNMAP bounds check
    - dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs
    - clk: qcom: gcc-sc8180x: Add missing GDSCs
    - clk: qcom: gcc-sc8180x: Use retention for USB power domains
    - clk: qcom: gcc-sc8180x: Use retention for PCIe power domains
    - clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk
    - clk: qcom: dispcc-sm8250: Enable parents for pixel clocks
    - clk: imx: imx6q: Fix device node reference leak in pll6_bypassed()
    - clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels()
    - clk: imx8mq: Correct the CSI PHY sels
    - [amd64] x86/um/vdso: Drop VDSO64-y from Makefile
    - clk: qoriq: avoid format string warning
    - clk: xgene: Fix mapping leak in xgene_pllclk_init()
    - dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets
    - clk: qcom: dispcc-sc7180: Add missing MDSS resets
    - lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug()
    - clk: qcom: gcc-x1e80100: Keep GCC USB QTB clock always ON
    - clk: visconti: pll: initialize clk_init_data to zero
    - f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show()
    - [amd64] drm/i915: Relocate the SKL wm sanitation code
    - [amd64] drm/i915/wm: Verify the correct plane DDB entry
    - crypto: sa2ul - Fix AEAD fallback algorithm names
    - crypto: ccp - copy IV using skcipher ivsize
    - erofs: add encoded extent on-disk definition
    - erofs: do sanity check on m->type in z_erofs_load_compact_lcluster()
    - erofs: avoid infinite loops due to corrupted subpage compact indexes
      (CVE-2025-68251)
    - erofs: unify lcn as u64 for 32-bit platforms
    - [arm64] dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT
    - [arm64] dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT
    - [arm64] dts: imx8mp-navqp: Correct PAD settings for PMIC_nINT
    - [arm64] dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT
    - [arm64] dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT
    - [arm64] dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for PMIC_nINT
    - PCMCIA: Fix garbled log messages for KERN_CONT
    - [arm64] dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT
    - [arm64] dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT
    - [arm64] dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT
    - [arm64] dts: marvell: armada-37xx: use 'usb2-phy' in USB3 controller's
      phy-names
    - net/sched: act_mirred: fix wrong device for mac_header_xmit check in
      tcf_blockcast_redir
    - macvlan: fix macvlan_get_size() not reserving space for
      IFLA_MACVLAN_BC_CUTOFF
    - net/sched: sch_cake: fix NAT destination port not being updated in
      cake_update_flowkeys
    - nexthop: fix IPv6 route referencing IPv4 nexthop
    - net/sched: taprio: fix use-after-free in advance_sched() on schedule
      switch
    - tcp: add data-race annotations around tp->data_segs_out and
      tp->total_retrans
    - tcp: add data-race annotations for TCP_NLA_SNDQ_SIZE
    - tcp: annotate data-races around tp->bytes_sent
    - tcp: annotate data-races around tp->bytes_retrans
    - tcp: annotate data-races around tp->dsack_dups
    - tcp: annotate data-races around (tp->write_seq - tp->snd_nxt)
    - tcp: annotate data-races around tp->plb_rehash
    - ice: update PCS latency settings for E825 10G/25Gb modes
    - ice: Remove jumbo_remove step from TX path
    - ice: fix double-free of tx_buf skb
    - ice: fix ICE_AQ_LINK_SPEED_M for 200G
    - i40e: don't advertise IFF_SUPP_NOFCS
    - e1000e: Unroll PTP in probe error handling
    - ipv6: fix possible UAF in icmpv6_rcv()
    - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks
    - pppoe: drop PFC frames
    - net/mlx5: Fix HCA caps leak on notifier init failure
    - openvswitch: cap upcall PID array size and pre-size vport replies
    - netfilter: nft_osf: restrict it to ipv4
    - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO
    - netfilter: conntrack: remove sprintf usage
    - netfilter: xtables: restrict several matches to inet family
    - ipvs: fix MTU check for GSO packets in tunnel mode
    - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching
    - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check
    - slip: reject VJ receive packets on instances with no rstate array
    - slip: bound decode() reads against the compressed packet length
    - [arm64] dts: meson-gxl-p230: fix ethernet PHY interrupt number
    - pwm: atmel-tcb: Cache clock rates and mark chip as atomic
    - ksmbd: destroy tree_conn_ida in ksmbd_session_destroy()
    - ksmbd: destroy async_ida in ksmbd_conn_free()
    - ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open
    - ksmbd: scope conn->binding slowpath to bound sessions only
    - net/rds: zero per-item info buffer before handing it to visitors
    - ice: fix timestamp interrupt configuration for E825C
    - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g
    - net_sched: sch_hhf: annotate data-races in hhf_dump_stats()
    - net/sched: sch_pie: annotate data-races in pie_dump_stats()
    - net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats()
    - net/sched: sch_red: annotate data-races in red_dump_stats()
    - net/sched: sch_sfb: annotate data-races in sfb_dump_stats()
    - net: dsa: realtek: rtl8365mb: fix mode mask calculation
    - net: airoha: Move ndesc initialization at end of
      airoha_qdma_init_rx_queue()
    - virtio_net: Split struct virtio_net_rss_config
    - virtio_net: Fix endian with virtio_net_ctrl_rss
    - virtio_net: Use new RSS config structs
    - virtio_net: sync rss_trailer.max_tx_vq on queue_pairs change via
      VQ_PAIRS_SET
    - nfp: fix swapped arguments in nfp_encode_basic_qdr() calls
    - tipc: fix double-free in tipc_buf_append()
    - vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll()
    - fs/adfs: validate nzones in adfs_validate_bblk()
    - rtc: abx80x: Disable alarm feature if no interrupt attached
    - kbuild: builddeb - avoid recompiles for non-cross-compiles
    - fbdev: offb: fix PCI device reference leak on probe failure
    - mailbox: mtk-cmdq: Fix CURR and END addr for task insert case
    - mailbox: mailbox-test: free channels on probe error
    - cgroup/rdma: fix integer overflow in rdmacg_try_charge()
    - mailbox: add sanity check for channel array
    - mailbox: mailbox-test: don't free the reused channel
    - mailbox: mailbox-test: initialize struct earlier
    - mailbox: mailbox-test: make data_ready a per-instance variable
    - fsnotify: fix inode reference leak in fsnotify_recalc_mask()
    - btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent()
    - cgroup: Increment nr_dying_subsys_* from rmdir context
    - tracing: branch: Fix inverted check on stat tracer registration
    - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers
    - netfilter: arp_tables: fix IEEE1394 ARP payload parsing
    - nvme-pci: fix missed admin queue sq doorbell write
    - drm/amdgpu/gmc: Fix AMDGPU_GART_PLACEMENT_LOW to not overlap with VRAM
    - drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG
    - drm/amdgpu: fix spelling typos
    - drm/amdgpu/uvd3.1: Don't validate the firmware when already validated
    - drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2)
    - netfilter: xt_policy: fix strict mode inbound policy matching
    - netfilter: nf_conntrack_sip: don't use simple_strtoul
    - [amd64] ASoC: amd: acp: Add DMI quirk for Valve Steam Deck OLED
    - spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ
    - drm/sysfb: ofdrm: fix PCI device reference leaks
    - arm64/scs: Fix potential sign extension issue of advance_loc4
    - cdrom, scsi: sr: propagate read-only status to block layer via
      set_disk_ro()
    - netdevsim: zero initialize struct iphdr in dummy sk_buff
    - net/sched: netem: fix probability gaps in 4-state loss model
    - net/sched: netem: fix queue limit check to include reordered packets
    - net/sched: netem: only reseed PRNG when seed is explicitly provided
    - net/sched: netem: validate slot configuration
    - net/sched: netem: fix slot delay calculation overflow
    - net/sched: netem: check for negative latency and jitter
    - net/sched: sch_choke: annotate data-races in choke_dump_stats()
    - net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats()
    - vrf: Fix a potential NPD when removing a port from a VRF
    - net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()
    - net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit
    - NFC: trf7970a: Ignore antenna noise when checking for RF field
    - net/sched: taprio: fix NULL pointer dereference in class dump
    - neigh: let neigh_xmit take skb ownership
    - tcp: make probe0 timer handle expired user timeout
    - net, treewide: define and use MAC_ADDR_STR_LEN
    - netconsole: allow selection of egress interface via MAC address
    - netpoll: Extract carrier wait function
    - netpoll: extract IPv4 address retrieval into helper function
    - netpoll: fix IPv6 local-address corruption
    - ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams
    - sched/fair: Clear rel_deadline when initializing forked entities
    - net: mctp i2c: check length before marking flow active
    - net: phy: dp83869: fix setting CLK_O_SEL field.
    - drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings
    - drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings
    - drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings
    - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring
    - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.5 enc ring
    - drm/amdgpu/vcn: set no_user_fence for VCN v5.0.0 enc ring
    - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring
    - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring
    - drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring
    - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring
    - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring
    - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.5 ring
    - drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.0 ring
    - ASoC: codecs: ab8500: Fix casting of private data
    - netfilter: skip recording stale or retransmitted INIT
    - sctp: discard stale INIT after handshake completion
    - bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst()
    - net/sched: sch_cake: annotate data-races in cake_dump_stats() (V)
    - netconsole: propagate device name truncation in dev_name_store()
    - ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87
    - ALSA: hda/conexant: Fix missing error check for jack detection
    - ALSA: hda: cs35l56: Fix uninitialized value in cs35l56_hda_read_acpi()
    - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup
    - drm/amd/display: Allow DCE link encoder without AUX registers
    - drm/amd/display: Read EDID from VBIOS embedded panel info
    - drm/xe/debugfs: Correct printing of register whitelist ranges
    - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()
    - drm/xe/gsc: Fix BO leak on error in query_compatibility_version()
    - page_pool: Set `dma_sync` to false for devmem memory provider
    - net: page_pool: create hooks for custom memory providers
    - page_pool: fix memory-provider leak in page_pool_create_percpu() error
      path
    - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING
    - iavf: stop removing VLAN filters from PF on interface down
    - iavf: wait for PF confirmation before removing VLAN filters
    - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler
    - ice: fix NULL pointer dereference in ice_reset_all_vfs()
    - net: tls: fix strparser anchor skb leak on offload RX setup failure
    - sfc: fix error code in efx_devlink_info_running_versions()
    - net/sched: cls_flower: revert unintended changes
    - [arm64] Reserve an extra page for early kernel mapping
    - smb: client: correctly handle ErrorContextData as a flexible array
    - smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613)
    - LoongArch: KVM: Compile switch.S directly into the kernel
    - ntfs: ->d_compare() must not block
    - PCI: Initialize temporary device in new_id_store()
    - net: bcmgenet: Initialize u64 stats seq counter
    - net: bcmgenet: fix leaking free_bds
    - [amd64] iommu/amd: Reorder attach device code
    - [amd64] iommu/amd: Put list_add/del(dev_data) back under the domain->lock
    - perf tool_pmu: Fix aggregation on duration_time
    - net/sched: sch_pie: annotate more data-races in pie_dump_stats()
    - netpoll: Extract IPv6 address retrieval function
    - netpoll: pass buffer size to egress_dev() to avoid MAC truncation
    - page_pool: fix incorrect mp_ops error handling
    - crypto: af_alg - Cap AEAD AD length to 0x80000000
    - i40e: Cleanup PTP pins on probe failure
    - workqueue: Fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path
    - netfilter: nf_conntrack_sip: get helper before allocating expectation
    - audit: fix incorrect inheritable capability in CAPSET records
    - Revert "ACPI: CPPC: Adjust debug messages in amd_set_max_freq_ratio() to
      warn"
    - netfilter: nft_ct: fix missing expect put in obj eval
    - net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled
    - audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV
    - KVM: Reject wrapped offset in kvm_reset_dirty_gfn()
    - [s390x] KVM: s390: pci: fix GAIT table indexing due to double-scaling
      pointer arithmetic
    - [amd64] KVM: x86: Fix Xen hypercall tracepoint argument assignment
    - netfilter: nf_tables: unconditionally bump set->nelems before insertion
      (CVE-2026-23272)
    - ata: libata-scsi: fix requeue of deferred ATA PASS-THROUGH commands
    - smb/client: fix possible infinite loop and oob read in symlink_data()
    - [amd64] drm/i915/dp: Fix VSC dynamic range signaling for RGB formats
    - ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans
    - ALSA: usb-audio: Bound MIDI endpoint descriptor scans
    - ceph: fix a buffer leak in __ceph_setxattr()
    - ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size
    - io-wq: check that the predecessor is hashed in io_wq_remove_pending()
    - [powerpc*] warp: Fix error handling in pika_dtm_thread
    - netfs: fix error handling in netfs_extract_user_iter()
    - irqchip/riscv-imsic: Clear interrupt move state during CPU offlining
    - libceph: Fix potential out-of-bounds access in osdmap_decode()
    - libceph: Fix potential null-ptr-deref in decode_choose_args()
    - libceph: Fix potential out-of-bounds access in crush_decode()
    - libceph: handle rbtree insertion error in decode_choose_args()
    - [amd64] iommu/vt-d: Disable DMAR for Intel Q35 IGFX
    - [amd64] drm/i915: skip __i915_request_skip() for already signaled requests
    - drm/panfrost: Fix wait_bo ioctl leaking positive return from
      dma_resv_wait_timeout()
    - drm/xe/dma-buf: handle empty bo and UAF races
    - drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup
    - drm/gma500/oaktrail_lvds: fix hang on init failure
    - drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init
    - iommufd: Fix return value of iommufd_fault_fops_write()
    - eventfs: Use list_add_tail_rcu() for SRCU-protected children list
    - drm/v3d: Reject empty multisync extension to prevent infinite loop
    - btrfs: use inode already stored in local variable at btrfs_rmdir()
    - btrfs: use btrfs inodes in btrfs_rmdir() to avoid so much usage of
      BTRFS_I()
    - btrfs: fix missing last_unlink_trans update when removing a directory
    - smb: client: Use FullSessionKey for AES-256 encryption key derivation
    - btrfs: do not mark inode incompressible after inline attempt fails
    - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()
    - sched_ext: Guard scx_dsq_move() against NULL kit->dsq after failed
      iter_new
    - mptcp: pm: prio: skip closed subflows
    - mptcp: drop __mptcp_fastopen_gen_msk_ackseq()
    - mptcp: fix rx timestamp corruption on fastopen
    - f2fs: fix incorrect file address mapping when inline inode is unwritten
    - f2fs: fix false alarm of lockdep on cp_global_sem lock
    - spi: sifive: Simplify clock handling with devm_clk_get_enabled()
    - spi: sifive: fix controller deregistration
    - mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0
    - mptcp: pm: ADD_ADDR rtx: fix potential data-race
    - mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker
    - netfs: Fix potential uninitialised var in netfs_extract_user_iter()
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.92
    - mptcp: sync the msk->sndbuf at accept() time
    - mptcp: pm: ADD_ADDR rtx: allow ID 0
    - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount (CVE-2026-46158)
    - mptcp: pm: ADD_ADDR rtx: free sk if last (CVE-2026-46170)
    - ksmbd: validate owner of durable handle on reconnect (CVE-2026-31717)
    - drm/xe/hdcp: Add NULL check for media_gt in intel_hdcp_gsc_check_status()
      (CVE-2026-46216)
    - [s390x] debug: Reject zero-length input before trimming a newline
    - Revert "perf cgroup: Update metric leader in evlist__expand_cgroup"
    - Revert "perf tool_pmu: Fix aggregation on duration_time"
    - Revert "perf python: Add parse_events function"
    - Revert "perf tool_pmu: Factor tool events into their own PMU"
    - bridge: mrp: reject zero test interval to avoid OOM panic (CVE-2026-31420)
    - spi: spi-dw-dma: fix print error log when wait finish transaction
      (CVE-2026-31560)
    - Revert "x86/vdso: Fix output operand size of RDPID"
    - sched/deadline: Less agressive dl_server handling
    - sched/deadline: Fix dl_server_stopped()
    - sched/deadline: Fix dl_server getting stuck
    - sched/deadline: Fix dl_server behaviour
    - sched/deadline: Stop dl_server before CPU goes offline
    - ksmbd: close durable scavenger races against m_fp_list lookups
    - af_unix: Give up GC if MSG_PEEK intervened. (CVE-2026-23394)
    - drm/imagination: Synchronize interrupts before suspending the GPU
      (CVE-2026-23469)
    - ata: libata-scsi: improve readability of ata_scsi_qc_issue()
    - ata: libata-scsi: do not use the deferred QC feature for ATA_DEFER_PORT
    - ata: libata-scsi: do not use the deferred QC feature on PMPs with CBS
    - ata: libata-scsi: do not needlessly defer commands when using PMP with FBS
    - perf parse-events: Expose/rename config_term_name
    - Revert "ice: fix double-free of tx_buf skb"
    - Revert "ice: Remove jumbo_remove step from TX path"
    - tracing: Fix the bug where bpf_get_stackid returns -EFAULT on the ARM64
    - net/mlx5e: Trigger neighbor resolution for unresolved destinations
    - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init
    - [amd64] x86/fgraph: Fix return_to_handler regs.rsp value
    - [amd64] iommu/vt-d: Draining PRQ in sva unbind path when FPD bit set
    - [riscv64] fgraph: Select HAVE_FUNCTION_GRAPH_TRACER depends on
      HAVE_DYNAMIC_FTRACE_WITH_ARGS
    - [riscv64] fgraph: Fix stack layout to match __arch_ftrace_regs argument of
      ftrace_return_to_handler (CVE-2025-22069)
    - hwmon: (pmbus/core) Protect regulator operations with mutex
    - [arm64] Kconfig: Remove selecting replaced HAVE_FUNCTION_GRAPH_RETVAL
    - sysfs: don't remove existing directory on update failure
    - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break()
    - ksmbd: fix null pointer dereference in compare_guid_key()
    - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow
    - ksmbd: validate SID in parent security descriptor during ACL inheritance
    - smb: client: require net admin for CIFS SWN netlink
    - smb: client: protect tc_count increment in
      smb2_find_smb_sess_tcon_unlocked()
    - smb: client: use data_len for SMB2 READ encrypted folioq copy
    - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close
    - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX
    - ALSA: ua101: Reject too-short USB descriptors
    - ALSA: pcm: Don't setup bogus iov_iter for silencing
    - ALSA: asihpi: Fix potential OOB array access at reading cache
    - efi: Allocate runtime workqueue before ACPI init
    - io_uring/waitid: clear waitid info before copying it to userspace
    - drivers/base/memory: fix memory block reference leak in poison accounting
    - ipv6: ioam: refresh hdr pointer before ioam6_event()
    - mm/memory_hotplug: fix memory block reference leak on remove
    - net: wwan: iosm: fix potential memory leaks in ipc_imem_init()
    - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()
    - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START
    - Bluetooth: bnep: Fix UAF read of dev->name
    - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths
    - Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer
    - Bluetooth: MGMT: validate Add Extended Advertising Data length
    - Bluetooth: serialize accept_q access
    - phonet/pep: disable BH around forwarded sk_receive_skb()
    - net: bcmgenet: keep RBUF EEE/PM disabled
    - net: ifb: report ethtool stats over num_tx_queues
    - net: pse-pd: fix sign on -ENOENT check in of_load_pse_pis()
    - netfilter: ip6t_hbh: reject oversized option lists
    - netfilter: nf_queue: hold bridge skb->dev while queued
    - netfilter: ipset: stop hash:* range iteration at end
    - netfilter: nft_inner: Fix IPv6 inner_thoff desync
    - sched_ext: Fix missing warning in scx_set_task_state() default case
    - sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path
    - cgroup/cpuset: Reset DL migration state on can_attach() failure
    - fs/ntfs3: handle attr_set_size() errors when truncating files
    - l2tp: use list_del_rcu in l2tp_session_unhash
    - qed: fix double free in qed_cxt_tables_alloc()
    - ring-buffer: Fix reporting of missed events in iterator
    - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()
    - vsock/vmci: fix UAF when peer resets connection during handshake
    - vsock/virtio: reset connection on receiving queue overflow
    - wifi: ath11k: clear shared SRNG pointer state on restart
    - ipv4: raw: reject IP_HDRINCL packets with ihl < 5
    - ixgbevf: fix use-after-free in VEPA multicast source pruning
    - rbd: eliminate a race in lock_dwork draining on unmap
    - lsm: hold cred_guard_mutex for lsm_set_self_attr()
    - [arm64] octeontx2-af: CGX: add bounds check to cgx_speed_mbps index
    - ice: fix setting promisc mode while adding VID filter
    - ice: restore PTP Rx timestamp config after ethtool set-channels
    - wifi: cfg80211: advance loop vars in cfg80211_merge_profile()
    - af_unix: Fix UAF read of tail->len in unix_stream_data_wait()
    - wifi: mac80211: consume only present negotiated TTLM maps
    - cifs: Fix busy dentry used after unmounting
    - tracing: Do not call map->ops->elt_free() if elt_alloc() fails
    - [arm64] probes: Handle probes on hinted conditional branch instructions
    - [arm64] KVM: arm64: vgic-its: Reject restored DTE with out-of-range
      num_eventid_bits
    - [arm64] KVM: arm64: vgic: Free private_irqs when init fails after
      allocation
    - [riscv64] kvm: return SBI_ERR_FAILURE for pmu_snapshot_set_shmem() when
      OOM
    - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe
    - spi: qup: fix error pointer deref after DMA setup failure
    - [arm64] phy: tegra: xusb: Fix per-pad high-speed termination calibration
    - scsi: isci: Fix use-after-free in device removal path
    - spi: ep93xx: fix error pointer deref after DMA setup failure
    - spi: sprd: fix error pointer deref after DMA setup failure
    - spi: ti-qspi: fix use-after-free after DMA setup failure
    - RDMA/siw: Reject MPA FPDU length underflow before signed receive math
    - device property: set fwnode->secondary to NULL in fwnode_init()
    - drm/virtio: use uninterruptible resv lock for plane updates
    - drm/amdgpu/vpe: Force collaborate sync after TRAP
    - drm/bridge: it66121: acquire reset GPIO in probe
    - drm/bridge: megachips: remove bridge when irq request fails
    - drm/amd/display: Fix integer overflow in bios_get_image()
    - drm/amd/display: Validate GPIO pin LUT table size before iterating
    - drm/amd/display: Validate payload length and link_index in
      dc_process_dmub_aux_transfer_async
    - batman-adv: mcast: fix use-after-free in orig_node RCU release
    - batman-adv: clear current gateway during teardown
    - batman-adv: dat: handle forward allocation error
    - batman-adv: fix fragment reassembly length accounting
    - batman-adv: fix tp_meter counter underflow during shutdown
    - batman-adv: frag: disallow unicast fragment in fragment
    - batman-adv: bla: fix report_work leak on backbone_gw purge
    - batman-adv: tp_meter: avoid use of uninit sender vars
    - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown
    - batman-adv: tp_meter: fix race condition in send error reporting
    - batman-adv: tt: fix negative last_changeset_len
    - batman-adv: tt: fix negative tt_buff_len
    - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock
    - hwmon: (pmbus/adm1266) reject implausible blackbox record_count
    - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer
    - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized
      buffer
    - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR
    - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in
      get_multiple
    - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe()
    - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe()
    - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO
      accessors
    - [arm64] pinctrl: renesas: rzg2l: Fix incorrect PUPD register offset for
      high pins during suspend/resume
    - HID: uclogic: Fix regression of input name assignment
    - [riscv64] mm: Fixup no5lvl failure when vaddr is invalid
    - [arm64] pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for
      sm8150
    - ALSA: hda: cs35l56: Put ACPI device after setting companion
    - ALSA: hda: cs35l41: Put ACPI device on missing physical node
    - btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file()
    - netfilter: x_tables: unregister the templates first
    - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist()
    - tcp: Fix imbalanced icsk_accept_queue count.
    - ice: fix setting RSS VSI hash for E830
    - ice: fix locking in ice_dcb_rebuild()
    - net: lan966x: avoid unregistering netdev on register failure
    - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register
      access
    - NFSD: Fix infinite loop in layout state revocation
    - irqchip/ath79-cpu: Remove unused function
    - ublk: reject max_sectors smaller than PAGE_SECTORS in parameter validation
    - nsfs: fix wrong error code returned for pidns ioctls
    - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT
    - zonefs: handle integer overflow in zonefs_fname_to_fno
    - tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key().
    - [powerpc*] fix dead default for GUEST_STATE_BUFFER_TEST
    - netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call
    - netfs: Fix overrun check in netfs_extract_user_iter()
    - netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone
    - netfs: Defer the emission of trace_netfs_folio()
    - netfs: Fix streaming write being overwritten
    - netfs: Fix potential deadlock in write-through mode
    - netfs: Fix write streaming disablement if fd open O_RDWR
    - netfs: Fix early put of sink folio in netfs_read_gaps()
    - netfs: Fix partial invalidation of streaming-write folio
    - netfs: Fix a few minor bugs in netfs_page_mkwrite()
    - netfs: Remove unnecessary references to pages
    - netfs: Fix folio->private handling in netfs_perform_write()
    - net: ethernet: cortina: Make RX SKB per-port
    - net: ethernet: cortina: Drop half-assembled SKB
    - net: ethernet: cortina: Carry over frag counter
    - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference
    - wifi: ath11k: fix error path leaks in some WMI WOW calls
    - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm()
    - wifi: ath10k: skip WMI and beacon transmission when device is wedged
    - blk-integrity: remove seed for user mapped buffers
    - block: don't overwrite bip_vcnt in bio_integrity_copy_user()
    - block: recompute nr_integrity_segments in blk_insert_cloned_request
    - HID: quirks: really enable the intended work around for appledisplay
    - block: modify bio_integrity_map_user to accept iov_iter as argument
    - block: drop direction param from bio_integrity_copy_user()
    - blk-integrity: use simpler alignment check
    - blk-integrity: enable p2p source and destination
    - block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user()
    - accel/qaic: Add overflow check to remap_pfn_range during mmap
    - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint
    - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics
    - [arm64] drm/msm/dsi: don't dump registers past the mapped region
    - [arm64] drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN
    - [powerpc*] time: Remove redundant preempt_disable|enable() calls from
      arch_irq_work_raise()
    - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot
    - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring
    - net: tls: prevent chain-after-chain in plain text SG
    - net: phy: DP83TC811: add reading of abilities
    - [amd64] x86/xen: Fix xen_e820_swap_entry_with_ram()
    - tls: Preserve sk_err across recvmsg() when data has been copied
    - net/mlx5: Do not restore destination-less TC rules
    - scsi: sd: Fix return code handling in sd_spinup_disk()
    - ALSA: scarlett2: Add missing error check when initialise Autogain Status
    - io_uring/net: punt IORING_OP_BIND async if it needs file create
    - btrfs: fix squota accounting during enable generation
    - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache()
    - [arm64] drm/msm/snapshot: fix dumping of the unaligned regions
    - drm/xe/gsc: Fix double-free of managed BO in error path
    - drm/xe/vf: Fix signature of print functions
    - drm/xe/pf: Fix CFI failure in debugfs access
    - wifi: ath11k: fix peer resolution on rx path when peer_id=0
    - ice: ptp: serialize E825 PHY timer start with PTP lock
    - [amd64] drm/i915/dp: Fix readback for target_rr in Adaptive Sync SDP
    - [arm64] net: dsa: mt7530: fix FDB entries not aging out with short timeout
    - [arm64] net: dsa: mt7530: preserve VLAN tags on trapped link-local frames
    - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer
    - platform/surface: aggregator_registry: omit battery & AC nodes on Surface
      Laptop 7
    - [amd64] platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL
    - [amd64] platform/x86: hp_accel: Check ACPI_COMPANION() against NULL
    - [amd64] platform/x86: intel-hid: Check ACPI_HANDLE() against NULL
    - [amd64] platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL
    - RDMA/rtrs: Fix use-after-free in path file creation cleanup
    - net: bridge: Flush multicast groups when snooping is disabled
    - bridge: mcast: Fix a possible use-after-free when removing a bridge port
    - pds_core: fix error handling in pdsc_devcmd_wait
    - pds_core: fix debugfs_lookup dentry leak and error handling
    - wifi: mac80211: fix MLE defragmentation
    - ALSA: seq: Serialize UMP output teardown with event_input
    - tracing: Avoid NULL return from hist_field_name() on truncation
    - Bluetooth: btmtk: fix urb->setup_packet leak in error paths
    - net: ag71xx: check error for platform_get_irq
    - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx
    - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n)
    - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed
    - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove()
    - drm/xe/oa: Fix exec_queue leak on width check in stream open
    - [arm64] octeontx2-af: npc: Fix allmulticast skip logic for LBK and SDP VFs
    - net: mana: validate rx_req_idx to prevent out-of-bounds array access
    - pds_core: ensure null-termination for firmware version strings
    - net: gro: don't merge zcopy skbs
    - landlock: Fix TCP handling of short AF_UNSPEC addresses
    - block: make bio_integrity_map_user() static inline
    - security/keys: fix missed RCU read section on lookup
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.93
    - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size
    - [arm64] drm/v3d: Fix use-after-free of CPU job query arrays on error path
    - [arm64] drm/v3d: Release indirect CSD GEM reference on CPU job free
    - net/sched: cls_fw: fix NULL dereference of "old" filters before change()
    - net: mctp: ensure our nlmsg responses are initialised (CVE-2026-45930)
    - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit
    - net/sched: sch_sfb: Replace direct dequeue call with peek and
      qdisc_dequeue_peeked
    - bcache: fix uninitialized closure object
    - net: cpsw_new: Fix potential unregister of netdev that has not been
      registered yet (CVE-2026-43219)
    - [arm64] Introduce esr_is_ubsan_brk()
    - [arm64] debug: clean up single_step_handler logic
    - [arm64] refactor aarch32_break_handler()
    - [arm64] debug: call software breakpoint handlers statically
    - [arm64] debug: call step handlers statically
    - [arm64] debug: remove break/step handler registration infrastructure
    - [arm64] entry: Add entry and exit functions for debug exceptions
    - [arm64] debug: split hardware breakpoint exception entry
    - [arm64] debug: refactor reinstall_suspended_bps()
    - [arm64] debug: split single stepping exception entry
    - [arm64] debug: split hardware watchpoint exception entry
    - [arm64] debug: split brk64 exception entry
    - [arm64] debug: split bkpt32 exception entry
    - [arm64] debug: remove debug exception registration infrastructure
    - [arm64] debug: always unmask interrupts in el0_softstp()
    - nfc: llcp: Fix use-after-free in llcp_sock_release()
    - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()
    - xfrm: Check for underflow in xfrm_state_mtu
    - nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems
    - netfilter: synproxy: refresh tcphdr after skb_ensure_writable
    - netfilter: xt_cpu: prefer raw_smp_processor_id
    - netfilter: ebtables: fix OOB read in compat_mtw_from_user
    - tun: free page on short-frame rejection in tun_xdp_one() (CVE-2026-46321)
    - tun: free page on build_skb failure in tun_xdp_one() (CVE-2026-46322)
    - vsock: keep poll shutdown state consistent
    - net: netlink: fix sending unassigned nsid after assigned one
    - net: netlink: don't set nsid on local notifications
    - net/smc: Do not re-initialize smc hashtables
    - [s390x] net/iucv: fix locking in .getsockopt
    - scsi: core: Run queues for all non-SDEV_DEL devices from
      scsi_run_host_queues
    - ipv4: free net->ipv4.sysctl_local_reserved_ports after
      unregister_net_sysctl_table()
    - ALSA: pcm: oss: Fix setup list UAF on proc write error
    - [amd64] ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors
    - net: hsr: fix potential OOB access in supervision frame handling
    - [amd64] accel/ivpu: prevent uninitialized data bug in debugfs
    - gpio: mxc: fix irq_high handling
    - net: Avoid checksumming unreadable skb tail on trim
    - ethtool: rss: fix hkey leak when indir_size is 0
    - ethtool: module: avoid leaking a netdev ref on module flash errors
    - ethtool: module: check fw_flash_in_progress under rtnl_lock
    - ethtool: module: fix cleanup if socket used for flashing multiple devices
    - ethtool: cmis: require exact CDB reply length
    - ethtool: cmis: fix u16-to-u8 truncation of msleep_pre_rpl
    - net: ethtool: Add new parameters and a function to support EPL
    - net: ethtool: Add support for writing firmware blocks using EPL payload
    - ethtool: cmis: validate start_cmd_payload_size from module
    - ethtool: cmis: validate fw->size against start_cmd_payload_size
    - tunnels: load network headers after skb_cow() in
      iptunnel_pmtud_build_icmp[v6]()
    - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()
    - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()
    - ASoC: codecs: simple-mux: Fix enum control bounds check
    - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()
    - bonding: refuse to enslave CAN devices
    - ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES
    - ethtool: linkstate: fix unbalanced ethnl_ops_complete() on PHY lookup
      error
    - ethtool: pse-pd: fix missing ethnl_ops_complete()
    - ethtool: strset: fix header attribute index in ethnl_req_get_phydev()
    - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during
      fallback
    - ethtool: eeprom: add more safeties to EEPROM Netlink fallback
    - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
    - net/sched: Revert "net/sched: Restrict conditions for adding duplicating
      netems to qdisc tree"
    - net/sched: fix packet loop on netem when duplicate is on
    - net/sched: act_mirred: Move the recursion counter struct netdev_xmit
    - net/sched: act_mirred: add loop detection
    - net: Introduce skb tc depth field to track packet loops
    - net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loop
    - net/sched: act_mirred: Fix return code in early mirred redirect error
      paths
    - net/handshake: Use spin_lock_bh for hn_lock
    - nvme-tcp: store negative errno in queue->tls_err
    - net/handshake: Pass negative errno through handshake_complete()
    - remove pointless includes of <linux/fdtable.h>
    - net/handshake: Take a long-lived file reference at submit
    - net/handshake: Drain pending requests at net namespace exit
    - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success
    - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
    - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close
    - [arm64,armhf] gpio: rockchip: convert bank->clk to devm_clk_get_enabled()
    - [amd64,arm64] net: mana: Add NULL guards in teardown path to prevent panic
      on attach failure
    - sctp: fix race between sctp_wait_for_connect and peeloff
    - ipv6: fix possible infinite loop in rt6_fill_node()
    - ipv6: fix possible infinite loop in fib6_select_path()
    - net: skbuff: fix pskb_carve leaking zcopy pages
    - perf: Fix dangling cgroup pointer in cpuctx
    - batman-adv: v: stop OGMv2 on disabled interface
    - batman-adv: tvlv: abort OGM send on tvlv append failure
    - batman-adv: tt: reject oversized local TVLV buffers
    - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface
    - batman-adv: tvlv: reject oversized TVLV packets
    - batman-adv: iv: recover OGM scheduling after forward packet error
    - batman-adv: tp_meter: avoid role confusion in tp_list
    - [s390x] cio: Restore GFP_DMA for CHSC allocation
    - batman-adv: tp_meter: directly shut down timer on cleanup
    - batman-adv: tt: fix TOCTOU race for reported vlans
    - batman-adv: tt: avoid empty VLAN responses
    - batman-adv: bla: avoid double decrement of bla.num_requests
    - mm/page_alloc: clear page->private in free_pages_prepare()
      (CVE-2026-43303)
    - media: rc: fix race between unregister and urb/irq callbacks
    - media: rc: ttusbir: fix inverted error logic
    - inet: frags: add inet_frag_queue_flush()
    - inet: frags: flush pending skbs in fqdir_pre_exit() (CVE-2025-68768)
    - HID: core: Add printk_ratelimited variants to hid_warn() etc
    - HID: pass the buffer size to hid_report_raw_event
    - HID: core: introduce hid_safe_input_report()
    - HID: core: Fix size_t specifier in hid_report_raw_event()
    - [amd64] drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD
      register
    - [amd64] drm/i915/psr: Read Intel DPCD workaround register
    - drm/dp: Add eDP 1.5 bit definition
    - [amd64] drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line
      used
    - [arm64] io: Rename ioremap_prot() to __ioremap_prot()
    - [arm64] io: Extract user memory type in ioremap_prot() (CVE-2026-23346)
    - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X
    - batman-adv: tt: prevent TVLV entry number overflow
    - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer
    - usb: typec: ucsi: ccg: reject firmware images without a ':' record header
    - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers
    - usb: typec: tcpm: bound altmode_desc[] per iteration in
      svdm_consume_modes()
    - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO
    - usb: typec: altmodes/displayport: validate count before reading Status
      Update VDO
    - usb: typec: wcove: don't write past struct pd_message in
      wcove_read_rx_buffer()
    - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT
    - usb: typec: ucsi: validate connector number in ucsi_connector_change()
    - USB: serial: safe_serial: fix memory corruption with small endpoint
    - media: rc: igorplugusb: fix control request setup packet
    - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free()
    - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse
    - Bluetooth: btusb: Allow firmware re-download when version matches
    - hpfs: fix a crash if hpfs_map_dnode_bitmap fails
    - ipc: limit next_id allocation to the valid ID range
    - auxdisplay: line-display: fix OOB read on zero-length message_store()
    - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()
    - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn
    - Bluetooth: HIDP: fix missing length checks in hidp_input_report()
    - Bluetooth: ISO: fix UAF in iso_recv_frame
    - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock
    - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync
    - Input: xpad - fix out-of-bounds access for Share button
    - parport: Fix race between port and client registration (Closes: #1130365)
    - USB: cdc-acm: Fix bit overlap and move quirk definitions to header
    - [arm64] KVM: arm64: PMU: Preserve AArch32 counter low bits
    - [amd64] KVM: SVM: Flush the current TLB when transitioning from xAVIC =>
      x2AVIC
    - [amd64] KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use
    - [amd64] KVM: SEV: Use the size of the PSC header as the minimum size for
      PSC requests
    - [amd64] KVM: SEV: WARN if KVM attempts to setup scratch area with
      min_len==0
    - [amd64] KVM: SEV: Compute the correct max length of the in-GHCB scratch
      area
    - [amd64] KVM: SEV: Check PSC request indices against the actual size of the
      buffer
    - [amd64] KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC
      buffer
    - [amd64] KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc()
    - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux
    - iio: adc: npcm: fix unbalanced clk_disable_unprepare()
    - iio: dac: max5821: fix return value check in powerdown sync
    - iio: dac: ad5686: fix input raw value check
    - iio: dac: ad5686: acquire lock when doing powerdown control
    - iio: adc: mt6359: fix unchecked return value in mt6358_read_imp
    - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw
    - iio: gyro: itg3200: fix i2c read into the wrong stack location
    - iio: gyro: adis16260: fix division by zero in write_raw
    - iio: ssp_sensors: cancel delayed work_refresh on remove
    - iio: temperature: tsys01: fix broken PROM checksum validation
    - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL
    - iio: light: cm3323: fix reg_conf not being initialized correctly
    - iio: buffer: hw-consumer: fix use-after-free in error path
    - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf()
    - USB: serial: omninet: fix memory corruption with small endpoint
    - usb: cdns3: gadget: fix request skipping after clearing halt
    - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy
      acquisition failure
    - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently
      leaks the runtime PM usage counter across bind/unbind cycles
    - usb: dwc2: Fix use after free in debug code
    - Input: elan_i2c - validate firmware size before use
    - wireguard: send: append trailer after expanding head
    - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data
    - macsec: fix replay protection at XPN lower-PN wrap
    - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()
    - [arm64] ASoC: qcom: q6asm-dai: fix error handling in prepare and
      set_params
    - ipv6: exthdrs: refresh nh after handling HAO option
    - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().
    - ipv6: validate extension header length before copying to cmsg
    - xfrm: input: hold netns during deferred transport reinjection
    - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname
    - ip6: vti: Use ip6_tnl.net in vti6_changelink().
    - net: skbuff: fix missing zerocopy reference in pskb_carve helpers
    - HID: wacom: Fix OOB write in wacom_hid_set_device_mode()
    - nfc: hci: fix out-of-bounds read in HCP header parsing
    - xfrm: route MIGRATE notifications to caller's netns
    - xfrm: ah: use skb_to_full_sk in async output callbacks
    - ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware 2417
    - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without
      direction check
    - [arm64] ASoC: qcom: q6asm-dai: close stream only when running
    - [arm64] ASoC: qcom: q6asm-dai: do not set stream state in event and
      trigger callbacks
    - xfrm: esp: restore combined single-frag length gate
    - Input: xpad - add "Nova 2 Lite" from GameSir
    - Input: xpad - add support for ASUS ROG RAIKIRI II
    - ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops
    - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem
    - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490
    - [amd64] comedi: comedi_test: fix check for valid scan_begin_src in
      waveform_ai_cmdtest()
    - [amd64] comedi: comedi_test: Fix limiting of convert_arg in
      waveform_ai_cmdtest()
    - counter: Fix refcount leak in counter_alloc() error path
    - tty: serial: pch_uart: add check for dma_alloc_coherent()
    - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers
    - usb: chipidea: core: convert ci_role_switch to local variable
    - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval
    - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub
      controllers
    - usb: storage: Add quirks for PNY Elite Portable SSD
    - usbip: vudc: Fix use after free bug in vudc_remove due to race condition
    - usb: usbtmc: check URB actual_length for interrupt-IN notifications
    - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize
    - usb: typec: tcpm: improve handling of DISCOVER_MODES failures
    - USB: serial: option: add MeiG SRM813Q
    - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL
    - USB: serial: belkin_sa: validate interrupt status length
    - USB: serial: cypress_m8: validate interrupt packet headers
    - USB: serial: keyspan: fix missing indat transfer sanity check
    - USB: serial: mxuport: fix memory corruption with small endpoint
    - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check
    - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind
    - usb: gadget: net2280: Fix double free in probe error path
    - usb: gadget: f_hid: fix device reference leak in hidg_alloc()
    - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling
    - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports
    - usb: gadget: f_fs: copy only received bytes on short ep0 read
    - usb: gadget: f_fs: serialize DMABUF cancel against request completion
    - [amd64] thunderbolt: property: Reject u32 wrap in
      tb_property_entry_valid()
    - [amd64] thunderbolt: property: Reject dir_len < 4 to prevent size_t
      underflow
    - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker
    - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32
    - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf
    - scsi: target: iscsi: Validate CHAP_R length before base64 decode
    - drm/hyperv: validate resolution_count and fix WIN8 fallback
    - drm/hyperv: validate VMBus packet size in receive callback
    - [amd64] drm/i915: Fix potential UAF in TTM object purge
    - drm/amd/pm/si: Disregard vblank time when no displays are connected
    - serial: altera_jtaguart: handle uart_add_one_port() failures
    - serial: qcom-geni: fix UART_RX_PAR_EN bit position
    - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion
      IRQ
    - serial: sh-sci: fix memory region release in error path
    - serial: zs: Fix swapped RI/DSR modem line transition counting
    - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma
    - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr
    - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger
    - drm/amdkfd: Check for pdd drm file first in CRIU restore path
    - serial: dz: Fix bootconsole message clobbering at chip reset
    - serial: dz: Fix bootconsole handover lockup
    - serial: dz: Convert to use a platform device
    - serial: zs: Fix bootconsole handover lockup
    - serial: zs: Switch to using channel reset
    - serial: zs: Convert to use a platform device
    - USB: serial: cypress_m8: fix memory corruption with small endpoint
    - USB: serial: digi_acceleport: fix memory corruption with small endpoints
    - xhci: tegra: Fix ghost USB device on dual-role port unplug
    - iommu: Skip PASID validation for devices without PASID capability
    - [amd64] x86/boot: Disable stack protector for early boot code
    - [amd64] x86/kexec: Disable KCOV instrumentation after load_segments()
      (CVE-2026-43331)
    - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg
    - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer
    - serdev: Provide a bustype shutdown function
    - Bluetooth: hci_qca: Migrate to serdev specific shutdown function
    - Bluetooth: hci_qca: Convert timeout from jiffies to ms
    - ALSA: scarlett2: Return ENOSPC for out-of-bounds flash writes
    - ALSA: scarlett2: Allow flash writes ending at segment boundary
    - mm/memory: fix spurious warning when unmapping device-private/exclusive
      pages
    - [amd64] platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error
      recovery
    - net: hsr: defer node table free until after RCU readers
    - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient
    - ice: fix VF queue configuration with low MTU values
    - ring-buffer: Flush and stop persistent ring buffer on panic
    - mptcp: cleanup fallback dummy mapping generation
    - mptcp: reset rcv wnd on disconnect
    - [arm64] tlb: Flush walk cache when unsharing PMD tables
    - [arm64] octeontx2-pf: avoid double free of pool->stack on AQ init failure
    - mptcp: introduce the mptcp_init_skb helper
    - mptcp: handle first subflow closing consistently
    - mptcp: do not drop partial packets
    - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs()
    - iio: chemical: scd30: Use guard(mutex) to allow early returns
    - iio: chemical: scd30: fix division by zero in write_raw
    - iio: dac: ad5686: fix ref bit initialization for single-channel parts
    - ALSA: firewire-motu: Protect register DSP event queue positions
    - [arm64] usb: dwc3: xilinx: fix error handling in zynqmp init error paths
    - usb: musb: omap2430: Fix use-after-free in omap2430_probe()
    - usb: typec: ucsi: Check if power role change actually happened before
      handling
    - [amd64] thunderbolt: property: Cap recursion depth in
      __tb_property_parse_dir()
    - scsi: target: iscsi: Fix CRC overread and double-free in
      iscsit_handle_text_cmd()
    - usb: typec: ucsi: Don't update power_supply on power role change if not
      connected
    - [amd64] x86/alternatives: Rename 'apply_relocation()' to
      'text_poke_apply_relocation()'
    - [amd64] x86/ftrace: Relocate %rip-relative percpu refs in dynamic
      trampolines
    - hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read with
      pmbus_lock
    - hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock
    - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock
    - mm: perform all memfd seal checks in a single place
    - mm/memfd: fix spelling and grammatical issues
    - memfd: deny writeable mappings when implying SEAL_WRITE
    - usb: core: Fix SuperSpeed root hub wMaxPacketSize
    - ethtool: cmis_cdb: Fix incorrect read / write length extension
    - net/sched: act_mirred: Fix blockcast recursion bypass leading to stack
      overflow
    - [arm64] KVM: arm64: vgic-its: Drop the translation cache reference only
      for the erased entry (CVE-2026-46316)
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.94
    - bpf: Free reuseport cBPF prog after RCU grace period. (CVE-2026-52910)
    - USB: serial: mct_u232: fix memory corruption with small endpoint
    - [armhf] group is_permission_fault() with is_translation_fault()
    - [armhf] allow __do_kernel_fault() to report execution of memory faults
    - [armhf] fix hash_name() fault
    - [armhf] fix branch predictor hardening
    - net: phy: micrel: fix LAN8814 QSGMII soft reset
    - wifi: remove zero-length arrays
    - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl
    - ipv6: mcast: Fix use-after-free when processing MLD queries
    - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS
    - [arm64] tee: optee: prevent use-after-free when the client exits before
      the supplicant
    - [arm64]soc: qcom: ice: Return -ENODEV if the ICE platform device is not
      found
    - erofs: add sysfs node to drop internal caches
    - erofs: tidy up synchronous decompression
    - erofs: fix use-after-free on sbi->sync_decompress
    - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers
    - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id
    - ipvs: clear the svc scheduler ptr early on edit
    - netfilter: synproxy: add mutex to guard hook reference counting
    - netfilter: conntrack_irc: fix possible out-of-bounds read
    - netfilter: nft_ct: bail out on template ct in get eval
    - netfilter: bridge: make ebt_snat ARP rewrite writable
    - dm cache policy smq: check allocation under invalidate lock
    - net/sched: act_api: use RCU with deferred freeing for action lifecycle
    - 6lowpan: fix off-by-one in multicast context address compression
    - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()
    - devlink: Release nested relation on devlink free
    - [arm64] drm/imx: Fix three kernel-doc warnings in dcss-scaler.c
    - wifi: mac80211: limit injected antenna index in
      ieee80211_parse_tx_radiotap
    - pcnet32: stop holding device spin lock during napi_complete_done
    - net: Annotate sk->sk_write_space() for UDP SOCKMAP.
    - hsr: Remove WARN_ONCE() in hsr_addr_is_self().
    - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr
    - net: lan743x: permit VLAN-tagged packets up to configured MTU
    - net: fec: fix pinctrl default state restore order on resume
    - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()
    - Bluetooth: MGMT: validate advertising TLV before type checks
    - Bluetooth: RFCOMM: validate skb length in MCC handlers
    - Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension
      handling
    - Bluetooth: bnep: reject short frames before parsing
    - Bluetooth: fix memory leak in error path of hci_alloc_dev()
    - Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync
    - Bluetooth: ISO: Fix not using bc_sid as advertisement SID
    - Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls
    - Bluetooth: MGMT: Fix backward compatibility with userspace
    - [arm64] octeontx2-pf: Fix NDC sync operation errors
    - [arm64] octeontx2-af: Fix initialization of mcam's entry2target_pffunc
      field
    - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options
    - ptp: vclock: Switch from RCU to SRCU
    - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown
    - net_sched: act_pedit: use RCU in tcf_pedit_dump()
    - net/sched: fix pedit partial COW leading to page cache corruption
      (CVE-2026-46331)
    - [arm64] octeontx2-af: npc: Fix CPT channel mask in npc_install_flow
    - vxlan: vnifilter: send notification on VNI add
    - vxlan: vnifilter: fix spurious notification on VNI update
    - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()
    - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr
    - sctp: purge outqueue on stale COOKIE-ECHO handling
    - ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp
    - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()
    - time: Fix off-by-one in settimeofday() usec validation
    - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked
      streams
    - ALSA: seq: dummy: fix UMP event stack overread
    - ima: kexec: skip IMA segment validation after kexec soft reboot
    - ima: kexec: move IMA log copy from kexec load to execute
    - spi: cadence-quadspi: fix unclocked access on unbind (CVE-2026-46203)
    - tools/rv: Fix cleanup after failed trace setup
    - tap: free page on error paths in tap_get_user_xdp() (CVE-2026-46320)
    - [arm64] tlb: Allow XZR argument to TLBI ops
    - [arm64] tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI
    - iomap: don't revert iov_iter on partially completed buffered writes
    - dma-debug: fix physical address retrieval in debug_dma_sync_sg_for_device
    - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()
    - netlabel: validate unlabeled address and mask attribute lengths
    - gpio: mvebu: fix NULL pointer dereference in suspend/resume
    - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls
    - tcp: restrict SO_ATTACH_FILTER to priv users
    - net: add pskb_may_pull() to skb_gro_receive_list()
    - net/mlx4: avoid GCC 10 __bad_copy_from() false positive
    - net: ibm: emac: Fix use-after-free during device removal
    - netdev: fix double-free in netdev_nl_bind_rx_doit()
    - net: phy: clean the sfp upstream if phy probing fails
    - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove
    - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list
    - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure
    - net/mlx5: Use effective affinity mask for IRQ selection
    - ipv6: sit: reload inner IPv6 header after GSO offloads
    - net: openvswitch: fix possible kfree_skb of ERR_PTR
    - r8152: handle the return value of usb_reset_device()
    - gpio: zynq: fix runtime PM leak on remove
    - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()
    - net: guard timestamp cmsgs to real error queue skbs
    - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic
      completion
    - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
    - rds: mark snapshot pages dirty in rds_info_getsockopt()
    - netfilter: revalidate bridge ports
    - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister
    - netfilter: x_tables: avoid leaking percpu counter pointers
    - netfilter: nf_log: validate MAC header was set before dumping it
    - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag
    - [arm64,armhf] net: mvpp2: sync RX data at the hardware packet offset
    - [arm64,armhf] net: mvpp2: limit XDP frame size to the RX buffer
    - [arm64,armhf] net: mvpp2: Add metadata support for xdp mode
    - [arm64,armhf] net: mvpp2: refill RX buffers before XDP or skb use
    - [arm64,armhf] net: mvpp2: build skb from XDP-adjusted data on XDP_PASS
    - ipv6: Fix a potential NPD in cleanup_prefix_route()
    - netfilter: ctnetlink: ensure safe access to master conntrack
      (CVE-2026-43116)
    - writeback: Avoid contention on wb->list_lock when switching inodes
    - writeback: Fix use after free in inode_switch_wbs_work_fn()
    - xfrm: hold device only for the asynchronous decryption
    - xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)
    - [amd64] KVM: VMX: Update SVI during runtime APICv activation
    - [arm64] clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from
      getting parked
    - clk: samsung: gs101: Fix missing USI7_USI DIV clock in peric0_clk_regs
    - [arm64] clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration
      time
    - drm/virtio: Fix driver removal with disabled KMS
    - [arm64,armhf] drm/vc4: fix krealloc() memory leak
    - drm/xe: fix refcount leak in xe_range_fence_insert()
    - netfilter: nft_tunnel: fix use-after-free on object destroy
    - [arm64] tee: shm: fix shm leak in register_shm_helper()
    - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend
    - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig
    - [arm64] soc: qcom: ice: Fix race between qcom_ice_probe() and
      of_qcom_ice_get()
    - [amd64] accel/ivpu: Add bounds checks for firmware log indices
    - [amd64] accel/ivpu: Add buffer overflow check in MS get_info_ioctl
    - [amd64] accel/ivpu: Fix signed integer truncation in IPC receive
    - tracing/probes: Point the error offset correctly for eprobe argument error
    - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation
    - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying
    - [amd64] KVM: SEV: Decouple the need to sync the GHCB SA from the need to
      free the SA
    - [amd64] drm/i915/gem: Fix phys BO pread/pwrite with offset
    - pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init
    - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL
    - xfrm: espintcp: do not reuse an in-progress partial send
    - USB: serial: io_ti: fix heap overflow in get_manuf_info()
    - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()
    - USB: serial: option: add usb-id for Dell Wireless DW5826e-m
    - USB: serial: kl5kusb105: fix bulk-out buffer overflow
    - ALSA: timer: Forcibly close timer instances at closing
    - ALSA: timer: Fix UAF at snd_timer_user_params()
    - io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries
    - drm/virtio: fix dma_fence refcount leak on error in
      virtio_gpu_dma_fence_wait()
    - drm/amd/display: Reject gpio_bitshift >= 32 in
      bios_parser_get_gpio_pin_info()
    - mm/huge_memory: update file PMD counter before folio_put()
    - mm/damon/ops-common: call folio_test_lru() after folio_get()
    - RDMA/srp: bound SRP_RSP sense copy by the received length
    - zram: fix use-after-free in zram_bvec_write_partial()
    - udp: clear skb->dev before running a sockmap verdict
    - mptcp: fix retransmission loop when csum is enabled
    - mptcp: close TOCTOU race while computing rcv_wnd
    - mptcp: allow subflow rcv wnd to shrink
    - mptcp: sockopt: check timestamping ret value
    - mptcp: add-addr: always drop other suboptions
    - wifi: nl80211: reject oversized EMA RNR lists
    - vsock/vmci: fix sk_ack_backlog leak on failed handshake
    - timers/migration: Fix livelock in tmigr_handle_remote_up()
    - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write
    - bnxt_en: Fix NULL pointer dereference
    - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
    - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush
    - pidfd: refuse access to tasks that have started exiting harder
    - fs/qnx6: fix pointer arithmetic in directory iteration
    - fuse: reject fuse_notify() pagecache ops on directories
    - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()
    - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter
    - i2c: tegra: Fix NOIRQ suspend/resume
    - Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)
    - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard
    - ipc/shm: serialize orphan cleanup with shm_nattch updates
    - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context
    - misc: fastrpc: fix use-after-free race in fastrpc_map_create
    - misc: fastrpc: fix DMA address corruption due to find_vma misuse
    - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback
    - net/mlx5: Reorder completion before putting command entry in
      cmd_work_handler
    - net: bonding: fix NULL pointer dereference in bond_do_ioctl()
    - net: mv643xx: fix OF node refcount
    - net: rds: clear i_sends on setup unwind
    - nvmem: core: fix use-after-free bugs in error paths
    - nvmem: layouts: onie-tlv: fix hang on unknown types
    - [arm64] octeontx2-af: fix memory leak in rvu_setup_hw_resources()
    - io_uring/kbuf: don't truncate end buffer for bundles
    - io_uring/wait: fix min_timeout behavior
    - mm/hugetlb: restore reservation on error in hugetlb folio copy paths
    - mmc: core: Fix host controller programming for fixed driver type
    - mmc: dw_mmc-rockchip: Add missing private data for very old controllers
    - mmc: litex_mmc: Set mandatory idle clocks before CMD0
    - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC
    - mmc: sdhci: add signal voltage switch in sdhci_resume_host
    - pmdomain: imx: fix OF node refcount
    - rtase: Avoid sleeping in get_stats64()
    - rtase: Reset TX subqueue when clearing TX ring
    - sctp: diag: reject stale associations in dump_one path
    - sctp: stream: fully roll back denied add-stream state
    - [amd64] thunderbolt: Reject zero-length property entries in validator
    - [amd64] thunderbolt: Bound root directory content to block size
    - [amd64] thunderbolt: Clamp XDomain response data copy to allocation size
    - [amd64] thunderbolt: Validate XDomain request packet size before type cast
    - [amd64] thunderbolt: Limit XDomain response copy to actual frame size
    - [arm64] slimbus: qcom-ngd-ctrl: fix OF node refcount
    - [arm64] slimbus: qcom-ngd-ctrl: Fix up platform_driver registration
    - [arm64] slimbus: qcom-ngd-ctrl: Fix probe error path ordering
    - [arm64] slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd
    - [arm64] slimbus: qcom-ngd-ctrl: Initialize controller resources in
      controller
    - [arm64] slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership
    - [arm64] slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD
    - [arm64] slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock
    - drm/amdkfd: fix NULL dereference in get_queue_ids()
    - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11
    - drm/xe: Clear pending_disable before signaling suspend fence
    - [arm64,armhf] drm/v3d: Fix vaddr leak when indirect CSD has zeroed
      workgroups
    - drm/amdgpu: restart the CS if some parts of the VM are still invalidated
    - drm/amd/pm: fix smu13 power limit default/cap calculation
    - drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2
    - drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in
      set_soft_freq_limited_range
    - drm/amd/display: Bound VBIOS record-chain walk loops
    - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size
    - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size
    - drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs
    - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs
    - drm/amd/display: Use krealloc_array() in dal_vector_reserve()
    - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling
    - driver core: reject devices with unregistered buses
    - mailbox: Fix NULL message support in mbox_send_message()
    - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf
    - sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task()
    - netfilter: nft_fib: fix stale stack leak via the OIFNAME register
    - mm/memory-failure: fix hugetlb_lock AA deadlock in
      get_huge_page_for_hwpoison
    - RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper
    - RDMA/umem: Move umem dmabuf revoke logic into helper function
    - RDMA/umem: Add helpers for umem dmabuf revoke lock
    - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible
    - RDMA/umem: fix kernel-doc warnings
    - RDMA: Move DMA block iterator logic into dedicated files
    - RDMA/umem: Fix truncation for block sizes >= 4G
    - mm/hugetlb: avoid false positive lockdep assertion
    - mptcp: fix missing wakeups in edge scenarios
    - ipmi:ssif: Remove unnecessary indention
    - ipmi:ssif: NULL thread on error
    - ipvs: skip ipv6 extension headers for csum checks (CVE-2026-45850)
    - vsock/virtio: fix potential unbounded skb queue
    - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc
    - block: fix handling of dead zone write plugs
    - [arm64] cputype: Add NVIDIA Olympus definitions
    - [arm64] cputype: Add C1-Ultra definitions
    - [arm64] cputype: Add C1-Premium definitions
    - [arm64] errata: Mitigate TLBI errata on various Arm CPUs
    - [arm64] errata: Mitigate TLBI errata on NVIDIA Olympus CPU
    - [arm64] errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU
    - net: introduce EXPORT_IPV6_MOD() and EXPORT_IPV6_MOD_GPL()
    - tcp: use EXPORT_IPV6_MOD[_GPL]()
    - tcp: secure_seq: add back ports to TS offset (CVE-2026-23247)
    - mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation
    - vsock/virtio: fix skb overhead overflow on 32-bit builds
    - netfilter: require Ethernet MAC header before using eth_hdr()

[ Salvatore Bonaccorso ]
  * [rt] Refresh "ARM: enable irq in translation/section permission fault"
  * ip6_vti: set netns_immutable on the fallback device. (CVE-2026-52909)

-- Salvatore Bonaccorso <carnil@debian.org>  Sat, 20 Jun 2026 09:03:06 +0200

linux (6.12.90-2~bpo12+1) bookworm-backports; urgency=high

* Rebuild for bookworm-backports

-- Ben Hutchings <benh@debian.org>  Thu, 28 May 2026 09:16:24 +0200

linux (6.12.90-2) trixie-security; urgency=high

* smb: client: reject userspace cifs.spnego descriptions
  * net/rds: reset op_nents when zerocopy page pin fails (CVE-2026-43494)

-- Salvatore Bonaccorso <carnil@debian.org>  Wed, 27 May 2026 09:38:07 +0200

linux (6.12.90-1~bpo12+1) bookworm-backports; urgency=high

* Rebuild for bookworm-backports

-- Ben Hutchings <benh@debian.org>  Mon, 25 May 2026 21:09:08 +0200

linux (6.12.90-1) trixie-security; urgency=high

* New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.89
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.90
    - HID: playstation: Clamp num_touch_reports
    - media: uvcvideo: Enable VB2_DMABUF for metadata stream
    - [arm64] dts: lx2160a-cex7/lx2162a-sr-som: fix usd-cd & gpio pinmux
    - [arm64] regulator: mt6357: fix OF node reference imbalance
    - [arm64,armhf] regulator: rk808: fix OF node reference imbalance
    - media: videobuf2: Set vma_flags in vb2_dma_sg_mmap
    - [amd64] media: intel/ipu6: fix error pointer dereference
    - media: saa7164: add ioremap return checks and cleanups
    - spi: aspeed-smc: fix controller deregistration
    - [amd64] platform/x86: hp-wmi: Ignore backlight and FnLock events
    - vsock/virtio: fix MSG_PEEK ignoring skb offset when calculating bytes to
      copy
    - [arm64] drm/msm/gem: fix error handling in
      msm_ioctl_gem_info_get_metadata()
    - [amd64] drm/i915/psr: Init variable to avoid early exit from et alignment
      loop
    - drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure
    - drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count.
    - drm/amdgpu: gate VM CPU HDP flush on reset lock
    - drm/amd/pm: fix incorrect FeatureCtrlMask setting on smu v14.0.x
    - drm/amdkfd: Add upper bound check for num_of_nodes
    - drm/amdgpu: Add bounds checking to ib_{get,set}_value
    - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB
    - drm/amdgpu/vce: Prevent partial address patches
    - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg
    - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg
    - drm/amd/display: Change dither policy for 10 bpc output back to dithering
    - drm/gem: Fix inconsistent plane dimension calculation in
      drm_gem_fb_init_with_funcs()
    - drm/amdkfd: validate SVM ioctl nattr against buffer size
    - drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked()
    - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import()
    - drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked()
    - drm/radeon: add missing revision check for CI
    - drm/amdgpu: zero-initialize GART table on allocation
    - drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds
    - drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ
    - drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds
    - drm/amdkfd: Make all TLB-flushes heavy-weight
    - drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission
    - drm/amdgpu/pm: add missing revision check for CI
    - drm/amdgpu/pm: align Hawaii mclk workaround with radeon
    - [arm64] dts: ti: k3-am62a7-sk: Fix pin name in comment from M19 to N22
    - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL
    - batman-adv: fix integer overflow on buff_pos
    - batman-adv: reject new tp_meter sessions during teardown
    - batman-adv: stop caching unowned originator pointers in BAT IV
    - batman-adv: bla: prevent use-after-free when deleting claims
    - batman-adv: bla: only purge non-released claims
    - batman-adv: bla: put backbone reference on failed claim hash insert
    - usb: typec: tcpm: reset internal port states on soft reset AMS
    - usb: dwc3: Move GUID programming after PHY initialization
    - ALSA: hda: cs35l56: Propagate ASP TX source control errors
    - ALSA: misc: Use guard() for spin locks
    - ALSA: core: Serialize deferred fasync state checks
    - ALSA: seq: Notify client and port info changes
    - ALSA: seq: Fix UMP group 16 filtering
    - Bluetooth: hci_conn: fix potential UAF in create_big_sync
    - [arm64,armhf] spi: tegra20-sflash: fix controller deregistration
    - [arm64,armhf] spi: tegra114: fix controller deregistration
    - mm/hugetlb_cma: round up per_node before logging it
    - block: cleanup blkdev_report_zones()
    - block: reorganize struct blk_zone_wplug
    - block: fix zone write plug removal
    - tracefs: Fix default permissions not being applied on initial mount
    - fbcon: Avoid OOB font access if console rotation fails
    - mm/damon/core: disallow time-quota setting zero esz
    - mm/damon/core: implement damon_kdamond_pid()
    - mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values
    - mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values
    - bonding: fix use-after-free due to enslave fail after slave array update
      (CVE-2026-23171)
    - io_uring/kbuf: support min length left for incremental buffers
    - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb()
    - btrfs: remove fs_info argument from btrfs_sysfs_add_space_info_type()
    - btrfs: fix double free in create_space_info_sub_group() error path
    - btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to
      info-leak
    - tracing/probes: Limit size of event probe to 3K
    - batman-adv: stop tp_meter sessions during mesh teardown
    - batman-adv: tp_meter: fix tp_num leak on kmalloc failure
    - vsock: fix buffer size clamping order
    - vsock/virtio: fix length and offset in tap skb for split packets
    - vsock/virtio: fix empty payload in tap skb for non-linear buffers
    - vsock/virtio: fix accept queue count leak on transport mismatch
    - drm/amdgpu/vcn3: Avoid overflow on msg bound check
    - drm/amdgpu/vcn4: Avoid overflow on msg bound check

[ Salvatore Bonaccorso ]
  * Bluetooth: btmtk: accept too short WMT FUNC_CTRL events (Closes: #1136790)
  * net: skbuff: preserve shared-frag marker during coalescing (CVE-2026-46300)
  * net: skbuff: propagate shared-frag marker through frag-transfer helpers

-- Salvatore Bonaccorso <carnil@debian.org>  Fri, 22 May 2026 21:01:16 +0200

linux (6.12.88-1~bpo12+1) bookworm-backports; urgency=high

* Rebuild for bookworm-backports

-- Ben Hutchings <benh@debian.org>  Sat, 16 May 2026 10:53:21 +0200

linux (6.12.88-1) trixie-security; urgency=high

* New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.87
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.88
    - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()
    - ipmi: Add limits to event and receive message requests
    - ipmi: Check event message buffer response for bad data
    - ipmi:si: Return state to normal if message allocation fails
    - fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free
    - ACPI: scan: Use acpi_dev_put() in object add error paths
    - ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO
    - ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug
    - ACPI: video: force native backlight on HP OMEN 16 (8A44)
    - ASoC: SOF: Don't allow pointer operations on unconfigured streams
    - spi: rockchip: fix controller deregistration
    - ksmbd: rewrite stop_sessions() with restartable iteration
    - mm: convert mm_lock_seq to a proper seqcount
    - [amd64] x86: shadow stacks: proper error handling for mmap lock
      (CVE-2026-43109)
    - [amd64] x86/shstk: Prevent deadlock during shstk sigreturn
    - [amd64] KVM: x86: Fix shadow paging use-after-free due to unexpected GFN
    - [amd64] iommu/amd: Use atomic64_inc_return() in iommu.c
    - [amd64] iommu/amd: serialize sequence allocation under concurrent TLB
      invalidations (CVE-2026-43220) (Closes: #1135313)
    - flow_dissector: do not dissect PPPoE PFC frames
    - net: txgbe: fix RTNL assertion warning when remove module
    - net: af_key: zero aligned sockaddr tail in PF_KEY exports (CVE-2026-43088)
    - [amd64] KVM: SVM: check validity of VMCB controls when returning from SMM
    - net/sched: sch_red: Replace direct dequeue call with peek and
      qdisc_dequeue_peeked
    - Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (CVE-2026-31499)
    - exit: prevent preemption of oopsing TASK_DEAD task
    - wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr
    - wifi: mt76: mt7925: fix incorrect length field in txpower command
    - wifi: mt76: mt7921: fix a potential clc buffer length underflow
    - wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work
    - wifi: b43legacy: enforce bounds check on firmware key index in RX path
    - wifi: mac80211: drop stray 'static' from fast-RX rx_result
    - wifi: rsi: fix kthread lifetime race between self-exit and external-stop
    - wifi: mac80211: use safe list iteration in radar detect work
    - wifi: ath5k: do not access array OOB (Closes: #1119093)
    - wifi: mac80211: remove station if connection prep fails
    - wifi: b43: enforce bounds check on firmware key index in b43_rx()
    - wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog
      task
    - usb: usblp: fix heap leak in IEEE 1284 device ID via short response
    - usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl
    - ALSA: usb-audio: midi2: Restart output URBs on resume
    - ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3()
    - ALSA: usb-audio: Fix UAC3 cluster descriptor size check
    - USB: omap_udc: DMA: Don't enable burst 4 mode
    - USB: serial: option: add Telit Cinterion LE910Cx compositions
    - usb: ulpi: fix memory leak on ulpi_register() error paths
    - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger
    - ALSA: firewire-tascam: Do not drop unread control events
    - xfrm: provide message size for XFRM_MSG_MAPPING
    - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete
    - ipv6: xfrm6: release dst on error in xfrm6_rcv_encap()
    - xfrm: ah: account for ESN high bits in async callbacks
    - selinux: don't reserve xattr slot when we won't fill it
    - selinux: shrink critical section in sel_write_load()
    - selinux: prune /sys/fs/selinux/disable
    - Bluetooth: virtio_bt: clamp rx length before skb_put
    - Bluetooth: virtio_bt: validate rx pkt_type header length
    - Bluetooth: btmtk: validate WMT event SKB length before struct access
    - Bluetooth: hci_event: Fix OOB read and infinite loop in
      hci_le_create_big_complete_evt
    - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb()
    - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()
    - [armhf] spi: sun4i: fix controller deregistration
    - [armhf] spi: ti-qspi: fix controller deregistration
    - spi: sun6i: fix controller deregistration
    - fanotify: fix false positive on permission events
    - [arm64] KVM: arm64: Fix kvm_vcpu_initialized() macro parameter
    - mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show()
    - net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in
      rtnl_fill_vfinfo
    - sound: ua101: fix division by zero at probe
    - net: libwx: fix VF illegal register access
    - ip6_gre: Use cached t->net in ip6erspan_changelink().
    - net/rds: handle zerocopy send cleanup before the message is queued
    - net: wwan: t7xx: validate port_count against message length in
      t7xx_port_enum_msg_handler
    - hwmon: (ltc2992) Clamp threshold writes to hardware range
    - hwmon: (ltc2992) Fix u32 overflow in power read path
    - clk: rk808: fix OF node reference imbalance
    - hwmon: (corsair-psu) Close HID device on probe errors
    - af_unix: Reject SIOCATMARK on non-stream sockets
    - block: add pgmap check to biovec_phys_mergeable
    - cifs: abort open_cached_dir if we don't request leases
    - cifs: change_conf needs to be called for session setup
    - extcon: ptn5150: handle pending IRQ events during system resume
    - gpio: of: clear OF_POPULATED on hog nodes in remove path
    - hv_sock: fix ARM64 support
    - ibmveth: Disable GSO for packets with small MSS
    - ice: fix double free in ice_sf_eth_activate() error path
    - spi: microchip-core-qspi: fix controller deregistration
    - udf: reject descriptors with oversized CRC length
    - thermal: core: Free thermal zone ID later during removal
    - thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata
    - thermal/drivers/sprd: Fix raw temperature clamping in
      sprd_thm_rawdata_to_temp
    - spi: topcliff-pch: fix controller deregistration
    - spi: topcliff-pch: fix use-after-free on unbind
    - clk: imx: imx8-acm: fix flags for acm clocks
    - clk: microchip: mpfs-ccc: fix out of bounds access during output
      registration
    - cpuidle: powerpc: avoid double clear when breaking snooze
    - [amd64] ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in
      quirk table
    - [arm64] ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop
    - [arm64] ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens
    - [arm64] ASoC: qcom: q6apm: remove child devices when apm is removed
    - btrfs: fix double free in create_space_info() error path
    - dm-thin: fix metadata refcount underflow
    - dm: don't report warning when doing deferred remove
    - dm: fix a buffer overflow in ioctl processing
    - eventfs: Hold eventfs_mutex and SRCU when remount walks events
    - dm-verity-fec: correctly reject too-small FEC devices
    - dm-verity-fec: correctly reject too-small hash devices
    - isofs: validate Rock Ridge CE continuation extent against volume size
    - isofs: validate block number from NFS file handle in isofs_export_iget
    - [arm64] iommu/arm-smmu-v3: Add a missing dma_wmb() for hitless STE update
    - lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl()
    - lib/scatterlist: fix length calculations in extract_kvec_to_sg
    - lib/scatterlist: fix temp buffer in extract_user_to_sg()
    - libceph: Fix slab-out-of-bounds access in auth message processing
    - md/raid10: fix divide-by-zero in setup_geo() with zero far_copies
    - nvme-apple: drop invalid put of admin queue reference count
    - nvmet-tcp: fix race between ICReq handling and queue teardown
    - nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free
    - openvswitch: vport: fix self-deadlock on release of tunnel ports
    - pmdomain: core: Fix detach procedure for virtual devices in genpd
    - [arm64] RDMA/hns: Fix unlocked call to hns_roce_qp_remove()
    - [s390x] debug: Reject zero-length input in debug_input_flush_fn()
    - smb/client: fix out-of-bounds read in smb2_compound_op()
    - smb/client: fix out-of-bounds read in symlink_data()
    - smb: client: use kzalloc to zero-initialize security descriptor buffer
    - smb: client: validate dacloffset before building DACL pointers
    - [amd64] KVM: x86: check for nEPT/nNPT in slow flush hypercalls
    - mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock
    - PCI: Update saved_config_space upon resource assignment (Closes: #1131025)
    - PCI/AER: Clear only error bits in PCIe Device Status
    - PCI/AER: Stop ruling out unbound devices as error source
    - PCI/ASPM: Fix pci_clear_and_set_config_dword() usage
    - power: supply: max17042: avoid overflow when determining health
    - RDMA/mana: Fix error unwind in mana_ib_create_qp_rss()
    - RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss()
    - RDMA/mana: Validate rx_hash_key_len
    - RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq()
    - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()
    - RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp()
    - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads
    - RDMA/rxe: Reject unknown opcodes before ICRC processing
    - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path
    - mptcp: fastclose msk when linger time is 0
    - mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure
    - mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure
    - mptcp: sockopt: set timestamp flags on subflow socket, not msk
    - mptcp: fix scheduling with atomic in timestamp sockopt
    - f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode()
    - f2fs: fix fiemap boundary handling when read extent cache is incomplete
    - f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks()
    - f2fs: fix node_cnt race between extent node destroy and writeback
    - f2fs: fix uninitialized kobject put in f2fs_init_sysfs()
    - [arm64] KVM: arm64: vgic: Fix IIDR revision field extracted from wrong
      value
    - [arm64] KVM: arm64: Fix initialisation order in __pkvm_init_finalise()
    - bpf: Fix use-after-free in arena_vm_close on fork
    - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info
    - fs: prepare for adding LSM blob to backing_file
    - dma-mapping: drop unneeded includes from dma-mapping.h
    - dma-mapping: add __dma_from_device_group_begin()/end()
    - hwmon: (powerz) Avoid cacheline sharing for DMA buffer
    - mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs
    - udf: fix partition descriptor append bookkeeping
    - mtd: spinand: winbond: Declare the QE bit on W25NxxJW
    - hfsplus: fix uninit-value by validating catalog record size
    - hfsplus: fix held lock freed on hfsplus_fill_super()
    - erofs: move {in,out}pages into struct z_erofs_decompress_req
    - erofs: tidy up z_erofs_lz4_handle_overlap()
    - erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap()
    - gtp: disable BH before calling udp_tunnel_xmit_skb()
    - printk: add print_hex_dump_devel()
    - crypto: caam - guard HMAC key hex dumps in hash_digest_key
    - ALSA: aloop: Fix peer runtime UAF during format-change stop
    - net: stmmac: avoid shadowing global buf_sz
    - net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY()
    - net: stmmac: Prevent NULL deref when RX memory exhausted
    - wifi: mt76: mt7925: fix incorrect TLV length in CLC command
    - tracepoint: balance regfunc() on func_add() failure in
      tracepoint_add_func()
    - [arm64] KVM: arm64: Wake-up from WFI when iqrchip is in userspace
    - [amd64] x86/CPU/AMD: Prevent improper isolation of shared resources in
      Zen2's op cache
    - ksmbd: validate inherited ACE SID length

[ Salvatore Bonaccorso ]
  * ptrace: slightly saner 'get_dumpable()' logic

-- Salvatore Bonaccorso <carnil@debian.org>  Fri, 15 May 2026 11:52:56 +0200

linux (6.12.86-1~bpo12+1) bookworm-backports; urgency=high

* Rebuild for bookworm-backports

-- Ben Hutchings <benh@debian.org>  Fri, 08 May 2026 15:01:32 +0200

linux (6.12.86-1) trixie-security; urgency=high

* New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.86
    - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES
    - ALSA: usb-audio: Avoid false E-MU sample-rate notifications
    - ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch
    - usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable()
    - usb: chipidea: otg: not wait vbus drop if use role_switch
    - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change
    - ALSA: usb-audio: Evaluate packsize caps at the right place
    - LoongArch: Add spectre boundry for syscall dispatch table
    - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check
    - leds: qcom-lpg: Check for array overflow when selecting the high
      resolution
    - greybus: gb-beagleplay: bound bootloader receive buffering
    - greybus: gb-beagleplay: fix sleep in atomic context in hdlc_tx_frames()
    - misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt()
    - ibmasm: fix OOB reads in command_file_write due to missing size checks
    - ibmasm: fix heap over-read in ibmasm_send_i2o_message()
    - driver core: Don't let a device probe until it's ready
    - drm/nouveau: fix nvkm_device leak on aperture removal failure
    - kbuild: rust: allow `clippy::uninlined_format_args`
    - firmware: google: framebuffer: Do not mark framebuffer as busy
    - arm64/mm: Enable batched TLB flush in unmap_hotplug_range()
    - padata: Fix pd UAF once and for all (CVE-2025-38584)
    - padata: Remove comment for reorder_work
    - rust: init: fix `clippy::undocumented_unsafe_blocks` warnings
    - drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array
    - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion
      (CVE-2026-23468)
    - device property: Make modifications of fwnode "flags" thread safe
    - ocfs2: split transactions in dio completion to avoid credit exhaustion
    - zram: do not forget to endio for partial discard requests
    - wifi: rtw88: check for PCI upstream bridge existence
    - vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex
    - vfio/cdx: Fix NULL pointer dereference in interrupt trigger path
    - um: drivers: call kernel_strrchr() explicitly in cow_user.c
    - spi: imx: fix use-after-free on unbind
    - spi: ch341: fix memory leaks on probe failures
    - mm/memory_hotplug: fix hwpoisoned large folio handling in
      do_migrate_range()
    - crypto: pcrypt - Fix handling of MAY_BACKLOG requests
    - of: unittest: fix use-after-free in of_unittest_changeset()
    - of: unittest: fix use-after-free in testdrv_probe()
    - hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt
    - media: amphion: Fix race between m2m job_abort and device_run
    - ALSA: control: Validate buf_len before strnlen() in
      snd_ctl_elem_init_enum_names()
    - net: caif: clear client service pointer on teardown
    - net: strparser: fix skb_head leak in strp_abort_strp()
    - media: mtk-jpeg: fix use-after-free in release path due to uncancelled
      work
    - crypto: atmel-sha204a - Fix OTP sysfs read and error handling
    - PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown
    - Revert "ALSA: usb: Increase volume range that triggers a warning"
    - PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete
    - lib/ts_kmp: fix integer overflow in pattern length calculation
    - media: i2c: imx219: Check return value of devm_gpiod_get_optional() in
      imx219_probe()
    - net: qrtr: ns: Fix use-after-free in driver remove()
    - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget()
    - ALSA: aoa: i2sbus: fix OF node lifetime handling
    - ALSA: ctxfi: Add fallback to default RSR for S/PDIF
    - ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes
    - erofs: fix the out-of-bounds nameoff handling for trailing dirents
    - jbd2: fix deadlock in jbd2_journal_cancel_revoke()
    - md/raid10: fix deadlock with check operation and nowait requests
    - mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused
    - mtd: docg3: fix use-after-free in docg3_release()
    - nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4
    - nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set
    - parisc: _llseek syscall is only available for 32-bit userspace
    - remoteproc: xlnx: Only access buffer information if IPI is buffered
    - sched: Use u64 for bandwidth ratio calculations
    - rbd: fix null-ptr-deref when device_add_disk() fails
    - block: fix zone write plugs refcount handling in
      disk_zone_wplug_schedule_bio_work()
    - io_uring/timeout: check unused sqe fields
    - iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned()
    - io_uring/poll: fix signed comparison in io_poll_get_ownership()
    - io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE
    - ALSA: core: Fix potential data race at fasync handling
    - ALSA: caiaq: Fix control_put() result and cache rollback
    - ALSA: caiaq: Handle probe errors properly
    - ALSA: 6fire: Fix input volume change detection
    - ALSA: pcmtest: fix reference leak on failed device registration
    - ALSA: pcmtest: Fix resource leaks in module init error paths
    - iio: adc: ad7768-1: fix one-shot mode data acquisition
    - rxrpc: Fix memory leaks in rxkad_verify_response()
    - rxrpc: Fix rxkad crypto unalignment handling
    - rxrpc: Fix re-decryption of RESPONSE packets
    - tools/accounting: handle truncated taskstats netlink messages
    - arm64: dts: marvell: uDPU: add ethernet aliases
    - net: qrtr: ns: Free the node during ctrl_cmd_bye()
    - net: rds: fix MR cleanup on copy error
    - net: txgbe: fix firmware version check
    - net/smc: avoid early lgr access in smc_clc_wait_msg
    - net: ks8851: Reinstate disabling of BHs around IRQ handler
    - netconsole: avoid out-of-bounds access on empty string in trim_newline()
    - net: ks8851: Avoid excess softirq scheduling
    - drm/arcpgu: fix device node leak
    - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv
    - ipv4: icmp: validate reply type before using icmp_pointers
    - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply()
    - extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE'
    - tpm: avoid -Wunused-but-set-variable
    - LoongArch: Show CPU vulnerabilites correctly
    - power: supply: axp288_charger: Do not cancel work before initializing it
    - hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data()
    - randomize_kstack: Maintain kstack_offset per task
    - mmc: block: use single block write in retry
    - mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration
    - arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins
    - xfs: fix a resource leak in xfs_alloc_buftarg()
    - firmware: google: framebuffer: Do not unregister platform device
    - crypto: talitos - fix SEC1 32k ahash request limitation
    - crypto: talitos - rename first/last to first_desc/last_desc
    - pwm: imx-tpm: Count the number of enabled channels in probe
    - tpm: Fix auth session leak in tpm2_get_random() error path
    - tpm: Use kfree_sensitive() to free auth session in tpm_dev_release()
    - tpm: tpm_tis: add error logging for data transfer
    - tpm: tpm_tis: stop transmit if retries are exhausted
    - rtc: ntxec: fix OF node reference imbalance
    - mm/damon/core: use time_in_range_open() for damos quota window start
    - userfaultfd: allow registration of ranges below mmap_min_addr
    - KVM: x86: Defer non-architectural deliver of exception payload to
      userspace read
    - KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state
    - KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2
    - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2
    - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0
    - KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts
    - KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode
    - KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT
    - KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN
    - KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID)
    - KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT
    - KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT
    - KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS
    - KVM: nSVM: Add missing consistency check for nCR3 validity
    - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1
    - KVM: nSVM: Always intercept VMMCALL when L2 is active
    - io_uring/poll: fix multishot recv missing EOF on wakeup race
    - perf annotate: Use jump__delete when freeing LoongArch jumps
    - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access
    - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all()
    - mtd: spi-nor: sst: Fix write enable before AAI sequence
    - amdgpu/jpeg: fix deepsleep register for jpeg 5_0_0 and 5_0_2
    - md/raid5: fix soft lockup in retry_aligned_read()
    - md/raid5: validate payload size before accessing journal metadata
    - check-uapi: link into shared objects
    - HID: apple: ensure the keyboard backlight is off if suspending
    - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails
    - x86/cpu: Disable FRED when PTI is forced on
    - wifi: rtl8xxxu: fix potential use of uninitialized value
    - tcp: call sk_data_ready() after listener migration
    - taskstats: set version in TGID exit notifications
    - mfd: core: Preserve OF node when ACPI handle is present
    - apparmor: use target task's context in apparmor_getprocattr()
    - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers
    - bus: mhi: host: pci_generic: Switch to async power up to avoid boot delays
    - can: ucan: fix devres lifetime
    - crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit
    - crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup
    - crypto: atmel-ecc - Release client on allocation failure
    - crypto: hisilicon - Fix dma_unmap_single() direction
    - crypto: ccree - fix a memory leak in cc_mac_digest()
    - crypto: atmel-tdes - fix DMA sync direction
    - crypto: atmel-sha204a - Fix error codes in OTP reads
    - crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path
    - crypto: atmel-sha204a - Fix uninitialized data access on OTP read error
    - crypto: nx - Fix packed layout in struct nx842_crypto_header
    - dm mirror: fix integer overflow in create_dirty_log()
    - ceph: only d_add() negative dentries when they are unhashed
    - IB/core: Fix zero dmac race in neighbor resolution
    - ktest: Fix the month in the name of the failure directory
    - ntfs3: add buffer boundary checks to run_unpack()
    - ntfs3: fix integer overflow in run_unpack() volume boundary check
    - rtmutex: Use waiter::task instead of current in remove_waiter()
    - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails
    - seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode
    - smb: client: validate the whole DACL before rewriting it in cifsacl
      (CVE-2026-31709)
    - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in
      f2fs_write_end_io() (CVE-2026-31715)
    - lib: test_hmm: evict device pages on file close to avoid use-after-free
    - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally
    - ksmbd: use msleep instaed of schedule_timeout_interruptible()
    - ksmbd: replace connection list with hash table
    - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id()
    - thermal: core: Fix thermal zone governor cleanup issues
    - wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor
    - wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling
    - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()
    - mm/migrate: factor out movable_ops page handling into
      migrate_movable_ops_page()
    - mm/migrate: move movable_ops page handling out of move_to_new_folio()
    - mm: migrate: requeue destination folio on deferred split queue
    - ALSA: aoa: Use guard() for mutex locks
    - ALSA: aoa: i2sbus: clear stale prepared state
    - mm/zsmalloc: copy KMSAN metadata in zs_page_migrate()
    - media: rc: ttusbir: respect DMA coherency rules
    - ALSA: aoa: Skip devices with no codecs in i2sbus_resume()
    - media: rc: igorplugusb: heed coherency rules
    - RDMA/mana_ib: Disable RX steering on RSS QP destroy
    - block: relax pgmap check in bio_add_page for compatible zone device pages
    - iio: frequency: admv1013: add dev variable
    - iio: frequency: admv1013: fix NULL pointer dereference on str
    - rxrpc: Fix potential UAF after skb_unshare() failure
    - net: qrtr: ns: Limit the maximum server registration per node
    - net: qrtr: ns: Limit the maximum number of lookups
    - net: bridge: use a stable FDB dst snapshot in RCU readers
    - net: mctp: fix don't require received header reserved bits to be zero
    - net: qrtr: ns: Limit the total number of nodes
    - spi: fix resource leaks on device setup failure
    - mm: prevent droppable mappings from being locked
    - crypto: authencesn - reject short ahash digests during instance creation
    - net: bonding: fix use-after-free in bond_xmit_broadcast() (CVE-2026-31419)
    - driver core: Add kernel-doc for DEV_FLAG_COUNT enum value
    - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path
    - ALSA: caiaq: Don't abort when no input device is available
    - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets
    - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
    - drm/amdgpu: fix zero-size GDS range init on RDNA4
    - ALSA: caiaq: fix usb_dev refcount leak on probe failure
    - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels
    - netfilter: reject zero shift in nft_bitwise

[ Ben Hutchings ]
  * Fix ordering of kernel version strings for multiple Debian revisions
    (Closes: #1113728)
  * rxrpc: Fix conn-level packet handling to unshare RESPONSE packets

[ Salvatore Bonaccorso ]
  * xfrm: esp: avoid in-place decrypt on shared skb frags
  * rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present

-- Salvatore Bonaccorso <carnil@debian.org>  Fri, 08 May 2026 08:54:02 +0200

linux (6.12.85-1~bpo12+1) bookworm-backports; urgency=high

* Rebuild for bookworm-backports

-- Ben Hutchings <benh@debian.org>  Fri, 01 May 2026 00:04:44 +0200

linux (6.12.85-1) trixie-security; urgency=high

* New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.75
    - RDMA/siw: Fix potential NULL pointer dereference in header processing
    - RDMA/umad: Reject negative data_len in ib_umad_write
    - auxdisplay: arm-charlcd: fix release_mem_region() size
    - hfsplus: return error when node already exists in hfs_bnode_create
    - rcu: Refactor expedited handling check in rcu_read_unlock_special()
    - rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler()
    - rcu: Fix rcu_read_unlock() deadloop due to softirq
    - audit: move the compat_xxx_class[] extern declarations to audit_arch.h
    - i3c: Move device name assignment after i3c_bus_init
    - fs: add <linux/init_task.h> for 'init_fs'
    - i3c: master: Update hot-join flag only on success
    - gfs2: Retries missing in gfs2_{rename,exchange}
    - gfs2: Fix slab-use-after-free in qd_put
    - gfs2: Fix use-after-free in iomap inline data write path
    - i3c: dw: Initialize spinlock to avoid upsetting lockdep
    - i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers()
    - tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure
    - tpm: st33zp24: Fix missing cleanup on get_burstcount() error
    - erofs: get rid of raw bi_end_io() usage
    - erofs: handle end of filesystem properly for file-backed mounts
    - btrfs: qgroup: return correct error when deleting qgroup relation item
    - btrfs: fix block_group_tree dirty_list corruption
    - smb: client: fix potential UAF and double free in smb2_open_file()
    - block: add a bio_add_virt_nofail helper
    - rnbd-srv: use bio_add_virt_nofail
    - rnbd-srv: Fix server side setting of bi_size for special IOs
    - xen/virtio: Don't use grant-dma-ops when running as Dom0
    - io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED
    - ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch()
    - io_uring/sync: validate passed in offset
    - cpuidle: governors: menu: Always check timers with tick stopped
    - thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature
    - md/raid5: fix raid5_run() to return error when log_init() fails
    - md/raid10: fix any_working flag handling in raid10_sync_request
    - OPP: Return correct value in dev_pm_opp_get_level
    - cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id()
    - iomap: fix submission side handling of completion side errors
    - thermal/of: Fix reference leak in thermal_of_cm_lookup()
    - ublk: Validate SQE128 flag before accessing the cmd
    - Partial revert "x86/xen: fix balloon target initialization for PVH dom0"
    - md/raid1: fix memory leak in raid1_run() if no active rdev
    - md/raid1: fix memory leak in raid1_run()
    - PM: wakeup: Handle empty list in wakeup_sources_walk_start()
    - perf: arm_spe: Properly set hw.state on failures
    - cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not
      possible
    - PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races
    - [s390x] cio: Fix device lifecycle handling in css_alloc_subchannel()
    - [amd64] perf/x86/core: Do not set bit width for unavailable counters
    - crypto: qat - fix warning on adf_pfvf_pf_proto.c
    - libbpf: Fix OOB read in btf_dump_get_bitfield_value
    - [armhf] VDSO: Patch out __vdso_clock_getres() if unavailable
    - [arm64] crypto: cavium - fix dma_free_coherent() size
    - bpf: Preserve id of register in sync_linked_regs()
    - hrtimer: Fix trace oddity
    - [amd64] crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls
    - [amd64] crypto: ccp - narrow scope of snp_range_list
    - bpf, sockmap: Fix incorrect copied_seq calculation
    - bpf, sockmap: Fix FIONREAD for sockmap
    - tracing: Add a comment about ftrace_regs definition
    - ftrace: Make ftrace_regs abstract from direct use
    - ftrace: Consolidate ftrace_regs accessor functions for archs using pt_regs
    - ftrace: Use arch_ftrace_regs() for ftrace_regs_*() macros
    - ftrace: Rename ftrace_regs_return_value to ftrace_regs_get_return_value
    - fgraph: Replace fgraph_ret_regs with ftrace_regs
    - tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs
    - tracing: Add ftrace_fill_perf_regs() for perf event
    - [amd64] x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return
      probe
    - [amd64] x86/fgraph,bpf: Switch kprobe_multi program stack unwind to
      hw_regs path
    - [arm64] crypto: caam - fix netdev memory leak in dpaa2_caam_probe
    - bpf: Fix bpf_xdp_store_bytes proto for read-only arg
    - genirq: Set IRQF_COND_ONESHOT in devm_request_irq().
    - [amd64] platform/x86: int0002: Remove IRQF_ONESHOT from request_irq()
    - Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler
    - scsi: efct: Use IRQF_ONESHOT and default primary handler
    - EDAC/altera: Remove IRQF_ONESHOT
    - mfd: wm8350-core: Use IRQF_ONESHOT
    - media: pci: mg4b: Use IRQF_NO_THREAD
    - sched/deadline: Clear the defer params
    - sched/rt: Skip currently executing CPU in rto_next_cpu()
    - hwrng: core - Allow runtime disabling of the HW RNG
    - hwrng: core - use RCU and work_struct to fix race condition
    - pstore/ram: fix buffer overflow in persistent_ram_save_old()
    - soc: qcom: smem: handle ENOMEM error during probe
    - EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size()
    - EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size()
    - firmware: arm_ffa: Correct 32-bit response handling in
      NOTIFICATION_INFO_GET
    - [arm64] dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings
    - [arm64] dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings
    - [arm64] clk: qcom: Return correct error code in qcom_cc_probe_by_index()
    - [arm64] dts: qcom: sdm630: fix gpu_speed_bin size
    - [arm64] dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on
    - [arm64] dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on
    - [arm64] dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks
    - [arm64] dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of
      AD7147
    - [armhf] dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property
    - [powerpc*] uaccess: Move barrier_nospec() out of
      allow_read_{from/write}_user()
    - [arm64] soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in
      cmd_db_dev_probe
    - [arm64] soc: mediatek: svs: Fix memory leak in svs_enable_debug_write()
    - [powerpc*] eeh: fix recursive pci_lock_rescan_remove locking in EEH event
      handling
    - [arm64] dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node
    - [arm64] dts: amlogic: s4: assign mmc b clock to 24MHz
    - [arm64] dts: amlogic: s4: fix mmc clock assignment
    - [arm64] dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order
    - [arm64] dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog
      instances for j784s4
    - hwspinlock: omap: Handle devm_pm_runtime_enable() errors
    - [arm64] dts: amlogic: c3: assign the MMC signal clocks
    - [arm64] dts: amlogic: axg: assign the MMC signal clocks
    - [arm64] dts: amlogic: gx: assign the MMC signal clocks
    - [arm64] dts: amlogic: g12: assign the MMC B and C signal clocks
    - [arm64] dts: amlogic: g12: assign the MMC A signal clock
    - [arm64] dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm
    - [arm64] dts: qcom: sdm845-db845c: drop CS from SPIO0
    - [arm64] dts: qcom: sdm845-db845c: specify power for WiFi CH1
    - [arm64] dts: qcom: x1e: bus is 40-bits (fix 64GB models)
    - [arm64] dts: qcom: agatti: Add CX_MEM/DBGC GPU regions
    - [arm64] dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions
    - [arm64] drm/panthor: Recover from panthor_gpu_flush_caches() failures
    - [arm64] drm/panthor: Fix the full_tick check
    - [arm64] drm/panthor: Fix the group priority rotation logic
    - [arm64] drm/panthor: Fix immediate ticking on a disabled tick
    - [arm64] drm/panthor: Fix the logic that decides when to stop ticking
    - [arm64] drm/panthor: Make sure we resume the tick when new jobs are
      submitted
    - workqueue: Factor out assign_rescuer_work()
    - workqueue: Only assign rescuer work when really needed
    - workqueue: Process rescuer work items one-by-one using a cursor
    - drm/panel: sw43408: Remove manual invocation of unprepare at remove
    - ALSA: pcm: use new array-copying-wrapper
    - ALSA: pcm: Relax __free() variable declarations
    - ALSA: vmaster: Relax __free() variable declarations
    - [arm64] drm/panthor: Evict groups before VM termination
    - [amd64] ASoC: nau8821: Consistently clear interrupts before unmasking
    - [amd64] ASoC: nau8821: Avoid unnecessary blocking in IRQ handler
    - [amd64] ASoC: nau8821: Fixup nau8821_enable_jack_detect()
    - media: chips-media: wave5: Fix memory leak on codec_info allocation
      failure
    - drm/amd: Drop "amdgpu kernel modesetting enabled" message
    - drm/amdkfd: Fix signal_eviction_fence() bool return value
    - drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init
    - [arm64] drm/msm/disp/dpu: add merge3d support for sc7280
    - [arm64] drm/msm/dpu: Set vsync source irrespective of mdp top support
    - [arm64] drm/msm/dpu: fix WD timer handling on DPU 8.x
    - regulator: core: move supply check earlier in set_machine_constraints()
    - HID: playstation: Add missing check for input_ff_create_memless
    - [arm64] drm/msm/disp: set num_planes to 1 for interleaved YUV formats
    - [arm64] drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x
    - media: ccs: Accommodate C-PHY into the calculation
    - [arm64] drm/msm/a2xx: fix pixel shader start on A225
    - drm/buddy: release free_trees array on buddy mm teardown
    - platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev
    - media: uvcvideo: Fix allocation for small frame sizes
    - evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac()
    - drm/xe: Unregister drm device on probe error
    - platform/chrome: cros_ec_lightbar: Fix response size initialization
    - HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients
    - spi: tools: Add include folder to .gitignore
    - Revert "hwmon: (ibmpex) fix use-after-free in high/low store"
    - hwmon: pmbus: mpq8785: Prepare driver for multiple device support
    - hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio
      configuration
    - hwmon: pmbus: mpq8785: Add support for MPM82504
    - hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification
    - PCI: mediatek: Fix IRQ domain leak when MSI allocation fails
    - Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors
    - PCI/PM: Avoid redundant delays on D3hot->D3cold
    - wifi: cfg80211: Fix use_for flag update on BSS refresh
    - PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails
    - docs: fix WARNING document not included in any toctree
    - Documentation: trace: Refactor toctree
    - Documentation: tracing: Add PCI tracepoint documentation
    - PCI: Do not attempt to set ExtTag for VFs
    - PCI/portdrv: Fix potential resource leak
    - dm: fix unlocked test for dm_suspended_md
    - dm: use READ_ONCE in dm_blk_report_zones
    - quota: fix livelock between quotactl and freeze_super
    - net: mctp-i2c: fix duplicate reception of old data
    - mctp i2c: initialise event handler read bytes
    - wifi: cfg80211: stop NAN and P2P in cfg80211_leave
    - netfilter: nf_tables: reset table validation state on abort
    - netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH
    - netfilter: nf_conncount: increase the connection clean up limit to 64
    - netfilter: nft_compat: add more restrictions on netlink attributes
    - netfilter: nf_conncount: fix tracking of connections from localhost
    - module: add helper function for reading module_buildid()
    - kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup()
    - PCI: Mark 3ware-9650SA Root Port Extended Tags as broken
    - [amd64] iommu/vt-d: Flush cache for PASID table before using it
    - [amd64] iommu/vt-d: Separate page request queue from SVM
    - [amd64] iommu/vt-d: Drain PRQs when domain removed from RID
    - [amd64] iommu/vt-d: Avoid draining PRQ in sva mm release path
    - [amd64] iommu/vt-d: Clear Present bit before tearing down PASID entry
    - dm: use bio_clone_blkg_association
    - xdrgen: Fix struct prefix for typedef types in program wrappers
    - NFS: NFSERR_INVAL is not defined by NFSv2
    - xdrgen: Initialize data pointer for zero-length items
    - nfsd: never defer requests during idmap lookup
    - fat: avoid parent link count underflow in rmdir
    - tcp: tcp_tx_timestamp() must look at the rtx queue
    - PCI: Check parent for NULL in of_pci_bus_release_domain_nr()
    - wifi: ath10k: sdio: add missing lock protection in
      ath10k_sdio_fw_crashed_dump()
    - PCI: Initialize RCB from pci_configure_device()
    - PCI: Add defines for bridge window indexing
    - PCI/ACPI: Restrict program_hpx_type2() to AER bits
    - ipc: don't audit capability check in ipc_permissions()
    - ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit()
    - mptcp: fix receive space timestamp initialization
    - octeontx2-af: Fix PF driver crash with kexec kernel booting
    - bonding: only set speed/duplex to unknown, if getting speed failed
    - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP
    - nfc: hci: shdlc: Stop timers and work before freeing context
    - netfilter: nfnetlink_queue: optimize verdict lookup with hash table
    - netfilter: nfnetlink_queue: do shared-unconfirmed check before
      segmentation
    - netfilter: nft_set_hash: fix get operation on big endian
    - netfilter: nft_counter: fix reset of counters on 32bit archs
    - netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null
      interval
    - netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets
    - PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404]
    - [arm64] net: hns3: fix double free issue for tx spare buffer
    - procfs: fix missing RCU protection when reading real_parent in
      do_task_stat()
    - smb: client: correct value for smbd_max_fragmented_recv_size
    - net: atm: fix crash due to unvalidated vcc pointer in sigd_send()
    - net: sunhme: Fix sbus regression
    - net: Add skb_dstref_steal and skb_dstref_restore
    - net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input
      callers
    - xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path
    - serial: caif: fix use-after-free in caif_serial ldisc_close()
    - octeon_ep: disable per ring interrupts
    - octeon_ep: ensure dbell BADDR updation
    - octeon_ep_vf: ensure dbell BADDR updation
    - ionic: Rate limit unknown xcvr type messages
    - octeontx2-pf: Unregister devlink on probe failure
    - RDMA/rtrs: server: remove dead code
    - IB/cache: update gid cache on client reregister event
    - RDMA/hns: Fix WQ_MEM_RECLAIM warning
    - RDMA/hns: Fix RoCEv1 failure due to DSCP
    - RDMA/hns: Notify ULP of remaining soft-WCs during reset
    - power: supply: ab8500: Fix use-after-free in power_supply_changed()
    - power: supply: act8945a: Fix use-after-free in power_supply_changed()
    - power: supply: bq256xx: Fix use-after-free in power_supply_changed()
    - power: supply: bq25980: Fix use-after-free in power_supply_changed()
    - power: supply: cpcap-battery: Fix use-after-free in power_supply_changed()
    - power: supply: goldfish: Fix use-after-free in power_supply_changed()
    - power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed()
    - power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed()
    - power: supply: rt9455: Fix use-after-free in power_supply_changed()
    - power: supply: sbs-battery: Fix use-after-free in power_supply_changed()
    - power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write
    - power: supply: bq27xxx: fix wrong errno when bus ops are unsupported
    - power: supply: wm97xx: Fix NULL pointer dereference in
      power_supply_changed()
    - RDMA/rtrs-srv: fix SG mapping
    - RDMA/rxe: Fix double free in rxe_srq_from_init
    - RDMA/iwcm: Fix workqueue list corruption by removing work_list
    - tools/power/x86/intel-speed-select: Fix file descriptor leak in
      isolate_cpus()
    - RDMA/mlx5: Fix UMR hang in LAG error state unload
    - IB/mlx5: Fix port speed query for representors
    - mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper
    - vfio/pci: Lock upstream bridge for vfio_pci_core_disable()
    - [amd64] platform/x86/amd/pmf: Prevent TEE errors after hibernate
    - [amd64] crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails
    - [amd64] crypto: ccp - Add an S4 restore flow
    - [amd64] crypto: ccp - Factor out ring destroy handling to a helper
    - [amd64] crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when
      PSP_CMD_TEE_RING_INIT fails
    - mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse()
    - nfs/localio: eliminate unnecessary kref in nfs_local_fsync_ctx
    - NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit
    - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send
    - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler
    - RDMA/rxe: Fix race condition in QP timer handlers
    - RDMA/core: add rdma_rw_max_sge() helper for SQ sizing
    - cxl: Fix premature commit_end increment on decoder commit failure
    - mtd: parsers: ofpart: fix OF node refcount leak in
      parse_fixed_partitions()
    - mtd: spinand: Fix kernel doc
    - power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler
    - power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer
    - RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc
    - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN
    - scsi: smartpqi: Fix memory leak in pqi_report_phys_luns()
    - scsi: ufs: host: mediatek: Require CONFIG_PM
    - scsi: csiostor: Fix dereference of null pointer rn
    - nvdimm: virtio_pmem: serialize flush requests
    - fs/nfs: Fix readdir slow-start regression
    - tracing: Properly process error handling in event_hist_trigger_parse()
    - tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros
    - fbdev: of_display_timing: Fix device node reference leak in
      of_get_display_timings()
    - fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe()
    - clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs
    - clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs
    - clk: qcom: rcg2: compute 2d using duty fraction directly
    - clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs
    - clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops
    - clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops
    - clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops
    - clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops
    - clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops
    - clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc
    - clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc
    - clk: qcom: gcc-ipq5018: flag sleep clock as critical
    - clk: Move clk_{save,restore}_context() to COMMON_CLK section
    - clk: qcom: dispcc-sdm845: Enable parents for pixel clocks
    - clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src
    - clk: qcom: gfx3d: add parent to parent request map
    - clk: mediatek: Fix error handling in runtime PM setup
    - interconnect: mediatek: Don't hijack parent device
    - interconnect: mediatek: Aggregate bandwidth with saturating add
    - dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX
    - dma: dma-axi-dmac: fix SW cyclic transfers
    - dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue
    - soundwire: intel_ace2x: add SND_HDA_CORE dependency
    - iio: test: drop dangling symbol in gain-time-scale helpers
    - staging: greybus: lights: avoid NULL deref
    - serial: imx: change SERIAL_IMX_CONSOLE to bool
    - serial: SH_SCI: improve "DMA support" prompt
    - mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms
    - iio: pressure: mprls0025pa: fix spi_transfer struct initialisation
    - iio: pressure: mprls0025pa: fix SPI CS delay violation
    - iio: pressure: mprls0025pa: fix interrupt flag
    - iio: pressure: mprls0025pa: fix scan_type struct
    - iio: pressure: mprls0025pa: fix pressure calculation
    - watchdog: starfive-wdt: Fix PM reference leak in probe error path
    - coresight: etm3x: Fix cpulocked warning on cpuhp
    - phy: freescale: imx8qm-hsio: fix NULL pointer dereference
    - Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms"
    - mfd: arizona: Fix regulator resource leak on
      wm5102_clear_write_sequencer() failure
    - mfd: simple-mfd-i2c: Add MAX77705 support
    - mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA
    - mfd: simple-mfd-i2c: Add SpacemiT P1 support
    - mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order
    - mfd: simple-mfd-i2c: Add Delta TN48M CPLD support
    - drivers: iio: mpu3050: use dev_err_probe for regulator request
    - usb: bdc: fix sleep during atomic
    - pinctrl: equilibrium: Fix device node reference leak in pinbank_init()
    - ovl: Fix uninit-value in ovl_fill_real
    - iio: sca3000: Fix a resource leak in sca3000_probe()
    - pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition
    - pinctrl: single: fix refcount leak in pcs_add_gpio_func()
    - leds: qcom-lpg: Check the return value of regmap_bulk_write()
    - backlight: qcom-wled: Support ovp values for PMI8994
    - backlight: qcom-wled: Change PM8950 WLED configurations
    - dmaengine: fsl-edma: don't explicitly disable clocks in .remove()
    - drbd: always set BLK_FEAT_STABLE_WRITES
    - io_uring/cancel: de-unionize file and user_data in struct io_cancel_data
    - fs/ntfs3: Initialize new folios before use
    - fs/ntfs3: prevent infinite loops caused by the next valid being the same
    - fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot
    - ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs
    - powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check
    - kbuild: Add objtool to top-level clean target
    - objpool: fix the overestimation of object pooling metadata size
    - ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO
    - cpuidle: Skip governor when only one idle state is available
    - net: sparx5/lan969x: fix DWRR cost max to match hardware register width
    - net: mscc: ocelot: extract ocelot_xmit_timestamp() helper
    - net: mscc: ocelot: split xmit into FDMA and register injection paths
    - net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj()
    - ipv6: Fix out-of-bound access in fib6_add_rt2node().
    - net: sparx5/lan969x: fix PTP clock max_adj value
    - net: usb: catc: enable basic endpoint checking
    - xen-netback: reject zero-queue configuration from guest
    - net/rds: rds_sendmsg should not discard payload_len
    - net: bridge: mcast: always update mdb_n_entries for vlan contexts
    - netfilter: nf_conntrack_h323: don't pass uninitialised l3num value
    - ipvs: do not keep dest_dst if dev is going down
    - net: remove WARN_ON_ONCE when accessing forward path array
    - netfilter: nf_tables: fix use-after-free in nf_tables_addchain()
      (CVE-2026-23231)
    - ipv6: fix a race in ip6_sock_set_v6only()
    - bpftool: Fix truncated netlink dumps
    - ping: annotate data-races in ping_lookup()
    - macvlan: observe an RCU grace period in macvlan_common_newlink() error
      path
    - icmp: prevent possible overflow in icmp_global_allow()
    - inet: move icmp_global_{credit,stamp} to a separate cache line
    - octeontx2-af: Fix default entries mcam entry action
    - bonding: alb: fix UAF in rlb_arp_recv during bond up/down
    - net/mlx5: Fix multiport device check over light SFs
    - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels
    - apparmor: fix NULL sock in aa_sock_file_perm
    - AppArmor: Allow apparmor to handle unaligned dfa tables
    - apparmor: Fix & Optimize table creation from possibly unaligned memory
    - apparmor: return -ENOMEM in unpack_perms_table upon alloc failure
    - apparmor: fix rlimit for posix cpu timers
    - apparmor: remove apply_modes_to_perms from label_match
    - apparmor: make label_match return a consistent value
    - apparmor: avoid per-cpu hold underflow in aa_get_buffer
    - apparmor: fix invalid deref of rawdata when export_binary is unset
    - apparmor: fix aa_label to return state from compount and component match
    - drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc()
    - drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges()
    - drm/amdgpu: Fix memory leak in amdgpu_ras_init()
    - ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put()
    - [amd64] drm/i915/acpi: free _DSM package when no connectors
    - ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init
    - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2
    - drm/amd/display: Reject cursor plane on DCE when scaled differently than
      primary
    - drm/amd/display: Fix out-of-bounds stream encoder index v3
    - spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe()
    - [s390x] kexec: Make KEXEC_SIG available when CONFIG_MODULES=n
    - drm/xe: Move forcewake to 'gt.pm' substructure
    - drm/xe: Create dedicated xe_mmio structure
    - drm/xe: Clarify size of MMIO region
    - drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio'
    - drm/xe: Populate GT's mmio iomap from tile during init
    - drm/xe: Switch mmio_ext to use 'struct xe_mmio'
    - drm/xe: Add xe_tile backpointer to xe_mmio
    - drm/xe: Adjust mmio code to pass VF substructure to SRIOV code
    - drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt
    - drm/xe/mmio: Avoid double-adjust in 64-bit reads
    - drm/xe/ptl: Apply Wa_13011645652
    - drm/xe/xe2_hpg: Add set of workarounds
    - drm/xe/xe2_hpg: Fix handling of Wa_14019988906 & Wa_14019877138
    - efi: Fix reservation of unaccepted memory table
    - btrfs: use the correct type to initialize block reserve for delayed refs
    - btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not
      found
    - [amd64] x86/hyperv: Fix error pointer dereference
    - [arm64] ASoC: rockchip: i2s-tdm: Use param rate if not provided by
      set_sysclk
    - drm/amd/display: Use same max plane scaling limits for all 64 bpp formats
    - ext4: subdivide EXT4_EXT_DATA_VALID1
    - ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1
    - ext4: don't cache extent during splitting extent
    - ext4: drop extent cache after doing PARTIAL_VALID1 zeroout
    - ext4: drop extent cache when splitting extent fails
    - ext4: fix memory leak in ext4_ext_shift_extents()
    - ext4: fix e4b bitmap inconsistency reports
    - ext4: fix dirtyclusters double decrement on fs shutdown
    - ext4: use optimized mballoc scanning regardless of inode format
    - ata: pata_ftide010: Fix some DMA timings
    - ata: libata-scsi: refactor ata_scsi_translate()
    - Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT
    - SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths
    - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path
    - dt-bindings: phy: qcom-edp: Add missing clock for X Elite
    - ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false
    - ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names
    - ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names
    - perf test stat: Update test expectations and events
    - perf test stat tests: Fix for virtualized machines
    - perf unwind-libdw: Fix invalid reference counts
    - perf callchain: Fix srcline printing with inlines
    - libsubcmd: Fix null intersection case in exclude_cmds()
    - perf maps: Fix reference count leak in maps__find_ams()
    - perf annotate: Fix memcpy size in arch__grow_instructions()
    - perf vendor events amd: Fix Zen 5 MAB allocation events
    - libperf: Don't remove -g when EXTRA_CFLAGS are used
    - libperf build: Always place libperf includes first
    - rtc: interface: Alarm race handling should not discard preceding error
    - statmount: permission check should return EPERM
    - audit: add fchmodat2() to change attributes class
    - hfsplus: fix volume corruption issue for generic/498
    - fs/buffer: add alert in try_to_free_buffers() for folios without buffers
    - audit: add missing syscalls to read class
    - hfsplus: pretend special inodes as regular files
    - i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr()
    - i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init
    - minix: Add required sanity checking to minix_check_superblock()
    - dlm: validate length in dlm_search_rsb_tree
    - btrfs: fallback to buffered IO if the data profile has duplication
    - btrfs: handle user interrupt properly in btrfs_trim_fs()
    - smb: client: add proper locking around ses->iface_last_update
    - gfs2: fiemap page fault fix
    - smb: client: prevent races in ->query_interfaces()
    - tools/power cpupower: Reset errno before strtoull()
    - [s390x] purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS
    - [arm64] Add support for TSV110 Spectre-BHB mitigation
    - rnbd-srv: Zero the rsp buffer before using it
    - [amd64] x86/xen/pvh: Enable PAE mode for 32-bit guest only when
      CONFIG_X86_PAE is set
    - EFI/CPER: don't dump the entire memory region
    - APEI/GHES: ensure that won't go past CPER allocated record
    - APEI/GHES: ARM processor Error: don't go past allocated memory
    - EFI/CPER: don't go past the ARM processor CPER record buffer
    - ACPI: processor: Fix NULL-pointer dereference in
      acpi_processor_errata_piix4()
    - ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[]
    - ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP
    - powercap: intel_rapl: Add PL4 support for Ice Lake
    - alpha: fix user-space corruption during memory compaction
    - md-cluster: fix NULL pointer dereference in process_metadata_update
    - cpufreq: dt-platdev: Block the driver from probing on more QC platforms
    - [s390x] perf: Disable register readout on sampling events
    - perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD
    - ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display)
    - ACPI: battery: fix incorrect charging status when current is zero
    - xenbus: Use .freeze/.thaw to handle xenbus devices
    - blk-mq-debugfs: add missing debugfs_mutex in
      blk_mq_debugfs_register_hctxs()
    - block: decouple secure erase size limit from discard size limit
    - bpf: verifier improvement in 32bit shift sign extension pattern
    - [amd64] perf/x86/msr: Add Airmont NP
    - [amd64] perf/x86/cstate: Add Airmont NP
    - bpf: crypto: Use the correct destructor kfunc type
    - bpf: Recognize special arithmetic shift in the verifier
    - clocksource/drivers/sh_tmu: Always leave device running after probe
    - clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on
      OF
    - PCI/MSI: Unmap MSI-X region on error
    - crypto: hisilicon/qm - move the barrier before writing to the mailbox
      register
    - mailbox: bcm-ferxrm-mailbox: Use default primary handler
    - char: tpm: cr50: Remove IRQF_ONESHOT
    - sched/debug: Fix updating of ppos on server write ops
    - pstore: ram_core: fix incorrect success return when vmap() fails
    - firmware: arm_ffa: Unmap Rx/Tx buffers on init failure
    - [arm64] Revert "arm64: zynqmp: Add an OP-TEE node to the device tree"
    - [arm64] tegra: smaug: Add usb-role-switch support
    - drm/display/dp_mst: Add protection against 0 vcpi
    - gpu/panel-edp: add AUO panel entry for B140HAN06.4
    - drm/amdgpu: fix NULL pointer issue buffer funcs
    - drm/amdkfd: Handle GPU reset and drain retry fault race
    - spi-geni-qcom: initialize mode related registers to 0
    - spi-geni-qcom: use xfer->bits_per_word for can_dma()
    - drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32
    - [amd64] ASoC: SOF: ipc4: Support for sending payload along with
      LARGE_CONFIG_GET
    - media: dvb-core: dmxdevfilter must always flush bufs
    - spi: stm32: fix Overrun issue at < 8bpw
    - drm/v3d: Set DMA segment size to avoid debug warnings
    - media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes
    - media: omap3isp: isppreview: always clamp in preview_try_format()
    - media: omap3isp: set initial format
    - media: chips-media: wave5: Fix conditional in start_streaming
    - media: chips-media: wave5: Process ready frames when CMD_STOP sent to
      Encoder
    - media: mediatek: vcodec: Don't try to decode 422/444 VP9
    - drm/amdgpu: add support for HDP IP version 6.1.1
    - drm/amd/display: Fix dsc eDP issue
    - drm/amdgpu: avoid a warning in timedout job handler
    - drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src
    - HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards
    - drm/amdgpu: Skip loading SDMA_RS64 in VF
    - drm/amd/display: only power down dig on phy endpoints
    - drm/xe: Only toggle scheduling in TDR if GuC is running
    - ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask
    - ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug
    - spi: spi-mem: Limit octal DTR constraints to octal DTR situations
    - media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START
    - drm/panel: Fix a possible null-pointer dereference in
      jdi_panel_dsi_remove()
    - media: adv7180: fix frame interval in progressive mode
    - media: pvrusb2: fix URB leak in pvr2_send_request_ex
    - media: solo6x10: Check for out of bounds chip_id
    - media: cx25821: Fix a resource leak in cx25821_dev_setup()
    - media: v4l2-async: Fix error handling on steps after finding a match
    - media: mt9m114: Avoid a reset low spike during probe()
    - media: mt9m114: Return -EPROBE_DEFER if no endpoint is found
    - media: ipu6: Ensure stream_mutex is acquired when dealing with node list
    - media: ipu6: Close firmware streams on streaming enable failure
    - media: ipu6: Always close firmware stream
    - ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk
    - drm/amdkfd: Relax size checking during queue buffer get
    - drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map()
    - drm: Account property blob allocations to memcg
    - hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed
    - virt: vbox: uapi: Mark inner unions in packed structs as packed
    - [amd64] ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to
      aggregated
    - PCI: Add Intel Nova Lake audio Device ID
    - drm/amd/display: Disable FEC when powering down encoders
    - drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback
    - drm/atmel-hlcdc: don't reject the commit if the src rect has fractional
      parts
    - drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release
    - media: rkisp1: Fix filter mode register configuration
    - HID: multitouch: add eGalaxTouch EXC3188 support
    - HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK
    - ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro
    - ALSA: hda/realtek: fix LG Gram Style 14 speakers
    - gpio: aspeed-sgpio: Change the macro to support deferred probe
    - [arm64] ASoC: sunxi: sun50i-dmic: Add missing check for
      devm_regmap_init_mmio
    - spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end
    - drm/amd/display: Fix GFX12 family constant checks
    - drm/amd/display: avoid dig reg access timeout on usb4 link training fail
    - ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in
      max98390_i2c_probe()
    - hwmon: (dell-smm) Add support for Dell OptiPlex 7080
    - hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE
    - hwmon: (f71882fg) Add F81968 support
    - HID: logitech-hidpp: Add support for Logitech K980
    - ASoC: es8328: Add error unwind in resume
    - modpost: Amend ppc64 save/restfpr symnames for -Os build
    - power: sequencing: fix missing state_lock in pwrseq_power_on() error path
    - [amd64] ASoC: SOF: Intel: hda: Fix NULL pointer dereference
    - spi: geni-qcom: Fix abort sequence execution for serial engine errors
    - ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe
    - ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx
    - ALSA: mixer: oss: Add card disconnect checkpoints
    - ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio
    - jfs: Add missing set_freezable() for freezable kthread
    - jfs: nlink overflow in jfs_rename
    - wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero
    - wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode()
    - wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H
    - wifi: rtw89: 8922a: set random mac if efuse contains zeroes
    - wifi: rtw89: ser: enable error IMR after recovering from L1
    - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band()
    - wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band
      data
    - dm: replace -EEXIST with -EBUSY
    - dm: remove fake timeout to avoid leak request
    - [arm64] iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency
    - net: wwan: mhi: Add network support for Foxconn T99W760
    - wifi: libertas: fix WARNING in usb_tx_block
    - [amd64] iommu/amd: move wait_on_sem() out of spinlock
    - wifi: rtw89: mac: correct page number for CSI response
    - wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode
    - wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1
    - wifi: ath11k: Fix failure to connect to a 6 GHz AP
    - wifi: ath12k: fix preferred hardware mode calculation
    - wifi: cfg80211: allow only one NAN interface, also in multi radio
    - ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}()
    - ipv6: annotate data-races over sysctl.flowlabel_reflect
    - ipv6: exthdrs: annotate data-race over multiple sysctl
    - ext4: mark group add fast-commit ineligible
    - ext4: move ext4_percpu_param_init() before ext4_mb_init()
    - ext4: mark group extend fast-commit ineligible
    - ext4: use reserved metadata blocks when splitting extent on endio
    - netfilter: nf_conntrack: Add allow_clash to generic protocol handler
    - netfilter: xt_tcpmss: check remaining length before reading optlen
    - net: usb: r8152: fix transmit queue timeout
    - wifi: iwlwifi: mvm: check the validity of noa_len
    - wifi: rtw89: fix unable to receive probe responses under MLO connection
    - wifi: rtw89: 8922a: add digital compensation for 2GHz
    - net/rds: No shortcut out of RDS_CONN_ERROR
    - ext4: propagate flags to convert_initialized_extent()
    - gro: change the BUG_ON() in gro_pull_from_frag0()
    - ipv4: igmp: annotate data-races around idev->mr_maxdelay
    - [arm64] net: hns3: extend HCLGE_FD_AD_QID to 11 bits
    - wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power()
    - wifi: iwlegacy: add missing mutex protection in il3945_store_measurement()
    - ipv4: fib: Annotate access to struct fib_alias.fa_state.
    - Bluetooth: btusb: Add support for MediaTek7920 0489:e158
    - Bluetooth: hci_conn: Set link_policy on incoming ACL connections
    - Bluetooth: hci_conn: use mod_delayed_work for active mode timeout
    - Bluetooth: btusb: Add new VID/PID for RTL8852CE
    - Bluetooth: btusb: Add device ID for Realtek RTL8761BU
    - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky
    - net: sfp: add quirk for Lantech 8330-265D
    - wifi: rtw89: pci: restore LDO setting after device resume
    - wifi: ath10k: fix lock protection in
      ath10k_wmi_event_peer_sta_ps_state_chg()
    - bnxt_en: Allow ntuple filters for drops
    - net: usb: sr9700: remove code to drive nonexistent multicast filter
    - vmw_vsock: bypass false-positive Wnonnull warning with gcc-16
    - net/rds: Clear reconnect pending bit
    - PCI: Mark ASM1164 SATA controller to avoid bus reset
    - PCI/AER: Clear stale errors on reporting agents upon probe
    - PCI: Fix pci_slot_lock () device locking
    - PCI: Enable ACS after configuring IOMMU for OF platforms
    - PCI: Add ACS quirk for Qualcomm Hamoa & Glymur
    - PCI: Mark Nvidia GB10 to avoid bus reset
    - myri10ge: avoid uninitialized variable use
    - nfc: nxp-nci: remove interrupt trigger type
    - RDMA/rtrs-clt: For conn rejection use actual err number
    - ata: libata: avoid long timeouts on hot-unplugged SATA DAS
    - hisi_acc_vfio_pci: update status after RAS error
    - scsi: buslogic: Reduce stack usage
    - vhost: fix caching attributes of MMIO regions by setting them explicitly
    - scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event
    - [riscv64] vector: init vector context with proper vlenb
    - tracing: Fix false sharing in hwlat get_sample()
    - remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX
      channel is uninitialized
    - mailbox: pcc: Remove spurious IRQF_ONESHOT usage
    - mailbox: imx: Skip the suspend flag for i.MX7ULP
    - mailbox: sprd: mask interrupts that are not handled
    - remoteproc: mediatek: Break lock dependency to `prepare_lock`
    - mailbox: sprd: clear delivery flag before handling TX done
    - clk: microchip: core: correct return value on *_get_parent()
    - HID: i2c-hid: Add FocalTech FT8112
    - 9p/xen: protect xen_9pfs_front_free against concurrent calls
    - dmaengine: stm32-dma3: use module_platform_driver
    - soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15)
    - soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list
    - staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure
    - serial: 8250_dw: handle clock enable errors in runtime_resume
    - usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs
    - fpga: of-fpga-region: Fail if any bridge is missing
    - most: core: fix resource leak in most_register_interface error paths
    - dmaengine: sun6i: Choose appropriate burst length under maxburst
    - dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings
    - phy: ti: phy-j721e-wiz: restore mux selection during resume
    - phy: cadence-torrent: restore parent clock for refclk during resume
    - misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read()
    - misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66
    - usb: gadget: f_fs: fix DMA-BUF OUT queues
    - usb: gadget: f_fs: Fix ioctl error handling
    - usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()
    - staging: rtl8723bs: fix memory leak on failure path
    - serial: 8250: 8250_omap.c: Add support for handling UART error conditions
    - serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA
      termination is done
    - fix it87_wdt early reboot by reporting running timer
    - [arm*] binder: don't use %pK through printk
    - watchdog: imx7ulp_wdt: handle the nowayout option
    - phy: mvebu-cp110-utmi: fix dr_mode property read from dts
    - phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature
    - Revert "mfd: da9052-spi: Change read-mask to write-mask"
    - mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs
    - iio: Use IRQF_NO_THREAD
    - iio: magnetometer: Remove IRQF_ONESHOT
    - fs: ntfs3: check return value of indx_find to avoid infinite loop
    - fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent
      metadata
    - fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST
    - fs/ntfs3: drop preallocated clusters for sparse and compressed files
    - fs/ntfs3: avoid calling run_get_entry() when run == NULL in
      ntfs_read_run_nb_ra()
    - ceph: supply snapshot context in ceph_uninline_data()
    - libceph: define and enforce CEPH_MAX_KEY_LEN
    - thermal: int340x: Fix sysfs group leak on DLVR registration failure
    - [amd64] ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90
    - include: uapi: netfilter_bridge.h: Cover for musl libc
    - drm/amd/display: Fix writeback on DCN 3.2+
    - drm/amd/display: Fix system resume lag issue
    - drm/amd/display: Avoid updating surface with the same surface under MPO
    - drm/amdgpu: Adjust usleep_range in fence wait
    - ALSA: usb-audio: Update the number of packets properly at receiving
    - drm/amdgpu: Add HAINAN clock adjustment
    - drm/amd/display: bypass post csc for additional color spaces in dal
    - spi: spidev: fix lock inversion between spi_lock and buf_lock
    - drm/radeon: Add HAINAN clock adjustment
    - ALSA: usb-audio: Add sanity check for OOB writes at silencing
    - btrfs: replace BUG() with error handling in __btrfs_balance()
    - [arm64] hugetlbpage: avoid unused-but-set-parameter warning (gcc-16)
    - drm/amd/display: Remove conditional for shaper 3DLUT power-on
    - rtc: zynqmp: correct frequency value
    - ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access
    - ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut
    - xfrm6: fix uninitialized saddr in xfrm6_get_saddr()
    - xfrm: skip templates check for packet offload tunnel mode
    - ipmi: ipmb: initialise event handler read bytes
    - xfrm: always flush state and policy upon NETDEV_UNREGISTER event
    - espintcp: Fix race condition in espintcp_close() (CVE-2026-23239)
    - net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode
    - net: usb: lan78xx: scan all MDIO addresses on LAN7801
    - net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set()
    - net: ethernet: xscale: Check for PTP support properly
    - bnxt_en: Fix RSS context delete logic
    - bnxt_en: Fix deleting of Ntuple filters
    - wifi: cfg80211: wext: fix IGTK key ID off-by-one
    - Remove WARN_ALL_UNSEEDED_RANDOM kernel config option
    - Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ
    - Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short
    - Bluetooth: hci_qca: Cleanup on all setup failures
    - Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ
    - Bluetooth: L2CAP: Fix not checking output MTU is acceptable on
      L2CAP_ECRED_CONN_REQ
    - Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ
    - tls: Fix race condition in tls_sw_cancel_work_tx() (CVE-2026-23240)
    - kcm: fix zero-frag skb in frag_list on partial sendmsg error
    - tipc: fix duplicate publication key in tipc_service_insert_publ()
    - RDMA/core: Fix stale RoCE GIDs during netdev events at registration
    - net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets
    - RDMA/efa: Fix typo in efa_alloc_mr()
    - net: usb: pegasus: enable basic endpoint checking
    - RDMA/umem: Fix double dma_buf_unpin in failure path
    - net/mlx5: DR, Fix circular locking dependency in dump
    - net/mlx5: E-switch, Clear legacy flag when moving to switchdev
    - net/mlx5: Fix missing devlink lock in SRIOV enable error path
    - net/mlx5e: Separate address related variables to be in struct
    - net/mlx5e: Support routed networks during IPsec MACs initialization
    - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query
    - net: consume xmit errors of GSO frames
    - dpaa2-switch: validate num_ifs to prevent out-of-bounds write
    - netfilter: nf_conntrack_h323: fix OOB read in decode_choice()
    - rpmsg: core: fix race in driver_override_show() and use core helper
    - [arm64] clk: renesas: rzg2l: Fix intin variable size
    - [arm64] clk: renesas: rzg2l: Select correct div round macro
    - [amd64] ASoC: SOF: ipc4-control: If there is no data do not send bytes
      update
    - [amd64] ASoC: SOF: ipc4-topology: Correct the allocation size for bytes
      controls
    - [amd64] ASoC: SOF: ipc4-control: Use the correct size for
      scontrol->ipc_control_data
    - [amd64] ASoC: SOF: ipc4-control: Keep the payload size up to date
    - fpga: dfl: use subsys_initcall to allow built-in drivers to be added
    - Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global
      IRQ' is supported"
    - phy: qcom: edp: Make the number of clocks flexible
    - dm-verity: correctly handle dm_bufio_client_create() failure
    - media: mediatek: encoder: Fix uninitialized scalar variable issue
    - media: mtk-mdp: Fix error handling in probe function
    - media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove()
    - media: chips-media: wave5: Fix kthread worker destruction in polling mode
    - media: chips-media: wave5: Fix device cleanup order to prevent kernel
      panic
    - media: verisilicon: AV1: Fix enable cdef computation
    - media: verisilicon: AV1: Fix tx mode bit setting
    - [arm64] dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs
    - [armhf] omap2: Fix reference count leaks in omap_control_init()
    - [amd64] KVM: x86: Return "unsupported" instead of "invalid" on access to
      unsupported PV MSR
    - [amd64] KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3()
      succeeding
    - [arm64] Disable branch profiling for all arm64 code
    - HID: hid-pl: handle probe errors
    - HID: magicmouse: Do not crash on missing msc->input
    - HID: prodikeys: Check presence of pm->input_ep82
    - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length()
    - [arm64] dts: apple: t8112-j473: Keep the HDMI port powered on
    - media: amphion: Drop min_queued_buffers assignment
    - media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init()
    - media: verisilicon: AV1: Set IDR flag for intra_only frame type
    - media: radio-keene: fix memory leak in error path
    - media: cx88: Add missing unmap in snd_cx88_hw_params()
    - media: cx23885: Add missing unmap in snd_cx23885_hw_params()
    - media: cx25821: Add missing unmap in snd_cx25821_hw_params()
    - media: i2c/tw9903: Fix potential memory leak in tw9903_probe()
    - media: i2c/tw9906: Fix potential memory leak in tw9906_probe()
    - media: i2c: ov01a10: Fix the horizontal flip control
    - media: i2c: ov01a10: Fix reported pixel-rate value
    - media: i2c: ov01a10: Fix analogue gain range
    - media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls
    - media: i2c: ov01a10: Fix passing stream instead of pad to
      v4l2_subdev_state_get_format()
    - media: i2c: ov01a10: Fix test-pattern disabling
    - media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update()
    - media: ccs: Avoid possible division by zero
    - media: i2c: ov5647: Initialize subdev before controls
    - media: i2c: ov5647: Correct pixel array offset
    - media: i2c: ov5647: Correct minimum VBLANK value
    - media: i2c: ov5647: Sensor should report RAW color space
    - media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode
    - media: ccs: Fix setting initial sub-device state
    - media: i2c: ov5647: use our own mutex for the ctrl lock
    - media: ipu6: Fix typo and wrong constant in ipu6-mmu.c
    - media: ipu6: Fix RPM reference leak in probe error paths
    - [amd64] platform/x86: ISST: Add missing write block check
    - dm-integrity: fix a typo in the code for write/discard race
    - dm: clear cloned request bio pointer when last clone bio completes
    - [arm64] soc: ti: k3-socinfo: Fix regmap leak on probe failure
    - [arm64] soc: ti: pruss: Fix double free in pruss_clk_mux_setup()
    - [amd64] KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation
    - bus: omap-ocp2scp: fix OF populate on driver rebind
    - clk: clk-apple-nco: Add "apple,t8103-nco" compatible
    - [arm64,armhf] soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON
      definition
    - [arm64,armhf] soc: rockchip: grf: Support multiple grf to be handled
    - media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop
    - media: i2c: ov01a10: Fix digital gain range
    - clk: tegra: tegra124-emc: Fix potential memory leak in
      tegra124_clk_register_emc()
    - [s390x] pci: Handle futile config accesses of disabled devices directly
    - reset: gpio: suppress bind attributes in sysfs
    - dm-integrity: fix recalculation in bitmap mode
    - dm-unstripe: fix mapping bug when there are multiple targets in a table
    - [arm64] dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro
    - media: venus: vdec: fix error state assignment for zero bytesused
    - media: venus: vdec: restrict EOS addr quirk to IRIS2 only
    - drm: of: drm_of_panel_bridge_remove(): fix device_node leak
    - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations
    - selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs
    - drm/buddy: Prevent BUG_ON by validating rounded allocation
    - drm/bridge: anx7625: Fix invalid EDID size
    - xfs: mark data structures corrupt on EIO and ENODATA
    - xfs: remove xfs_attr_leaf_hasname
    - media: verisilicon: AV1: Fix tile info buffer size
    - [amd64] iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in
      scalable mode
    - mfd: core: Add locking around 'mfd_of_node_list'
    - mfd: qcom-pm8xxx: Fix OF populate on driver rebind
    - mfd: omap-usb-host: Fix OF populate on driver rebind
    - iio: accel: adxl380: Avoid reading more entries than present in FIFO
    - xfs: delete attr leaf freemap entries when empty
    - xfs: fix freemap adjustments when adding xattrs to leaf blocks
    - xfs: fix the xattr scrub to detect freemap/entries array collisions
    - xfs: fix remote xattr valuelblk check
    - [amd64] KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2()
    - PCI: endpoint: Fix swapped parameters in
      pci_{primary/secondary}_epc_epf_unlink() functions
    - pinctrl: intel: Add code name documentation
    - xfs: only call xf{array,blob}_destroy if we have a valid pointer
    - xfs: check return value of xchk_scrub_create_subord
    - xfs: check for deleted cursors when revalidating two btrees
    - md/bitmap: fix GPF in write_page caused by resize race
    - nfsd: fix return error code for nfsd_map_name_to_[ug]id
    - nvmem: Drop OF node reference on nvmem_add_one_cell() failure
    - [amd64] x86/kexec: add a sanity check on previous kernel's ima kexec
      buffer
    - mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node
    - usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN
    - io_uring/net: don't continue send bundle if poll was required for retry
    - bus: fsl-mc: fix an error handling in fsl_mc_device_add()
    - dm mpath: make pg_init_delay_msecs settable
    - [arm64] poe: fix stale POR_EL0 values for ptrace
    - tools: Fix bitfield dependency failure
    - vhost: move vdpa group bound check to vhost_vdpa
    - [powerpc*] smp: Add check for kcalloc() failure in parse_thread_groups()
    - iio: gyro: itg3200: Fix unchecked return value in read_raw
    - mtd: spinand: Disable continuous read during probe
    - mm/highmem: fix __kmap_to_page() build error
    - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net()
    - ocfs2: fix reflink preserve cleanup issue
    - kexec: derive purgatory entry from symbol
    - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling
      SR-IOV"
    - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug
    - [arm64] Fix non-atomic __READ_ONCE() with CONFIG_LTO=y
    - clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841
    - btrfs: continue trimming remaining devices on failure
    - remoteproc: imx_rproc: Fix invalid loaded resource table detection
    - perf/arm-cmn: Reject unsupported hardware configurations
    - scsi: ufs: core: Flush exception handling work when RPM level is zero
    - mm/slab: use unsigned long for orig_size to ensure proper metadata align
    - PCI: dwc: Fix msg_atu_index assignment
    - usb: dwc3: gadget: Move vbus draw to workqueue context
    - usb: dwc2: fix resume failure if dr_mode is host
    - mtd: rawnand: pl353: Fix software ECC support
    - tipc: fix RCU dereference race in tipc_aead_users_dec()
    - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()
    - net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error
      path
    - PCI: Fix pci_slot_trylock() error handling
    - staging: rtl8723bs: fix null dereference in find_network
    - kcsan, compiler_types: avoid duplicate type issues in BPF Type Format
    - watchdog/softlockup: fix sample ring index wrap in need_counting_irqs()
    - cifs: Fix locking usage for tcon fields
    - ceph: supply snapshot context in ceph_zero_partial_object()
    - rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0
    - net: ethernet: marvell: skge: remove incorrect conflicting PCI ID
    - net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean()
    - octeontx2-af: CGX: fix bitmap leaks
    - net: ti: icssg-prueth: Add optional dependency on HSR
    - net: macb: Fix tx/rx malfunction after phy link down and up
    - tracing: Fix to set write permission to per-cpu buffer_size_kb
    - io_uring/filetable: clamp alloc_hint to the configured alloc range
    - drm/amd/display: Increase DCN35 SR enter/exit latency
    - drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify
    - procfs: fix possible double mmput() in do_procmap_query()
    - net: intel: fix PCI device ID conflict between i40e and ipw2200
    - atm: fore200e: fix use-after-free in tasklets during device removal
    - function_graph: Restore direct mode when callbacks drop to one
    - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()
    - mm: numa_memblks: Identify the accurate NUMA ID of CFMW
    - fbcon: check return value of con2fb_acquire_newinfo()
    - fbdev: vt8500lcdfb: fix missing dma_free_coherent()
    - fbdev: of: display_timing: fix refcount leak in of_get_display_timings()
    - fbdev: ffb: fix corrupted video output on Sun FFB1
    - fbcon: Remove struct fbcon_display.inverse
    - cifs: some missing initializations on replay
    - [amd64] ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR
    - net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle
    - net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash()
    - [amd64] x86/kexec: Copy ACPI root pointer address from config table
    - [arm64] Force the use of CNTVCT_EL0 in __delay()
    - drm/amdgpu: keep vga memory on MacBooks with switchable graphics
    - net: nfc: nci: Fix parameter validation for packet data
    - tracing: ring-buffer: Fix to check event length before using
    - fgraph: Do not call handlers direct when not using ftrace_ops
    - tracing: Fix checking of freed trace_event_file for hist files
    - tracing: Wake up poll waiters for hist files when removing an event
    - NTB: ntb_transport: Fix too small buffer for debugfs_name
    - ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl()
    - [amd64] drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros
    - xfs: fix copy-paste error in previous fix
    - [arm64] Fix sampling the "stable" virtual counter in preemptible section
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.76
    - Revert "x86/kexec: add a sanity check on previous kernel's ima kexec
      buffer"
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.77
    - drm/vmwgfx: Fix invalid kref_put callback in vmw_bo_dirty_release
    - drm/vmwgfx: Return the correct value in vmw_translate_ptr functions
    - drm/logicvc: Fix device node reference leak in logicvc_drm_config_parse()
    - [arm64] KVM: arm64: Hide S1POE from guests when not supported by the host
    - [riscv64] irqchip/sifive-plic: Fix frozen interrupt due to affinity
      setting
    - scsi: lpfc: Properly set WC for DPP mapping
    - scsi: pm8001: Fix use-after-free in pm8001_queue_command()
    - ALSA: scarlett2: Fix redeclaration of loop variable
    - ALSA: scarlett2: Fix DSP filter control array handling
    - ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices
    - [amd64] x86/fred: Correct speculative safety in fred_extint()
    - rseq: Clarify rseq registration rseq_size bound check comment
    - cgroup/cpuset: Fix incorrect use of cpuset_update_tasks_cpumask() in
      update_cpumasks_hier()
    - scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume
    - ALSA: usb-audio: Cap the packet size pre-calculations
    - ALSA: usb-audio: Use inclusive terms
    - perf: Fix __perf_event_overflow() vs perf_remove_from_context() race
    - [s390x] idle: Fix cpu idle exit cpu time accounting
    - [s390x] vtime: Fix virtual timer forwarding
    - PCI: endpoint: Introduce pci_epc_function_is_valid()
    - PCI: endpoint: Introduce pci_epc_mem_map()/unmap()
    - [arm64] PCI: dwc: endpoint: Implement the pci_epc_ops::align_addr()
      operation
    - [arm64] PCI: dwc: ep: Use align addr function for
      dw_pcie_ep_raise_{msi,msix}_irq()
    - [arm64] PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry
    - drm/amdgpu: Unlock a mutex before destroying it
    - drm/amdgpu: Replace kzalloc + copy_from_user with memdup_user
    - drm/amdgpu: Fix locking bugs in error paths
    - ALSA: pci: hda: use snd_kcontrol_chip()
    - ALSA: hda: cs35l56: Fix signedness error in cs35l56_hda_posture_put()
    - btrfs: fix incorrect key offset in error message in
      check_dev_extent_item()
    - btrfs: fix objectid value in error message in check_extent_data_ref()
    - btrfs: fix warning in scrub_verify_one_metadata()
    - btrfs: print correct subvol num if active swapfile prevents deletion
    - btrfs: fix compat mask in error messages in btrfs_check_features()
    - [arm64] bpf, arm64: Force 8-byte alignment for JIT buffer to prevent
      atomic tearing
    - bpf: Fix stack-out-of-bounds write in devmap
    - PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value
    - [amd64] x86/acpi/boot: Correct acpi_is_processor_usable() check again
    - [arm64] memory: mtk-smi: fix device leaks on common probe
    - [arm64] memory: mtk-smi: fix device leak on larb probe
    - resource: Add resource set range and size helpers
    - PCI: Use resource_set_range() that correctly sets ->end
    - media: tegra-video: Fix memory leak in __tegra_channel_try_format()
    - media: dw9714: move power sequences to dedicated functions
    - media: dw9714: add support for powerdown pin
    - media: dw9714: Fix powerup sequence
    - [amd64] KVM: x86: Ignore -EBUSY when checking nested events from
      vcpu_block()
    - ata: libata-scsi: Refactor ata_scsi_simulate()
    - ata: libata-scsi: Refactor ata_scsiop_read_cap()
    - ata: libata-scsi: Refactor ata_scsiop_maint_in()
    - ata: libata-scsi: Document all VPD page inquiry actors
    - ata: libata-scsi: Remove struct ata_scsi_args
    - ata: libata: Remove ATA_DFLAG_ZAC device flag
    - ata: libata: Introduce ata_port_eh_scheduled()
    - ata: libata-scsi: avoid Non-NCQ command starvation
    - [arm64,armhf] drm/tegra: dsi: fix device leak on probe
    - ext4: correct the comments place for EXT4_EXT_MAY_ZEROOUT
    - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting
      I/O
    - mailbox: don't protect of_parse_phandle_with_args with con_mutex
    - mailbox: sort headers alphabetically
    - mailbox: remove unused header files
    - mailbox: Use dev_err when there is error
    - mailbox: Use guard/scoped_guard for con_mutex
    - mailbox: Allow controller specific mapping using fwnode
    - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()
    - ext4: add ext4_try_lock_group() to skip busy groups
    - ext4: factor out __ext4_mb_scan_group()
    - ext4: factor out ext4_mb_might_prefetch()
    - ext4: factor out ext4_mb_scan_group()
    - ext4: convert free groups order lists to xarrays
    - ext4: refactor choose group to scan group
    - ext4: implement linear-like traversal across order xarrays
    - ext4: always allocate blocks only from groups inode can use
    - workqueue: Add system_percpu_wq and system_dfl_wq
    - Input: synaptics_i2c - replace use of system_wq with system_dfl_wq
    - Input: synaptics_i2c - guard polling restart in resume
    - [amd64] iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device
      without scalable mode
    - [arm64] dts: rockchip: Fix rk356x PCIe range mappings
    - [arm64] dts: rockchip: Fix rk3588 PCIe range mappings
    - [armhf] clk: tegra: tegra124-emc: fix device leak on set_rate()
    - ima: kexec: silence RCU list traversal warning
    - ima: rename variable the seq_file "file" to "ima_kexec_file"
    - ima: define and call ima_alloc_kexec_file_buf()
    - kexec: define functions to map and unmap segments
    - ima: kexec: define functions to copy IMA log at soft boot
    - ima: verify the previous kernel's IMA buffer lies in addressable RAM
    - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range()
    - drm/exynos: vidi: fix to avoid directly dereferencing user pointer
    - drm/exynos/vidi: Remove redundant error handling in vidi_get_modes()
    - drm/exynos: vidi: use ctx->lock to protect struct vidi_context member
      variables related to memory alloc/free (CVE-2026-23227)
    - uprobes: switch to RCU Tasks Trace flavor for better performance
    - uprobes: Fix incorrect lockdep condition in filter_chain()
    - btrfs: drop unused parameter fs_info from do_reclaim_sweep()
    - btrfs: get used bytes while holding lock at btrfs_reclaim_bgs_work()
    - btrfs: fix reclaimed bytes accounting after automatic block group reclaim
    - btrfs: fix periodic reclaim condition
    - btrfs: zoned: fix alloc_offset calculation for partly conventional block
      groups
    - btrfs: zoned: fixup last alloc pointer after extent removal for RAID1
    - btrfs: zoned: fixup last alloc pointer after extent removal for DUP
    - btrfs: zoned: fix stripe width calculation
    - btrfs: define the AUTO_KFREE/AUTO_KVFREE helper macros
    - btrfs: zoned: fixup last alloc pointer after extent removal for RAID0/10
    - [riscv64] usb: cdns3: remove redundant if branch
    - [riscv64] usb: cdns3: call cdns_power_is_lost() only once in cdns_resume()
    - [riscv64] usb: cdns3: fix role switching during resume
    - drm/amd: Fix hang on amdgpu unload by using pci_dev_is_disconnected()
      (Closes: #1130930)
    - ALSA: hda/conexant: Add quirk for HP ZBook Studio G4
    - hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler optimization
      induced race
    - ksmbd: check return value of xa_store() in krb5_authenticate
    - ksmbd: add chann_lock to protect ksmbd_chann_list xarray (CVE-2026-23226)
    - ALSA: hda/realtek: Add quirk for Gigabyte G5 KF5 (2023)
    - ALSA: hda/realtek: Add quirk for Samsung Galaxy Book3 Pro 360 (NP965QFG)
    - ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314
    - net: arcnet: com20020-pci: fix support for 2.5Mbit cards
    - eventpoll: Fix integer overflow in ep_loop_check_proc()
    - namespace: fix proc mount iteration
    - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
    - nfc: pn533: properly drop the usb interface reference on disconnect
    - net: usb: kaweth: validate USB endpoints
    - net: usb: kalmia: validate USB endpoints
    - net: usb: pegasus: validate USB endpoints
    - can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a
      message
    - can: usb: f81604: correctly anchor the urb in the read bulk callback
    - can: ucan: Fix infinite loop from zero-length messages
    - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback
    - can: usb: f81604: handle short interrupt urb messages properly
    - can: usb: f81604: handle bulk write errors properly
    - HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them
    - [amd64] x86/efi: defer freeing of boot services memory
    - [amd64] platform/x86: dell-wmi-sysman: Don't hex dump plaintext password
      data
    - [amd64] platform/x86: dell-wmi: Add audio/mic mute key codes
    - ALSA: usb-audio: Use correct version for UAC3 header validation
    - wifi: radiotap: reject radiotap with unknown bits
    - wifi: cfg80211: cancel rfkill_block work in wiphy_unregister()
    - wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration
    - wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()
    - IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq()
    - RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah()
    - net/sched: ets: fix divide by zero in the offload path
    - nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit().
    - tracing: Fix WARN_ON in tracing_buffers_mmap_close
    - scsi: target: Fix recursive locking in __configfs_open_file()
    - Squashfs: check metadata block offset is within range
    - drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock()
    - drbd: fix null-pointer dereference on local read error
    - smb: client: fix cifs_pick_channel when channels are equally loaded
    - smb: client: fix broken multichannel with krb5+signing
    - smb: client: Don't log plaintext credentials in cifs_set_cifscreds
    - scsi: core: Fix refcount leak for tagset_refcnt
    - xattr: switch to CLASS(fd) (CVE-2024-14027)
    - btrfs: always fallback to buffered write if the inode requires checksum
    - ACPI: APEI: GHES: Disable KASAN instrumentation when compile testing with
      clang < 18
    - nvme: fix admin queue leak on controller reset
    - hwmon: (aht10) Add support for dht20
    - hwmon: (aht10) Fix initialization commands for AHT20
    - pinctrl: equilibrium: rename irq_chip function callbacks
    - pinctrl: equilibrium: fix warning trace on load
    - [amd64] platform/x86: thinkpad_acpi: Fix errors reading battery thresholds
    - HID: multitouch: add quirks for Lenovo Yoga Book 9i
    - HID: multitouch: new class MT_CLS_EGALAX_P80H84
    - [amd64] pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe()
    - hwmon: (it87) Check the it87_lock() return value
    - [amd64,arm64] idpf: change IRQ naming to match netdev and ethtool queue
      numbering
    - i40e: Fix preempt count leak in napi poll tracepoint
    - e1000e: clear DPG_EN after reset to avoid autonomous power-gating
    - drm/solomon: Fix page start when updating rectangle in page addressing
      mode
    - net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling
      in ALE table
    - xsk: Get rid of xdp_buff_xsk::xskb_list_node
    - xsk: s/free_list_node/list_node/
    - xsk: Fix fragment node deletion to prevent buffer leak
    - xsk: Fix zero-copy AF_XDP fragment drop
    - atm: lec: fix null-ptr-deref in lec_arp_clear_vccs
    - [arm64] net: ti: icssg-prueth: Fix ping failure after offload mode setup
      when link speed is not 1G
    - amd-xgbe: fix MAC_TCR_SS register width for 2.5G and 10M speeds
    - can: bcm: fix locking for bcm_op runtime updates
    - can: mcp251x: fix deadlock in error path of mcp251x_open
    - wifi: rsi: Don't default to -EOPNOTSUPP in rsi_mac80211_config
    - drm/xe: Do not preempt fence signaling CS instructions
    - kunit: tool: copy caller args in run_kernel to prevent mutation
    - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded
    - octeon_ep: Relocate counter updates before NAPI
    - octeon_ep: avoid compiler and IQ/OQ reordering
    - octeon_ep_vf: Relocate counter updates before NAPI
    - octeon_ep_vf: avoid compiler and IQ/OQ reordering
    - wifi: cw1200: Fix locking in error paths
    - wifi: wlcore: Fix a locking bug
    - wifi: mt76: mt7996: Fix possible oob access in
      mt7996_mac_write_txwi_80211()
    - wifi: mt76: mt7925: Fix possible oob access in
      mt7925_mac_write_txwi_80211()
    - wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211()
    - indirect_call_wrapper: do not reevaluate function pointer
    - net/rds: Fix circular locking dependency in rds_tcp_tune
    - xen/acpi-processor: fix _CST detection using undersized evaluation buffer
    - iavf: fix netdev->max_mtu to respect actual hardware limit
    - bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim
    - smb/client: fix buffer size for smb311_posix_qinfo in smb2_compound_op()
    - smb/client: fix buffer size for smb311_posix_qinfo in
      SMB311_posix_query_info()
    - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()
    - net: ipv4: fix ARM64 alignment fault in multipath hash seed
    - amd-xgbe: fix sleep while atomic on suspend/resume
    - drm/sched: Fix kernel-doc warning for drm_sched_job_done()
    - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock"
    - drm/xe/reg_sr: Fix leak on xa_store failure
    - nvme: reject invalid pr_read_keys() num_keys values
    - nvme: fix memory allocation in nvme_pr_read_keys()
    - hwmon: (max6639) : Configure based on DT property
    - hwmon: (max6639) fix inverted polarity
    - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless
      qdiscs
    - net: nfc: nci: Fix zero-length proprietary notifications
    - net_sched: sch_fq: clear q->band_pkt_count[] in fq_reset()
    - nfc: nci: free skb on nci_transceive early error paths
    - nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback
    - nfc: rawsock: cancel tx_work before socket teardown
    - net: stmmac: Fix error handling in VLAN add and delete paths
    - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase
    - net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in
      mtk_xdp_setup()
    - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled
    - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled
    - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop
    - net/sched: act_ife: Fix metalist update behavior
    - xdp: use modulo operation to calculate XDP frag tailroom
    - xsk: introduce helper to determine rxq->frag_size
    - i40e: fix registering XDP RxQ info
    - i40e: use xdp.frame_sz as XDP RxQ info frag_size
    - xdp: produce a warning when calculated tailroom is negative
    - tracing: Add NULL pointer check to trigger_data_free()
    - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared
      blocks
    - ext4: fix potential null deref in ext4_mb_init()
    - ata: libata-core: fix cancellation of a port deferred qc work
    - ata: libata-eh: correctly handle deferred qc timeouts
    - ata: libata: cancel pending work after clearing deferred_qc
    - ata: libata-eh: Fix detection of deferred qc timeouts
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.78
    - scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT
    - [amd64] ACPI: PM: Save NVS memory on Lenovo G70-35
    - scsi: mpi3mr: Add NULL checks when resetting request and reply queues
    - ALSA: hda/realtek: Fix speaker pop on Star Labs StarFighter
    - unshare: fix unshare_fs() handling
    - wifi: mac80211: set default WMM parameters on all links
    - ACPI: OSI: Add DMI quirk for Acer Aspire One D255
    - scsi: ses: Fix devices attaching to different hosts
    - [amd64] ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table
    - [amd64] ASoC: cs42l43: Report insert for exotic peripherals
    - scsi: ufs: core: Fix possible NULL pointer dereference in
      ufshcd_add_command_trace()
    - scsi: ufs: core: Fix shift out of bounds when MAXQ=32
    - ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0
    - drm/amdgpu/vcn5: Add SMU dpm interface type
    - ALSA: usb-audio: Check max frame size for implicit feedback mode, too
    - kexec: Consolidate machine_kexec_mask_interrupts() implementation
    - kexec: Include kernel-end even without crashkernel
    - [powerpc*] kexec/core: use big-endian types for crash variables
    - [powerpc*] crash: adjust the elfcorehdr size
    - remoteproc: sysmon: Correct subsys_name_len type in QMI request
    - remoteproc: mediatek: Unprepare SCP clock during system suspend
    - [powerpc*] 83xx: km83xx: Fix keymile vendor prefix
    - smb/server: Fix another refcount leak in smb2_open()
    - nfs: return EISDIR on nfs3_proc_create if d_alias is a dir
    - [arm64] drm/msm/dsi: fix hdisplay calculation when programming dsi
      registers
    - xprtrdma: Decrement re_receiving on the early exit paths
    - btrfs: hold space_info->lock when clearing periodic reclaim ready
    - workqueue: Use POOL_BH instead of WQ_BH when checking pool flags
    - perf disasm: Fix off-by-one bug in outside check
    - [arm64] drm/msm/dsi: fix pclk rate calculation for bonded dsi
    - drm/amd/pm: add missing od setting PP_OD_FEATURE_ZERO_FAN_BIT for smu v14
    - bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states
    - net/mlx5: IFC updates for disabled host PF
    - net/mlx5: Query to see if host PF is disabled
    - net/mlx5: Fix deadlock between devlink lock and esw->wq
    - net/mlx5: Fix crash when moving to switchdev mode
    - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery
    - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL
      slave xmit (CVE-2026-23277)
    - ASoC: soc-core: drop delayed_work_pending() check before flush
    - ASoC: soc-core: flush delayed work before removing DAIs and widgets
    - ASoC: simple-card-utils: use __free(device_node) for device node
    - ASoC: simple-card-utils: fix graph_util_is_ports0() for DT overlays
    - net: sfp: improve Huawei MA5671a fixup
    - serial: caif: hold tty->link reference in ldisc_open and ser_release
    - bnxt_en: Fix RSS table size check when changing ethtool channels
    - mctp: i2c: fix skb memory leak in receive path
    - can: hi311x: hi3110_open(): add check for hi3110_power_enable() return
      value
    - bonding: add ESP offload features when slaves support
    - bonding: Correctly support GSO ESP offload
    - net: add a common function to compute features for upper devices
    - bonding: use common function to compute the features
    - bonding: fix type confusion in bond_setup_by_slave()
    - mctp: route: hold key->lock in mctp_flow_prepare_output()
    - [amd64,arm64] amd-xgbe: fix link status handling in xgbe_rx_adaptation
    - [amd64,arm64] amd-xgbe: prevent CRC errors during RX adaptation with AN
      disabled
    - xdp: allow attaching already registered memory model to xdp_rxq_info
    - xdp: register system page pool as an XDP memory model
    - net: add xmit recursion limit to tunnel xmit functions (CVE-2026-23276)
    - netfilter: nf_tables: always walk all pending catchall elements
      (CVE-2026-23278)
    - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()
    - netfilter: x_tables: guard option walkers against 1-byte tail reads
    - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path
    - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()
    - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels
      (CVE-2026-23274)
    - perf annotate: Fix hashmap__new() error checking
    - regulator: pca9450: Correct interrupt type
    - perf ftrace: Fix hashmap__new() error checking
    - sched: idle: Make skipping governor callbacks more consistent
    - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set
    - nvme-pci: Fix race bug in nvme_poll_irqdisable()
    - i40e: fix src IP mask checks and memcpy argument names in cloud filter
    - e1000/e1000e: Fix leak in DMA error cleanup
    - net: bcmgenet: fix broken EEE by converting to phylib-managed state
    - ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address()
    - [amd64] ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock
      acquisition
    - ASoC: detect empty DMI strings
    - drm/amdkfd: Unreserve bo if queue update failed
    - net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled
    - [arm64] octeontx2-af: devlink: fix NIX RAS reporter recovery condition
    - [arm64] octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt
      status
    - net: prevent NULL deref in ip[6]tunnel_xmit()
    - iio: imu: inv-mpu9150: fix irq ack preventing irq storms
    - usb: gadget: f_mass_storage: Fix potential integer overflow in
      check_command_size_in_blocks()
    - Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on"
    - cgroup: fix race between task migration and iteration
    - ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain()
    - ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer
      interfaces
    - net: usb: lan78xx: fix silent drop of packets with checksum errors
    - net: usb: lan78xx: fix TX byte statistics for small packets
    - net: usb: lan78xx: skip LTM configuration for LAN7850
    - ata: libata-core: Add BRIDGE_OK quirk for QEMU drives
    - [amd64] ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA
    - [amd64] KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with
      in-kernel APIC
    - USB: add QUIRK_NO_BOS for video capture several devices
    - usb/core/quirks: Add Huawei ME906S-device to wakeup quirk
    - USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed
    - usb: xhci: Fix memory leak in xhci_disable_slot()
    - usb: xhci: Prevent interrupt storm on host controller error (HCE)
    - usb: yurex: fix race in probe
    - usb: dwc3: pci: add support for the Intel Nova Lake -H
    - usb: misc: uss720: properly clean up reference in uss720_probe()
    - usb: core: don't power off roothub PHYs if phy_set_mode() fails
    - usb: cdc-acm: Restore CAP_BRK functionnality to CH343
    - usb: roles: get usb role switch from parent only for usb-b-connector
    - usb: typec: altmode/displayport: set displayport signaling rate in
      configure message
    - USB: usbcore: Introduce usb_bulk_msg_killable()
    - USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts
    - USB: core: Limit the length of unkillable synchronous timeouts
    - usb: class: cdc-wdm: fix reordering issue in read code path
    - usb: mdc800: handle signal and read racing
    - usb: image: mdc800: kill download URB on timeout
    - mm/tracing: rss_stat: ensure curr is false from kthread context
    - mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index()
    - mm/kfence: disable KFENCE upon KASAN HW tags enablement
    - mmc: core: Avoid bitfield RMW for claim/retune flags
    - [arm64] ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and
      start
    - tipc: fix divide-by-zero in tipc_sk_filter_connect()
    - kprobes: avoid crash when rmmod/insmod after ftrace killed
    - ceph: add a bunch of missing ceph_path_info initializers
    - libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()
    - libceph: reject preamble if control segment is empty
    - libceph: prevent potential out-of-bounds reads in process_message_header()
    - libceph: Use u32 for non-negative values in ceph_monmap_decode()
    - libceph: admit message frames only in CEPH_CON_S_OPEN state
    - ceph: fix i_nlink underrun during async unlink
    - ceph: fix memory leaks in ceph_mdsc_build_path()
    - time/jiffies: Mark jiffies_64_to_clock_t() notrace
    - i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach
    - scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend
    - scsi: hisi_sas: Add time interval between two H2D FIS following soft reset
      spec
    - scsi: hisi_sas: Use macro instead of magic number
    - scsi: hisi_sas: Fix NULL pointer exception during user_scan()
    - kbuild: Disable CC_HAS_ASM_GOTO_OUTPUT on clang < 17
    - Fix CC_HAS_ASM_GOTO_OUTPUT on non-x86 architectures
    - Revert "tcpm: allow looking for role_sw device in the main node"
    - drm/amd: Disable MES LR compute W/A
    - drm/bridge: samsung-dsim: Fix memory leak in error path
    - drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used
    - [s390x] pfault: Fix virtual vs physical address confusion
    - nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit().
    - device property: Allow secondary lookup in fwnode_get_next_child_node()
    - [arm64,armhf] irqchip/gic-v3-its: Limit number of per-device MSIs to the
      range the ITS supports
    - btrfs: fix chunk map leak in btrfs_map_block() after
      btrfs_chunk_map_num_copies()
    - ice: reintroduce retry mechanism for indirect AQ
    - ixgbevf: fix link setup issue
    - staging: rtl8723bs: properly validate the data in rtw_get_ie_ex()
    - staging: rtl8723bs: fix potential out-of-bounds read in
      rtw_restruct_wmm_ie
    - media: dvb-net: fix OOB access in ULE extension header tables
    - [amd64,arm64] net: mana: Ring doorbell at 4 CQ wraparounds
    - ice: fix retry for AQ command 0x06EE
    - tracing: Fix syscall events activation by ensuring refcount hits zero
    - net/tcp-ao: Fix MAC comparison to be constant-time
    - batman-adv: Avoid double-rtnl_lock ELP metric worker
    - nouveau/dpcd: return EBUSY for aux xfer if the device is asleep
    - [arm64] mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation
    - hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read
    - [arm64] contpte: fix set_access_flags() no-op check for SMMU/ATS faults
    - pmdomain: bcm: bcm2835-power: Fix broken reset status read
    - ata: libata-core: Disable LPM on ST1000DM010-2EP102
    - drm/amd/display: Fallback to boot snapshot for dispclk
    - ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close()
    - smb: server: fix use-after-free in smb2_open()
    - ksmbd: fix use-after-free by using call_rcu() for oplock_info
    - net: nexthop: fix percpu use-after-free in remove_nh_grp_entry
    - net: ncsi: fix skb leak in error paths
    - net: ethernet: arc: emac: quiesce interrupts before requesting IRQ
    - net: dsa: microchip: Fix error path in PTP IRQ setup
    - drm/amd/pm: remove invalid gpu_metrics.energy_accumulator on smu v13.0.x
    - drm/amdgpu: Fix use-after-free race in VM acquire
    - drm/amd: Set num IP blocks to 0 if discovery fails
    - drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding
    - [amd64] drm/i915: Fix potential overflow of shmem scatterlist length
    - [arm64] drm/msm: Fix dma_free_attrs() buffer size
    - tracing: Fix enabling multiple events on the kernel command line and
      bootconfig
    - tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G
    - qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size
    - cifs: make default value of retrans as zero
    - xfs: fix returned valued from xfs_defer_can_append
    - xfs: fix undersized l_iclog_roundoff values
    - xfs: ensure dquot item is deleted from AIL only after log shutdown
    - [s390x] dasd: Move quiesce state with pprc swap
    - [s390x] dasd: Copy detected format information to secondary device
    - lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error
    - scsi: core: Fix error handling for scsi_alloc_sdev()
    - [amd64] x86/apic: Disable x2apic on resume if the kernel expects so
    - lib/bootconfig: fix snprintf truncation check in
      xbc_node_compose_key_after()
    - lib/bootconfig: check bounds before writing in __xbc_open_brace()
    - smb: client: fix atomic open with O_DIRECT & O_SYNC
    - smb: client: fix in-place encryption corruption in SMB2_write()
    - smb: client: fix iface port assignment in parse_server_interfaces
    - btrfs: fix transaction abort on file creation due to name hash collision
    - btrfs: fix transaction abort on set received ioctl due to item overflow
    - btrfs: abort transaction on failure to update root in the received subvol
      ioctl
    - iio: dac: ds4424: reject -128 RAW value
    - iio: frequency: adf4377: Fix duplicated soft reset mask
    - iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas()
    - iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas()
    - iio: potentiometer: mcp4131: fix double application of wiper shift
    - iio: chemical: bme680: Fix measurement wait duration calculation
    - iio: buffer: Fix wait_queue not being removed
    - iio: gyro: mpu3050-core: fix pm_runtime error handling
    - iio: gyro: mpu3050-i2c: fix pm_runtime error handling
    - iio: imu: inv_icm42600: fix odr switch to the same value
    - iio: imu: inv_icm42600: fix odr switch when turning buffer off
    - iio: proximity: hx9023s: Protect against division by zero in set_samp_freq
    - i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors
    - i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort
    - i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor
    - drm/bridge: ti-sn65dsi86: Add support for DisplayPort mode with HPD
    - net/tcp-md5: Fix MAC comparison to be constant-time
    - ksmbd: Compare MACs in constant time (CVE-2026-23364)
    - smb: client: Compare MACs in constant time
    - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list()
    - ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths
    - spi: cadence-quadspi: Implement refcount to handle unbind during busy
      (CVE-2025-40005)
    - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL
      (CVE-2026-23386)
    - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock
      (CVE-2026-23368)
    - [amd64] x86/sev: Allow IBPB-on-Entry feature for SNP guests
    - [amd64] platform/x86: hp-bioscfg: Support allocations of larger data
      (Closes: #1127612)
    - wifi: libertas: fix use-after-free in lbs_free_adapter() (CVE-2026-23281)
    - [amd64] perf/x86/intel/uncore: Support more units on Granite Rapids
    - [amd64] perf/x86/intel/uncore: Add per-scheduler IMC CAS count events
    - mptcp: pm: in-kernel: always mark signal+subflow endp as used
    - mptcp: pm: avoid sending RM_ADDR over same subflow
    - drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink
    - kbuild: Leave objtool binary around with 'make clean'
    - net/sched: act_gate: snapshot parameters with RCU on replace
      (CVE-2026-23245)
    - xfs: Fix error pointer dereference
    - can: gs_usb: gs_can_open(): always configure bitrates before starting
      device
    - cleanup: Provide retain_and_null_ptr()
    - usb: gadget: f_ncm: Fix net_device lifecycle with device_move
    - usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling
    - [amd64] KVM: SVM: Limit AVIC physical max index based on configured
      max_vcpu_ids
    - [amd64] KVM: SVM: Add a helper to look up the max physical ID for AVIC
    - [amd64] KVM: SVM: Set/clear CR8 write interception when AVIC is
      (de)activated
    - [arm64,armhf] mmc: dw_mmc-rockchip: use modern PM macros
    - [arm64,armhf] mmc: dw_mmc-rockchip: Add memory clock auto-gating support
    - [arm64,armhf] mmc: dw_mmc-rockchip: Fix runtime PM support for internal
      phase support
    - mm/page_alloc: move set_page_refcounted() to callers of post_alloc_hook()
    - mm/page_alloc: sort out the alloc_contig_range() gfp flags mess
    - mm/page_alloc: forward the gfp flags from alloc_contig_range() to
      post_alloc_hook()
    - mm/kfence: fix KASAN hardware tag faults during late enablement
    - nsfs: tighten permission checks for ns iteration ioctls
    - sched_ext: Disable preemption between scx_claim_exit() and kicking helper
      work
    - sched_ext: Fix starvation of scx_enable() under fair-class saturation
    - iomap: reject delalloc mappings during writeback
    - fgraph: Fix thresh_return clear per-task notrace
    - [amd64] KVM: x86: Co-locate initialization of feature MSRs in
      kvm_arch_vcpu_create()
    - [amd64] KVM: x86: Quirk initialization of feature MSRs to KVM's max
      configuration
    - [amd64] KVM: x86: do not allow re-enabling quirks
    - [amd64] KVM: x86: Allow vendor code to disable quirks
    - [amd64] KVM: x86: Introduce supported_quirks to block disabling quirks
    - [amd64] KVM: x86: Introduce Intel specific quirk
      KVM_X86_QUIRK_IGNORE_GUEST_PAT
    - [amd64] KVM: nVMX: Add consistency checks for CR0.WP and CR4.CET
    - [amd64] KVM: x86: Introduce KVM_X86_QUIRK_VMCS12_ALLOW_FREEZE_IN_SMM
    - ksmbd: Don't log keys in SMB3 signing and encryption key generation
    - drm/bridge: ti-sn65dsi83: halve horizontal syncs for dual LVDS output
    - net: macb: Shuffle the tx ring before enabling tx
    - cifs: open files should not hold ref on superblock
    - xfs: fix integer overflow in bmap intent sort comparator
    - drm/xe/sync: Cleanup partially initialized sync on parse failure
    - ipv6: use RCU in ip6_xmit() (CVE-2025-40135)
    - dm-verity: disable recursive forward error correction (CVE-2025-71161)
    - rxrpc: Fix recvmsg() unconditional requeue
    - btrfs: do not strictly require dirty metadata threshold for metadata
      writepages (CVE-2026-23157)
    - ice: fix devlink reload call trace (CVE-2026-23104)
    - tracing: Add recursion protection in kernel stack trace recording
      (CVE-2026-23138)
    - [amd64] Octeontx2-af: Add proper checks for fwdata (CVE-2026-23070)
    - io_uring/uring_cmd: fix too strict requirement on ioctl
    - [amd64] x86/uprobes: Fix XOL allocation failure for 32-bit tasks
    - [amd64] platform/x86/amd/pmc: Add support for Van Gogh SoC
      (CVE-2025-68334)
    - mptcp: pm: in-kernel: always set ID as avail when rm endp
    - net: stmmac: remove support for lpi_intr_o
    - f2fs: compress: change the first parameter of page_array_{alloc,free} to
      sbi
    - f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic
      (CVE-2025-38627)
    - f2fs: fix to avoid migrating empty section (CVE-2025-40150)
    - blk-throttle: fix access race during throttle policy activation
      (CVE-2025-40147)
    - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()
      (CVE-2025-71221)
    - net: dsa: properly keep track of conduit reference (CVE-2025-71152)
    - binfmt_misc: restore write access before closing files opened by
      open_exec() (CVE-2025-68239)
    - xfs: get rid of the xchk_xfile_*_descr calls
    - erofs: fix inline data read failure for ztailpacking pclusters
    - mm: thp: deny THP for files on anonymous inodes (CVE-2026-23375)
    - sched_ext: Remove redundant css_put() in scx_cgroup_init()
    - io_uring/kbuf: check if target buffer list is still legacy on recycle
    - sched/fair: Fix zero_vruntime tracking
    - [s390x] stackleak: Fix __stackleak_poison() inline assembly constraint
    - [s390x] xor: Fix xor_xc_2() inline assembly constraints
    - [amd64] drm/i915/alpm: ALPM disable fixes
    - [amd64] drm/i915/psr: Repeat Selective Update area alignment
    - drm/amd/display: Add pixel_clock to amd_pp_display_configuration
    - drm/amd/pm: Use pm_display_cfg in legacy DPM (v2)
    - drm/amdgpu: Add basic validation for RAS header (CVE-2025-38426)
    - NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd
    - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
    - HID: bpf: prevent buffer overflow in hid_hw_request
    - sunrpc: fix cache_request leak in cache_release
    - nvdimm/bus: Fix potential use after free in asynchronous initialization
    - NFC: nxp-nci: allow GPIOs to sleep
    - net: macb: fix use-after-free access to PTP clock
    - mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN stations
    - Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp()
    - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access
    - smb: client: fix krb5 mount with username option
    - ksmbd: unset conn->binding on failed binding request
    - ksmbd: use volume UUID in FS_OBJECT_ID_INFORMATION
    - [amd64] drm/i915/dsc: Add Selective Update register definitions
    - [amd64] drm/i915/dsc: Add helper for writing DSC Selective Update ET
      parameters
    - [amd64] drm/i915/psr: Write DSC parameters on Selective Update in ET mode
    - [s390x] zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute
    - kprobes: Remove unneeded goto
    - kprobes: Remove unneeded warnings from __arm_kprobe_ftrace()
    - btrfs: fix transaction abort when snapshotting received subvolumes
    - batman-adv: avoid OGM aggregation when skb tailroom is insufficient
    - net: macb: Introduce gem_init_rx_ring()
    - net: macb: Reinitialize tx/rx queue pointer registers and rx ring during
      resume
    - ata: libata-core: disable LPM on ADATA SU680 SSD
    - mmc: sdhci-pci-gli: fix GL9750 DMA write corruption
    - mmc: sdhci: fix timing selection for 1-bit bus width
    - pmdomain: bcm: bcm2835-power: Increase ASB control timeout
    - spi: fix use-after-free on controller registration failure
    - spi: fix statistics allocation
    - mtd: rawnand: pl353: make sure optimal timings are applied
    - mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in
      cadence_nand_init()
    - mtd: Avoid boot crash in RedBoot partition table parser
    - [amd64] iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry
    - serial: 8250_pci: add support for the AX99100
    - serial: 8250: Fix TX deadlock when using DMA
    - serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART
      BUSY
    - serial: uartlite: fix PM runtime usage count underflow on probe
    - io_uring/kbuf: propagate BUF_MORE through early buffer commit path
    - drm: Fix use-after-free on framebuffers and property blobs when calling
      drm_dev_unplug
    - drm/amd/display: Wrap dcn32_override_min_req_memclk() in DC_FP_{START,
      END}
    - drm/amdgpu/gmc9.0: add bounds checking for cid
    - drm/amdgpu/mmhub2.0: add bounds checking for cid
    - drm/amdgpu/mmhub2.3: add bounds checking for cid
    - drm/amdgpu/mmhub3.0.1: add bounds checking for cid
    - drm/amdgpu/mmhub3.0.2: add bounds checking for cid
    - drm/amdgpu/mmhub3.0: add bounds checking for cid
    - drm/amdgpu/mmhub4.1.0: add bounds checking for cid
    - drm/imagination: Fix deadlock in soft reset sequence
    - drm/radeon: apply state adjust rules to some additional HAINAN vairants
    - drm/amdgpu: apply state adjust rules to some additional HAINAN vairants
    - drm/xe/oa: Allow reading after disabling OA stream
    - drm/xe: Open-code GGTT MMIO access protection
    - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ
      (CVE-2026-23395)
    - ata: libata-scsi: Return residual for emulated SCSI commands
    - ata: libata-scsi: report correct sense field pointer in
      ata_scsiop_maint_in()
    - btrfs: log new dentries when logging parent dir of a conflicting inode
    - btrfs: tree-checker: fix misleading root drop_level error message
    - [riscv64] soc: microchip: mpfs: Fix memory leak in
      mpfs_sys_controller_probe()
    - [riscv64] cache: starfive: fix device node leak in starlink_cache_init()
    - [arm64,armhf] soc: rockchip: grf: Add missing of_node_put() when returning
    - wifi: mac80211: Fix static_branch_dec() underflow for aql_disable.
    - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down
    - [arm64] dts: renesas: r9a09g057: Add RTC node
    - [arm64] dts: renesas: r9a09g057: Remove wdt{0,2,3} nodes
    - [arm64] firmware: arm_scpi: Fix device_node reference leak in probe path
    - Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU
    - Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU
    - Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy
    - Bluetooth: ISO: Fix defer tests being unstable
    - Bluetooth: hci_sync: Fix hci_le_create_conn_sync
    - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers
    - Bluetooth: HIDP: Fix possible UAF
    - Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user
    - Bluetooth: qca: fix ROM version reading on WCN3998 chips
    - bridge: cfm: Fix race condition in peer_mep deletion (CVE-2026-23393)
    - net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect
    - mpls: add missing unregister_netdevice_notifier to mpls_init
    - netfilter: ctnetlink: remove refcounting in expectation dumpers
      (CVE-2025-39764)
    - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()
    - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in
      sip_help_tcp()
    - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case
    - nf_tables: nft_dynset: fix possible stateful expression memleak in error
      path (CVE-2026-23399)
    - netfilter: nft_ct: drop pending enqueued packets on removal
    - netfilter: xt_CT: drop pending enqueued packets on template removal
      (CVE-2026-23391)
    - netfilter: xt_time: use unsigned int for monthday bit shift
    - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()
    - net: bcmgenet: increase WoL poll timeout
    - [amd64,arm64] net: mana: fix use-after-free in mana_hwc_destroy_channel()
      by reordering teardown
    - sched: idle: Consolidate the handling of two special cases
    - PM: runtime: Fix a race condition related to device removal
    - bonding: prevent potential infinite loop in bond_header_parse()
    - net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()
    - net/sched: teql: Fix double-free in teql_master_xmit
    - net: airoha: read default PSE reserved pages value before updating
    - net: airoha: fix PSE memory configuration in airoha_fe_pse_ports_init()
    - net: airoha: Read completion queue data in airoha_qdma_tx_napi_poll()
    - net: airoha: Remove airoha_dev_stop() in airoha_remove()
    - net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check
    - net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check
    - clsact: Fix use-after-free in init/destroy rollback asymmetry
    - net: usb: aqc111: Do not perform PM inside suspend callback
    - igc: fix missing update of skb->tail in igc_xmit_frame()
    - igc: fix page fault in XDP TX timestamps handling
    - iavf: fix VLAN filter lost on add/delete race
    - wifi: mac80211: fix NULL deref in mesh_matches_local() (CVE-2026-23396)
    - wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough
      headroom
    - ACPI: processor: Fix previous acpi_processor_errata_piix4() fix
    - net: macb: fix uninitialized rx_fs_lock
    - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle
    - net/mlx5e: Prevent concurrent access to IPSec ASO context
    - net/mlx5e: Fix race condition during IPSec ESN update
    - udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n
    - net: bonding: fix NULL deref in bond_debug_rlb_hash_show
    - netfilter: bpf: defer hook memory release until rcu readers are done
    - netfilter: nf_tables: release flowtable after rcu grace period on error
      (CVE-2026-23392)
    - nfnetlink_osf: validate individual option lengths in fingerprints
      (CVE-2026-23397)
    - [arm64,armhf] net: mvpp2: guard flow control update with global_tx_fc in
      buffer switching
    - [armhf] net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error
      paths
    - icmp: fix NULL pointer dereference in icmp_tag_validation()
      (CVE-2026-23398)
    - hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return
      value
    - hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit()
    - [amd64] drm/i915/psr: Compute PSR entry_setup_frames into intel_crtc_state
    - USB: serial: f81232: fix incomplete serial port generation
    - i2c: cp2615: fix serial string NULL-deref at probe
    - i2c: fsi: Fix a potential leak in fsi_i2c_probe()
    - i2c: pxa: defer reset on Armada 3700 when recovery is used
    - ring-buffer: Fix to update per-subbuf entries of persistent ring buffer
    - [amd64] x86/platform/uv: Handle deconfigured sockets
    - mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D mode
    - mtd: spi-nor: core: avoid odd length/address writes in 8D-8D-8D mode
    - mm: shmem: fix potential data corruption during shmem swapin
    - mm: shmem: avoid unpaired folio_unlock() in shmem_swapin_folio()
    - mm/shmem, swap: improve cached mTHP handling and fix potential hang
    - mm/shmem, swap: avoid redundant Xarray lookup during swapin
    - mtd: rawnand: serialize lock/unlock against other NAND operations
    - mtd: rawnand: brcmnand: skip DMA during panic write
    - drm/amd/display: Fix DisplayID not-found handling in
      parse_edid_displayid_vrr()
    - drm/amd: fix dcn 2.01 check
    - ksmbd: fix use-after-free of share_conf in compound request
    - ksmbd: fix use-after-free in durable v2 replay of active file handles
    - [amd64] drm/i915/gt: Check set_default_submission() before deferencing
    - lib/bootconfig: check xbc_init_node() return in override path
    - tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure
    - hwmon: (max6639) Fix pulses-per-revolution implementation
    - [amd64] perf/x86/intel: Add missing branch counters constraint apply
    - xen/privcmd: restrict usage in unprivileged domU (CVE-2026-31788)
    - xen/privcmd: add boot control for restricted usage in domU
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.79
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.80
    - cxl/port: Fix use after free of parent_port in cxl_detach_ep()
    - bpf: Fix constant blinding for PROBE_MEM32 stores (CVE-2026-23417)
      (Closes: #1132622)
    - perf: Make sure to use pmu_ctx->pmu for groups
    - cxl/hdm: Avoid incorrect DVSEC fallback when HDM decoders are enabled
    - hwmon: axi-fan: don't use driver_override as IRQ name
    - driver core: generalize driver_override in struct device
    - driver core: platform: use generic driver_override infrastructure
    - bpf: Release module BTF IDR before module unload
    - bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN
    - bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR
    - HID: asus: avoid memory leak in asus_report_fixup()
    - [amd64] platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to
      dmi_vgbs_allow_list
    - nvme-pci: cap queue creation to used queues
    - nvme-fabrics: use kfree_sensitive() for DHCHAP secrets
    - [amd64] platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold
      16 Gen 1
    - [amd64] platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix
      touchscreen on SUPI S10
    - nvme-pci: ensure we're polling a polled queue
    - HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2
    - HID: magicmouse: avoid memory leak in magicmouse_report_fixup()
    - HID: apple: Add EPOMAKER TH87 to the non-apple keyboards list
    - net: usb: r8152: add TRENDnet TUC-ET2G
    - kbuild: install-extmod-build: Package resolve_btfids if necessary
    - HID: mcp2221: cancel last I2C command on read error
    - HID: asus: add xg mobile 2023 external hardware support
    - module: Fix kernel panic when a symbol st_shndx is out of bounds
    - scsi: mpi3mr: Clear reset history on ready and recheck state after timeout
    - scsi: devinfo: Add BLIST_SKIP_IO_HINTS for Iomega ZIP
    - dma-buf: Include ioctl.h in UAPI header
    - ALSA: hda/senary: Ensure EAPD is enabled during init
    - HID: apple: avoid memory leak in apple_report_fixup()
    - sched_ext: Use WRITE_ONCE() for the write side of dsq->seq update
    - btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create
    - ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk
    - ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390
    - objtool: Handle Clang RSP musical chairs
    - nvmet: move async event work off nvmet-wq
    - drm/amdgpu: fix gpu idle power consumption issue for gfx v12
    - usb: core: new quirk to handle devices with zero configurations
    - spi: intel-pci: Add support for Nova Lake mobile SPI flash
    - ALSA: hda/realtek: add quirk for ASUS UM6702RC
    - i3c: master: dw-i3c: Fix missing of_node for virtual I2C adapter
    - xfrm: add missing extack for XFRMA_SA_PCPU in add_acquire and allocspi
    - xfrm: fix the condition on x->pcpu_num in xfrm_sa_len
    - xfrm: call xdo_dev_state_delete during state update
    - xfrm: Fix the usage of skb->sk
    - esp: fix skb leak with espintcp and async crypto
    - xfrm: Fix work re-schedule after cancel in xfrm_nat_keepalive_net_fini()
    - xfrm: prevent policy_hthresh.work from racing with netns teardown
    - af_key: validate families in pfkey_send_migrate()
    - dma: swiotlb: add KMSAN annotations to swiotlb_bounce()
    - erofs: set fileio bio failed in short read case
    - can: statistics: add missing atomic access in hot path
    - Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req
    - Bluetooth: L2CAP: Validate PDU length before reading SDU length in
      l2cap_ecred_data_rcv()
    - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing
      sock_hold
    - Bluetooth: MGMT: Fix dangling pointer on
      mgmt_add_adv_patterns_monitor_complete
    - Bluetooth: hci_ll: Fix firmware leak on error path
    - Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb
    - [arm64] pinctrl: mediatek: common: Fix probe failure for devices without
      EINT
    - ionic: fix persistent MAC address override on PF
    - nfc: nci: fix circular locking dependency in nci_close_device
    - net: openvswitch: Avoid releasing netdev before teardown completes
    - openvswitch: defer tunnel netdev_put to RCU release
    - openvswitch: validate MPLS set/set_masked payload length
    - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe
      buffer
    - rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size
    - net: bcm: asp2: fix LPI timer handling
    - net: bcm: asp2: remove tx_lpi_enabled
    - net: bcm: asp2: convert to phylib managed EEE
    - net: bcmasp: Remove support for asp-v2.0
    - net: bcmasp: streamline early exit in probe
    - net: bcmasp: fix double free of WoL irq
    - net: bcmasp: Add support for asp-v3.0
    - net: bcmasp: fix double disable of clk
    - [armhf] platform/olpc: olpc-xo175-ec: Fix overflow error message to print
      inlen
    - [amd64] platform/x86: intel-hid: disable wakeup_mode during hibernation
    - ice: fix inverted ready check for VF representors
    - ice: use ice_update_eth_stats() for representor stats
    - iavf: fix out-of-bounds writes in iavf_get_ethtool_stats()
    - ipv6: Remove permanent routes from tb6_gc_hlist when all exceptions
      expire.
    - ipv6: Don't remove permanent routes with exceptions from tb6_gc_hlist.
    - net: fix fanout UAF in packet_release() via NETDEV_UP race
    - tcp: optimize inet_use_bhash2_on_bind()
    - udp: Fix wildcard bind conflict check when using hash2
    - net: enetc: fix the output issue of 'ethtool --show-ring'
    - team: fix header_ops type confusion with non-Ethernet ports
    - net: lan743x: fix duplex configuration in mac_link_up
    - dma-mapping: add missing `inline` for `dma_free_attrs`
    - Bluetooth: L2CAP: Fix send LE flow credits in ACL link
    - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock
    - Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop
    - Bluetooth: btusb: clamp SCO altsetting table indices
    - tls: Purge async_hold in tls_decrypt_async_wait() (CVE-2026-23414)
    - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD
    - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()
    - netfilter: nf_conntrack_expect: skip expectations in other netns via proc
    - netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in
      process_sdp
    - netfilter: ctnetlink: use netlink policy range checks
    - net: macb: use the current queue number for stats
    - regmap: Synchronize cache for the page selector
    - ALSA: hda/realtek: Sequence GPIO2 on Star Labs StarFighter
    - RDMA/rw: Fall back to direct SGE on MR pool exhaustion
    - RDMA/irdma: Initialize free_qp completion before using it
    - RDMA/irdma: Update ibqp state to error if QP is already in error state
    - RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce()
    - RDMA/irdma: Clean up unnecessary dereference of event->cm_node
    - RDMA/irdma: Remove reset check from irdma_modify_qp_to_err()
    - RDMA/irdma: Fix deadlock during netdev reset with active connections
    - RDMA/irdma: Return EINVAL for invalid arp index error
    - scsi: scsi_transport_sas: Fix the maximum channel scanning issue
    - [amd64] x86/efi: efi_unmap_boot_services: fix calculation of
      ranges_to_free size
    - [amd64] drm/i915/gmbus: fix spurious timeout on 512-byte burst reads
    - PM: hibernate: Drain trailing zero pages on userspace restore
    - spi: sn-f-ospi: Fix resource leak in f_ospi_probe()
    - [amd64] ASoC: Intel: catpt: Fix the device initialization
    - [arm64,armhf] spi: meson-spicc: Fix double-put in remove path
    - drm/amd/display: Do not skip unrelated mode changes in DSC validation
    - spi: Group CS related fields in struct spi_device
    - spi: use generic driver_override infrastructure
    - ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()
    - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib
    - hwmon: (adm1177) fix sysfs ABI violation and current unit conversion
    - hwmon: (pmbus/core) Fix various coding style issues
    - hwmon: (pmbus) Mark lowest/average/highest/rated attributes as read-only
    - hwmon: (pmbus) Introduce the concept of "write-only" attributes
    - sysctl: fix uninitialized variable in proc_do_large_bitmap
    - [s390x] syscalls: Add spectre boundary for syscall dispatch table
    - [s390x] barrier: Make array_index_mask_nospec() __always_inline
    - [s390x] entry: Scrub r12 register on kernel entry
    - ksmbd: replace hardcoded hdr2_len with offsetof() in
      smb2_calc_max_out_buf_len()
    - ksmbd: fix potencial OOB in get_file_all_info() for compound requests
    - ksmbd: fix memory leaks and NULL deref in smb2_lock()
    - ksmbd: do not expire session on binding failure
    - ALSA: firewire-lib: fix uninitialized local variable
    - [amd64] ASoC: SOF: ipc4-topology: Allow bytes controls without initial
      payload
    - can: gw: fix OOB heap access in cgw_csum_crc8_rel()
    - can: isotp: fix tx.buf use-after-free in isotp_sendmsg()
    - cpufreq: conservative: Reset requested_freq on limits change
    - [amd64] platform/x86: ISST: Correct locked bit width
    - [arm64] KVM: arm64: Discard PC update state on vcpu reset
    - hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs
      attributes
    - hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute
      temperature
    - hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible()
    - media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex
    - virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and
      napi_tx is false
    - erofs: add GFP_NOIO in the bio completion if needed
    - alarmtimer: Fix argument order in alarm_timer_forward()
    - [amd64] x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling()
    - [amd64] x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask
    - [arm64] phy: qcom: qmp-ufs: Fix SM8650 PCS table for Gear 4
    - ovl: fix wrong detection of 32bit inode numbers
    - scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done()
    - scsi: ses: Handle positive SCSI error from ses_recv_diag()
    - net: macb: Move devm_{free,request}_irq() out of spin lock area
    - net: macb: Protect access to net_device::ip_ptr with RCU lock
    - net: macb: Use dev_consume_skb_any() to free TX SKBs
    - [amd64] KVM: x86/mmu: Drop/zap existing present SPTE even when creating an
      MMIO SPTE (CVE-2026-23401)
    - jbd2: gracefully abort on checkpointing state corruptions
    - [arm64] irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment
    - futex: Clear stale exiting pointer in futex_lock_pi() retry path
    - dmaengine: fsl-edma: fix channel parameter config for fixed channel
      requests
    - dmaengine: sh: rz-dmac: Protect the driver specific lists
    - dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock
    - drm/amdgpu: prevent immediate PASID reuse case
    - [amd64] drm/i915/dp_tunnel: Fix error handling when clearing stream BW in
      atomic state
    - xfs: stop reclaim before pushing AIL during unmount
    - xfs: save ailp before dropping the AIL lock in push callbacks
    - xfs: scrub: unlock dquot before early return in quota scrub
    - xfs: fix ri_total validation in xlog_recover_attri_commit_pass2
    - xfs: don't irele after failing to iget in xfs_attri_recover_work
    - xfs: remove file_path tracepoint data
    - ext4: fix journal credit check when setting fscrypt context
    - ext4: convert inline data to extents when truncate exceeds inline size
    - ext4: fix stale xarray tags after writeback
    - ext4: fix fsync(2) for nojournal mode
    - ext4: make recently_deleted() properly work with lazy itable
      initialization
    - ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio
    - ext4: validate p_idx bounds in ext4_ext_correct_indexes
    - ext4: avoid infinite loops caused by residual data
    - ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()
    - ext4: reject mount if bigalloc with s_first_data_block != 0
    - ext4: fix use-after-free in update_super_work when racing with umount
    - ext4: fix the might_sleep() warnings in kvfree()
    - ext4: handle wraparound when searching for blocks for indirect mapped
      blocks
    - ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths
    - ext4: always drain queued discard work in ext4_mb_release()
    - [arm64] dts: imx8mn-tqma8mqnl: fix LDO5 power off
    - [powerpc*] powerpc64/bpf: do not increment tailcall count when prog is
      NULL
    - ksmbd: fix use-after-free and NULL deref in smb_grant_oplock()
    - tracing: Switch trace_osnoise.c code over to use guard() and __free()
    - tracing: Fix potential deadlock in cpu hotplug with osnoise
    - drm/xe: always keep track of remap prev/next
    - mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0]
    - ovl: Use str_on_off() helper in ovl_show_options()
    - ovl: make fsync after metadata copy-up opt-in mount option
    - xfs: avoid dereferencing log items after push callbacks
    - virt: tdx-guest: Fix handling of host controlled 'quote' buffer length
    - net: add proper RCU protection to /proc/net/ptype (CVE-2026-23255)
    - landlock: Optimize file path walks and prepare for audit support
    - landlock: Fix handling of disconnected directories (CVE-2025-68736)
    - ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw()
      (CVE-2025-22117)
    - ice: Fix PTP NULL pointer dereference during VSI rebuild (CVE-2026-23210)
    - [amd64,arm64] idpf: check error for register_netdev() on init
    - [amd64,arm64] idpf: detach and close netdevs while handling a reset
      (CVE-2026-22981)
    - [amd64,arm64] idpf: Fix RSS LUT NULL pointer crash on early ethtool
      operations (CVE-2026-22985)
    - [amd64,arm64] idpf: Fix RSS LUT NULL ptr issue after soft reset
      (CVE-2026-22993)
    - [amd64] dmaengine: idxd: Fix not releasing workqueue on .release()
    - [amd64] dmaengine: idxd: Fix memory leak when a wq is reset
    - [amd64] dmaengine: idxd: Fix freeing the allocated ida too late
    - phy: ti: j721e-wiz: Fix device node reference leak in
      wiz_get_lane_phy_types()
    - dmaengine: dw-edma: Fix multiple times setting of the CYCLE_STATE and
      CYCLE_BIT bits for HDMA.
    - netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators
    - [amd64] dmaengine: idxd: fix possible wrong descriptor completion in
      llist_abort_desc()
    - btrfs: fix super block offset in error message in btrfs_validate_super()
    - btrfs: fix leak of kobject name for sub-group space_info
    - btrfs: fix lost error when running device stats on multiple devices fs
    - xen/privcmd: unregister xenstore notifier on module exit
    - futex: Require sys_futex_requeue() to have identical flags
    - [amd64] dmaengine: idxd: Fix leaking event log memory
    - net: bcmasp: Restore programming of TX map vector register
    - net: bcmasp: Fix network filter wake for asp-3.0
    - [amd64,arm64] idpf: nullify pointers after they are freed
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.81
    - io_uring/kbuf: remove legacy kbuf bulk allocation
    - io_uring/kbuf: remove legacy kbuf kmem cache
    - io_uring/kbuf: simplify __io_put_kbuf
    - io_uring/kbuf: remove legacy kbuf caching
    - io_uring/kbuf: open code __io_put_kbuf()
    - io_uring/kbuf: introduce io_kbuf_drop_legacy()
    - io_uring/kbuf: uninline __io_put_kbufs
    - io_uring/kbuf: drop 'issue_flags' from io_put_kbuf(s)() arguments
    - io_uring/net: don't use io_net_kbuf_recyle() for non-provided cases
    - io_uring/net: clarify io_recv_buf_select() return value
    - io_uring/kbuf: pass in struct io_buffer_list to commit/recycle helpers
    - io_uring/kbuf: introduce struct io_br_sel
    - io_uring/kbuf: use struct io_br_sel for multiple buffers picking
    - io_uring/net: use struct io_br_sel->val as the recv finish value
    - io_uring/net: use struct io_br_sel->val as the send finish value
    - io_uring/kbuf: switch to storing struct io_buffer_list locally
    - io_uring: remove async/poll related provided buffer recycles
    - io_uring/net: correct type for min_not_zero() cast
    - io_uring/rw: check for NULL io_br_sel when putting a buffer
    - io_uring/kbuf: enable bundles for incrementally consumed buffers
    - io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths
    - io_uring/kbuf: use READ_ONCE() for userspace-mapped memory
    - io_uring/kbuf: use WRITE_ONCE() for userspace-shared buffer ring fields
    - io_uring/kbuf: fix missing BUF_MORE for incremental buffers at EOF
    - io_uring/kbuf: propagate BUF_MORE through early buffer commit path
    - HID: logitech-hidpp: Enable MX Master 4 over bluetooth
    - wifi: mac80211: check tdls flag in ieee80211_tdls_oper
    - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq
    - atm: lec: fix use-after-free in sock_def_readable()
    - btrfs: don't take device_list_mutex when querying zone info
    - tg3: replace placeholder MAC address with device property
    - HID: logitech-hidpp: Prevent use-after-free on force feedback
      initialisation failure
    - HID: multitouch: Check to ensure report responses match the request
    - btrfs: reserve enough transaction items for qgroup ioctls
    - [arm64,armhf] i2c: tegra: Don't mark devices with pins as IRQ safe
    - btrfs: reject root items with drop_progress and zero drop_level
    - [arm64] spi: geni-qcom: Check DMA interrupts early in ISR
    - dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common
      property warning
    - wifi: ath11k: Pass the correct value of each TID during a stop AMPDU
      session
    - [arm64,armhf] crypto: caam - fix DMA corruption on long hmac keys
    - [arm64,armhf] crypto: caam - fix overflow on long hmac keys
    - crypto: af-alg - fix NULL pointer dereference in scatterwalk
    - [arm64,armhf] net: fec: fix the PTP periodic output sysfs interface
    - net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak
    - net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields
      to zero to prevent an info-leak
    - net/ipv6: ioam6: prevent schema length wraparound in trace fill
    - tg3: Fix race for querying speed/duplex
    - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()
    - ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
    - bridge: br_nd_send: linearize skb before parsing ND options
    - net/sched: sch_hfsc: fix divide-by-zero in rtsc_min()
    - net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta
    - [arm64] net: enetc: check whether the RSS algorithm is Toeplitz
    - ipv6: prevent possible UaF in addrconf_permanent_addr()
    - net: airoha: Add missing cleanup bits in airoha_qdma_cleanup_rx_queue()
    - net: introduce mangleid_features
    - net: use skb_header_pointer() for TCPv4 GSO frag_off check
    - net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero
      to prevent an info-leak
    - NFC: pn533: bound the UART receive buffer
    - ASoC: Intel: boards: fix unmet dependency on PINCTRL
    - bpf: Fix regsafe() for pointers to packet
    - net: ipv6: flowlabel: defer exclusive option free until RCU teardown
    - netfilter: flowtable: strictly check for maximum number of actions
    - netfilter: nfnetlink_log: account for netlink header size
    - netfilter: x_tables: ensure names are nul-terminated
    - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr
    - netfilter: nf_conntrack_helper: pass helper to expect cleanup
    - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent
    - netfilter: nf_conntrack_expect: honor expectation helper field
    - netfilter: nf_conntrack_expect: use expect->helper
    - netfilter: nf_conntrack_expect: store netns and zone in expectation
    - netfilter: ctnetlink: ignore explicit helper on new expectations
    - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions
      for NFPROTO_ARP
    - netfilter: nf_tables: reject immediate NF_QUEUE verdict
    - Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate
    - Bluetooth: SCO: fix race conditions in sco_sock_connect()
    - Bluetooth: MGMT: validate LTK enc_size on load
    - Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync
    - Bluetooth: hci_event: fix potential UAF in
      hci_le_remote_conn_param_req_evt
    - Bluetooth: MGMT: validate mesh send advertising payload length
    - rds: ib: reject FRMR registration before IB connection is established
    - bpf: sockmap: Fix use-after-free of sk->sk_socket in
      sk_psock_verdict_data_ready().
    - net/sched: sch_netem: fix out-of-bounds access in packet corruption
    - net: macb: fix clk handling on PCI glue driver removal
    - net: macb: properly unregister fixed rate clocks
    - net/mlx5: lag: Check for LAG device before creating debugfs
    - net/mlx5: Avoid "No data available" when FW version queries fail
    - net/mlx5: Fix switchdev mode rollback in case of failure
    - bnxt_en: Restore default stat ctxs for ULP when resource is available
    - net/x25: Fix potential double free of skb
    - net/x25: Fix overflow when accumulating packets
    - net/sched: cls_fw: fix NULL pointer dereference on shared blocks
    - net/sched: cls_flow: fix NULL pointer dereference on shared blocks
    - net: hsr: fix VLAN add unwind on slave errors
    - ipv6: avoid overflows in ip6_datagram_send_ctl()
    - bpf: reject direct access to nullable PTR_TO_BUF pointers
    - Revert "drm: Fix use-after-free on framebuffers and property blobs when
      calling drm_dev_unplug"
    - iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one
    - hwmon: (pxe1610) Check return value of page-select write in probe
    - hwmon: (ltc4286) Add missing MODULE_IMPORT_NS("PMBUS")
    - dt-bindings: gpio: fix microchip #interrupt-cells
    - hwmon: (tps53679) Fix device ID comparison and printing in
      tps53676_identify()
    - [armhf] hwmon: (occ) Fix missing newline in occ_show_extended()
    - sched/fair: Use protect_slice() instead of direct comparison
    - sched/fair: Fix zero_vruntime tracking fix
    - [amd64,arm64] drm/ioc32: stop speculation on the drm_compat_ioctl path
    - wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation
    - wifi: iwlwifi: mvm: fix potential out-of-bounds read in
      iwl_mvm_nd_match_info_handler()
    - USB: serial: option: add MeiG Smart SRM825WN
    - ALSA: caiaq: fix stack out-of-bounds read in init_card
    - ALSA: ctxfi: Fix missing SPDIFI1 index handling
    - io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs()
    - Bluetooth: SMP: derive legacy responder STK authentication from MITM state
    - Bluetooth: SMP: force responder MITM requirements before building the
      pairing response
    - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync
    - ksmbd: fix OOB write in QUERY_INFO for compound requests
    - [armhf] hwmon: (occ) Fix division by zero in occ_show_power_1()
    - drm/amdgpu: fix the idr allocation flags
    - iio: adc: ti-adc161s626: fix buffer read on big-endian
    - iio: adc: ti-adc161s626: use DMA-safe memory for spi_read()
    - drm/ast: dp501: Fix initialization of SCU2C
    - [amd64] drm/i915/dsi: Don't do DSC horizontal timing adjustments in
      command mode
    - [amd64] drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw
      CPU eDP
    - drm/amdgpu: Change AMDGPU_VA_RESERVED_TRAP_SIZE to 64KB
    - drm/amdgpu/pm: drop SMU driver if version not matched messages
    - USB: serial: io_edgeport: add support for Blackbox IC135A
    - USB: serial: option: add support for Rolling Wireless RW135R-GL
    - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam
    - Input: synaptics-rmi4 - fix a locking bug in an error path
    - Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk
      table
    - Input: bcm5974 - recover from failed mode switch
    - Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode
    - Input: xpad - add support for Razer Wolverine V3 Pro
    - iio: adc: aspeed: clear reference voltage bits before configuring vref
    - iio: accel: fix ADXL355 temperature signature value
    - iio: accel: adxl380: fix FIFO watermark bit 8 always written as 0
    - iio: dac: ad5770r: fix error return in ad5770r_read_raw()
    - iio: light: vcnl4035: fix scan buffer on big-endian
    - iio: imu: bmi160: Remove potential undefined behavior in
      bmi160_config_pin()
    - iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only
    - iio: gyro: mpu3050: Fix incorrect free_irq() variable
    - iio: gyro: mpu3050: Fix irq resource leak
    - iio: gyro: mpu3050: Move iio_device_register() to correct location
    - iio: gyro: mpu3050: Fix out-of-sequence free_irq()
    - usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive
    - usb: ulpi: fix double free in ulpi_register_interface() error path
    - usb: usbtmc: Flush anchored URBs in usbtmc_release
    - usb: ehci-brcm: fix sleep during atomic
    - usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop()
    - usb: core: phy: avoid double use of 'usb3-phy'
    - usb: cdns3: gadget: fix NULL pointer dereference in ep_queue
    - usb: cdns3: gadget: fix state inconsistency on gadget init failure
    - bridge: br_nd_send: validate ND option lengths
    - cdc-acm: new quirk for EPSON HMD
    - [amd64] comedi: Reinit dev->spinlock between attachments to low-level
      drivers
    - [amd64] comedi: me_daq: Fix potential overrun of firmware buffer
    - [amd64] comedi: me4000: Fix potential overrun of firmware buffer
    - [riscv64] firmware: microchip: fail auto-update probe if no flash found
    - dt-bindings: connector: add pd-disable dependency
    - nvmem: imx: assign nvmem_cell_info::raw_len
    - nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy
    - netfilter: ipset: drop logically empty buckets in mtype_del
    - vxlan: validate ND option lengths in vxlan_na_create
    - net: ftgmac100: fix ring allocation unwind on open failure
    - [arm64] net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled
    - cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error
      path
    - gpio: mxc: map Both Edge pad wakeup to Rising Edge
    - thermal: core: Fix thermal zone device registration error path
    - misc: fastrpc: possible double-free of cctx->remote_heap
    - [amd64] thunderbolt: Fix property read in nhi_wake_supported()
    - USB: dummy-hcd: Fix locking/synchronization error
    - USB: dummy-hcd: Fix interrupt synchronization error
    - usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows
      partial transfer
    - usb: typec: ucsi: validate connector number in ucsi_notify_common()
    - ice: Fix memory leak in ice_set_ringparam() (CVE-2026-23389)
    - btrfs: fix the qgroup data free range for inline data extents
    - btrfs: do not free data reservation in fallback from inline due to -ENOSPC
      (CVE-2025-71269)
    - usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop
    - usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo
    - usb: gadget: uvc: fix NULL pointer dereference during unbind race
    - usb: gadget: f_subset: Fix unbalanced refcnt in geth_free
    - usb: gadget: f_rndis: Protect RNDIS options with mutex
    - usb: gadget: f_ecm: Fix net_device lifecycle with device_move
    - usb: gadget: f_eem: Fix net_device lifecycle with device_move
    - usb: gadget: f_subset: Fix net_device lifecycle with device_move
    - usb: gadget: f_rndis: Fix net_device lifecycle with device_move
    - usb: gadget: f_hid: move list and spinlock inits from bind to alloc
    - usb: gadget: f_uac1_legacy: validate control request size
    - wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free
    - spi: cadence-qspi: Fix exec_mem_op error handling
    - net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback
    - [amd64,arm64] net: mana: fix use-after-free in add_adev() error path
    - scsi: target: tcm_loop: Drain commands in target_reset handler
    - [amd64] x86/fred: Fix early boot failures on SEV-ES/SNP guests
    - mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
    - mm: replace READ_ONCE() with standard page table accessors
    - mm/memory: fix PMD/PUD checks in follow_pfnmap_start()
    - drm/amd/pm: disable OD_FAN_CURVE if temp or pwm range invalid for smu v13
    - ext4: publish jinode after initialization
    - [s390x] perf_cpum_sf: Convert to use try_cmpxchg128()
    - [s390x] cpum_sf: Cap sampling rate to prevent lsctl exception
    - MPTCP: fix lock class name family in pm_nl_create_listen_socket
    - [amd64] x86/CPU/AMD: Add additional fixed RDSEED microcode revisions
    - drm/amd/amdgpu: decouple ASPM with pcie dpm
    - drm/amd/amdgpu: disable ASPM in some situations
    - drm/amd/display: Disable fastboot on DCE 6 too
    - drm/amd/display: Keep PLL0 running on DCE 6.0 and 6.4
    - drm/amd/display: Fix DCE 6.0 and 6.4 PLL programming.
    - drm/amd/display: Adjust DCE 8-10 clock, don't overclock by 15%
    - drm/amd/display: Disable scaling on DCE6 for now
    - drm/amd: Disable ASPM on SI
    - drm/amd/display: Correct logic check error for fastboot
    - bpf: Improve bounds when s64 crosses sign boundary
    - bpf: Add third round of bounds deduction
    - bpf: Fix u32/s32 bounds when ranges cross min/max boundary
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.82
    - lib/crypto: chacha: Zeroize permuted_state before it leaves scope
    - usb: typec: ucsi: skip connector validation before init
    - wifi: rt2x00usb: fix devres lifetime
    - xfrm_user: fix info leak in build_report()
    - net: rfkill: prevent unlimited numbers of rfkill events from being created
    - mptcp: fix slab-use-after-free in __inet_lookup_established
    - seg6: separate dst_cache for input and output paths in seg6 lwtunnel
    - Input: uinput - fix circular locking dependency with ff-core
    - Input: uinput - take event lock when submitting FF request "event"
    - ASoC: simple-card-utils: Don't use __free(device_node) at
      graph_util_parse_dai()
    - btrfs: make wait_on_extent_buffer_writeback() static inline
    - btrfs: remove unused define WAIT_PAGE_LOCK for extent io
    - btrfs: split waiting from read_extent_buffer_pages(), drop parameter wait
    - btrfs: remove unused flag EXTENT_BUFFER_READAHEAD
    - btrfs: remove unused flag EXTENT_BUFFER_CORRUPT
    - btrfs: remove pointless out labels from extent-tree.c
    - btrfs: fix incorrect return value after changing leaf in
      lookup_extent_data_ref()
    - blktrace: fix __this_cpu_read/write in preemptible context
    - nfc: nci: complete pending data exchange on device close
    - misc: fastrpc: check qcom_scm_assign_mem() return in rpmsg_probe
    - Revert "mptcp: add needs_id for netlink appending addr"
    - net: annotate data-races around sk->sk_{data_ready,write_space}
    - netfilter: nft_ct: fix use-after-free in timeout object destroy
    - workqueue: Add pool_workqueue to pending_pwqs list when unplugging
      multiple inactive works
    - xfrm: clear trailing padding in build_polexpire()
    - tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG
    - wifi: brcmsmac: Fix dma_free_coherent() size
    - [amd64] platform/x86/intel-uncore-freq: Handle autonomous UFS status bit
    - [arm64] Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower"
    - [arm64] dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V
    - [arm64] dts: hisilicon: poplar: Correct PCIe reset GPIO polarity
    - [arm64] dts: hisilicon: hi3798cv200: Add missing dma-ranges
    - nfc: pn533: allocate rx skb before consuming bytes
    - batman-adv: reject oversized global TT response buffers
    - X.509: Fix out-of-bounds access when parsing extensions
    - [amd64,arm64] EDAC/mc: Fix error path ordering in edac_mc_alloc()
    - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption
    - batman-adv: hold claim backbone gateways by reference
    - [amd64] drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat
    - [amd64] drm/i915/psr: Do not use pipe_src as borders for SU area
    - net/mlx5: Update the list of the PCI supported devices
    - pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled
    - mmc: vub300: fix NULL-deref on disconnect
    - net: qualcomm: qca_uart: report the consumed byte on RX skb allocation
      failure
    - net: stmmac: fix integer underflow in chain mode
    - mm: filemap: fix nr_pages calculation overflow in filemap_map_pages()
    - [amd64,arm64] idpf: improve locking around idpf_vc_xn_push_free()
    - [amd64,arm64] idpf: set the payload size before calling the async handler
    - rxrpc: Fix anonymous key handling
    - rxrpc: Fix call removal to use RCU safe deletion
    - rxrpc: Fix key reference count leak from call->key
    - rxrpc: Only put the call ref if one was acquired
    - rxrpc: reject undecryptable rxkad response tickets
    - rxrpc: fix reference count leak in rxrpc_server_keyring()
    - rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING)
    - rxrpc: Fix missing error checks for rxkad encryption/decryption failure
    - net: skb: fix cross-cache free of KFENCE-allocated skb head
    - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6
    - [amd64] x86/CPU: Fix FPDSS on Zen1 (CVE-2026-31628)
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.83
    - RDMA/irdma: Fix double free related to rereg_user_mr
    - [amd64] ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA
    - ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk
    - ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC
    - [arm64,armhf] media: rkvdec: reduce stack usage in
      rkvdec_init_v4l2_vp9_count_tbl()
    - ALSA: asihpi: avoid write overflow check warning
    - Bluetooth: hci_sync: annotate data-races around hdev->req_status
    - [amd64] ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF
    - [amd64,arm64] ASoC: SOF: topology: reject invalid vendor array size in
      token parser
    - can: mcp251x: add error handling for power enable in open and resume
    - [amd64] platform/x86: asus-nb-wmi: add DMI quirk for ASUS ROG Flow Z13-KJP
      GZ302EAC
    - btrfs: tracepoints: get correct superblock from dentry in event
      btrfs_sync_file()
    - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx
    - drm/amdgpu: Handle GPU page faults correctly on non-4K page systems
    - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry
    - ALSA: hda/realtek: add quirk for Framework F111:000F
    - wifi: wl1251: validate packet IDs before indexing tx_frames
    - ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list
    - ALSA: hda/realtek: Add quirk for Samsung Book2 Pro 360 (NP950QED)
    - ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex
    - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath
    - [amd64] ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx
    - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IMH9
    - [amd64] pinctrl: intel: Fix the revision for new features (1kOhm PD, HW
      debouncer)
    - [amd64] platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug
    - HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3
    - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10
    - HID: roccat: fix use-after-free in roccat_report_event
    - ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585
    - wifi: brcmfmac: validate bsscfg indices in IF events
    - net: sfp: add quirks for Hisense and HSGQ GPON ONT SFP modules
    - [armhf] ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J
    - [armhf] soc: aspeed: socinfo: Mask table entries for accurate SoC ID
      matching
    - [arm64] dts: qcom: hamoa/x1: fix idle exit latency
    - [arm64] dts: imx8mq: Set the correct gpu_ahb clock frequency
    - [arm64] dts: imx93-9x9-qsb: change usdhc tuning step for eMMC and SD
    - [arm64] dts: imx93-tqma9352: improve eMMC pad configuration
    - [arm64] soc: qcom: pd-mapper: Fix element length in servreg_loc_pfr_req_ei
    - tools/power/turbostat: Fix microcode patch level output for AMD/Hygon
    - PCI: hv: Set default NUMA node to 0 for devices without affinity info
    - HID: amd_sfh: don't log error when device discovery fails with -EOPNOTSUPP
    - xfrm: account XFRMA_IF_ID in aevent size calculation
    - [arm*] drm/vc4: Release runtime PM reference after binding V3D
    - [arm*] drm/vc4: Fix memory leak of BO array in hang state
    - [arm*] drm/vc4: Fix a memory leak in hang state error path
    - [arm* drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock
    - eventpoll: defer struct eventpoll free to RCU grace period
    - net: sched: act_csum: validate nested VLAN headers
    - net: lapbether: handle NETDEV_PRE_TYPE_CHANGE
    - ipv4: nexthop: avoid duplicate NHA_HW_STATS_ENABLE on nexthop group dump
    - ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()
      (CVE-2026-31531)
    - ipv4: icmp: fix null-ptr-deref in icmp_build_probe()
    - net: increase IP_TUNNEL_RECURSION_LIMIT to 5
    - nfc: s3fwrn5: allocate rx skb before consuming bytes
    - net: stmmac: Fix PTP ref clock for Tegra234
    - dt-bindings: net: Fix Tegra234 MGBE PTP clock
    - tracing/probe: reject non-closed empty immediate strings
    - ixgbevf: add missing negotiate_features op to Hyper-V ops table
    - e1000: check return value of e1000_read_eeprom
    - xsk: tighten UMEM headroom validation to account for tailroom and min
      frame
    - xsk: respect tailroom for ZC setups
    - xsk: fix XDP_UMEM_SG_FLAG issues
    - xsk: validate MTU against usable frame size on bind
    - xfrm: Wait for RCU readers during policy netns exit
    - xfrm: fix refcount leak in xfrm_migrate_policy_find
    - xfrm_user: fix info leak in build_mapping()
    - ipvs: fix NULL deref in ip_vs_add_service error path
    - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator
    - netfilter: xt_multiport: validate range encoding in checkentry
    - netfilter: ip6t_eui64: reject invalid MAC header for all packets
    - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC ->
      GFP_KERNEL_ACCOUNT allocation
    - netfilter: nfnetlink_queue: make hash table per queue
    - net: txgbe: leave space for null terminators on property_entry
    - af_unix: read UNIX_DIAG_VFS data under unix_state_lock
    - net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+
    - net: ipa: fix event ring index not programmed for IPA v5.0+
    - l2tp: Drop large packets with UDP encap
    - gpio: tegra: fix irq_release_resources calling enable instead of disable
    - crypto: af_alg - limit RX SG extraction by receive buffer budget
    - [amd64] perf/x86/intel/uncore: Skip discovery table for offline dies
    - sched/deadline: Use revised wakeup rule for dl_server
    - crypto: algif_aead - Fix minimum RX size check for decryption
    - netfilter: conntrack: add missing netlink policy validations
      (CVE-2026-31407)
    - Revert "drm/xe/mmio: Avoid double-adjust in 64-bit reads"
    - Revert "drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt"
    - thermal: core: Mark thermal zones as exiting before unregistration
    - thermal: core: Address thermal zone removal races with resume
    - ALSA: usb-audio: Improve Focusrite sample rate filtering
    - [amd64,arm64] idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC
      handling
    - nfc: llcp: add missing return after LLCP_CLOSED checks
    - can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532)
    - i2c: s3c24xx: check the size of the SMBUS message before using it
    - staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify()
    - HID: alps: fix NULL pointer dereference in alps_raw_event()
    - HID: core: clamp report_size in s32ton() to avoid undefined shift
    - net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()
    - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler
    - [arm*] drm/vc4: platform_get_irq_byname() returns an int
    - ALSA: fireworks: bound device-supplied status before string array lookup
    - fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
    - usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb()
    - usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete()
    - usb: gadget: renesas_usb3: validate endpoint index in standard request
      handlers
    - smb: client: fix off-by-8 bounds check in check_wsl_eas()
    - ksmbd: validate EaNameLength in smb2_get_ea()
    - ksmbd: require 3 sub-authorities before reading sub_auth[2]
    - ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc
    - usbip: validate number_of_packets in usbip_pack_ret_submit()
    - usb: storage: Expand range of matched versions for VL817 quirks entry
    - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen
    - usb: gadget: f_hid: don't call cdev_init while cdev in use
    - usb: port: add delay after usb_hub_set_port_power()
    - fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
    - scripts: generate_rust_analyzer.py: avoid FD leak
    - wifi: rtw88: fix device leak on probe failure
    - staging: sm750fb: fix division by zero in ps_to_hz()
    - USB: serial: option: add Telit Cinterion FN990A MBIM composition
    - Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates
      race
    - ALSA: ctxfi: Limit PTP to a single page
    - dcache: Limit the minimal number of bucket to two
    - media: vidtv: fix NULL pointer dereference in
      vidtv_channel_pmt_match_sections
    - ocfs2: fix possible deadlock between unlink and dio_end_io_write
    - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY
    - ocfs2: handle invalid dinode in ocfs2_group_extend
    - PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup
    - [amd64] KVM: SEV: Reject attempts to sync VMSA of an
      already-launched/encrypted vCPU
    - [amd64] KVM: SEV: Disallow LAUNCH_FINISH if vCPUs are actively being
      created
    - [amd64] KVM: SEV: Drop WARN on large size for
      KVM_MEMORY_ENCRYPT_REG_REGION
    - gpiolib: unify two loops initializing GPIO descriptors
    - gpiolib: fix race condition for gdev->srcu (CVE-2026-22986)
    - net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr()
    - kernel: be more careful about dup_mmap() failures and uprobe registering
    - KVM: Remove subtle "struct kvm_stats_desc" pseudo-overlay
    - [amd64] KVM: x86: Use __DECLARE_FLEX_ARRAY() for UAPI structures with VLAs
    - checkpatch: add support for Assisted-by tag
    - [amd64] x86-64: rename misleadingly named '__copy_user_nocache()' function
    - [amd64] x86: rename and clean up __copy_from_user_inatomic_nocache()
    - x86-64/arm64/powerpc: clean up and rename __copy_from_user_flushcache
    - [amd64] KVM: x86: Use scratch field in MMIO fragment to hold small write
      values
    - [arm64] ASoC: qcom: q6apm: move component registration to unmanaged
      version
    - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()
    - media: vidtv: fix nfeeds state corruption on start_streaming failure
    - media: mediatek: vcodec: fix use-after-free in encoder release path
    - media: em28xx: fix use-after-free in em28xx_v4l2_open()
    - hwmon: (powerz) Fix use-after-free on USB disconnect
    - ALSA: 6fire: fix use-after-free on disconnect
    - bcache: fix cached_dev.sb_bio use-after-free and crash
    - media: as102: fix to not free memory after the device is registered in
      as102_usb_probe()
    - nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map
    - media: vidtv: fix pass-by-value structs causing MSAN warnings
    - media: hackrf: fix to not free memory after the device is registered in
      hackrf_probe()
    - ocfs2: add inline inode consistency check to ocfs2_validate_inode_block()
    - ocfs2: validate inline data i_size during inode read
    - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline
    - rxrpc: Fix key quota calculation for multitoken keys
    - PCI: Fix placement of pci_save_state() in pci_bus_add_device()
    - ipv6: add NULL checks for idev in SRv6 paths (CVE-2026-23442)
    - PCI: Revert "Enable ACS after configuring IOMMU for OF platforms"
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.84
    - mm/userfaultfd: fix hugetlb fault mutex hash calculation
    - PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown
    - ima: verify if the segment size has changed
    - ima: do not copy measurement list to kdump kernel
    - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure
    - [arm64] net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU
      registers
    - drm/amdgpu: replace PASID IDR with XArray
    - mm/pagewalk: fix race between concurrent split and refault
    - ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger
    - scripts/dtc: Remove unused dts_version in dtc-lexer.l
    - rxrpc: only handle RESPONSE during service challenge
    - fs/ntfs3: validate rec->used in journal-replay file record check
    - f2fs: fix to avoid memory leak in f2fs_rename()
    - fuse: reject oversized dirents in page cache
    - fuse: Check for large folio with SPLICE_F_MOVE
    - fuse: quiet down complaints in fuse_conn_limit_write
    - ksmbd: require minimum ACE size in smb_check_perm_dacl()
    - smb: server: fix active_num_conn leak on transport allocation failure
    - smb: server: fix max_connections off-by-one in tcp accept path
    - smb: client: require a full NFS mode SID before reading mode bits
    - smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path
    - ksmbd: validate response sizes in ipc_validate_msg()
    - ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl()
    - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment
    - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow
    - f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io()
    - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu
    - ALSA: caiaq: take a reference on the USB device in create_card()
    - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()
    - [amd64] crypto: ccp: Don't attempt to copy CSR to userspace if PSP command
      failed
    - [amd64] crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP
      command failed
    - [amd64] crypto: ccp: Don't attempt to copy ID to userspace if PSP command
      failed
    - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.85
    - crypto: scatterwalk - Backport memcpy_sglist()
    - crypto: algif_aead - use memcpy_sglist() instead of null skcipher
    - crypto: algif_aead - Revert to operating out-of-place (CVE-2026-31431)
    - crypto: algif_aead - snapshot IV for async AEAD requests
    - crypto: authenc - use memcpy_sglist() instead of null skcipher
    - crypto: authencesn - Do not place hiseq at end of dst for out-of-place
      decryption
    - crypto: authencesn - Fix src offset when decrypting in-place
    - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl
    - xen/privcmd: fix double free via VMA splitting (CVE-2026-31787)
    - Buffer overflow in drivers/xen/sys-hypervisor.c (CVE-2026-31786)

-- Salvatore Bonaccorso <carnil@debian.org>  Thu, 30 Apr 2026 13:38:11 +0200

linux (6.12.74-2~bpo12+1) bookworm-backports; urgency=high

* Rebuild for bookworm-backports

-- Ben Hutchings <benh@debian.org>  Fri, 13 Mar 2026 15:32:42 +0100

linux (6.12.74-2) trixie-security; urgency=high

* Refresh patchset to address multiple vulnerabilities in AppArmor

-- Salvatore Bonaccorso <carnil@debian.org>  Sun, 08 Mar 2026 20:54:04 +0100

linux (6.12.74-1) trixie-security; urgency=high

* New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.74
    - scsi: qla2xxx: Fix bsg_done() causing double free
    - bnxt_en: Change FW message timeout warning
    - bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code
    - [arm64] bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs
      show functions
    - [arm64] bus: fsl-mc: fix use-after-free in driver_override_show()
      (CVE-2026-23221)
    - ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU
    - [amd64] ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list
    - ALSA: hda/realtek: Add quirk for Inspur S14-G1
    - ALSA: hda/realtek - fixed speaker no sound
    - romfs: check sb_set_blocksize() return value
    - [arm64,armhf] drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not
      used
    - [amd64] platform/x86: classmate-laptop: Add missing NULL pointer checks
    - [amd64] ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9
    - [amd64] ASoC: amd: yc: Add quirk for HP 200 G2a 16
    - ALSA: hda/realtek: Enable headset mic for Acer Nitro 5
    - [amd64] platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro
    - [amd64] platform/x86: panasonic-laptop: Fix sysfs group leak in error path
    - [amd64] ASoC: cs42l43: Correct handling of 3-pole jack load detection
    - tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow
    - drm/amd/display: extend delta clamping logic to CM3 LUT helper
    - drm/amd/display: remove assert around dpp_base replacement
    - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count
    - mm/hugetlb: fix hugetlb_pmd_shared() (CVE-2026-23100)
    - mm/hugetlb: fix two comments related to huge_pmd_unshare()
    - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using
      mmu_gather
    - Revert "wireguard: device: enable threaded NAPI"
    - cpuset: Fix missing adaptation for cpuset_is_populated
    - fbdev: smscufx: properly copy ioctl memory to kernelspace
    - f2fs: fix to add gc count stat in f2fs_gc_range
    - f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly
    - f2fs: fix out-of-bounds access in sysfs attribute read/write
    - f2fs: fix to avoid mapping wrong physical block for swapfile
    - [arm64] iommu/arm-smmu-qcom: do not register driver in probe()
    - f2fs: fix to avoid UAF in f2fs_write_end_io()
    - f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent
      atomic commit and checkpoint writes
    - USB: serial: option: add Telit FN920C04 RNDIS compositions

[ Simone Weiß ]
  * db-mok: Remove unused function, fixing compilation warning

[ Ben Hutchings ]
  * CI: Delete support for ccache, which was removed from common pipeline
  * CI: Update build job to work after another common pipeline change

[ Salvatore Bonaccorso ]
  * apparmor: validate DFA start states are in bounds in unpack_pdb
  * apparmor: fix memory leak in verify_header
  * apparmor: replace recursive profile removal with iterative approach
  * apparmor: fix side-effect bug in match_char() macro usage
  * apparmor: fix missing bounds check on DEFAULT table in verify_dfa()
  * apparmor: Fix double free of ns_name in aa_replace_profiles()
  * apparmor: unprivileged local user can privilge escalate policy management
  * apparmor: fix differential encoding verification
  * apparmor: fix race on rawdata dereference

-- Salvatore Bonaccorso <carnil@debian.org>  Sun, 01 Mar 2026 13:47:48 +0100

linux (6.12.73-1~bpo12+1) bookworm-backports; urgency=medium

* Rebuild for bookworm-backports

-- Ben Hutchings <benh@debian.org>  Sat, 21 Feb 2026 01:02:57 +0100

linux (6.12.73-1) trixie-security; urgency=high

* New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.70
    - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec
    - [amd64] x86/vmware: Fix hypercall clobbers
    - [amd64] x86/kfence: fix booting on 32bit non-PAE systems
    - [amd64] platform/x86: intel_telemetry: Fix swapped arrays in PSS output
    - ALSA: aloop: Fix racy access at PCM trigger
    - [arm64] pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the
      highest state
    - [arm64] pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system
      wakeup
    - [arm64,armhf] pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong
      adb400 reset
    - [arm64] pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system
      wakeup
    - [arm64] pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains
    - mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single
    - ceph: fix NULL pointer dereference in ceph_mds_auth_match()
      (Closes: #1125405)
    - rbd: check for EOD after exclusive lock is ensured to be held
    - ceph: fix oops due to invalid pointer for kfree() in parse_longname()
    - gve: Fix stats report corruption on queue count change
    - gve: Correct ethtool rx_dropped calculation
    - mm, shmem: prevent infinite loop on truncate race
    - Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem"
    - KVM: Don't clobber irqfd routing type when deassigning irqfd
    - PCI/ERR: Ensure error recoverability at all times
    - ublk: fix deadlock when reading partition table (CVE-2025-68823)
    - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (CVE-2025-40082)
    - [arm*] binder: fix BR_FROZEN_REPLY error log
    - binderfs: fix ida_alloc_max() upper bound
    - procfs: avoid fetching build ID while holding VMA lock
    - tracing: Fix ftrace event field alignments
    - wifi: mac80211: ocb: skip rx_no_sta when interface is not joined
    - wifi: wlcore: ensure skb headroom before skb_push
    - net: usb: sr9700: support devices with virtual driver CD
    - block,bfq: fix aux stat accumulation destination
    - smb/server: call ksmbd_session_rpc_close() on error path in
      create_smb2_pipe()
    - md: suspend array while updating raid_disks via sysfs
    - smb/server: fix refcount leak in smb2_open()
    - smb/server: fix refcount leak in parse_durable_handle_context()
    - [amd64] HID: intel-ish-hid: Update ishtp bus match to support device ID
      table
    - HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL
    - btrfs: fix reservation leak in some error paths when inserting inline
      extent
    - [riscv64] Sanitize syscall table indexing under speculation
    - [amd64] HID: intel-ish-hid: Reset enum_devices_done before enumeration
    - HID: playstation: Center initial joystick axes to prevent spurious events
    - ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55
    - ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk
    - [arm64] PCI: qcom: Remove ASPM L0s support for MSM8996 SoC
    - netfilter: replace -EEXIST with -EBUSY
    - HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list
    - HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report()
    - HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101)
    - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset
    - ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free
    - HID: logitech: add HID++ support for Logitech MX Anywhere 3S
    - wifi: mac80211: collect station statistics earlier when disconnect
    - ASoC: simple-card-utils: Check device node before overwrite direction
    - nvme-fc: release admin tagset if init fails
    - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready()
    - [amd64] ASoC: amd: yc: Fix microphone on ASUS M6500RE
    - regmap: maple: free entry on mas_store_gfp() failure
    - wifi: cfg80211: Fix bitrate calculation overflow for HE rates
    - scsi: target: iscsi: Fix use-after-free in
      iscsit_dec_session_usage_count()
    - ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU
    - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()
    - wifi: mac80211: correctly check if CSA is active
    - wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice
    - btrfs: reject new transactions if the fs is fully read-only
    - ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio
    - [amd64] platform/x86: toshiba_haps: Fix memory leaks in add/remove
      routines
    - [amd64] platform/x86: intel_telemetry: Fix PSS event register mask
    - [amd64] platform/x86: hp-bioscfg: Skip empty attribute names
    - [amd64] platform/x86/intel/tpmi/plr: Make the file domain<n>/status
      writeable
    - smb/client: fix memory leak in smb2_open_file()
    - net: add skb_header_pointer_careful() helper
    - net/sched: cls_u32: use skb_header_pointer_careful()
    - net: liquidio: Initialize netdev pointer before queue setup
    - net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup
    - net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup
    - net: phy: add phy_interface_weight()
    - net: phy: add phy_interface_copy()
    - net: sfp: pre-parse the module support
    - net: sfp: convert sfp quirks to modify struct sfp_module_support
    - net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module
    - macvlan: fix error recovery in macvlan_common_newlink()
    - net: usb: r8152: fix resume reset deadlock
    - net: don't touch dev->stats in BPF redirect paths
    - tipc: use kfree_sensitive() for session key material
    - drm/amd/display: fix wrong color value mapping on MCM shaper LUT
    - net: gro: fix outer network offset
    - [amd64] drm/mgag200: fix mgag200_bmc_stop_scanout()
    - drm/xe/query: Fix topology query pointer advance
    - drm/xe/pm: Also avoid missing outer rpm warning on system suspend
    - drm/xe/pm: Disable D3Cold for BMG only on specific platforms
    - [armhf] hwmon: (occ) Mark occ_init_attribute() as __printf
    - netfilter: nf_tables: fix inverted genmask check in
      nft_map_catchall_activate()
    - ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF
    - ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update()
    - [amd64] ASoC: amd: fix memory leak in acp3x pdm dma ops
    - [arm64] ipi: tegra: Fix a memory leak in tegra_slink_probe()
    - [arm64,armhf] spi: tegra114: Preserve SPI mode bits in def_command1_reg
    - ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU.
    - gpiolib-acpi: Update file references in the Documentation and MAINTAINERS
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.71
    - net: tunnel: make skb_vlan_inet_prepare() return drop reasons
      (Closes: #1127597)
    - io_uring/rw: recycle buffers manually for non-mshot reads
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.72
    - smb: client: split cached_fid bitfields to avoid shared-byte RMW races
    - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error
      paths
    - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection()
    - driver core: enforce device_lock for driver_match_device()
    - Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB
    - [amd64] crypto: iaa - Fix out-of-bounds index in
      find_empty_iaa_compression_mode
    - [armhf] crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists
      correctly
    - crypto: virtio - Add spinlock protection with virtqueue notification
    - crypto: virtio - Remove duplicated virtqueue_kick in
      virtio_crypto_skcipher_crypt_req
    - nilfs2: Fix potential block overflow that cause system hang
    - wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon()
    - scsi: qla2xxx: Validate sp before freeing associated memory
    - scsi: qla2xxx: Allow recovery for tape devices
    - scsi: qla2xxx: Delay module unload while fabric scan in progress
    - scsi: qla2xxx: Free sp in error path to fix system crash
    - scsi: qla2xxx: Query FW again before proceeding with login
    - bus: mhi: host: pci_generic: Add Telit FE990B40 modem support
    - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (CVE-2026-23169)
    - erofs: fix UAF issue for file-backed mounts w/ directio option
    - xfs: fix UAF in xchk_btree_check_block_owner
    - PCI: endpoint: Avoid creating sub-groups asynchronously
    - wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add
    - [armhf] gpio: omap: do not register driver in probe()
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.73
    - Revert "driver core: enforce device_lock for driver_match_device()"

-- Salvatore Bonaccorso <carnil@debian.org>  Tue, 17 Feb 2026 06:47:26 +0100

linux (6.12.69-1~bpo12+1) bookworm-backports; urgency=medium

* Rebuild for bookworm-backports

-- Ben Hutchings <benh@debian.org>  Mon, 09 Feb 2026 22:52:52 +0100

linux (6.12.69-1) trixie-security; urgency=high

* New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.64
    - btrfs: do not skip logging new dentries when logging a new name
    - btrfs: fix a potential path leak in print_data_reloc_error()
    - [arm64] bpf, arm64: Do not audit capability check in do_jit()
    - btrfs: fix memory leak of fs_devices in degraded seed device path
    - shmem: fix recovery on rename failures
    - iomap: adjust read range correctly for non-block-aligned positions
    - iomap: account for unaligned end offsets when truncating read range
    - scripts/faddr2line: Fix "Argument list too long" error
    - [amd64] perf/x86/amd: Check event before enable to avoid GPF
    - sched/deadline: only set free_cpus for online runqueues
    - sched/fair: Revert max_newidle_lb_cost bump
    - [amd64] x86/ptrace: Always inline trivial accessors
    - ACPICA: Avoid walking the Namespace if start_node is NULL
    - ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only
    - cpufreq: dt-platdev: Add JH7110S SOC to the allowlist
    - ACPI: fan: Workaround for 64-bit firmware bug
    - cpuidle: menu: Use residency threshold in polling state override decisions
    - livepatch: Match old_sympos 0 and 1 in klp_find_func()
    - fs/ntfs3: Support timestamps prior to epoch
    - kbuild: Use objtree for module signing key path
    - ntfs: set dummy blocksize to read boot_block when mounting
    - hfsplus: fix volume corruption issue for generic/070
    - hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create
    - hfsplus: Verify inode mode when loading from disk
    - hfsplus: fix volume corruption issue for generic/073
    - fs/ntfs3: check for shutdown in fsync
    - wifi: rtl8xxxu: Fix HT40 channel config for RTL8192CU, RTL8723AU
    - wifi: cfg80211: stop radar detection in cfg80211_leave()
    - wifi: cfg80211: use cfg80211_leave() in iftype change
    - wifi: mt76: mt792x: fix wifi init fail by setting MCU_RUNNING after CLC
      load
    - wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet
    - btrfs: scrub: always update btrfs_scrub_progress::last_physical
    - gfs2: fix remote evict for read-only filesystems
    - gfs2: Fix "gfs2: Switch to wait_event in gfs2_quotad"
    - smb/server: fix return value of smb2_ioctl()
    - ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency
    - ksmbd: vfs: fix race on m_flags in vfs_cache
    - Bluetooth: btusb: Add new VID/PID 2b89/6275 for RTL8761BUV
    - Bluetooth: btusb: MT7922: Add VID/PID 0489/e170
    - Bluetooth: btusb: MT7920: Add VID/PID 0489/e135
    - Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE
    - Bluetooth: btusb: Add new VID/PID 0x0489/0xE12F for RTL8852BE-VT
    - gfs2: Fix use of bio_chain
    - [arm64,armhf] net: fec: ERR007885 Workaround for XDP TX path
    - netrom: Fix memory leak in nr_sendmsg()
    - net/sched: ets: Always remove class from active list before deleting in
      ets_qdisc_change
    - ipvlan: Ignore PACKET_LOOPBACK in handle_mode_l2()
    - bnxt_en: Fix XDP_TX path
    - net: openvswitch: fix middle attribute validation in push_nsh() action
    - broadcom: b44: prevent uninitialized value usage
    - netfilter: nf_conncount: fix leaked ct in error paths
    - ipvs: fix ipv4 null-ptr-deref in route error path
    - net/sched: ets: Remove drr class from the active list if it changes to
      strict
    - nfc: pn533: Fix error code in pn533_acr122_poweron_rdr()
    - netfilter: nf_nat: remove bogus direction check
    - netfilter: nf_tables: remove redundant chain validation on register store
    - ethtool: Avoid overflowing userspace buffer on stats query
    - net/mlx5: fw reset, clear reset requested on drain_fw_reset
    - net/mlx5: Drain firmware reset in shutdown callback
    - net/mlx5: fw_tracer, Validate format string parameters
    - net/mlx5: fw_tracer, Handle escaped percent properly
    - net/mlx5: Serialize firmware reset with devlink
    - net/handshake: duplicate handshake cancellations leak socket
    - [arm64] net: enetc: do not transmit redirected XDP frames when the link is
      down
    - [arm64] net: hns3: using the num_tqps in the vf driver to apply for
      resources
    - [arm64] net: hns3: using the num_tqps to check whether tqp_index is out of
      range when vf get ring info from mbx
    - [arm64] net: hns3: add VLAN id validation before using
    - [amd64] hwmon: (dell-smm) Limit fan multiplier to avoid overflow
    - hwmon: (ibmpex) fix use-after-free in high/low store
    - hwmon: (tmp401) fix overflow caused by default conversion rate value
    - drm/me/gsc: mei interrupt top half should be in irq disabled context
    - drm/xe: Restore engine registers before restarting schedulers after GT
      reset
    - drm/panel: sony-td4353-jdi: Enable prepare_prev_first
    - [amd64] x86/xen: Move Xen upcall handler
    - [amd64] x86/xen: Fix sparse warning in enlighten_pv.c
    - [arm64] kdump: Fix elfcorehdr overlap caused by reserved memory processing
      reorder
    - spi: cadence-quadspi: Fix clock disable on probe failure path
    - block: rnbd-clt: Fix leaked ID in init_dev()
    - drm/xe: Limit num_syncs to prevent oversized allocations
    - drm/xe/oa: Limit num_syncs to prevent oversized allocations
    - ksmbd: skip lock-range check on equal size to avoid size==0 underflow
    - ksmbd: Fix refcount leak when invalid session is found on session lookup
    - ksmbd: fix buffer validation by including null terminator size in EA
      length
    - HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen
    - Input: ti_am335x_tsc - fix off-by-one error in wire_order validation
    - Input: lkkbd - disable pending work before freeing device
    - Input: alps - fix use-after-free bugs caused by dev3_register_work
    - Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table
    - xfs: don't leak a locked dquot when xfs_dquot_attach_buf fails
    - can: gs_usb: gs_can_open(): fix error handling
    - [arm64,armhf] soc/tegra: fuse: Do not register SoC device on ACPI boot
    - ACPI: PCC: Fix race condition by removing static qualifier
    - ACPI: CPPC: Fix missing PCC check for guaranteed_perf
    - [arm64] mmc: sdhci-of-arasan: Increase CD stable timeout to 2 seconds
    - dt-bindings: mmc: sdhci-of-aspeed: Switch ref to sdhci-common.yaml
    - net/hsr: fix NULL pointer dereference in prp_get_untagged_frame()
    - [amd64] x86/fpu: Fix FPU state core dump truncation on CPUs with no
      extended xfeatures
    - ALSA: vxpocket: Fix resource leak in vxpocket_probe error path
    - ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path
    - ALSA: usb-mixer: us16x08: validate meter packet indices
    - nfsd: update percpu_ref to manage references on nfsd_net
    - nfsd: rename nfsd_serv_ prefixed methods and variables with nfsd_net_
    - nfsd: fix memory leak in nfsd_create_serv error paths
    - ipmi: Fix the race between __scan_channels() and deliver_response()
    - ipmi: Fix __scan_channels() failing to rescan channels
    - [arm64,armhf] ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on
      AM33xx
    - scsi: smartpqi: Add support for Hurray Data new controller PCI device
    - [arm64] clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 &
      pcie_x4
    - scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled
    - scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive
    - scsi: qla2xxx: Use reinit_completion on mbx_intr_comp
    - fuse: Always flush the page cache before FOPEN_DIRECT_IO write
    - fuse: Invalidate the page cache after FOPEN_DIRECT_IO write
    - via_wdt: fix critical boot hang due to unnamed resource allocation
    - reset: fix BIT macro reference
    - exfat: fix remount failure in different process environments
    - exfat: zero out post-EOF page cache on file extension
    - usbip: Fix locking bug in RT-enabled kernels
    - usb: typec: ucsi: Handle incorrect num_connectors capability
    - [armhf] iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc
      complains
    - usb: xhci: limit run_graceperiod for only usb 3.0 devices
    - usb: usb-storage: No additional quirks need to be added to the EL-R12
      optical drive.
    - libperf cpumap: Fix perf_cpu_map__max for an empty/NULL map
    - i2c: designware: Disable SMBus interrupts to prevent storms from
      mis-configured firmware
    - nvme-fc: don't hold rport lock when putting ctrl
    - nvme-fabrics: add ENOKEY to no retry criteria for authentication failures
    - [amd64] platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS
      DMI quirks
    - [amd64] scsi: scsi_debug: Fix atomic write enable module param description
    - block: rnbd-clt: Fix signedness bug in init_dev()
    - vhost/vsock: improve RCU read sections around vhost_vsock_get()
    - cifs: Fix memory and information leak in smb3_reconfigure()
    - KEYS: trusted: Fix a memory leak in tpm2_load_cmd
    - io_uring: fix filename leak in __io_openat_prep()
    - [amd64] x86/mce: Do not clear bank's poll bit in mce_poll_banks on AMD
      SMCA systems
    - [arm64] mmc: sdhci-msm: Avoid early clock doubling during HS400 transition
    - perf: arm_cspmu: fix error handling in arm_cspmu_impl_unregister()
    - [amd64] lib/crypto: x86/blake2s: Fix 32-bit arg treated as 64-bit
    - [s390x] dasd: Fix gendisk parent after copy pair swap
    - wifi: mt76: Fix DTS power-limits on little endian systems
    - block: rate-limit capacity change info log
    - floppy: fix for PAGE_SIZE != 4KB
    - kallsyms: Fix wrong "big" kernel symbol type read from procfs
    - fs/ntfs3: fix mount failure for sparse runs in run_unpack()
    - tpm: Cap the number of PCR banks
    - ext4: fix string copying in parse_apply_sb_mount_options()
    - ext4: xattr: fix null pointer deref in ext4_raw_inode()
    - ext4: clear i_state_flags when alloc inode
    - ext4: fix incorrect group number assertion in mb_check_buddy
    - ext4: align max orphan file size with e2fsprogs limit
    - jbd2: use a per-journal lock_class_key for jbd2_trans_commit_key
    - jbd2: use a weaker annotation in journal handling
    - media: v4l2-mem2mem: Fix outdated documentation
    - mptcp: schedule rtx timer only after pushing data
    - mptcp: avoid deadlock on fallback while reinjecting
    - usb: usb-storage: Maintain minimal modifications to the bcdDevice range.
    - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg()
    - media: pvrusb2: Fix incorrect variable used in trace message
    - usb: typec: altmodes/displayport: Drop the device reference in
      dp_altmode_probe()
    - [arm64,armhf] usb: dwc3: of-simple: fix clock resource leak in
      dwc3_of_simple_probe
    - [arm64,armhf] usb: dwc3: keep susphy enabled during exit to avoid
      controller faults
    - char: applicom: fix NULL pointer dereference in ac_ioctl
    - [amd64] intel_th: Fix error handling in intel_th_output_open
    - mei: gsc: add dependency on Xe driver
    - serial: sh-sci: Check that the DMA cookie is valid
    - cpuidle: governors: teo: Drop misguided target residency check
    - cpufreq: nforce2: fix reference count leak in nforce2
    - scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort
      path"
    - scsi: aic94xx: fix use-after-free in device removal path
    - NFSD: use correct reservation type in nfsd4_scsi_fence_client
    - scsi: target: Reset t_task_cdb pointer in error case
    - scsi: mpi3mr: Read missing IOCFacts flag for reply queue full overflow
    - scsi: ufs: core: Add ufshcd_update_evt_hist() for UFS suspend error
    - f2fs: ensure node page reads complete before f2fs_put_super() finishes
    - f2fs: fix to avoid potential deadlock
    - f2fs: fix to avoid updating zero-sized extent in extent cache
    - f2fs: invalidate dentry cache on failed whiteout creation
    - f2fs: fix age extent cache insertion skip on counter overflow
    - f2fs: fix uninitialized one_time_gc in victim_sel_policy
    - f2fs: fix return value of f2fs_recover_fsync_data()
    - KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot
    - media: vidtv: initialize local pointers upon transfer of memory ownership
    - ocfs2: fix kernel BUG in ocfs2_find_victim_chain
    - [amd64] KVM: x86: Don't clear async #PF queue when CR0.PG is disabled
      (e.g. on #SMI)
    - [amd64] platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver
    - scs: fix a wrong parameter in __scs_magic
    - libceph: make decode_pool() more resilient against corrupted osdmaps
    - [powerpc*] Add reloc_offset() to font bitmap pointer used for
      bootx_printf()
    - [amd64] KVM: x86: WARN if hrtimer callback for periodic APIC timer fires
      with period=0
    - [amd64] KVM: x86: Explicitly set new periodic hrtimer expiration in
      apic_timer_fn()
    - [amd64] KVM: x86: Fix VM hard lockup after prolonged inactivity with
      periodic HV timer
    - [amd64] KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE
    - [amd64] KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN
    - [amd64] KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW
      emulation
    - [amd64] KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN
    - [amd64] KVM: nVMX: Immediately refresh APICv controls as needed on nested
      VM-Exit
    - [amd64] KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR
      (failed VMRUN)
    - [amd64] KVM: nSVM: Clear exit_code_hi in VMCB when synthesizing nested
      VM-Exits
    - xfs: fix a memory leak in xfs_buf_item_init()
    - xfs: fix stupid compiler warning
    - xfs: fix a UAF problem in xattr repair
    - tracing: Do not register unsupported perf events
    - PM: runtime: Do not clear needs_force_resume with enabled runtime PM
    - r8169: fix RTL8117 Wake-on-Lan in DASH mode
    - fsnotify: do not generate ACCESS/MODIFY events on child for special files
    - net/handshake: restore destructor on submit failure
    - NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap
    - NFSD: NFSv4 file creation neglects setting ACL
    - nfsd: Mark variable __maybe_unused to avoid W=1 build break
    - svcrdma: return 0 on success from svc_rdma_copy_inline_range
    - svcrdma: use rc_pageoff for memcpy byte offset
    - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in
      gss_read_proxy_verf
    - [powerpc*] kexec: Enable SMT before waking offline CPUs
    - btrfs: don't log conflicting inode if it's a dir moved in the current
      transaction
    - [s390x] ipl: Clear SBP flag when bootprog is set
    - gpio: regmap: Fix memleak in error path in gpio_regmap_register()
    - io_uring/poll: correctly handle io_poll_add() return value on update
    - io_uring: fix min_wait wakeups for SQPOLL
    - Revert "drm/amd/display: Fix pbn to kbps Conversion"
    - drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state()
    - drm/amd/display: Fix scratch registers offsets for DCN35
    - drm/amd/display: Fix scratch registers offsets for DCN351
    - drm/displayid: pass iter to drm_find_displayid_extension()
    - ALSA: hda: cs35l41: Fix NULL pointer dereference in
      cs35l41_hda_read_acpi() (CVE-2025-68345)
    - ALSA: wavefront: Use guard() for spin locks
    - ALSA: wavefront: Clear substream pointers on close
    - [arm64] pinctrl: renesas: rzg2l: Fix ISEL restore on resume
    - hsr: hold rcu and dev lock for hsr_get_port_ndev (CVE-2025-39872)
    - sched/rt: Fix race in push_rt_task (CVE-2025-38234)
    - [arm64] KVM: arm64: Initialize HCR_EL2.E2H early
    - [arm64] KVM: arm64: Initialize SCTLR_EL1 in __kvm_hyp_init_cpu()
    - [arm64] Revamp HCR_EL2.E2H RES1 detection
    - dt-bindings: PCI: qcom,pcie-sc7280: Add missing required power-domains and
      resets
    - dt-bindings: PCI: qcom,pcie-sc8280xp: Add missing required power-domains
      and resets
    - dt-bindings: PCI: qcom,pcie-sm8150: Add missing required power-domains and
      resets
    - dt-bindings: PCI: qcom,pcie-sm8250: Add missing required power-domains and
      resets
    - dt-bindings: PCI: qcom,pcie-sm8350: Add missing required power-domains and
      resets
    - dt-bindings: PCI: qcom,pcie-sm8450: Add missing required power-domains and
      resets
    - dt-bindings: PCI: qcom,pcie-sm8550: Add missing required power-domains and
      resets
    - crypto: af_alg - zero initialize memory allocated via sock_kmalloc
    - crypto: caam - Add check for kcalloc() in test_len()
    - [arm64,armhf] amba: tegra-ahb: Fix device leak on SMMU enable
    - virtio: vdpa: Fix reference count leak in octep_sriov_enable()
    - tracing: Fix fixed array of synthetic event
    - [arm64,armhf] soc: samsung: exynos-pmu: fix device leak on regmap lookup
    - [arm64] soc: qcom: ocmem: fix device leak on lookup
    - [arm64] soc: amlogic: canvas: fix device leak on lookup
    - rpmsg: glink: fix rpmsg device leak
    - [amd64] platform/x86: intel: chtwc_int33fe: don't dereference swnode args
    - i2c: amd-mp2: fix reference leak in MP2 PCI device
    - hwmon: (max16065) Use local variable to avoid TOCTOU
    - hwmon: (max6697) fix regmap leak on probe failure
    - hwmon: (w83791d) Convert macros to functions to avoid TOCTOU
    - hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU
    - [amd64] x86/msi: Make irq_retrigger() functional for posted MSI
    - [arm64] iommu/mediatek: fix use-after-free on probe deferral
    - fuse: fix readahead reclaim deadlock
    - wifi: rtw88: limit indirect IO under powered off for RTL8822CS
      (Closes: #1125797)
    - wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc()
    - wifi: cfg80211: sme: store capped length in __cfg80211_connect_result()
    - wifi: mac80211: do not use old MBSSID elements
    - i40e: fix scheduling in set_rx_mode
    - i40e: validate ring_len parameter against hardware-specific values
    - iavf: fix off-by-one issues in iavf_config_rss_reg()
    - idpf: reduce mbx_task schedule delay to 300us
    - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt
    - Bluetooth: btusb: revert use of devm_kzalloc in btusb
    - net: mdio: aspeed: add dummy read to avoid read-after-write issue
    - net: openvswitch: Avoid needlessly taking the RTNL on vport destroy
    - ip6_gre: make ip6gre_header() robust
    - [amd64] platform/x86: msi-laptop: add missing sysfs_remove_group()
    - [amd64] platform/x86: ibm_rtl: fix EBDA signature search pointer
      arithmetic
    - team: fix check for port enabled in
      team_queue_override_port_prio_changed()
    - [arm64,armhf] net: dsa: fix missing put_device() in
      dsa_tree_find_first_conduit()
    - amd-xgbe: reset retries and mode on RX adapt failures
    - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure
    - genalloc.h: fix htmldocs warning
    - firewire: nosy: Fix dma_free_coherent() size
    - [armhf] net: dsa: b53: skip multicast entries for fdb_dump()
    - kbuild: fix compilation of dtb specified on command-line without make rule
    - net: usb: asix: validate PHY address before use
    - net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct
    - vfio/pds: Fix memory leak in pds_vfio_dirty_enable()
    - [amd64] platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI
      package parsing
    - [arm64] octeontx2-pf: fix "UBSAN: shift-out-of-bounds error"
    - net: stmmac: fix the crash issue for zero copy XDP_TX action
    - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()
    - ipv4: Fix reference count leak when using error routes with nexthop
      objects
    - net: rose: fix invalid array index in rose_kill_by_device()
    - ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT
    - RDMA/irdma: avoid invalid read in irdma_net_event
    - RDMA/efa: Remove possible negative shift
    - RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr()
    - RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db()
    - RDMA/core: always drop device refcount in ib_del_sub_device_and_put()
    - RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send
    - RDMA/bnxt_re: Fix to use correct page size for PDE table
    - md: Fix static checker warning in analyze_sbs
    - md/raid5: fix possible null-pointer dereferences in
      raid5_store_group_thread_cnt()
    - ksmbd: Fix memory leak in get_file_all_info()
    - RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation
    - RDMA/bnxt_re: fix dma_free_coherent() pointer
    - blk-mq: skip CPU offline notify on unmapped hctx
    - ntfs: Do not overwrite uptodate pages
    - [armhf] ASoC: stm32: sai: fix device leak on probe
    - [armhf] ASoC: stm32: sai: fix clk prepare imbalance on probe failure
    - [armhf] ASoC: stm32: sai: fix OF node leak on probe
    - [arm64] ASoC: codecs: lpass-tx-macro: fix SM6115 support
    - [arm64] ASoC: qcom: q6apm-dai: set flags to reflect correct operation of
      appl_ptr
    - [arm64] ASoC: qcom: q6asm-dai: perform correct state check before closing
    - [arm64] ASoC: qcom: q6adm: the the copp device only during last instance
    - [arm64] ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer
      alignment.
    - [amd64] iommu/amd: Fix pci_segment memleak in alloc_pci_segment()
    - [amd64] iommu/amd: Propagate the error code returned by __modify_irte_ga()
      in modify_irte_ga()
    - [armhf] iommu/omap: fix device leaks on probe_device()
    - [arm64] iommu/qcom: fix device leak on of_xlate()
    - [arm64,riscv64] iommu/sun50i: fix device leak on of_xlate()
    - [arm64,armhf] iommu/tegra: fix device leak on probe_device()
    - iommu: disable SVA when CONFIG_X86 is set
    - HID: logitech-dj: Remove duplicate error logging
    - fgraph: Initialize ftrace_ops->private for function graph ops
    - fgraph: Check ftrace_pids_enabled on registration for early filtering
    - PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths
    - [arm64] dts: ti: k3-j721e-sk: Fix pinmux for pin Y1 used by power
      regulator
    - [powerpc*] mm: Fix mprotect on book3s 32-bit
    - [powerpc*] 64s/slb: Fix SLB multihit issue during SLB preload
    - leds: leds-cros_ec: Skip LEDs without color components
    - leds: leds-lp50xx: Allow LED 0 to be added to module bank
    - leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs
    - leds: leds-lp50xx: Enable chip before any communication
    - block: Clear BLK_ZONE_WPLUG_PLUGGED when aborting plugged BIOs
    - [arm64,armhf] clk: samsung: exynos-clkout: Assign .num before accessing
      .hws (Closes: #1121211)
    - [arm64] mfd: max77620: Fix potential IRQ chip conflict when probing two
      devices
    - media: rc: st_rc: Fix reset control resource leak
    - media: verisilicon: Fix CPU stalls on G2 bus error
    - mtd: mtdpart: ignore error -ENOENT from parsers on subpartitions
    - mtd: spi-nor: winbond: Add support for W25Q01NWxxIQ chips
    - mtd: spi-nor: winbond: Add support for W25Q01NWxxIM chips
    - mtd: spi-nor: winbond: Add support for W25Q02NWxxIM chips
    - mtd: spi-nor: winbond: Add support for W25H512NWxxAM chips
    - mtd: spi-nor: winbond: Add support for W25H01NWxxAM chips
    - mtd: spi-nor: winbond: Add support for W25H02NWxxAM chips
    - [amd64] perf/x86/amd/uncore: Fix the return value of
      amd_uncore_df_event_init() on error
    - [powerpc*] pseries/cmm: call balloon_devinfo_init() also without
      CONFIG_BALLOON_COMPACTION
    - media: adv7842: Avoid possible out-of-bounds array accesses in
      adv7842_cp_log_status()
    - firmware: stratix10-svc: Add mutex in stratix10 memory management
    - dm-ebs: Mark full buffer dirty even on partial write
    - dm-bufio: align write boundary on physical block size
    - fbdev: gbefb: fix to use physical address instead of dma address
    - fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing
    - fbdev: tcx.c fix mem_map to correct smem_start offset
    - media: cec: Fix debugfs leak on bus_register() failure
    - media: msp3400: Avoid possible out-of-bounds array accesses in
      msp3400c_thread()
    - media: platform: mtk-mdp3: fix device leaks at probe
    - media: renesas: rcar_drif: fix device node reference leak in
      rcar_drif_bond_enabled
    - media: samsung: exynos4-is: fix potential ABBA deadlock on init
    - media: TDA1997x: Remove redundant cancel_delayed_work in probe
    - media: verisilicon: Protect G2 HEVC decoder against invalid DPB index
    - media: videobuf2: Fix device reference leak in vb2_dc_alloc error path
    - media: vpif_capture: fix section mismatch
    - media: vpif_display: fix section mismatch
    - media: amphion: Cancel message work before releasing the VPU core
    - media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe
    - media: i2c: adv7842: Remove redundant cancel_delayed_work in probe
    - media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init()
    - [armhf] pmdomain: imx: Fix reference count leak in imx_gpc_probe()
    - compiler_types.h: add "auto" as a macro for "__auto_type"
    - lockd: fix vfs_test_lock() calls
    - idr: fix idr_alloc() returning an ID out of range
    - mm/page_owner: fix memory leak in page_owner_stack_fops->release()
    - [amd64] x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix
      Halo
    - tools/mm/page_owner_sort: fix timestamp comparison for stable sorting
    - samples/ftrace: Adjust LoongArch register restore order in direct calls
    - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly
    - RDMA/cm: Fix leaking the multicast GID table reference
    - e1000: fix OOB in e1000_tbi_should_accept()
    - fjes: Add missing iounmap in fjes_hw_init()
    - nfsd: Drop the client reference in client_states_open()
    - net: usb: sr9700: fix incorrect command used to write single register
    - net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write
    - net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to
      macb_open()
    - Revert "drm/amd: Skip power ungate during suspend for VPE"
    - drm/amdgpu/gmc12: add amdgpu_vm_handle_fault() handling
    - drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma
    - drm/amdgpu/gmc11: add amdgpu_vm_handle_fault() handling
    - [arm64] drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers
    - [amd64] drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg()
    - drm/edid: add DRM_EDID_IDENT_INIT() to initialize struct drm_edid_ident
    - drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl()
    - [arm64] drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse()
    - [arm64] drm/mediatek: Fix probe resource leaks
    - [arm64] drm/mediatek: Fix probe memory leak
    - [arm64] drm/mediatek: Fix probe device leaks
    - drm/amdkfd: Export the cwsr_size and ctl_stack_size to userspace
    - drm/amdkfd: bump minimum vgpr size for gfx1151
    - drm/amdkfd: Trap handler support for expert scheduling mode
    - [amd64] drm/i915: Fix format string truncation warning
    - drm/ttm: Avoid NULL pointer deref for evicted BOs
    - [amd64] drm/mgag200: Fix big-endian support
    - drm/xe/bo: Don't include the CCS metadata in the dma-buf sg-table
    - drm/xe/oa: Disallow 0 OA property values
    - drm/xe: Adjust long-running workload timeslices to reasonable values
    - drm/xe: Use usleep_range for accurate long-running workload timeslicing
    - drm/xe: Drop preempt-fences when destroying imported dma-bufs.
    - [arm64] drm/msm/dpu: Add missing NULL pointer check for pingpong interface
    - [amd64] drm/i915/gem: Zero-initialize the eb.vma array in
      i915_gem_do_execbuffer
    - drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb
    - [riscv64] lib/crypto: riscv/chacha: Avoid s0/fp register
    - gfs2: fix freeze error handling
    - btrfs: don't rewrite ret from inode_permission
    - sched/eevdf: Fix min_vruntime vs avg_vruntime
    - erofs: fix unexpected EIO under memory pressure
    - sched_ext: Fix incorrect sched_class settings for per-cpu migration tasks
    - jbd2: fix the inconsistency between checksum and data in memory for
      journal sb
    - tty: introduce and use tty_port_tty_vhangup() helper
    - xhci: dbgtty: fix device unregister: fixup
    - f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes()
    - f2fs: use global inline_xattr_slab instead of per-sb slab cache
    - f2fs: drop inode from the donation list when the last file is closed
    - f2fs: fix to avoid updating compression context during writeback
    - serial: core: fix OF node leak
    - serial: core: Restore sysfs fwnode information
    - mptcp: pm: ignore unknown endpoint flags
    - mm/ksm: fix exec/fork inheritance support for prctl
    - svcrdma: bound check rq_pages index in inline path
    - block: freeze queue when updating zone resources
    - tpm2-sessions: Fix tpm2_read_public range checks
    - sched_ext: Factor out local_dsq_post_enq() from dispatch_enqueue()
    - sched_ext: Fix missing post-enqueue handling in
      move_local_task_to_local_dsq()
    - drm/displayid: add quirk to ignore DisplayID checksum errors
    - hrtimers: Introduce hrtimer_update_function()
    - [arm64] serial: xilinx_uartps: Use helper function
      hrtimer_update_function()
    - [arm64] serial: xilinx_uartps: fix rs485 delay_rts_after_send
    - f2fs: clear SBI_POR_DOING before initing inmem curseg
    - f2fs: add timeout in f2fs_enable_checkpoint()
    - f2fs: dump more information for f2fs_{enable,disable}_checkpoint()
    - f2fs: fix to propagate error from f2fs_enable_checkpoint()
    - gpiolib: acpi: Switch to use enum in acpi_gpio_in_ignore_list()
    - gpiolib: acpi: Handle deferred list via new API
    - gpiolib: acpi: Add acpi_gpio_need_run_edge_events_on_boot() getter
    - gpiolib: acpi: Move quirks to a separate file
    - gpiolib: acpi: Add a quirk for Acer Nitro V15
    - gpiolib: acpi: Add quirk for ASUS ProArt PX13
    - gpiolib: acpi: Add quirk for Dell Precision 7780
    - netfilter: nft_ct: add seqadj extension for natted connections
      (CVE-2025-68206)
    - md/raid10: wait barrier before returning discard request with REQ_NOWAIT
      (CVE-2025-40325)
    - [arm64] drm/panthor: Flush shmem writes before mapping buffers
      CPU-uncached (CVE-2025-40276)
    - net: ipv6: ioam6: use consistent dst names
    - ipv6: adopt dst_dev() helper
    - net: use dst_dev_rcu() in sk_setup_caps()
    - usbnet: Fix using smp_processor_id() in preemptible code warnings
    - serial: core: Fix serial device initialization
    - tty: fix tty_port_tty_*hangup() kernel-doc
    - [amd64] x86/microcode/AMD: Select which microcode patch to load
    - media: i2c: imx219: Fix 1920x1080 mode to use 1:1 pixel aspect ratio
    - wifi: mt76: mt7925: fix the unfinished command of regd_notifier before
      suspend
    - wifi: mt76: mt7925: fix CLC command timeout when suspend/resume
    - wifi: mt76: mt7925: add handler to hif suspend/resume event
    - idpf: add support for SW triggered interrupts
    - idpf: trigger SW interrupt when exiting wb_on_itr mode
    - idpf: add support for Tx refillqs in flow scheduling mode
    - idpf: improve when to set RE bit logic
    - idpf: simplify and fix splitq Tx packet rollback error path
    - idpf: replace flow scheduling buffer ring with buffer pool
    - idpf: stop Tx if there are insufficient buffer resources
    - idpf: remove obsolete stashing code
    - hrtimers: Make hrtimer_update_function() less expensive
    - gve: defer interrupt enabling until NAPI registration
    - block: handle zone management operations completions
    - soundwire: stream: extend sdw_alloc_stream() to take 'type' parameter
    - [arm64] ASoC: qcom: sdw: fix memory leak for sdw_stream_runtime
    - PCI: brcmstb: Reuse pcie_cfg_data structure
    - PCI: brcmstb: Set MLW based on "num-lanes" DT property if present
    - PCI: brcmstb: Fix disabling L0s capability
    - mm/balloon_compaction: we cannot have isolated pages in the balloon list
    - mm/balloon_compaction: convert balloon_page_delete() to
      balloon_page_finalize()
    - [powerpc*] pseries/cmm: adjust BALLOON_MIGRATE when migrating pages
    - media: mediatek: vcodec: Use spinlock for context list protection lock
    - media: amphion: Add a frame flush mode for decoder
    - media: amphion: Make some vpu_v4l2 functions static
    - media: amphion: Remove vpu_vb_is_codecconfig
    - vfio/pci: Disable qword access to the PCI ROM bar
    - iomap: allocate s_dio_done_wq for async reads as well (CVE-2025-68357)
    - block: fix NULL pointer dereference in blk_zone_reset_all_bio_endio()
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.65
    - mptcp: fallback earlier on simult connection
    - mm/page_alloc: change all pageblocks migrate type on coalescing
    - mm: simplify folio_expected_ref_count()
    - mm: consider non-anon swap cache folios in folio_expected_ref_count()
    - mptcp: ensure context reset on disconnect()
    - wifi: mac80211: Discard Beacon frames to non-broadcast address
    - [arm64] net: phy: mediatek: fix nvmem cell reference leak in
      mt798x_phy_calibration
    - drm/amdgpu: Forward VMID reservation errors
    - [amd64] cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL
      writes
    - net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF.
    - sched/fair: Small cleanup to sched_balance_newidle()
    - sched/fair: Small cleanup to update_newidle_cost()
    - sched/fair: Proportional newidle balance
    - virtio_console: fix order of fields cols and rows
    - [armhf] pwm: stm32: Always program polarity
    - [amd64] Revert "iommu/amd: Skip enabling command/event buffers for kdump"
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.66
    - NFSD: Fix permission check for read access to executable-only files
    - nfsd: provide locking for v4_end_grace
    - nfsd: use correct loop termination in nfsd4_revoke_states()
    - nfsd: check that server is running in unlock_filesystem
    - NFSD: net ref data still needs to be freed even if net hasn't startup
    - NFSD: Remove NFSERR_EAGAIN
    - atm: Fix dma_free_coherent() size
    - net: 3com: 3c59x: fix possible null dereference in vortex_probe1()
    - [arm64] Fix cleared E0POE bit after cpu_suspend()/resume()
    - btrfs: always detect conflicting inodes when logging inode refs
    - [amd64] mei: me: add nova lake point S DID
    - lib/crypto: aes: Fix missing MMU protection for AES S-box
    - drm/amdgpu: Fix query for VPE block_type and ip_count
    - drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[]
      (Closes: #1122106)
    - [arm64,armhf] gpio: rockchip: mark the GPIO controller as sleeping
    - [arm64] pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping
    - wifi: avoid kernel-infoleak from struct iw_point
    - wifi: mac80211: restore non-chanctx injection behaviour
    - libceph: prevent potential out-of-bounds reads in handle_auth_done()
    - libceph: replace overzealous BUG_ON in osdmap_apply_incremental()
    - libceph: make free_choose_arg_map() resilient to partial allocation
    - libceph: return the handler error from mon_handle_auth_done()
    - libceph: reset sparse-read state in osd_fault()
    - libceph: make calc_target() set t->paused, not just clear it
    - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock().
      (CVE-2025-40149)
    - drm/xe: make xe_gt_idle_disable_c6() handle the forcewake internally
    - drm/xe: Ensure GT is in C0 during resumes
    - dm-snapshot: fix 'scheduling while atomic' on real-time kernels
    - NFSv4: ensure the open stateid seqid doesn't go backwards
    - [arm64] ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again)
    - NFS: Fix up the automount fs_context to use the correct cred
    - drm/amd/display: shrink struct members
    - smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value
    - smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value
    - smb/client: fix NT_STATUS_NO_DATA_DETECTED value
    - scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset
    - scsi: ufs: core: Fix EH failure after W-LUN resume error
    - scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe
      failure scanned in again after probe failed"
    - btrfs: fix qgroup_snapshot_quick_inherit() squota bug
    - btrfs: qgroup: update all parent qgroups when doing quick inherit
    - btrfs: tracepoints: use btrfs_root_id() to get the id of a root
    - btrfs: fix NULL dereference on root when tracing inode eviction
    - drm/amd/display: Respect user's CONFIG_FRAME_WARN more for dml files
    - drm/amd/display: Apply e4479aecf658 to dml
    - [arm64] dts: ti: k3-am62-lp-sk-nand: Rename pinctrls to fix schema
      warnings
    - [amd64] crypto: qat - fix duplicate restarting msg during AER error
    - [arm64] dts: add off-on-delay-us for usdhc2 regulator
    - netfilter: nft_set_pipapo: fix range overlap detection
    - netfilter: nft_synproxy: avoid possible data-race on update operation
    - [arm64,armhf] gpio: pca953x: Add support for level-triggered interrupts
    - [arm64,armhf] gpio: pca953x: handle short interrupt pulses on PCAL devices
    - netfilter: nf_tables: fix memory leak in nf_tables_newrule()
    - netfilter: nf_conncount: update last_gc only when GC has been performed
    - bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress
    - [arm64] net: mscc: ocelot: Fix crash when adding interface under a lag
    - inet: ping: Fix icmp out counting
    - net: sock: fix hardened usercopy panic in sock_recv_errqueue
    - netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates
    - net/mlx5e: Don't print error message due to invalid module
    - net: wwan: iosm: Fix memory leak in ipc_mux_deinit()
    - bnxt_en: Fix potential data corruption with HW GRO/LRO
    - vsock: Make accept()ed sockets use custom setsockopt()
    - btrfs: only enforce free space tree if v1 cache is required for bs < ps
      cases
    - [riscv64] pgtable: Cleanup useless VA_USER_XXX definitions
    - net: fix memory leak in skb_segment_list for GRO packets
    - idpf: keep the netdev when a reset fails
    - idpf: fix memory leak in idpf_vport_rel()
    - idpf: cap maximum Rx buffer size
    - HID: quirks: work around VID/PID conflict for appledisplay
    - net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in
      qfq_reset
    - net: usb: pegasus: fix memory leak in update_eth_regs_async()
    - arp: do not assume dev_hard_header() does not change skb->head
    - erofs: don't bother with s_stack_depth increasing for now
    - erofs: fix file-backed mounts no longer working on EROFS partitions
    - ALSA: ac97bus: Use guard() for mutex locks
    - ALSA: ac97: fix a double free in snd_ac97_controller_register()
    - btrfs: fix error handling of submit_uncompressed_range()
    - btrfs: subpage: dump the involved bitmap when ASSERT() failed
    - btrfs: add extra error messages for delalloc range related errors
    - btrfs: remove btrfs_fs_info::sectors_per_page
    - btrfs: truncate ordered extent when skipping writeback past i_size
    - btrfs: use variable for end offset in extent_writepage_io()
    - btrfs: fix beyond-EOF write handling
    - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K
    - bpf: Make variables in bpf_prog_test_run_xdp less confusing
    - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN
    - bpf: Fix reference count leak in bpf_prog_test_run_xdp()
    - net: sfp: extend Potron XGSPON quirk to cover additional EEPROM variant
    - powercap: fix race condition in register_control_type()
    - powercap: fix sscanf() error return value handling
    - netfilter: nf_tables: avoid chain re-validation if possible
    - ata: libata-core: Disable LPM on ST2000DM008-2FR102
    - drm/amd/display: Fix DP no audio issue
    - [arm64] spi: mt65xx: Use IRQF_ONESHOT with threaded IRQ
    - drm/amdkfd: Fix improper NULL termination of queue restore SMI event
      string
    - can: j1939: make j1939_session_activate() fail if device is no longer
      registered
    - ALSA: usb-audio: Update for native DSD support quirks
    - [amd64] ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025
    - ALSA: hda/realtek: enable woofer speakers on Medion NM14LNL
    - [arm64,armhf] ASoC: fsl_sai: Add missing registers to cache default
    - scsi: sg: Fix occasional bogus elapsed time that exceeds timeout
    - spi: cadence-quadspi: Prevent lost complete() call during indirect read
    - tpm2-sessions: Fix out of range indexing in name_size (CVE-2025-68792)
    - ALSA: hda: intel-dsp-config: Prefer legacy driver as fallback
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.67
    - efi/cper: Fix cper_bits_to_str buffer handling and return value
    - Revert "gfs2: Fix use of bio_chain"
    - [amd64] x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1
    - xfrm: Fix inner mode lookup in tunnel mode GSO segmentation
    - xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set
    - pNFS: Fix a deadlock when returning a delegation during open()
    - NFS: Fix a deadlock involving nfs_release_folio()
    - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()
    - pnfs/blocklayout: Fix memory leak in bl_parse_scsi()
    - drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions
    - PM: EM: Fix incorrect description of the cost field in struct
      em_perf_state
    - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec
    - btrfs: send: check for inline extents in range_is_hole_in_parent()
    - net: bridge: annotate data-races around fdb->{updated,used}
    - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()
    - net: update netdev_lock_{type,name}
    - macvlan: fix possible UAF in macvlan_forward_source()
    - ipv4: ip_gre: make ipgre_header() robust
    - net/mlx5e: Fix crash on profile change rollback failure
    - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv
    - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv
    - net/mlx5e: Restore destroying state bit after profile cleanup
    - btrfs: factor out init_space_info() from create_space_info()
    - btrfs: factor out check_removing_space_info() from
      btrfs_free_block_groups()
    - btrfs: introduce btrfs_space_info sub-group
    - btrfs: fix memory leaks in create_space_info() error paths
    - ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip
    - net: hv_netvsc: reject RSS hash key programming without RX indirection
      table
    - ipv6: Fix use-after-free in inet6_addr_del().
    - net/sched: sch_qfq: do not free existing class in qfq_change_class()
    - [amd64] ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack
      type
    - drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2
    - mm: describe @flags parameter in memalloc_flags_save()
    - textsearch: describe @list member in ts_ops search
    - mm, kfence: describe @slab parameter in __kfence_obj_info()
    - [arm64] dmaengine: tegra-adma: Fix use-after-free
    - [arm64] phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before
      using it
    - [arm64] phy: phy-snps-eusb2: refactor constructs names
    - phy: drop probe registration printks
    - [arm64] phy: qcom-qusb2: Fix NULL pointer dereference on early suspend
    - [armhf] phy: stm32-usphyc: Fix off by one in probe()
    - [armhf] dmaengine: omap-dma: fix dma_pool resource leak in error paths
    - [arm64] i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA
    - HID: usbhid: paper over wrong bNumDescriptor field (Closes: #1122193)
    - bridge: mcast: Fix use-after-free during router port configuration
      (CVE-2025-38248)
    - [arm64] ASoC: codecs: wsa883x: fix unnecessary initialisation
    - drm/amd/display: mark static functions noinline_for_stack
    - io_uring: move local task_work in exit cancel loop
    - scsi: core: Fix error handler encryption support
    - ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer
    - null_blk: fix kmemleak by releasing references to fault configfs items
    - can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak
    - can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit.
    - net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session
      upon receiving the second rts
    - xfs: Fix the return value of xfs_rtcopy_summary()
    - lib/buildid: use __kernel_read() for sleepable context
    - [arm64] phy: rockchip: inno-usb2: fix communication disruption in gadget
      mode
    - [arm64,armhf] phy: ti: gmii-sel: fix regmap leak on probe failure
    - [arm64] phy: freescale: imx8m-pcie: assert phy reset during power on
    - [arm64] phy: rockchip: inno-usb2: fix disconnection in gadget mode
    - usb: dwc3: Check for USB4 IP_NAME
    - usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor
    - USB: OHCI/UHCI: Add soft dependencies on ehci_platform
    - USB: serial: option: add Telit LE910 MBIM composition
    - USB: serial: ftdi_sio: add support for PICAXE AXE027 cable
    - nvme-pci: disable secondary temp for Wodposit WPBSNM8
    - [arm64] ASoC: codecs: wsa881x: fix unnecessary initialisation
    - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref
    - hrtimer: Fix softirq base check in update_needs_ipi()
    - [amd64] EDAC/x38: Fix a resource leak in x38_probe1()
    - [amd64] EDAC/i3200: Fix a resource leak in i3200_probe1()
    - tcpm: allow looking for role_sw device in the main node
    - i2c: riic: Move suspend handling to NOIRQ phase
    - [amd64] x86/resctrl: Add missing resctrl initialization for Hygon
    - [amd64] x86/resctrl: Fix memory bandwidth counter width for Hygon
    - nvme: fix PCIe subsystem reset controller state transition
    - mm/zswap: fix error pointer free in zswap_cpu_comp_prepare()
    - mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free
    - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure
    - drm/amd/display: Bump the HDMI clock to 340MHz
    - drm/amd: Clean up kfd node on surprise disconnect
    - drm/amdkfd: fix a memory leak in device_queue_manager_init()
    - drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare
    - [arm64,armhf] drm/panel-simple: fix connector type for DataImage
      SCF0700C48GGU18 panel
    - drm/vmwgfx: Fix an error return check in vmw_compat_shader_add()
    - [arm64] dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config()
    - [armhf] dmaengine: stm32: dmamux: fix device leak on route allocation
    - [armhf] dmaengine: stm32: dmamux: fix OF node leak on route allocation
      failure
    - [armhf] dmaengine: ti: dma-crossbar: fix device leak on dra7x route
      allocation
    - [armhf] dmaengine: ti: dma-crossbar: fix device leak on am335x route
      allocation
    - [amd64] HID: intel-ish-hid: Use dedicated unbound workqueues to prevent
      resume blocking
    - [amd64] HID: intel-ish-hid: Fix -Wcast-function-type-strict in
      devm_ishtp_alloc_workqueue()
    - btrfs: fix deadlock in wait_current_trans() due to ignored transaction
      type
    - xfs: set max_agbno to allow sparse alloc of last full inode chunk
    - mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure
    - mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup
      failure
    - bpf: Reject narrower access to pointer ctx fields (CVE-2025-38591)
    - mm/fake-numa: allow later numa node hotplug
    - mm: numa,memblock: include <asm/numa.h> for 'numa_nodes_parsed'
    - [arm64] phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path
    - [arm64] phy: rockchip: inno-usb2: Fix a double free bug in
      rockchip_usb2phy_probe()
    - [arm64] dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure
    - mm/page_alloc/vmstat: simplify refresh_cpu_vm_stats change detection
    - mm/page_alloc: batch page freeing in decay_pcp_high
    - mm/page_alloc: prevent pcp corruption with SMP=n
    - mm/fake-numa: handle cases with no SRAT info
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.68
    - posix-clock: Store file pointer in struct posix_clock_context
    - ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE.
    - dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains
    - dt-bindings: power: qcom,rpmpd: add Turbo L5 corner
    - dt-bindings: power: qcom-rpmpd: split RPMh domains definitions
    - dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO
    - [arm64] pmdomain: qcom: rpmhpd: Add MXC to SC8280XP
    - Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump()
    - btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE
    - ata: ahci: Do not read the per port area for unimplemented ports
    - ata: libata-sata: Improve link_power_management_supported sysfs attribute
    - ata: libata: Add cpr_log to ata_dev_print_features() early return
    - ata: libata-core: Introduce ata_dev_config_lpm()
    - ata: libata: Call ata_dev_config_lpm() for ATAPI devices
    - ata: libata: Print features also for ATAPI devices
    - ice: initialize ring_stats->syncp
    - ice: Avoid detrimental cleanup for bond during interface stop
    - ice: Fix incorrect timeout ice_release_res()
    - igc: Restore default Qbv schedule when changing channels
    - igc: fix race condition in TX timestamp read for register 0
    - vsock/virtio: Coalesce only linear skb
    - net: usb: dm9601: remove broken SR9700 support
    - bonding: limit BOND_MODE_8023AD to Ethernet devices
    - l2tp: Fix memleak in l2tp_udp_encap_recv().
    - can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on
      usb_submit_urb() error
    - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT
    - [amd64,arm64] amd-xgbe: avoid misleading per-packet error log
    - gue: Fix skb memleak with inner IP protocol 0.
    - fou: Don't allow 0 for FOU_ATTR_IPPROTO.
    - veth: fix data race in veth_get_ethtool_stats
    - l2tp: avoid one data-race in l2tp_tunnel_del_work()
    - ipvlan: Make the addrs_lock be per port
    - [arm64] octeontx2: cn10k: fix RX flowid TCAM mask handling
    - net/sched: Enforce that teql can only be used as root qdisc
    - net/sched: qfq: Use cl_is_active to determine whether class is active in
      qfq_rm_from_ag
    - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN
      spec
    - wifi: mac80211: don't perform DA check on S1G beacon
    - serial: 8250_pci: Fix broken RS485 for F81504/508/512
    - w1: therm: Fix off-by-one buffer overflow in alarms_store
    - w1: fix redundant counter decrement in w1_attach_slave_device()
    - Revert "nfc/nci: Add the inconsistency check between the input data length
      and count"
    - Input: i8042 - add quirks for MECHREVO Wujie 15X Pro
    - Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA
    - scsi: storvsc: Process unsupported MODE_SENSE_10
    - scsi: xen: scsiback: Fix potential memory leak in scsiback_remove()
    - [arm64] dts: rockchip: remove dangerous max-link-speed from helios64
    - [arm64] dts: rockchip: Fix voltage threshold for volume keys for Pinephone
      Pro
    - [amd64] x86/kfence: avoid writing L1TF-vulnerable PTEs
    - [amd64] comedi: Fix getting range information for subdevices 16 to 255
    - [amd64] platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute
      names
    - [amd64] platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID
      macro
    - mm/rmap: fix two comments related to huge_pmd_unshare()
    - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop
    - iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event
      detection
    - interconnect: debugfs: initialize src_node and dst_node to empty strings
    - regmap: Fix race condition in hwspinlock irqsave routine
    - [riscv64] clocksource: Fix stimecmp update hazard on RV32
    - [amd64] platform/x86/amd: Fix memory leak in wbrf_record()
    - scsi: core: Wake up the error handler when final completions race against
      each other
    - scsi: qla2xxx: Sanitize payload size to prevent member overflow
    - ALSA: usb: Increase volume range that triggers a warning
    - ice: Fix persistent failure in ice_get_rxfh
    - [arm64] net: hns3: fix data race in hns3_fetch_stats
    - be2net: fix data race in be_get_new_eqd
    - [arm64] net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M
    - [arm64] net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue
    - mISDN: annotate data-race around dev->work
    - ipv6: annotate data-race in ndisc_router_discovery()
    - usbnet: limit max_mtu based on device's hard_mtu
    - clocksource: Reduce watchdog readout delay limit to prevent false
      positives
    - sched/fair: Fix pelt clock sync when entering idle
    - drm/amd/pm: Don't clear SI SMC table when setting power limit
    - drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2)
    - drm/nouveau: add missing DCB connector types
    - drm/nouveau: implement missing DCB connector types; gracefully handle
      unknown connectors
    - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list
    - bonding: provide a net pointer to __skb_flow_dissect()
    - [arm64,armhf] net: dsa: fix off-by-one in maximum bridge ID determination
    - [arm64] octeontx2-af: Fix error handling
    - net: openvswitch: fix data race in ovs_vport_get_upcall_stats
    - vsock/virtio: fix potential underflow in virtio_transport_get_credit()
    - vsock/virtio: cap TX credit to local buffer size
    - net/sched: act_ife: avoid possible NULL deref
    - dpll: Prevent duplicate registrations
    - [amd64] x86: make page fault handling disable interrupts properly
    - tpm: Compare HMAC values in constant time
    - keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal
    - leds: led-class: Only Add LED to leds_list when it is fully ready
    - of: fix reference count leak in of_alias_scan()
    - of: platform: Use default match table for /firmware
    - iio: accel: iis328dq: fix gain values
    - iio: adc: ad9467: fix ad9434 vref mask
    - iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc
      driver
    - iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot
    - iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl
    - ALSA: ctxfi: Fix potential OOB access in audio mixer handling
      (Closes: #1121535)
    - ALSA: scarlett2: Fix buffer overflow in config retrieval
    - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()
    - mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function
    - mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode
    - drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)
    - wifi: ath10k: fix dma_free_coherent() pointer
    - wifi: ath12k: fix dma_free_coherent() pointer
    - wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize()
    - wifi: rsi: Fix memory corruption due to not set vif driver data size
    - [arm64] fpsimd: signal: Allocate SSVE storage when restoring ZA
    - [arm64] Set __nocfi on swsusp_arch_resume()
    - slimbus: core: fix runtime PM imbalance on report present
    - slimbus: core: fix device reference leak on report present
    - tracing: Fix crash on synthetic stacktrace field usage
    - [amd64] intel_th: fix device leak on output open()
    - mei: trace: treat reg parameter as string
    - [s390x] ap: Fix wrong APQN fill calculation
    - netrom: fix double-free in nr_route_frame()
    - [amd64] platform/x86: hp-bioscfg: Fix automatic module loading
    - [arm64] pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq
      vpu
    - [amd64] perf/x86/intel: Do not enable BTS for guests
    - [arm64,armhf] irqchip/gic-v3-its: Avoid truncating memory addresses
    - net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick
    - can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak
    - can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak
    - can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak
    - can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak
    - drm/amdgpu: remove frame cntl for gfx v12
    - gpio: cdev: Correct return code on memory allocation failure
    - migrate: correct lock ordering for hugetlb file folios
    - [arm64] dmaengine: ti: k3-udma: Enable second resource range for BCDMA and
      PKTDMA
    - can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak
    - bpf: Do not let BPF test infra emit invalid GSO types to stack
      (CVE-2025-68725)
    - [arm64] dts: rockchip: remove redundant max-link-speed from nanopi-r4s
    - iio: core: add missing mutex_destroy in iio_dev_release()
    - iio: core: Replace lockdep_set_class() + mutex_init() by combined call
    - iio: core: add separate lockdep class for info_exist_lock
    - [armhf] iio: adc: exynos_adc: fix OF populate on driver rebind
    - exfat: fix refcount leak in exfat_find (CVE-2025-68351)
    - sched_ext: Fix possible deadlock in the deferred_irq_workfn()
      (CVE-2025-68333)
    - fs/ntfs3: Initialize allocated memory before use (CVE-2025-68365)
    - [amd64] accel/ivpu: Fix race condition when unbinding BOs (CVE-2025-68749)
    - btrfs: fix racy bitfield write in btrfs_clear_space_info_full()
      (CVE-2025-68358)
    - wifi: ath11k: fix RCU stall while reaping monitor destination ring
      (CVE-2024-58097)
    - vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put()
    - vsock/virtio: Rename virtio_vsock_alloc_skb()
    - vsock/virtio: Move SKB allocation lower-bound check to callers
    - vsock/virtio: Rename virtio_vsock_skb_rx_put()
    - vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers
    - vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers
    - net: Introduce skb_copy_datagram_from_iter_full()
    - vsock/virtio: Fix message iterator handling on transmit path
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.69
    - Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work
    - Bluetooth: MGMT: Fix memory leak in set_ssp_complete
    - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup()
    - can: gs_usb: gs_usb_receive_bulk_callback(): fix error message
    - bonding: annotate data-races around slave->last_rx
    - [arm64,armhf] net: mvpp2: cls: Fix memory leak in
      mvpp2_ethtool_cls_rule_ins()
    - ipv6: use the right ifindex when replying to icmpv6 from localhost
    - net: wwan: t7xx: fix potential skb->frags overflow in RX path
    - nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame().
    - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues
    - ice: stop counting UDP csum mismatch as rx_errors
    - net/mlx5e: TC, delete flows only for existing peers
    - nfc: nci: Fix race between rfkill and nci_unregister_device().
    - net: bridge: fix static key check
    - net: phy: micrel: fix clk warning when removing the driver
    - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect
    - net/mlx5: Initialize events outside devlink lock
    - net/mlx5: Fix vhca_id access call trace use before alloc
    - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload
    - scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg()
    - [amd64] ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion
    - gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler
    - gpio: virtuser: fix UAF in configfs release path
    - bcache: fix improper use of bi_end_io
    - bcache: use bio cloning for detached device requests
    - bcache: fix I/O accounting leak in detached_dev_do_request
    - dma/pool: distinguish between missing and exhausted atomic pools
    - sched/deadline: Document dl_server
    - sched/deadline: Fix 'stuck' dl_server
    - [arm64,armhf] pinctrl: meson: mark the GPIO controller as sleeping
    - [riscv64] compat: fix COMPAT_UTS_MACHINE definition
    - scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo()
    - [amd64] ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO
    - [arm64,armhf] gpio: pca953x: mask interrupts in irq shutdown
    - scsi: qla2xxx: edif: Fix dma_free_coherent() size
    - efivarfs: fix error propagation in efivar_entry_get()
    - nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference
      (Closes: #1122521)
    - gpio: rockchip: Stop calling pinctrl for set_direction
    - mptcp: only reset subflow errors when propagated
    - flex_proportions: make fprop_new_period() hardirq safe
    - mm/memory-failure: fix missing ->mf_stats count in hugetlb poison
    - mm/memory-failure: teach kill_accessing_process to accept hugetlb tail
      page pfn
    - mm/shmem, swap: fix race of truncate and swap entry split
    - net: fix segmentation of forwarding fraglist GRO
    - [arm64] drm/msm/a6xx: fix bogus hwcg register updates
    - drm/amdgpu/soc21: fix xclk for APUs
    - drm/amdgpu/gfx10: fix wptr reset in KGQ init
    - drm/amdgpu/gfx11: fix wptr reset in KGQ init
    - drm/amdgpu/gfx12: fix wptr reset in KGQ init
    - drm/amdgpu: fix NULL pointer dereference in
      amdgpu_gmc_filter_faults_remove
    - drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule()
    - gpiolib: acpi: Fix potential out-of-boundary left shift
    - cgroup: Fix kernfs_node UAF in css_free_rwork_fn
    - rxrpc: Fix data-race warning and potential load/store tearing
    - ksmbd: smbd: fix dma_unmap_sg() nents (CVE-2026-23093)
    - mm/kfence: randomize the freelist on initialization
    - wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode
      (CVE-2024-58096)
    - Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)"
    - btrfs: prevent use-after-free on folio private data in
      btrfs_subpage_clear_uptodate()
    - net/sched: act_ife: convert comma to semicolon
    - [arm64] pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and
      SWR TX pins
    - mptcp: avoid dup SUB_CLOSED events after disconnect
    - perf: Simplify get_perf_callchain() user logic
    - perf: sched: Fix perf crash with new is_user_task() helper
    - writeback: fix 100% CPU usage when dirtytime_expire_interval is 0
    - drm/amdgpu/gfx11: adjust KGQ reset sequence
    - [arm64] pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver
    - net: mana: Change the function signature of mana_get_primary_netdev_rcu
    - RDMA/mana_ib: Handle net event for pointing to the current netdev

[ Macpaul Lin ]
  * udeb: Add USB TYPE-C and Mux modules in usb-modules (Closes: #1109090)

[ Salvatore Bonaccorso ]
  * fs/nfsd: Enable NFSD_SCSILAYOUT (NFSv4.1 server support for pNFS SCSI
    layouts)
  * [rt] Update to 6.12.66-rt15

-- Salvatore Bonaccorso <carnil@debian.org>  Sun, 08 Feb 2026 08:58:22 +0100

linux (6.12.63-1~bpo12+1) bookworm-backports; urgency=medium

* Rebuild for bookworm-backports

-- Ben Hutchings <benh@debian.org>  Fri, 02 Jan 2026 17:55:03 +0100

linux (6.12.63-1) trixie; urgency=medium

* New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.58
    - NFSD: Fix crash in nfsd4_read_release()
    - net: usb: asix_devices: Check return value of usbnet_get_endpoints
    - fbcon: Set fb_display[i]->mode to NULL when the mode is released
    - fbdev: atyfb: Check if pll_ops->init_pll failed
    - ACPI: video: Fix use-after-free in acpi_video_switch_brightness()
    - ACPI: button: Call input_free_device() on failing input device
      registration
    - virtio-net: drop the multi-buffer XDP packet in zerocopy
    - fbdev: bitblit: bound-check glyph index in bit_putcs*
    - Bluetooth: rfcomm: fix modem control handling
    - wifi: brcmfmac: fix crash while sending Action Frames in standalone AP
      Mode
    - mptcp: drop bogus optimization in __mptcp_check_push()
    - mptcp: restore window probe
    - [arm64] ASoC: qdsp6: q6asm: do not sleep while atomic
    - [s390x] pci: Restore IRQ unconditionally for the zPCI device
    - smb: client: fix potential cfid UAF in smb2_query_info_compound
    - [amd64] x86/fpu: Ensure XFD state on signal delivery
    - wifi: ath10k: Fix memory leak on unsupported WMI command
    - wifi: ath11k: Add missing platform IDs for quirk table
    - wifi: ath12k: free skb during idr cleanup callback
    - wifi: ath11k: add support for MU EDCA
    - wifi: ath11k: avoid bit operation on key flags
    - [arm64] drm/msm/a6xx: Fix GMU firmware parser
    - ALSA: usb-audio: fix control pipe direction
    - wifi: mac80211: don't mark keys for inactive links as uploaded
    - wifi: mac80211: fix key tailroom accounting leak
    - bpf: Sync pending IRQ work before freeing ring buffer
    - scsi: ufs: core: Initialize value of an attribute returned by uic cmd
    - bpf: Find eligible subprogs for private stack support
    - bpf, x86: Avoid repeated usage of bpf_prog->aux->stack_depth
    - bpf: Do not audit capability check in do_jit()
    - [amd64] ASoC: Intel: avs: Unprepare a stream when XRUN occurs
    - [amd64] ASoC: Intel: avs: Disable periods-elapsed work when closing PCM
    - [arm64,armhf] ASoC: fsl_sai: fix bit order for DSD format
    - libbpf: Fix powerpc's stack register definition in bpf_tracing.h
    - usbnet: Prevents free active kevent
    - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once
    - Bluetooth: ISO: Update hci_conn_hash_lookup_big for Broadcast slave
    - Bluetooth: ISO: Fix BIS connection dst_type handling
    - Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset
    - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00
    - Bluetooth: ISO: Fix another instance of dst_type handling
    - Bluetooth: hci_core: Fix tracking of periodic advertisement
    - [arm64,armhf] drm/etnaviv: fix flush sequence logic
    - [arm64] net: hns3: return error code when function fails
    - sfc: fix potential memory leak in efx_mae_process_mport()
    - dpll: spec: add missing module-name and clock-id to pin-get reply
    - [arm64,armhf] ASoC: fsl_sai: Fix sync error in consumer mode
    - drm/radeon: Do not kfree() devres managed rdev
    - drm/radeon: Remove calls to drm_put_dev()
    - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table()
    - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji
    - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland
    - ACPI: fan: Use ACPI handle when retrieving _FST
    - block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL
    - block: make REQ_OP_ZONE_OPEN a write operation
    - regmap: slimbus: fix bus_context pointer in regmap init calls
    - [s390x] mm: Fix memory leak in add_marker() when kvrealloc() fails
    - drm/xe: Do not wake device during a GT reset
    - drm/sysfb: Do not dereference NULL pointer in plane reset
    - drm/sched: avoid killing parent entity on child SIGKILL
    - drm/nouveau: Fix race in nouveau_sched_fini()
    - [arm64] drm/mediatek: Fix device use-after-free on unbind
    - drm/amd: Check that VPE has reached DPM0 in idle handler
    - drm/amd/display: Fix incorrect return of vblank enable on unconfigured
      crtc (Closes: #1000966)
    - ACPI: fan: Add fan speed reporting for fans with only _FST
    - ACPI: fan: Use platform device for devres-related actions
    - sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU
    - cpuidle: governors: menu: Rearrange main loop in menu_select()
    - cpuidle: governors: menu: Select polling state in some more cases
    - [amd64] mfd: kempld: Switch back to earlier ->init() behavior
    - [amd64] x86/CPU/AMD: Add RDSEED fix for Zen5
    - usb: gadget: f_fs: Fix epfile null pointer access after ep enable.
    - drm/sched: Optimise drm_sched_entity_push_job
    - drm/sched: Re-group and rename the entity run-queue lock
    - drm/sched: Fix race in drm_sched_entity_select_rq()
    - [s390x] pci: Avoid deadlock between PCI error recovery and mlx5 crdump
    - [s390x] Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP
    - [armhf] soc: aspeed: socinfo: Add AST27xx silicon IDs
    - [arm64] firmware: qcom: scm: preserve assign_mem() error return value
    - [arm64] soc: qcom: smem: Fix endian-unaware access of num_entries
    - [arm64] soc: ti: pruss: don't use %pK through printk
    - bpf: Don't use %pK through printk
    - pinctrl: single: fix bias pull up/down handling in pin_config_set
    - [arm64] mmc: host: renesas_sdhi: Fix the actual clock
    - memstick: Add timeout to prevent indefinite waiting
    - [arm64,armhf] cpufreq: ti: Add support for AM62D2
    - bpf: Use tnums for JEQ/JNE is_branch_taken logic
    - firewire: ohci: move self_id_complete tracepoint after validating register
    - [riscv64] irqchip/sifive-plic: Respect mask state when setting affinity
    - io_uring/zctx: check chained notif contexts
    - ACPI: sysfs: Use ACPI_FREE() for freeing an ACPI object
    - ACPI: video: force native for Lenovo 82K8
    - libbpf: Fix USDT SIB argument handling causing unrecognized register error
    - cpufreq/longhaul: handle NULL policy in longhaul_exit
    - [arm64,armhf] irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment
    - ACPI: PRM: Skip handlers with NULL handler_address or NULL VA
    - ACPI: resource: Skip IRQ override on ASUS Vivobook Pro N6506CU
    - ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[]
    - thermal: gov_step_wise: Allow cooling level to be reduced earlier
    - power: supply: qcom_battmgr: add OOI chemistry
    - [amd64] hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based
      models
    - [amd64] hwmon: (k10temp) Add device ID for Strix Halo
    - power: supply: sbs-charger: Support multiple devices
    - cpufreq: ondemand: Update the efficient idle check for Intel extended
      Families
    - [arm64,armhf] soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups
    - [arm64] firmware: qcom: tzmem: disable sc7180 platform
    - [arm64] mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card
    - pwm: pca9685: Use bulk write to atomicially update registers
    - ACPICA: dispatcher: Use acpi_ds_clear_operands() in
      acpi_ds_call_control_method()
    - [amd64,arm64] tee: allow a driver to allocate a tee_device without a pool
    - nvmet-fc: avoid scheduling association deletion twice
    - nvme-fc: use lock accessing port_state and rport state
    - bpf: Do not limit bpf_cgroup_from_id to current's namespace
    - i3c: mipi-i3c-hci-pci: Add support for Intel Wildcat Lake-U I3C
    - video: backlight: lp855x_bl: Set correct EPROM start for LP8556
    - tools/cpupower: fix error return value in cpupower_write_sysfs()
    - power: supply: qcom_battmgr: handle charging state change notifications
    - bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21
    - cpuidle: Fail cpuidle device registration if there is one already
    - futex: Don't leak robust_list pointer on exec race
    - ACPI: SPCR: Support Precise Baud Rate field
    - blk-cgroup: fix possible deadlock while configuring policy
    - [riscv64] bpf: Fix uninitialized symbol 'retval_off'
    - bpf: Clear pfmemalloc flag when freeing all fragments
    - nvme: Use non zero KATO for persistent discovery connections
    - uprobe: Do not emulate/sstep original instruction when ip is changed
    - [amd64] hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex
    - [amd64] hwmon: (dell-smm) Remove Dell Precision 490 custom config data
    - tools/cpupower: Fix incorrect size in cpuidle_state_disable()
    - tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage
    - tools/power x86_energy_perf_policy: Enhance HWP enable
    - tools/power x86_energy_perf_policy: Prefer driver HWP limits
    - [armhf] mfd: stmpe: Remove IRQ domain upon removal
    - [armhf] mfd: stmpe-i2c: Add missing MODULE_LICENSE
    - [riscv64] mfd: da9063: Split chip variant reading in two bus transactions
    - mfd: core: Increment of_node's refcount before linking it to the platform
      device
    - [amd64] mfd: intel-lpss: Add Intel Wildcat Lake LPSS PCI IDs
    - drm/amd/display: fix condition for setting timing_adjust_pending
    - drm/amd/display: ensure committing streams is seamless
    - drm/amdgpu: add range check for RAS bad page address
    - drm/amdgpu: Check vcn sram load return value
    - drm/amd/display: Move setup_stream_attribute
    - drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration
    - drm/xe/guc: Add more GuC load error status codes
    - drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test.
    - drm/amdgpu: Avoid rma causes GPU duplicate reset
    - drm/amd/amdgpu: Release xcp drm memory after unplug
    - drm/amdgpu: Skip poison aca bank from UE channel
    - drm/amd/display: add more cyan skillfish devices
    - drm/amd/display: update dpp/disp clock from smu clock table
    - drm/amd/pm: Use cached metrics data on aldebaran
    - drm/amd/pm: Use cached metrics data on arcturus
    - drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff
    - drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf()
    - [arm64] ASoC: mediatek: Use SND_JACK_AVOUT for HDMI/DP jacks
    - drm/amd/display: Reset apply_eamless_boot_optimization when dpms_off
    - drm/amd/display: Wait until OTG enable state is cleared
    - PCI: Disable MSI on RDC PCI to PCIe bridges
    - wifi: rtw89: print just once for unknown C2H events
    - wifi: rtw88: sdio: use indirect IO for device registers before power-on
    - drm/amdkfd: return -ENOTTY for unsupported IOCTLs
    - media: pci: ivtv: Don't create fake v4l2_fh
    - [arm64] drm/tidss: Use the crtc_* timings when programming the HW
    - [arm64] drm/tidss: Set crtc modesetting parameters with adjusted mode
    - PCI/ERR: Update device error_state already after reset
    - [amd64] x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall
    - net: stmmac: Check stmmac_hw_setup() in stmmac_resume()
    - ice: Don't use %pK through printk or tracepoints
    - thunderbolt: Use is_pciehp instead of is_hotplug_bridge
    - tty: serial: ip22zilog: Use platform device for probing
    - [powerpc*] eeh: Use result of error_detected() in uevent
    - [s390x] pci: Use pci_uevent_ers() in PCI recovery
    - bridge: Redirect to backup port when port is administratively down
    - net: ipv6: fix field-spanning memcpy warning in AH output
    - media: imon: make send_packet() more robust
    - [arm64] drm/panthor: Serialize GPU cache flush operations
    - HID: pidff: Use direction fix only for conditional effects
    - HID: pidff: PERMISSIVE_CONTROL quirk autodetection
    - [arm64,armhf] drm/bridge: display-connector: don't set OP_DETECT for
      DisplayPorts
    - drm/amdgpu: fix nullptr err of vm_handle_moved
    - drm/amdkfd: Handle lack of READ permissions in SVM mapping
    - iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before
      setting register
    - iio: adc: imx93_adc: load calibrated values even calibration failed
    - usb: gadget: f_ncm: Fix MAC assignment NCM ethernet
    - wifi: rtw89: wow: remove notify during WoWLAN net-detect
    - wifi: rtw89: fix BSSID comparison for non-transmitted BSSID
    - dm error: mark as DM_TARGET_PASSES_INTEGRITY
    - char: misc: Make misc_register() reentry for miscdevice who wants dynamic
      minor
    - char: misc: Does not request module for miscdevice with dynamic minor
    - net: When removing nexthops, don't call synchronize_net if it is not
      necessary
    - net: stmmac: Correctly handle Rx checksum offload errors
    - net: Call trace_sock_exceed_buf_limit() for memcg failure with
      SK_MEM_RECV.
    - f2fs: fix to detect potential corrupted nid in free_nid_list
    - PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call
    - bnxt_en: Add Hyper-V VF ID
    - tty: serial: Modify the use of dev_err_probe()
    - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units
    - [amd64,arm64] idpf: do not linearize big TSO packets
    - rds: Fix endianness annotation for RDS_MPATH_HASH
    - media: ipu6: isys: Set embedded data type correctly for metadata formats
    - rpmsg: char: Export alias for RPMSG ID rpmsg-raw from table
    - net: ipv4: allow directed broadcast routes to use dst hint
    - scsi: mpi3mr: Fix I/O failures during controller reset
    - scsi: mpi3mr: Fix controller init failure on fault during queue creation
    - scsi: pm80xx: Fix race condition caused by static variables
    - remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper
    - net: phy: fixed_phy: let fixed_phy_unregister free the phy_device
    - fuse: zero initialize inode private data
    - drm/amdgpu: Correct the counts of nr_banks and nr_errors
    - drm/amdkfd: fix vram allocation failure for a special case
    - drm/amd/display: Support HW cursor 180 rot for any number of pipe splits
    - drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption
    - [amd64] platform/x86/intel-uncore-freq: Fix warning in partitioned system
    - media: fix uninitialized symbol warnings
    - media: pci: mgb4: Fix timings comparison in VIDIOC_S_DV_TIMINGS
    - [amd64] ASoC: SOF: ipc4-pcm: Add fixup for channels
    - drm/amd/display: Increase minimum clock for TMDS 420 with pipe splitting
    - drm/amd/display: incorrect conditions for failing dto calculations
    - drm/amdgpu: Avoid vcn v5.0.1 poison irq call trace on sriov guest
    - drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2)
    - inet_diag: annotate data-races in inet_diag_bc_sk()
    - tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check()
    - [amd64] crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof()
    - scsi: pm8001: Use int instead of u32 to store error codes
    - [arm64] scsi: ufs: exynos: fsd: Gate ref_clk and put UFS device in reset
      on suspend
    - ptp: Limit time setting of PTP clocks
    - dmaengine: sh: setup_xref error handling
    - [arm64,armhf] dmaengine: mv_xor: match alloc_wc and free_wc
    - [arm64] drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL
    - [arm64] drm/msm/dsi/phy_7nm: Fix missing initial VCO rate
    - drm/amdgpu: Allow kfd CRIU with no buffer objects
    - drm/xe/guc: Increase GuC crash dump buffer size
    - ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled
    - [arm64] drm/panthor: check bo offset alignment in vm bind
    - drm: panel-backlight-quirks: Make EDID match optional
    - net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms
    - media: adv7180: Add missing lock in suspend callback
    - media: adv7180: Do not write format to device in set_fmt
    - media: adv7180: Only validate format in querystd
    - [arm64,armhf] media: verisilicon: Explicitly disable selection api ioctls
      for decoders
    - wifi: mac80211: Fix 6 GHz Band capabilities element advertisement in lower
      bands
    - ALSA: usb-audio: apply quirk for MOONDROP Quark2
    - [arm64,armhf] PCI: imx6: Enable the Vaux supply if available
    - drm/xe/guc: Set upper limit of H2G retries over CTB
    - net: call cond_resched() less often in __release_sock()
    - smsc911x: add second read of EEPROM mac when possible corruption seen
    - [amd64] iommu/amd: Skip enabling command/event buffers for kdump
    - [amd64] crypto: ccp: Skip SEV and SNP INIT for kdump boot
    - drm/amd: add more cyan skillfish PCI ids
    - drm/amdgpu: don't enable SMU on cyan skillfish
    - drm/amdgpu: add support for cyan skillfish gpu_info
    - drm/amd/display: Fix pbn_div Calculation Error
    - [arm64] net: dsa: felix: support phy-mode = "10g-qxgmii"
    - usb: gadget: f_hid: Fix zero length packet transfer
    - usb: cdns3: gadget: Use-after-free during failed initialization and exit
      of cdnsp gadget
    - tty/vt: Add missing return value for VT_RESIZE in vt_ioctl()
    - [arm64] drm/msm: make sure to not queue up recovery more than once
    - char: Use list_del_init() in misc_deregister() to reinitialize list
      pointer
    - PCI: endpoint: pci-epf-test: Limit PCIe BAR size for fixed BARs
    - wifi: iwlwifi: fw: Add ASUS to PPAG and TAS list
    - [amd64] media: ov08x40: Fix the horizontal flip control
    - media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer
    - f2fs: fix wrong layout information on 16KB page
    - net: phy: marvell: Fix 88e1510 downshift counter errata
    - ntfs3: pretend $Extend records as regular files
    - wifi: mac80211: Fix HE capabilities element check
    - [arm64] phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf
      register 0
    - [arm64] drm/msm/registers: Generate _HI/LO builders for reg64
    - net: sh_eth: Disable WoL if system can not suspend
    - netfilter: nf_reject: don't reply to icmp error messages
    - [amd64] x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective
      of PV_UNHALT
    - net: devmem: expose tcp_recvmsg_locked errors
    - udp_tunnel: use netdev_warn() instead of netdev_WARN()
    - HID: asus: add Z13 folio to generic group for multitouch to work
    - watchdog: s3c2410_wdt: Fix max_timeout being calculated larger
    - [arm64] crypto: sun8i-ce - remove channel timeout field
    - PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify()
    - [amd64] crypto: ccp - Fix incorrect payload size calculation in
      psp_poulate_hsti()
    - [arm64,armhf] crypto: caam - double the entropy delay interval for retry
    - net/cls_cgroup: Fix task_get_classid() during qdisc run
    - wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device
    - wifi: mt76: mt7996: Temporarily disable EPCS
    - wifi: mt76: mt76_eeprom_override to int
    - ALSA: serial-generic: remove shared static buffer
    - wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error
    - drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl
    - drm/amd/display: Set up pixel encoding for YCBCR422
    - drm/amd/display: fix dml ms order of operations
    - drm/amd: Avoid evicting resources at S5
    - drm/amd/display: Fix DVI-D/HDMI adapters
    - drm/amd/display: Disable VRR on DCE 6
    - drm/amd/display/dml2: Guard dml21_map_dc_state_into_dml_display_cfg with
      DC_FP_START
    - page_pool: always add GFP_NOWARN for ATOMIC allocations
    - ethernet: Extend device_get_mac_address() to use NVMEM
    - HID: i2c-hid: Resolve touchpad issues on Dell systems during S4
    - drm/xe/guc: Return an error code if the GuC load fails
    - drm/amdgpu: reject gang submissions under SRIOV
    - scsi: ufs: core: Disable timestamp functionality if not supported
    - scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail
    - scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted
    - scsi: lpfc: Check return status of lpfc_reset_flush_io_context during
      TGT_RESET
    - scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in
      lpfc_cleanup
    - scsi: lpfc: Define size of debugfs entry for xri rebalancing
    - scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point
      topology
    - allow finish_no_open(file, ERR_PTR(-E...))
    - usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs
    - usb: xhci: plat: Facilitate using autosuspend for xhci plat devices
    - f2fs: fix infinite loop in __insert_extent_tree()
    - wifi: rtw89: obtain RX path from ppdu status IE00
    - wifi: rtw89: renew a completion for each H2C command waiting C2H event
    - usb: xhci-pci: add support for hosts with zero USB3 ports
    - ipv6: np->rxpmtu race annotation
    - RDMA/irdma: Update Kconfig
    - IB/ipoib: Ignore L3 master device
    - jfs: Verify inode mode when loading from disk
    - jfs: fix uninitialized waitqueue in transaction manager
    - drm/amdgpu/atom: Check kcalloc() for WS buffer in
      amdgpu_atom_execute_table_locked()
    - [arm64] ASoC: qcom: sc8280xp: explicitly set S16LE format in
      sc8280xp_be_hw_params_fixup()
    - net: phy: clear link parameters on admin link down
    - bus: mhi: core: Improve mhi_sync_power_up handling for SYS_ERR state
    - [amd64] iommu/vt-d: Replace snprintf with scnprintf in
      dmar_latency_snapshot()
    - wifi: ath10k: Fix connection after GTK rekeying
    - wifi: mac80211: Track NAN interface start/stop
    - net: intel: fm10k: Fix parameter idx set but not used
    - r8169: set EEE speed down ratio to 1
    - vfio: return -ENOTTY for unsupported device feature
    - PCI/PM: Skip resuming to D0 if device is disconnected
    - remoteproc: qcom: q6v5: Avoid handling handover twice
    - wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256
    - [armhf] net: dsa: microchip: Set SPI as bus interface during reset for
      KSZ8463
    - drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream
    - drm/amd/display: Init dispclk from bootup clock for DCN314
    - drm/amd/display: Fix for test crash due to power gating
    - drm/amd/display: change dc stream color settings only in atomic commit
    - NFSv4: handle ERR_GRACE on delegation recalls
    - NFSv4.1: fix mount hang after CREATE_SESSION failure
    - nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode
      dereferencing
    - net: bridge: Install FDB for bridge MAC on VLAN 0
    - scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill()
    - [amd64] accel/habanalabs/gaudi2: fix BMON disable configuration
    - scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate
    - [amd64] accel/habanalabs: return ENOMEM if less than requested pages were
      pinned
    - [amd64] accel/habanalabs/gaudi2: read preboot status after recovering from
      dirty state
    - [amd64] accel/habanalabs: support mapping cb with vmalloc-backed coherent
      memory
    - fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock
    - ext4: increase IO priority of fastcommit
    - amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw
    - [armhf] ASoC: stm32: sai: manage context in set_sysclk callback
    - [armhf] ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007
    - ACPI: scan: Update honor list for RPMI System MSI
    - vfio/pci: Fix INTx handling on legacy non-PCI 2.3 devices
    - net/mlx5e: Don't query FEC statistics when FEC is disabled
    - net: macb: avoid dealing with endianness in macb_set_hwaddr()
    - Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames
    - Bluetooth: SCO: Fix UAF on sco_conn_free
    - Bluetooth: btusb: Add new VID/PID 13d3/3633 for MT7922
    - Bluetooth: bcsp: receive data only if registered
    - ALSA: usb-audio: add mono main switch to Presonus S1824c
    - net: stmmac: est: Drop frames causing HLBS error
    - exfat: limit log print for IO error
    - exfat: validate cluster allocation bits of the allocation bitmap
    - 6pack: drop redundant locking and refcounting
    - page_pool: Clamp pool size to max 16K pages
    - orangefs: fix xattr related buffer overflow...
    - ftrace: Fix softlockup in ftrace_module_enable
    - ksmbd: use sock_create_kern interface to create kernel socket
    - smb: client: transport: avoid reconnects triggered by pending task work
    - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr
    - usb: xhci-pci: Fix USB2-only root hub registration
    - char: misc: restrict the dynamic range to exclude reserved minors
    - drm/amd/display: Add fallback path for YCBCR422
    - ACPICA: Update dsmethod.c to get rid of unused variable warning
    - RDMA/irdma: Fix SD index calculation
    - RDMA/irdma: Remove unused struct irdma_cq fields
    - RDMA/irdma: Set irdma_cq cq_num field during CQ create
    - [arm64] RDMA/hns: Fix recv CQ and QP cache affinity
    - [arm64] RDMA/hns: Fix the modification of max_send_sge
    - [arm64] RDMA/hns: Fix wrong WQE data when QP wraps around
    - btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation
    - btrfs: mark dirty extent range for out of bound prealloc extents
    - fs/hpfs: Fix error code for new_inode() failure in
      mkdir/create/mknod/symlink
    - clk: sunxi-ng: sun6i-rtc: Add A523 specifics
    - [arm64] rtc: pcf2127: clear minute/second interrupt
    - 9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN
    - [armhf] clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled
    - [arm64] clk: scmi: Add duty cycle ops only when duty cycle is supported
    - 9p: fix /sys/fs/9p/caches overwriting itself
    - 9p: sysfs_init: don't hardcode error to ENOMEM
    - scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS
    - ACPI: property: Return present device nodes only on fwnode interface
    - tools bitmap: Add missing asm-generic/bitsperlong.h include
    - tools: lib: thermal: don't preserve owner in install
    - tools: lib: thermal: use pkg-config to locate libnl3
    - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
    - [arm64] rtc: pcf2127: fix watchdog interrupt mask on pcf2131
    - net: wwan: t7xx: add support for HP DRMR-H01
    - kbuild: uapi: Strip comments before size type check
    - [arm64,armhf] ASoC: meson: aiu-encoder-i2s: fix bit clock polarity
    - drm/amdkfd: Fix mmap write lock not release
    - ceph: add checking of wait_for_completion_killable() return value
    - ceph: fix potential race condition in ceph_ioctl_lazyio()
    - ceph: refactor wake_up_bit() pattern of calling
    - ceph: fix multifs mds auth caps issue
    - [amd64] x86: use cmov for user address masking
    - [amd64] x86/runtime-const: Add the RUNTIME_CONST_PTR assembly macro
    - [amd64] x86: uaccess: don't use runtime-const rewriting in modules
    - ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again
    - btrfs: ensure no dirty metadata is written back for an fs with errors
    - media: uvcvideo: Use heuristic to find stream entity
    - media: videobuf2: forbid remove_bufs when legacy fileio is active
    - [arm64] drm/mediatek: Disable AFBC support on Mediatek DRM driver
    - Revert "wifi: ath10k: avoid unnecessary wait for service ready message"
      (Closes: #1120680)
    - ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader
      catches up
    - [riscv64] ptdump: use seq_puts() in pt_dump_seq_puts() macro
    - Bluetooth: hci_event: validate skb length for unknown CC opcode
    - Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2()
    - [armhf] net: dsa: tag_brcm: legacy: reorganize functions
    - [armhf] net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for
      bcm63xx
    - net: vlan: sync VLAN features with lower device
    - gpio: swnode: don't use the swnode's name as the key for GPIO lookup
    - gpiolib: fix invalid pointer access in debugfs
    - [armhf] net: dsa: b53: fix resetting speed and pause on forced link
    - [armhf] net: dsa: b53: fix bcm63xx RGMII port link adjustment
    - [armhf] net: dsa: b53: fix enabling ip multicast
    - [armhf] net: dsa: b53: stop reading ARL entries if search is done
    - sctp: Hold RCU read lock while iterating over address list
    - sctp: Prevent TOCTOU out-of-bounds write
    - sctp: Hold sock lock while iterating over address list
    - net: ionic: add dma_wmb() before ringing TX doorbell
    - net: ionic: map SKB after pseudo-header checksum prep
    - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup
    - bnxt_en: Fix a possible memory leak in bnxt_ptp_init
    - bnxt_en: Add mem_valid bit to struct bnxt_ctx_mem_type
    - bnxt_en: Refactor bnxt_free_ctx_mem()
    - bnxt_en: Add a 'force' parameter to bnxt_free_ctx_mem()
    - wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup
    - net/mlx5e: Fix return value in case of module EEPROM read error
    - [arm64] net: ti: icssg-prueth: Fix fdb hash size configuration
    - net/mlx5e: SHAMPO, Fix skb size check for 64K pages
    - [armhf] net: dsa: microchip: Fix reserved multicast address table
      programming
    - net: bridge: fix use-after-free due to MST port state bypass
    - net: bridge: fix MST static key usage
    - tracing: Fix memory leaks in create_field_var()
    - drm/amd/display: Enable mst when it's detected but yet to be initialized
    - drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb
    - Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern()
    - [arm64] rtc: rx8025: fix incorrect register reference
    - [amd64] x86/microcode/AMD: Add more known models to entry sign checking
    - smb: client: validate change notify buffer before copy
    - smb: client: fix potential UAF in smb2_close_cached_fid()
    - drm/amdgpu/smu: Handle S0ix for vangogh
    - drm/amd/display: Fix NULL deref in debugfs odm_combine_segments
    - virtio-net: fix received length check in big packets
    - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC
    - scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers
    - scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel
      ADL
    - scsi: ufs: core: Add a quirk to suppress link_startup_again
    - drm/amd/display: update color on atomic commit time
    - ACPI: SPCR: Check for table version when using precise baudrate
    - drm/amdgpu: Fix unintended error log in VCN5_0_0
    - drm/amdgpu: Fix function header names in amdgpu_connectors.c
    - drm/amd/display: Fix black screen with HDMI outputs
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.59
    - [arm64] drm/mediatek: Add pm_runtime support for GCE power control
    - [amd64] drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD
    - [amd64] drm/i915: Fix conversion between clock ticks and nanoseconds
    - smb: client: fix refcount leak in smb2_set_path_attr
    - drm/amd: Fix suspend failure with secure display TA
    - drm/xe/guc: Synchronize Dead CT worker with unbind
    - drm/xe: Move declarations under conditional branch
    - drm/xe: Do clean shutdown also when using flr
    - [arm64] kprobes: check the return value of set_memory_rox()
    - [riscv64] clear hot-unplugged cores from all task mm_cpumasks to avoid
      rfence errors
    - [riscv64] acpi: avoid errors caused by probing DT devices when ACPI is
      used
    - drm/amdgpu: remove two invalid BUG_ON()s
    - drm/amd/pm: Disable MCLK switching on SI at high pixel clocks
    - drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM
    - drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices
    - NFS4: Fix state renewals missing after boot
    - NFS4: Apply delay_retrans to async operations
    - HID: quirks: avoid Cooler Master MM712 dongle wakeup bug
    - HID: nintendo: Wait longer for initial probe
    - NFS: check if suid/sgid was cleared after a write as needed
    - HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel
    - exfat: fix improper check of dentry.stream.valid_size
    - smb/server: fix possible memory leak in smb2_read()
    - smb/server: fix possible refcount leak in smb2_sess_setup()
    - HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL
    - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down
    - wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp()
    - erofs: avoid infinite loop due to incomplete zstd-compressed data
    - [arm64,armhf] net: fec: correct rx_bytes statistic for the case SHIFT16 is
      set
    - net: phy: micrel: Introduce lanphy_modify_page_reg
    - net: phy: micrel: Replace hardcoded pages with defines
    - net: phy: micrel: lan8814 fix reset of the QSGMII interface
    - NFSD: Skip close replay processing if XDR encoding fails
    - Bluetooth: MGMT: cancel mesh send timer when hdev removed
    - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF
    - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path
    - Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion
    - Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions
    - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto
    - net/smc: fix mismatch between CLC header and proposal
    - net/handshake: Fix memory leak in tls_handshake_accept()
    - tipc: Fix use-after-free in tipc_mon_reinit_self().
    - net: mdio: fix resource leak in mdiobus_register_device()
    - wifi: mac80211: skip rate verification for not captured PSDUs
    - af_unix: Initialise scc_index in unix_add_edge().
    - net_sched: act_connmark: use RCU in tcf_connmark_dump()
    - net: sched: act_connmark: initialize struct tc_ife to fix kernel leak
    - net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak
    - net/mlx5e: Fix maxrate wraparound in threshold between units
    - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps
    - net/mlx5e: Fix potentially misleading debug message
    - net_sched: limit try_bulk_dequeue_skb() batches
    - virtio-net: fix incorrect flags recording in big mode
    - hsr: Fix supervision frame sending on HSRv0
    - [amd64] ACPI: CPPC: Detect preferred core availability on online CPUs
    - [amd64] ACPI: CPPC: Check _CPC validity for only the online CPUs
    - [amd64] ACPI: CPPC: Perform fast check switch only for online CPUs
    - [amd64] ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs
    - Bluetooth: L2CAP: export l2cap_chan_hold for modules
    - acpi,srat: Fix incorrect device handle check for Generic Initiator
    - regulator: fixed: fix GPIO descriptor leak on register failure
    - [arm64] ASoC: codecs: va-macro: fix resource leak in probe error path
    - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE
    - ASoC: tas2781: fix getting the wrong device number
    - pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect()
    - pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS
    - simplify nfs_atomic_open_v23()
    - NFSv2/v3: Fix error handling in nfs_atomic_open_v23()
    - NFS: sysfs: fix leak when nfs_client kobject add fails
    - NFSv4: Fix an incorrect parameter when calling nfs4_call_sync()
    - NFS: Fix LTP test failures when timestamps are delegated
    - ALSA: usb-audio: Fix NULL pointer dereference in
      snd_usb_mixer_controls_badd
    - acpi/hmat: Fix lockdep warning for hmem_register_resource()
    - bpf: Add bpf_prog_run_data_pointers()
    - bpf: account for current allocated stack depth in
      widen_imprecise_scalars()
    - [riscv64] irqchip/riscv-intc: Add missing free() callback in
      riscv_intc_domain_ops
    - wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in
      error path
    - proc: fix the issue of proc_mem_open returning NULL
    - ext4: introduce ITAIL helper
    - ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all()
      (CVE-2025-22121)
    - Bluetooth: MGMT: Fix possible UAFs (CVE-2025-39981)
    - f2fs: fix to avoid overflow while left shift operation (CVE-2025-40077)
    - hostfs: Fix only passing host root in boot stage with new mount
    - virtio-fs: fix incorrect check for fsvq->kobj
    - fs/namespace: correctly handle errors returned by grab_requested_mnt_ns
    - sched_ext: Fix unsafe locking in the scx_dump_state()
    - Revert "netfilter: nf_tables: Reintroduce shortened deletion
      notifications"
    - netfilter: nf_tables: reject duplicate device on updates (CVE-2025-38678)
    - [arm64] dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1
    - [arm64] dts: rockchip: Make RK3588 GPU OPP table naming less generic
    - [armhf] dts: imx51-zii-rdu1: Fix audmux node names
    - HID: hid-ntrig: Prevent memory leak in ntrig_report_version()
    - HID: playstation: Fix memory leak in dualshock4_get_calibration_data()
    - HID: uclogic: Fix potential memory leak in error path
    - [amd64] KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated
    - nfsd: fix refcount leak in nfsd_set_fh_dentry() (CVE-2025-40212)
    - nfsd: add missing FATTR4_WORD2_CLONE_BLKSIZE from supported attributes
    - NFSD: free copynotify stateid in nfs4_free_ol_stateid()
    - ksmbd: close accepted socket when per-IP limit rejects connection
    - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item
    - strparser: Fix signed/unsigned mismatch bug
    - dma-mapping: benchmark: Restore padding to ensure uABI remained consistent
    - ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe
    - nilfs2: avoid having an active sc_timer before freeing sci
    - wifi: mac80211: reject address change while connecting
    - fs/proc: fix uaf in proc_readdir_de()
    - mm/mm_init: fix hash table order logging in alloc_large_system_hash()
    - mm/shmem: fix THP allocation and fallback loop
    - mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4
    - mmc: dw_mmc-rockchip: Fix wrong internal phase calculate
    - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer
    - cifs: client: fix memory leak in smb3_fs_context_parse_param
    - codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for
      slabobj_ext
    - crash: fix crashkernel resource shrink
    - smb: client: fix cifs_pick_channel when channel needs reconnect
    - spi: Try to get ACPI GPIO IRQ earlier
    - [amd64] x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev
    - ftrace: Fix BPF fexit with livepatch
    - PM: hibernate: Emit an error when image writing fails
    - PM: hibernate: Use atomic64_t for compressed_size variable
    - btrfs: zoned: fix conventional zone capacity calculation
    - btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe()
    - btrfs: do not update last_log_commit when logging inode due to a new name
    - btrfs: release root after error in data_reloc_print_warning_inode()
    - drm/amdkfd: relax checks for over allocation of save area
    - drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces
    - [arm64] pmdomain: arm: scmi: Fix genpd leak on provider registration
      failure
    - [armhf] pmdomain: imx: Fix reference count leak in imx_gpc_remove
    - [arm64,armhf] pmdomain: samsung: plug potential memleak during probe
    - mptcp: fix MSG_PEEK stream corruption
    - wifi: cfg80211: add an hrtimer based delayed work item
    - wifi: mac80211: use wiphy_hrtimer_work for csa.switch_work
    - mm, percpu: do not consider sleepable allocations atomic
    - [amd64] KVM: guest_memfd: Pass index, not gfn, to __kvm_gmem_get_pfn()
    - [amd64] KVM: guest_memfd: Remove RCU-protected attribute from
      slot->gmem.file
    - [amd64] KVM: guest_memfd: Remove bindings on memslot deletion when gmem is
      dying
    - net: netpoll: Individualize the skb pool
    - net: netpoll: flush skb pool during cleanup
    - net: netpoll: fix incorrect refcount handling causing incorrect cleanup
    - [amd64] KVM: VMX: Split out guts of EPT violation to common/exposed
      function
    - [amd64] KVM: VMX: Fix check for valid GVA on an EPT violation
    - ALSA: hda: Fix missing pointer check in hda_component_manager_init
      function (CVE-2025-40097)
    - io_uring/napi: fix io_napi_entry RCU accesses
    - uio_hv_generic: Set event for all channels on the device
      (Closes: #1120602)
    - mm/memory: do not populate page table entries beyond i_size
    - mm/truncate: unmap large folio on split failure
    - mm/secretmem: fix use-after-free race in fault handler
    - mm/huge_memory: do not change split_huge_page*() target order silently
    - mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to >0 order
    - isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe()
    - net: phy: micrel: Fix lan8814_config_init
    - net: netpoll: ensure skb_pool list is always initialized
    - proc: proc_maps_open allow proc_mem_open to return NULL
    - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete
      (CVE-2025-40213)
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.60
    - [arm64] KVM: arm64: Check the untrusted offset in FF-A memory share
    - timers: Fix NULL function pointer race in timer_shutdown_sync()
    - HID: amd_sfh: Stop sensor before starting
    - HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155
      (Closes: #1114557)
    - [arm64] dts: rockchip: fix PCIe 3.3V regulator voltage on orangepi-5
    - mtdchar: fix integer overflow in read/write ioctls
    - isofs: check the return value of sb_min_blocksize() in isofs_fill_super
    - shmem: fix tmpfs reconfiguration (remount) when noswap is set
    - exfat: check return value of sb_min_blocksize in exfat_read_boot_sector
    - mptcp: Disallow MPTCP subflows from sockmap
    - mptcp: Fix proto fallback detection with BPF
    - ata: libata-scsi: Fix system suspend for a security locked drive
    - smb: client: introduce close_cached_dir_locked()
    - ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan()
    - be2net: pass wrb_params in case of OS2BMC
    - [armhf] net: dsa: microchip: lan937x: Fix RGMII delay tuning
    - [arm64,armhf] Revert "drm/tegra: dsi: Clear enable register if powered by
      bootloader"
    - Input: cros_ec_keyb - fix an invalid memory access
    - Input: goodix - add support for ACPI ID GDIX1003
    - Input: pegasus-notetaker - fix potential out-of-bounds access
    - mm/mempool: fix poisoning order>0 pages with HIGHMEM
    - nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot
    - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl()
    - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()
    - scsi: sg: Do not sleep in atomic context
    - scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show()
    - dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups
    - mptcp: fix race condition in mptcp_schedule_work()
    - mptcp: fix ack generation for fallback msk
    - mptcp: fix duplicate reset on fastclose
    - mptcp: fix premature close in case of fallback
    - mptcp: avoid unneeded subflow-level drops
    - mptcp: decouple mptcp fastclose from tcp close
    - mptcp: do not fallback when OoO is present
    - [arm64,armhf] drm/tegra: dc: Fix reference leak in tegra_dc_couple()
    - drm/radeon: delete radeon_fence_process in is_signaled, no deadlock
    - drm/amd: Skip power ungate during suspend for VPE
    - drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled
    - drm/amd/display: Increase DPCD read retries
    - drm/amd/display: Move sleep into each retry for retrieve_link_cap()
    - drm/amd/display: Fix pbn to kbps Conversion
    - drm/amd/display: Clear the CUR_ENABLE register on DCN20 on DPP5
    - xfrm: drop SA reference in xfrm_state_update if dir doesn't match
    - xfrm: set err and extack on failure to create pcpu SA
    - xfrm: Determine inner GSO type from packet inner protocol
    - xfrm: Prevent locally generated packets from direct output in tunnel mode
    - [amd64] pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe()
    - mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats()
    - [arm64,armhf] drm/tegra: Add call to put_pid()
    - net: mlxsw: linecards: fix missing error check in
      mlxsw_linecard_devlink_info_get()
    - net: openvswitch: remove never-working support for setting nsh fields
    - nvme-multipath: fix lockdep WARN due to partition scan work
    - [s390x] ctcm: Fix double-kfree
    - [amd64] platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes
      to errnos
    - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and
      qede_tpa_end()
    - [amd64,arm64] idpf: fix possible vport_config NULL pointer deref in remove
    - ice: fix PTP cleanup on driver removal in error path
    - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy
    - net/mlx5: Clean up only new IRQ glue on request_irq() failure
    - af_unix: Cache state->msg in unix_stream_read_generic().
    - af_unix: Read sk_peek_offset() again after sleeping in
      unix_stream_read_generic().
    - cifs: fix memory leak in smb3_fs_context_parse_param error path
    - vsock: Ignore signal/timeout on connect() if already established
    - bcma: don't register devices disabled in OF
    - cifs: fix typo in enable_gcm_256 module parameter
    - scsi: core: Fix a regression triggered by scsi_host_busy()
    - [amd64] x86/microcode/AMD: Limit Entrysign signature checking to known
      generations
    - net: tls: Change async resync helpers argument
    - blk-crypto: use BLK_STS_INVAL for alignment errors
    - net: tls: Cancel RX async resync request on rcd_delta overflow
    - ALSA: usb-audio: Fix missing unlock at error path of maxpacksize check
    - [arm64] KVM: arm64: Make all 32bit ID registers fully writable
    - drm/xe: Prevent BIT() overflow when handling invalid prefetch region
    - [s390x] mm: Fix __ptep_rdp() inline assembly
    - ALSA: usb-audio: fix uac2 clock source at terminal parser
    - tracing/tools: Fix incorrcet short option in usage text for --threads
    - drm/amdgpu: fix gpu page fault after hibernation on PF passthrough
    - smb: client: fix incomplete backport in cfids_invalidation_worker()
    - tty/vt: fix up incorrect backport to stable releases
    - maple_tree: fix tracepoint string pointers
    - [amd64] drm/i915/dp_mst: Disable Panel Replay
    - mptcp: fix a race in mptcp_pm_del_add_timer()
    - xfs: Replace strncpy with memcpy
    - xfs: fix out of bounds memory read error in symlink repair
    - drm/amd/display: avoid reset DTBCLK at clock init
    - drm/amd/display: disable DPP RCG before DPP CLK enable
    - drm/amd/display: Insert dccg log for easy debug
    - drm/amd/display: Prevent Gating DTBCLK before It Is Properly Latched
    - Revert "gpio: swnode: don't use the swnode's name as the key for GPIO
      lookup"
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.61
    - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers
    - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted
      URBs
    - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before
      accessing header
    - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before
      accessing data
    - Bluetooth: btusb: mediatek: Fix kernel crash when releasing mtk iso
      interface
    - Bluetooth: hci_core: Fix triggering cmd_timer for HCI_OP_NOP
    - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind
    - Bluetooth: SMP: Fix not generating mackey and ltk when repairing
    - net: sched: generalize check for no-queue qdisc on TX queue
    - veth: apply qdisc backpressure on full ptr_ring to reduce TX drops
    - veth: prevent NULL pointer dereference in veth_xdp_rcv
    - veth: more robust handing of race to avoid txq getting stuck
    - veth: reduce XDP no_direct return section to fix race
    - [amd64] platform/x86: intel: punit_ipc: fix memory corruption
    - net: aquantia: Add missing descriptor cache invalidation on ATL2
    - net: lan966x: Fix the initialization of taprio
    - drm/xe: Fix conversion from clock ticks to milliseconds
    - net/mlx5e: Fix validation logic in rate limiting
    - team: Move team device type change at the end of team_port_add
    - drm/amdgpu: fix cyan_skillfish2 gpu info fw handling
    - net: wwan: mhi: Keep modem name match with Foxconn T99W640
    - net: atlantic: fix fragment overflow handling in RX path
    - [arm64,armhf] net: fec: cancel perout_timer when PEROUT is disabled
    - [arm64,armhf] net: fec: do not update PEROUT if it is enabled
    - [arm64,armhf] net: fec: do not allow enabling PPS and PEROUT
      simultaneously
    - [arm64,armhf] net: fec: do not register PPS event for PEROUT
    - iio: st_lsm6dsx: Fixed calibrated timestamp calculation
    - [arm64] mailbox: mtk-cmdq: Refine DMA address handling for the command
      buffer
    - mailbox: pcc: Refactor error handling in irq handler into separate
      function
    - mailbox: pcc: don't zero error register
    - fs/namespace: fix reference leak in grab_requested_mnt_ns
    - spi: spi-mem: Allow specifying the byte order in Octal DTR mode
    - spi: spi-mem: Extend spi-mem operations with a per-operation maximum
      frequency
    - spi: spi-mem: Add a new controller capability
    - [arm64] spi: nxp-fspi: Support per spi-mem operation frequency switches
    - [arm64] spi: spi-nxp-fspi: remove the goto in probe
    - [arm64] spi: spi-nxp-fspi: Add OCT-DTR mode support
    - [arm64] spi: nxp-fspi: Propagate fwnode in ACPI case as well
    - Revert "drm/amd/display: Move setup_stream_attribute"
    - [amd64] Revert "perf/x86: Always store regs->ip in
      perf_callchain_kernel()"
    - iio: buffer-dma: support getting the DMA channel
    - iio: buffer-dmaengine: enable .get_dma_dev()
    - iio: buffer: support getting dma channel from the buffer
    - iio: accel: bmc150: Fix irq assumption regression (Closes: #1106411)
    - tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs
    - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230
    - [arm64] dts: imx8qm-mek: fix mux-controller select/enable-gpios polarity
    - Bluetooth: btusb: mediatek: Avoid btusb_mtk_claim_iso_intf() NULL deref
    - can: sja1000: fix max irq loop handling
    - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling
    - ceph: fix crash in process_v2_sparse_read() for encrypted directories
    - dm-verity: fix unreliable memory allocation
    - drivers/usb/dwc3: fix PCI parent check
    - smb: client: fix memory leak in cifs_construct_tcon()
    - [amd64] thunderbolt: Add support for Intel Wildcat Lake
    - [arm64] slimbus: ngd: Fix reference count leak in
      qcom_slim_ngd_notify_slaves
    - nvmem: layouts: fix nvmem_layout_bus_uevent
    - firmware: stratix10-svc: fix bug in saving controller data
    - mm/memfd: fix information leak in hugetlb folios
    - mmc: sdhci-of-dwcmshc: Promote the th1520 reset handling to ip level
    - mptcp: clear scheduled subflows on retransmit
    - mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in
      mptcp_do_fastclose().
    - [arm*] serial: amba-pl011: prefer dma_mapping_error() over explicit
      address checking
    - usb: cdns3: Fix double resource release in cdns3_pci_probe
    - usb: gadget: f_eem: Fix memory leak in eem_unwrap
    - usb: storage: Fix memory leak in USB bulk transport
    - USB: storage: Remove subclass and protocol overrides from Novatek quirk
    - usb: storage: sddr55: Reject out-of-bound new_pba
    - usb: uas: fix urb unmapping issue when the uas device is remove during
      ongoing data transfer
    - [amd64,arm64] usb: dwc3: pci: add support for the Intel Nova Lake -S
    - [amd64,arm64] usb: dwc3: pci: Sort out the Intel device IDs
    - [amd64,arm64] usb: dwc3: Fix race condition between concurrent
      dwc3_remove_requests() call paths
    - xhci: fix stale flag preventig URBs after link state error is cleared
    - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host
    - xhci: dbgtty: fix device unregister
    - USB: serial: ftdi_sio: add support for u-blox EVK-M101
    - USB: serial: option: add support for Rolling RW101R-GL
    - drm: sti: fix device leaks at component probe
    - drm/amd/amdgpu: reserve vm invalidation engine for uni_mes
    - drm/amd/display: Check NULL before accessing
    - drm/amd/display: Don't change brightness for disabled connectors
    - [armhf] net: dsa: microchip: common: Fix checks on irq_find_mapping()
    - [armhf] net: dsa: microchip: ptp: Fix checks on irq_find_mapping()
    - [armhf] net: dsa: microchip: Don't free uninitialized ksz_irq
    - libceph: fix potential use-after-free in have_mon_and_osd_map()
    - libceph: prevent potential out-of-bounds writes in
      handle_auth_session_key()
    - libceph: replace BUG_ON with bounds check for map->max_osd
    - staging: rtl8712: Remove driver using deprecated API wext
    - nfsd: Replace clamp_t in nfsd4_get_drc_mem()
    - usb: typec: ucsi: psy: Set max current to zero when disconnected
    - usb: udc: Add trace event for usb_gadget_set_state
    - usb: gadget: udc: fix use-after-free in usb_gadget_state_work
    - mm/huge_memory: fix NULL pointer deference when splitting folio
    - [amd64] KVM: SVM: Introduce svm_recalc_lbr_msr_intercepts()
    - [amd64] KVM: nSVM: Always recalculate LBR MSR intercepts in
      svm_update_lbrv()
    - [amd64] KVM: nSVM: Fix and simplify LBR virtualization handling with
      nested
    - [amd64] KVM: SVM: Fix redundant updates of LBR MSR intercepts
    - drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup
    - [armhf] net: dsa: microchip: Do not execute PTP driver code for
      unsupported switches
    - [armhf] net: dsa: microchip: Free previously initialized ports on init
      failures
    - wifi: ath12k: correctly handle mcast packets for clients
    - Revert "ACPI: Suppress misleading SPCR console message when SPCR table is
      absent"
    - [amd64] drm/i915/dp: Initialize the source OUI write timestamp always
    - [arm64] spi: spi-nxp-fspi: Check return value of devm_mutex_init()
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.62
    - xfrm: delete x->tunnel as we delete x
    - Revert "xfrm: destroy xfrm_state synchronously on net exit path"
    - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that
      were never added
    - xfrm: flush all states in xfrm_state_fini
    - Documentation: process: Also mention Sasha Levin as stable tree maintainer
    - jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system
      corrupted
    - ext4: refresh inline data size before write operations
    - ksmbd: ipc: fix use-after-free in ipc_msg_send_request
    - ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock()
    - [amd64] KVM: SVM: Don't skip unrelated instruction if INT3/INTO is
      replaced
    - USB: serial: option: add Foxconn T99W760
    - USB: serial: option: add Telit Cinterion FE910C04 new compositions
    - USB: serial: option: move Telit 0x10c7 composition in the right place
    - USB: serial: ftdi_sio: match on interface number for jtag
    - serial: add support of CPCI cards
    - USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC
    - USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC
    - ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct()
    - [arm64,armhf] ipi: imx: keep dma request disabled before dma transfer
      setup
    - drm/vmwgfx: Use kref in vmw_bo_dirty
    - Bluetooth: btrtl: Avoid loading the config file on security chips
    - smb: fix invalid username check in smb3_fs_context_parse_param()
    - drm/amdkfd: Fix GPU mappings for APU after prefetch
    - ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series
    - bfs: Reconstruct file type when loading from disk
    - HID: hid-input: Extend Elan ignore battery quirk to USB
    - nvme: fix admin request_queue lifetime
    - [arm64] pinctrl: qcom: msm: Fix deadlock in pinmux configuration
    - [amd64] platform/x86: acer-wmi: Ignore backlight event
    - HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list
    - [amd64] platform/x86: huawei-wmi: add keys for HONOR models
    - [amd64] platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list
    - [amd64] platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally
    - HID: elecom: Add support for ELECOM M-XT3URBK (018F)
    - wifi: rtl8xxxu: Add USB ID 2001:3328 for D-Link AN3U rev. A1
    - wifi: rtw88: Add USB ID 2001:3329 for D-Link AC13U rev. A1
    - [amd64] comedi: check device's attached status in compat ioctls
    - staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser
    - staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing
    - staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing
    - bus: mhi: host: pci_generic: Add Telit FN920C04 modem support
    - bus: mhi: host: pci_generic: Add Telit FN990B40 modem support
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.63
    - [arm64,armhf] gpu: host1x: Fix race in syncpt alloc/free
    - [amd64] accel/ivpu: Prevent runtime suspend during context abort work
    - [amd64] accel/ivpu: Ensure rpm_runtime_put in case of engine reset/resume
      fail
    - [amd64] accel/ivpu: Make function parameter names consistent
    - [amd64] accel/ivpu: Fix DCT active percent format
    - drm/vgem-fence: Fix potential deadlock on release
    - USB: Fix descriptor count when handling invalid MBIM extended descriptor
    - [arm64] pinctrl: renesas: rzg2l: Fix PMC restore
    - [arm64] clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle
      callback
    - [arm64] clk: renesas: Use str_on_off() helper
    - [arm64] clk: renesas: Pass sub struct of cpg_mssr_priv to cpg_clk_register
    - [arm64] clk: renesas: cpg-mssr: Read back reset registers to assure values
      latched
    - HID: logitech-hidpp: Do not assume FAP in hidpp_send_message_sync()
    - objtool: Fix standalone --hacks=jump_label
    - objtool: Fix weak symbol detection
    - wifi: ath10k: Avoid vdev delete timeout when firmware is already down
    - wifi: ath10k: Add missing include of export.h
    - wifi: ath10k: move recovery check logic into a new work
    - wifi: ath11k: restore register window after global reset
    - sched/fair: Forfeit vruntime on yield
    - [arm*] irqchip/irq-brcmstb-l2: Fix section mismatch
    - [arm64,armhf] irqchip/imx-mu-msi: Fix section mismatch
    - [arm64] irqchip/renesas-rzg2l: Fix section mismatch
    - [riscv64] irqchip/starfive-jh8100: Fix section mismatch
    - [arm64] irqchip/qcom-irq-combiner: Fix section mismatch
    - crypto: authenc - Correctly pass EINPROGRESS back up to the caller
    - ntfs3: fix uninit memory after failed mi_read in mi_format_new
    - ntfs3: Fix uninit buffer allocated by __getname()
    - dt-bindings: clock: qcom,x1e80100-gcc: Add missing video resets
    - dt-bindings: clock: qcom,x1e80100-gcc: Add missing USB4 clocks/resets
    - clk: qcom: gcc-x1e80100: Add missing USB4 clocks/resets
    - rculist: Add hlist_nulls_replace_rcu() and hlist_nulls_replace_init_rcu()
    - inet: Avoid ehash lookup race in inet_ehash_insert()
    - inet: Avoid ehash lookup race in inet_twsk_hashdance_schedule()
    - firmware: qcom: tzmem: fix qcom_tzmem_policy kernel-doc
    - block/mq-deadline: Introduce dd_start_request()
    - block/mq-deadline: Switch back to a single dispatch list
    - [arm64] dts: freescale: imx8mp-venice-gw7905-2x: remove duplicate usdhc1
      props
    - [arm64] dts: imx8mm-venice-gw72xx: remove unused sdhc1 pinctrl
    - [arm64] dts: imx8mp-venice-gw702x: remove off-board uart
    - [arm64] dts: imx8mp-venice-gw702x: remove off-board sdhc1
    - perf annotate: Check return value of evsel__get_arch() properly
    - [arm64] dts: exynos: gs101: fix sysreg_apm reg property
    - uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe
    - soc: Switch back to struct platform_driver::remove()
    - [arm64] soc: qcom: gsbi: fix double disable caused by devm
    - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id
    - wifi: ath11k: fix VHT MCS assignment
    - wifi: ath11k: fix peer HE MCS assignment
    - [s390x] smp: Fix fallback CPU detection
    - [s390x] ap: Don't leak debug feature files if AP instructions are not
      available
    - [arm64] dts: ti: k3-am62p: Fix memory ranges for GPU
    - firmware: imx: scu-irq: fix OF node leak in
    - [arm64] dts: qcom: x1e80100: Fix compile warnings for USB HS controller
    - [arm64] dts: qcom: x1e80100: Add missing quirk for HS only USB controller
    - [arm64] dts: qcom: sdm845-oneplus: Correct gpio used for slider
    - [arm64] dts: qcom: sm8650: set ufs as dma coherent
    - [arm64] dts: qcom: qcm6490-shift-otter: Add missing reserved-memory
    - phy: mscc: Fix PTP for VSC8574 and VSC8572
    - sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock().
    - RDMA/rxe: Fix null deref on srq->rq.queue after resize failure
    - Revert "mtd: rawnand: marvell: fix layouts"
    - [arm64,armhf] mtd: nand: relax ECC parameter validation check
    - perf: Remove get_perf_callchain() init_nr argument
    - bpf: Refactor stack map trace depth calculation into helper function
    - bpf: Fix stackmap overflow check in __bpf_get_stackid()
    - [amd64] perf/x86/intel/cstate: Remove PC3 support from LunarLake
    - task_work: Fix NMI race condition
    - [amd64] x86/dumpstack: Prevent KASAN false positive warnings in
      __show_regs()
    - tools/nolibc/stdio: let perror work when NOLIBC_IGNORE_ERRNO is set
    - [arm64] soc: qcom: smem: fix hwspinlock resource leak in probe error paths
    - [armhf] pinctrl: stm32: fix hwspinlock resource leak in probe function
    - i3c: fix refcount inconsistency in i3c_master_register
    - i3c: master: svc: Prevent incomplete IBI transaction
    - wifi: ath12k: fix potential memory leak in ath12k_wow_arp_ns_offload()
    - [arm64] interconnect: qcom: msm8996: add missing link to SLAVE_USB_HS
    - [arm64] dts: qcom: msm8996: add interconnect paths to USB2 controller
    - interconnect: debugfs: Fix incorrect error handling for NULL path
    - drm/imagination: Fix reference to devm_platform_get_and_ioremap_resource()
    - perf lock contention: Load kernel map before lookup
    - perf record: skip synthesize event when open evsel failed
    - power: supply: rt5033_charger: Fix device node reference leaks
    - power: supply: cw2015: Check devm_delayed_work_autocancel() return code
    - power: supply: max17040: Check iio_read_channel_processed() return code
    - power: supply: rt9467: Return error on failure in
      rt9467_set_value_from_ranges()
    - power: supply: rt9467: Prevent using uninitialized local variable in
      rt9467_set_value_from_ranges()
    - power: supply: wm831x: Check wm831x_set_bits() return value
    - power: supply: apm_power: only unset own apm_get_power_status
    - scsi: target: Do not write NUL characters into ASCII configfs output
    - fs/9p: Don't open remote file with APPEND mode when writeback cache is
      used
    - [arm64] drm/panthor: Handle errors returned by drm_sched_entity_init()
    - [arm64] drm/panthor: Fix group_free_queue() for partially initialized
      queues
    - [arm64] drm/panthor: Fix UAF race between device unplug and FW event
      processing
    - [arm64] drm/panthor: Fix race with suspend during unplug
    - [arm64] drm/panthor: Fix UAF on kernel BO VA nodes
    - libbpf: Fix parsing of multi-split BTF
    - [armhf] dts: am335x-netcom-plus-2xx: add missing GPIO labels
    - [armhf] dts: omap3: beagle-xm: Correct obsolete TWL4030 power compatible
    - [armhf] dts: omap3: n900: Correct obsolete TWL4030 power compatible
    - [amd64] x86/boot: Fix page table access in 5-level to 4-level paging
      transition
    - efi/libstub: Fix page table access in 5-level to 4-level paging transition
    - ext4: correct the checking of quota files before moving extents
    - [amd64] perf/x86/intel: Correct large PEBS flag check
    - regulator: core: disable supply if enabling main regulator fails
    - md: fix rcu protection in md_wakeup_thread
    - nbd: defer config put in recv_work
    - scsi: stex: Fix reboot_notifier leak in probe error path
    - scsi: smartpqi: Fix device resources accessed after device removal
    - dt-bindings: PCI: amlogic: Fix the register name of the DBI region
    - RDMA/rtrs: server: Fix error handling in get_or_create_srv
    - ntfs3: init run lock for extend inode
    - [arm64] drm/panthor: Fix potential memleak of vma structure
    - scsi: ufs: core: fix incorrect buffer duplication in
      ufshcd_read_string_desc()
    - [amd64] cpufreq/amd-pstate: Call cppc_set_auto_sel() only for online CPUs
    - [powerpc*] kdump: Fix size calculation for hot-removed memory ranges
    - [powerpc*] 32: Fix unpaired stwcx. on interrupt exit
    - wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper()
    - nbd: defer config unlock in nbd_genl_connect
    - coresight: Change device mode to atomic type
    - [arm64] coresight: etm4x: Correct polling IDLE bit
    - [arm64] coresight: etm4x: Extract the trace unit controlling
    - [arm64] coresight: etm4x: Add context synchronization before enabling
      trace
    - lib/vsprintf: Check pointer before dereferencing in time_and_date()
    - ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent()
    - ACPI: property: Fix fwnode refcount leak in
      acpi_fwnode_graph_parse_endpoint()
    - scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls
    - leds: netxbig: Fix GPIO descriptor leak in error paths
    - bpf: Free special fields when update [lru_,]percpu_hash maps
    - PCI: keystone: Exit ks_pcie_probe() for invalid mode
    - [arm64] dts: rockchip: Move the EEPROM to correct I2C bus on Radxa ROCK 5A
    - [arm64] dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 5A
    - [arm64] dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 3C
    - [amd64] crypto: iaa - Fix incorrect return value in save_iaa_wq()
    - [arm64] drm/msm/dpu: drop dpu_hw_dsc_destroy() prototype
    - ps3disk: use memcpy_{from,to}_bvec index
    - bpf: Handle return value of ftrace_set_filter_ip in register_fentry
    - bpf: Check skb->transport_header is set in bpf_skb_check_mtu
    - watchdog: wdat_wdt: Fix ACPI table leak in probe function
    - watchdog: starfive: Fix resource leak in probe error path
    - tracefs: fix a leak in eventfs_create_events_dir()
    - NFSD/blocklayout: Fix minlength check in proc_layoutget
    - block/blk-throttle: Fix throttle slice time for SSDs
    - [arm64] drm/msm/a2xx: stop over-complaining about the legacy firmware
    - wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring()
    - bpf: Fix invalid prog->stats access when update_effective_progs fails
    - [powerpc*] 64s/hash: Restrict stress_hpt_struct memblock region to within
      RMA limit
    - [powerpc*] 64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE
      format
    - fs/ntfs3: out1 also needs to put mi
    - fs/ntfs3: Prevent memory leaks in add sub record
    - [arm64] drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue
    - [arm64] drm/msm/a6xx: Flush LRZ cache before PT switch
    - [arm64] drm/msm/a6xx: Fix the gemnoc workaround
    - [arm64] drm/msm/a6xx: Improve MX rail fallback in RPMH vote init
    - ipv6: clear RA flags when adding a static route (Closes: #1117959)
    - pwm: bcm2835: Make sure the channel is enabled after pwm_request()
    - scsi: qla2xxx: Fix improper freeing of purex item
    - [amd64] iommu/vt-d: Fix unused invalidation hint in qi_desc_iotlb
    - wifi: mac80211: fix CMAC functions not handling errors
    - [arm64] mfd: mt6397-irq: Fix missing irq_domain_remove() in error path
    - [arm64] mfd: mt6358-irq: Fix missing irq_domain_remove() in error path
    - leds: rgb: leds-qcom-lpg: Don't enable TRILED when configuring PWM
    - [arm64] phy: renesas: rcar-gen3-usb2: Fix an error handling path in
      rcar_gen3_phy_usb2_probe()
    - [arm64] phy: rockchip: samsung-hdptx: Reduce ROPLL loop bandwidth
    - [arm64] phy: rockchip: samsung-hdptx: Prevent Inter-Pair Skew from
      exceeding the limits
    - net: phy: adin1100: Fix software power-down ready condition
    - cpuset: Treat cpusets in attaching as populated
    - wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb()
    - RAS: Report all ARM processor CPER information to userspace
    - ima: Handle error code returned by ima_filter_rule_match()
    - usb: chaoskey: fix locking for O_NONBLOCK
    - usb: dwc2: disable platform lowlevel hw resources during shutdown
    - usb: dwc2: fix hang during shutdown if set as peripheral
    - usb: dwc2: fix hang during suspend if set as peripheral
    - usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE
    - [riscv64] KVM: Fix guest page fault within HLV* instructions
    - erofs: limit the level of fs stacking for file-backed mounts
    - RDMA/bnxt_re: Fix the inline size for GenP7 devices
    - RDMA/bnxt_re: Pass correct flag for dma mr creation
    - ASoC: tas2781: correct the wrong period
    - mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add()
    - firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc
    - staging: fbtft: core: fix potential memory leak in fbtft_probe_common()
    - [arm64] iommu/arm-smmu-v3: Fix error check in arm_smmu_alloc_cd_tables
    - btrfs: fix leaf leak in an error path in btrfs_del_items()
    - PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition
    - drm/nouveau: restrict the flush page to a 32-bit address
    - iomap: factor out a iomap_dio_done helper
    - iomap: always run error completions in user context
    - wifi: ieee80211: correct FILS status codes
    - backlight: led-bl: Add devlink to supplier LEDs
    - backlight: lp855x: Fix lp855x.h kernel-doc warnings
    - [arm64] iommu/arm-smmu-qcom: Enable use of all SMR groups when running
      bare-metal
    - RDMA/irdma: Fix data race in irdma_sc_ccq_arm
    - RDMA/irdma: Fix data race in irdma_free_pble
    - RDMA/irdma: Do not directly rely on IB_PD_UNSAFE_GLOBAL_RKEY
    - [arm64] drm/panthor: Avoid adding of kernel BOs to extobj list
    - gfs2: Prevent recursive memory reclaim
    - firmware_loader: make RUST_FW_LOADER_ABSTRACTIONS select FW_LOADER
    - drm/amd/display: Fix logical vs bitwise bug in
      get_embedded_panel_info_v2_1()
    - hwmon: sy7636a: Fix regulator_enable resource leak on error path
    - ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4
    - ublk: prevent invalid access with DEBUG
    - ext4: improve integrity checking in __mb_check_buddy by enhancing order-0
      validation
    - of: Skip devicetree kunit tests when RISCV+ACPI doesn't populate root node
    - virtio_vdpa: fix misleading return in void function
    - virtio: fix typo in virtio_device_ready() comment
    - virtio: fix whitespace in virtio_config_ops
    - virtio: fix grammar in virtio_queue_info docs
    - virtio: fix virtqueue_set_affinity() docs
    - vdpa/mlx5: Fix incorrect error code reporting in query_virtqueues
    - vhost: Fix kthread worker cgroup failure handling
    - vdpa/pds: use %pe for ERR_PTR() in event handler registration
    - [amd64] ASoC: Intel: catpt: Fix error path in hw_params()
    - [armhf] dts: samsung: universal_c210: turn off SDIO WLAN chip during
      system suspend
    - [armhf] dts: samsung: exynos4210-i9100: turn off SDIO WLAN chip during
      system suspend
    - [armhf] dts: samsung: exynos4210-trats: turn off SDIO WLAN chip during
      system suspend
    - [armhf] dts: samsung: exynos4412-midas: turn off SDIO WLAN chip during
      system suspend
    - regulator: core: Protect regulator_supply_alias_list with
      regulator_list_mutex
    - resource: replace open coded resource_intersection()
    - resource: introduce is_type_match() helper and use it
    - Reinstate "resource: avoid unnecessary lookups in find_next_iomem_res()"
    - netfilter: flowtable: check for maximum number of encapsulations in bridge
      vlan
    - netfilter: nf_conncount: rework API to use sk_buff directly
    - netfilter: nft_connlimit: update the count if add was skipped
    - net: stmmac: fix rx limit check in stmmac_rx_zc()
    - vfio/pci: Use RCU for error/request triggers to avoid circular locking
    - net: phy: aquantia: check for NVMEM deferral
    - mtd: lpddr_cmds: fix signed shifts in lpddr_cmds
    - [arm64] remoteproc: qcom_q6v5_wcss: fix parsing of qcom,halt-regs
    - md/raid5: fix IO hang when array is broken with IO inflight
    - net: hsr: remove one synchronize_rcu() from hsr_del_port()
    - net: hsr: remove synchronize_rcu() from hsr_add_port()
    - net: hsr: Create and export hsr_get_port_ndev()
    - net: hsr: create an API to get hsr port type
    - net: dsa: xrs700x: reject unsupported HSR configurations
    - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop
      (CVE-2025-68325)
    - perf tools: Mark split kallsyms DSOs as loaded
    - perf tools: Fix split kallsyms DSO counting
    - perf hist: In init, ensure mem_info is put on error paths
    - [arm64,armhf] pinctrl: single: Fix incorrect type for error return
      variable
    - fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe()
    - 9p: fix cache/debug options printing in v9fs_show_options
    - sched/fair: Fix unfairness caused by stalled tg_load_avg_contrib when the
      last task migrates out
    - [amd64] platform/x86:intel/pmc: Update Arrow Lake telemetry GUID
    - f2fs: keep POSIX_FADV_NOREUSE ranges
    - f2fs: add a sysfs entry to reclaim POSIX_FADV_NOREUSE pages
    - f2fs: fix to avoid running out of free segments
    - f2fs: add carve_out sysfs node
    - f2fs: sysfs: add encoding_flags entry
    - f2fs: introduce reserved_pin_section sysfs entry
    - f2fs: add gc_boost_gc_multiple sysfs node
    - f2fs: add gc_boost_gc_greedy sysfs node
    - f2fs: maintain one time GC mode is enabled during whole zoned GC cycle
    - NFS: Avoid changing nlink when file removes and attribute updates race
    - fs/nls: Fix utf16 to utf8 conversion
    - NFS: Initialise verifiers for visible dentries in readdir and lookup
    - NFS: Initialise verifiers for visible dentries in nfs_atomic_open()
    - nfs/vfs: discard d_exact_alias()
    - NFS: Initialise verifiers for visible dentries in _nfs4_open_and_get_state
    - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid
    - Revert "nfs: ignore SB_RDONLY when remounting nfs"
    - Revert "nfs: clear SB_RDONLY before getting superblock"
    - Revert "nfs: ignore SB_RDONLY when mounting nfs"
    - NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags
    - Expand the type of nfs_fattr->valid
    - NFS: Fix inheritance of the block sizes when automounting
    - fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8()
    - [amd64] platform/x86: asus-wmi: use brightness_set_blocking() for kbd led
    - blk-mq: Abort suspend when wakeup events are pending
    - block: fix comment for op_is_zone_mgmt() to include RESET_ALL
    - block: fix memory leak in __blkdev_issue_zero_pages
    - nvme-auth: use kvfree() for memory allocated with kvcalloc()
    - drm/plane: Fix IS_ERR() vs NULL check in
      drm_plane_create_hotspot_properties()
    - regulator: fixed: Rely on the core freeing the enable GPIO
    - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events
    - drm/nouveau: refactor deprecated strcpy
    - cifs: Fix handling of a beyond-EOF DIO/unbuffered read over SMB2
    - docs: hwmon: fix link to g762 devicetree binding
    - dma/pool: eliminate alloc_pages warning in atomic_pool_expand
    - ALSA: uapi: Fix typo in asound.h comment
    - drm/amdkfd: Use huge page size to check split svm range alignment
    - rtc: gamecube: Check the return value of ioremap()
    - ALSA: firewire-motu: add bounds check in put_user loop for DSP events
    - block: Use RCU in blk_mq_[un]quiesce_tagset() instead of
      set->tag_list_lock
    - block: return unsigned int from queue_dma_alignment
    - dm-raid: fix possible NULL dereference with undefined raid type
    - dm log-writes: Add missing set_freezable() for freezable kthread
    - efi/cper: Add a new helper function to print bitmasks
    - efi/cper: Adjust infopfx size to accept an extra space
    - efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs
    - scsi: imm: Fix use-after-free bug caused by unfinished delayed work
      (CVE-2025-68324)
    - irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc()
    - ocfs2: fix memory leak in ocfs2_merge_rec_left()
    - net: lan743x: Allocate rings outside ZONE_DMA
    - net: dst: introduce dst->dev_rcu
    - tcp_metrics: use dst_dev_net_rcu() (CVE-2025-40075)
    - usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt
    - usb: phy: Initialize struct usb_phy list_head
    - usb: dwc3: dwc3_power_off_all_roothub_ports: Use ioremap_np when required
    - ALSA: dice: fix buffer overflow in detect_stream_formats()
    - ALSA: wavefront: Fix integer overflow in sample size validation

[ Uwe Kleine-König ]
  * [armhf] Enable LEDS_TURRIS_OMNIA as a module for Turris Omnia LED
    support.

[ Maxwell Pevner ]
  * drivers/hid: Enable HID_UNIVERSAL_PIDFF as module (Closes: #1122144)

-- Salvatore Bonaccorso <carnil@debian.org>  Tue, 30 Dec 2025 20:37:47 +0100

linux (6.12.57-1~bpo12+1) bookworm-backports; urgency=medium

* Rebuild for bookworm-backports

-- Ben Hutchings <benh@debian.org>  Mon, 17 Nov 2025 12:29:47 +0100

linux (6.12.57-1) trixie; urgency=medium

* New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.49
    - wifi: wilc1000: avoid buffer overflow in WID string configuration
    - nvme: fix PI insert on write
    - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not
      supported
    - wifi: mac80211: increase scan_ies_len for S1G
    - wifi: mac80211: fix incorrect type for ret
    - cgroup: split cgroup_destroy_wq into 3 workqueues
    - btrfs: fix invalid extref key setup when replaying dentry
    - net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR
    - qed: Don't collect too many protection override GRC elements
    - bonding: set random address only when slaves already exist
    - mptcp: set remote_deny_join_id0 on SYN recv
    - mptcp: tfo: record 'deny join id0' info
    - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure
    - ice: store max_frame and rx_buf_len only in ice_rx_ring
    - ice: fix Rx page leak on multi-buffer frames
    - i40e: remove redundant memory barrier when cleaning Tx descs
    - igc: don't fail igc_probe() on LED setup error
    - net/mlx5e: Harden uplink netdev access against device unbind
    - bonding: don't set oif to bond dev when getting NS target destination
    - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().
    - tls: make sure to abort the stream if headers are bogus
    - Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set"
    - net: liquidio: fix overflow in octeon_init_instr_queue()
    - cnic: Fix use-after-free bugs in cnic_delete_task
    - [arm64] octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp()
    - [amd64] perf/x86/intel: Fix crash in icl_update_topdown_event()
      (CVE-2025-38322)
    - ksmbd: smbdirect: validate data_offset and data_length field of
      smb_direct_data_transfer
    - ksmbd: smbdirect: verify remaining_data_length respects
      max_fragmented_recv_size
    - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/*
    - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
    - power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery
    - power: supply: bq27xxx: restrict no-battery detection to bq27000
    - dm-raid: don't set io_min and io_opt for raid1
    - dm-stripe: fix a possible integer overflow
    - gup: optimize longterm pin_user_pages() for large folio
    - mm: revert "mm: vmscan.c: fix OOM on swap stress test"
    - [amd64] iommu/vt-d: Fix __domain_mapping()'s usage of
      switch_to_super_page()
    - [amd64] iommu/amd/pgtbl: Fix possible race while increase page table level
    - btrfs: tree-checker: fix the incorrect inode ref size check
    - [arm64] ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S
      interface
    - [arm64] ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if
      source graph failed
    - [arm64] ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S
    - mmc: mvsdio: Fix dma_unmap_sg() nents value
    - [amd64] KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is
      active
    - drm/amd/display: Allow RX6xxx & RX7700 to invoke amdgpu_irq_get/put
    - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer
    - rds: ib: Increment i_fastreg_wrs before bailing out
    - mptcp: propagate shutdown to subflows when possible
    - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx
    - io_uring/cmd: let cmds to know about dying task
    - io_uring: backport io_should_terminate_tw()
    - io_uring: include dying ring in task_work "should cancel" state
    - io_uring/msg_ring: kill alloc_cache for io_kiocb allocations
    - io_uring/kbuf: drop WARN_ON_ONCE() from incremental length check
      (CVE-2025-39816)
    - [amd64] ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error
      message
    - [amd64] ASoC: Intel: catpt: Expose correct bit depth to userspace
    - drm/xe/tile: Release kobject for the failure path
    - drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ
    - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path
    - drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue()
    - smb: client: fix filename matching of deferred files
    - smb: client: let smbd_destroy() call
      disable_work_sync(&info->post_send_credits_work)
    - crypto: af_alg - Set merge to zero early in af_alg_sendmsg
    - smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path
    - io_uring: fix incorrect io_kiocb reference in io_link_skb
    - [amd64] platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on
      ASUS ROG Z13
    - [amd64] platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk
    - vmxnet3: unregister xdp rxq info in the reset path (CVE-2025-22106)
    - mm: add folio_expected_ref_count() for reference count calculation
    - mm/gup: check ref_count instead of lru before migration
    - mptcp: pm: nl: announce deny-join-id0 flag
    - usb: xhci: introduce macro for ring segment list iteration
    - usb: xhci: remove option to change a default ring's TRB cycle bit
    - xhci: dbc: decouple endpoint allocation from initialization
    - xhci: dbc: Fix full DbC transfer ring after several reconnects
    - rtc: pcf2127: fix SPI command byte for PCF2131 backport
    - minmax.h: add whitespace around operators and after commas
    - minmax.h: update some comments
    - minmax.h: reduce the #define expansion of min(), max() and clamp()
    - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp()
    - minmax.h: move all the clamp() definitions after the min/max() ones
    - minmax.h: simplify the variants of clamp()
    - minmax.h: remove some #defines that are only expanded once
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.50
    - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE
    - firewire: core: fix overlooked update of subsystem ABI version
    - ALSA: usb-audio: Fix code alignment in mixer_quirks
    - ALSA: usb-audio: Fix block comments in mixer_quirks
    - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks
    - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks
    - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks
    - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks
    - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5
    - ALSA: usb-audio: Convert comma to semicolon
    - ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA
    - ALSA: usb-audio: Fix build with CONFIG_INPUT=n
    - usb: core: Add 0x prefix to quirks debug output
    - [arm64,armhf] net: fec: rename struct fec_devinfo fec_imx6x_info ->
      fec_imx6sx_info
    - net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick
    - [riscv64] mmc: sdhci-cadence: add Mobileye eyeQ support
    - i2c: designware: Add quirk for Intel Xe
    - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device
    - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk
    - ALSA: usb-audio: Add mute TLV for playback volumes on more devices
    - net: sfp: add quirk for FLYPRO copper SFP+ module
    - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions
    - [amd64] HID: amd_sfh: Add sync across amd sfh work functions
    - cpufreq: Initialize cpufreq-based invariance before subsys
    - smb: server: don't use delayed_work for post_recv_credits_work
    - smb: server: use disable_work_sync in transport_rdma.c
    - bpf: Check the helper function is valid in get_helper_proto
    - btrfs: don't allow adding block device of less than 1 MB
    - wifi: virt_wifi: Fix page fault on connect
    - bpf: Reject bpf_timer for PREEMPT_RT
    - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI
    - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow
    - [armhf] can: sun4i_can: populate ndo_change_mtu() to prevent buffer
      overflow
    - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow
    - can: peak_usb: fix shift-out-of-bounds issue
    - net: tun: Update napi->skb after XDP process
    - net/smc: fix warning in smc_rx_splice() when calling get_page()
    - [arm64] ethernet: rvu-af: Remove slash from the driver name
    - Bluetooth: hci_sync: Fix hci_resume_advertising_sync
    - Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync
    - vhost: Take a reference on the task in struct vhost_task.
    - bnxt_en: correct offset handling for IPv6 destination address
    - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS
    - nexthop: Forbid FDB status change while nexthop is in a group
    - mm/gup: local lru_add_drain() to avoid lru_add_drain_all()
    - mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU
      batch"
    - mm: folio_may_be_lru_cached() unless folio_test_large()
    - [amd64] drm/gma500: Fix null dereference in hdmi teardown
    - futex: Prevent use-after-free during requeue-PI
    - [arm64] drm/panthor: Defer scheduler entitiy destruction to queue release
    - [amd64] platform/x86: lg-laptop: Fix WMAB call in fan_mode_store()
    - smb: client: fix wrong index reference in smb2_compound_op()
    - HID: asus: add support for missing PX series fn keys
    - i40e: add validation for ring_len param
    - i40e: fix idx validation in i40e_validate_queue_map
    - i40e: fix idx validation in config queues msg
    - i40e: fix input validation logic for action_meta
    - i40e: fix validation of VF state in get resources
    - i40e: add max boundary check for VF filters
    - i40e: add mask to apply valid bits for itr_idx
    - i40e: improve VF MAC filters accounting
    - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx
    - tracing: dynevent: Add a missing lockdown check on dynevent
    - [armhf] dts: socfpga: sodia: Fix mdio bus probe and PHY address
    - drm/ast: Use msleep instead of mdelay for edid read
    - afs: Fix potential null pointer dereference in afs_put_server
    - fs/proc/task_mmu: check p->vec_buf for NULL
    - gpiolib: Extend software-node support to support secondary software-nodes
    - mm/hugetlb: fix folio is still mapped when deleted
    - fbcon: fix integer overflow in fbcon_do_set_font
    - fbcon: Fix OOB access in font allocation
    - iommufd: Fix race during abort for file descriptors
    - Revert "usb: xhci: remove option to change a default ring's TRB cycle bit"
    - [amd64] drm/i915/backlight: Return immediately when scale() finds invalid
      parameters
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.51
    - crypto: sha256 - fix crash at kexec
    - scsi: target: target_core_configfs: Add length check to avoid buffer
      overflow
    - media: b2c2: Fix use-after-free causing by irq_check_work in
      flexcop_pci_remove
    - media: tuner: xc5000: Fix use-after-free in xc5000_release
    - media: rc: fix races with imon_disconnect()
    - media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID
    - mm: swap: check for stable address space before operating on the VMA
    - wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load()
    - [arm64] ASoC: qcom: audioreach: fix potential null pointer dereference
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.52
    - wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait()
    - USB: serial: option: add SIMCom 8230C compositions
    - Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1
    - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188
    - wifi: rtl8xxxu: Don't claim USB ID 07b8:8188
    - dm-integrity: limit MAX_TAG_SIZE to 255
    - [amd64] platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042
      list
    - [amd64] platform/x86/amd/pmf: Support new ACPI ID AMDI0108
    - [amd64,arm64] ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue
    - btrfs: ref-verify: handle damaged extent root tree
    - netfs: Prevent duplicate unlocking
    - can: hi311x: fix null pointer dereference when resuming from sleep before
      interface was enabled
    - [amd64] platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042
      quirks list
    - drm/amd : Update MES API header file for v11 & v12
    - drm/amd/include : MES v11 and v12 API header update
    - drm/amd/include : Update MES v12 API for fence update
    - drm/amdgpu: Enable MES lr_compute_wa by default (Closes: #1118658)
    - ALSA: usb-audio: Kill timer properly at removal (CVE-2025-38105)
    - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free
    - hid: fix I2C read buffer overflow in raw_event() for mcp2221
    - nvmem: layouts: fix automatic module loading
    - binder: fix double-free in dbitmap
    - driver core/PM: Set power.no_callbacks along with power.no_pm
    - crypto: rng - Ensure set_ent is always present
    - net/9p: fix double req put in p9_fd_cancelled
    - [amd64] KVM: x86: Don't (re)check L1 intercepts when completing userspace
      I/O
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.53
    - filelock: add FL_RECLAIM to show_fl_flags() macro
    - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD
    - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast
    - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote
    - [powerpc*] 8xx: Remove left-over instruction and comments in
      DataStoreTLBMiss handler
    - [powerpc*] 603: Really copy kernel PGD entries into all PGDIRs
    - uprobes: uprobe_warn should use passed task
    - [arm64] coresight: trbe: Prevent overflow in PERF_IDX2OFF()
    - [arm64] perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
    - smb: server: fix IRD/ORD negotiation with the client
    - [amd64] EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller
    - [amd64] x86/vdso: Fix output operand size of RDPID
    - lsm: CONFIG_LSM can depend on CONFIG_SECURITY
    - btrfs: return any hit error from extent_writepage_io()
    - [arm64] pinctrl: renesas: rzg2l: Fix invalid unsigned return in
      rzg3s_oen_read()
    - [arm64] dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0
    - regmap: Remove superfluous check for !config in __regmap_init()
    - bpf: Remove migrate_disable in kprobe_multi_link_prog_run
    - libbpf: Fix reuse of DEVMAP
    - [arm64] dts: imx93-kontron: Fix GPIO for panel regulator
    - [arm64] dts: imx93-kontron: Fix USB port assignment
    - [arm64] dts: imx95: Correct the lpuart7 and lpuart8 srcid
    - ACPI: processor: idle: Fix memory leak when register cpuidle device failed
    - [arm64] soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
    - [arm64] pinctrl: meson-gxl: add missing i2c_d pinmux
    - blk-mq: check kobject state_in_sysfs before deleting in
      blk_mq_unregister_hctx
    - block: use int to store blk_stack_limits() return value
    - PM: sleep: core: Clear power.must_resume in noirq suspend error path
    - vdso: Add struct __kernel_old_timeval forward declaration to gettime.h
    - [armhf] dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer
      property
    - [arm64] PM / devfreq: mtk-cci: Fix potential error pointer dereference in
      probe()
    - [arm64] power: supply: cw2015: Fix a alignment coding style issue
    - [arm64] pinctrl: renesas: Use int type to store negative error codes
    - null_blk: Fix the description of the cache_size module argument
    - nbd: restrict sockets to TCP and UDP
    - [arm64] PM / devfreq: rockchip-dfi: double count on RK3588
    - [arm64] soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure
    - [arm64] soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure
    - [arm64] arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model
    - mmc: core: Fix variable shadowing in mmc_route_rpmb_frames()
    - [arm64] dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value
    - [arm64] dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes
    - [arm64] dts: mediatek: mt8516-pumpkin: Fix machine compatible
    - [armhf] pwm: tiehrpwm: Don't drop runtime PM reference in .free()
    - [armhf] pwm: tiehrpwm: Make code comment in .free() more useful
    - [armhf] pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle
      calculation
    - [armhf] pwm: tiehrpwm: Fix corner case in clock divisor calculation
    - ACPICA: Fix largest possible resource descriptor index
    - [riscv64] bpf: Sign extend struct ops return values properly
    - nvmet-fc: move lsop put work to nvmet_fc_ls_req_op
    - i3c: master: svc: Use manual response for IBI events
    - i3c: master: svc: Recycle unused IBI slot
    - bpf: Explicitly check accesses to bpf_sock_addr
    - bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free()
    - smp: Fix up and expand the smp_call_function_many() kerneldoc
    - tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host
      headers
    - spi: fix return code when spi device has too many chipselects
    - bpf: Mark kfuncs as __noclone
    - once: fix race by moving DO_ONCE to separate section
    - [arm64] thermal/drivers/qcom/lmh: Add missing IRQ includes
    - [arm64] i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD
    - i2c: designware: Fix clock issue when PM is disabled
    - i2c: designware: Add disabling clocks when probe fails
    - libbpf: Fix error when st-prefix_ops and ops from differ btf
    - bpf: Enforce expected_attach_type for tailcall compatibility
    - drm/radeon/r600_cs: clean up of dead code in r600_cs
    - f2fs: fix condition in __allow_reserved_blocks()
    - [arm64] phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568
    - drm/amd/display: Remove redundant semicolons
    - scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
    - scsi: myrs: Fix dma_alloc_coherent() error check
    - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count
    - RDMA/mlx5: Fix vport loopback forcing for MPV device
    - PCI/ACPI: Fix pci_acpi_preserve_config() memory leak
    - ALSA: lx_core: use int type to store negative error codes
    - inet: ping: check sock_net() in ping_get_port() and ping_lookup()
    - [arm64,armhf] coresight: Only register perf symlink for sinks with
      alloc_buffer
    - drm/amdgpu: Power up UVD 3 for FW validation (v2)
    - drm/amd/pm: Disable ULV even if unsupported (v3)
    - drm/amd/pm: Fix si_upload_smc_data (v3)
    - drm/amd/pm: Adjust si_upload_smc_data register programming (v3)
    - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3)
    - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2)
    - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3)
    - wifi: mwifiex: send world regulatory domain to driver
    - [arm64,armhf] PCI: tegra: Fix devm_kcalloc() argument order for port->phys
      allocation
    - tcp: fix __tcp_close() to only send RST when required
    - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl()
    - [armhf] usb: phy: twl6030: Fix incorrect type for ret
    - usb: gadget: configfs: Correctly set use_os_string at bind
    - tty: n_gsm: Don't block input queue by waiting MSC
    - [powerpc*] misc: genwqe: Fix incorrect cmd field being reported in error
    - pps: fix warning in pps_register_cdev when register device fail
    - wifi: iwlwifi: Remove redundant header files
    - [amd64,arm64] idpf: fix Rx descriptor ready check barrier in splitq
    - [amd64] ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping
    - [amd64] ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
    - [amd64] ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
    - [arm64] drm/msm/dpu: fix incorrect type for ret
    - fs: ntfs3: Fix integer overflow in run_unpack()
    - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist
    - iio: consumers: Fix handling of negative channel scale in
      iio_convert_raw_to_processed()
    - iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
    - netfilter: ipset: Remove unused htable_bits in macro ahash_region
    - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable
    - drivers/base/node: handle error properly in register_one_node()
    - RDMA/cm: Rate limit destroy CM ID timeout error message
    - wifi: mt76: fix potential memory leak in mt76_wmac_probe()
    - wifi: mt76: mt7996: Fix RX packets configuration for primary WED device
    - wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE
    - wifi: mt76: mt7915: fix mt7981 pre-calibration
    - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks()
    - f2fs: fix to truncate first page in error path of f2fs_truncate()
    - f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page()
    - ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on
      PREEMPT_RT
    - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message
    - scsi: qla2xxx: edif: Fix incorrect sign of error code
    - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES()
    - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp()
    - HID: hidraw: tighten ioctl command parsing
    - f2fs: fix zero-sized extent for precache extents
    - Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems
      Running"
    - RDMA/core: Resolve MAC of next-hop device without ARP support
    - IB/sa: Fix sa_local_svc_timeout_ms read race
    - Documentation: trace: historgram-design: Separate sched_waking histogram
      section heading and the following diagram
    - wifi: ath12k: fix wrong logging ID used for CE
    - wifi: ath10k: avoid unnecessary wait for service ready message
    - iommu/vt-d: debugfs: Fix legacy mode page table dump logic
    - wifi: mac80211: fix Rx packet handling when pubsta information is not
      available
    - [amd64] ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback
    - RDMA/rxe: Fix race in do_task() when draining
    - wifi: rtw89: avoid circular locking dependency in ser_state_run()
    - [arm64] remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice
    - dm vdo: return error on corrupted metadata in start_restoring_volume
      functions
    - [arm64] coresight-etm4x: Conditionally access register TRCEXTINSELR
    - [arm64,armhf] coresight: tmc: Support atclk
    - [arm64,armhf] coresight: catu: Support atclk
    - [arm64,armhf] coresight: etm4x: Support atclk
    - [arm64,armhf] coresight: trbe: Return NULL pointer for allocation failures
    - [arm64,armhf] coresight: tpda: fix the logic to setup the element size
    - [arm64] coresight: Fix incorrect handling for return value of devm_kzalloc
    - NFSv4.1: fix backchannel max_resp_sz verification check
    - ipvs: Defer ip_vs_ftp unregister during netns cleanup
    - netfilter: nfnetlink: reset nlh pointer during batch replay
    - scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
    - usb: vhci-hcd: Prevent suspending virtually attached devices
    - iommu/vt-d: Disallow dirty tracking if incoherent page walk
    - net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
    - ptp: Add a upper bound on max_vclocks
    - vhost: vringh: Fix copy_to_iter return value check
    - Bluetooth: MGMT: Fix not exposing debug UUID on
      MGMT_OP_READ_EXP_FEATURES_INFO
    - Bluetooth: ISO: Fix possible UAF on iso_conn_free
    - Bluetooth: ISO: free rx_skb if not consumed
    - Bluetooth: ISO: don't leak skb in ISO_CONT RX
    - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements
    - KEYS: X.509: Fix Basic Constraints CA flag parsing
    - ocfs2: fix double free in user_cluster_connect()
    - drivers/base/node: fix double free in register_one_node()
    - [arm64] PCI: j721e: Fix incorrect error message in probe()
    - [amd64,arm64] idpf: fix mismatched free function for dma_alloc_coherent
    - nfp: fix RSS hash key size when RSS is not supported
    - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not
      configurable
    - net: dlink: handle copy_thresh allocation failure
    - net/mlx5: Stop polling for command response if interface goes down
    - net/mlx5: pagealloc: Fix reclaim race during command interface teardown
    - net/mlx5: fw reset, add reset timeout work
    - smb: client: fix crypto buffers in non-linear memory
    - Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set"
    - bpf: Reject negative offsets for ALU ops
    - tpm: Disable TPM2_TCG_HMAC by default
    - Squashfs: fix uninit-value in squashfs_get_parent
    - uio_hv_generic: Let userspace take care of interrupt mask
    - io_uring/waitid: always prune wait queue entry in io_waitid_wait()
    - [arm64] ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()
    - [amd64,arm64] ASoC: SOF: ipc3-topology: Fix multi-core and static
      pipelines tear down
    - fs: udf: fix OOB read in lengthAllocDescs handling
    - net: nfc: nci: Add parameter validation for packet data
    - [arm64,armhf] mfd: vexpress-sysreg: Check the return value of
      devm_gpiochip_add_data()
    - dm: fix queue start/stop imbalance under suspend/load/resume races
    - dm: fix NULL pointer dereference in __dm_suspend()
    - ksmbd: Fix race condition in RPC handle list access
    - ksmbd: fix error code overwriting in smb2_get_info_filesystem()
    - ksmbd: add max ip connections parameter
    - ext4: fix checks for orphan inodes
    - [amd64] KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't
      valid
    - fbdev: simplefb: Fix use after free in simplefb_detach_genpds()
    - mm: hugetlb: avoid soft lockup when mprotect to large memory area
    - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe()
    - [arm64] misc: fastrpc: Save actual DMA size in fastrpc_map structure
    - [arm64] misc: fastrpc: Fix fastrpc_map_lookup operation
    - [arm64] misc: fastrpc: fix possible map leak in fastrpc_put_args
    - [arm64] misc: fastrpc: Skip reference for DMA handles
    - Input: atmel_mxt_ts - allow reset GPIO to sleep
    - Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak
    - sunrpc: fix null pointer dereference on zero-length checksum
    - [arm64] remoteproc: pru: Fix potential NULL pointer dereference in
      pru_rproc_set_ctable()
    - [amd64,arm64] tee: fix register_shm_helper()
    - pinctrl: check the return value of pinmux_ops::get_function_name()
    - bus: fsl-mc: Check return value of platform_get_resource()
    - net/9p: Fix buffer overflow in USB transport layer
    - net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock
    - usb: typec: tipd: Clear interrupts first
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.54
    - fs: always return zero on success from replace_fd()
    - fscontext: do not consume log entries when returning -EMSGSIZE
    - [arm64] map [_text, _stext) virtual address range non-executable+read-only
    - rseq: Protect event mask against membarrier IPI
    - listmount: don't call path_put() under namespace semaphore
    - page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches
    - dma-mapping: fix direction in dma_alloc direction traces
    - [amd64] KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2
    - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE
    - media: v4l2-subdev: Fix alloc failure check in
      v4l2_subdev_call_state_try()
    - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled
    - perf disasm: Avoid undefined behavior in incrementing NULL
    - perf test trace_btf_enum: Skip if permissions are insufficient
    - perf evsel: Avoid container_of on a NULL leader
    - libperf event: Ensure tracing data is multiple of 8 sized
    - [arm64] clk: qcom: common: Fix NULL vs IS_ERR() check in
      qcom_cc_icc_register()
    - [arm64] clk: renesas: cpg-mssr: Fix memory leak in
      cpg_mssr_reserved_init()
    - perf util: Fix compression checks returning -1 as bool
    - perf arm_spe: Correct setting remote access
    - perf arm-spe: Rename the common data source encoding
    - perf arm_spe: Correct memory level for remote access
    - perf vendor events arm64 AmpereOneX: Fix typo - should be
      l1d_cache_access_prefetches
    - perf session: Fix handling when buffer exceeds 2 GiB
    - perf tools: Add fallback for exclude_guest
    - perf evsel: Ensure the fallback message is always written to
    - [arm64] clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m
    - [arm64] clk: mediatek: clk-mux: Do not pass flags to
      clk_mux_determine_rate_flags()
    - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (CVE-2025-40001)
    - [amd64] ASoC: SOF: Intel: hda-pcm: Place the constraint on period time
      instead of buffer time
    - [amd64] ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel
    - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
    - drm/xe/hw_engine_group: Fix double write lock release in error path
    - [s390x] cio: Update purge function to unregister the unused subchannels
    - drm/vmwgfx: Fix a null-ptr access in the cursor snooper
    - drm/vmwgfx: Fix Use-after-free in validation
    - drm/vmwgfx: Fix copy-paste typo in validation
    - net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
    - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
    - [arm64] net: mscc: ocelot: Fix use-after-free caused by cyclic delayed
      work (CVE-2025-40003)
    - ice: ice_adapter: release xa entry on adapter allocation failure
    - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat()
    - [arm64] mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister()
      call
    - [arm64] mailbox: zynqmp-ipi: Remove dev.parent check in
      zynqmp_ipi_free_mboxes
    - [arm64] mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup
      loop
    - [arm64] mailbox: zynqmp-ipi: Fix SGI cleanup on unbind
    - bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}
    - [arm64] mailbox: mtk-cmdq-mailbox: Switch to
      __pm_runtime_put_autosuspend()
    - [arm64] mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend()
    - [arm64] mailbox: mtk-cmdq: Remove pm_runtime APIs from
      cmdq_mbox_send_data()
    - drm/amdgpu: Add additional DCE6 SCL registers
    - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs
    - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6
    - drm/amd/display: Properly disable scaling on DCE6
    - netfilter: nft_objref: validate objref and objrefmap expressions
    - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu()
    - crypto: essiv - Check ssize for decryption and in-place encryption
    - cifs: Fix copy_to_iter return value check
    - smb: client: fix missing timestamp updates after utime(2)
    - cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points
    - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single
    - [arm64] gpio: wcd934x: mark the GPIO controller as sleeping
    - bpf: Avoid RCU context warning when unpinning htab with internal structs
    - [s390x] vmlinux.lds.S: Reorder sections
    - [s390x] vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections
    - ACPI: property: Fix buffer properties extraction for subnodes
    - ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT
    - ACPI: debug: fix signedness issues in read/write helpers
    - [arm64] dts: qcom: msm8916: Add missing MDSS reset
    - [arm64] dts: qcom: msm8939: Add missing MDSS reset
    - [arm64] dts: qcom: sdm845: Fix slimbam num-channels/ees
    - [arm64] dts: qcom: x1e80100-pmics: Disable pm8010 by default
    - [arm64] dts: ti: k3-am62a-main: Fix main padcfg length
    - [arm64] kprobes: call set_memory_rox() for kprobe page
    - [armhf] AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on
      reset)
    - [armhf] OMAP2+: pm33xx-core: ix device node reference leaks in
      amx3_idle_init
    - [arm64] perf/arm-cmn: Fix CMN S3 DTM offset
    - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required
    - xen/events: Cleanup find_virq() return codes
    - xen/manage: Fix suspend error path
    - xen/events: Return -EEXIST for bound VIRQs
    - xen/events: Update virq_to_irq on migration
    - [arm64] firmware: meson_sm: fix device leak at probe
    - media: cx18: Add missing check after DMA map
    - media: mc: Fix MUST_CONNECT handling for pads with no links
    - media: pci: ivtv: Add missing check after DMA map
    - media: pci: mg4b: fix uninitialized iio scan data
    - [arm64] media: venus: firmware: Use correct reset sequence for IRIS2
    - media: vivid: fix disappearing <Vendor Command With ID> messages
    - media: lirc: Fix error handling in lirc_register()
    - [arm64] drm/panthor: Fix memory leak in panthor_ioctl_group_create()
    - drm/nouveau: fix bad ret code in nouveau_bo_move_prep
    - drm/xe/uapi: loosen used tracking restriction
    - drm/amd/display: Enable Dynamic DTBCLK Switch
    - blk-crypto: fix missing blktrace bio split events
    - btrfs: avoid potential out-of-bounds in btrfs_encode_fh()
    - bus: mhi: ep: Fix chained transfer handling in read path
    - bus: mhi: host: Do not use uninitialized 'dev' pointer in
      mhi_init_irq_setup()
    - [arm64] clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP
      refclk
    - copy_sighand: Handle architectures where sizeof(unsigned long) <
      sizeof(u64)
    - [amd64] cpufreq: intel_pstate: Fix object lifecycle issue in
      update_qos_request()
    - [arm64,armhf] crypto: rockchip - Fix dma_unmap_sg() nents value
    - eventpoll: Replace rwlock with spinlock
    - fbdev: Fix logic error in "offb" name match
    - fs/ntfs3: Fix a resource leak bug in wnd_extend()
    - fs: quota: create dedicated workqueue for quota_release_work
    - fuse: fix possibly missing fuse_copy_finish() call in fuse_notify()
    - fuse: fix livelock in synchronous file put from fuseblk workers
    - iio: dac: ad5360: use int type to store negative error codes
    - iio: dac: ad5421: use int type to store negative error codes
    - iio: frequency: adf4350: Fix prescaler usage.
    - init: handle bootloader identifier in kernel parameters
    - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in
      resume
    - [amd64] iommu/vt-d: PRS isn't usable if PDS isn't supported
    - kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in
      sys_prlimit64() paths
    - KEYS: trusted_tpm1: Compare HMAC values in constant time
    - lib/genalloc: fix device leak in of_gen_pool_get()
    - loop: fix backing file reference leak on validation error
    - openat2: don't trigger automounts with RESOLVE_NO_XDEV
    - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk
    - [powerpc*] powernv/pci: Fix underflow and leak issue
    - [powerpc*] pseries/msi: Fix potential underflow and leak issue
    - Revert "ipmi: fix msg stack when IPMI is disconnected"
    - sched/deadline: Fix race in push_dl_task()
    - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl()
    - scsi: sd: Fix build warning in sd_revalidate_disk()
    - sctp: Fix MAC comparison to be constant-time
    - xsk: Harden userspace-supplied xdp_desc validation
    - mmc: core: SPI mode remove cmd7
    - mmc: mmc_spi: multiple block read remove read crc ack
    - [armhf] memory: samsung: exynos-srom: Fix of_iomap leak in
      exynos_srom_probe
    - rtc: interface: Ensure alarm irq is enabled when UIE is enabled
    - rtc: interface: Fix long-standing race when setting alarm
    - [arm64] PCI: xilinx-nwl: Fix ECAM programming
    - [arm64,armhf] PCI: tegra: Convert struct tegra_msi mask_lock into raw
      spinlock
    - PCI/sysfs: Ensure devices are powered for config reads
    - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV
    - PCI/ERR: Fix uevent on failure to recover
    - PCI/AER: Fix missing uevent on recovery when a reset is requested
    - PCI/AER: Support errors introduced by PCIe r6.0
    - [arm64] PCI: j721e: Fix programming sequence of "strap" settings
    - spi: cadence-quadspi: Flush posted register writes before INDAC access
    - spi: cadence-quadspi: Flush posted register writes before DAC access
    - spi: cadence-quadspi: Fix cqspi_setup_flash()
    - [x86] fred: Remove ENDBR64 from FRED entry points
    - [x86] umip: Check that the instruction opcode is at least two bytes
    - [x86] umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT
      aliases)
    - [s390x] dasd: enforce dma_alignment to ensure proper buffer validation
    - [s390x] dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request
    - [s390x] Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR
    - slab: prevent warnings when slab obj_exts vector allocation fails
    - slab: mark slab->obj_exts allocation failures unconditionally
    - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again
    - wifi: mt76: mt7925u: Add VID/PID for Netgear A9000
    - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500
    - mm/thp: fix MTE tag mismatch when replacing zero-filled subpages
    - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations
    - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when
      max_huge_pages=0
    - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success
    - mm/damon/lru_sort: use param_ctx for damon_attrs staging
    - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul()
    - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry
    - ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches()
    - ext4: verify orphan file size is not too big
    - ext4: increase i_disksize to offset + len in
      ext4_update_disksize_before_punch()
    - ext4: correctly handle queries for metadata mappings
    - ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()
    - ext4: fix an off-by-one issue during moving extents
    - ext4: guard against EA inode refcount underflow in xattr update
    - ext4: validate ea_ino and size in check_xattrs
    - ACPICA: Allow to skip Global Lock initialization
    - ext4: free orphan info with kvfree
    - media: mc: Clear minor number before put device
    - Squashfs: add additional inode sanity checking
    - Squashfs: reject negative file sizes in squashfs_read_inode()
    - tracing: Fix race condition in kprobe initialization causing NULL pointer
      dereference
    - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork
    - [amd64] ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams
    - [amd64] ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples
    - [amd64] mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config
      max_register value
    - [amd64] mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for
      cache_type
    - [amd64] mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config
      flag
    - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range()
    - cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency
    - [amd64] KVM: x86: Advertise SRSO_USER_KERNEL_NO to userspace
    - statmount: don't call path_put() under namespace semaphore
    - [arm64] mte: Do not flag the zero page as PG_mte_tagged
    - [x86] mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state()
    - [x86] kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP
    - nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT
    - NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock()
    - nfsd: refine and rename NFSD_MAY_LOCK
    - nfsd: don't use sv_nrthreads in connection limiting calculations.
    - nfsd: unregister with rpcbind when deleting a transport
    - ACPI: battery: allocate driver data through devm_ APIs
    - ACPI: battery: initialize mutexes through devm_ APIs
    - ACPI: battery: Check for error code from devm_mutex_init() call
    - ACPI: battery: Add synchronization between interface updates
    - ACPI: property: Disregard references in data-only subnode lists
    - ACPI: property: Add code comments explaining what is going on
    - ACPI: property: Do not pass NULL handles to acpi_attach_data()
    - mptcp: pm: in-kernel: usable client side with C-flag
    - ipmi: Rework user message limit handling
    - ipmi: Fix handling of messages with provided receive message pointer
    - mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled
      mTHP subpage to shared zeropage
    - [s390x] bpf: Centralize frame offset calculations
    - [s390x] bpf: Describe the frame using a struct instead of constants
    - [s390x] bpf: Write back tail call counter for BPF_PSEUDO_CALL
    - [s390x] bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG
    - [riscv64] irqchip/sifive-plic: Make use of __assign_bit()
    - [riscv64] irqchip/sifive-plic: Avoid interrupt ID 0 handling during
      suspend/resume
    - copy_file_range: limit size if in compat mode
    - minixfs: Verify inode mode when loading from disk
    - pid: Add a judgment for ns null in pid_nr_ns
    - fs: Add 'initramfs_options' to set initramfs mount options
    - cramfs: Verify inode mode when loading from disk
    - writeback: Avoid softlockup when switching many inodes
    - writeback: Avoid excessively long inode switching times
    - sched/fair: Block delayed tasks on throttled hierarchy during dequeue
    - nfsd: fix __fh_verify for localio
    - nfsd: fix access checking for NLM under XPRTSEC policies
    - [amd64] ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA
    - mount: handle NULL values in mnt_ns_release()
    - nfsd: decouple the xprtsec policy check from check_nfsd_access()
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.55
    - drm/xe/guc: Check GuC running state before deregistering exec queue
    - smb: client: Fix refcount leak for cifs_sb_tlink
    - slab: reset slab->obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL
    - r8152: add error handling in rtl8152_driver_init
    - f2fs: fix wrong block mapping for multi-devices
    - jbd2: ensure that all ongoing I/O complete before freeing blocks
    - ext4: wait for ongoing I/O to complete before freeing blocks
    - ext4: detect invalid INLINE_DATA + EXTENTS flag combination
    - btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already
      running
    - btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl
    - btrfs: fix incorrect readahead expansion length
    - btrfs: fix memory leaks when rejecting a non SINGLE data profile without
      an RST
    - btrfs: do not assert we found block group item when creating free space
      tree
    - can: gs_usb: gs_make_candev(): populate net_device->dev_port
    - can: gs_usb: increase max interface to U8_MAX
    - cifs: parse_dfs_referrals: prevent oob on malformed input
    - drm/sched: Fix potential double free in
      drm_sched_job_add_resv_dependencies
    - drm/amdgpu: use atomic functions with memory barriers for vm fault info
    - drm/amdgpu: fix gfx12 mes packet status return check
    - perf/core: Fix address filter match with backing files
    - perf/core: Fix MMAP event path names with backing files
    - perf/core: Fix MMAP2 event device with backing files
    - drm/amd: Check whether secure display TA loaded successfully
    - irqdomain: cdx: Switch to of_fwnode_handle()
    - [arm64] drm/msm/a6xx: Fix PDC sleep sequence
    - usb: gadget: Store endpoint pointer in usb_request
    - usb: gadget: Introduce free_usb_request helper
    - usb: gadget: f_ncm: Refactor bind path to use __free()
    - usb: gadget: f_acm: Refactor bind path to use __free()
    - usb: gadget: f_ecm: Refactor bind path to use __free()
    - usb: gadget: f_rndis: Refactor bind path to use __free()
    - cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay
    - Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()"
      (Closes: #1116358)
    - HID: multitouch: fix sticky fingers
    - dax: skip read lock assertion for read-only filesystems
    - can: m_can: m_can_plat_remove(): add missing pm_runtime_disable()
    - can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error
      Active
    - can: m_can: m_can_chip_config(): bring up interface in correct state
    - can: m_can: add deinit callback
    - can: m_can: call deinit/init callback when going into suspend/resume
    - can: m_can: fix CAN state in system PM
    - net: dlink: handle dma_map_single() failure properly
    - doc: fix seg6_flowlabel path
    - r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H
    - net/ip6_tunnel: Prevent perpetual tunnel growth
    - [amd64,arm64] amd-xgbe: Avoid spurious link down messages during interface
      toggle
    - tcp: fix tcp_tso_should_defer() vs large RTT
    - ksmbd: fix recursive locking in RPC handle list access
    - tg3: prevent use of uninitialized remote_adv and local_adv variables
    - tls: trim encrypted message to match the plaintext on short splice
    - tls: wait for async encrypt in case of error during latter iterations of
      sendmsg
    - tls: always set record_type in tls_process_cmsg
    - tls: wait for pending async decryptions if tls_strp_msg_hold fails
    - tls: don't rely on tx_work during send()
    - net: usb: lan78xx: Add error handling to lan78xx_init_mac_address
    - net: usb: lan78xx: fix use of improperly initialized dev->chipid in
      lan78xx_reset
    - [arm64] drm/panthor: Ensure MCU is disabled on suspend
    - nvme-multipath: Skip nr_active increments in RETRY disposition
    - [riscv64] kprobes: Fix probe address validation
    - [amd64] ASoC: nau8821: Cancel jdet_work before handling jack ejection
    - [amd64] ASoC: nau8821: Generalize helper to clear IRQ status
    - [amd64] ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit
    - [amd64] drm/i915/guc: Skip communication warning on reset in progress
    - drm/amdgpu: add ip offset support for cyan skillfish
    - drm/amdgpu: add support for cyan skillfish without IP discovery
    - drm/amdgpu: fix handling of harvesting for ip_discovery firmware
    - drm/amd/powerplay: Fix CIK shutdown temperature
    - [arm64] drm/rockchip: vop2: use correct destination rectangle height check
    - sched/fair: Fix pelt lost idle time detection
    - ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings
    - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card
    - HID: hid-input: only ignore 0 battery events for digitizers
    - HID: multitouch: fix name of Stylus input devices
    - nvme/tcp: handle tls partially sent records in write_space()
    - hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp()
    - xfs: rename the old_crc variable in xlog_recover_process
    - xfs: fix log CRC mismatches between i386 and other architectures
    - PM: runtime: Add new devm functions
    - iio: imu: inv_icm42600: Simplify pm_runtime setup
    - iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended
    - nfsd: Use correct error code when decoding extents
    - nfsd: Drop dprintk in blocklayout xdr functions
    - NFSD: Rework encoding and decoding of nfsd4_deviceid
    - NFSD: Minor cleanup in layoutcommit processing
    - NFSD: Implement large extent array support in pNFS
    - NFSD: Fix last write offset handling in layoutcommit
    - wifi: rtw89: avoid possible TX wait initialization race
    - xfs: use deferred intent items for reaping crosslinked blocks
    - padata: Reset next CPU when reorder sequence wraps around
    - md/raid0: Handle bio_split() errors
    - md/raid1: Handle bio_split() errors
    - md/raid10: Handle bio_split() errors
    - md: fix mssing blktrace bio split events
    - [amd64] x86/resctrl: Refactor resctrl_arch_rmid_read()
    - [amd64] x86/resctrl: Fix miscount of bandwidth event when reactivating
      previously unavailable RMID
    - d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier
    - vfs: Don't leak disconnected dentries on umount
    - PCI: Add PCI_VDEVICE_SUB helper macro
    - ixgbevf: Add support for Intel(R) E610 device
    - ixgbevf: fix getting link speed data for E610 devices
    - ixgbevf: fix mailbox API compatibility by negotiating supported features
    - tcp: convert to dev_net_rcu()
    - tcp: cache RTAX_QUICKACK metric in a hot cache line
    - net: dst: add four helpers to annotate data-races around dst->dev
    - ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu]
    - net: Add locking to protect skb->dev access in ip_output
    - mptcp: Call dst_release() in mptcp_active_enable().
    - mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable().
    - mptcp: reset blackhole on success with non-loopback ifaces
    - NFSD: Define a proc_layoutcommit for the FlexFiles layout type
    - [arm64] cputype: Add Neoverse-V3AE definitions
    - [arm64] errata: Apply workarounds for Neoverse-V3AE
    - [amd64] dmaengine: Add missing cleanup on module unload
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.56
    - exec: Fix incorrect type for ret
    - hfs: clear offset and space out of valid records in b-tree node
    - hfs: make proper initalization of struct hfs_find_data
    - hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent()
    - hfs: validate record offset in hfsplus_bmap_alloc
    - hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat()
    - dlm: check for defined force value in dlm_lockspace_release
    - hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits()
    - hfsplus: return EIO when type of hidden directory mismatch in
      hfsplus_fill_super()
    - PCI: Test for bit underflow in pcie_set_readrq()
    - [arm64] sysreg: Correct sign definitions for EIESB and DoubleLock
    - drivers/perf: hisi: Relax the event ID check in the framework
    - [s390x] mm: Use __GFP_ACCOUNT for user page table allocations
    - smb: server: let smb_direct_flush_send_list() invalidate a remote key
      first
    - PM: EM: Drop unused parameter from em_adjust_new_capacity()
    - PM: EM: Slightly reduce em_check_capacity_update() overhead
    - PM: EM: Move CPU capacity check to em_adjust_new_capacity()
    - PM: EM: Fix late boot with holes in CPU topology
    - net/mlx5e: Return 1 instead of 0 in invalid case in
      mlx5e_mpwrq_umr_entry_size()
    - rtnetlink: Allow deleting FDB entries in user namespace
    - [arm64] net: enetc: fix the deadlock of enetc_mdio_lock
    - [arm64] net: enetc: correct the value of ENETC_RXB_TRUESIZE
    - [arm64] dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path
    - net/mlx5e: Reuse per-RQ XDP buffer to avoid stack zeroing overhead
    - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ
    - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ
    - net/smc: fix general protection fault in __smc_diag_dump
    - [arm64] net: ethernet: ti: am65-cpts: fix timestamp loss due to race
      conditions
    - [arm64] mm: avoid always making PTE dirty in pte_mkwrite()
    - ptp: ocp: Fix typo using index 1 instead of i in SMA initialization loop
    - sctp: avoid NULL dereference when chunk data buffer is missing
    - net: phy: micrel: always set shared->phydev for LAN8814
    - net/mlx5: Fix IPsec cleanup over MPV device
    - fs/notify: call exportfs_encode_fid with s_umount
    - net: bonding: fix possible peer notify event loss or dup issue
    - dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC
    - arch_topology: Fix incorrect error check in topology_parse_cpu_capacity()
    - btrfs: directly free partially initialized fs_info in
      btrfs_check_leaked_roots()
    - gpio: pci-idio-16: Define maximum valid register address offset
    - gpio: 104-idio-16: Define maximum valid register address offset
    - xfs: fix locking in xchk_nlinks_collect_dir
    - Revert "cpuidle: menu: Avoid discarding useful information"
    - slab: Avoid race on slab->obj_exts in alloc_slab_obj_exts
    - slab: Fix obj_ext mistakenly considered NULL due to race condition
    - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11
    - can: netlink: can_changelink(): allow disabling of automatic restart
    - cifs: Fix TCP_Server_Info::credits to be signed
    - ocfs2: clear extent cache after moving/defragmenting extents
    - vsock: fix lock inversion in vsock_assign_transport()
    - [arm64,armhf] net: stmmac: dwmac-rk: Fix disabling set_clock_selection
    - net: usb: rtl8150: Fix frame padding
    - mm: prevent poison consumption when splitting THP
    - drm/amd/display: increase max link count and fix link->enc NULL pointer
      access
    - [arm64] spi: spi-nxp-fspi: add extra delay after dll locked
    - [arm64] dts: broadcom: bcm2712: Add default GIC address cells
    - [arm64] dts: broadcom: bcm2712: Define VGIC interrupt
    - [arm64] firmware: arm_scmi: Account for failed debug initialization
    - [arm64] firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing
      in raw mode
    - [arm64] drm/panthor: Fix kernel panic on partial unmap of a GPU VA region
    - [riscv64] Define pgprot_dmacoherent() for non-coherent devices
    - [riscv64] Don't print details of CPUs disabled in DT
    - [riscv64] hwprobe: avoid uninitialized variable use in hwprobe_arch_id()
    - hwmon: (sht3x) Fix error handling
    - nbd: override creds to kernel when calling sock_{send,recv}msg()
    - drm/panic: Fix drawing the logo on a small narrow screen
    - drm/panic: Fix qr_code, ensure vmargin is positive
    - [amd64] gpio: ljca: Fix duplicated IRQ mapping
    - io_uring: correct __must_hold annotation in io_install_fixed_file
    - sched: Remove never used code in mm_cid_get()
    - io_uring/sqpoll: switch away from getrusage() for CPU accounting
    - io_uring/sqpoll: be smarter on when to update the stime usage
    - Bluetooth: btintel: Add DSBR support for BlazarIW, BlazarU and GaP
      (Closes: #1118660)
    - platform/x86/amd/hsmp: Ensure sock->metric_tbl_addr is non-NULL
      (CVE-2025-39678)
    - USB: serial: option: add UNISOC UIS7720
    - USB: serial: option: add Quectel RG255C
    - USB: serial: option: add Telit FN920C04 ECM compositions
    - usb/core/quirks: Add Huawei ME906S to wakeup quirk
    - usb: raw-gadget: do not limit transfer length
    - xhci: dbc: enable back DbC in resume if it was enabled before suspend
    - xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall
      event
    - [amd64] x86/microcode: Fix Entrysign revision check for Zen1/Naples
    - [arm*] binder: remove "invalid inc weak" check
    - [amd64] comedi: fix divide-by-zero in comedi_buf_munge() (CVE-2025-40106)
    - [amd64] mei: me: add wildcat lake P DID
    - [arm64] misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup
    - [amd64,arm64] tcpm: switch check for role_sw device with fw_node
    - dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp
    - serial: 8250_dw: handle reset control deassert error
    - serial: 8250_exar: add support for Advantech 2 port card with Device ID
      0x0018
    - [arm64] serial: 8250_mtk: Enable baud clock and manage in runtime PM
    - serial: sc16is7xx: remove useless enable of enhanced features
    - devcoredump: Fix circular locking dependency with devcd->mutex.
    - [arm64] mte: Do not warn if the page is already tagged in copy_highpage()
    - xfs: always warn about deprecated mount options
    - ksmbd: transport_ipc: validate payload size before reading handle
      (CVE-2025-40084)
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.57
    - net/sched: sch_qfq: Fix null-deref in agg_dequeue (CVE-2025-40083)
    - audit: record fanotify event regardless of presence of rules
    - [amd64] perf/x86/intel: Add ICL_FIXED_0_ADAPTIVE bit into
      INTEL_FIXED_BITS_MASK
    - perf: Use current->flags & PF_KTHREAD|PF_USER_WORKER instead of
      current->mm == NULL
    - perf: Have get_perf_callchain() return NULL if crosstask and user are set
    - perf: Skip user unwind if the task is a kernel thread
    - seccomp: passthrough uprobe systemcall without filtering
    - [amd64] x86/bugs: Report correct retbleed mitigation status
    - [amd64] x86/bugs: Fix reporting of LFENCE retpoline
    - [amd64,arm64] EDAC/mc_sysfs: Increase legacy channel support to 16
    - cpuset: Use new excpus for nocpu error check when enabling root partition
    - btrfs: abort transaction on specific error places when walking log tree
    - btrfs: abort transaction in the process_one_buffer() log tree walk
      callback
    - btrfs: zoned: return error from btrfs_zone_finish_endio()
    - btrfs: zoned: refine extent allocator hint selection
    - btrfs: scrub: replace max_t()/min_t() with clamp() in
      scrub_throttle_dev_io()
    - btrfs: always drop log root tree reference in btrfs_replay_log()
    - btrfs: use level argument in log tree walk callback replay_one_buffer()
    - btrfs: abort transaction if we fail to update inode in log replay dir
      fixup
    - btrfs: tree-checker: add inode extref checks
    - btrfs: use smp_mb__after_atomic() when forcing COW in
      create_pending_snapshot()
    - sched_ext: Make qmap dump operation non-destructive
    - arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c
    - docs: kdoc: handle the obsolescensce of docutils.ErrorString()
    - mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR
    - f2fs: fix to avoid panic once fallocation fails for pinfile
      (CVE-2025-23130)
    - wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac()
      (CVE-2025-38643)
    - bonding: return detailed error when loading native XDP fails
    - bonding: check xdp prog when set bond mode (CVE-2025-22105)
    - bits: add comments and newlines to #if, #else and #endif directives
    - bits: introduce fixed-type GENMASK_U*()
    - gpio: regmap: Allow to allocate regmap-irq device
    - gpio: regmap: add the .fixed_direction_output configuration parameter
    - gpio: idio-16: Define fixed direction of the GPIO lines
    - [amd64] iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (CVE-2025-21833)
    - wifi: ath12k: fix read pointer after free in
      ath12k_mac_assign_vif_to_vdev() (CVE-2024-57995)
    - [amd64,arm64] udmabuf: fix a buf size overflow issue during udmabuf
      creation (CVE-2025-37803)
    - sfc: fix NULL dereferences in ef100_process_design_param()
      (CVE-2025-37860)
    - btrfs: tree-checker: fix bounds check in check_inode_extref()

[ Salvatore Bonaccorso ]
  * drivers/infiniband/hw/bnxt_re: Enable INFINIBAND_BNXT_RE as module
    (Closes: #1109977)

[ Ben Hutchings ]
  * d/salsa-ci.yml: Adjust filenames to allow source package name suffix
  * tools/hv: Make the sample hv_get_dhcp_info script more useful
  * hyperv-daemons: Install the sample network info scripts (Closes: #919350)
  * d/salsa-ci.yml: Fix cache configuration for build job
  * d/salsa-ci.yml: Move orig tarball generation to a separate job again
  * d/salsa-ci.yml: Restore lintian checking of source package

-- Salvatore Bonaccorso <carnil@debian.org>  Wed, 05 Nov 2025 15:56:27 +0100

linux (6.12.48-1) trixie-security; urgency=high

* New upstream stable update:
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.44
    - serial: 8250: fix panic due to PSLVERR
    - ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig
    - platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister()
    - PM: runtime: Take active children into account in
      pm_runtime_get_if_in_use()
    - dm: dm-crypt: Do not partially accept write BIOs with zoned targets
    - dm: Check for forbidden splitting of zone write operations
    - usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init()
    - usb: gadget: udc: renesas_usb3: fix device leak at unbind
    - usb: musb: omap2430: fix device leak at unbind
    - [arm64,armhf] usb: dwc3: meson-g12a: fix device leaks at unbind
    - [arm64] usb: dwc3: imx8mp: fix device leak at unbind
    - bus: mhi: host: Fix endianness of BHI vector table
    - bus: mhi: host: Detect events pointing to unexpected TREs
    - vt: keyboard: Don't process Unicode characters in K_OFF mode
    - vt: defkeymap: Map keycodes above 127 to K_HOLE
    - [amd64] crypto: qat - lower priority for skcipher and aead algorithms
    - [arm64,armhf] crypto: caam - Prevent crash on suspend with iMX8QM /
      iMX8ULP
    - [amd64] crypto: qat - flush misc workqueue during device shutdown
    - Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()"
    - ksmbd: fix refcount leak causing resource not released
    - ksmbd: extend the connection limiting mechanism to support IPv6
    - tracing: fprobe-event: Sanitize wildcard for fprobe event name
    - ext4: check fast symlink for ea_inode correctly
    - ext4: fix fsmap end of range reporting with bigalloc
    - ext4: fix reserved gdt blocks handling in fsmap
    - ext4: use kmalloc_array() for array space allocation
    - ext4: fix hole length calculation overflow in non-extent inodes
    - btrfs: zoned: fix write time activation failure for metadata block group
    - btrfs: fix incorrect log message for nobarrier mount option
    - btrfs: restore mount option info messages during mount
    - btrfs: fix printing of mount info messages for NODATACOW/NODATASUM
    - apparmor: Fix 8-byte alignment for initial dfa blob streams
    - dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints
    - dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks
      constraints
    - scsi: dt-bindings: mediatek,ufs: Add ufs-disable-mcq flag for UFS host
    - [arm64] scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE
    - scsi: mpi3mr: Fix race between config read submit and interrupt completion
    - ata: libata-scsi: Fix ata_to_sense_error() status handling
    - scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host
      controllers
    - scsi: ufs: ufs-pci: Fix default runtime and system PM levels
    - ata: libata-scsi: Fix CDL control
    - [arm64] soc: qcom: mdt_loader: Ensure we don't read past the ELF header
    - iio: imu: bno055: fix OOB access of hw_xlate array
    - iio: adc: ad_sigma_delta: change to buffer predisable
    - wifi: brcmsmac: Remove const from tbl_ptr parameter in
      wlc_lcnphy_common_read_table()
    - wifi: ath12k: fix dest ring-buffer corruption
    - wifi: ath12k: fix source ring-buffer corruption
    - wifi: ath12k: fix dest ring-buffer corruption when ring is full
    - wifi: ath11k: fix dest ring-buffer corruption
    - wifi: ath11k: fix source ring-buffer corruption
    - wifi: ath11k: fix dest ring-buffer corruption when ring is full
    - [arm64] pwm: mediatek: Handle hardware enable and clock enable separately
    - [arm64] pwm: mediatek: Fix duty and period setting
    - mtd: spi-nor: Fix spi_nor_try_unlock_all()
    - [arm64] mtd: spinand: propagate spinand_wait() errors from
      spinand_write_page()
    - readahead: fix return value of page_cache_next_miss() when no hole is
      found
    - PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge
    - PCI: endpoint: Fix configfs group list head handling
    - PCI: endpoint: Fix configfs group removal on driver teardown
    - [arm64,armhf] PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4
      in epc_features
    - [arm64,armhf] PCI: imx6: Remove apps_reset toggling from
      imx_pcie_{assert/deassert}_core_reset
    - [arm64,armhf] PCI: imx6: Delay link start until configfs 'start' written
    - vsock/virtio: Validate length in packet header before skb_put()
    - vhost/vsock: Avoid allocating arbitrarily-sized SKBs
    - amdgpu/amdgpu_discovery: increase timeout limit for IFWI init
    - [amd64] ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in
      resume context
    - f2fs: fix to avoid out-of-boundary access in dnode page (CVE-2025-38677)
    - jbd2: prevent softlockup in jbd2_log_do_checkpoint()
    - kbuild: userprogs: use correct linker when mixing clang and GNU ld
    - [arm64,armhf] soc/tegra: pmc: Ensure power-domains are in a known state
    - media: gspca: Add bounds checking to firmware parser
    - media: hi556: correct the test pattern configuration
    - [armhf] media: imx: fix a potential memory leak in
      imx_media_csc_scaler_device_init()
    - media: ipu6: isys: Use correct pads for xlate_streams()
    - media: vivid: fix wrong pixel_array control size
    - media: verisilicon: Fix AV1 decoder clock frequency
    - media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free()
    - media: usbtv: Lock resolution while streaming
    - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()
    - media: pisp_be: Fix pm_runtime underrun in probe
    - media: ov2659: Fix memory leaks in ov2659_probe()
    - media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval
    - media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable()
      calls
    - [arm64] media: qcom: camss: cleanup media device allocated resource on
      error path
    - [arm64] media: venus: Add a check for packet size after reading from
      shared memory
    - [arm64] media: venus: Fix MSM8998 frequency table
    - [arm64] media: venus: hfi: explicitly release IRQ during teardown
    - [arm64] media: venus: protect against spurious interrupts during probe
    - [arm64] media: venus: vdec: Clamp param smaller than 1fps and bigger than
      240.
    - [arm64] media: venus: venc: Clamp param smaller than 1fps and bigger than
      240
    - drm/amdgpu/discovery: fix fw based ip discovery
    - drm/amd: Restore cached power limit during resume
    - drm/amdgpu: Avoid extra evict-restore process.
    - drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities
    - drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram()
    - drm/amdgpu: Update external revid for GC v9.5.0
    - drm/amdgpu: update mmhub 3.0.1 client id mappings
    - drm/amdgpu: update mmhub 4.1.0 client id mappings
    - drm/amdkfd: Destroy KFD debugfs after destroy KFD wq
    - drm/amd/display: Add primary plane to commits for correct VRR handling
    - drm/amd/display: fix a Null pointer dereference vulnerability
    - drm/amd/display: Don't overwrite dce60_clk_mgr
    - net, hsr: reject HSR frame if skb can't hold tag
    - sched/ext: Fix invalid task state transitions on class switch
    - ipv6: sr: Fix MAC comparison to be constant-time
    - ACPI: pfr_update: Fix the driver update version check
    - mptcp: drop skb if MPTCP skb extension allocation fails
    - mptcp: pm: kernel: flush: do not reset ADD_ADDR limit
    - mm/damon/ops-common: ignore migration request to invalid nodes
    - [amd64] x86/sev: Ensure SVSM reserved fields in a page validation entry
      are initialized to zero
    - USB: typec: Use str_enable_disable-like helpers
    - usb: typec: fusb302: cache PD RX state
    - btrfs: qgroup: drop unused parameter fs_info from __del_qgroup_rb()
    - btrfs: qgroup: fix race between quota disable and quota rescan ioctl
    - btrfs: move transaction aborts to the error site in
      add_block_group_free_space()
    - btrfs: always abort transaction on failure to add block group to free
      space tree
    - btrfs: abort transaction on unexpected eb generation at btrfs_copy_root()
    - btrfs: explicitly ref count block_group on new_bgs list
    - btrfs: codify pattern for adding block_group to bg_list
    - btrfs: zoned: requeue to unused block group list if zone finish failed
    - xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags
    - btrfs: send: factor out common logic when sending xattrs
    - btrfs: send: only use boolean variables at process_recorded_refs()
    - btrfs: send: add and use helper to rename current inode when processing
      refs
    - btrfs: send: keep the current inode's path cached
    - btrfs: send: avoid path allocation for the current inode when issuing
      commands
    - btrfs: send: use fallocate for hole punching with send stream v2
    - btrfs: send: make fs_path_len() inline and constify its argument
    - netfs: Fix unbuffered write error handling
    - io_uring/net: commit partial buffers on retry
    - ata: libata-scsi: Return aborted command when missing sense and result TF
    - sched_ext: initialize built-in idle state before ops.init()
    - Revert "can: ti_hecc: fix -Woverflow compiler warning"
    - io_uring/futex: ensure io_futex_wait() cleans up properly on failure
    - iov_iter: iterate_folioq: fix handling of offset >= folio size
    - [arm64] iommu/arm-smmu-v3: Fix smmu_domain->nr_ats_masters decrement
    - mmc: sdhci-pci-gli: Add a new function to simplify the code
    - memstick: Fix deadlock by moving removing flag earlier
    - mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER
    - mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency
    - NFS: Fix a race when updating an existing write
    - squashfs: fix memory leak in squashfs_fill_super
    - mm/debug_vm_pgtable: clear page table entries at destroy_args()
    - mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn
    - ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook
      830 G6
    - RDMA/rxe: Flush delayed SKBs while releasing RXE resources
    - [s390x] sclp: Fix SCCB present check
    - [amd64] platform/x86/intel-uncore-freq: Check write blocked for ELC
    - kvm: retry nx_huge_page_recovery_thread creation
    - [amd64] accel/habanalabs/gaudi2: Use kvfree() for memory allocated with
      kvcalloc()
    - drm/amdgpu/swm14: Update power limit logic
    - drm/amd/display: Avoid a NULL pointer dereference
    - drm/amd/display: Don't overclock DCE 6 by 15%
    - drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3
    - drm/amd/display: Fix Xorg desktop unresponsive on Replay panel
    - drm/amd/display: Fix DP audio DTO1 clock source on DCE 6.
    - drm/amd/display: Find first CRTC and its line time in
      dce110_fill_display_configs
    - drm/amd/display: Fill display clock and vblank time in
      dce110_fill_display_configs
    - scsi: core: Fix command pass through retry regression
    - [arm64] soc: qcom: mdt_loader: Fix error return values in
      mdt_header_valid()
    - mptcp: remove duplicate sk_reset_timer call
    - mptcp: disable add_addr retransmission when timeout is 0
    - Mark xe driver as BROKEN if kernel page size is not 4kB
    - [arm64,armhf] PCI: imx6: Add i.MX8Q PCIe Endpoint (EP) support
    - [arm64,armhf] PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features
    - [arm64] PCI: rockchip: Use standard PCIe definitions
    - [arm64] PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining
    - iio: adc: ad7173: fix setting ODR in probe
    - scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers
    - scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems
    - ext4: preserve SB_I_VERSION on remount
    - btrfs: subpage: keep TOWRITE tag until folio is cleaned
    - [arm64] dts: ti: k3-am6*: Add boot phase flag to support MMC boot
    - [arm64] dts: ti: k3-am62*: Add non-removable flag for eMMC
    - [arm64] dts: ti: k3-am6*: Remove disable-wp for eMMC
    - [arm64] dts: ti: k3-am62*: Move eMMC pinmux to top level board file
    - debugfs: fix mount options not being applied
    - smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy()
    - fs/buffer: fix use-after-free when call bh_read() helper
    - use uniform permission checks for all mount propagation changes
    - cpuidle: menu: Remove iowait influence
    - cpuidle: governors: menu: Avoid selecting states with too much latency
    - drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS
    - [arm64] mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1
    - ftrace: Also allocate and copy hash for reading of filter files
    - iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe()
    - iio: proximity: isl29501: fix buffered read on big-endian systems
    - most: core: Drop device reference after usage in get_channel()
    - kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq()
    - cdx: Fix off-by-one error in cdx_rpmsg_probe()
    - usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive
    - [amd64] comedi: Make insn_rw_emulate_bits() do insn->n samples
    - [amd64] comedi: pcl726: Prevent invalid irq number
    - [amd64] comedi: Fix use of uninitialized memory in do_insn_ioctl() and
      do_insnlist_ioctl()
    - usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE
      test
    - usb: renesas-xhci: Fix External ROM access timeouts
    - USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera
    - usb: storage: realtek_cr: Use correct byte order for bcs->Residue
    - USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles
    - usb: typec: maxim_contaminant: disable low power mode when reading
      comparator values
    - usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port
      is clean
    - usb: xhci: Fix slot_id resource race conflict
    - usb: dwc3: Ignore late xferNotReady event to prevent halt timeout
    - usb: dwc3: Remove WARN_ON for device endpoint command timeouts
    - usb: dwc3: pci: add support for the Intel Wildcat Lake
    - iio: light: Use aligned_s64 instead of open coding alignment.
    - iio: light: as73211: Ensure buffer holes are zeroed
    - iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read()
    - tracing: Remove unneeded goto out logic
    - tracing: Limit access to parser->buffer when trace_get_user failed
    - [amd64] drm/i915/icl+/tc: Convert AUX powered WARN to a debug message
    - compiler: remove __ADDRESSABLE_ASM{_STR,}() again
    - [amd64] drm/i915/icl+/tc: Cache the max lane count value
    - ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp()
    - tls: fix handling of zero-length records on the rx_list
    - iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to
      aligned_s64
    - iio: imu: inv_icm42600: use = { } instead of memset()
    - iio: imu: inv_icm42600: Convert to uXX and sXX integer types
    - iio: imu: inv_icm42600: change invalid data error to -EBUSY
    - [amd64] x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper
    - drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor().
    - cgroup/cpuset: Use static_branch_enable_cpuslocked() on
      cpusets_insane_config_key
    - cgroup/cpuset: Fix a partition error with CPU hotplug
    - drm/panic: Move drawing functions to drm_draw
    - drm/format-helper: Add conversion from XRGB8888 to BGR888
    - drm/format-helper: Move helpers for pixel conversion to header file
    - drm/format-helper: Add generic conversion to 32-bit formats
    - iosys-map: Fix undefined behavior in iosys_map_clear()
    - [arm64] RDMA/hns: Fix querying wrong SCC context for DIP algorithm
    - RDMA/bnxt_re: Fix to do SRQ armena by default
    - RDMA/bnxt_re: Fix to remove workload check in SRQ limit path
    - RDMA/bnxt_re: Fix a possible memory leak in the driver
    - RDMA/bnxt_re: Fix to initialize the PBL array
    - RDMA/hns: Fix dip entries leak on devices newer than hip09
    - net: bridge: fix soft lockup in br_multicast_query_expired()
    - scsi: qla4xxx: Prevent a potential error pointer dereference
    - [amd64] iommu/amd: Avoid stack buffer overflow from kernel cmdline
      (CVE-2025-38676)
    - Bluetooth: hci_sync: Fix scan state after PA Sync has been established
    - Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown
    - Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF
    - Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established
    - Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync()
    - [arm64] drm/hisilicon/hibmc: refactored struct hibmc_drm_private
    - [arm64] drm/hisilicon/hibmc: fix the i2c device resource leak when vdac
      init failed
    - [arm64] drm/hisilicon/hibmc: fix the hibmc loaded failed bug
    - ALSA: usb-audio: Fix size validation in convert_chmap_v3()
    - drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session()
    - drm/amd/display: Don't print errors for nonexistent connectors
    - net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM
    - ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add
    - [arm64] net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path
    - ppp: fix race conditions in ppp_fill_forward_path
    - net: ti: icssg-prueth: Fix HSR and switch offload Enablement during
      firwmare reload.
    - cifs: Fix oops due to uninitialised variable
    - phy: mscc: Fix timestamping for vsc8584
    - net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization
    - gve: prevent ethtool ops after shutdown
    - net/smc: fix UAF on smcsk after smc_listen_out()
    - [s390x] mm: Do not map lowcore with identity mapping
    - ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc
    - igc: fix disabling L1.2 PCI-E link substate on I226 on init
    - [armhf] net: dsa: microchip: Fix KSZ9477 HSR port setup issue
    - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit
    - net/sched: Remove unnecessary WARNING condition for empty child qdisc in
      htb_activate
    - ALSA: timer: fix ida_free call while not allocated
    - bonding: update LACP activity flag after setting lacp_active
    - bonding: send LACPDUs periodically in passive mode after receiving
      partner's LACPDU
    - [arm64] Octeontx2-af: Skip overlap check for SPI field
    - net/mlx5: Base ECVF devlink port attrs from 0
    - net/mlx5: Relocate function declarations from port.h to mlx5_core.h
    - net/mlx5: Add IFC bits and enums for buf_ownership
    - net/mlx5e: Query FW for buffer ownership
    - net/mlx5e: Preserve shared buffer capacity during headroom updates
    - ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation
    - [s390x] hypfs: Avoid unnecessary ioctl registration in debugfs
    - [s390x] hypfs: Enable limited access during lockdown
    - netfilter: nf_reject: don't leak dst refcount for loopback packets
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.45
    - rtla: Check pkg-config install
    - trace/fgraph: Fix the warning caused by missing unregister notifier
    - of: dynamic: Fix memleak when of_pci_add_properties() failed
    - of: dynamic: Fix use after free in of_changeset_add_prop_helper()
    - ftrace: Fix potential warning in trace_printk_seq during ftrace_dump
    - perf symbol-minimal: Fix ehdr reading in filename__read_build_id
    - vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER
    - scsi: core: sysfs: Correct sysfs attributes access rights
    - smb: client: fix race with concurrent opens in unlink(2)
    - smb: client: fix race with concurrent opens in rename(2)
    - [arm64] ASoC: codecs: tx-macro: correct tx_macro_component_drv name
    - erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC
    - ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list
    - vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put()
    - [arm64] drm/msm: Defer fd_install in SUBMIT ioctl
    - of: reserved_mem: Restructure call site for dma_contiguous_early_fixup()
    - [arm64] drm/msm/kms: move snapshot init earlier in KMS init
    - [arm64] drm/msm: update the high bitfield of certain DSI registers
    - [arm64] drm/mediatek: Add error handling for old state CRTC in
      atomic_disable
    - [powerpc*] kvm: Fix ifdef to remove build warning
    - HID: input: rename hidinput_set_battery_charge_status()
    - HID: input: report battery status changes immediately
    - net: macb: fix unregister_netdev call order in macb_remove()
    - Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success
    - Bluetooth: hci_event: Mark connection as closed during suspend disconnect
    - Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced
    - Bluetooth: hci_sync: fix set_local_name race condition
    - atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control().
    - drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr
    - drm/nouveau: remove unused memory target test
    - ice: don't leave device non-functional if Tx scheduler config fails
    - ice: use fixed adapter index for E825C embedded devices
    - ice: fix incorrect counter for buffer allocation failures
    - dt-bindings: display/msm: qcom,mdp5: drop lut clock
    - net: dlink: fix multicast stats being counted incorrectly
    - drm/xe/xe_sync: avoid race during ufence signaling
    - drm/xe: Don't trigger rebind on initial dma-buf validation
    - phy: mscc: Fix when PTP clock is register and unregister
    - bnxt_en: Fix memory corruption when FW resources change during ifdown
    - bnxt_en: Adjust TX rings if reservation is less than requested
    - bnxt_en: Fix stats context reservation logic
    - net/mlx5: Reload auxiliary drivers on fw_activate
    - net/mlx5: Fix lockdep assertion on sync reset unload event
    - net/mlx5: Nack sync reset when SFs are present
    - net/mlx5e: Update and set Xon/Xoff upon MTU set
    - net/mlx5e: Update and set Xon/Xoff upon port speed set
    - net/mlx5e: Set local Xoff after FW update
    - net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts
    - net: stmmac: xgmac: Correct supported speed modes
    - net: stmmac: Set CIC bit only for TX queues with COE
    - [amd64,arm64] hv_netvsc: Link queues to NAPIs
    - [amd64,arm64] net: hv_netvsc: fix loss of early receive events from host
      during channel open.
    - net: rose: split remove and free operations in rose_remove_neigh()
    - net: rose: convert 'use' field to refcount_t
    - net: rose: include node references in rose_neigh refcount
    - sctp: initialize more fields in sctp_v6_from_sk()
    - l2tp: do not use sock_hold() in pppol2tp_session_get_sock()
    - fbnic: Move phylink resume out of service_task and into open/close
    - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare
    - net: macb: Disable clocks once
    - [amd64] KVM: x86: use array_index_nospec with indices that come from guest
    - [riscv64] KVM: fix stack overrun when loading vlenb
    - [amd64] x86/microcode/AMD: Handle the case of no BIOS microcode
    - [amd64] x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on
      AMD/HYGON
    - HID: asus: fix UAF via HID_CLAIMED_INPUT validation
    - HID: multitouch: fix slab out-of-bounds access in mt_report_fixup()
    - HID: quirks: add support for Legion Go dual dinput modes
    - HID: logitech: Add ids for G PRO 2 LIGHTSPEED
    - HID: wacom: Add a new Art Pen 2
    - HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()
    - Revert "drm/amdgpu: fix incorrect vm flags to map bo"
    - blk-zoned: Fix a lockdep complaint about recursive locking
    - dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted
    - fs/smb: Fix inconsistent refcnt update
    - net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions
    - smb3 client: fix return code mapping of remap_file_range
    - xfs: do not propagate ENODATA disk errors into xattr code
    - drm/xe/vm: Clear the scratch_pt pointer on error
    - drm/nouveau/disp: Always accept linear modifier
    - drm/nouveau: fix error path in nvkm_gsp_fwsec_v2
    - drm/mediatek: Fix device/node reference count leaks in
      mtk_drm_get_all_drm_priv
    - drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode
    - net: rose: fix a typo in rose_clear_routes()
    - PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS
    - PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up
    - Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to
      LANE0_1_STATUS"
    - [arm64] thermal/drivers/mediatek/lvts_thermal: Change lvts commands array
      to static const
    - [arm64] thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their
      sizes to driver data
    - [arm64] thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.46
    - bpf: Add cookie object to bpf maps
    - bpf: Move bpf map owner out of common struct
    - bpf: Move cgroup iterator helpers to bpf.h
    - bpf: Fix oob access in cgroup local storage (CVE-2025-38502)
    - btrfs: fix race between logging inode and checking if it was logged before
    - btrfs: fix race between setting last_dir_index_offset and inode logging
    - btrfs: avoid load/store tearing races when checking if an inode was logged
    - cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN
    - drm/amd/display: Don't warn when missing DCE encoder caps
    - cpupower: Fix a bug where the -t option of the set subcommand was not
      working.
    - Bluetooth: hci_sync: Avoid adding default advertising on startup
    - btrfs: zoned: skip ZONE FINISH of conventional zones
    - fs: writeback: fix use-after-free in __mark_inode_dirty()
    - tee: fix NULL pointer dereference in tee_shm_put
    - tee: fix memory leak in tee_dyn_shm_alloc_helper
    - [arm64] dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro
    - [arm64] tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible"
    - [arm64] dts: imx8mp-tqma8mpql: fix LDO5 power off
    - [arm64] dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics
      i.MX8M Plus DHCOM
    - [arm64] dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M
      Plus eDM SBC
    - HID: simplify snto32()
    - HID: stop exporting hid_snto32()
    - HID: core: Harden s32ton() against conversion to 0 bits (CVE-2025-38556)
    - net: usb: qmi_wwan: fix Telit Cinterion FN990A name
    - net: usb: qmi_wwan: fix Telit Cinterion FE990A name
    - net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition
    - [arm64] mmc: sdhci-of-arasan: Support for emmc hardware reset
    - [arm64] mmc: sdhci-of-arasan: Ensure CD logic stabilization before
      power-up
    - wifi: cfg80211: fix use-after-free in cmp_bss()
    - wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info
      work
    - wifi: mt76: mt7925: fix locking in mt7925_change_vif_links()
    - wifi: mt76: prevent non-offchannel mgmt tx during scan/roc
    - wifi: mt76: free pending offchannel tx frames on wcid cleanup
    - wifi: mt76: fix linked list corruption
    - netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in()
      after confirm
    - netfilter: conntrack: helper: Replace -EEXIST by -EBUSY
    - wifi: iwlwifi: uefi: check DSM item validity
    - Bluetooth: vhci: Prevent use-after-free by removing debugfs files early
    - Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()
    - netfilter: nft_flowtable.sh: re-run with random mtu sizes
    - net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y
    - [amd64] xirc2ps_cs: fix register access when enabling FullDuplex
    - mISDN: Fix memory leak in dsp_hwec_enable()
    - bnxt_en: fix incorrect page count in RX aggr ring log
    - icmp: fix icmp_ndo_send address translation for reply direction
    - net: macb: Fix tx_ptr_lock locking
    - macsec: read MACSEC_SA_ATTR_PN with nla_get_uint
    - net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync()
    - net: mctp: mctp_fraq_queue should take ownership of passed skb
    - ice: fix NULL access of tx->in_use in ice_ll_ts_intr
    - [amd64,arm64] idpf: set mac type when adding and removing MAC filters
    - i40e: remove read access to debugfs files
    - i40e: Fix potential invalid access when MAC list is empty
    - ixgbe: fix incorrect map used in eee linkmode
    - wifi: ath11k: fix group data packet drops during rekey
    - net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6
    - [arm64] net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets
    - net: skb: add pskb_network_may_pull_reason() helper
    - net: tunnel: add pskb_inet_may_pull_reason() helper
    - net: vxlan: add skb drop reasons to vxlan_rcv()
    - net: vxlan: make vxlan_snoop() return drop reasons
    - vxlan: Fix NPD when refreshing an FDB entry with a nexthop object
    - net: vxlan: make vxlan_set_mac() return drop reasons
    - net: vxlan: use kfree_skb_reason() in vxlan_xmit()
    - net: vxlan: use kfree_skb_reason() in vxlan_mdb_xmit()
    - net: vxlan: rename SKB_DROP_REASON_VXLAN_NO_REMOTE
    - vxlan: Refresh FDB 'updated' time upon 'NTF_USE'
    - vxlan: Avoid unnecessary updates to FDB 'used' time
    - vxlan: Add RCU read-side critical sections in the Tx path
    - vxlan: Rename FDB Tx lookup function
    - vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects
    - wifi: cw1200: cap SSID length in cw1200_do_join()
    - wifi: libertas: cap SSID len in lbs_associate()
    - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result()
    - [arm64] net: thunder_bgx: add a missing of_node_put
    - [arm64] net: thunder_bgx: decrement cleanup index before use
    - ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init()
    - net/smc: Remove validation of reserved bits in CLC Decline message
    - mctp: return -ENOPROTOOPT for unknown getsockopt options
    - ax25: properly unshare skbs in ax25_kiss_rcv()
    - net: atm: fix memory leak in atm_register_sysfs when device_register fail
    - ppp: fix memory leak in pad_compress_skb
    - phy: mscc: Stop taking ts_lock for tx_queue and use its own lock
    - ALSA: usb-audio: Add mute TLV for playback volumes on some devices
    - [amd64] accel/ivpu: Prevent recovery work from being queued during device
      removal
    - ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids()
    - [arm64] ftrace: fix unreachable PLT for ftrace_caller in init_module with
      CONFIG_DYNAMIC_FTRACE
    - pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region()
    - io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU
      (CVE-2025-38453)
    - [amd64] x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and
      arch_sync_kernel_mappings()
    - mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE
    - mm: move page table sync declarations to linux/pgtable.h
    - mm: fix possible deadlock in kmemleak
    - mm: slub: avoid wake up kswapd in set_track_prepare
    - sched: Fix sched_numa_find_nth_cpu() if mask offline
    - ocfs2: prevent release journal inode after journal shutdown
    - of_numa: fix uninitialized memory nodes causing kernel panic
    - [arm64] soc: qcom: mdt_loader: Deal with zero e_shentsize
    - wifi: mwifiex: Initialize the chan_stats array to zero
    - wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete
    - wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data()
    - wifi: mt76: mt7925: fix the wrong bss cleanup for SAP
    - net: ethernet: oa_tc6: Handle failure of spi_setup
    - drm/amdgpu: drop hw access in non-DC audio fini
    - drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG
    - [amd64] platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042
      quirks list
    - scsi: lpfc: Fix buffer free/clear order in deferred receive path
    - batman-adv: fix OOB read/write in network-coding decode
    - cifs: prevent NULL pointer dereference in UTF16 conversion
    - e1000e: fix heap overflow in e1000_set_eeprom
    - net: pcs: rzn1-miic: Correct MODCTRL register offset
    - fs/fhandle.c: fix a race in call of has_locked_children() (CVE-2025-38306)
    - [arm64,armhf] net: dsa: add hook to determine whether EEE is supported
    - [arm64,armhf] net: dsa: provide implementation of .support_eee()
    - [armhf] net: dsa: b53/bcm_sf2: implement .support_eee() method
    - [armhf] net: dsa: b53: do not enable EEE on bcm63xx (CVE-2025-38272)
    - md/raid1,raid10: don't ignore IO flags (CVE-2025-22125)
    - md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT
    - md/raid1,raid10: strip REQ_NOWAIT from member bios
    - ext4: define ext4_journal_destroy wrapper
    - ext4: avoid journaling sb update on error if journal is destroying
      (CVE-2025-22113)
    - wifi: ath11k: update channel list in reg notifier instead reg worker
      (CVE-2025-23133)
    - wifi: ath11k: update channel list in worker when wait flag is set
    - net: fix NULL pointer dereference in l3mdev_l3_rcv (CVE-2025-22103)
    - md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb
      (CVE-2025-22124)
    - mm: slub: Print the broken data before restoring them
    - mm: slub: call WARN() when detecting a slab corruption
    - mm, slab: cleanup slab_bug() parameters
    - mm/slub: avoid accessing metadata when pointer is invalid in object_err()
    - nouveau: fix disabling the nonstall irq due to storm code
    - mm: fix accounting of memmap pages
    - [arm64] thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum
      threshold
    - ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model
    - ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY
    - Revert "drm/amdgpu: Avoid extra evict-restore process."
    - pcmcia: omap: Add missing check for platform_get_resource
    - pcmcia: Add error handling for add_interval() in do_validate_mem()
    - [amd64] platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan
      quirk
    - [amd64] platform/x86/intel: power-domains: Use
      topology_logical_package_id() for package ID
    - block: add a queue_limits_commit_update_frozen helper
    - scsi: sr: Reinstate rotational media flag
    - drm/bridge: ti-sn65dsi86: fix REFCLK setting
    - perf bpf-event: Fix use-after-free in synthesis
    - perf bpf-utils: Constify bpil_array_desc
    - perf bpf-utils: Harden get_bpf_prog_info_linear
    - drm/amd/amdgpu: Fix missing error return on kzalloc failure
    - tools: gpio: remove the include directory on make clean
    - md: prevent incorrect update of resync/recovery offset
    - [riscv64] ACPI: RISC-V: Fix FFH_CPPC_CSR error handling
    - [riscv64] Only allow LTO with CMODEL_MEDANY
    - [riscv64] use lw when reading int cpu in new_vmalloc_check
    - [riscv64] use lw when reading int cpu in asm_per_cpu
    - [riscv64] bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG
    - [riscv64] bpf: use lw when reading int cpu in bpf_get_smp_processor_id
    - md/raid1: fix data lost for writemostly rdev
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.47
    - [amd64] Add mitigations for VMSCAPE (CVE-2025-40300):
      - Documentation/hw-vuln: Add VMSCAPE documentation
      - x86/vmscape: Enumerate VMSCAPE bug
      - x86/vmscape: Add conditional IBPB mitigation
      - x86/vmscape: Enable the mitigation
      - x86/bugs: Move cpu_bugs_smt_update() down
      - x86/vmscape: Warn when STIBP is disabled with SMT
      - x86/vmscape: Add old Intel CPUs to affected list
    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.48
    - fhandle: use more consistent rules for decoding file handle from userns
    - dma-debug: store a phys_addr_t in struct dma_debug_entry
    - dma-mapping: trace dma_alloc/free direction
    - dma-mapping: use trace_dma_alloc for dma_alloc* instead of using
      trace_dma_map
    - dma-mapping: trace more error paths
    - dma-debug: don't enforce dma mapping check on noncoherent allocations
    - net/mlx5: HWS, change error flow on matcher disconnect
    - mm: introduce and use {pgd,p4d}_populate_kernel()
    - dma-mapping: fix swapped dir/flags arguments to trace_dma_alloc_sgt_err
    - dma-debug: fix physical address calculation for struct dma_debug_entry
    - nvme-pci: skip nvme_write_sq_db on empty rqlist
    - Revert "udmabuf: fix vmap_udmabuf error page set"
    - ext4: introduce linear search for dentries
    - [amd64] drm/i915/pmu: Fix zero delta busyness issue
    - drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed
    - Revert "drm/amd/display: Optimize cursor position updates"
    - ALSA: hda/realtek: Fix built-in mic assignment on ASUS VivoBook X515UA
    - drm/amdgpu: Add back JPEG to video caps for carrizo and newer
    - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read
    - SUNRPC: call xs_sock_process_cmsg for all cmsg
    - NFSv4: Don't clear capabilities that won't be reset (Closes: #1114898)
    - trace/fgraph: Fix error handling
    - tracing: Fix tracing_marker may trigger page fault during preempt_disable
    - nfs/localio: remove extra indirect nfs_to call to check {read,write}_iter
    - nfs/localio: add direct IO enablement with sync and async IO support
    - nfs/localio: restore creds before releasing pageio data
    - ftrace/samples: Fix function size computation
    - fs/nfs/io: make nfs_start_io_*() killable
    - NFS: Serialise O_DIRECT i/o and truncate()
    - NFSv4.2: Serialise O_DIRECT i/o and fallocate()
    - NFSv4.2: Serialise O_DIRECT i/o and clone range
    - NFSv4.2: Serialise O_DIRECT i/o and copy range
    - NFS: nfs_invalidate_folio() must observe the offset and size arguments
    - NFSv4/flexfiles: Fix layout merge mirror check.
    - tracing: Silence warning when chunk allocation fails in trace_pid_write
    - [s390x] pai: Deny all events not handled by this PMU
    - [s390x] cpum_cf: Deny all sampling events by counter PMU
    - bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt
    - bpf: Allow fall back to interpreter for programs with stack size <= 512
    - bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init()
    - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate
      psock->cork.
    - proc: fix type confusion in pde_set_flags()
    - Revert "SUNRPC: Don't allow waiting for exiting tasks"
    - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN
    - ocfs2: fix recursive semaphore deadlock in fiemap call
    - btrfs: fix squota compressed stats leak
    - btrfs: fix subvolume deletion lockup caused by inodes xarray race
    - [amd64] i2c: i801: Hide Intel Birch Stream SoC TCO WDT
    - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM
      wakeups
    - [armhf] mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer
    - [armhf] mtd: rawnand: stm32_fmc2: fix ECC overwrite
    - fuse: do not allow mapping a non-regular backing file
    - fuse: check if copy_file_range() returns larger than requested size
    - fuse: prevent overflow in copy_file_range return value
    - mm/khugepaged: fix the address passed to notifier on testing young
    - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison
      memory
    - mm/memory-failure: fix redundant updates for already poisoned pages
    - mm/damon/core: set quota->charged_from to jiffies at first charge window
    - mm/damon/lru_sort: avoid divide-by-zero in
      damon_lru_sort_apply_parameters()
    - [arm64] drm/mediatek: fix potential OF node use-after-free
    - drm/xe: Attempt to bring bos back to VRAM after eviction
    - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time
    - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages
    - netlink: specs: mptcp: add missing 'server-side' attr
    - netlink: specs: mptcp: clearly mention attributes
    - netlink: specs: mptcp: replace underscores with dashes in names
    - netlink: specs: mptcp: fix if-idx attribute type
    - kernfs: Fix UAF in polling when open file is released
    - libceph: fix invalid accesses to ceph_connection_v1_info
    - ceph: fix race condition validating r_parent before applying state
    - ceph: fix race condition where r_parent becomes stale before sending
      message
    - mm/damon/sysfs: fix use-after-free in state_show()
    - mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters()
    - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range()
    - [arm64] mtd: spinand: winbond: Fix oob_layout for W25N01JW
    - btrfs: use readahead_expand() on compressed extents
    - btrfs: fix corruption reading compressed range when block size is smaller
      than page size
    - hrtimers: Unconditionally update target CPU base after offline timer
      migration
    - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table
    - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO
      runtime PM wakeups"
    - tty: hvc_console: Call hvc_kick in hvc_write unconditionally
    - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks
    - USB: serial: option: add Telit Cinterion FN990A w/audio compositions
    - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions
    - [arm64] drm/panthor: validate group queue count
    - [arm64,armhf] net: fec: Fix possible NPD in
      fec_enet_phy_reset_after_clk_enable()
    - genetlink: fix genl_bind() invoking bind() after -EPERM
    - net: bridge: Bounce invalid boolopts
    - tunnels: reset the GSO metadata before reusing the skb
    - docs: networking: can: change bcm_msg_head frames member to support
      flexible array
    - igb: fix link test skipping when interface is admin down
    - i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path
    - drm/amd/display: use udelay rather than fsleep
    - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when
      j1939_local_ecu_get() failed
    - can: j1939: j1939_local_ecu_get(): undo increment when
      j1939_local_ecu_get() fails
    - netfilter: nft_set_pipapo: remove unused arguments
    - netfilter: nft_set: remove one argument from lookup and update functions
    - netfilter: nft_set_pipapo: merge pipapo_get/lookup
    - netfilter: nft_set_pipapo: don't return bogus extension pointer
    - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups
    - netfilter: nft_set_rbtree: continue traversal if element is inactive
    - netfilter: nf_tables: Reintroduce shortened deletion notifications
    - netfilter: nf_tables: place base_seq in struct net
    - netfilter: nf_tables: make nft_set_do_lookup available unconditionally
    - netfilter: nf_tables: restart set lookup on base_seq change
    - net: hsr: Add VLAN CTAG filter support
    - hsr: use rtnl lock when iterating over ports
    - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr
    - [arm64] phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties
    - [amd64] dmaengine: idxd: Remove improper idxd_free
    - [amd64] dmaengine: idxd: Fix refcount underflow on module unload
    - [amd64] dmaengine: idxd: Fix double free in idxd_setup_wqs()
    - [amd64] dmaengine: ti: edma: Fix memory allocation size for
      queue_priority_map
    - xhci: fix memory leak regression when freeing xhci vdev devices depth
      first
    - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels
    - [amd64,arm64] usb: typec: tcpm: properly deliver cable vdms to altmode
      drivers
    - [arm64] dmaengine: qcom: bam_dma: Fix DT error handling for
      num-channels/ees
    - [arm64] phy: tegra: xusb: fix device and OF node leak at probe
    - [armhf] phy: ti: omap-usb2: fix device leak at unbind
    - [armhf] phy: ti-pipe3: fix device leak at unbind
    - [amd64] x86/cpu/topology: Always try cpu_parse_topology_ext() on AMD/Hygon
    - net: mdiobus: release reset_gpio in mdiobus_unregister_device()
    - [amd64] drm/i915/power: fix size for for_each_set_bit() in abox iteration
    - drm/amdgpu: fix a memory leak in fence cleanup when unloading
    - netfilter: nft_set_pipapo: fix null deref for empty set

[ Santiago Ruano Rincón ]
  * d/salsa-ci.yml: Merge the extract-source job into the build's job script
  * d/salsa-ci.yml: Suppress unreleased changes and mismatching distribution
    lintian tags.
  * d/salsa-ci.yml: Early move orig tarballs back where they can be cached

[ Salvatore Bonaccorso ]
  * [rt] Add new signing key for Daniel Wagner
  * [rt] Update to 6.12.43-rt12
  * [amd64] x86/bugs: Add SRSO_USER_KERNEL_NO support
  * [amd64] x86/bugs: KVM: Add support for SRSO_MSR_FIX
  * [amd64] KVM: SVM: Set/clear SRSO's BP_SPEC_REDUCE on 0 <=> 1 VM count
    transitions

-- Salvatore Bonaccorso <carnil@debian.org>  Sat, 20 Sep 2025 20:41:31 +0200

--- Cambios de base-files ---
base-files (12.4+deb12u15) bookworm; urgency=medium

* Change /etc/debian_version to 12.15, for Debian 12.15 point release.

-- Santiago Vila <sanvila@debian.org>  Thu, 02 Jul 2026 21:05:00 +0200

base-files (12.4+deb12u14) bookworm; urgency=medium

* Change /etc/debian_version to 12.14, for Debian 12.14 point release.

-- Santiago Vila <sanvila@debian.org>  Fri, 08 May 2026 18:15:00 +0200

base-files (12.4+deb12u13) bookworm; urgency=medium

* Change /etc/debian_version to 12.13, for Debian 12.13 point release.

-- Santiago Vila <sanvila@debian.org>  Fri, 02 Jan 2026 13:40:00 +0100

--- Cambios de btrfs-progs ---
btrfs-progs (6.2-1+deb12u2) bookworm; urgency=medium

* Acknowledge NMU.
  * Cherry pick upstream commit:cba1ef1 "btrfs-progs: dev stats: fix printing
    wrong values in tabular output" because this bug hides file and/or
    metadata corruption that requires sysadmin action; That action is `btrfs
    scrub`, which repairs the bad data (when there is a 2nd copy ie: raid1
    profile).  If a 2nd copy is not available then the necessity of having to
    restore corrupted files from backup (in profile=single) will no longer be
    hidden.  Thanks to Craig Hesling for reporting the bug and identifying the
    commit of the fix (Closes: #1116278).
  * Update the Maintainer field, because Adam Borowski is no longer
    maintaining this package in Debian.

-- Nicholas D Steeves <sten@debian.org>  Fri, 31 Oct 2025 15:16:11 -0400

--- Cambios de chrony ---
chrony (4.3-2+deb12u3) bookworm; urgency=medium

* debian/chrony.if-{post-down,up}:
    - Adjust the if-up and if-down hook scripts so that they always exit
    successfully. (Closes: #1011533)

-- Vincent Blut <vincent.debian@free.fr>  Thu, 02 Jul 2026 15:56:53 +0200

chrony (4.3-2+deb12u2) bookworm; urgency=medium

* debian/patches/:
    - Add refclock_phc_open-device-for-writing-with-extpps-option.patch.
    Thanks to Jan Lübbe for the report. (Closes: #1127659)

* debian/tests/upstream-simulation-test-suite:
    - Prevent simulation test failures.

-- Vincent Blut <vincent.debian@free.fr>  Tue, 17 Feb 2026 16:40:15 +0100

--- Cambios de clamav (clamav-base clamav-daemon clamav-freshclam clamdscan libclamav12) ---
clamav (1.4.3+dfsg-1~deb12u2) bookworm; urgency=medium

* Revert moving files to usr/lib

-- Sebastian Andrzej Siewior <sebastian@breakpoint.cc>  Wed, 07 Jan 2026 21:19:45 +0100

clamav (1.4.3+dfsg-1~deb12u1) bookworm; urgency=medium

* Import 1.4.3
    - CVE-2025-20234 (Fixed a possible buffer overflow read bug in the UDF
      file parser that may write to a temp file and thus disclose information,
      or it may crash and cause a denial-of-service (DoS) condition.)
      Closes: #1108045
  * Move files from lib to usr/lib (Closes: #1073612).
  * Mark clamav-base as foreign (Closes: #1060889).
  * Add libclamav12 after so bump.
  * Move documentation to clamav-doc.

-- Sebastian Andrzej Siewior <sebastian@breakpoint.cc>  Sun, 21 Dec 2025 17:37:50 +0100

--- Cambios de curl (libcurl3-gnutls libcurl4) ---
curl (7.88.1-10+deb12u15) bookworm; urgency=medium

* Fix 7 CVEs:
    - CVE-2025-10148
    - CVE-2025-14524
    - CVE-2025-14819
    - CVE-2026-3783
    - CVE-2026-3784
    - CVE-2026-5773
    - CVE-2026-7168

-- Samuel Henrique <samueloph@debian.org>  Fri, 08 May 2026 07:16:21 -0700

--- Cambios de distro-info-data ---
distro-info-data (0.58+deb12u7) bookworm; urgency=medium

* Add Ubuntu 26.10 "Stonking Stingray" (LP: #2150234).

-- Stefano Rivera <stefanor@debian.org>  Sat, 25 Apr 2026 09:18:53 -0400

distro-info-data (0.58+deb12u6) bookworm; urgency=medium

* Update data to 0.68:
    - Update the bookworm EoL
    - Add Ubuntu 26.04 LTS "Resolute Raccoon" (LP: #2126961)

-- Stefano Rivera <stefanor@debian.org>  Sat, 18 Oct 2025 16:50:26 +0200

--- Cambios de dpkg ---
dpkg (1.21.23) bookworm; urgency=medium

[ Guillem Jover ]
  * dpkg-deb: Fix cleanup for control member with restricted directories.
    Reported by zhutyra on HackerOne. Fixes CVE-2025-6297.
  * Perl modules:
    - Dpkg::BuildDriver::DebianRules: Fix uninitialized Perl variables.
      Closes: #1107971
    - Dpkg::BuildDriver::DebianRules: Fix R³ dpkg/target/<target> values
      handling.
  * Code internals:
    - libdpkg: Fix varbuf memory leak in pkg_source_version().
    - dpkg-deb: Initialize threads_max in no-uniform-compression mode.
    - libdpkg: Handle tar long GNU names and links not being NUL terminated.
      Closes: #1061404
    - libdpkg: Do not segfault when adding triggers in no-act mode.
      Closes: #1108192
    - libdpkg: Terminate zstd decompression when we have no more data.
      Reported by Yashashree Gund <yash_gund@live.com>. Closes: #1129722
      Fixes CVE-2026-2219.
  * Build system:
    - Build gitlab CI images for bookworm instead of sid.
  * Localization:
    - Fix typos in Swedish man pages translations. Closes: #1065575
    - Update Swedish translations.
      Thanks to Peter Krefting <peter@softwolves.pp.se>. Closes: #1070010

[ Helge Kreutzmann ]
  * Localization:
    - Update German man pages translation.

-- Guillem Jover <guillem@debian.org>  Sat, 07 Mar 2026 13:15:41 +0100

--- Cambios de glib2.0 (libglib2.0-0) ---
glib2.0 (2.74.6-2+deb12u9) bookworm; urgency=medium

* Non-maintainer upload by the LTS Security Team.
  * Add patch to fix timezone handling with Debian & Ubuntu's symlinks
    (Closes: #1119919) (LP: #2130378)
  * CVE-2026-0988: Missing input validation in g_buffered_input_stream_peek
    (Closes: #1125752)
  * CVE-2026-1484: Integer overflow in base64 encoding can cause memory corruption.
    (Closes: #1126551)
  * CVE-2026-1485: Buffer underflow vulnerability in content type parsing
    caused by (signed) integer wrap for large inputs. (Closes: #1126550)
  * CVE-2026-1489: Integer overflow in unicode conversion
    can lead to memory corruption. (Closes: #1126549)

-- Andreas Henriksson <andreas@fatal.se>  Fri, 13 Feb 2026 12:35:33 +0100

glib2.0 (2.74.6-2+deb12u8) bookworm; urgency=medium

* Team upload.
  * CVE-2025-13601: integer overflow into heap buffer overflow escaping
    very large strings in g_escape_uri_string (Closes: #1121488).
  * CVE-2025-14087: buffer overwrite when processing large GVariant strings.
    (Closes: #1122347).
  * CVE-2025-14512: interger overflow into buffer overwrite when processing
    file attributes in GIO's escape_byte_string (Closes: #1122346).

-- Emilio Pozuelo Monfort <pochu@debian.org>  Mon, 15 Dec 2025 15:29:38 +0100

--- Cambios de glibc (libc6 libc-bin libc-l10n locales) ---
glibc (2.36-9+deb12u14) bookworm; urgency=medium

* debian/patches/git-updates.diff: update from upstream stable branch:
    - Fix a performance bottleneck with the Address Sanitizer (ASAN) on 32-bit
      arm.
    - Fix _dl_find_object when ld.so has LOAD segment gaps, causing wrong
      backtrace unwinding. This affects at least arm64.
    - Add GLIBC_ABI_DT_X86_64_PLT symbol version on amd64.
    - Fix typo in wmemset ifunc selector that caused AVX2/AVX512 paths to be
      skipped.
    - Fix POWER optimized rawmemchr function on ppc64el.
    - Optimize trylock for high cache contention workloads.
    - Fix and integer overflow in _int_memalign leading to heap corruption
      (CVE-2026-0861).  Closes: #1125678.
    - Fix stack contents leak in getnetbyaddr (CVE-2026-0915).  Closes:
      #1125748.
    - Fix bug in wordexp, which could return uninitialized memory when using
      WRDE_REUSE together with WRDE_APPEND (CVE-2025-15281).  Closes: #1126266.
    - Fix invalid pointer arithmetic in ANSI_X3.110 iconv module
    - Fix a typo preventing new tst-wordexp-reuse-mem to run
    - Fix incorrect handling of DNS responses in gethostbyaddr and
      gethostbyaddr_r (CVE-2026-4437).  Closes: #1131435.
    - Fix invalid DNS hostnames returned by gethostbyaddr and
      gethostbyaddr_r (CVE-2026-4438).  Closes: #1131887.
    - Fix random failure of tst-link-map-contiguous-ldso.
    - Fix a possible crash due to an assertion failure when converting
      inputs from the IBM139x character sets (CVE-2026-4046).  Closes:
      #1132499.
  * d/p/amd64/local-revert-x86-64-add-GLIBC_ABI_DT_X86_64_PLT-version.diff:
    revert addition of the GLIBC_ABI_DT_X86_64_PLT symbol version used as ABI
    flag, as the dpkg-shlibdeps version in bookworm is not able to handle it
    (see #1122107).

-- Aurelien Jarno <aurel32@debian.org>  Mon, 27 Apr 2026 22:14:33 +0200

--- Cambios de graphite2 (libgraphite2-3) ---
graphite2 (1.3.14-1+deb12u1) bookworm; urgency=medium

* debian/patches/ad78c6b7319909e1540c1b134e115ced03417866.patch:
    fix CVE-2026-50593

-- Rene Engelhard <rene@debian.org>  Sat, 06 Jun 2026 19:58:37 +0200

--- Cambios de grub2 (grub2-common grub-common grub-pc grub-pc-bin) ---
grub2 (2.06-13+deb12u2) bookworm; urgency=medium

[ Julian Andres Klode ]
  * Set Protected: yes for -signed packages so they cannot easily be removed
  * debian/patches: Backport to bookworm

[ Felix Zielcke ]
  * Add salsa-ci.yml and disable blhc and reprotest pipelines.

[ Luca Boccassi ]
  * salsa-ci: configure for stable builds

[ Mate Kukri ]
  * Cherry-pick remaining XFS delta from 2.12
  * Cherry-pick upstream vulnerability fixes
  * Cherry-pick extfs regression patch
  * Cherry-pick xfs regression patches
  * Bump SBAT level to grub,5
  * fs/fat: Don't error when mtime is 0 (LP: #2098641)
  * SECURITY UPDATE: video/readers/jpeg: Do not permit duplicate SOF0 markers in JPEG
    - CVE-2024-45774
  * SECURITY UPDATE: commands/extcmd: Missing check for failed allocation
    - CVE-2024-45775
  * SECURITY UPDATE: gettext: Integer overflow leads to heap OOB write or read
    - CVE-2024-45776
  * SECURITY UPDATE: gettext: Integer overflow leads to heap OOB write
    - CVE-2024-45777
  * SECURITY UPDATE: fs/bfs: Integer overflow
    - CVE-2024-45778
  * SECURITY UPDATE: fs/bfs: integer overflow leads to heap OOB read
    - CVE-2024-45779
  * SECURITY UPDATE: fs/tar: Integer overflow leads to heap OOB write
    - CVE-2024-45780
  * SECURITY UPDATE: fs/ufs: `strcpy` use leading to heap OOB write
    - CVE-2024-45781
  * SECURITY UPDATE: fs/hfs: `strcpy` use leading to potential heap OOB write
    - CVE-2024-45782
  * SECURITY UPDATE: fs/hfsplus: incorrect refcount handling leading to UAF
    - CVE-2024-45783
  * SECURITY UPDATE: command/gpg: Use-after-free due to hooks not being removed on module unload
    - CVE-2025-0622
  * SECURITY UPDATE: net: Out-of-bounds write in grub_net_search_config_file()
    - CVE-2025-0624
  * SECURITY UPDATE: UFS: Integer overflow may lead to heap based out-of-bounds write when handling symlinks
    - CVE-2025-0677
  * SECURITY UPDATE: squash4: Integer overflow may lead to heap based out-of-bounds write when reading data
    - CVE-2025-0678
  * SECURITY UPDATE: reiserfs: Integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading data
    - CVE-2025-0684
  * SECURITY UPDATE: jfs: Integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading data
    - CVE-2025-0685
  * SECURITY UPDATE: romfs: Integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading data
    - CVE-2025-0686
  * SECURITY UPDATE: udf: Heap based buffer overflow  in grub_udf_read_block() may lead to arbitrary code execution
    - CVE-2025-0689
  * SECURITY UPDATE: read: Integer overflow may lead to out-of-bounds write
    - CVE-2025-0690
  * SECURITY UPDATE: commands/dump: The dump command is not in lockdown when secure boot is enabled
    - CVE-2025-1118
  * SECURITY UPDATE: fs/hfs: Integer overflow may lead to heap based out-of-bounds write
    - CVE-2025-1125
  * SECURITY UPDATE: insmod: incorrect refcount handling leading to UAF [LP: #2055835]

[ Steve McIntyre ]
  * Drop NTFS patches that seem to be causing regressions
  * Remove NTFS from the monolithic EFI grub image, so we don't sign
    vulnerable code.
  * Similarly, remove jfs - we have doubts.
  * Bump SBAT levels:
    + grub,5 now we have the 2025 CVE fixes included
    + grub.debian,5
    + grub.debian12,1

-- Steve McIntyre <93sam@debian.org>  Wed, 01 Apr 2026 21:03:46 +0100

--- Cambios de libbytes-random-secure-perl ---
libbytes-random-secure-perl (0.29-4~deb13u1~deb12u1) bookworm; urgency=medium

* Rebuild for bookworm

-- Salvatore Bonaccorso <carnil@debian.org>  Fri, 26 Jun 2026 20:35:55 +0200

libbytes-random-secure-perl (0.29-4~deb13u1) trixie; urgency=medium

* Rebuild for trixie

-- Salvatore Bonaccorso <carnil@debian.org>  Fri, 26 Jun 2026 20:32:02 +0200

libbytes-random-secure-perl (0.29-4) unstable; urgency=medium

* Team upload.
  * Fix incorrect usage of seed in PRNG (CVE-2026-11625)

-- Salvatore Bonaccorso <carnil@debian.org>  Fri, 26 Jun 2026 17:27:21 +0200

--- Cambios de libcap2 (libcap2 libcap2-bin) ---
libcap2 (1:2.66-4+deb12u3) bookworm; urgency=medium

* Add patch fixing CVE-2026-4878 (TOCTOU race condition)

-- Christian Kastner <ckk@debian.org>  Mon, 06 Apr 2026 22:27:39 +0200

--- Cambios de libhtml-parser-perl ---
libhtml-parser-perl (3.81-1+deb12u1) bookworm; urgency=medium

* Fix heap-use-after-free in _decode_entities (CVE-2026-8829)

-- Salvatore Bonaccorso <carnil@debian.org>  Sat, 13 Jun 2026 16:54:34 +0200

--- Cambios de libxml-libxml-perl ---
libxml-libxml-perl (2.0207+dfsg+really+2.0134-1+deb12u1) bookworm; urgency=medium

* Team upload.
  * fix: replace domParseChar with xmlValidateName to prevent OOB UTF-8 read
    (CVE-2026-8177) (Closes: #1136300)

-- Salvatore Bonaccorso <carnil@debian.org>  Sat, 27 Jun 2026 13:41:54 +0200

--- Cambios de libxslt (libxslt1.1) ---
libxslt (1.1.35-1+deb12u4) bookworm; urgency=medium

* Non-maintainer upload.
  * Fix deterministic generate-id() regression introduced in previous fix by
    moving the stable ID generation into a per-transform, per-document hash
    table. (Closes: #1114928)

-- Miao Wang <shankerwangmiao@gmail.com>  Fri, 10 Apr 2026 06:56:30 +0000

--- Cambios de openmediavault ---
openmediavault (7.7.24-7) stable; urgency=medium

* Several improvements.
  * Add omv-release-upgrade to allow users to migrate their systems to
    OMV8 (Synchrony) which is based on Debian 13 (Trixie).

-- Volker Theile <volker.theile@openmediavault.org>  Sun, 07 Dec 2025 08:08:40 +0100

openmediavault (7.7.23-1) stable; urgency=medium

* Improve performance when enumerating file systems.
  * Issue #2055: Add SMART support for QNAP TR-004U (non-RAID mode).

-- Volker Theile <volker.theile@openmediavault.org>  Mon, 24 Nov 2025 21:13:47 +0100

openmediavault (7.7.22-1) stable; urgency=medium

* Fix NFS configuration issue when `insecure` option is used in a share.

-- Volker Theile <volker.theile@openmediavault.org>  Sun, 16 Nov 2025 10:54:32 +0100

openmediavault (7.7.21-1) stable; urgency=medium

* Hardening the log file parser.

-- Volker Theile <volker.theile@openmediavault.org>  Fri, 07 Nov 2025 09:29:18 +0100

openmediavault (7.7.20-1) stable; urgency=medium

* Update locale files.
  * Improve the temperature detection via SMART. Thanks to robNice.
  * Fix bug in configuring APM/AAM/spindown for disk.

-- Volker Theile <volker.theile@openmediavault.org>  Sun, 26 Oct 2025 01:55:43 +0200

openmediavault (7.7.19-2) stable; urgency=medium

* Update locale files.
  * Several improvements, e.g. missing translations in the Workbench UI.
  * Issue #2012: Fix resizing issue of Dashboard chart widgets.

-- Volker Theile <volker.theile@openmediavault.org>  Wed, 01 Oct 2025 20:40:41 +0200

--- Cambios de openssh (openssh-client openssh-server openssh-sftp-server) ---
openssh (1:9.2p1-2+deb12u10) bookworm; urgency=medium

* Backport minor security fixes from 10.3p1:
    - ssh(1): the -J and equivalent -oProxyJump="..." options now validate
      user and host names for ProxyJump/-J options passed via the
      command-line (no such validation is performed for this option in
      configuration files). This prevents shell injection in situations
      where these were directly exposed to adversarial input, which would
      have been a terrible idea to begin with.
    - CVE-2026-35386: ssh(1): validation of shell metacharacters in user
      names supplied on the command-line was performed too late to prevent
      some situations where they could be expanded from %-tokens in
      ssh_config. For certain configurations, such as those that use a "%u"
      token in a "Match exec" block, an attacker who can control the user
      name passed to ssh(1) could potentially execute arbitrary shell
      commands. Reported by Florian Kohnhäuser (closes: #1132573).
      We continue to recommend against directly exposing ssh(1) and other
      tools' command-lines to untrusted input. Mitigations such as this can
      not be absolute given the variety of shells and user configurations in
      use.
    - CVE-2026-35414: sshd(8): when matching an authorized_keys
      principals="" option against a list of principals in a certificate, an
      incorrect algorithm was used that could allow inappropriate matching
      in cases where a principal name in the certificate contains a comma
      character. Exploitation of the condition requires an authorized_keys
      principals="" option that lists more than one principal *and* a CA
      that will issue a certificate that encodes more than one of these
      principal names separated by a comma (typical CAs strongly constrain
      which principal names they will place in a certificate). This
      condition only applies to user- trusted CA keys in authorized_keys,
      the main certificate authentication path
      (TrustedUserCAKeys/AuthorizedPrincipalsFile) is not affected. Reported
      by Vladimir Tokarev (closes: #1132576).
    - CVE-2026-35385: scp(1): when downloading files as root in legacy (-O)
      mode and without the -p (preserve modes) flag set, scp did not clear
      setuid/setgid bits from downloaded files as one might typically
      expect. This bug dates back to the original Berkeley rcp program.
      Reported by Christos Papakonstantinou of Cantina and Spearbit (closes:
      #1132572).
    - CVE-2026-35387: sshd(8): fix incomplete application of
      PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms with regard
      to ECDSA keys. Previously if one of these directives contains any
      ECDSA algorithm name (say "ecdsa-sha2-nistp384"), then any other ECDSA
      algorithm would be accepted in its place regardless of whether it was
      listed or not.  Reported by Christos Papakonstantinou of Cantina and
      Spearbit (closes: #1132574).
    - CVE-2026-35388: ssh(1): connection multiplexing confirmation
      (requested using "ControlMaster ask/autoask") was not being tested for
      proxy mode multiplexing sessions (i.e. "ssh -O proxy ..."). Reported
      by Michalis Vasileiadis (closes: #1132575).

-- Colin Watson <cjwatson@debian.org>  Tue, 05 May 2026 11:26:56 +0100

--- Cambios de pam (libpam0g libpam-modules libpam-modules-bin libpam-runtime) ---
pam (1.5.2-6+deb12u2) bookworm; urgency=medium

* Fix CVE-2025-6020: local privilege escalation in pam_namespace, Closes: #1107919
  * Check for explicit_bzero and memset_explicit so pam_namespace can
    use them

-- Sam Hartman <hartmans@debian.org>  Sun, 10 Aug 2025 09:54:02 -0600

--- Cambios de python-xmltodict (python3-xmltodict) ---
python-xmltodict (0.13.0-1.1~deb12u1) bookworm; urgency=medium

* Non-maintainer upload.
  * Rebuild for bookworm.

-- Adrian Bunk <bunk@debian.org>  Fri, 03 Jul 2026 17:45:21 +0300

python-xmltodict (0.13.0-1.1) unstable; urgency=medium

* Non-maintainer upload.
  * CVE-2025-9375: XML Injection (Closes: #1113825)

-- Adrian Bunk <bunk@debian.org>  Sun, 28 Jun 2026 20:26:05 +0300

--- Cambios de python3.11 (libpython3.11 libpython3.11-minimal libpython3.11-stdlib python3.11 python3.11-minimal) ---
python3.11 (3.11.2-6+deb12u8) bookworm; urgency=medium

* Non-maintainer upload.
  * Apply upstream patches for the following CVEs:
    - CVE-2025-13462: Incorrect parsing of TarInfo header when GNU long name
      and type AREGTYPE are combined
    - CVE-2026-2297: SourcelessFileLoader does not use io.open_code()
    - CVE-2026-3644: Reject control characters in more places in
      http.cookies.Morsel (follow-up of patch for CVE-2026-0672)
    - CVE-2026-4224: pyexpat.c: Unbounded C recursion in conv_content_model
      causes crash
    - CVE-2026-4519: Reject leading dashes in webbrowser.open()
    - CVE-2026-6100: Possible UAF in {LZMA,BZ2}Decompressor
  * Add patch to skip some failing XML tests. Failure is due to the fact that
    we build / tests against expat/2.5.0-1+deb12u2, which was patched for
    CVE-2023-52425, and that broke some tests. See the patch itself for more
    details.

-- Arnaud Rebillout <arnaudr@debian.org>  Tue, 12 May 2026 12:17:27 +0700

python3.11 (3.11.2-6+deb12u7) bookworm; urgency=medium

* Non-maintainer upload.
  * Apply upstream patches for the following CVEs:
    - CVE-2025-4516: issue in bytes.decode("unicode_escape",
      error="ignore|replace")
    - CVE-2025-6069: quadratic complexity in html.parser.HTMLParser
    - CVE-2025-6075: performance degradation in os.path.expandvars()
    - CVE-2025-8194: infinite loop and deadlock in tarfile
    - CVE-2025-8291: incorrect ZIP64 End of Central Directory handling
    - CVE-2025-11468: Folding email comments of unfoldable characters
      didn't preserve parenthesis which could be abused.
    - CVE-2025-12084: quadratic complexity in xml.dom.minidom appendChild etc
    - CVE-2025-13836: OOM or other DoS due to incorrect Content-Length
      handling in http.client
    - CVE-2025-13837: OOM or other DoS due to incorrect data size handling
      in plistlib
    - CVE-2025-15282: User-controlled data URLs parsed by urllib allowed
      injecting headers through newlines in the data URL mediatype.
    - CVE-2026-0672: User-controlled cookie values and parameters could be
      used to inject HTTP headers into messages.
    - CVE-2026-0865: User-controlled header names and values containing
      newlines could be used to inject HTTP headers.
    - CVE-2026-1299: email module allowed header injection in the
      BytesGenerator class.

-- Arnaud Rebillout <arnaudr@debian.org>  Wed, 08 Apr 2026 08:58:00 +0700

--- Cambios de rsync ---
rsync (3.2.7-1+deb12u6) bookworm; urgency=medium

* Non-maintainer upload.
  * Import upstream patch to reject overlong HTTP proxy response lines,
    avoiding a one byte out of bounds stack write when using RSYNC_PROXY.
    (CVE-2026-45232).

-- Aquila Macedo Costa <aquila@debian.org>  Sun, 24 May 2026 18:23:41 -0300

--- Cambios de sed ---
sed (4.9-1+deb12u1) bookworm; urgency=medium

* Non-maintainer upload.
  * sed: -i --follow-symlinks: fix TOCTOU race (CVE-2026-5958)
    (Closes: #1134495)

-- Salvatore Bonaccorso <carnil@debian.org>  Tue, 21 Apr 2026 09:50:58 +0200

--- Cambios de shadow (login passwd) ---
shadow (1:4.13+dfsg1-1+deb12u2) bookworm; urgency=medium

* Apply upstream patch to fix groupmod -U "" segfault (Closes: #1122913)

-- Chris Hofstaedtler <zeha@debian.org>  Sun, 14 Dec 2025 15:00:01 +0100

--- Cambios de sudo ---
sudo (1.9.13p3-1+deb12u4) bookworm; urgency=medium

* cherry-pick upstream exec_mailer-Set-group-as-well-as-uid.
    This is adapted from upstream and fixes CVE-2026-35535:
    https://github.com/sudo-project/sudo/commit/3e474c2 (Closes: #1130593)

-- Marc Haber <mh+debian-packages@zugschlus.de>  Sat, 11 Apr 2026 14:01:23 +0200

sudo (1.9.13p3-1+deb12u3) bookworm; urgency=medium

* Apply a patch fro Marcos Del Sol Vives to Enable Intel CET on amd64 only.
    This has been discussed with the TC in #1113774. After following their
    advice to apply the patch, I verified that this change produces an
    identical deb on amd64 (Closes: #1124339)

-- Marc Haber <mh+debian-packages@zugschlus.de>  Tue, 30 Dec 2025 21:07:33 +0100

--- Cambios de systemd (libnss-myhostname libnss-resolve libnss-systemd libsystemd0 libsystemd-shared libudev1 systemd systemd-resolved systemd-sysv udev) ---
systemd (252.39-1~deb12u2) bookworm; urgency=medium

[ Arnaud Rebillout ]
  * test-cgroup: Ignore ENOENT from cg_create()
  * CVE-2026-4105 (A flaw was found in systemd. The systemd-machined service
    contains an  ...)
  * CVE-2026-29111 (systemd, a system and service manager, (as PID 1) hits an
    assert and f ...)
  * CVE-2026-40225 (In udev in systemd before 260, local root execution can
    occur via mali ...)
  * CVE-2026-40226 (In nspawn in systemd 233 through 259 before 260, an
    escape-to-host act ...)

-- Tobias Deiminger <tobias.deiminger@linutronix.de>  Mon, 27 Apr 2026 21:48:55 +0200

--- Cambios de tzdata ---
tzdata (2026b-0+deb12u1) bookworm; urgency=medium

* New upstream version 2026b:
    - No leap second on 2026-06-30
    - Moldova has used EU transition times since 2022
    - British Columbia moved to permanent -07 on 2026-03-09, so it will not
      fall back from -07 to -08 on 2026-11-01.
  * Drop No-leap-second-on-2025-12-31.patch (merged upstream)

-- Aurelien Jarno <aurel32@debian.org>  Tue, 28 Apr 2026 21:04:30 +0200

--- Cambios de wireless-regdb ---
wireless-regdb (2026.05.30-1~deb12u1) bookworm; urgency=medium

* Rebuild for bookworm

-- Ben Hutchings <benh@debian.org>  Fri, 05 Jun 2026 19:02:58 +0200

wireless-regdb (2026.05.30-1) unstable; urgency=medium

* New upstream version:
    - Add regulatory info for CEPT countries FO, GI, IM, SM and VA listed by
      WiFi Alliance
    - Update 6 GHz rules for Hong Kong (HK)
    - Update 5/6 GHz power rules for Russia (RU)
    - Fix 60 GHz power unit for Ukraine (UA)
    - Update 6 GHz rules for South Africa (ZA)
    - Update 6 GHz rules for South Korea (KR)
    - allow 320MHz channel width for Russia
    - Update regulatory info for Brunei Darussalam (BN) for 2022
    - Update regulatory rules for Sri Lanka (LK)

-- Ben Hutchings <benh@debian.org>  Fri, 05 Jun 2026 17:45:04 +0200

wireless-regdb (2026.03.18-1) unstable; urgency=medium

* New upstream version:
    - Update regulatory rules for India (IN) on 6GHz

-- Ben Hutchings <benh@debian.org>  Thu, 07 May 2026 11:43:19 +0200

wireless-regdb (2026.02.04-1~deb12u1) bookworm; urgency=medium

* Backport to bookworm:
    - Revert "d/salsa-ci.yml: Suppress false bad-distribution-in-changes-file
      error" which is no longer needed
    - Revert "Add support and documentation for setting default regulatory
      domain"
    - d/rules: Set FIRMWARE_PATH = /lib/firmware

-- Ben Hutchings <benh@debian.org>  Fri, 20 Feb 2026 17:30:17 +0100

wireless-regdb (2026.02.04-1) unstable; urgency=medium

[ Ben Hutchings ]
  * New upstream version:
    - Update regulatory info for Australia (AU) for 2025
    - Update broken link in regulatory.bin(5) manpage
    - Update regulatory info for Malaysia (MY) for 2024
    - Update regulatory info for Malaysia (MY) for 2025
    - Update regulatory info for Tunisia (TN) on 6GHz for 2025
    - Update regulatory info for Canada (CA) for 2025
  * d/rules: Install regulatory.db under /usr without dh_movetousr
    (Closes: #1122785)
  * d/README.Debian: Remove minimum kernel version for direct-loading
  * Add support and documentation for setting default regulatory domain

[ Bastian Germann ]
  * Drop unnecessary B-D m2crypto (Closes: #1126431)

-- Ben Hutchings <benh@debian.org>  Fri, 13 Feb 2026 14:11:18 +0100

wireless-regdb (2025.10.07-1) unstable; urgency=medium

* New upstream version:
    - update regulatory rules for Botswana (BW) for 2022
    - update regulatory rules for Sint Marteen (SX) for 2018
    - Update regulatory info including bandwidth for Costa Rica (CR) for 2023
    - Permit lower 6 GHz band for Kazakhstan (KZ)
  * d/salsa-ci.yml: Remove obsolete lintian error suppression
  * d/upstream/signing-key.asc: Update for later expiry date
  * d/watch: Convert to version 5 format

-- Ben Hutchings <benh@debian.org>  Mon, 20 Oct 2025 20:42:25 +0200

--- Binary NMU of: bash (5.2.15-2+b13), busybox (1:1.35.0-4+deb12u1+b1), 
 libcap2 (1:2.66-4+deb12u3+b1)

* Binary-only non-maintainer upload for amd64; no source changes.
  * Rebuild for outdated Built-Using (glibc/2.36-9+deb12u13)

========================================================================

You can perform the upgrade by issuing the command:

apt-get dist-upgrade

as root on storagecentral.bagno.company.com

--
apticron

0xn0l - 0011000001111000011011100011000001101100