SUSE-SU-2026:4254-1

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2024-57841,CVE-2026-53260: net: fix memory leak in tcp_conn_request() (bsc#1235944 bsc#1269731).
• CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
• CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
• CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
• CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
• CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).
• CVE-2026-31658: net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() (bsc#1263052).
• CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
• CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).
• CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
• CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
• CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
• CVE-2026-43213: wifi: rtw89: pci: validate sequence number of TX release report (bsc#1264643).
• CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
• CVE-2026-43386: staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie (bsc#1264740).
• CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
• CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
• CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).
• CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
• CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
• CVE-2026-46078: erofs: fix the out-of-bounds nameoff handling for trailing dirents (bsc#1267505).
• CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).
• CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
• CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
• CVE-2026-46127: RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() (bsc#1267236).
• CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
• CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
• CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
• CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
• CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
• CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
• CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
• CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
• CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
• CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).
• CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
• CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
• CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).
• CVE-2026-53034: bpf, sockmap: Fix af_unix null-ptr-deref in proto update (bsc#1269140).
• CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).
• CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).
• CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).
• CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).
• CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).
• CVE-2026-53094: bpf: Fix stale offload->prog pointer after constant blinding (bsc#1269965).
• CVE-2026-53096: bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path (bsc#1269969).
• CVE-2026-53110: selftests/bpf: Add ASSERT_OK_FD macro (bsc#1269985).
• CVE-2026-53111: bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap (bsc#1269167).
• CVE-2026-53126: blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() (bsc#1269635).
• CVE-2026-53142: drm/xe/display: fix oops in suspend/shutdown without display (bsc#1269402).
• CVE-2026-53154: mm/hugetlb: restore reservation on error in hugetlb folio copy paths (bsc#1269665).
• CVE-2026-53163: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (bsc#1269306).
• CVE-2026-53180: timers/migration: Fix livelock in tmigr_handle_remote_up() (bsc#1269888).
• CVE-2026-53207: mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison (bsc#1269590).
• CVE-2026-53219: netfilter: x_tables: avoid leaking percpu counter pointers (bsc#1269686).
• CVE-2026-53220: netfilter: revalidate bridge ports (bsc#1269381).
• CVE-2026-53223: net: guard timestamp cmsgs to real error queue skbs (bsc#1269301).
• CVE-2026-53228: ipv6: sit: reload inner IPv6 header after GSO offloads (bsc#1269256).
• CVE-2026-53238: netlabel: validate unlabeled address and mask attribute lengths (bsc#1269774).
• CVE-2026-53263: 6lowpan: fix off-by-one in multicast context address compression (bsc#1269647).
• CVE-2026-53264: net/sched: act_api: use RCU with deferred freeing for action lifecycle (bsc#1269238).
• CVE-2026-53269: netfilter: synproxy: add mutex to guard hook reference counting (bsc#1269579).
• CVE-2026-53273: tee: optee: prevent use-after-free when the client exits before the supplicant (bsc#1269713).
• CVE-2026-53309: ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison (bsc#1269815).
• CVE-2026-53330: drm/amd/display: Fix out-of-bounds read in (bsc#1270090).
• CVE-2026-53336: nvmem: layouts: onie-tlv: fix hang on unknown types (bsc#1270108).
• CVE-2026-53337: net: bonding: fix NULL pointer dereference in bond_do_ioctl() (bsc#1270251).
• CVE-2026-53353: hsr: Remove WARN_ONCE() in hsr_addr_is_self() (bsc#1270111).
• CVE-2026-53365: vsock/virtio: fix zerocopy completion for multi-skb sends (bsc#1271365).
• CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271830).
• CVE-2026-63801: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (bsc#1272230).
• CVE-2026-63808: exfat: fix potential use-after-free in exfat_find_dir_entry() (bsc#1272260).
• CVE-2026-63810: block: Avoid mounting the bdev pseudo-filesystem in userspace (bsc#1272297).
• CVE-2026-63823: keys: Pin request_key_auth payload in instantiate paths (bsc#1272182).
• CVE-2026-63827: apparmor: fix use-after-free in rawdata dedup loop (bsc#1272179).
• CVE-2026-63828: apparmor: mediate the implicit connect of TCP fast open sendmsg (bsc#1272175).
• CVE-2026-63860: RDMA/core: Prefer NLA_NUL_STRING (bsc#1272429).
• CVE-2026-63865: bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks (bsc#1272486).
• CVE-2026-63868: net: garp: fix unsigned integer underflow in garp_pdu_parse_attr (bsc#1272497).
• CVE-2026-63879: drm/amdgpu: fix amdgpu_hmm_range_get_pages (bsc#1272569).
• CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).
• CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272385).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272390).
• CVE-2026-63889: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (bsc#1272423).
• CVE-2026-63891: thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() (bsc#1272641).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1272877).
• CVE-2026-63923: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (bsc#1273005).
• CVE-2026-63925: macsec: fix replay protection at XPN lower-PN wrap (bsc#1273008).
• CVE-2026-63926: bpf: sockmap: fix tail fragment offset in bpf_msg_push_data (bsc#1273019).
• CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1272662).
• CVE-2026-63969: ipv6: fix possible infinite loop in rt6_fill_node() (bsc#1272484).
• CVE-2026-63970: vsock/virtio: bind uarg before filling zerocopy skb (bsc#1272673).
• CVE-2026-63980: net/handshake: Use spin_lock_bh for hn_lock (bsc#1273028).
• CVE-2026-63985: ethtool: eeprom: add more safeties to EEPROM Netlink fallback (bsc#1272963).
• CVE-2026-63990: bonding: refuse to enslave CAN devices (bsc#1273027).
• CVE-2026-63992: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (bsc#1272868).
• CVE-2026-63995: ethtool: cmis: validate start_cmd_payload_size from module (bsc#1273033).
• CVE-2026-63996: ethtool: cmis: require exact CDB reply length (bsc#1273032).
• CVE-2026-63997: ethtool: module: avoid leaking a netdev ref on module flash errors (bsc#1273036).
• CVE-2026-63998: ethtool: module: call ethnl_ops_complete() on module flash errors (bsc#1273037).
• CVE-2026-63999: ethtool: rss: fix indir_table and hkey leak on get_rxfh failure (bsc#1273038).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273030).
• CVE-2026-64001: ALSA: pcm: oss: Fix setup list UAF on proc write error (bsc#1273734).
• CVE-2026-64002: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (bsc#1273774).
• CVE-2026-64004: net/iucv: fix locking in .getsockopt (bsc#1273804).
• CVE-2026-64005: net/smc: Do not re-initialize smc hashtables (bsc#1273831).
• CVE-2026-64006: netfilter: nf_tables: fix dst corruption in same register operation (bsc#1273834).
• CVE-2026-64007: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (bsc#1273105).
• CVE-2026-64010: nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (bsc#1273882).
• CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1273891).
• CVE-2026-64015: security/keys: fix missed RCU read section on lookup (bsc#1273762).
• CVE-2026-64029: ALSA: seq: Serialize UMP output teardown with event_input (bsc#1273766).
• CVE-2026-64033: RDMA/rtrs: Fix use-after-free in path file creation cleanup (bsc#1273134).
• CVE-2026-64047: net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (bsc#1273060).
• CVE-2026-64048: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (bsc#1273484).
• CVE-2026-64052: block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user() (bsc#1272983).
• CVE-2026-64055,CVE-2026-64056: net: ethernet: cortina: Make RX SKB per-port (bsc#1272502 bsc#1272893).
• CVE-2026-64055: net: ethernet: cortina: Drop half-assembled SKB (bsc#1272893).
• CVE-2026-64073: irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT (bsc#1273490).
• CVE-2026-64098: drm/virtio: use uninterruptible resv lock for plane updates (bsc#1273488).
• CVE-2026-64099: drm/v3d: Fix use-after-free of CPU job query arrays on error path (bsc#1273465).
• CVE-2026-64102: RDMA/siw: Reject MPA FPDU length underflow before signed receive math (bsc#1272516).
• CVE-2026-64109: af_unix: Peek the queue synchronized (bsc#1273748).
• CVE-2026-64112: rbd: eliminate a race in lock_dwork draining on unmap (bsc#1273741).
• CVE-2026-64113: ixgbevf: fix use-after-free in VEPA multicast source pruning (bsc#1272262).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273742).
• CVE-2026-64115: vsock/vmci: fix UAF when peer resets connection during handshake (bsc#1273745).
• CVE-2026-64118: qed: fix double free in qed_cxt_tables_alloc() (bsc#1273749).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273743).
• CVE-2026-64125: net: bcmgenet: keep RBUF EEE/PM disabled (bsc#1272346).
• CVE-2026-64131: mm/memory: fix spurious warning when unmapping device-private/exclusive pages (bsc#1274063).
• CVE-2026-64136: smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (bsc#1272351).
• CVE-2026-64146: erofs: fix metabuf leak in inode xattr initialization (bsc#1273681).
• CVE-2026-64148: pds_core: check health in devcmd wait (bsc#1273956).
• CVE-2026-64164: btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() (bsc#1273957).
• CVE-2026-64180: mm/memory_hotplug: fix memory block reference leak on remove (bsc#1273679).
• CVE-2026-64185: sysfs: don't remove existing directory on update failure (bsc#1272200).
• CVE-2026-64188: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() (bsc#1272150).
• CVE-2026-64190: net: team: fix NULL pointer dereference in team_xmit during mode change (bsc#1272210).
• CVE-2026-64192: bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized (bsc#1272213).
• CVE-2026-64214: powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() (bsc#1272799).
• CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272798).
• CVE-2026-64222: octeontx2-pf: avoid double free of pool->stack on AQ init failure (bsc#1272788).
• CVE-2026-64224: octeontx2-pf: fix double free in rvu_rep_rsrc_init() (bsc#1272804).
• CVE-2026-64225: octeontx2-af: CGX: add bounds check to cgx_speed_mbps index (bsc#1272786).
• CVE-2026-64244: drivers/base/memory: set mem->altmap after successful device registration (bsc#1273812).
• CVE-2026-64245: fbdev: modedb: fix a possible UAF in fb_find_mode() (bsc#1273905).
• CVE-2026-64268: RDMA/siw: bound Read Response placement to the RREAD length (bsc#1273276).
• CVE-2026-64269: RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg (bsc#1273280).
• CVE-2026-64286: KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU (bsc#1274058).
• CVE-2026-64287: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (bsc#1273325).
• CVE-2026-64294: mm: do file ownership checks with the proper mount idmap (bsc#1273525).
• CVE-2026-64296: exfat: bound uniname advance in exfat_find_dir_entry() (bsc#1273975).
• CVE-2026-64304: crypto: qat - validate RSA CRT component lengths (bsc#1273944).
• CVE-2026-64312: crypto: pcrypt - restore callback for non-parallel fallback (bsc#1273968).
• CVE-2026-64315: crypto: caam - use print_hex_dump_devel to guard key hex dumps (bsc#1274028).
• CVE-2026-64316: crypto: caam - use print_hex_dump_devel to guard key hex dumps (bsc#1273598).
• CVE-2026-64317: isofs: bound Rock Ridge symlink components to the SL record (bsc#1273936).
• CVE-2026-64322: udf: validate sparing table length as an entry count, not a byte count (bsc#1273958).
• CVE-2026-64323: udf: validate VAT header length against the VAT inode size (bsc#1273305).
• CVE-2026-64355: bpf: Reject fragmented frames in devmap (bsc#1273422).
• CVE-2026-64375: proc: protect ptrace_may_access() with exec_update_lock (FD links) (bsc#1273868).
• CVE-2026-64378: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (bsc#1273603).
• CVE-2026-64381: smb: client: Fix next buffer leak in receive_encrypted_standard() (bsc#1273860).
• CVE-2026-64382: smb: client: fix double-free in SMB2_open() replay (bsc#1273291).
• CVE-2026-64383: smb: client: fix double-free in SMB2_flush() replay (bsc#1273426).
• CVE-2026-64384: smb: client: fix change notify replay double-free (bsc#1274541).
• CVE-2026-64385: smb: client: fix double-free in SMB2_ioctl() replay (bsc#1274539).
• CVE-2026-64386: smb: client: fix query_info() replay double-free (bsc#1274543).
• CVE-2026-64387: smb: client: fix query directory replay double-free (bsc#1274545).
• CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).
• CVE-2026-64411: netfilter: ebtables: terminate table name before find_table_lock() (bsc#1274077).
• CVE-2026-64412: netfilter: ebtables: module names must be null-terminated (bsc#1273780).
• CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction (bsc#1274274).
• CVE-2026-64434: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref (bsc#1273880).
• CVE-2026-64436: net: af_key: initialize alg_key_len for IPComp states (bsc#1274277).
• CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).
• CVE-2026-64450: tipc: fix out-of-bounds read in broadcast Gap ACK blocks (bsc#1273523).
• CVE-2026-64452: 6lowpan: fix NHC entry use-after-free on error path (bsc#1273460).
• CVE-2026-64463: usb: typec: tcpci_rt1711h: unregister TCPCI port with devres (bsc#1273273).
• CVE-2026-64472: vfio/mlx5: Fix racy bitfields and tighten struct layout (bsc#1274075).
• CVE-2026-64477: x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled (bsc#1274264).
• CVE-2026-64481: ALSA: hda/cs35l41: Fix firmware load work teardown (bsc#1274547).
• CVE-2026-64515: wifi: mac80211: fix MLE defragmentation (bsc#1273859).
• CVE-2026-64537: bridge: cfm: reject invalid CCM interval at configuration time (bsc#1273289).
• CVE-2026-64538: ipv6: Fix null-ptr-deref in fib6_nh_mtu_change() (bsc#1273335).
• CVE-2026-64541: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (bsc#1273303).
• CVE-2026-64543: tipc: fix use-after-free of the discoverer in tipc_disc_rcv() (bsc#1273311).
• CVE-2026-64545: net, bpf: check master for NULL in xdp_master_redirect() (bsc#1273318).
• CVE-2026-64548: bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() (bsc#1273337).
• CVE-2026-64551: sctp: validate STALE_COOKIE cause length before reading staleness (bsc#1273813).
• CVE-2026-64552: virtio-net: fix len check in receive_big() (bsc#1273323).
• CVE-2026-64553: net: psample: fix info leak in PSAMPLE_ATTR_DATA (bsc#1273336).
• CVE-2026-64554: netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() (bsc#1273340).
• CVE-2026-64562: KVM: nVMX: Hide shadow VMCS right after VMCLEAR (bsc#1273930).
• CVE-2026-64563: rhashtable: clear stale iter->p on table restart (bsc#1273995).
• CVE-2026-64567: btrfs: reject free space cache with more entries than pages (bsc#1274006).
• CVE-2026-64569: mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n (bsc#1274009).
• CVE-2026-64572: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (bsc#1274014).
• CVE-2026-64576: nexthop: initialize extack in nh_res_bucket_migrate() (bsc#1274030).
• CVE-2026-64577: gtp: check skb_pull_data() return in gtp1u_send_echo_resp() (bsc#1274031).
• CVE-2026-64581: xfrm: fix sk_dst_cache double-free in xfrm_user_policy() (bsc#1274041).
• CVE-2026-64582: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (bsc#1274040).
• CVE-2026-64593: btrfs: do not trim a device which is not writeable (bsc#1274497).
• CVE-2026-64597: smb: client: fix double-free in SMB2_close() replay (bsc#1274297).
• CVE-2026-64598: smb/client: Fix error code in smb2_aead_req_alloc() (bsc#1274298).
• CVE-2026-68081: KVM: nVMX: Add helper to put (unmap) vmcs12 pages (bsc#1274580).
• CVE-2026-68082: libceph: fix two unsafe bare decodes in decode_lockers() (bsc#1274581).
• CVE-2026-68086: mm/khugepaged: write all dirty file folios when collapsing (bsc#1274713).
• CVE-2026-68105: drm/amdgpu: Fix kernel panic during driver load failure (bsc#1274849).
• CVE-2026-68116: vxlan: mdb: Fix source list corruption on a failed replace (bsc#1274876).
• CVE-2026-68117: tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (bsc#1274881).
• CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1274888).
• CVE-2026-68123: openvswitch: fix GSO userspace truncation underflow (bsc#1275169).
• CVE-2026-68124: mctp: serial: handle zero-length frames to prevent rx buffer overflow (bsc#1275192).
• CVE-2026-68127: ila: reload IPv6 header after pskb_may_pull in checksum adjust (bsc#1275237).
• CVE-2026-68129: gve: fix Rx queue stall on alloc failure (bsc#1275517).
• CVE-2026-68132: super: fix emergency thaw deadlock on frozen block devices (bsc#1275553).
• CVE-2026-68135: net: hip04: fix RX buffer leak on build_skb failure (bsc#1275557).
• CVE-2026-68136: net: gro: fix double aggregation of flush-marked skbs (bsc#1275474).
• CVE-2026-68138: net/sched: serialize qdisc_rtab_list against concurrent get/put (bsc#1274941).
• CVE-2026-68139: net/mlx5e: Use sender devcom for MPV master-up (bsc#1275578).
• CVE-2026-68142: geneve: require CAP_NET_ADMIN in the device netns for changelink (bsc#1275582).
• CVE-2026-68143: net: slip: serialize receive against buffer reallocation (bsc#1275583).
• CVE-2026-68145: iomap: fix out-of-bounds bitmap_set() with zero-length range (bsc#1275584).
• CVE-2026-68149: fs: preserve ACL_DONT_CACHE state in forget_cached_acl() (bsc#1275294).
• CVE-2026-68152: amt: fix use-after-free in AMT delayed works (bsc#1275300).
• CVE-2026-68153: libceph: remove debugfs files before client teardown (bsc#1275301).
• CVE-2026-68154: libceph: reject zero bucket types in crush_decode (bsc#1275303).
• CVE-2026-68155: libceph: Reject monmaps advertising zero monitors (bsc#1275304).
• CVE-2026-68156: libceph: refresh auth->authorizer_buf{,_len} after authorizer update (bsc#1275305).
• CVE-2026-68157: libceph: guard missing CRUSH type name lookup (bsc#1275306).
• CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight() (bsc#1275307).
• CVE-2026-68159: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (bsc#1275470).
• CVE-2026-68160: ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() (bsc#1275472).
• CVE-2026-68161: sctp: close UDP tunnel sockets during netns teardown (bsc#1274892).
• CVE-2026-68166: userfaultfd: prevent registration of special VMAs (bsc#1274930).
• CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275161).
• CVE-2026-68205: media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() (bsc#1274934).
• CVE-2026-68238: drm/amdgpu: Release VFCT ACPI table reference (bsc#1275704).
• CVE-2026-68247: drm/i915/bios: range check LFP Data Block panel_type2 (bsc#1275817).
• CVE-2026-68254: drm/i915/vrr: require valid min/max vfreq for VRR (bsc#1275150).
• CVE-2026-68267: drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (bsc#1275139).
• CVE-2026-68284: bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() (bsc#1275970).
• CVE-2026-68286: drop_monitor: perform u64_stats updates under IRQ-disabled section (bsc#1275973).
• CVE-2026-68288: net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD (bsc#1275975).
• CVE-2026-68289: tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() (bsc#1275976).
• CVE-2026-68293: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (bsc#1275091).
• CVE-2026-68297: tipc: fix u16 MTU truncation in media and bearer MTU validation (bsc#1275040).
• CVE-2026-68299: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (bsc#1275088).
• CVE-2026-68300: sctp: auth: verify auth requirement when auth_chunk is NULL (bsc#1275083).
• CVE-2026-68302: amt: re-read skb header pointers after every pull (bsc#1275081).
• CVE-2026-68312: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (bsc#1274663).
• CVE-2026-68313: tipc: fix infinite loop in __tipc_nl_compat_dumpit (bsc#1274665).
• CVE-2026-68315: sctp: validate stream count in sctp_process_strreset_inreq() (bsc#1274662).
• CVE-2026-68320: sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid (bsc#1274659).
• CVE-2026-68322: rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled (bsc#1274656).
• CVE-2026-68324: iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() (bsc#1274649).
• CVE-2026-68325: iommu/amd: Bound the early ACPI HID map (bsc#1274651).
• CVE-2026-68328: nfp: Check resource mutex allocation (bsc#1274646).
• CVE-2026-68329: iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() (bsc#1274645).
• CVE-2026-68331: dpaa2-eth: put MAC endpoint device on disconnect (bsc#1274642).
• CVE-2026-68333: dpaa2-switch: put MAC endpoint device on disconnect (bsc#1274644).
• CVE-2026-68335: rds: drop incoming messages that cross network namespace boundaries (bsc#1274640).
• CVE-2026-68336: bonding: fix devconf_all NULL dereference when IPv6 is disabled (bsc#1274639).
• CVE-2026-68343: smb: client: validate DFS referral PathConsumed (bsc#1274629).
• CVE-2026-68375: bnxt_en: Handle partially initialized auxiliary devices (bsc#1274835).
• CVE-2026-68377: net/sched: act_tunnel_key: Defer dst_release to RCU callback (bsc#1274831).
• CVE-2026-68386: bpf, sockmap: Reject unhashed UDP sockets on sockmap update (bsc#1274814).
• CVE-2026-68397: net/iucv: take a reference on the socket found in afiucv_hs_rcv() (bsc#1274898).
• CVE-2026-68398: ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF (bsc#1274908).
• CVE-2026-68408: wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (bsc#1274709).
• CVE-2026-68417: RDMA/siw: publish QP after initialization (bsc#1274696).
• CVE-2026-68418: RDMA/irdma: Prevent user-triggered null deref on QP create (bsc#1274690).
• CVE-2026-68419: RDMA/irdma: Prevent rereg_mr for non-mem regions (bsc#1274698).
• CVE-2026-68422: btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() (bsc#1274706).
• CVE-2026-68425: IB/mad: Drop unmatched RMPP responses before reassembly (bsc#1274700).
• CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274705).
• CVE-2026-68432: vxlan: require CAP_NET_ADMIN in the device netns for changelink (bsc#1274800).
• CVE-2026-68433: libceph: bound get_version reply decode to front len (bsc#1274801).
• CVE-2026-68450: btrfs: free mapping node on duplicate reloc root insert (bsc#1274834).
• CVE-2026-68470: wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements (bsc#1276500).
• CVE-2026-68480: x86/bugs: Make Safe-RET robust against interrupt injection (bsc#1274208).
• CVE-2026-72020: ipvs: reset full ip_vs_seq structs in ip_vs_conn_new (bsc#1275506).
• CVE-2026-72032: net/mlx5: HWS, fix matcher leak on resize target setup failure (bsc#1276955).
• CVE-2026-72035: net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1276961).
• CVE-2026-72036: net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1277034).
• CVE-2026-72046: gve: fix header buffer corruption with header-split and HW-GRO (bsc#1275519).
• CVE-2026-72069: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (bsc#1275528).
• CVE-2026-72072: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (bsc#1277155).
• CVE-2026-72083: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (bsc#1275535).
• CVE-2026-72084: scsi: target: Bound PR-OUT TransportID parsing to the received buffer (bsc#1275540).
• CVE-2026-72123: can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (bsc#1277523).
• CVE-2026-72132: NFS: Charge unstable writes by request size, not folio size (bsc#1277551).
• CVE-2026-72221: sunrpc: wait for in-flight TLS handshake callback when cancel loses race (bsc#1275665).
• CVE-2026-72222: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (bsc#1275669).
• CVE-2026-72251: netfilter: nf_nat_sip: reload possible stale data pointer (bsc#1275827).
• CVE-2026-72254: netfilter: nft_fib: reject fib expression on the netdev egress hook (bsc#1277204).
• CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (bsc#1277678).
• CVE-2026-72288: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (bsc#1275886).
• CVE-2026-72289: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (bsc#1275905).
• CVE-2026-72296: net: ife: require ETH_HLEN to be pullable in ife_decode() (bsc#1275923).
• CVE-2026-72307: mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() (bsc#1277160).
• CVE-2026-72308: mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() (bsc#1277159).
• CVE-2026-72317: SUNRPC: pin upper rpc_clnt across the TLS connect_worker (bsc#1275925).
• CVE-2026-72341: net/mlx5e: Fix publication race for priv->channel_stats[] (bsc#1277660).
• CVE-2026-72342: net/mlx5e: Fix HV VHCA stats agent registration race (bsc#1277775).
• CVE-2026-72343: net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation (bsc#1277776).
• CVE-2026-72389: bridge: stp: Fix a potential use-after-free when deleting a bridge (bsc#1273869).
• CVE-2026-72463: xfrm: Fix dev use-after-free in xfrm async resumption (bsc#1268276 bsc#1277064).
• CVE-2026-72464: xprtrdma: Remove temp allocation of rpcrdma_rep objects (bsc#1277069).
• CVE-2026-72466: xprtrdma: Fix bcall rep leak and unbounded peek (bsc#1277057).
• CVE-2026-72467: xprtrdma: Check frwr_wp_create() during connect (bsc#1277059).
• CVE-2026-72469: xprtrdma: Fix ep kref imbalance on ADDR_CHANGE (bsc#1277047).
• CVE-2026-72473: xprtrdma: Avoid 250 ms delay on backlog wakeup (bsc#1277037).
• CVE-2026-72494: RDMA/irdma: Replace waitqueue and flag with completion (bsc#1276941).
• CVE-2026-72495: RDMA/bnxt_re: Avoid repeated requests to allocate WC pages (bsc#1276937).
• CVE-2026-72496: RDMA/bnxt_re: Proper rollback if the ioremap fails (bsc#1276943).
• CVE-2026-72497: RDMA/bnxt_re: Add a max slot check for SQ (bsc#1276913).
• CVE-2026-72498: RDMA/bnxt_re: Avoid displaying the kernel pointer (bsc#1276912).
• CVE-2026-72499: RDMA/bnxt_re: Free CQ toggle page after firmware teardown (bsc#1276551).
• CVE-2026-72500: RDMA/bnxt_re: Free SRQ toggle page after firmware teardown (bsc#1276552).
• CVE-2026-72501: RDMA/bnxt_re: Initialize dpi variable to zero (bsc#1276546).
• CVE-2026-72502: tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) (bsc#1276542).
• CVE-2026-74269: bnxt: fix head underflow on XDP head-grow (bsc#1276507).
• CVE-2026-74296: RDMA/mlx5: Release the HW-provided UAR index rather than the SW one (bsc#1276452).
• CVE-2026-74297: RDMA/mlx5: Fix undefined shift of user RQ WQE size (bsc#1276446).
• CVE-2026-74318: btrfs: fix deadlock cloning inline extent when using flushoncommit (bsc#1276864).
• CVE-2026-74321: btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() (bsc#1277202).
• CVE-2026-74334: RDMA/nldev: Fix locking when accessing mr->pd (bsc#1277095).
• CVE-2026-74345: RDMA/siw: Fix endpoint/socket association handling (bsc#1277285).
• CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277408).
• CVE-2026-74395: RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference (bsc#1277077).
• CVE-2026-74454: drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO (bsc#1277073).
• CVE-2026-74474: vxlan: use pskb_network_may_pull() for transmit path header pulls (bsc#1276335).
• CVE-2026-74481: mm/page_reporting: use system_freezable_wq to fix UAF during suspend (bsc#1276355).
• CVE-2026-74482: mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios (bsc#1276346).
• CVE-2026-74488: wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (bsc#1276350).
• CVE-2026-74495: igbvf: Fix leak in TX DMA error cleanup (bsc#1275864).
• CVE-2026-74496: fou: Fix use-after-free in fou_create() (bsc#1275867).
• CVE-2026-74509: Bluetooth: hci_sync: Fix advertising data UAFs (bsc#1275946).
• CVE-2026-74510: Bluetooth: mgmt: fix UAF in pair command cancellation (bsc#1275950).
• CVE-2026-74512: audit: fix potential use-after-free in audit_del_rule() (bsc#1275954).
• CVE-2026-74516: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (bsc#1275797).
• CVE-2026-74518: mm/hugetlb: fix list corruption in allocate_file_region_entries() (bsc#1275798).
• CVE-2026-74527: octeontx2-af: Block VFs from clobbering special CGX PKIND state (bsc#1275805).
• CVE-2026-74537: Bluetooth: ISO: hold sk properly in iso_conn_ready (bsc#1275687).
• CVE-2026-74548: forcedeth: fix UAF of txrx_stats in nv_remove (bsc#1275695).
• CVE-2026-74550: net: do not send ICMP/NDISC Redirects when peer allocation fails (bsc#1275688).
• CVE-2026-74556: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (bsc#1275696).
• CVE-2026-74563: rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() (bsc#1275574).
• CVE-2026-74566: keys: make keyring key-chunk byte order agree with keyring_diff_objects() (bsc#1275566).
• CVE-2026-74567: keys: fix out-of-bounds read in keyring_get_key_chunk() (bsc#1275569).
• CVE-2026-74571: btrfs: skip global block reserve accounting for rescue mounts (bsc#1275561).
• CVE-2026-74577: net: mpls: initialize rtm_tos in mpls_getroute() (bsc#1275572).
• CVE-2026-74581: net: ipv6: clear suppressed fib6 rule result (bsc#1275782).
• CVE-2026-74582: packet: use consistent hard_header_len in non-ring send paths (bsc#1275784).
• CVE-2026-74584: RDMA/bnxt_re: zero shared page before exposing to userspace (bsc#1277066).
• CVE-2026-74610: tls: don't leave a full plaintext sk_msg ring unpushed (bsc#1277054).
• CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277391).
• CVE-2026-74692: net/smc: fix TOCTOU race between smc_listen_out() and listener close (bsc#1276927).
• CVE-2026-74694: net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length (bsc#1277625).
• CVE-2026-74695: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() (bsc#1276931).
• CVE-2026-74712: vdpa/mlx5: Fix buffer length in create_direct_keys() (bsc#1276577).
• CVE-2026-74717: net/mlx5: fw_tracer, return NULL on create error (bsc#1276569).
• CVE-2026-74722: btrfs: fix memory leak in btrfs_do_encoded_write() (bsc#1276561).
• CVE-2026-80529: xfs: don't swallow dquot recovery verification errors (bsc#1277688).
• CVE-2026-80534: xfs: fix ilock leak on error in xfs_dq_get_next_id (bsc#1277022).
• CVE-2026-80590: inet: frags: strip GSO state from fragments before reassembly (bsc#1277275).
• CVE-2026-80654: soc: xilinx: Shutdown and free rx mailbox channel (bsc#1277516).

The following non security issues were fixed:

• accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status() (git-fixes).
• accessibility: speakup: unregister tty ldisc on later init failures (git-fixes).
• ACPI: APEI: Fix ERST timeout unit conversion (git-fixes).
• ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer (git-fixes).
• ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root (git-fixes).
• ACPI: pfr_update: fix stack buffer overflow in query_capability() (git-fixes).
• ACPI: processor: idle: Expand _LPI package sanity checks (git-fixes).
• ACPI: processor: validate MADT IOAPIC entry bounds (git-fixes).
• ACPI: scan: fix bus ID cleanup on device_add() failures (git-fixes).
• ACPI: video: Release PCI device reference after lookup (git-fixes).
• add my missing Reviewed-by: tag.
• ALSA: 6fire: bound the MIDI event length from the device (git-fixes).
• ALSA: 6fire: Fix UAF at error handling during probe (stable-fixes).
• ALSA: bcd2000: clear the URB pointers on disconnect (git-fixes).
• ALSA: control: Don't add invalid kcontrols to LED layer (git-fixes).
• ALSA: core: Fix use-after-free in snd_card_do_free() (git-fixes).
• ALSA: dummy: Check card index validity at probe (stable-fixes).
• ALSA: hda/ext: preserve PPLCCTL bits when clearing reset (git-fixes).
• ALSA: hda: Fix connection list comparison in proc output (git-fixes).
• ALSA: hpi: Check transport errors during HPI6000 adapter initialization (git-fixes).
• ALSA: pcxhr: initialize mutexes before requesting threaded IRQ (git-fixes).
• ALSA: scarlett2: Use a private URB for the notification endpoint (git-fixes).
• ALSA: seq: Don't leak the extension cell pointer in the bounce payload (git-fixes).
• ALSA: seq: midi: Optimize event_input locking with RCU (git-fixes).
• ALSA: seq: midi: Serialize input teardown with event_input (git-fixes).
• ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion (git-fixes).
• ALSA: usb-audio: Complete cleanup after system-resume errors (git-fixes).
• ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() (git-fixes).
• ALSA: usb-audio: fix OOB write on Type II inbound URBs (git-fixes).
• ALSA: usb: Fix UAF at delayed release of MIDI2 EPs (git-fixes).
• ALSA: usx2y: bound the hwdep mmap fault offset (git-fixes).
• ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer() (git-fixes).
• apparmor: advertise the tcp fast open fix is applied (git-fixes).
• arm64: Exclude nohz_full CPUs from 32bits el0 support (bsc#1269313).
• ASoC: adau1761: sort the register default table (git-fixes).
• ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC (git-fixes).
• ASoC: apple: mca: increase SERDES reset delay (git-fixes).
• ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses (git-fixes).
• ASoC: cs35l33: drain threaded IRQ before runtime suspend (git-fixes).
• ASoC: cs35l34: drain threaded IRQ before runtime suspend (git-fixes).
• ASoC: cs35l41: sort the register default table (git-fixes).
• ASoC: cs35l45: sort the register default table (git-fixes).
• ASoC: cs4265: sort the register default table (git-fixes).
• ASoC: cx2072x: sort the register default table (git-fixes).
• ASoC: dapm: Fix off-by-one check on the second enum channel (git-fixes).
• ASoC: fix unmet dependencies on PPC_BESTCOMM and SND_SOC_AC97_BUS (git-fixes).
• ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready (git-fixes).
• ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure (git-fixes).
• ASoC: fsl_audmix: rework runtime PM handling in probe (git-fixes).
• ASoC: fsl_easrc: sort the register default table (git-fixes).
• ASoC: hdac_hda: Fix hlink refcount leak on component registration failure (git-fixes).
• AsoC: intel: sst: fix PCI device reference leak on probe failure (git-fixes).
• ASoC: max9860: sort the register default table (git-fixes).
• ASoC: meson: Keep link pointers valid on realloc failure (git-fixes).
• ASoC: ml26124: sort the register default table (git-fixes).
• ASoC: pcm512x: sort the register default table (git-fixes).
• ASoC: pxa: Use devm_clk_get_optional() for extclk clock (git-fixes).
• ASoC: qcom: q6apm: keep the graph start count in sync with the DSP (git-fixes).
• ASoC: rt274: sort the register default table (git-fixes).
• ASoC: rt286: sort the register default table (git-fixes).
• ASoC: rt298: sort the register default table (git-fixes).
• ASoC: rt700-sdw: always drain jack work on remove (git-fixes).
• ASoC: rt700: drop duplicate reg_default entry (git-fixes).
• ASoC: rt700: sort the register default table (git-fixes).
• ASoC: rt711-sdca: sort the register default tables (git-fixes).
• ASoC: rt711: sort the register default table (git-fixes).
• ASoC: rt712-sdca-dmic: sort the register default table (git-fixes).
• ASoC: rt712-sdca-sdw: sort the register default table (git-fixes).
• ASoC: rt715-sdca: drop duplicate reg_default entries (git-fixes).
• ASoC: rt715-sdca: sort the register default tables (git-fixes).
• ASoC: rt715: sort the register default table (git-fixes).
• ASoC: rt1017-sdca-sdw: sort the register default table (git-fixes).
• ASoC: rt1316-sdw: sort the register default table (git-fixes).
• ASoC: rt1318-sdw: sort the register default table (git-fixes).
• ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get (git-fixes).
• ASoC: sgtl5000: sort the register default table (git-fixes).
• ASoC: SOF: pcm: Move period/buffer configuration print after platform open (stable-fixes).
• ASoC: sof: pcm: use snd_pcm_direction_name() (stable-fixes).
• ASoC: SOF: Relocate and rework functionality for PCM stream freeing (stable-fixes).
• ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() (git-fixes).
• ASoC: SOF: validate topology volume range before allocation (git-fixes).
• ASoC: sti-sas: sort the register default table (git-fixes).
• ASoC: tas2552: sort the register default table (git-fixes).
• ASoC: tas2764: sort the register default table (git-fixes).
• ASoC: tas2780: sort the register default table (git-fixes).
• ASoC: tegra210_i2s: sort the register default table (git-fixes).
• ASoC: tegra210_mixer: sort the register default table (git-fixes).
• ASoC: tegra: Fix the MIXER enable default value (git-fixes).
• ASoC: tegra: Sort MBDRC register defaults (git-fixes).
• ASoC: xilinx: formatter_pcm: fix stream_data leak on open error (git-fixes).
• ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers (git-fixes).
• batman-adv: bla: fix freeing of claims on meshif deletion (git-fixes).
• batman-adv: bla: prevent CRC corruptions after claim flush (git-fixes).
• batman-adv: dat: avoid unaligned fault in IP extraction (git-fixes).
• batman-adv: fix stale receive device on merged fragments (git-fixes).
• Bluetooth: btintel: Fix diagnostics event detection (git-fixes).
• Bluetooth: btmtk: Do not discard the subsystem reset timeout (git-fixes).
• Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read() (stable-fixes).
• Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path (git-fixes).
• Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX (git-fixes).
• Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event (git-fixes).
• Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855() (git-fixes).
• Bluetooth: do not leak an hci_conn when a second LE connect is rejected (git-fixes).
• Bluetooth: eir: Fix OOB read in eir_get_service_data() (git-fixes).
• Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378 (git-fixes).
• Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative (git-fixes).
• Bluetooth: hci_conn: fix the SCO setup context lifetime (git-fixes).
• Bluetooth: hci_conn: hold conn reference in abort_conn_sync() (git-fixes).
• Bluetooth: hci_conn: re-enable advertising only for peripheral role (git-fixes).
• Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb (git-fixes).
• Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection (git-fixes).
• Bluetooth: hci_event: fix LE list UAF on reset (git-fixes).
• Bluetooth: hci_event: validate LE Set CIG Parameters response (git-fixes).
• Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative (git-fixes).
• Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative (git-fixes).
• Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request (git-fixes).
• Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths (git-fixes).
• Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists (stable-fixes).
• Bluetooth: hci_uart: Fix false success return in hci_uart_setup() (git-fixes).
• Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready (git-fixes).
• Bluetooth: MGMT: free the mesh send cancel command when it is cancelled (git-fixes).
• Bluetooth: MSFT: validate evt_prefix_len against the response length (git-fixes).
• Bluetooth: RFCOMM: serialize security confirmation handling (git-fixes).
• Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept (git-fixes).
• Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (git-fixes).
• Bluetooth: virtio_bt: avoid OOB read of build info string (git-fixes).
• bnxt_en: Adjust TX rings if reservation is less than requested (jsc#PED-16798).
• bnxt_en: Delay for 5 seconds after AER DPC for all chips (jsc#PED-16798).
• bnxt_en: Don't assume XDP is never enabled in bnxt_init_dflt_ring_mode() (jsc#PED-16798).
• bnxt_en: Drop pci_save_state() after pci_restore_state() (jsc#PED-16798).
• bnxt_en: Implement XDP RSS hash metadata extraction (jsc#PED-16798).
• bnxt_en: Implement XDP RSS hash metadata extraction for V3_CMP (jsc#PED-16798).
• bnxt_en: Move bnxt_rss_ext_op into header (jsc#PED-16798).
• bnxt_en: Refactor some basic ring setup and adjustment logic (jsc#PED-16798).
• bnxt_en: Restore default stat ctxs for ULP when resource is available (jsc#PED-16798).
• bnxt_en: Set bp->max_tpa according to what the FW supports (jsc#PED-16798).
• bnxt_en: Use absolute target ns from ptp_clock_request (jsc#PED-16798).
• bnxt_en: use bnxt_xdp_buff for xdp context (jsc#PED-16798).
• bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation (git-fixes).
• bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET (git-fixes).
• bus: ti-sysc: Fix /chosen node reference leak (git-fixes).
• cacheinfo: don't propagate DT/ACPI error when arch supplies info (arm64) (git-fixes).
• can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking (stable-fixes).
• cpufreq: intel_pstate: Use correct scaling factor on Raptor Lake-E (bsc#1240957 bsc#1249104 bsc#1265220).
• cpufreq: intel_pstate: Use CPPC to get scaling factors (bsc#1240957 bsc#1249104 bsc#1265220).
• cpufreq: intel_pstate: Use HYBRID_SCALING_FACTOR_ADL for Bartlett Lake (bsc#1240957 bsc#1249104 bsc#1265220).
• crypto: aspeed - Propagate platform_get_irq() errors (git-fixes).
• crypto: atmel-sha204a - fix heap info leak on I2C transfer failure (git-fixes).
• crypto: atmel-tdes - use scatterlist length before DMA mapping (git-fixes).
• crypto: ccm - Set rfc4309 maxauthsize from child (git-fixes).
• crypto: ccp - Fix memory leak in SEV INIT_EX path (git-fixes).
• crypto: ccp - Fix possible deadlock in SEV init failure path (git-fixes).
• crypto: doc - Remove extra parenthesis (git-fixes).
• crypto: hisilicon/sec2 - fix CCM algorithm long packet failure (git-fixes).
• crypto: keembay - Initialize completion before requesting IRQ (git-fixes).
• crypto: keembay - publish OF module alias for OCS AES/SM4 (git-fixes).
• crypto: mxs-dcp - fix source scatterlist length access (git-fixes).
• crypto: qat - cancel work on re-enable SR-IOV timeout (git-fixes).
• crypto: qat - clear AES key schedule from stack (git-fixes).
• crypto: qce - fix CCM AAD buffer underallocation (git-fixes).
• crypto: qce - fix error path in devm_qce_register_algs (git-fixes).
• crypto: rk3288 - fail ahash requests on HASH idle timeout (git-fixes).
• crypto: sa2ul - stop probe if context pool creation fails (git-fixes).
• crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping (git-fixes).
• device property: fix infinite loop in fwnode_for_each_child_node() (git-fixes).
• dmaengine: dw-edma: Clear stale requests on termination (git-fixes).
• dmaengine: dw-edma: Complete descriptors before pausing (git-fixes).
• dmaengine: dw-edma: Initialize IRQ data before requesting IRQs (git-fixes).
• dmaengine: dw-edma: Serialize abort state updates (git-fixes).
• dmaengine: dw-edma: Serialize channel state checks (git-fixes).
• dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe (git-fixes).
• dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure (git-fixes).
• dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal (git-fixes).
• dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers (git-fixes).
• dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout (git-fixes).
• driver core: soc: Unregister bus on early device registration failure (git-fixes).
• drm/amd/display: Add AV mute wait frames to dce110_set_avmute (stable-fixes).
• drm/amd/display: avoid divide-by-zero in __is_lut_linear() (git-fixes).
• drm/amd/display: Check for tg ops in dce110_set_avmute (git-fixes).
• drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix (git-fixes).
• drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE (git-fixes).
• drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank() (git-fixes).
• drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames (stable-fixes).
• drm/amd/display: Remove unused-but-set variable hubp from (git-fixes).
• drm/amd/display: validate plane degamma LUT size for private color prop (git-fixes).
• drm/amd/pm: adjust the visibility of pp_table sysfs node (stable-fixes).
• drm/amd/pm: Use same metric table for APU (stable-fixes).
• drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read (git-fixes).
• drm/amdgpu/gfx6: Fixup emit_cntxcntl() (git-fixes).
• drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets (git-fixes).
• drm/amdgpu/gfx6: Use PFP on the compute queues too (git-fixes).
• drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup (git-fixes).
• drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup (git-fixes).
• drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (git-fixes).
• drm/amdgpu: cap GTT size to physical RAM on APUs (stable-fixes).
• drm/amdgpu: check ASPM on the dGPU host link (git-fixes).
• drm/amdgpu: disallow multiple FENCE chunks in one submit (git-fixes).
• drm/amdgpu: fix aperture iounmap skipped on device removal (git-fixes).
• drm/amdgpu: fix autosuspend cleanup during removal (git-fixes).
• drm/amdgpu: fix nbif 6.3.1 l1 low power not functional (git-fixes).
• drm/amdgpu: Fix UVD decode image min size calculation (stable-fixes).
• drm/amdgpu: Fix UVD dpb min size calculation for H264 (stable-fixes).
• drm/amdgpu: Fix UVD min buffer sizes (stable-fixes).
• drm/amdgpu: Fix VCE 3 ring align_mask (git-fixes).
• drm/amdgpu: Implement insert_end for VCE 3 (git-fixes).
• drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini (git-fixes).
• drm/amdgpu: read TRUNCATE_COORD_MODE on gfx12 (git-fixes).
• drm/amdgpu: reject oversized IBs with per-ring packet limits (stable-fixes).
• drm/amdgpu: Reject UVD message with dimensions above 4096 (stable-fixes).
• drm/amdgpu: Reject UVD message with invalid number of h265 refs (stable-fixes).
• drm/amdgpu: remove unused function parameter (stable-fixes).
• drm/amdgpu: restore UMD profile pstate after runtime resume (stable-fixes).
• drm/amdgpu: validate GEM_CREATE domain combinations (stable-fixes).
• drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE (stable-fixes).
• drm/amdkfd: fix QID bit leak in pqm_create_queue() (stable-fixes).
• drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore (git-fixes).
• drm/amdkfd: Handle invalid event type in CRIU event restore (stable-fixes).
• drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure (git-fixes).
• drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure (git-fixes).
• drm/bridge: ps8640: propagate AUX transfer register errors (git-fixes).
• drm/bridge: tc358767: clamp the reported AUX read size to the request (git-fixes).
• drm/connector/hdmi: Fix out of bounds memory read (git-fixes).
• drm/connector: Fix epoch_counter docs to reflect reality (git-fixes).
• drm/hibmc: Fix list of formats on the primary plane (git-fixes).
• drm/hibmc: Use drm_atomic_helper_check_plane_state() (git-fixes).
• drm/i915/fbc: Extract intel_fbc_has_fences() (stable-fixes).
• drm/i915/hdcp: check streams bounds before overflow (git-fixes).
• drm/i915/hdcp: Move to using intel_display in intel_hdcp (stable-fixes).
• drm/i915/hdcp: require monotonically increasing seq_num_v (git-fixes).
• drm/i915/hdcp: Skip inactive MST connectors when building stream list (stable-fixes).
• drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable() (stable-fixes).
• drm/i915/vrr: require valid min/max vfreq for VRR (git-fixes).
• drm/lima: call drm_mm_init() with a valid allocation range (git-fixes).
• drm/msm/a6xx: Fix RBBM_CLOCK_CNTL3_TP0 value in a730_hwcg (git-fixes).
• drm/msm/a6xx: Fix stale rpmh votes after suspend (git-fixes).
• drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0) (git-fixes).
• drm/msm/dsi: Drop dev_pm_opp_set_rate(0) (git-fixes).
• drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value (git-fixes).
• drm/panel-edp: fix i2c adapter leak on probe failure (git-fixes).
• drm/panel: samsung-s6d16d0: Power off on prepare failure (git-fixes).
• drm/panthor: fix firmware control interface bounds checks (git-fixes).
• drm/panthor: return PTR_ERR() from devm_drm_dev_alloc() (git-fixes).
• drm/panthor: skip zero-sized firmware sections (git-fixes).
• drm/radeon: fix autosuspend cleanup during teardown (git-fixes).
• drm/radeon: restore hardware polling in fence_is_signaled to fix performance regression (git-fixes).
• drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format (git-fixes).
• drm/ssd130x: fix column and row end address in partial updates for ssd132x (git-fixes).
• drm/ssd130x: fix column and row end address in partial updates in ssd133x (git-fixes).
• drm/sun4i: crtc: Propagate layer initialization error (git-fixes).
• drm/sun4i: Drop node references while building component list (git-fixes).
• drm/sun4i: dw-hdmi: Drop TCON TOP port reference (git-fixes).
• drm/sun4i: fix refcount leak in sun4i_backend_init_sat() (git-fixes).
• drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz (git-fixes).
• drm/sun4i: hdmi: Don't leak sync polarity bits into packet control (git-fixes).
• drm/sun4i: tcon: Drop remote endpoint reference (git-fixes).
• drm/sun4i: tcon: Drop TCON TOP device reference (git-fixes).
• drm/sun4i: tcon: Set output mux for DSI and LVDS (git-fixes).
• drm/sun4i: vi scaler: Fix coefficient selection (git-fixes).
• drm/tegra: dsi: Re-add clear enable register if DSI was powered by bootloader (git-fixes).
• drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info (git-fixes).
• drm/tve200: add OF module alias for autoloading (git-fixes).
• drm/xe/oa: Check managed mutex initialization errors (git-fixes).
• drm/xe/oa: Fix sync entry leak on OA config emit failure (git-fixes).
• drm/xe: Introduce xe_gt_dbg_printer() (stable-fixes).
• drm/xe: Order ring writes before ring tail updates (git-fixes).
• drm/xe: Stub out new pagefault layer (stable-fixes).
• drm/xe: tests: fix error message in xe_migrate_sanity_test() (git-fixes).
• drm: fix race between partial drm_dev_register() failure and ioctl (git-fixes).
• drm: lcdif: Wait for vblank before disabling DMA (git-fixes).
• drm: Remove unused header in drm_dumb_buffers.c (git-fixes).
• ethtool: rss: fix hkey leak when indir_size is 0 (git-fixes).
• fbdev: bitblit: bound-check glyph index in bit_cursor() (git-fixes).
• fbdev: core: Fix pointer desynchronization in fb_io_read() (git-fixes).
• fbdev: kyro: Validate overlay viewport coordinates (git-fixes).
• fbdev: omapfb: panel-dsi-cm: initialize lock before registering display (git-fixes).
• fbdev: ssd1307fb: defer I2C transfers from damage callbacks (git-fixes).
• fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device() (git-fixes).
• fbdev: uvesafb: unregister connector callback on init failure (git-fixes).
• firmware: arm_scmi: Avoid IDR updates while cleaning channels (git-fixes).
• firmware: arm_scmi: Drop handle on protocol bind failures (git-fixes).
• firmware: arm_scmi: Fix requested device removal race (git-fixes).
• firmware: arm_scmi: Free transport channel on IDR failure (git-fixes).
• firmware: arm_scmi: Protect device request lookup with RCU (git-fixes).
• firmware: arm_scmi: Reject out of range DT protocol IDs (git-fixes).
• firmware: arm_scmi: Unregister device notifier before IDR teardown (git-fixes).
• firmware: arm_scmi: Use channel ID for transport teardown (git-fixes).
• firmware_loader: do not queue completed sysfs fallback requests (git-fixes).
• fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write (git-fixes).
• fpga: dfl: fme: add error handling (git-fixes).
• fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration (git-fixes).
• gpu: host1x: Avoid stack over-read in debug output helpers (git-fixes).
• gpu: host1x: Fix offset calculation in trace_write_gather (git-fixes).
• HID: core: fix number/pointer type confusion on long items (git-fixes).
• HID: core: fix OOB read of field->usage in hid_set_field() (git-fixes).
• HID: hyperv: validate initial device info bounds (git-fixes).
• HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure (git-fixes).
• HID: lg4ff: validate report length before fixed offsets (git-fixes).
• HID: logitech-dj: Fix maxfield check in DJ short report validation (git-fixes).
• HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report (git-fixes).
• HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write (stable-fixes).
• HID: logitech-dj: Standardise hid_report_enum variable nomenclature (stable-fixes).
• HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID (stable-fixes).
• HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() (git-fixes).
• HID: mcp2221: validate report size in mcp2221_raw_event() (git-fixes).
• HID: nintendo: Fix imu_timestamp_us double increment per report (git-fixes).
• HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() (git-fixes).
• HID: picolcd: clamp eeprom debugfs read to bytes actually received (git-fixes).
• HID: roccat: bound device-supplied profile index (git-fixes).
• HID: roccat: free buffered reports when destroying device (git-fixes).
• HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature (git-fixes).
• HID: sensor: custom: Fix field sysfs group cleanup on failure (git-fixes).
• HID: sensor: custom: Fix use-after-free in enable_sensor (git-fixes).
• HID: tmff: Use 64-bit arithmetic for force feedback scaling (git-fixes).
• hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination (git-fixes).
• hwmon: (lm25066) Use i2c_get_match_data() (stable-fixes).
• hwmon: (max6621) fix negative temperature offset and crit readings (git-fixes).
• hwmon: (max6621) fix temperature clamp range (git-fixes).
• hwmon: (nzxt-smart2) Check return value of init_device() in probe (git-fixes).
• hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations (git-fixes).
• hwrng: ks-sa - Fix runtime PM cleanup on registration failure (git-fixes).
• hwrng: omap - Fix probe error path cleanup (git-fixes).
• hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() (git-fixes).
• i2c: bcm-iproc: remove printout on handled timeouts (stable-fixes).
• i2c: core: fix debugfs UAF on adapter removal (git-fixes).
• i2c: iproc: reset bus after timeout if START_BUSY is stuck (git-fixes).
• i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure (git-fixes).
• i2c: mux: Fix channel node leak on adapter add failure (git-fixes).
• i2c: ocores: Disable clock on failed resume (git-fixes).
• i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices (git-fixes).
• i3c: master: Fix device_register() error path (git-fixes).
• i3c: master: Fix info leak and UAF in device unregister path (git-fixes).
• i3c: master: Fix potential UAF in i3c_device_uevent() (git-fixes).
• i3c: master: svc: bound IBI payload to the requested max_payload_len (git-fixes).
• ibmvnic: Only record tx completed bytes once per handler (bsc#1274620).
• iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE (git-fixes).
• iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable (git-fixes).
• iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF (git-fixes).
• iio: chemical: sgp30: Handle IAQ thread creation failure (git-fixes).
• iio: dac: m62332: Fix regulator reference count imbalance (git-fixes).
• iio: gyro: mpu3050: fix sign of raw angular velocity readings (git-fixes).
• iio: light: cm32181: return zero after writing calibscale (git-fixes).
• iio: light: gp2ap002: Disable regulators on resume failure (git-fixes).
• iio: light: gp2ap002: re-enable irq if runtime suspend fails (git-fixes).
• iio: light: isl29028: return zero in write_raw() on success (git-fixes).
• iio: light: tsl2583: return zero in write_raw() on success (git-fixes).
• iio: light: tsl2772: fix ALS calibscale readback (git-fixes).
• iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure (git-fixes).
• iio: pressure: dps310: fix NULL pointer dereference on ACPI probe (git-fixes).
• iio: pressure: mpl115: Fix runtime PM cleanup (git-fixes).
• iio: srf04: fix pm_runtime handling on probe error path (git-fixes).
• iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() (git-fixes).
• Input: atkbd - skip deactivate for HONOR ZQC-P (git-fixes).
• Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard (stable-fixes).
• Input: evdev - fix information leak in evdev_pass_values() (stable-fixes).
• Input: evdev - sanitize event type index when fetching event masks (stable-fixes).
• Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet (git-fixes).
• Input: focaltech - use signed coordinates to prevent underflow (git-fixes).
• Input: hynitron_cstxxx - validate touch count and finger IDs (git-fixes).
• Input: iforce - validate input packet lengths (stable-fixes).
• Input: iqs5xx - validate firmware record destination span (git-fixes).
• Input: mms114 - fix Y-resolution configuration (git-fixes).
• Input: psxpad-spi - set driver data before use (git-fixes).
• Input: sur40 - fix input device registration ordering (stable-fixes).
• Input: sur40 - fix V4L error path cleanup (stable-fixes).
• Input: synaptics-rmi4 - block s_input when F54 queue is busy (git-fixes).
• Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer (git-fixes).
• Input: synaptics-rmi4 - fix F55 transmitter electrode count typo (git-fixes).
• Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue (git-fixes).
• Input: synaptics-rmi4 - zero report size on F54 work error (git-fixes).
• Input: xpad - add support for ZENAIM LEVERLESS (stable-fixes).
• interconnect: Fix use after free in icc_get() and of_icc_get_by_index() (git-fixes).
• ipmi: ipmb: validate write message length (git-fixes).
• ipmi: si: Fix NULL pointer dereference after failed registration (git-fixes).
• kthread: Default affine kthread to its preferred NUMA node (bsc#1269313).
• kthread: Make sure kthread hasn't started while binding it (bsc#1269313).
• KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes).
• KVM: PPC: Book3S HV: Add support for compat CPU capabilities for KVM on PowerNV (bsc#1263864 ltc#217835).
• KVM: PPC: Book3S HV: Implement compat CPU capability retrieval for KVM on PowerVM (bsc#1263864 ltc#217835).
• KVM: PPC: Book3S HV: Validate arch_compat against host compatibility mode (bsc#1263864 ltc#217835).
• KVM: PPC: Document KVM_PPC_GET_COMPAT_CAPS ioctl (bsc#1263864 ltc#217835).
• KVM: PPC: Introduce KVM_CAP_PPC_COMPAT_CAPS and wire up ioctl (bsc#1263864 ltc#217835).
• KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page (git-fixes).
• leds: pca9532: Fix inverted GPIO output polarity (git-fixes).
• leds: pca9532: Fix phantom device registration on missing hardware (git-fixes).
• lib/string: fix memchr_inv() for large ranges (git-fixes).
• lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() (git-fixes).
• mailbox: qcom-ipcc: fix duplicate channel allocation across holes (git-fixes).
• mailbox: rockchip: disable pclk on probe failure and unbind (git-fixes).
• maple_tree: fix argument name in header (git-fixes).
• md/raid1: create serial pool adding rdev to array with serialize_policy=1 (bsc#1272261).
• media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref (git-fixes).
• media: amphion: Remove obsolete frame_count check in venc_start_session (git-fixes).
• media: cec-pin: Fix event FIFO ordering (git-fixes).
• media: cec: disable delayed work before freeing an interrupted transmit (git-fixes).
• media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash (git-fixes).
• media: cec: Serialize exclusive follower delivery (git-fixes).
• media: cec: stm32: prevent out-of-bounds write on RX overflow (git-fixes).
• media: cedrus: fix memory leak in cedrus_init_ctrls() (git-fixes).
• media: cobalt: Avoid freeing ALSA private data twice (git-fixes).
• media: cx231xx: reject geometry changes while the VBI queue is busy (git-fixes).
• media: cx23885: cancel NetUP CI work before teardown (git-fixes).
• media: em28xx: defer audio-only extension registration (git-fixes).
• media: em28xx: fix use-after-free of dev_next->devlist on disconnect (git-fixes).
• media: go7007: defer the ALSA v4l2 put until card release (git-fixes).
• media: i2c: imx219: Rename VTS to FRM_LENGTH (stable-fixes).
• media: i2c: ov02a10: fix endpoint parsing use-after-free (git-fixes).
• media: i2c: ov7740: fix use-after-destroy in remove (git-fixes).
• media: i2c: rdacm21: Fix missing media_entity_cleanup() (git-fixes).
• media: imx219: Fix maximum frame length in lines (git-fixes).
• media: intel/ipu6: fix async notifier cleanup leak on parse error (git-fixes).
• media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define (git-fixes).
• media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define (git-fixes).
• media: mc-entity: Add missing kerneldoc (git-fixes).
• media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common (git-fixes).
• media: nxp: imx8-isi: Correct color map between V4L2 and ISI (git-fixes).
• media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing (git-fixes).
• media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks (git-fixes).
• media: rc: sunxi-cir: Unregister rc device on probe failure (git-fixes).
• media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure (git-fixes).
• media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak (git-fixes).
• media: s2255: bound JPEG frame size before copying into the buffer (git-fixes).
• media: s2255: check firmware size before reading trailing marker (git-fixes).
• media: saa7164: fix cleanup on resource allocation failure (git-fixes).
• media: tda18250: fix possible integer overflow (git-fixes).
• media: usbtv: keep device alive while ALSA card exists (git-fixes).
• media: v4l2-async: avoid deleting unlinked ASC entry on link error (git-fixes).
• media: v4l2-async: Unregister sub-device if asc_list is empty (git-fixes).
• media: v4l2-ctrls: Allow unknown HDR10 white point and luminance (git-fixes).
• media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link (git-fixes).
• media: venus: fix payload size calculation in parse_raw_formats() (git-fixes).
• media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() (git-fixes).
• media: vicodec: fix out-of-bounds write in FWHT encoder (git-fixes).
• media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure (git-fixes).
• media: vimc: fix pixel format lookup in enum_framesizes (git-fixes).
• media: zoran: Avoid freeing a registered video_device twice (git-fixes).
• mei: pull kvfree out of spinlock (git-fixes).
• mfd: iqs62x: Reject zero-length firmware records (git-fixes).
• mfd: rave-sp: validate received frame payload lengths (git-fixes).
• misc: bcm-vk: Use acquire/release for msgq_inited (git-fixes).
• misc: fastrpc: fix channel ctx ref leak when session alloc fails (git-fixes).
• misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free (git-fixes).
• misc: fastrpc: Remove buffer from list prior to unmap operation (git-fixes).
• misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke (git-fixes).
• misc: rtsx: add missing write register handling (git-fixes).
• misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe() (git-fixes).
• mkspec-dtb: Move DTS prefix into package list.
• mkspec-dtb: Move provides-obsoletes to package list.
• mkspec-dtb: Put per-architecture package lists into a hash.
• mkspec-dtb: re-indent.
• mm: Create/affine kcompactd to its preferred node (bsc#1269313).
• mm: Create/affine kswapd to its preferred node (bsc#1269313).
• mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit (git-fixes).
• mmc: sdhci: unmap the bounce buffer before device release (git-fixes).
• mmc: via-sdmmc: stop card-detect handling on probe failure (git-fixes).
• mtd: afs: validate v2 image info bounds (git-fixes).
• mtd: mtdoops: free page bitmap when the backing MTD is removed (git-fixes).
• mtd: mtdswap: Avoid freeing registered blktrans device twice (git-fixes).
• mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() (git-fixes).
• mtd: rawnand: validate ONFI extended parameter page sections (git-fixes).
• net: mana: Add debug knob to skip TX timeout recovery reset (git-fixes).
• net: mana: Add handler for sriov configure (bsc#1272756).
• net: mana: Cap MSI-X vectors to the device MSI-X table size (git-fixes).
• net: mana: Extend RX CQE coalescing up to 8 packets (git-fixes).
• net: mana: Fall back to scattered pages for GDMA queues (git-fixes).
• net: mana: force full-page RX buffers via ethtool private flag (bsc#1269792).
• net: mana: refactor mana_get_strings() and mana_get_sset_count() to use switch (bsc#1269792).
• net: mana: Route ring-buffer access through offset-based helpers (git-fixes).
• net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() (git-fixes bsc#1274550).
• net: thunderbolt: Count delivered packets in rx_packets and rx_bytes (git-fixes).
• net: thunderbolt: Mark the connection down when bringing it up fails (git-fixes).
• net: thunderbolt: Release the Rx HopID that was handed out on mismatch (git-fixes).
• net: thunderbolt: Tear down DMA paths before stopping the rings (git-fixes).
• net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() (git-fixes).
• net: usb: ipheth: fix carrier_work UAF on disconnect (git-fixes).
• nfc: digital: clamp SENSF_RES length to the destination buffer (git-fixes).
• nfc: digital: Do not dump a NULL response in command completion (git-fixes).
• nfc: fdp: bound the device-reported read length and fix an skb leak (git-fixes).
• nfc: llcp: avoid userspace overflow on invalid optlen (git-fixes).
• nfc: llcp: bound SNL TLV parsing to the skb and add length checks (git-fixes).
• nfc: llcp: bound the connect_sn TLV walk to the skb (git-fixes).
• nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers (git-fixes).
• nfc: llcp: read llcp_sock->local under the socket lock in getsockopt (git-fixes).
• nfc: llcp: reject PDUs shorter than the LLCP header (git-fixes).
• nfc: microread: validate target discovery payload lengths (git-fixes).
• nfc: nci: fix double completion race in nci_data_exchange_complete (git-fixes).
• nfc: nci: fix out-of-bounds write in nci_target_auto_activated() (git-fixes).
• nfc: nci: fix uninit-value in the RF discover/activated NTF handlers (git-fixes).
• nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing (git-fixes).
• nfc: nci: free destination parameters when closing a connection (git-fixes).
• nfc: pn533: hold a reference to the request skb during send_frame (git-fixes).
• nfc: pn533: purge fragmented skbs during cleanup (git-fixes).
• nfc: st21nfca: validate ATR_REQ length against the received frame (git-fixes).
• nouveau/gem: reserve the bo in the info ioctl around the vma lookup (git-fixes).
• of: fix out-of-bounds read in of_alias_scan() stem parser (git-fixes).
• PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] (git-fixes).
• PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk (git-fixes).
• PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip (git-fixes).
• PCI: j721e: Fix incorrect max_lanes for J7200 (git-fixes).
• PCI: meson: Fix GPIO state while requesting PERST# (git-fixes).
• phy: qcom: qmp-combo: Correct pre-emphasis table for QMP v4 DP PHYs (git-fixes).
• phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend (git-fixes).
• phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table (git-fixes).
• phy: sunplus: fix error handling in sp_uphy_init() (git-fixes).
• pinctrl: bcm2835: Don't remove an unregistered GPIO chip (git-fixes).
• pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).
• pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).
• pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip (git-fixes).
• pinctrl: rockchip: Reset the pin count when recalculating SoC data (git-fixes).
• platform/chrome: cros_ec_debugfs: Clean up console log on probe failure (git-fixes).
• platform/chrome: cros_ec_debugfs: Unregister panic notifier (git-fixes).
• platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count (git-fixes).
• platform/chrome: sensorhub: Bound the EC-reported sensor number (git-fixes).
• platform/chrome: sensorhub: Fix dropped timestamp events and log spam (git-fixes).
• platform/chrome: sensorhub: Fix memory overread in ring handler (git-fixes).
• platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL (git-fixes).
• platform/surface: acpi-notify: Check ACPI companion before use (git-fixes).
• platform/x86/amd/hsmp: Reject negative power cap writes in hwmon (git-fixes).
• platform/x86: dell-privacy: Fix race condition (git-fixes).
• platform/x86: dell-wmi-base: Fix resource leak on module load failure (git-fixes).
• platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer (git-fixes).
• platform/x86: dell-wmi-sysman: Fix instance ID bounds (git-fixes).
• platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS (git-fixes).
• platform/x86: hp-bioscfg: advance elem past consumed array elements (git-fixes).
• platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store() (git-fixes).
• platform/x86: hp-bioscfg: fix heap OOB read on empty password write (git-fixes).
• platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password (git-fixes).
• platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer() (git-fixes).
• platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed (git-fixes).
• platform/x86: hp-bioscfg: fix password encoding bounds check (git-fixes).
• platform/x86: hp-bioscfg: warn on element type mismatch instead of failing (git-fixes).
• platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path (git-fixes).
• platform/x86: ISST: Add a NULL check for sst_inst (git-fixes).
• platform/x86: ISST: Just allow 2 bits for SST feature enable (git-fixes).
• platform/x86: ISST: Return error during profile addition (git-fixes).
• platform/x86: ISST: Use PP level enable mask (git-fixes).
• platform/x86: ISST: Validate level in perf mask ioctls (git-fixes).
• platform/x86: ISST: Validate logical CPU id and clos id (git-fixes).
• platform/x86: ISST: Validate parameter for core power state (git-fixes).
• platform/x86: ISST: Validate socket ID in clos_assoc ioctl (git-fixes).
• PM: sleep: Fix off-by-one in wakelocks number limit check (git-fixes).
• power: supply: bd99954: Drop bad register fields (git-fixes).
• power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address (git-fixes).
• power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address (git-fixes).
• power: supply: bq27xxx: bq27520g4: fix REG_TTES address (git-fixes).
• power: supply: bq256xx: drain usb_work before freeing the charger (git-fixes).
• power: supply: bq24257: fix use-after-free on remove (git-fixes).
• power: supply: bq25890: Fix power_supply reference leak (git-fixes).
• power: supply: cros_usbpd-charger: bound the EC-reported port count (git-fixes).
• power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS (git-fixes).
• power: supply: isp1704_charger: cancel work on remove (git-fixes).
• power: supply: lp8727: fix use-after-free in lp8727_release_irq() (git-fixes).
• power: supply: max17040: drop incorrect I2C functionality check (git-fixes).
• power: supply: max17040: synchronize work cancellation on suspend (git-fixes).
• power: supply: qcom_battmgr: terminate the strings from firmware (git-fixes).
• power: supply: rt9455: quiesce delayed work before teardown (git-fixes).
• power: supply: sbs-battery: Use a per-device serial number buffer (git-fixes).
• power: supply: twl4030_charger: cancel workers via devm (git-fixes).
• power: supply: ucs1002: fix use-after-free on remove (git-fixes).
• powercap: intel_rapl_tpmi: Handle PMU registration failure during probe (git-fixes).
• powerpc/dt_cpu_ftrs: Set CPU_FTR_P11_PVR for Power11 and later processors (bsc#1263864 ltc#217835).
• powerpc/pseries: Ensure vpa,slb_shadow & dtl are unregistered during crash (bsc#1271256).
• powerpc/pseries: lparcfg - fix kbuf[] underflow (bsc#1274753 ltc#221289 bsc#1274754 ltc#221288 bsc#1274752 ltc#221290).
• powerpc/pseries: pci - logic bug (bsc#1274749 ltc#221282 bsc#1274755 ltc#221284 bsc#1274756 ltc#221283).
• powerpc: Replace ASSEMBLY with ASSEMBLER in non-uapi headers (bsc#1263864 ltc#217835).
• powerpc: Replace ASSEMBLY with ASSEMBLER in uapi headers (bsc#1263864 ltc#217835).
• ppdev: prevent overflow when setting port timeout (git-fixes).
• qede: fix out-of-bounds check for cqe->len_list (git-fixes).
• rapidio: clear mport->net when rio_add_net() fails (git-fixes).
• rapidio: mport_cdev: fix use-after-free in dma_req_free() (git-fixes).
• RDMA/irdma: Remove redundant legacy_mode checks (git-fixes).
• RDMA/mana_ib: drain QP references after partial table insertion (git-fixes).
• RDMA/mana_ib: unify QP lookup table (git-fixes).
• RDMA/mlx5: Fix integer overflow of user QP buffer size (git-fixes).
• regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer (git-fixes).
• regulator: core: use system_freezable_wq for init complete work (git-fixes).
• regulator: devres: add API for reference voltage supplies (stable-fixes).
• regulator: devres: fix devm_regulator_get_enable_read_voltage() return (git-fixes).
• regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata (git-fixes).
• regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling (git-fixes).
• remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdev (git-fixes).
• remoteproc: qcom_q6v5_adsp: Fix reference leak for device node (git-fixes).
• remoteproc: scp: Fix device reference leak on failed lookup (git-fixes).
• Revert 'drm/amdgpu: fix aperture mapping leak' (git-fixes).
• Revert 'media: v4l2-dev: fix error handling in __video_register_device()' (git-fixes).
• Revert 'thermal/drivers/hwmon: Cleanup coding style a bit' (stable-fixes).
• rpmsg: core: Fix incorrect return value documentation (git-fixes).
• rpmsg: glink: smem: order FIFO read after availability check (git-fixes).
• rtc: gamecube: check return value of devm_rtc_register_device() (git-fixes).
• rtc: pcf8563: fix clock provider leak on unbind (git-fixes).
• rtc: pcf85363: Add error checking to regmap calls in probe() (git-fixes).
• rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers (git-fixes).
• rtc: rzn1: Fix weekday underflow when alarm crosses month boundary (git-fixes).
• rtc: zynqmp: Return optional clock lookup errors (git-fixes).
• sched,arm64: Handle CPU isolation on last resort fallback rq (bsc#1269313).
• scsi: fnic: Abort timed-out NVMe LS requests (bsc#1236344).
• scsi: fnic: Add FDLS role handling for NVMe initiators (bsc#1236344).
• scsi: fnic: Add the NVMe/FC transport path (bsc#1236344).
• scsi: fnic: Advertise NVMe initiator service parameters (bsc#1236344).
• scsi: fnic: Bump up version number (bsc#1236344).
• scsi: fnic: Decode firmware role configuration (bsc#1236344).
• scsi: fnic: Do not use GFP_ZERO for mempools (bsc#1236344).
• scsi: fnic: Expose NVMe transport state in debugfs (bsc#1236344).
• scsi: fnic: Handle NVMe LS frames in FDLS (bsc#1236344).
• scsi: fnic: Make debug logging protocol independent (bsc#1236344).
• scsi: fnic: Make fnic_queuecommand() easier to analyze (bsc#1236344).
• scsi: fnic: Refactor in_remove flag and call to fnic_fcpio_reset() (bsc#1236344).
• scsi: fnic: Remove a useless struct mempool forward declaration (bsc#1236344).
• scsi: fnic: Rename fnic_scsi_fcpio_reset() (bsc#1236344).
• scsi: fnic: Route completions and resets by initiator role (bsc#1236344).
• scsi: fnic: Self-assignment of intr_time_type has no effect (bsc#1236344).
• scsi: fnic: Send NVMe LS requests through FDLS (bsc#1236344).
• scsi: fnic: Switch to use %ptSp (bsc#1236344).
• scsi: fnic: Track NVMe transport statistics (bsc#1236344).
• scsi: fnic: Use fnic_num for non-SCSI identifiers (bsc#1236344).
• scsi: fnic: Use mempool for receive frames (bsc#1236344).
• scsi: qla2xxx: Declare qla2xxx_mqueuecommand() static (bsc#1275737).
• scsi: qla2xxx: Use nr_cpu_ids instead of NR_CPUS for qp_cpu_map allocation (bsc#1275737).
• scsi: storvsc: Support manual scans for all Hyper-V targets (git-fixes).
• sctp: avoid auth_enable sysctl UAF during netns teardown (git-fixes).
• serial: 8250_dma: Clear stale RX state on shutdown (git-fixes).
• serial: amba-pl011: unprepare console clock on unregister (git-fixes).
• serial: core: clear freed pointers on uart_register_driver() failure (git-fixes).
• serial: qcom-geni: fix TX DMA buffer flush (git-fixes).
• serial: sc16is7xx: fix copy-paste errors in EFR_SWFLOWx_BIT constants (stable-fixes).
• smb/client: handle overlapping allocated ranges in fallocate (bsc#1274902).
• smb: client: reject overlapping data areas in SMB2 responses (git-fixes).
• smb: client: require net admin for CIFS SWN netlink (bsc#1273966).
• smb: client: resolve SWN tcon from live registrations (bsc#1273872).
• soc: fsl: qe: check platform_driver_register() in qe_ic_of_init() (git-fixes).
• soc: qcom: rpmh-rsc: manage PM notifiers with devres (git-fixes).
• soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap() (git-fixes).
• software node: Fix software_node_get_reference_args() with index -1 (git-fixes).
• soundwire: qcom: Fix port exhaustion check in stream_alloc_ports (git-fixes).
• speakup: keyhelp: guard letter_offsets possible out-of-range indexing (git-fixes).
• spi: img-spfi: don't disable runtime PM on DMA deferred probe (git-fixes).
• spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers (stable-fixes).
• spi: sprd-adi: Fix probe succeeding without registering the controller (git-fixes).
• staging: fbtft: Use sysfs_emit_at() to print to sysfs file (git-fixes).
• staging: media: tegra-video: fix of_node_put() on VIP parse errors (git-fixes).
• staging: media: tegra-video: vi: fix probe failure on skipped last port (git-fixes).
• staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown (git-fixes).
• staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() (git-fixes).
• staging: rtl8723bs: fix missing shared-key auth challenge length check (git-fixes).
• staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() (git-fixes).
• staging: rtl8723bs: fix OOB read in WMM_param_handler() (git-fixes).
• staging: rtl8723bs: use kfree_sensitive() for key material (git-fixes).
• staging: rtl8723bs: validate monitor transmit frame lengths (git-fixes).
• staging: sm750fb: gate dualview dataflow using g_dualview (git-fixes).
• thermal/drivers/imx: Disable clock on runtime resume failure (git-fixes).
• thermal/drivers/qoriq: Disable clock on resume failure (git-fixes).
• thermal: intel: int3400: clean up ODVP on probe failures (git-fixes).
• thunderbolt: Bound the DROM dual link port number before indexing sw->ports (git-fixes).
• thunderbolt: Fix bandwidth group reservation indexing (git-fixes).
• thunderbolt: icm: Preserve USB4 proxy data-valid bit (git-fixes).
• tlclk: if sscanf() fails, fall back to 0, not random value (git-fixes).
• tpm: st33zp24: Return zero on status read failure (git-fixes).
• tpm: st33zp24: Validate locality read result (git-fixes).
• tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout (git-fixes).
• tty: clear cdev pointer after cdev_add() failure (git-fixes).
• tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64 (git-fixes).
• tty: skip cdev_del() when no cdev is registered (git-fixes).
• uaccess: add copy_struct_to_user helper (bsc#1263864 ltc#217835).
• uaccess: fix ignored_trailing logic in copy_struct_to_user() (bsc#1263864 ltc#217835).
• uio: Fix stale info pointer in failed registration path (git-fixes).
• usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() (git-fixes).
• usb: atm: usbatm: fix invalid ci_range initialization (git-fixes).
• USB: c67x00: fix use-after-free in c67x00_add_iso_urb() (git-fixes).
• usb: cdnsp: fix incorrect endian conversions for APB timeout register (git-fixes).
• usb: dwc2: add missing @remotewakeup kernel-doc parameter (git-fixes).
• usb: dwc2: gadget: Exit partial power down state when changing USB pull-up (git-fixes).
• usb: gadget: configfs: fix out-of-bounds read of qw_sign (git-fixes).
• usb: gadget: f_fs: Prevent deadlock during ep0 read loop (git-fixes).
• usb: gadget: f_ncm: Use unsigned int for ndp_index (git-fixes).
• usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() (git-fixes).
• usb: gadget: f_uac1_legacy: remove broken string configfs attributes (git-fixes).
• usb: gadget: pch_udc: remove excess kernel-doc member for registered (git-fixes).
• usb: gadget: r8a66597: avoid double free of ep0_req in probe error path (git-fixes).
• usb: gadget: snps_udc_plat: clean up PHY on probe deferral (git-fixes).
• usb: gadget: u_audio: Fix use-after-free on sound card disconnect (git-fixes).
• usb: gadget: uac: validate rate list length before storing (git-fixes).
• usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() (git-fixes).
• usb: mtu3: allow system suspend during active gadget connection (git-fixes).
• usb: musb: omap2430: clean up probe error handling (stable-fixes).
• USB: phy: fsl-usb: fix missing static keywords (git-fixes).
• usb: renesas_usbhs: Fix power-off ordering on unbind (git-fixes).
• USB: serial: digi_acceleport: fix port registration order (git-fixes).
• USB: serial: ftdi_sio: add support for E+H FXA291 (stable-fixes).
• USB: serial: option: add TDTECH MT5710-CN (stable-fixes).
• USB: serial: option: fix slab OOB read in interrupt URB callback (git-fixes).
• USB: serial: spcp8x5: drop broken carrier detect support (git-fixes).
• USB: storage: add NO_ATA_1X quirk for Longmai USB Key (stable-fixes).
• usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive() (git-fixes).
• usb: typec: ucsi: unregister debugfs entries on teardown (git-fixes).
• usb: usbfs: fix use-after-free of usb_device in usbdev_release() (git-fixes).
• usb: xhci: Handle USB3 port events when there is one roothub (git-fixes).
• vt: add permission check for KDSKBMETA ioctl (stable-fixes).
• vt: stabilize tty reference in kbd_keycode with tty_port_tty_get (stable-fixes).
• w1: ds28e17: reject an oversize length on an I2C block read (git-fixes).
• w1: ds2482: Fix signedness bug in ds2482_w1_triplet() (git-fixes).
• wifi: ath6kl: avoid buffer overreads in WMI event handlers (git-fixes).
• wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets (git-fixes).
• wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump (git-fixes).
• wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() (git-fixes).
• wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate (git-fixes).
• wifi: ath11k: Correctly copy the hint BSSID in WMI scan request (git-fixes).
• wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx() (git-fixes).
• wifi: ath12k: Correctly copy the hint BSSID in WMI scan request (git-fixes).
• wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() (git-fixes).
• wifi: brcmfmac: fix P2P action frame handling without device vif (git-fixes).
• wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs (git-fixes).
• wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments (git-fixes).
• wifi: iwlwifi: mei: check SAP message length before reading it (git-fixes).
• wifi: iwlwifi: mei: pass correct argument to function (git-fixes).
• wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser (git-fixes).
• wifi: mac80211: disconnect on CSA to channel 0 (git-fixes).
• wifi: mac80211: fix multi-link element inheritance (git-fixes).
• wifi: mac80211: fix per-STA profile length in cross-link CSA parsing (git-fixes).
• wifi: mac80211: send TWT teardown to peer after setup TX failure (git-fixes).
• wifi: mac80211: skip default WMM setup for AP_VLAN links (git-fixes).
• wifi: mac80211: skip unused probe response countdown offsets (git-fixes).
• wifi: mt76: fix 4th chain ACK RSSI bitmask in sta_poll (git-fixes).
• wifi: mt76: fix ER-SU 106-tone RU check in RX rate decode (git-fixes).
• wifi: mt76: fix HE DCM max-RU capability encoding (git-fixes).
• wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length (git-fixes).
• wifi: mt76: mt792x: Fix memory leak in SDIO TX path (git-fixes).
• wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex (git-fixes).
• wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss (git-fixes).
• wifi: mt76: mt7915: fix double hif2 init on the non-WED path (git-fixes).
• wifi: mt76: mt7915: fix ext PHY use-after-free on register error path (git-fixes).
• wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986 (git-fixes).
• wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie (git-fixes).
• wifi: mt76: mt7915: release hif2 reference on probe IRQ failure (git-fixes).
• wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement (git-fixes).
• wifi: mt76: mt7915: unwind state on add_interface failure (git-fixes).
• wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields (git-fixes).
• wifi: mt76: mt7915: write RX header translation bit to the correct register (git-fixes).
• wifi: mt76: mt7921: validate CLC firmware records (git-fixes).
• wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb (git-fixes).
• wifi: mt76: mt7925: fix msg len mismatch between driver and firmware (git-fixes).
• wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config (git-fixes).
• wifi: mt76: mt7996: don't report a zero TX bitrate (git-fixes).
• wifi: mt76: mt7996: fix capability of EHT-MCS 15 in MRU (git-fixes).
• wifi: mt76: mt7996: fix reg addr remap when addr is 0 (git-fixes).
• wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV (git-fixes).
• wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset (git-fixes).
• wifi: mt76: mt7996: validate RX band_idx before dereferencing phys (git-fixes).
• wifi: mt76: report data NSS for STBC frames in RX rate decode (git-fixes).
• wifi: mwifiex: Detach sync cmd buffer on interrupted wait (git-fixes).
• wifi: rtl818x: initialize eeprom_93cx6 struct to zero (git-fixes).
• wifi: rtlwifi: pci: fix error path in rtl_pci_probe() (git-fixes).
• wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() (git-fixes).
• wifi: rtw89: fix HE extended capability length check (git-fixes).
• wifi: zd1211rw: reject secondary interfaces to prevent conflicts (git-fixes).
• x86/bugs: Clarify that syscall hardening isn't a BHI mitigation (git-fixes).
• x86/cpu: Add CPU model number for Bartlett Lake CPUs with Raptor Cove cores (bsc#1240957 bsc#1249104 bsc#1265220).
• xhci: dbgtty: Fix unregister on tty_alloc_driver() failure (git-fixes).
• xhci: dbgtty: Fix unregister on tty_register_driver() failure (git-fixes).