6.6.143-rc1 review

Greg Kroah-Hartman amd-gfx dri-devel linux-fbdev linux-kbuild linux-patches lkml nouveau stable 1 version Jun 16 In review

Get series with b4

b4 am [email protected]

Versions newest first

v1 Latest Jun 16452 patches 18 repliesIn review

Patches in v1 No applies recorded yet

#	Subject and files	Size	Replies
1/452	Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size`drivers/input/touchscreen/usbtouchscreen.c`	+5 -0	0 replies
2/452	net/sched: cls_fw: fix NULL dereference of "old" filters before change()`net/sched/cls_fw.c`	+5 -1	0 replies
3/452	net: mctp: ensure our nlmsg responses are initialised`net/mctp/device.c` `net/mctp/neigh.c` `net/mctp/route.c`	+3 -0	0 replies
4/452	net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked`net/sched/sch_sfb.c`	+1 -1	0 replies
5/452	drm: Remove plane hsub/vsub alignment requirement for core helpers`include/drm/drm_fourcc.h`	+3 -2	0 replies
6/452	bcache: fix uninitialized closure object`drivers/md/bcache/super.c`	+2 -1	0 replies
7/452	net: cpsw_new: Fix potential unregister of netdev that has not been registered yet`drivers/net/ethernet/ti/cpsw_new.c`	+2 -2	0 replies
8/452	nfc: llcp: Fix use-after-free in llcp_sock_release()`net/nfc/llcp_sock.c`	+2 -0	0 replies
9/452	nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()`net/nfc/llcp_core.c`	+11 -0	0 replies
10/452	xfrm: Check for underflow in xfrm_state_mtu`net/xfrm/xfrm_state.c`	+16 -3	0 replies
11/452	nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems`drivers/nfc/nxp-nci/i2c.c`	+20 -1	0 replies
12/452	netfilter: synproxy: refresh tcphdr after skb_ensure_writable`net/netfilter/nf_synproxy_core.c`	+2 -0	0 replies
13/452	netfilter: xt_cpu: prefer raw_smp_processor_id`net/netfilter/xt_cpu.c`	+1 -1	0 replies
14/452	netfilter: ebtables: fix OOB read in compat_mtw_from_user`net/bridge/netfilter/ebtables.c`	+30 -0	0 replies
15/452	netfilter: bitwise: rename some boolean operation functions`include/uapi/linux/netfilter/nf_tables.h` `net/netfilter/nft_bitwise.c`	+24 ~~-20~~	0 replies
16/452	netfilter: bitwise: add support for doing AND, OR and XOR directly`include/uapi/linux/netfilter/nf_tables.h` `net/netfilter/nft_bitwise.c`	+131 ~~-11~~	0 replies
17/452	netfilter: nf_tables: fix dst corruption in same register operation`include/net/netfilter/nf_tables.h` `net/netfilter/nft_bitwise.c` `net/netfilter/nft_byteorder.c`	+31 -7	0 replies
18/452	tun: free page on short-frame rejection in tun_xdp_one()`drivers/net/tun.c`	+3 -1	0 replies
19/452	tun: free page on build_skb failure in tun_xdp_one()`drivers/net/tun.c`	+1 -0	0 replies
20/452	vsock: keep poll shutdown state consistent`net/vmw_vsock/af_vsock.c` `net/vmw_vsock/hyperv_transport.c` `net/vmw_vsock/virtio_transport_common.c` +1 more	+52 ~~-28~~	0 replies
21/452	net: netlink: fix sending unassigned nsid after assigned one`net/netlink/af_netlink.c`	+1 -0	0 replies
22/452	net: netlink: dont set nsid on local notifications`net/netlink/af_netlink.c`	+7 -3	0 replies
23/452	net/smc: Do not re-initialize smc hashtables`net/smc/af_smc.c`	+2 -2	0 replies
24/452	net/iucv: fix locking in .getsockopt`net/iucv/af_iucv.c`	+14 -6	0 replies
25/452	scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues`drivers/scsi/scsi_lib.c`	+25 -2	0 replies
26/452	ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()`net/ipv4/sysctl_net_ipv4.c`	+1 -1	0 replies
27/452	ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors`sound/soc/intel/boards/bytcht_es8316.c`	+27 -2	0 replies
28/452	net: hsr: fix potential OOB access in supervision frame handling`net/hsr/hsr_forward.c`	+2 -2	0 replies
29/452	gpio: mxc: fix irq_high handling`drivers/gpio/gpio-mxc.c`	+1 -1	0 replies
30/452	tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()`net/ipv4/ip_tunnel_core.c`	+4 -5	0 replies
31/452	vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()`drivers/net/vxlan/vxlan_core.c`	+2 -2	0 replies
32/452	tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()`net/ipv4/ip_tunnel_core.c`	+10 -3	0 replies
33/452	ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE`fs/smb/server/smb2pdu.c`	+11 -0	0 replies
34/452	ASoC: codecs: simple-mux: Fix enum control bounds check`sound/soc/codecs/simple-mux.c`	+1 -1	0 replies
35/452	Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()`net/bluetooth/6lowpan.c`	+2 -0	0 replies
36/452	bonding: refuse to enslave CAN devices`drivers/net/bonding/bond_main.c`	+6 -0	0 replies
37/452	ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback`net/ethtool/eeprom.c`	+2 -3	0 replies
38/452	ethtool: eeprom: add more safeties to EEPROM Netlink fallback`net/ethtool/eeprom.c`	+4 -1	0 replies
39/452	ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()`net/ipv6/exthdrs.c`	+1 -1	0 replies
40/452	net/sched: Revert "net/sched: Restrict conditions for adding duplicating netems to qdisc tree"`net/sched/sch_netem.c`	+0 ~~-40~~	0 replies
41/452	Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success`net/bluetooth/l2cap_core.c`	+8 -2	0 replies
42/452	Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp`net/bluetooth/l2cap_core.c`	+22 -5	0 replies
43/452	gpio: rockchip: convert bank->clk to devm_clk_get_enabled()`drivers/gpio/gpio-rockchip.c`	+1 -5	0 replies
44/452	net: mana: Add NULL guards in teardown path to prevent panic on attach failure`drivers/net/ethernet/microsoft/mana/mana_en.c`	+41 ~~-29~~	0 replies
45/452	sctp: fix race between sctp_wait_for_connect and peeloff`net/sctp/socket.c`	+2 -0	0 replies
46/452	ipv6: fix possible infinite loop in rt6_fill_node()`net/ipv6/route.c`	+2 -0	0 replies
47/452	ipv6: fix possible infinite loop in fib6_select_path()`net/ipv6/route.c`	+3 -0	0 replies
48/452	net: skbuff: fix pskb_carve leaking zcopy pages`net/core/skbuff.c`	+10 -0	0 replies
49/452	perf: Fix dangling cgroup pointer in cpuctx`kernel/events/core.c`	+4 ~~-12~~	14 replies
50/452	batman-adv: v: stop OGMv2 on disabled interface`net/batman-adv/bat_v_ogm.c`	+21 ~~-12~~	0 replies
51/452	batman-adv: tvlv: abort OGM send on tvlv append failure`net/batman-adv/bat_iv_ogm.c` `net/batman-adv/bat_v_ogm.c` `net/batman-adv/tvlv.c` +1 more	+40 ~~-21~~	0 replies
52/452	batman-adv: tt: reject oversized local TVLV buffers`net/batman-adv/translation-table.c`	+5 -3	0 replies
53/452	batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface`net/batman-adv/bridge_loop_avoidance.c`	+4 -2	0 replies
54/452	batman-adv: tvlv: reject oversized TVLV packets`net/batman-adv/tvlv.c`	+8 -3	0 replies
55/452	batman-adv: iv: recover OGM scheduling after forward packet error`net/batman-adv/bat_iv_ogm.c` `net/batman-adv/types.h`	+60 ~~-19~~	0 replies
56/452	batman-adv: tp_meter: avoid role confusion in tp_list`net/batman-adv/tp_meter.c`	+36 ~~-23~~	0 replies
57/452	net: af_key: zero aligned sockaddr tail in PF_KEY exports`net/key/af_key.c`	+34 ~~-18~~	0 replies
58/452	batman-adv: tp_meter: directly shut down timer on cleanup`net/batman-adv/tp_meter.c`	+1 -7	0 replies
59/452	batman-adv: tt: fix TOCTOU race for reported vlans`net/batman-adv/translation-table.c`	+10 -4	0 replies
60/452	batman-adv: tt: avoid empty VLAN responses`net/batman-adv/translation-table.c`	+18 -3	0 replies
61/452	batman-adv: bla: avoid double decrement of bla.num_requests`net/batman-adv/bridge_loop_avoidance.c` `net/batman-adv/soft-interface.c` `net/batman-adv/types.h`	+67 ~~-24~~	0 replies
62/452	mm/page_alloc: clear page->private in free_pages_prepare()`mm/page_alloc.c`	+1 -0	0 replies
63/452	media: rc: fix race between unregister and urb/irq callbacks`drivers/gpu/drm/bridge/sil-sii8620.c` `drivers/hid/hid-picolcd_cir.c` `drivers/media/cec/core/cec-core.c` +38 more	+58 ~~-36~~	0 replies
64/452	media: rc: ttusbir: fix inverted error logic`drivers/media/rc/ttusbir.c`	+1 -1	0 replies
65/452	drm/fbdev-helper: Set and clear VGA switcheroo client from fb_info`drivers/gpu/drm/drm_fb_helper.c`	+12 -6	0 replies
66/452	drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup`drivers/gpu/drm/drm_fb_helper.c` `drivers/video/fbdev/core/fbcon.c`	+9 ~~-14~~	0 replies
67/452	inet: frags: add inet_frag_queue_flush()`include/net/inet_frag.h` `net/ipv4/inet_fragment.c` `net/ipv4/ip_fragment.c`	+15 ~~-11~~	0 replies
68/452	inet: frags: flush pending skbs in fqdir_pre_exit()`include/net/inet_frag.h` `include/net/ipv6_frag.h` `net/ipv4/inet_fragment.c` +1 more	+50 ~~-20~~	0 replies
69/452	drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register`drivers/gpu/drm/i915/display/intel_dpcd.h`	+15 -0	0 replies
70/452	drm/i915/psr: Read Intel DPCD workaround register`drivers/gpu/drm/i915/display/intel_display_types.h` `drivers/gpu/drm/i915/display/intel_psr.c`	+8 -0	0 replies
71/452	drm/dp: Add eDP 1.5 bit definition`include/drm/display/drm_dp.h`	+1 -0	0 replies
72/452	drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used`drivers/gpu/drm/i915/display/intel_psr.c`	+26 -1	0 replies
73/452	arm64: io: Rename ioremap_prot() to __ioremap_prot()`arch/arm64/include/asm/io.h` `arch/arm64/kernel/acpi.c` `arch/arm64/mm/ioremap.c`	+10 -8	0 replies
74/452	arm64: io: Extract user memory type in ioremap_prot()`arch/arm64/include/asm/io.h`	+15 -2	0 replies
75/452	phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X`drivers/net/phy/mscc/mscc.h` `drivers/net/phy/mscc/mscc_main.c`	+8 ~~-23~~	0 replies
76/452	ima: verify the previous kernels IMA buffer lies in addressable RAM`include/linux/ima.h` `security/integrity/ima/ima_kexec.c`	+36 -0	0 replies
77/452	of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range()`drivers/of/kexec.c`	+3 ~~-12~~	0 replies
78/452	x86/kexec: add a sanity check on previous kernels ima kexec buffer`arch/x86/kernel/setup.c`	+6 -0	0 replies
79/452	hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock`drivers/hwmon/pmbus/adm1266.c`	+34 -6	0 replies
80/452	hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock`drivers/hwmon/pmbus/adm1266.c`	+7 -0	0 replies
81/452	soc/tegra: pmc: Fix unsafe generic_handle_irq() call`drivers/soc/tegra/pmc.c`	+74 ~~-30~~	0 replies
82/452	iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer`drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c`	+1 -1	0 replies
83/452	usb: typec: ucsi: ccg: reject firmware images without a : record header`drivers/usb/typec/ucsi/ucsi_ccg.c`	+5 -0	0 replies
84/452	usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO`drivers/usb/typec/ucsi/displayport.c`	+4 -0	0 replies
85/452	usb: typec: altmodes/displayport: validate count before reading Status Update VDO`drivers/usb/typec/altmodes/displayport.c`	+2 -0	0 replies
86/452	usb: typec: wcove: dont write past struct pd_message in wcove_read_rx_buffer()`drivers/usb/typec/tcpm/wcove.c`	+8 -5	0 replies
87/452	usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT`drivers/usb/typec/tcpm/tcpci_maxim_core.c`	+9 -0	0 replies
88/452	usb: typec: ucsi: validate connector number in ucsi_connector_change()`drivers/usb/typec/ucsi/ucsi.c`	+10 -1	0 replies
89/452	USB: serial: safe_serial: fix memory corruption with small endpoint`drivers/usb/serial/safe_serial.c`	+11 -0	0 replies
90/452	media: rc: igorplugusb: fix control request setup packet`drivers/media/rc/igorplugusb.c`	+1 -1	0 replies
91/452	Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free()`drivers/input/misc/ims-pcu.c`	+1 -1	0 replies
92/452	HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse`drivers/hid/hid-ids.h` `drivers/hid/hid-quirks.c`	+2 -0	0 replies
93/452	Bluetooth: btusb: Allow firmware re-download when version matches`drivers/bluetooth/btusb.c`	+7 -1	0 replies
94/452	hpfs: fix a crash if hpfs_map_dnode_bitmap fails`fs/hpfs/alloc.c`	+1 -1	0 replies
95/452	ipc: limit next_id allocation to the valid ID range`ipc/util.c`	+1 -1	0 replies
96/452	auxdisplay: line-display: fix OOB read on zero-length message_store()`drivers/auxdisplay/line-display.c`	+1 -1	0 replies
97/452	Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()`net/bluetooth/l2cap_sock.c`	+9 -7	0 replies
98/452	Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn`net/bluetooth/l2cap_core.c`	+3 -1	0 replies
99/452	Bluetooth: HIDP: fix missing length checks in hidp_input_report()`net/bluetooth/hidp/core.c`	+18 -5	0 replies
100/452	Bluetooth: ISO: fix UAF in iso_recv_frame`net/bluetooth/iso.c`	+7 -3	0 replies
101/452	Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock`net/bluetooth/iso.c`	+1 -1	0 replies
102/452	Input: xpad - fix out-of-bounds access for Share button`drivers/input/joystick/xpad.c`	+4 -4	0 replies
103/452	parport: Fix race between port and client registration`drivers/parport/share.c` `include/linux/parport.h`	+10 -2	0 replies
104/452	USB: cdc-acm: Fix bit overlap and move quirk definitions to header`drivers/usb/class/cdc-acm.c` `drivers/usb/class/cdc-acm.h`	+2 -2	0 replies
105/452	KVM: arm64: PMU: Preserve AArch32 counter low bits`arch/arm64/kvm/pmu-emul.c`	+2 -2	0 replies
106/452	KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC`arch/x86/kvm/svm/avic.c`	+29 -6	0 replies
107/452	wireguard: send: append trailer after expanding head`drivers/net/wireguard/send.c`	+10 ~~-10~~	0 replies
108/452	iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux`drivers/iio/adc/xilinx-xadc-core.c`	+9 -2	0 replies
109/452	iio: dac: max5821: fix return value check in powerdown sync`drivers/iio/dac/max5821.c`	+8 -1	0 replies
110/452	iio: dac: ad5686: fix input raw value check`drivers/iio/dac/ad5686.c`	+1 -1	0 replies
111/452	iio: dac: ad5686: acquire lock when doing powerdown control`drivers/iio/dac/ad5686.c`	+8 -0	0 replies
112/452	iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw`drivers/iio/adc/viperboard_adc.c`	+3 -1	0 replies
113/452	iio: gyro: itg3200: fix i2c read into the wrong stack location`drivers/iio/gyro/itg3200_buffer.c`	+1 -1	0 replies
114/452	iio: ssp_sensors: cancel delayed work_refresh on remove`drivers/iio/common/ssp_sensors/ssp_dev.c`	+1 -0	0 replies
115/452	iio: temperature: tsys01: fix broken PROM checksum validation`drivers/iio/temperature/tsys01.c`	+1 -1	0 replies
116/452	iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL`drivers/iio/magnetometer/st_magn_core.c`	+11 -2	0 replies
117/452	iio: light: cm3323: fix reg_conf not being initialized correctly`drivers/iio/light/cm3323.c`	+2 -3	0 replies
118/452	iio: buffer: hw-consumer: fix use-after-free in error path`drivers/iio/buffer/industrialio-hw-consumer.c`	+2 -2	0 replies
119/452	USB: serial: omninet: fix memory corruption with small endpoint`drivers/usb/serial/omninet.c`	+5 -4	0 replies
120/452	usb: cdns3: gadget: fix request skipping after clearing halt`drivers/usb/cdns3/cdns3-gadget.c`	+11 -1	0 replies
121/452	usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles`drivers/usb/cdns3/cdns3-plat.c`	+3 -0	0 replies
122/452	usb: dwc2: Fix use after free in debug code`drivers/usb/dwc2/hcd.c`	+3 -1	0 replies
123/452	Input: elan_i2c - validate firmware size before use`drivers/input/mouse/elan_i2c_core.c`	+5 -0	0 replies
124/452	bpf: sockmap: fix tail fragment offset in bpf_msg_push_data`net/core/filter.c`	+1 -1	0 replies
125/452	macsec: fix replay protection at XPN lower-PN wrap`drivers/net/macsec.c`	+2 -1	0 replies
126/452	ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()`net/ipv6/exthdrs.c`	+2 -0	0 replies
127/452	ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params`sound/soc/qcom/qdsp6/q6asm-dai.c`	+16 -8	0 replies
128/452	ipv6: exthdrs: refresh nh after handling HAO option`net/ipv6/exthdrs.c`	+2 -0	0 replies
129/452	ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().`net/ipv6/ip6_vti.c`	+9 -2	0 replies
130/452	ipv6: validate extension header length before copying to cmsg`net/ipv6/datagram.c`	+46 -8	0 replies
131/452	xfrm: input: hold netns during deferred transport reinjection`net/xfrm/xfrm_input.c`	+12 -4	0 replies
132/452	ip6: vti: Use ip6_tnl.net in vti6_changelink().`net/ipv6/ip6_vti.c`	+7 -5	0 replies
133/452	HID: wacom: Fix OOB write in wacom_hid_set_device_mode()`drivers/hid/wacom_sys.c` `drivers/hid/wacom_wac.h`	+11 -3	0 replies
134/452	iommu, debugobjects: avoid gcc-16.1 section mismatch warnings`drivers/iommu/io-pgtable-arm-v7s.c` `include/linux/compiler_attributes.h` `lib/debugobjects.c`	+24 -7	0 replies
135/452	nfc: hci: fix out-of-bounds read in HCP header parsing`net/nfc/hci/core.c` `net/nfc/nci/hci.c`	+20 -0	0 replies
136/452	xfrm: route MIGRATE notifications to callers netns`include/net/xfrm.h` `net/key/af_key.c` `net/xfrm/xfrm_policy.c` +2 more	+10 ~~-10~~	0 replies
137/452	xfrm: ah: use skb_to_full_sk in async output callbacks`net/ipv4/ah4.c` `net/ipv6/ah6.c`	+2 -2	0 replies
138/452	netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check`net/netfilter/nf_conntrack_proto_tcp.c`	+2 -1	0 replies
139/452	ASoC: qcom: q6asm-dai: close stream only when running`sound/soc/qcom/qdsp6/q6asm-dai.c`	+7 -7	0 replies
140/452	ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks`sound/soc/qcom/qdsp6/q6asm-dai.c`	+0 -5	0 replies
141/452	xfrm: esp: restore combined single-frag length gate`net/ipv4/esp4.c` `net/ipv6/esp6.c`	+4 -4	0 replies
142/452	Input: xpad - add "Nova 2 Lite" from GameSir`drivers/input/joystick/xpad.c`	+1 -0	0 replies
143/452	Input: xpad - add support for ASUS ROG RAIKIRI II`drivers/input/joystick/xpad.c`	+5 -0	0 replies
144/452	ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops`fs/smb/server/smbacl.c`	+4 -4	0 replies
145/452	Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem`drivers/input/touchscreen/atmel_mxt_ts.c`	+1 -1	0 replies
146/452	Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490`drivers/input/mouse/synaptics.c`	+1 -0	0 replies
147/452	comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest()`drivers/comedi/drivers/comedi_test.c`	+1 -0	0 replies
148/452	comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest()`drivers/comedi/drivers/comedi_test.c`	+2 -2	0 replies
149/452	counter: Fix refcount leak in counter_alloc() error path`drivers/counter/counter-core.c`	+2 -1	0 replies
150/452	tty: serial: pch_uart: add check for dma_alloc_coherent()`drivers/tty/serial/pch_uart.c`	+13 -6	0 replies
151/452	usb: chipidea: core: convert ci_role_switch to local variable`drivers/usb/chipidea/core.c`	+6 ~~-10~~	0 replies
152/452	usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval`drivers/usb/core/config.c`	+8 -1	0 replies
153/452	USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers`drivers/usb/core/quirks.c`	+4 -0	0 replies
154/452	usb: storage: Add quirks for PNY Elite Portable SSD`drivers/usb/storage/unusual_uas.h`	+7 -0	0 replies
155/452	usbip: vudc: Fix use after free bug in vudc_remove due to race condition`drivers/usb/usbip/vudc_dev.c` `drivers/usb/usbip/vudc_transfer.c`	+3 -1	0 replies
156/452	usb: usbtmc: check URB actual_length for interrupt-IN notifications`drivers/usb/class/usbtmc.c`	+8 -0	0 replies
157/452	usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize`drivers/usb/class/usbtmc.c`	+6 -0	0 replies
158/452	USB: serial: option: add MeiG SRM813Q`drivers/usb/serial/option.c`	+6 -0	0 replies
159/452	USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL`drivers/usb/serial/option.c`	+2 -1	0 replies
160/452	USB: serial: belkin_sa: validate interrupt status length`drivers/usb/serial/belkin_sa.c`	+3 -0	0 replies
161/452	USB: serial: cypress_m8: validate interrupt packet headers`drivers/usb/serial/cypress_m8.c`	+11 -1	0 replies
162/452	USB: serial: keyspan: fix missing indat transfer sanity check`drivers/usb/serial/keyspan.c`	+4 -0	0 replies
163/452	USB: serial: mxuport: fix memory corruption with small endpoint`drivers/usb/serial/mxuport.c`	+8 -0	0 replies
164/452	USB: serial: mct_u232: fix missing interrupt-in transfer sanity check`drivers/usb/serial/mct_u232.c`	+5 -0	0 replies
165/452	usb: gadget: net2280: Fix double free in probe error path`drivers/usb/gadget/udc/net2280.c`	+1 -3	0 replies
166/452	usb: gadget: f_hid: fix device reference leak in hidg_alloc()`drivers/usb/gadget/function/f_hid.c`	+1 -2	0 replies
167/452	usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling`drivers/usb/gadget/composite.c`	+4 -1	0 replies
168/452	usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports`drivers/usb/gadget/udc/dummy_hcd.c`	+4 -0	0 replies
169/452	usb: gadget: f_fs: copy only received bytes on short ep0 read`drivers/usb/gadget/function/f_fs.c`	+1 -1	0 replies
170/452	thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()`drivers/thunderbolt/property.c`	+5 -1	0 replies
171/452	thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow`drivers/thunderbolt/property.c`	+6 -2	0 replies
172/452	scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker`drivers/scsi/fcoe/fcoe_ctlr.c`	+1 -1	0 replies
173/452	scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32`drivers/scsi/scsi_transport_fc.c`	+41 ~~-36~~	0 replies
174/452	scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf`drivers/target/iscsi/iscsi_target_nego.c` `drivers/target/iscsi/iscsi_target_parameters.c` `drivers/target/iscsi/iscsi_target_parameters.h`	+55 ~~-16~~	0 replies
175/452	scsi: target: iscsi: Validate CHAP_R length before base64 decode`drivers/target/iscsi/iscsi_target_auth.c`	+18 -1	0 replies
176/452	drm/hyperv: validate resolution_count and fix WIN8 fallback`drivers/gpu/drm/hyperv/hyperv_drm_proto.c`	+10 -3	0 replies
177/452	drm/hyperv: validate VMBus packet size in receive callback`drivers/gpu/drm/hyperv/hyperv_drm_proto.c`	+87 ~~-13~~	0 replies
178/452	drm/i915: Fix potential UAF in TTM object purge`drivers/gpu/drm/i915/gem/i915_gem_ttm.c`	+16 ~~-12~~	0 replies
179/452	drm/amd/pm/si: Disregard vblank time when no displays are connected`drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c`	+4 -0	0 replies
180/452	serial: altera_jtaguart: handle uart_add_one_port() failures`drivers/tty/serial/altera_jtaguart.c`	+6 -1	0 replies
181/452	serial: qcom-geni: fix UART_RX_PAR_EN bit position`drivers/tty/serial/qcom_geni_serial.c`	+1 -1	0 replies
182/452	serial: sh-sci: fix memory region release in error path`drivers/tty/serial/sh-sci.c`	+1 -1	0 replies
183/452	serial: zs: Fix swapped RI/DSR modem line transition counting`drivers/tty/serial/zs.c`	+2 -2	0 replies
184/452	serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma`drivers/tty/serial/fsl_lpuart.c`	+12 -3	0 replies
185/452	drm/amdkfd: fix NULL pointer bug in svm_range_set_attr`drivers/gpu/drm/amd/amdkfd/kfd_svm.c`	+3 -0	0 replies
186/452	drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger`drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c`	+5 -3	0 replies
187/452	drm/amdkfd: Check for pdd drm file first in CRIU restore path`drivers/gpu/drm/amd/amdkfd/kfd_chardev.c`	+5 -5	0 replies
188/452	serial: dz: Fix bootconsole message clobbering at chip reset`drivers/tty/serial/dz.c`	+21 -0	0 replies
189/452	serial: zs: Fix bootconsole handover lockup`drivers/tty/serial/zs.c`	+8 ~~-21~~	0 replies
190/452	serial: zs: Switch to using channel reset`drivers/tty/serial/zs.c` `drivers/tty/serial/zs.h`	+5 -4	0 replies
191/452	USB: serial: cypress_m8: fix memory corruption with small endpoint`drivers/usb/serial/cypress_m8.c`	+8 -0	0 replies
192/452	Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync`net/bluetooth/hci_sync.c`	+3 -1	0 replies
193/452	x86/kexec: Disable KCOV instrumentation after load_segments()`arch/x86/kernel/Makefile` `arch/x86/mm/Makefile`	+16 -0	0 replies
194/452	landlock: Fix handling of disconnected directories`security/landlock/errata/abi-1.h` `security/landlock/fs.c`	+45 ~~-11~~	2 replies
195/452	USB: serial: digi_acceleport: fix memory corruption with small endpoints`drivers/usb/serial/digi_acceleport.c`	+21 -2	0 replies
196/452	xhci: tegra: Fix ghost USB device on dual-role port unplug`drivers/usb/host/xhci-tegra.c`	+45 ~~-34~~	0 replies
197/452	serial: dz: Fix bootconsole handover lockup`drivers/tty/serial/dz.c`	+12 ~~-24~~	0 replies
198/452	serial: dz: Convert to use a platform device`arch/mips/dec/platform.c` `drivers/tty/serial/dz.c`	+110 ~~-61~~	0 replies
199/452	serial: zs: Convert to use a platform device`arch/mips/dec/platform.c` `drivers/tty/serial/zs.c` `drivers/tty/serial/zs.h`	+129 ~~-124~~	0 replies
200/452	HID: core: Add printk_ratelimited variants to hid_warn() etc`include/linux/hid.h`	+11 -0	0 replies
201/452	HID: pass the buffer size to hid_report_raw_event`drivers/hid/bpf/hid_bpf_dispatch.c` `drivers/hid/hid-core.c` `drivers/hid/hid-gfrm.c` +8 more	+41 ~~-25~~	0 replies
202/452	HID: core: Fix size_t specifier in hid_report_raw_event()`drivers/hid/hid-core.c`	+2 -2	0 replies
203/452	usb: core: Fix SuperSpeed root hub wMaxPacketSize`drivers/usb/core/hcd.c`	+1 -3	0 replies
204/452	bpf: Free reuseport cBPF prog after RCU grace period.`net/core/filter.c`	+12 -3	0 replies
205/452	USB: serial: mct_u232: fix memory corruption with small endpoint`drivers/usb/serial/mct_u232.c`	+11 ~~-10~~	0 replies
206/452	Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync`net/bluetooth/hci_conn.c`	+7 -1	0 replies
207/452	RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug`drivers/infiniband/sw/rxe/rxe_qp.c`	+6 -1	0 replies
208/452	hwmon: (pmbus/core) Protect regulator operations with mutex`drivers/hwmon/pmbus/pmbus_core.c`	+91 ~~-26~~	0 replies
209/452	Disable -Wattribute-alias for clang-23 and newer`include/linux/compat.h` `include/linux/compiler-clang.h` `include/linux/compiler_types.h` +1 more	+18 -0	0 replies
210/452	i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl`drivers/i2c/i2c-dev.c`	+5 -4	0 replies
211/452	ipv6: mcast: Fix use-after-free when processing MLD queries`net/ipv6/mcast.c`	+4 -4	0 replies
212/452	net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS`net/smc/af_smc.c`	+8 -9	0 replies
213/452	tee: optee: prevent use-after-free when the client exits before the supplicant`drivers/tee/optee/supp.c`	+74 ~~-33~~	0 replies
214/452	ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers`fs/smb/server/oplock.c`	+12 -3	0 replies
215/452	netfilter: xt_NFQUEUE: prefer raw_smp_processor_id`net/netfilter/xt_NFQUEUE.c`	+1 -1	0 replies
216/452	ipvs: clear the svc scheduler ptr early on edit`include/net/ip_vs.h` `net/netfilter/ipvs/ip_vs_ctl.c` `net/netfilter/ipvs/ip_vs_sched.c`	+16 ~~-14~~	0 replies
217/452	netfilter: synproxy: add mutex to guard hook reference counting`net/netfilter/nf_synproxy_core.c`	+18 -6	0 replies
218/452	netfilter: conntrack_irc: fix possible out-of-bounds read`net/netfilter/nf_conntrack_irc.c`	+2 -2	0 replies
219/452	netfilter: nft_ct: bail out on template ct in get eval`net/netfilter/nft_ct.c` `net/netfilter/nft_ct_fast.c`	+4 -6	0 replies
220/452	netfilter: bridge: make ebt_snat ARP rewrite writable`net/bridge/netfilter/ebt_snat.c`	+3 -0	0 replies
221/452	dm cache policy smq: check allocation under invalidate lock`drivers/md/dm-cache-policy-smq.c`	+8 -4	0 replies
222/452	net/sched: act_api: use RCU with deferred freeing for action lifecycle`include/net/act_api.h` `net/sched/act_api.c`	+2 -6	0 replies
223/452	6lowpan: fix off-by-one in multicast context address compression`net/6lowpan/iphc.c`	+2 -2	0 replies
224/452	drm/imx: Fix three kernel-doc warnings in dcss-scaler.c`drivers/gpu/drm/imx/dcss/dcss-scaler.c`	+3 -0	0 replies
225/452	pcnet32: stop holding device spin lock during napi_complete_done`drivers/net/ethernet/amd/pcnet32.c`	+3 -1	0 replies
226/452	net: Annotate sk->sk_write_space() for UDP SOCKMAP.`net/core/sock.c`	+6 -2	0 replies
227/452	hsr: Remove WARN_ONCE() in hsr_addr_is_self().`net/hsr/hsr_framereg.c`	+1 -3	0 replies
228/452	net: garp: fix unsigned integer underflow in garp_pdu_parse_attr`net/802/garp.c`	+1 -1	0 replies
229/452	net: lan743x: permit VLAN-tagged packets up to configured MTU`drivers/net/ethernet/microchip/lan743x_main.c` `drivers/net/ethernet/microchip/lan743x_main.h`	+33 -0	0 replies
230/452	net: fec: fix pinctrl default state restore order on resume`drivers/net/ethernet/freescale/fec_main.c`	+1 -2	0 replies
231/452	Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()`net/bluetooth/rfcomm/sock.c`	+22 -4	0 replies
232/452	Bluetooth: MGMT: validate advertising TLV before type checks`net/bluetooth/mgmt.c`	+6 -6	0 replies
233/452	Bluetooth: RFCOMM: validate skb length in MCC handlers`net/bluetooth/rfcomm/core.c`	+49 ~~-18~~	0 replies
234/452	Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling`net/bluetooth/bnep/core.c`	+10 -3	0 replies
235/452	Bluetooth: bnep: reject short frames before parsing`net/bluetooth/bnep/core.c`	+36 ~~-21~~	0 replies
236/452	Bluetooth: fix memory leak in error path of hci_alloc_dev()`net/bluetooth/hci_sysfs.c`	+4 -2	0 replies
237/452	Bluetooth: MGMT: Fix backward compatibility with userspace`net/bluetooth/mgmt.c`	+3 -2	0 replies
238/452	ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options`net/ipv4/ip_options.c`	+4 -0	0 replies
239/452	ptp: vclock: Switch from RCU to SRCU`drivers/ptp/ptp_vclock.c`	+9 -5	0 replies
240/452	net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown`drivers/net/ethernet/mediatek/mtk_eth_soc.c`	+1 -1	0 replies
241/452	octeontx2-af: npc: Fix CPT channel mask in npc_install_flow`drivers/net/ethernet/marvell/octeontx2/af/rvu.h` `drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c` `drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c`	+18 ~~-17~~	0 replies
242/452	vxlan: vnifilter: send notification on VNI add`drivers/net/vxlan/vxlan_vnifilter.c`	+1 -2	0 replies
243/452	vxlan: vnifilter: fix spurious notification on VNI update`drivers/net/vxlan/vxlan_vnifilter.c`	+1 -1	0 replies
244/452	ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()`net/ieee802154/6lowpan/tx.c`	+5 -0	0 replies
245/452	net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr`net/802/mrp.c`	+9 -0	0 replies
246/452	sctp: purge outqueue on stale COOKIE-ECHO handling`net/sctp/sm_statefuns.c`	+1 -5	0 replies
247/452	ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp`drivers/char/ipmi/ipmi_msghandler.c`	+1 -1	0 replies
248/452	signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()`kernel/signal.c`	+1 -0	0 replies
249/452	time: Fix off-by-one in settimeofday() usec validation`kernel/time/time.c`	+1 -1	0 replies
250/452	ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams`sound/core/pcm_native.c`	+3 -4	0 replies
251/452	usb: gadget: f_ncm: Fix net_device lifecycle with device_move`drivers/usb/gadget/function/f_ncm.c` `drivers/usb/gadget/function/u_ether.c` `drivers/usb/gadget/function/u_ether.h` +1 more	+73 ~~-12~~	0 replies
252/452	usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo`drivers/usb/gadget/function/u_ether.c`	+4 -2	0 replies
253/452	tools/rv: Fix cleanup after failed trace setup`tools/verification/rv/src/in_kernel.c`	+1 -1	0 replies
254/452	net: skbuff: fix missing zerocopy reference in pskb_carve helpers`net/core/skbuff.c`	+4 -0	0 replies
255/452	tap: free page on error paths in tap_get_user_xdp()`drivers/net/tap.c`	+2 -0	0 replies
256/452	KVM: arm64: Remove VPIPT I-cache handling`arch/arm64/include/asm/kvm_mmu.h` `arch/arm64/kvm/hyp/nvhe/pkvm.c` `arch/arm64/kvm/hyp/nvhe/tlb.c` +1 more	+3 ~~-78~~	0 replies
257/452	arm64: tlb: Allow XZR argument to TLBI ops`arch/arm64/include/asm/tlbflush.h`	+3 -3	0 replies
258/452	arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI`arch/arm64/include/asm/tlbflush.h` `arch/arm64/kernel/sys_compat.c` `arch/arm64/kvm/hyp/nvhe/mm.c` +3 more	+46 ~~-36~~	0 replies
259/452	iomap: dont revert iov_iter on partially completed buffered writes`fs/iomap/buffered-io.c`	+0 -4	0 replies
260/452	xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()`net/xfrm/xfrm_policy.c`	+2 ~~-11~~	0 replies
261/452	netlabel: validate unlabeled address and mask attribute lengths`net/netlabel/netlabel_unlabeled.c`	+10 ~~-20~~	0 replies
262/452	gpio: mvebu: fix NULL pointer dereference in suspend/resume`drivers/gpio/gpio-mvebu.c`	+2 -2	0 replies
263/452	ASoC: wm_adsp: Fix NULL dereference when removing firmware controls`sound/soc/codecs/wm_adsp.c`	+3 -0	0 replies
264/452	tcp: restrict SO_ATTACH_FILTER to priv users`net/core/sock.c`	+5 -0	0 replies
265/452	net/mlx4: avoid GCC 10 __bad_copy_from() false positive`drivers/net/ethernet/mellanox/mlx4/cq.c`	+8 -1	0 replies
266/452	net: phy: clean the sfp upstream if phy probing fails`drivers/net/phy/phy_device.c`	+6 -0	0 replies
267/452	net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove`net/qrtr/af_qrtr.c`	+2 -2	0 replies
268/452	net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list`drivers/net/ethernet/mellanox/mlx5/core/eswitch.c` `drivers/net/ethernet/mellanox/mlx5/core/vport.c` `include/linux/mlx5/vport.h`	+59 ~~-30~~	0 replies
269/452	ipv6: sit: reload inner IPv6 header after GSO offloads`net/ipv6/sit.c`	+1 -0	0 replies
270/452	net: openvswitch: fix possible kfree_skb of ERR_PTR`net/openvswitch/datapath.c`	+1 -0	0 replies
271/452	r8152: handle the return value of usb_reset_device()`drivers/net/usb/r8152.c`	+6 -1	0 replies
272/452	sctp: fix uninit-value in __sctp_rcv_asconf_lookup()`net/sctp/input.c`	+8 -0	0 replies
273/452	net: guard timestamp cmsgs to real error queue skbs`include/net/sock.h` `net/core/skbuff.c` `net/socket.c`	+10 -8	0 replies
274/452	net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion`net/rds/ib_send.c`	+2 -0	0 replies
275/452	ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()`net/ipv6/ip6_vti.c`	+2 -0	0 replies
276/452	rds: mark snapshot pages dirty in rds_info_getsockopt()`net/rds/info.c`	+1 -1	0 replies
277/452	netfilter: nf_conntrack: destroy stale expectfn expectations on unregister`include/net/netfilter/nf_conntrack_helper.h` `net/ipv4/netfilter/nf_nat_h323.c` `net/netfilter/nf_conntrack_helper.c` +2 more	+25 -0	0 replies
278/452	netfilter: x_tables: avoid leaking percpu counter pointers`net/ipv4/netfilter/arp_tables.c` `net/ipv4/netfilter/ip_tables.c` `net/ipv6/netfilter/ip6_tables.c`	+18 ~~-27~~	0 replies
279/452	netfilter: nf_log: validate MAC header was set before dumping it`net/netfilter/nf_log_syslog.c`	+2 -2	0 replies
280/452	netfilter: nft_exthdr: fix register tracking for F_PRESENT flag`net/netfilter/nft_exthdr.c`	+3 -0	0 replies
281/452	net: mvpp2: sync RX data at the hardware packet offset`drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c`	+4 -3	0 replies
282/452	net: mvpp2: limit XDP frame size to the RX buffer`drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c`	+1 -1	0 replies
283/452	net: mvpp2: Add metadata support for xdp mode`drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c`	+6 -2	0 replies
284/452	net: mvpp2: refill RX buffers before XDP or skb use`drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c`	+24 ~~-19~~	0 replies
285/452	net: mvpp2: build skb from XDP-adjusted data on XDP_PASS`drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c`	+15 -6	0 replies
286/452	ipv6: Fix a potential NPD in cleanup_prefix_route()`net/ipv6/addrconf.c`	+4 -2	0 replies
287/452	netfilter: ctnetlink: ensure safe access to master conntrack`include/net/netfilter/nf_conntrack_core.h` `net/netfilter/nf_conntrack_ecache.c` `net/netfilter/nf_conntrack_expect.c` +1 more	+35 ~~-10~~	0 replies
288/452	clk: qcom: dispcc-sc8280xp: Dont park mdp_clk_src at registration time`drivers/clk/qcom/dispcc-sc8280xp.c`	+2 -2	0 replies
289/452	drm/virtio: Fix driver removal with disabled KMS`drivers/gpu/drm/virtio/virtgpu_drv.c`	+4 -1	0 replies
290/452	drm/vc4: fix krealloc() memory leak`drivers/gpu/drm/vc4/vc4_validate_shaders.c`	+7 -6	0 replies
291/452	netfilter: nft_tunnel: fix use-after-free on object destroy`net/netfilter/nft_tunnel.c`	+1 -1	0 replies
292/452	Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend`net/bluetooth/hci_sync.c`	+5 -0	0 replies
293/452	Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig`include/net/bluetooth/l2cap.h` `net/bluetooth/l2cap_core.c`	+47 -0	0 replies
294/452	tracing/probes: Point the error offset correctly for eprobe argument error`kernel/trace/trace_probe.c` `tools/testing/selftests/ftrace/test.d/dynevent/eprobes_syntax_errors.tc`	+1 -3	0 replies
295/452	mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation`drivers/mmc/host/litex_mmc.c`	+3 -3	0 replies
296/452	KVM: Dont WARN if memory is dirtied without a vCPU when the VM is dying`virt/kvm/kvm_main.c`	+2 -1	0 replies
297/452	drm/i915/gem: Fix phys BO pread/pwrite with offset`drivers/gpu/drm/i915/gem/i915_gem_phys.c`	+15 -4	0 replies
298/452	ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL`fs/smb/server/smb2pdu.c`	+11 -0	0 replies
299/452	xfrm: espintcp: do not reuse an in-progress partial send`net/xfrm/espintcp.c`	+4 -0	0 replies
300/452	USB: serial: io_ti: fix heap overflow in get_manuf_info()`drivers/usb/serial/io_ti.c`	+6 -0	0 replies
301/452	USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()`drivers/usb/serial/io_ti.c`	+5 -0	0 replies
302/452	USB: serial: option: add usb-id for Dell Wireless DW5826e-m`drivers/usb/serial/option.c`	+3 -0	0 replies
303/452	USB: serial: kl5kusb105: fix bulk-out buffer overflow`drivers/usb/serial/kl5kusb105.c`	+2 -2	0 replies
304/452	ALSA: timer: Fix UAF at snd_timer_user_params()`sound/core/timer.c`	+1 -0	0 replies
305/452	drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait()`drivers/gpu/drm/virtio/virtgpu_submit.c`	+3 -1	0 replies
306/452	drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info()`drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c`	+4 -2	0 replies
307/452	mm/damon/ops-common: call folio_test_lru() after folio_get()`mm/damon/ops-common.c`	+2 -2	0 replies
308/452	RDMA/srp: bound SRP_RSP sense copy by the received length`drivers/infiniband/ulp/srp/ib_srp.c`	+24 -6	0 replies
309/452	zram: fix use-after-free in zram_bvec_write_partial()`drivers/block/zram/zram_drv.c`	+1 -1	0 replies
310/452	udp: clear skb->dev before running a sockmap verdict`net/ipv4/udp.c`	+8 -0	0 replies
311/452	ARM: socfpga: Fix OF node refcount leak in SMP setup`arch/arm/mach-socfpga/platsmp.c`	+1 -0	0 replies
312/452	ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O`arch/arm/include/asm/io.h`	+13 -2	0 replies
313/452	ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow`arch/arm/kernel/entry-armv.S`	+1 -1	0 replies
314/452	mptcp: fix retransmission loop when csum is enabled`net/mptcp/protocol.c`	+4 -0	0 replies
315/452	mptcp: close TOCTOU race while computing rcv_wnd`net/mptcp/options.c`	+18 ~~-18~~	0 replies
316/452	mptcp: allow subflow rcv wnd to shrink`net/mptcp/options.c`	+7 -0	0 replies
317/452	mptcp: sockopt: check timestamping ret value`net/mptcp/sockopt.c`	+6 -2	0 replies
318/452	selftests: mptcp: add test for extra_subflows underflow on userspace PM`tools/testing/selftests/net/mptcp/mptcp_join.sh`	+4 -0	0 replies
319/452	wifi: nl80211: reject oversized EMA RNR lists`net/wireless/nl80211.c`	+3 -0	0 replies
320/452	vsock/vmci: fix sk_ack_backlog leak on failed handshake`net/vmw_vsock/vmci_transport.c`	+3 -1	0 replies
321/452	ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write`sound/soc/fsl/fsl_sai.c`	+1 -1	0 replies
322/452	bnxt_en: Fix NULL pointer dereference`drivers/net/ethernet/broadcom/bnxt/bnxt.c`	+1 -1	0 replies
323/452	IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN`drivers/infiniband/ulp/isert/ib_isert.c`	+6 -0	0 replies
324/452	inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush`net/ipv4/inet_fragment.c` `net/ipv4/ip_fragment.c`	+3 -3	0 replies
325/452	pidfd: refuse access to tasks that have started exiting harder`kernel/pid.c`	+5 -3	0 replies
326/452	fuse: reject fuse_notify() pagecache ops on directories`fs/fuse/dev.c`	+8 -1	0 replies
327/452	i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()`drivers/i2c/busses/i2c-qcom-cci.c`	+1 -1	0 replies
328/452	i2c: stm32f7: fix timing computation ignoring i2c-analog-filter`drivers/i2c/busses/i2c-stm32f7.c`	+3 -3	0 replies
329/452	i2c: tegra: Fix NOIRQ suspend/resume`drivers/i2c/busses/i2c-tegra.c`	+30 ~~-23~~	0 replies
330/452	Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)`drivers/input/keyboard/atkbd.c`	+8 -0	0 replies
331/452	Input: atkbd - skip deactivate for HONOR BCC-Ns internal keyboard`drivers/input/keyboard/atkbd.c`	+7 -0	0 replies
332/452	ipc/shm: serialize orphan cleanup with shm_nattch updates`ipc/shm.c`	+6 -4	0 replies
333/452	misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context`drivers/misc/fastrpc.c`	+52 ~~-23~~	0 replies
334/452	misc: fastrpc: fix use-after-free race in fastrpc_map_create`drivers/misc/fastrpc.c`	+11 ~~-14~~	0 replies
335/452	misc: fastrpc: fix DMA address corruption due to find_vma misuse`drivers/misc/fastrpc.c`	+1 -1	0 replies
336/452	misc: fastrpc: Fix NULL pointer dereference in rpmsg callback`drivers/misc/fastrpc.c`	+4 -1	0 replies
337/452	net/mlx5: Reorder completion before putting command entry in cmd_work_handler`drivers/net/ethernet/mellanox/mlx5/core/cmd.c`	+4 -2	0 replies
338/452	net: bonding: fix NULL pointer dereference in bond_do_ioctl()`drivers/net/bonding/bond_main.c`	+2 -2	0 replies
339/452	net: mv643xx: fix OF node refcount`drivers/net/ethernet/marvell/mv643xx_eth.c`	+1 -1	0 replies
340/452	net: rds: clear i_sends on setup unwind`net/rds/ib_cm.c`	+1 -0	0 replies
341/452	nvmem: layouts: onie-tlv: fix hang on unknown types`drivers/nvmem/layouts/onie-tlv.c`	+2 -1	0 replies
342/452	octeontx2-af: fix memory leak in rvu_setup_hw_resources()`drivers/net/ethernet/marvell/octeontx2/af/rvu.c`	+1 -1	0 replies
343/452	bpf: Track equal scalars history on per-instruction level`include/linux/bpf_verifier.h` `kernel/bpf/verifier.c` `tools/testing/selftests/bpf/progs/verifier_subprog_precision.c`	+239 ~~-23~~	2 replies
344/452	bpf: Remove mark_precise_scalar_ids()`kernel/bpf/verifier.c` `tools/testing/selftests/bpf/progs/verifier_scalar_ids.c` `tools/testing/selftests/bpf/verifier/precise.c`	+56 ~~-232~~	0 replies
345/452	selftests/bpf: Tests for per-insn sync_linked_regs() precision tracking`tools/testing/selftests/bpf/progs/verifier_scalar_ids.c`	+162 -0	0 replies
346/452	selftests/bpf: Update comments find_equal_scalars->sync_linked_regs`tools/testing/selftests/bpf/progs/verifier_spill_fill.c`	+2 -2	0 replies
347/452	mm/hugetlb: restore reservation on error in hugetlb folio copy paths`mm/hugetlb.c`	+2 -0	0 replies
348/452	mmc: core: Fix host controller programming for fixed driver type`drivers/mmc/core/mmc.c`	+3 -1	0 replies
349/452	mmc: litex_mmc: Set mandatory idle clocks before CMD0`drivers/mmc/host/litex_mmc.c`	+14 -0	0 replies
350/452	mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC`drivers/mmc/host/renesas_sdhi_internal_dmac.c`	+1 -0	0 replies
351/452	mmc: sdhci: add signal voltage switch in sdhci_resume_host`drivers/mmc/host/sdhci.c`	+1 -0	0 replies
352/452	sctp: diag: reject stale associations in dump_one path`net/sctp/diag.c`	+9 -8	0 replies
353/452	sctp: stream: fully roll back denied add-stream state`net/sctp/stream.c`	+5 -1	0 replies
354/452	thunderbolt: Reject zero-length property entries in validator`drivers/thunderbolt/property.c`	+2 -0	0 replies
355/452	thunderbolt: Bound root directory content to block size`drivers/thunderbolt/property.c`	+4 -0	0 replies
356/452	thunderbolt: Clamp XDomain response data copy to allocation size`drivers/thunderbolt/xdomain.c`	+2 -0	0 replies
357/452	thunderbolt: Validate XDomain request packet size before type cast`drivers/thunderbolt/xdomain.c`	+6 -2	0 replies
358/452	thunderbolt: Limit XDomain response copy to actual frame size`drivers/thunderbolt/xdomain.c`	+3 -1	0 replies
359/452	slimbus: qcom-ngd-ctrl: fix OF node refcount`drivers/slimbus/qcom-ngd-ctrl.c`	+1 -1	0 replies
360/452	slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock`drivers/slimbus/qcom-ngd-ctrl.c`	+0 -3	0 replies
361/452	drm/amdkfd: fix NULL dereference in get_queue_ids()`drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c`	+1 -1	0 replies
362/452	drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11`drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c`	+41 -8	0 replies
363/452	drm/amdgpu: restart the CS if some parts of the VM are still invalidated`drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c`	+3 -1	0 replies
364/452	drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size`drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c`	+2 -1	0 replies
365/452	drm/amd/display: Clamp VBIOS HDMI retimer register count to array size`drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c`	+32 ~~-16~~	0 replies
366/452	drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs`drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c`	+5 -0	0 replies
367/452	drm/amd/display: Use krealloc_array() in dal_vector_reserve()`drivers/gpu/drm/amd/display/dc/basics/vector.c`	+2 -2	0 replies
368/452	fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling`fs/fcntl.c`	+4 -4	0 replies
369/452	driver core: reject devices with unregistered buses`drivers/base/bus.c`	+9 -2	0 replies
370/452	mm/hugetlb: avoid false positive lockdep assertion`mm/hugetlb.c`	+37 ~~-20~~	0 replies
371/452	soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get()`drivers/soc/qcom/ice.c`	+29 -7	0 replies
372/452	mm/huge_memory: update file PMD counter before folio_put()`mm/huge_memory.c`	+2 -0	0 replies
373/452	ipmi:ssif: Remove unnecessary indention`drivers/char/ipmi/ipmi_ssif.c`	+12 ~~-16~~	0 replies
374/452	ipmi:ssif: NULL thread on error`drivers/char/ipmi/ipmi_ssif.c`	+1 -0	0 replies
375/452	fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros`drivers/video/fbdev/Kconfig` `drivers/video/fbdev/vt8500lcdfb.c`	+4 -1	0 replies
376/452	ksmbd: fix OOB write in QUERY_INFO for compound requests`fs/smb/server/smb2pdu.c` `fs/smb/server/smbacl.c` `fs/smb/server/smbacl.h`	+134 ~~-32~~	0 replies
377/452	cgroup/cpuset: Reset DL migration state on can_attach() failure`kernel/cgroup/cpuset.c`	+4 -4	0 replies
378/452	genetlink: Use internal flags for multicast groups`include/net/genetlink.h` `net/core/drop_monitor.c` `net/mptcp/pm_netlink.c` +2 more	+11 -8	0 replies
379/452	smb: client: require net admin for CIFS SWN netlink`fs/smb/client/netlink.c`	+5 -1	0 replies
380/452	platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery`drivers/platform/x86/intel/vsec.c`	+20 ~~-14~~	0 replies
381/452	octeontx2-af: replace deprecated strncpy with strscpy`drivers/net/ethernet/marvell/octeontx2/af/cgx.c`	+3 -5	0 replies
382/452	octeontx2-af: CGX: add bounds check to cgx_speed_mbps index`drivers/net/ethernet/marvell/octeontx2/af/cgx.c`	+6 -1	0 replies
383/452	mptcp: use plain bool instead of custom binary enum`net/mptcp/protocol.h` `net/mptcp/subflow.c`	+7 ~~-12~~	0 replies
384/452	mptcp: cleanup fallback dummy mapping generation`net/mptcp/protocol.c` `net/mptcp/subflow.c`	+10 -1	0 replies
385/452	mptcp: reset rcv wnd on disconnect`net/mptcp/protocol.c`	+1 -0	0 replies
386/452	selftests: mptcp: drop nanoseconds width specifier`tools/testing/selftests/net/mptcp/mptcp_connect.sh`	+3 -3	0 replies
387/452	ice: fix VF queue configuration with low MTU values`drivers/net/ethernet/intel/ice/ice_virtchnl.c`	+1 -1	0 replies
388/452	mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient`net/mptcp/pm.c` `net/mptcp/pm_netlink.c`	+46 ~~-10~~	0 replies
389/452	ipv6/addrconf: annotate data-races around devconf fields (II)`net/ipv6/addrconf.c` `net/ipv6/exthdrs.c` `net/ipv6/ioam6.c` +4 more	+60 ~~-53~~	0 replies
390/452	ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()`net/ipv6/exthdrs.c`	+13 -2	0 replies
391/452	net: hsr: defer node table free until after RCU readers`net/hsr/hsr_framereg.c`	+4 -2	0 replies
392/452	rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg`net/rxrpc/ar-internal.h` `net/rxrpc/call_event.c` `net/rxrpc/call_object.c` +3 more	+96 ~~-97~~	0 replies
393/452	rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer`net/rxrpc/ar-internal.h` `net/rxrpc/conn_event.c` `net/rxrpc/insecure.c` +1 more	+28 ~~-41~~	0 replies
394/452	af_unix: Cache state->msg in unix_stream_read_generic().`net/unix/af_unix.c`	+16 ~~-13~~	0 replies
395/452	af_unix: Fix UAF read of tail->len in unix_stream_data_wait()`net/unix/af_unix.c`	+2 -9	0 replies
396/452	octeontx2-pf: avoid double free of pool->stack on AQ init failure`drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c`	+2 -0	0 replies
397/452	arm64: tlb: Flush walk cache when unsharing PMD tables`arch/arm64/include/asm/tlb.h`	+1 -1	0 replies
398/452	iio: adc: npcm: Convert to platform remove callback returning void`drivers/iio/adc/npcm_adc.c`	+2 -4	0 replies
399/452	iio: adc: npcm: fix unbalanced clk_disable_unprepare()`drivers/iio/adc/npcm_adc.c`	+8 ~~-17~~	0 replies
400/452	mptcp: introduce the mptcp_init_skb helper`net/mptcp/protocol.c`	+27 ~~-23~~	0 replies
401/452	mptcp: do not drop partial packets`net/mptcp/protocol.c`	+19 -5	0 replies
402/452	mm/memory: fix spurious warning when unmapping device-private/exclusive pages`mm/memory.c` `tools/testing/selftests/mm/hmm-tests.c`	+51 -1	0 replies
403/452	mm/damon/sysfs-schemes: delete tried region in regions_rmdirs()`mm/damon/sysfs-schemes.c`	+4 -4	0 replies
404/452	serdev: make serdev_bus_type const`drivers/tty/serdev/core.c`	+1 -1	0 replies
405/452	serdev: Provide a bustype shutdown function`drivers/tty/serdev/core.c` `include/linux/serdev.h`	+22 -0	0 replies
406/452	Bluetooth: hci_qca: Migrate to serdev specific shutdown function`drivers/bluetooth/hci_qca.c`	+2 -3	0 replies
407/452	Bluetooth: hci_qca: Convert timeout from jiffies to ms`drivers/bluetooth/hci_qca.c`	+16 ~~-17~~	0 replies
408/452	mptcp: handle first subflow closing consistently`net/mptcp/protocol.c` `net/mptcp/protocol.h`	+11 -6	0 replies
409/452	iio: gyro: adis16260: fix division by zero in write_raw`drivers/iio/gyro/adis16260.c`	+3 -0	0 replies
410/452	iio: chemical: scd30: Use guard(mutex) to allow early returns`drivers/iio/chemical/scd30_core.c`	+28 ~~-35~~	0 replies
411/452	iio: chemical: scd30: fix division by zero in write_raw`drivers/iio/chemical/scd30_core.c`	+1 -1	0 replies
412/452	usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure`drivers/usb/cdns3/cdns3-plat.c`	+4 -4	0 replies
413/452	iio: dac: ad5686: fix ref bit initialization for single-channel parts`drivers/iio/dac/ad5686.c` `drivers/iio/dac/ad5686.h`	+4 -3	0 replies
414/452	memfd: deny writeable mappings when implying SEAL_WRITE`mm/memfd.c`	+6 -6	0 replies
415/452	ALSA: firewire-motu: Protect register DSP event queue positions`sound/firewire/motu/motu-register-dsp-message-parser.c`	+7 -7	0 replies
416/452	serial: samsung_tty: Use port lock wrappers`drivers/tty/serial/samsung_tty.c`	+25 ~~-25~~	0 replies
417/452	tty: serial: samsung: use u32 for register interactions`drivers/tty/serial/samsung_tty.c`	+39 ~~-40~~	0 replies
418/452	tty: serial: samsung: Remove redundant port lock acquisition in rx helpers`drivers/tty/serial/samsung_tty.c`	+0 -8	0 replies
419/452	usb: musb: omap2430: Fix use-after-free in omap2430_probe()`drivers/usb/musb/omap2430.c`	+2 -1	0 replies
420/452	usb: dwc3: xilinx: fix error handling in zynqmp init error paths`drivers/usb/dwc3/dwc3-xilinx.c`	+14 ~~-12~~	0 replies
421/452	usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind`drivers/usb/gadget/function/f_uvc.c`	+20 -6	0 replies
422/452	usb: typec: ucsi: Check if power role change actually happened before handling`drivers/usb/typec/ucsi/ucsi.c`	+4 -2	0 replies
423/452	thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()`drivers/thunderbolt/property.c`	+12 -6	0 replies
424/452	scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()`drivers/target/iscsi/iscsi_target.c`	+4 -2	0 replies
425/452	serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ`drivers/tty/serial/qcom_geni_serial.c`	+14 -1	0 replies
426/452	usb: typec: ucsi: Dont update power_supply on power role change if not connected`drivers/usb/typec/ucsi/ucsi.c`	+6 -1	0 replies
427/452	netfilter: nft_fib: fix stale stack leak via the OIFNAME register`net/ipv4/netfilter/nft_fib_ipv4.c` `net/ipv6/netfilter/nft_fib_ipv6.c` `net/netfilter/nft_fib.c`	+8 -2	0 replies
428/452	mm/hugetlb: rename isolate_hugetlb() to folio_isolate_hugetlb()`include/linux/hugetlb.h` `mm/gup.c` `mm/hugetlb.c` +4 more	+27 ~~-14~~	0 replies
429/452	mm/migrate: dont call folio_putback_active_hugetlb() on dst hugetlb folio`mm/hugetlb.c` `mm/migrate.c`	+14 -4	0 replies
430/452	mm/hugetlb: rename folio_putback_active_hugetlb() to folio_putback_hugetlb()`include/linux/hugetlb.h` `mm/hugetlb.c` `mm/migrate.c`	+18 -7	0 replies
431/452	mm/memory-failure: fix missing ->mf_stats count in hugetlb poison`mm/memory-failure.c`	+46 ~~-27~~	0 replies
432/452	mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison`include/linux/hugetlb.h` `include/linux/mm.h` `mm/hugetlb.c` +1 more	+10 ~~-36~~	0 replies
433/452	hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf`drivers/net/hyperv/netvsc.c`	+15 -4	0 replies
434/452	RDMA: During rereg_mr ensure that REREG_ACCESS is compatible`drivers/infiniband/core/umem.c` `drivers/infiniband/hw/hns/hns_roce_mr.c` `drivers/infiniband/hw/irdma/verbs.c` +4 more	+45 -0	0 replies
435/452	RDMA/umem: fix kernel-doc warnings`include/rdma/ib_umem.h`	+5 -1	0 replies
436/452	RDMA: Move DMA block iterator logic into dedicated files`drivers/infiniband/core/Makefile` `drivers/infiniband/core/iter.c` `drivers/infiniband/core/verbs.c` +17 more	+146 ~~-130~~	0 replies
437/452	RDMA/umem: Fix truncation for block sizes >= 4G`drivers/infiniband/core/iter.c`	+2 -2	0 replies
438/452	net: bonding: fix use-after-free in bond_xmit_broadcast()`drivers/net/bonding/bond_main.c`	+1 -1	0 replies
439/452	ipvs: skip ipv6 extension headers for csum checks`net/netfilter/ipvs/ip_vs_proto_sctp.c` `net/netfilter/ipvs/ip_vs_proto_tcp.c` `net/netfilter/ipvs/ip_vs_proto_udp.c`	+20 ~~-39~~	0 replies
440/452	ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6`sound/pci/hda/patch_hdmi.c`	+1 -0	0 replies
441/452	arm64: cputype: Add NVIDIA Olympus definitions`arch/arm64/include/asm/cputype.h`	+2 -0	0 replies
442/452	arm64: cputype: Add C1-Ultra definitions`arch/arm64/include/asm/cputype.h`	+2 -0	0 replies
443/452	arm64: cputype: Add C1-Premium definitions`arch/arm64/include/asm/cputype.h`	+2 -0	0 replies
444/452	arm64: errata: Mitigate TLBI errata on various Arm CPUs`Documentation/arch/arm64/silicon-errata.rst` `arch/arm64/Kconfig` `arch/arm64/kernel/cpu_errata.c`	+122 -2	0 replies
445/452	arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU`Documentation/arch/arm64/silicon-errata.rst` `arch/arm64/Kconfig` `arch/arm64/kernel/cpu_errata.c`	+5 -1	0 replies
446/452	arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU`Documentation/arch/arm64/silicon-errata.rst` `arch/arm64/Kconfig` `arch/arm64/kernel/cpu_errata.c`	+4 -0	0 replies
447/452	mptcp: add-addr: always drop other suboptions`net/mptcp/options.c` `net/mptcp/pm.c` `net/mptcp/protocol.h`	+14 ~~-38~~	0 replies
448/452	mptcp: fix missing wakeups in edge scenarios`net/mptcp/protocol.c`	+5 -1	0 replies
449/452	Revert "selftest/ptp: update ptp selftest to exercise the gettimex options"`tools/testing/selftests/ptp/testptp.c`	+5 ~~-57~~	0 replies
450/452	x86/CPU/AMD: Move the Zen3 BTC_NO detection to the Zen3 init function`arch/x86/kernel/cpu/amd.c`	+9 -8	0 replies
451/452	x86/CPU/AMD: Call the spectral chicken in the Zen2 init function`arch/x86/kernel/cpu/amd.c`	+3 -4	0 replies
452/452	x86/CPU/AMD: Rename init_amd_zn() to init_amd_zen_common()`arch/x86/kernel/cpu/amd.c`	+7 -4	0 replies

Reviews trailers per patch

243 of 452 patches have a Reviewed-by or Acked-by.

Patch	Jamal Hadi Salim	Eric Dumazet	André Almeida	Simon Horman	Alexander Sverdlin	Jeremy Sowden	Dongli Zhang	Willem de Bruijn	Nicolas Dichtel	Halil Pasic	Mahanta Jambigi	Alexandra Winter	Bart Van Assche	Jason Xing	Jiayuan Chen	Fernando Fernandez Mancera	Frank Li	Stefano Brivio	Kuniyuki Iwashima	Namjae Jeon	Jay Vosburgh	Maxime Chevallier	Bartosz Golaszewski	Mark Pearson	Luca Stefani	David Wang	Yuan Tan	Xiao Liu	Stephen Hemminger	Zi Yan	David Hildenbrand (Arm)	Vlastimil Babka	Patrice Chotard	Javier Martinez Canillas	Alex Deucher	Suraj Kandpal	Arun R Murthy	Ben Kao	Maarten Lankhorst	Catalin Marinas	Haiyang Zhang	Xin Long	Ido Schimmel	Heikki Krogerus	Abel Vesa	Benson Leung	Greg Kroah-Hartman	[email protected]	Mimi Zohar	Sudip Mukherjee	Andy Shevchenko	Nuno Sá	Salih Erim	Jon Hunter	David Lechner	Peter Chen	Justin Iurman	Ping Cheng	Will Deacon	Thomas Gleixner	Miguel Ojeda	Joshua Crofts	Maxwell Doose	Sabrina Dubroca	Ricardo Ribalda	Oliver Neukum	Shuah Khan	Alan Stern	Johan Hovold	Hannes Reinecke	Christoph Hellwig	John Garry	David Disseldorp	Michael Kelley	Andi Shyti	Christian König	Jeremy Klarenbeek	Tao Xue	Konrad Dybcio	Dmitry Vyukov	Tingmao Wang	Geert Uytterhoeven	Daniel Borkmann	Sanman Pradhan	David Ahern	Dust Li	Ox Yeh	Sumit Garg	Andrew Lunn	Alexander Lobakin	Jakub Sitnicki	Thangaraj Samynathan	Nicolai Buchwitz	Wei Fang	Paul Menzel	[email protected]	Sebastian Andrzej Siewior	Petr Machata	Miquel Raynal	John Stultz	Victor Nogueira	[email protected]	Kyle Zeng	Pedro Tammela	Alexander Aring	Laurentiu Palcu	Jacob Keller	Carolina Jubran	Aaron Conole	Eelco Chaudron	Nam Cao	Hayes Wang	Allison Henderson	Michal Kubiak	Zenghui Yu	Anshuman Khandual	Mark Rutland	Jérôme de Bretagne	Tvrtko Ursulin	Ryosuke Yasuoka	Steven Rostedt	Gabriel Somlo	Michael Roth	Linus Walleij	Matthieu Baerts (NGI0)	Mat Martineau	Stefano Garzarella	Shengjiu Wang	Pavan Chebbi	Miklos Szeredi	Alain Volmat	Hongfei Ren	Dmitry Osipenko	Alex Hung	Daniel Wheeler	Sergey Senozhatsky	Lars Melin	Bjorn Andersson	Muchun Song	Shawn Lin	Wolfram Sang	Adrian Hunter	Md Haris Iqbal	Moshe Shemesh	Tariq Toukan	Vitaly Prosyak	Jeff Layton	Oscar Salvador	Dmitry Baryshkov	Lorenzo Stoakes	Lance Yang	Dev Jain	Kees Cook	Geliang Tang	Michal Swiatkowski	Rafal Romanowski	Jiri Pirko	Jeffrey Altman	Marc Dionne	Balbir Singh	Chen Ridong	Waiman Long	Ilpo Järvinen	Sam Protsenko	Thinh Nguyen	Matthew Wilcox (Oracle)	Baolin Wang	Miaohe Lin	Oscar Salvador (SUSE)	Kefeng Wang	Pasha Tatashin	Jeff Xu	Takashi Sakamoto	Nikolay Borisov	Brett A C Sheffield	Wentao Guan	Francesco Dolcini	Mark Brown	Peter Schneider	Barry K. Nathan	Ron Economos	Pavel Machek (CIP)	Florian Fainelli
Series																																																													T-b						T-b																																																																																																												T-b	T-b	T-b	T-b	T-b	T-b	T-b	T-b	T-b
1/452
2/452	A-b
3/452				R-b
4/452		R-b
5/452			R-b
6/452
7/452					R-b
8/452
9/452				R-b
10/452
11/452																							T-b R-b	R-b T-b	T-b
12/452																R-b
13/452
14/452																R-b
15/452
16/452
17/452						A-b
18/452							R-b	R-b
19/452							R-b	R-b
20/452
21/452									A-b
22/452									A-b
23/452										A-b	R-b
24/452												R-b T-b
25/452													R-b
26/452														R-b	R-b
27/452
28/452																R-b
29/452																	R-b
30/452																		R-b
31/452																		R-b
32/452																			R-b
33/452																				A-b
34/452
35/452
36/452																					A-b
37/452																						R-b
38/452																						R-b
39/452
40/452																													R-b
41/452
42/452
43/452
44/452																																									R-b
45/452																																										A-b
46/452																																											R-b
47/452																																											R-b
48/452								R-b
49/452																										T-b
50/452																											R-b
51/452
52/452
53/452
54/452																											R-b
55/452
56/452
57/452																												T-b
58/452
59/452
60/452
61/452
62/452																														A-b	A-b	R-b
63/452																																	R-b
64/452
65/452																																		R-b
66/452																																		A-b	A-b
67/452		R-b
68/452		R-b
69/452																																				R-b
70/452																																				R-b
71/452																																					R-b	T-b	A-b
72/452																																				R-b
73/452																																								R-b
74/452																																								R-b
75/452																						R-b
76/452																																																	R-b
77/452																																																	R-b
78/452																																																	R-b
79/452																							R-b
80/452
81/452																																																						R-b T-b
82/452																																																							R-b
83/452																																												R-b
84/452																																												R-b
85/452																																												R-b
86/452																																												R-b
87/452
88/452																																												R-b	R-b	R-b
89/452																																															R-b
90/452																																																T-b
91/452
92/452
93/452
94/452
95/452
96/452
97/452
98/452
99/452
100/452
101/452
102/452
103/452																																																		A-b
104/452
105/452
106/452
107/452
108/452																																																			R-b	R-b	R-b
109/452																																																			R-b
110/452																																																			R-b
111/452
112/452																																																				R-b										R-b	R-b
113/452																																																			R-b
114/452
115/452
116/452																																																			R-b
117/452
118/452																																																			R-b	R-b											R-b
119/452																																															R-b
120/452																																																								A-b
121/452
122/452
123/452
124/452
125/452
126/452																																											R-b
127/452
128/452																																											R-b														R-b
129/452
130/452								R-b
131/452
132/452		R-b
133/452																																																										T-b R-b
134/452																																																											A-b	A-b	A-b
135/452				R-b
136/452
137/452
138/452
139/452
140/452
141/452																																																																R-b
142/452
143/452
144/452																				A-b
145/452																																																																	R-b
146/452
147/452
148/452
149/452
150/452																																																			R-b
151/452																	R-b																																							A-b
152/452																																																																														Reported-and-tested-by
153/452
154/452																																																																		A-b
155/452																																																																			A-b
156/452
157/452
158/452
159/452
160/452
161/452
162/452																																															R-b
163/452																																															R-b
164/452																																															R-b
165/452																																																																				R-b
166/452																																																																					R-b R-b
167/452
168/452																																																																				R-b
169/452
170/452
171/452
172/452																																																																						R-b
173/452																																																																							R-b	R-b
174/452																																																																								T-b R-b
175/452																																																																									R-b
176/452																																																																										R-b T-b
177/452																																																																										R-b T-b
178/452																																																																											R-b	R-b
179/452																																			R-b																																										T-b
180/452
181/452																																																																															R-b
182/452																																																																																		R-b
183/452
184/452																	R-b
185/452																																			R-b
186/452																																			A-b
187/452																																			R-b
188/452
189/452
190/452
191/452																																															R-b
192/452
193/452																																																																																R-b
194/452																																																																																	R-b
195/452																																															R-b
196/452
197/452
198/452
199/452
200/452
201/452																																															R-b																						A-b
202/452
203/452
204/452																																																																																			A-b
205/452																																															R-b
206/452
207/452
208/452																																																																																				R-b
209/452
210/452
211/452		R-b													R-b																																																																						R-b
212/452																																																																																						R-b T-b
213/452																																																																																							T-b	R-b
214/452																				A-b
215/452
216/452
217/452
218/452																R-b
219/452
220/452
221/452
222/452		R-b																																																																																																			T-b R-b	T-b	T-b	R-b
223/452																																																																																																									A-b
224/452																																																																																																										R-b
225/452																																																																																									R-b	R-b
226/452																																																																																											R-b
227/452																R-b
228/452				R-b
229/452																																																																																												R-b	R-b T-b
230/452																																																																																														R-b
231/452
232/452																																																																																															R-b
233/452
234/452
235/452
236/452																																																																																																T-b
237/452
238/452																																											R-b																																										R-b
239/452																																																																																																	R-b
240/452
241/452
242/452																																																																																																		R-b
243/452																																																																																																		R-b
244/452																																																																																																			R-b
245/452
246/452
247/452
248/452
249/452																																																																																																				A-b
250/452
251/452
252/452
253/452																																																																																																															R-b
254/452								R-b
255/452							R-b	R-b
256/452																																																																																																																			R-b	R-b	A-b
257/452
258/452
259/452
260/452
261/452
262/452
263/452
264/452								R-b																																																																											A-b
265/452																																																																																																											R-b
266/452																																																																																													R-b
267/452				R-b
268/452																																																																																																												R-b
269/452		R-b
270/452																																																																																																													R-b	A-b
271/452																																																																																									R-b																							R-b
272/452																																										A-b
273/452								R-b											R-b
274/452																																																																																																																	R-b
275/452									R-b
276/452																																																																																																																	R-b
277/452
278/452
279/452
280/452
281/452
282/452
283/452																																																																																																																		R-b
284/452
285/452
286/452																																																																																					R-b
287/452
288/452																																																																																																																						T-b
289/452																																																																																																																								T-b R-b
290/452
291/452																R-b
292/452
293/452
294/452																																																																																																																									R-b
295/452																																																																																																																										R-b
296/452																																																																																																																											R-b
297/452																																																																																																																							R-b
298/452																				A-b
299/452
300/452
301/452
302/452																																																																																																																																									R-b
303/452
304/452																																																																																																							T-b
305/452																																																																																																																																					R-b
306/452																																																																																																																																						R-b	T-b
307/452
308/452													R-b
309/452																																																																							R-b																																																																	R-b
310/452		R-b													R-b
311/452
312/452																																																																																																																												R-b
313/452																																																																																																																												R-b
314/452																																																																																																																													R-b
315/452																																																																																																																													R-b
316/452																																																																																																																													R-b
317/452																																																																																																																														R-b
318/452																																																																																																																													R-b
319/452
320/452																																																																																																																															A-b
321/452																																																																																																																																R-b
322/452																																																																																																																																	R-b
323/452
324/452
325/452
326/452																																																																																																																																		A-b
327/452																																																																															R-b
328/452																																																																																																																																			A-b
329/452																																																						R-b
330/452
331/452																																																																																																																																				T-b
332/452
333/452
334/452
335/452																																																																																																																																																					R-b
336/452																																																																																																																																										R-b
337/452																																																																																																																																															R-b	R-b	A-b
338/452
339/452
340/452																																																																																																																	R-b
341/452																																																																																																			R-b
342/452
343/452
344/452
345/452
346/452
347/452																																																																																																																																											R-b
348/452																																																																																																																																												R-b
349/452																																																																																																																										R-b
350/452																																																																																		R-b																																																											R-b
351/452																																																																																																																																														A-b
352/452																																										A-b
353/452																																										A-b
354/452
355/452
356/452
357/452
358/452
359/452
360/452
361/452
362/452																																			A-b
363/452																																			R-b																																																																																																															R-b T-b
364/452																																																																																																																																						R-b	T-b
365/452																																																																																																																																						R-b	T-b
366/452																																																																																																																																						R-b	T-b
367/452																																																																																																																																						R-b	T-b
368/452																																																																																																																																																			R-b
369/452
370/452																															A-b																																																																																																																					A-b
371/452																																																																																								T-b A-b
372/452																															A-b																																																																																																																							R-b	R-b	R-b
373/452
374/452
375/452																																		R-b
376/452
377/452																																																																																																																																																																	R-b	R-b
378/452																																																			R-b																																																																											R-b
379/452
380/452																																																																																																																																																																			R-b
381/452																																																																																																																																																									R-b
382/452
383/452																																																																																																																														R-b
384/452																																																																																																																														R-b																												R-b T-b
385/452																																																																																																																													R-b
386/452
387/452																																																																																															R-b												R-b																																																R-b	T-b
388/452																																																																																																																													R-b
389/452																																																																																																																																																													R-b
390/452																																											R-b
391/452
392/452																																																																																																																																																														R-b	T-b
393/452																																																																																																																																																														R-b	T-b
394/452
395/452																			R-b
396/452				R-b
397/452
398/452
399/452																																																			R-b
400/452																																																																																																																													R-b																													R-b T-b
401/452																																																																																																																													R-b
402/452																																																																																																																																																																R-b
403/452
404/452
405/452
406/452
407/452																							A-b																																																																								R-b
408/452																																																																																																																														R-b
409/452																																																				R-b
410/452																																																							R-b
411/452
412/452
413/452																																																			R-b
414/452																																																																																																																																																																											R-b	A-b
415/452																																																																																																																																																																													R-b
416/452
417/452																																																																																																																																																																				R-b
418/452
419/452
420/452																																																																																																																																																																					A-b
421/452
422/452																																												R-b																																																																																												Reported-and-tested-by
423/452
424/452																																																																								T-b R-b
425/452																							R-b
426/452																																																																																																																																								Reported-and-tested-by
427/452
428/452																																																																																																																																																																						R-b	R-b
429/452																																																																																																																																																																							R-b
430/452																																																																																																																																																																							R-b
431/452																																																																																																																																																																								A-b
432/452																																																																																																																																											A-b																													A-b	A-b	R-b
433/452
434/452
435/452
436/452
437/452
438/452
439/452
440/452
441/452
442/452
443/452
444/452
445/452																																																																																																																					A-b
446/452
447/452
448/452																																																																																																																													R-b
449/452
450/452																																																																																																																																																																														R-b
451/452																																																																																																																																																																														R-b
452/452																																																																																																																																																																														R-b

Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes. Scroll the table sideways for all 183 reviewers.

Read the v1 thread

Cover letter [PATCH 6.6 000/452] 6.6.143-rc1 review

This is the start of the stable review cycle for the 6.6.143 release. There are 452 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Thu, 18 Jun 2026 14:49:57 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.143-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 6.6.143-rc1

Borislav Petkov (AMD) <[email protected]>
x86/CPU/AMD: Rename init_amd_zn() to init_amd_zen_common()

Borislav Petkov (AMD) <[email protected]>
x86/CPU/AMD: Call the spectral chicken in the Zen2 init function

Borislav Petkov (AMD) <[email protected]>
x86/CPU/AMD: Move the Zen3 BTC_NO detection to the Zen3 init function

Petr Machata <[email protected]>
Revert "selftest/ptp: update ptp selftest to exercise the gettimex options"

Paolo Abeni <[email protected]>
mptcp: fix missing wakeups in edge scenarios

Matthieu Baerts (NGI0) <[email protected]>
mptcp: add-addr: always drop other suboptions

Will Deacon <[email protected]>
arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU

Shanker Donthineni <[email protected]>
arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU

Mark Rutland <[email protected]>
arm64: errata: Mitigate TLBI errata on various Arm CPUs

Mark Rutland <[email protected]>
arm64: cputype: Add C1-Premium definitions

Mark Rutland <[email protected]>
arm64: cputype: Add C1-Ultra definitions

Shanker Donthineni <[email protected]>
arm64: cputype: Add NVIDIA Olympus definitions

Aaron Erhardt <[email protected]>
ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6

Julian Anastasov <[email protected]>
ipvs: skip ipv6 extension headers for csum checks

Xiang Mei <[email protected]>
net: bonding: fix use-after-free in bond_xmit_broadcast()

Jason Gunthorpe <[email protected]>
RDMA/umem: Fix truncation for block sizes >= 4G

Leon Romanovsky <[email protected]>
RDMA: Move DMA block iterator logic into dedicated files

Randy Dunlap <[email protected]>
RDMA/umem: fix kernel-doc warnings

Jason Gunthorpe <[email protected]>
RDMA: During rereg_mr ensure that REREG_ACCESS is compatible

Anton Leontev <[email protected]>
hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf

Wupeng Ma <[email protected]>
mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison

Jane Chu <[email protected]>

    mm/memory-failure: fix missing ->mf_stats count in hugetlb poison

David Hildenbrand <[email protected]>
mm/hugetlb: rename folio_putback_active_hugetlb() to folio_putback_hugetlb()

David Hildenbrand <[email protected]>
mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio

David Hildenbrand <[email protected]>
mm/hugetlb: rename isolate_hugetlb() to folio_isolate_hugetlb()

Davide Ornaghi <[email protected]>
netfilter: nft_fib: fix stale stack leak via the OIFNAME register

Myrrh Periwinkle <[email protected]>
usb: typec: ucsi: Don't update power_supply on power role change if not connected

Viken Dadhaniya <[email protected]>
serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ

Michael Bommarito <[email protected]>
scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()

Michael Bommarito <[email protected]>
thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()

Myrrh Periwinkle <[email protected]>
usb: typec: ucsi: Check if power role change actually happened before handling

Kai Aizen <[email protected]>

    usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind

Radhey Shyam Pandey <[email protected]>
usb: dwc3: xilinx: fix error handling in zynqmp init error paths

Wentao Liang <[email protected]>

    usb: musb: omap2430: Fix use-after-free in omap2430_probe()

Tudor Ambarus <[email protected]>
tty: serial: samsung: Remove redundant port lock acquisition in rx helpers

Tudor Ambarus <[email protected]>
tty: serial: samsung: use u32 for register interactions

Thomas Gleixner <[email protected]>
serial: samsung_tty: Use port lock wrappers

Cássio Gabriel <[email protected]>
ALSA: firewire-motu: Protect register DSP event queue positions

Pratyush Yadav (Google) <[email protected]>
memfd: deny writeable mappings when implying SEAL_WRITE

Rodrigo Alencar <[email protected]>
iio: dac: ad5686: fix ref bit initialization for single-channel parts

Peter Chen <[email protected]>
usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure

Antoniu Miclaus <[email protected]>
iio: chemical: scd30: fix division by zero in write_raw

Jonathan Cameron <[email protected]>
iio: chemical: scd30: Use guard(mutex) to allow early returns

Antoniu Miclaus <[email protected]>
iio: gyro: adis16260: fix division by zero in write_raw

Paolo Abeni <[email protected]>
mptcp: handle first subflow closing consistently

Shuai Zhang <[email protected]>
Bluetooth: hci_qca: Convert timeout from jiffies to ms

Uwe Kleine-König <[email protected]>
Bluetooth: hci_qca: Migrate to serdev specific shutdown function

Uwe Kleine-König <[email protected]>
serdev: Provide a bustype shutdown function

Ricardo B. Marliere <[email protected]>
serdev: make serdev_bus_type const

SeongJae Park <[email protected]>
mm/damon/sysfs-schemes: delete tried region in regions_rmdirs()

Alistair Popple <[email protected]>
mm/memory: fix spurious warning when unmapping device-private/exclusive pages

Shardul Bankar <[email protected]>
mptcp: do not drop partial packets

Paolo Abeni <[email protected]>
mptcp: introduce the mptcp_init_skb helper

David Carlier <[email protected]>
iio: adc: npcm: fix unbalanced clk_disable_unprepare()

Uwe Kleine-König <[email protected]>
iio: adc: npcm: Convert to platform remove callback returning void

Zeng Heng <[email protected]>
arm64: tlb: Flush walk cache when unsharing PMD tables

Dawei Feng <[email protected]>

    octeontx2-pf: avoid double free of pool->stack on AQ init failure

Jann Horn <[email protected]>

    af_unix: Fix UAF read of tail->len in unix_stream_data_wait()

Kuniyuki Iwashima <[email protected]>

    af_unix: Cache state->msg in unix_stream_read_generic().

David Howells <[email protected]>
rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer

David Howells <[email protected]>
rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg

Michael Bommarito <[email protected]>
net: hsr: defer node table free until after RCU readers

Justin Iurman <[email protected]>
ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()

Eric Dumazet <[email protected]>
ipv6/addrconf: annotate data-races around devconf fields (II)

Li Xiasong <[email protected]>
mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient

Jose Ignacio Tornos Martinez <[email protected]>
ice: fix VF queue configuration with low MTU values

Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: drop nanoseconds width specifier

Paolo Abeni <[email protected]>
mptcp: reset rcv wnd on disconnect

Paolo Abeni <[email protected]>
mptcp: cleanup fallback dummy mapping generation

Paolo Abeni <[email protected]>
mptcp: use plain bool instead of custom binary enum

Sam Daly <[email protected]>
octeontx2-af: CGX: add bounds check to cgx_speed_mbps index

Justin Stitt <[email protected]>
octeontx2-af: replace deprecated strncpy with strscpy

Lukas Wunner <[email protected]>
platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery

Michael Bommarito <[email protected]>
smb: client: require net admin for CIFS SWN netlink

Ido Schimmel <[email protected]>
genetlink: Use internal flags for multicast groups

Guopeng Zhang <[email protected]>
cgroup/cpuset: Reset DL migration state on can_attach() failure

Asim Viladi Oglu Manizada <[email protected]>
ksmbd: fix OOB write in QUERY_INFO for compound requests

Thomas Zimmermann <[email protected]>
fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros

Corey Minyard <[email protected]>
ipmi:ssif: NULL thread on error

Corey Minyard <[email protected]>
ipmi:ssif: Remove unnecessary indention

Yin Tirui <[email protected]>
mm/huge_memory: update file PMD counter before folio_put()

Manivannan Sadhasivam <[email protected]>
soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get()

Lorenzo Stoakes <[email protected]>
mm/hugetlb: avoid false positive lockdep assertion

Johan Hovold <[email protected]>
driver core: reject devices with unregistered buses

Mingyu Wang <[email protected]>
fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling

Harry Wentland <[email protected]>
drm/amd/display: Use krealloc_array() in dal_vector_reserve()

Harry Wentland <[email protected]>
drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs

Harry Wentland <[email protected]>
drm/amd/display: Clamp VBIOS HDMI retimer register count to array size

Harry Wentland <[email protected]>
drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size

Christian König <[email protected]>
drm/amdgpu: restart the CS if some parts of the VM are still invalidated

Andrew Martin <[email protected]>
drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11

Muhammad Bilal <[email protected]>
drm/amdkfd: fix NULL dereference in get_queue_ids()

Bjorn Andersson <[email protected]>

    slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock

Bartosz Golaszewski <[email protected]>
slimbus: qcom-ngd-ctrl: fix OF node refcount

Michael Bommarito <[email protected]>
thunderbolt: Limit XDomain response copy to actual frame size

Michael Bommarito <[email protected]>
thunderbolt: Validate XDomain request packet size before type cast

Michael Bommarito <[email protected]>
thunderbolt: Clamp XDomain response data copy to allocation size

Michael Bommarito <[email protected]>
thunderbolt: Bound root directory content to block size

Michael Bommarito <[email protected]>
thunderbolt: Reject zero-length property entries in validator

Wyatt Feng <[email protected]>
sctp: stream: fully roll back denied add-stream state

Zhao Zhang <[email protected]>
sctp: diag: reject stale associations in dump_one path

Jisheng Zhang <[email protected]>
mmc: sdhci: add signal voltage switch in sdhci_resume_host

Lad Prabhakar <[email protected]>
mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC

Inochi Amaoto <[email protected]>
mmc: litex_mmc: Set mandatory idle clocks before CMD0

Kamal Dasu <[email protected]>
mmc: core: Fix host controller programming for fixed driver type

David Carlier <[email protected]>
mm/hugetlb: restore reservation on error in hugetlb folio copy paths

Eduard Zingerman <[email protected]>

    selftests/bpf: Update comments find_equal_scalars->sync_linked_regs

Eduard Zingerman <[email protected]>
selftests/bpf: Tests for per-insn sync_linked_regs() precision tracking

Eduard Zingerman <[email protected]>
bpf: Remove mark_precise_scalar_ids()

Eduard Zingerman <[email protected]>
bpf: Track equal scalars history on per-instruction level

Dawei Feng <[email protected]>
octeontx2-af: fix memory leak in rvu_setup_hw_resources()

Andre Heider <[email protected]>
nvmem: layouts: onie-tlv: fix hang on unknown types

Yuqi Xu <[email protected]>
net: rds: clear i_sends on setup unwind

Bartosz Golaszewski <[email protected]>
net: mv643xx: fix OF node refcount

ZhaoJinming <[email protected]>
net: bonding: fix NULL pointer dereference in bond_do_ioctl()

Nikolay Kuratov <[email protected]>
net/mlx5: Reorder completion before putting command entry in cmd_work_handler

Mukesh Ojha <[email protected]>
misc: fastrpc: Fix NULL pointer dereference in rpmsg callback

Junrui Luo <[email protected]>
misc: fastrpc: fix DMA address corruption due to find_vma misuse

Zhenghang Xiao <[email protected]>
misc: fastrpc: fix use-after-free race in fastrpc_map_create

Anandu Krishnan E <[email protected]>
misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context

Yilin Zhu <[email protected]>
ipc/shm: serialize orphan cleanup with shm_nattch updates

Cryolitia PukNgae <[email protected]>
Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard

Zeyu WANG <[email protected]>
Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)

Akhil R <[email protected]>
i2c: tegra: Fix NOIRQ suspend/resume

Guillermo Rodríguez <[email protected]>
i2c: stm32f7: fix timing computation ignoring i2c-analog-filter

Vladimir Zapolskiy <[email protected]>
i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()

Jann Horn <[email protected]>
fuse: reject fuse_notify() pagecache ops on directories

Christian Brauner <[email protected]>
pidfd: refuse access to tasks that have started exiting harder

Hyunwoo Kim <[email protected]>
inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush

Michael Bommarito <[email protected]>
IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN

Kyle Meyer <[email protected]>
bnxt_en: Fix NULL pointer dereference

Chancel Liu <[email protected]>
ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write

Raf Dickson <[email protected]>
vsock/vmci: fix sk_ack_backlog leak on failed handshake

Yuqi Xu <[email protected]>
wifi: nl80211: reject oversized EMA RNR lists

Tao Cui <[email protected]>
selftests: mptcp: add test for extra_subflows underflow on userspace PM

Matthieu Baerts (NGI0) <[email protected]>
mptcp: sockopt: check timestamping ret value

Paolo Abeni <[email protected]>
mptcp: allow subflow rcv wnd to shrink

Paolo Abeni <[email protected]>
mptcp: close TOCTOU race while computing rcv_wnd

Paolo Abeni <[email protected]>
mptcp: fix retransmission loop when csum is enabled

Karl Mehltretter <[email protected]>
ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow

Karl Mehltretter <[email protected]>
ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O

Yuho Choi <[email protected]>
ARM: socfpga: Fix OF node refcount leak in SMP setup

Sechang Lim <[email protected]>

    udp: clear skb->dev before running a sockmap verdict

Cunlong Li <[email protected]>
zram: fix use-after-free in zram_bvec_write_partial()

Michael Bommarito <[email protected]>
RDMA/srp: bound SRP_RSP sense copy by the received length

SeongJae Park <[email protected]>
mm/damon/ops-common: call folio_test_lru() after folio_get()

Harry Wentland <[email protected]>
drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info()

Wentao Liang <[email protected]>
drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait()

Takashi Iwai <[email protected]>
ALSA: timer: Fix UAF at snd_timer_user_params()

HyeongJun An <[email protected]>
USB: serial: kl5kusb105: fix bulk-out buffer overflow

Jack Wu <[email protected]>
USB: serial: option: add usb-id for Dell Wireless DW5826e-m

Adrian Korwel <[email protected]>
USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()

Adrian Korwel <[email protected]>
USB: serial: io_ti: fix heap overflow in get_manuf_info()

Wyatt Feng <[email protected]>
xfrm: espintcp: do not reuse an in-progress partial send

Gil Portnoy <[email protected]>
ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL

Joonas Lahtinen <[email protected]>
drm/i915/gem: Fix phys BO pread/pwrite with offset

Sean Christopherson <[email protected]>
KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying

Inochi Amaoto <[email protected]>
mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation

Masami Hiramatsu (Google) <[email protected]>
tracing/probes: Point the error offset correctly for eprobe argument error

Michael Bommarito <[email protected]>
Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig

Yuqi Xu <[email protected]>
Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend

Tristan Madani <[email protected]>
netfilter: nft_tunnel: fix use-after-free on object destroy

Alexander A. Klimov <[email protected]>
drm/vc4: fix krealloc() memory leak

Dmitry Osipenko <[email protected]>
drm/virtio: Fix driver removal with disabled KMS

Pengyu Luo <[email protected]>

    clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time

Pablo Neira Ayuso <[email protected]>
netfilter: ctnetlink: ensure safe access to master conntrack

Ido Schimmel <[email protected]>
ipv6: Fix a potential NPD in cleanup_prefix_route()

Til Kaiser <[email protected]>
net: mvpp2: build skb from XDP-adjusted data on XDP_PASS

Til Kaiser <[email protected]>
net: mvpp2: refill RX buffers before XDP or skb use

Lorenzo Bianconi <[email protected]>
net: mvpp2: Add metadata support for xdp mode

Til Kaiser <[email protected]>
net: mvpp2: limit XDP frame size to the RX buffer

Til Kaiser <[email protected]>
net: mvpp2: sync RX data at the hardware packet offset

Florian Westphal <[email protected]>
netfilter: nft_exthdr: fix register tracking for F_PRESENT flag

Xiang Mei <[email protected]>
netfilter: nf_log: validate MAC header was set before dumping it

Kyle Zeng <[email protected]>
netfilter: x_tables: avoid leaking percpu counter pointers

Weiming Shi <[email protected]>
netfilter: nf_conntrack: destroy stale expectfn expectations on unregister

Breno Leitao <[email protected]>
rds: mark snapshot pages dirty in rds_info_getsockopt()

Eric Dumazet <[email protected]>
ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()

Weiming Shi <[email protected]>
net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion

Kyle Zeng <[email protected]>
net: guard timestamp cmsgs to real error queue skbs

Michael Bommarito <[email protected]>
sctp: fix uninit-value in __sctp_rcv_asconf_lookup()

Chih Kai Hsu <[email protected]>
r8152: handle the return value of usb_reset_device()

Adrian Moreno <[email protected]>
net: openvswitch: fix possible kfree_skb of ERR_PTR

Kyle Zeng <[email protected]>
ipv6: sit: reload inner IPv6 header after GSO offloads

Dragos Tatulea <[email protected]>
net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list

Mingyu Wang <[email protected]>
net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove

Maxime Chevallier <[email protected]>
net: phy: clean the sfp upstream if phy probing fails

Yao Sang <[email protected]>
net/mlx4: avoid GCC 10 __bad_copy_from() false positive

Eric Dumazet <[email protected]>
tcp: restrict SO_ATTACH_FILTER to priv users

Richard Fitzgerald <[email protected]>
ASoC: wm_adsp: Fix NULL dereference when removing firmware controls

Yun Zhou <[email protected]>
gpio: mvebu: fix NULL pointer dereference in suspend/resume

Chenguang Zhao <[email protected]>
netlabel: validate unlabeled address and mask attribute lengths

Sanghyun Park <[email protected]>
xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()

Brian Foster <[email protected]>
iomap: don't revert iov_iter on partially completed buffered writes

Mark Rutland <[email protected]>
arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI

Mark Rutland <[email protected]>
arm64: tlb: Allow XZR argument to TLBI ops

Marc Zyngier <[email protected]>
KVM: arm64: Remove VPIPT I-cache handling

Weiming Shi <[email protected]>
tap: free page on error paths in tap_get_user_xdp()

Minh Nguyen <[email protected]>
net: skbuff: fix missing zerocopy reference in pskb_carve helpers

Gabriele Monaco <[email protected]>
tools/rv: Fix cleanup after failed trace setup

Kuen-Han Tsai <[email protected]>
usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo

Kuen-Han Tsai <[email protected]>
usb: gadget: f_ncm: Fix net_device lifecycle with device_move

Ji'an Zhou <[email protected]>
ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams

Naveen Kumar Chaudhary <[email protected]>
time: Fix off-by-one in settimeofday() usec validation

Aleksandr Nogikh <[email protected]>
signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()

Rui Qi <[email protected]>
ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp

Xin Long <[email protected]>
sctp: purge outqueue on stale COOKIE-ECHO handling

Yizhou Zhao <[email protected]>
net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr

Eric Dumazet <[email protected]>
ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()

Andy Roulin <[email protected]>
vxlan: vnifilter: fix spurious notification on VNI update

Andy Roulin <[email protected]>
vxlan: vnifilter: send notification on VNI add

Nithin Dabilpuram <[email protected]>
octeontx2-af: npc: Fix CPT channel mask in npc_install_flow

Lorenzo Bianconi <[email protected]>
net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown

Kurt Kanzenbach <[email protected]>
ptp: vclock: Switch from RCU to SRCU

Eric Dumazet <[email protected]>
ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options

Luiz Augusto von Dentz <[email protected]>
Bluetooth: MGMT: Fix backward compatibility with userspace

Bharath Reddy <[email protected]>
Bluetooth: fix memory leak in error path of hci_alloc_dev()

Zhang Cen <[email protected]>
Bluetooth: bnep: reject short frames before parsing

Dudu Lu <[email protected]>
Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling

SeungJu Cheon <[email protected]>
Bluetooth: RFCOMM: validate skb length in MCC handlers

Zhang Cen <[email protected]>
Bluetooth: MGMT: validate advertising TLV before type checks

Zhang Cen <[email protected]>
Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()

Tapio Reijonen <[email protected]>
net: fec: fix pinctrl default state restore order on resume

David Thompson <[email protected]>
net: lan743x: permit VLAN-tagged packets up to configured MTU

Yizhou Zhao <[email protected]>
net: garp: fix unsigned integer underflow in garp_pdu_parse_attr

Kuniyuki Iwashima <[email protected]>
hsr: Remove WARN_ONCE() in hsr_addr_is_self().

Kuniyuki Iwashima <[email protected]>

    net: Annotate sk->sk_write_space() for UDP SOCKMAP.

Oscar Maes <[email protected]>
pcnet32: stop holding device spin lock during napi_complete_done

Yicong Hui <[email protected]>
drm/imx: Fix three kernel-doc warnings in dcss-scaler.c

Yizhou Zhao <[email protected]>
6lowpan: fix off-by-one in multicast context address compression

Jamal Hadi Salim <[email protected]>
net/sched: act_api: use RCU with deferred freeing for action lifecycle

Guangshuo Li <[email protected]>
dm cache policy smq: check allocation under invalidate lock

Yiming Qian <[email protected]>
netfilter: bridge: make ebt_snat ARP rewrite writable

Jiayuan Chen <[email protected]>
netfilter: nft_ct: bail out on template ct in get eval

Florian Westphal <[email protected]>
netfilter: conntrack_irc: fix possible out-of-bounds read

Fernando Fernandez Mancera <[email protected]>
netfilter: synproxy: add mutex to guard hook reference counting

Julian Anastasov <[email protected]>
ipvs: clear the svc scheduler ptr early on edit

Fernando Fernandez Mancera <[email protected]>
netfilter: xt_NFQUEUE: prefer raw_smp_processor_id

Gil Portnoy <[email protected]>

    ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers

Amirreza Zarrabi <[email protected]>
tee: optee: prevent use-after-free when the client exits before the supplicant

Nicolò Coccia <[email protected]>
net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS

Ido Schimmel <[email protected]>
ipv6: mcast: Fix use-after-free when processing MLD queries

Mingyu Wang <[email protected]>
i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl

Nathan Chancellor <[email protected]>
Disable -Wattribute-alias for clang-23 and newer

Guenter Roeck <[email protected]>
hwmon: (pmbus/core) Protect regulator operations with mutex

Zhu Yanjun <[email protected]>
RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug

Pauli Virtanen <[email protected]>
Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync

Johan Hovold <[email protected]>
USB: serial: mct_u232: fix memory corruption with small endpoint

Kuniyuki Iwashima <[email protected]>
bpf: Free reuseport cBPF prog after RCU grace period.

Michal Pecio <[email protected]>
usb: core: Fix SuperSpeed root hub wMaxPacketSize

Nathan Chancellor <[email protected]>
HID: core: Fix size_t specifier in hid_report_raw_event()

Benjamin Tissoires <[email protected]>
HID: pass the buffer size to hid_report_raw_event

Vicki Pfau <[email protected]>
HID: core: Add printk_ratelimited variants to hid_warn() etc

Maciej W. Rozycki <[email protected]>
serial: zs: Convert to use a platform device

Maciej W. Rozycki <[email protected]>
serial: dz: Convert to use a platform device

Maciej W. Rozycki <[email protected]>
serial: dz: Fix bootconsole handover lockup

Wei-Cheng Chen <[email protected]>
xhci: tegra: Fix ghost USB device on dual-role port unplug

Johan Hovold <[email protected]>
USB: serial: digi_acceleport: fix memory corruption with small endpoints

Mickaël Salaün <[email protected]>
landlock: Fix handling of disconnected directories

Aleksandr Nogikh <[email protected]>
x86/kexec: Disable KCOV instrumentation after load_segments()

Doruk Tan Ozturk <[email protected]>
Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync

Johan Hovold <[email protected]>
USB: serial: cypress_m8: fix memory corruption with small endpoint

Maciej W. Rozycki <[email protected]>
serial: zs: Switch to using channel reset

Maciej W. Rozycki <[email protected]>
serial: zs: Fix bootconsole handover lockup

Maciej W. Rozycki <[email protected]>
serial: dz: Fix bootconsole message clobbering at chip reset

David Francis <[email protected]>
drm/amdkfd: Check for pdd drm file first in CRIU restore path

Eric Huang <[email protected]>
drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger

Eric Huang <[email protected]>
drm/amdkfd: fix NULL pointer bug in svm_range_set_attr

Shitalkumar Gandhi <[email protected]>
serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma

Maciej W. Rozycki <[email protected]>
serial: zs: Fix swapped RI/DSR modem line transition counting

Hongling Zeng <[email protected]>
serial: sh-sci: fix memory region release in error path

Prasanna S <[email protected]>
serial: qcom-geni: fix UART_RX_PAR_EN bit position

Myeonghun Pak <[email protected]>
serial: altera_jtaguart: handle uart_add_one_port() failures

Timur Kristóf <[email protected]>
drm/amd/pm/si: Disregard vblank time when no displays are connected

Janusz Krzysztofik <[email protected]>
drm/i915: Fix potential UAF in TTM object purge

Berkant Koc <[email protected]>
drm/hyperv: validate VMBus packet size in receive callback

Berkant Koc <[email protected]>
drm/hyperv: validate resolution_count and fix WIN8 fallback

Alexandru Hossu <[email protected]>
scsi: target: iscsi: Validate CHAP_R length before base64 decode

Michael Bommarito <[email protected]>
scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf

Michael Bommarito <[email protected]>
scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32

Michael Bommarito <[email protected]>
scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker

Michael Bommarito <[email protected]>
thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow

Michael Bommarito <[email protected]>
thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()

Michael Bommarito <[email protected]>
usb: gadget: f_fs: copy only received bytes on short ep0 read

Seungjin Bae <[email protected]>
usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports

Jeremy Erazo <[email protected]>
usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling

Guangshuo Li <[email protected]>
usb: gadget: f_hid: fix device reference leak in hidg_alloc()

Guangshuo Li <[email protected]>
usb: gadget: net2280: Fix double free in probe error path

Johan Hovold <[email protected]>
USB: serial: mct_u232: fix missing interrupt-in transfer sanity check

Johan Hovold <[email protected]>
USB: serial: mxuport: fix memory corruption with small endpoint

Johan Hovold <[email protected]>
USB: serial: keyspan: fix missing indat transfer sanity check

Zhang Cen <[email protected]>
USB: serial: cypress_m8: validate interrupt packet headers

Zhang Cen <[email protected]>
USB: serial: belkin_sa: validate interrupt status length

Wanquan Zhong <[email protected]>
USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL

Jan Volckaert <[email protected]>
USB: serial: option: add MeiG SRM813Q

Heitor Alves de Siqueira <[email protected]>
usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize

Heitor Alves de Siqueira <[email protected]>
usb: usbtmc: check URB actual_length for interrupt-IN notifications

Michael Bommarito <[email protected]>
usbip: vudc: Fix use after free bug in vudc_remove due to race condition

Sam Burkels <[email protected]>
usb: storage: Add quirks for PNY Elite Portable SSD

Stephen J. Fuhry <[email protected]>
USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers

Michal Pecio <[email protected]>
usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval

Xu Yang <[email protected]>
usb: chipidea: core: convert ci_role_switch to local variable

Zhaoyang Yu <[email protected]>
tty: serial: pch_uart: add check for dma_alloc_coherent()

Guangshuo Li <[email protected]>
counter: Fix refcount leak in counter_alloc() error path

Ian Abbott <[email protected]>
comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest()

Ian Abbott <[email protected]>
comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest()

Nicolás Bazaes <[email protected]>
Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490

Dmitry Torokhov <[email protected]>
Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem

Ali Ganiyev <[email protected]>
ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops

Dmitriy Zharov <[email protected]>
Input: xpad - add support for ASUS ROG RAIKIRI II

Qbeliw Tanaka <[email protected]>
Input: xpad - add "Nova 2 Lite" from GameSir

Jingguo Tan <[email protected]>
xfrm: esp: restore combined single-frag length gate

Srinivas Kandagatla <[email protected]>
ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks

Srinivas Kandagatla <[email protected]>
ASoC: qcom: q6asm-dai: close stream only when running

Hamza Mahfooz <[email protected]>
netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check

Michael Bommarito <[email protected]>
xfrm: ah: use skb_to_full_sk in async output callbacks

Maoyi Xie <[email protected]>
xfrm: route MIGRATE notifications to caller's netns

Ashutosh Desai <[email protected]>
nfc: hci: fix out-of-bounds read in HCP header parsing

Arnd Bergmann <[email protected]>
iommu, debugobjects: avoid gcc-16.1 section mismatch warnings

Lee Jones <[email protected]>
HID: wacom: Fix OOB write in wacom_hid_set_device_mode()

Kuniyuki Iwashima <[email protected]>
ip6: vti: Use ip6_tnl.net in vti6_changelink().

Zhengchuan Liang <[email protected]>
xfrm: input: hold netns during deferred transport reinjection

Qi Tang <[email protected]>
ipv6: validate extension header length before copying to cmsg

Maoyi Xie <[email protected]>
ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().

Zhengchuan Liang <[email protected]>
ipv6: exthdrs: refresh nh after handling HAO option

Srinivas Kandagatla <[email protected]>
ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params

Justin Iurman <[email protected]>
ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()

Junrui Luo <[email protected]>
macsec: fix replay protection at XPN lower-PN wrap

Yuqi Xu <[email protected]>
bpf: sockmap: fix tail fragment offset in bpf_msg_push_data

Dmitry Torokhov <[email protected]>
Input: elan_i2c - validate firmware size before use

Dan Carpenter <[email protected]>
usb: dwc2: Fix use after free in debug code

Peter Chen <[email protected]>
usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles

Yongchao Wu <[email protected]>
usb: cdns3: gadget: fix request skipping after clearing halt

Johan Hovold <[email protected]>
USB: serial: omninet: fix memory corruption with small endpoint

Felix Gu <[email protected]>
iio: buffer: hw-consumer: fix use-after-free in error path

Aldo Conte <[email protected]>
iio: light: cm3323: fix reg_conf not being initialized correctly

Advait Dhamorikar <[email protected]>
iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL

Salah Triki <[email protected]>
iio: temperature: tsys01: fix broken PROM checksum validation

Sanjay Chitroda <[email protected]>
iio: ssp_sensors: cancel delayed work_refresh on remove

David Carlier <[email protected]>
iio: gyro: itg3200: fix i2c read into the wrong stack location

Salah Triki <[email protected]>
iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw

Rodrigo Alencar <[email protected]>
iio: dac: ad5686: acquire lock when doing powerdown control

Rodrigo Alencar <[email protected]>
iio: dac: ad5686: fix input raw value check

Salah Triki <[email protected]>
iio: dac: max5821: fix return value check in powerdown sync

Christofer Jonason <[email protected]>
iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux

Jason A. Donenfeld <[email protected]>
wireguard: send: append trailer after expanding head

Sean Christopherson <[email protected]>
KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC

Qiang Ma <[email protected]>
KVM: arm64: PMU: Preserve AArch32 counter low bits

Wentao Guan <[email protected]>
USB: cdc-acm: Fix bit overlap and move quirk definitions to header

Ben Hutchings <[email protected]>
parport: Fix race between port and client registration

Dmitry Torokhov <[email protected]>
Input: xpad - fix out-of-bounds access for Share button

Muhammad Bilal <[email protected]>
Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock

Muhammad Bilal <[email protected]>
Bluetooth: ISO: fix UAF in iso_recv_frame

Muhammad Bilal <[email protected]>
Bluetooth: HIDP: fix missing length checks in hidp_input_report()

Siwei Zhang <[email protected]>
Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn

Siwei Zhang <[email protected]>
Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()

Stepan Ionichev <[email protected]>
auxdisplay: line-display: fix OOB read on zero-length message_store()

Linpu Yu <[email protected]>
ipc: limit next_id allocation to the valid ID range

Mikulas Patocka <[email protected]>
hpfs: fix a crash if hpfs_map_dnode_bitmap fails

Shuai Zhang <[email protected]>
Bluetooth: btusb: Allow firmware re-download when version matches

hlleng <[email protected]>
HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse

Thomas Fourier <[email protected]>
Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free()

Henri A <[email protected]>
media: rc: igorplugusb: fix control request setup packet

Johan Hovold <[email protected]>
USB: serial: safe_serial: fix memory corruption with small endpoint

Greg Kroah-Hartman <[email protected]>
usb: typec: ucsi: validate connector number in ucsi_connector_change()

Greg Kroah-Hartman <[email protected]>
usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT

Greg Kroah-Hartman <[email protected]>
usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer()

Greg Kroah-Hartman <[email protected]>
usb: typec: altmodes/displayport: validate count before reading Status Update VDO

Greg Kroah-Hartman <[email protected]>
usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO

Greg Kroah-Hartman <[email protected]>
usb: typec: ucsi: ccg: reject firmware images without a ':' record header

Greg Kroah-Hartman <[email protected]>
iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer

Prathamesh Shete <[email protected]>
soc/tegra: pmc: Fix unsafe generic_handle_irq() call

Abdurrahman Hussain <[email protected]>
hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock

Abdurrahman Hussain <[email protected]>
hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock

Harshit Mogalapalli <[email protected]>
x86/kexec: add a sanity check on previous kernel's ima kexec buffer

Harshit Mogalapalli <[email protected]>
of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range()

Harshit Mogalapalli <[email protected]>
ima: verify the previous kernel's IMA buffer lies in addressable RAM

Horatiu Vultur <[email protected]>

    phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X

Will Deacon <[email protected]>
arm64: io: Extract user memory type in ioremap_prot()

Will Deacon <[email protected]>
arm64: io: Rename ioremap_prot() to __ioremap_prot()

Jouni Högander <[email protected]>
drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used

Suraj Kandpal <[email protected]>
drm/dp: Add eDP 1.5 bit definition

Jouni Högander <[email protected]>
drm/i915/psr: Read Intel DPCD workaround register

Jouni Högander <[email protected]>
drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register

Jakub Kicinski <[email protected]>
inet: frags: flush pending skbs in fqdir_pre_exit()

Jakub Kicinski <[email protected]>
inet: frags: add inet_frag_queue_flush()

Thomas Zimmermann <[email protected]>
drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup

Thomas Zimmermann <[email protected]>
drm/fbdev-helper: Set and clear VGA switcheroo client from fb_info

Oliver Neukum <[email protected]>
media: rc: ttusbir: fix inverted error logic

Sean Young <[email protected]>
media: rc: fix race between unregister and urb/irq callbacks

Mikhail Gavrilov <[email protected]>

    mm/page_alloc: clear page->private in free_pages_prepare()

Sven Eckelmann <[email protected]>
batman-adv: bla: avoid double decrement of bla.num_requests

Sven Eckelmann <[email protected]>
batman-adv: tt: avoid empty VLAN responses

Sven Eckelmann <[email protected]>
batman-adv: tt: fix TOCTOU race for reported vlans

Sven Eckelmann <[email protected]>
batman-adv: tp_meter: directly shut down timer on cleanup

Zhengchuan Liang <[email protected]>
net: af_key: zero aligned sockaddr tail in PF_KEY exports

Sven Eckelmann <[email protected]>
batman-adv: tp_meter: avoid role confusion in tp_list

Sven Eckelmann <[email protected]>
batman-adv: iv: recover OGM scheduling after forward packet error

Sven Eckelmann <[email protected]>
batman-adv: tvlv: reject oversized TVLV packets

Sven Eckelmann <[email protected]>
batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface

Sven Eckelmann <[email protected]>
batman-adv: tt: reject oversized local TVLV buffers

Sven Eckelmann <[email protected]>
batman-adv: tvlv: abort OGM send on tvlv append failure

Sven Eckelmann <[email protected]>
batman-adv: v: stop OGMv2 on disabled interface

Yeoreum Yun <[email protected]>
perf: Fix dangling cgroup pointer in cpuctx

Pavel Begunkov <[email protected]>
net: skbuff: fix pskb_carve leaking zcopy pages

Jiayuan Chen <[email protected]>
ipv6: fix possible infinite loop in fib6_select_path()

Jiayuan Chen <[email protected]>
ipv6: fix possible infinite loop in rt6_fill_node()

Zhenghang Xiao <[email protected]>
sctp: fix race between sctp_wait_for_connect and peeloff

Dipayaan Roy <[email protected]>
net: mana: Add NULL guards in teardown path to prevent panic on attach failure

Marco Scardovi <[email protected]>

    gpio: rockchip: convert bank->clk to devm_clk_get_enabled()

Luiz Augusto von Dentz <[email protected]>
Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp

Zhenghang Xiao <[email protected]>

    Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success

Jamal Hadi Salim <[email protected]>
net/sched: Revert "net/sched: Restrict conditions for adding duplicating netems to qdisc tree"

Rahul Chandelkar <[email protected]>
ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()

Jakub Kicinski <[email protected]>
ethtool: eeprom: add more safeties to EEPROM Netlink fallback

Jakub Kicinski <[email protected]>
ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback

Oliver Hartkopp <[email protected]>
bonding: refuse to enslave CAN devices

Zhao Dongdong <[email protected]>
Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()

Cássio Gabriel <[email protected]>
ASoC: codecs: simple-mux: Fix enum control bounds check

Sean Shen <[email protected]>
ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE

Eric Dumazet <[email protected]>
tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()

Eric Dumazet <[email protected]>
vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()

Eric Dumazet <[email protected]>
tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()

Alexander Stein <[email protected]>
gpio: mxc: fix irq_high handling

Luka Gejak <[email protected]>
net: hsr: fix potential OOB access in supervision frame handling

Cássio Gabriel <[email protected]>
ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors

Eric Dumazet <[email protected]>

    ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()

David Jeffery <[email protected]>
scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues

Breno Leitao <[email protected]>
net/iucv: fix locking in .getsockopt

Alexandra Winter <[email protected]>
net/smc: Do not re-initialize smc hashtables

Ilya Maximets <[email protected]>
net: netlink: don't set nsid on local notifications

Ilya Maximets <[email protected]>
net: netlink: fix sending unassigned nsid after assigned one

Ziyu Zhang <[email protected]>
vsock: keep poll shutdown state consistent

Weiming Shi <[email protected]>
tun: free page on build_skb failure in tun_xdp_one()

Weiming Shi <[email protected]>
tun: free page on short-frame rejection in tun_xdp_one()

Fernando Fernandez Mancera <[email protected]>
netfilter: nf_tables: fix dst corruption in same register operation

Jeremy Sowden <[email protected]>
netfilter: bitwise: add support for doing AND, OR and XOR directly

Jeremy Sowden <[email protected]>
netfilter: bitwise: rename some boolean operation functions

Florian Westphal <[email protected]>
netfilter: ebtables: fix OOB read in compat_mtw_from_user

Florian Westphal <[email protected]>
netfilter: xt_cpu: prefer raw_smp_processor_id

Chris Mason <[email protected]>
netfilter: synproxy: refresh tcphdr after skb_ensure_writable

Carl Lee <[email protected]>
nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems

David Ahern <[email protected]>
xfrm: Check for underflow in xfrm_state_mtu

Lee Jones <[email protected]>
nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()

Lee Jones <[email protected]>
nfc: llcp: Fix use-after-free in llcp_sock_release()

Kevin Hao <[email protected]>
net: cpsw_new: Fix potential unregister of netdev that has not been registered yet

Mingzhe Zou <[email protected]>
bcache: fix uninitialized closure object

Carlos Eduardo Gallo Filho <[email protected]>
drm: Remove plane hsub/vsub alignment requirement for core helpers

Victor Nogueria <[email protected]>
net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked

Jeremy Kerr <[email protected]>
net: mctp: ensure our nlmsg responses are initialised

Davide Caratti <[email protected]>
net/sched: cls_fw: fix NULL dereference of "old" filters before change()

Greg Kroah-Hartman <[email protected]>
Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size

-------------

Diffstat:

 Documentation/arch/arm64/silicon-errata.rst        |  48 +++
 Makefile                                           |   4 +-
 arch/arm/include/asm/io.h                          |  15 +-
 arch/arm/kernel/entry-armv.S                       |   2 +-
 arch/arm/mach-socfpga/platsmp.c                    |   1 +
 arch/arm64/Kconfig                                 |  50 +++
 arch/arm64/include/asm/cputype.h                   |   6 +
 arch/arm64/include/asm/io.h                        |  25 +-
 arch/arm64/include/asm/kvm_mmu.h                   |   5 +-
 arch/arm64/include/asm/tlb.h                       |   2 +-
 arch/arm64/include/asm/tlbflush.h                  |  64 ++--
 arch/arm64/kernel/acpi.c                           |   2 +-
 arch/arm64/kernel/cpu_errata.c                     |  34 +-
 arch/arm64/kernel/sys_compat.c                     |   2 +-
 arch/arm64/kvm/hyp/nvhe/mm.c                       |   2 +-
 arch/arm64/kvm/hyp/nvhe/pkvm.c                     |   2 +-
 arch/arm64/kvm/hyp/nvhe/tlb.c                      |  69 +---
 arch/arm64/kvm/hyp/pgtable.c                       |   2 +-
 arch/arm64/kvm/hyp/vhe/tlb.c                       |  21 +-
 arch/arm64/kvm/pmu-emul.c                          |   4 +-
 arch/arm64/mm/ioremap.c                            |   8 +-
 arch/mips/dec/platform.c                           | 109 +++++-
 arch/x86/kernel/Makefile                           |  14 +
 arch/x86/kernel/cpu/amd.c                          |  33 +-
 arch/x86/kernel/setup.c                            |   6 +
 arch/x86/kvm/svm/avic.c                            |  35 +-
 arch/x86/mm/Makefile                               |   2 +
 drivers/auxdisplay/line-display.c                  |   2 +-
 drivers/base/bus.c                                 |  11 +-
 drivers/block/zram/zram_drv.c                      |   2 +-
 drivers/bluetooth/btusb.c                          |   8 +-
 drivers/bluetooth/hci_qca.c                        |  38 +--
 drivers/char/ipmi/ipmi_msghandler.c                |   2 +-
 drivers/char/ipmi/ipmi_ssif.c                      |  29 +-
 drivers/clk/qcom/dispcc-sc8280xp.c                 |   4 +-
 drivers/comedi/drivers/comedi_test.c               |   5 +-
 drivers/counter/counter-core.c                     |   3 +-
 drivers/gpio/gpio-mvebu.c                          |   4 +-
 drivers/gpio/gpio-mxc.c                            |   2 +-
 drivers/gpio/gpio-rockchip.c                       |   6 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c             |   4 +-
 drivers/gpu/drm/amd/amdkfd/kfd_chardev.c           |  10 +-
 .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c  |  10 +-
 drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c   |  49 ++-
 drivers/gpu/drm/amd/amdkfd/kfd_svm.c               |   3 +
 .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c  |   5 +
 drivers/gpu/drm/amd/display/dc/basics/vector.c     |   4 +-
 drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c |  54 ++-
 .../gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c    |   3 +-
 drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c         |   4 +
 drivers/gpu/drm/bridge/sil-sii8620.c               |   1 +
 drivers/gpu/drm/drm_fb_helper.c                    |  12 +-
 drivers/gpu/drm/hyperv/hyperv_drm_proto.c          | 113 ++++++-
 drivers/gpu/drm/i915/display/intel_display_types.h |   1 +
 drivers/gpu/drm/i915/display/intel_dpcd.h          |  15 +
 drivers/gpu/drm/i915/display/intel_psr.c           |  34 +-
 drivers/gpu/drm/i915/gem/i915_gem_phys.c           |  19 +-
 drivers/gpu/drm/i915/gem/i915_gem_ttm.c            |  28 +-
 drivers/gpu/drm/imx/dcss/dcss-scaler.c             |   3 +
 drivers/gpu/drm/vc4/vc4_validate_shaders.c         |  13 +-
 drivers/gpu/drm/virtio/virtgpu_drv.c               |   5 +-
 drivers/gpu/drm/virtio/virtgpu_submit.c            |   4 +-
 drivers/hid/bpf/hid_bpf_dispatch.c                 |   3 +-
 drivers/hid/hid-core.c                             |  35 +-
 drivers/hid/hid-gfrm.c                             |   4 +-
 drivers/hid/hid-ids.h                              |   1 +
 drivers/hid/hid-logitech-hidpp.c                   |   2 +-
 drivers/hid/hid-multitouch.c                       |   2 +-
 drivers/hid/hid-picolcd_cir.c                      |   1 +
 drivers/hid/hid-primax.c                           |   2 +-
 drivers/hid/hid-quirks.c                           |   1 +
 drivers/hid/hid-vivaldi-common.c                   |   2 +-
 drivers/hid/wacom_sys.c                            |  19 +-
 drivers/hid/wacom_wac.h                            |   1 +
 drivers/hwmon/pmbus/adm1266.c                      |  49 ++-
 drivers/hwmon/pmbus/pmbus_core.c                   | 117 +++++--
 drivers/i2c/busses/i2c-qcom-cci.c                  |   2 +-
 drivers/i2c/busses/i2c-stm32f7.c                   |   6 +-
 drivers/i2c/busses/i2c-tegra.c                     |  53 +--
 drivers/i2c/i2c-dev.c                              |   9 +-
 drivers/iio/adc/npcm_adc.c                         |  31 +-
 drivers/iio/adc/viperboard_adc.c                   |   4 +-
 drivers/iio/adc/xilinx-xadc-core.c                 |  11 +-
 drivers/iio/buffer/industrialio-hw-consumer.c      |   4 +-
 drivers/iio/chemical/scd30_core.c                  |  65 ++--
 drivers/iio/common/ssp_sensors/ssp_dev.c           |   1 +
 drivers/iio/dac/ad5686.c                           |  16 +-
 drivers/iio/dac/ad5686.h                           |   1 +
 drivers/iio/dac/max5821.c                          |   9 +-
 drivers/iio/gyro/adis16260.c                       |   3 +
 drivers/iio/gyro/itg3200_buffer.c                  |   2 +-
 drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c     |   2 +-
 drivers/iio/light/cm3323.c                         |   5 +-
 drivers/iio/magnetometer/st_magn_core.c            |  13 +-
 drivers/iio/temperature/tsys01.c                   |   2 +-
 drivers/infiniband/core/Makefile                   |   2 +-
 drivers/infiniband/core/iter.c                     |  43 +++
 drivers/infiniband/core/umem.c                     |  16 +
 drivers/infiniband/core/verbs.c                    |  38 ---
 drivers/infiniband/hw/bnxt_re/qplib_res.c          |   2 +-
 drivers/infiniband/hw/cxgb4/mem.c                  |   2 +-
 drivers/infiniband/hw/efa/efa_verbs.c              |   2 +-
 drivers/infiniband/hw/erdma/erdma_verbs.c          |   2 +-
 drivers/infiniband/hw/hns/hns_roce_alloc.c         |   2 +-
 drivers/infiniband/hw/hns/hns_roce_mr.c            |   4 +
 drivers/infiniband/hw/irdma/main.h                 |   2 +-
 drivers/infiniband/hw/irdma/verbs.c                |   4 +
 drivers/infiniband/hw/mana/mana_ib.h               |   2 +-
 drivers/infiniband/hw/mlx4/mr.c                    |   5 +
 drivers/infiniband/hw/mlx5/mem.c                   |   1 +
 drivers/infiniband/hw/mlx5/mr.c                    |   4 +
 drivers/infiniband/hw/mlx5/umr.c                   |   1 +
 drivers/infiniband/hw/mthca/mthca_provider.c       |   2 +-
 drivers/infiniband/hw/ocrdma/ocrdma_verbs.c        |   2 +-
 drivers/infiniband/hw/qedr/verbs.c                 |   2 +-
 drivers/infiniband/hw/vmw_pvrdma/pvrdma.h          |   2 +-
 drivers/infiniband/sw/rxe/rxe_qp.c                 |   7 +-
 drivers/infiniband/sw/rxe/rxe_verbs.c              |   5 +
 drivers/infiniband/ulp/isert/ib_isert.c            |   6 +
 drivers/infiniband/ulp/srp/ib_srp.c                |  30 +-
 drivers/input/joystick/xpad.c                      |  14 +-
 drivers/input/keyboard/atkbd.c                     |  15 +
 drivers/input/misc/ims-pcu.c                       |   2 +-
 drivers/input/mouse/elan_i2c_core.c                |   5 +
 drivers/input/mouse/synaptics.c                    |   1 +
 drivers/input/touchscreen/atmel_mxt_ts.c           |   2 +-
 drivers/input/touchscreen/usbtouchscreen.c         |   5 +
 drivers/iommu/io-pgtable-arm-v7s.c                 |  18 +-
 drivers/md/bcache/super.c                          |   3 +-
 drivers/md/dm-cache-policy-smq.c                   |  12 +-
 drivers/media/cec/core/cec-core.c                  |   2 +-
 drivers/media/common/siano/smsir.c                 |   1 +
 drivers/media/i2c/ir-kbd-i2c.c                     |   2 +
 drivers/media/pci/bt8xx/bttv-input.c               |   3 +-
 drivers/media/pci/cx23885/cx23885-input.c          |   1 +
 drivers/media/pci/cx88/cx88-input.c                |   3 +-
 drivers/media/pci/dm1105/dm1105.c                  |   1 +
 drivers/media/pci/mantis/mantis_input.c            |   1 +
 drivers/media/pci/saa7134/saa7134-input.c          |   1 +
 drivers/media/pci/smipcie/smipcie-ir.c             |   1 +
 drivers/media/pci/ttpci/budget-ci.c                |   1 +
 drivers/media/rc/ati_remote.c                      |   6 +-
 drivers/media/rc/ene_ir.c                          |   2 +-
 drivers/media/rc/fintek-cir.c                      |   3 +-
 drivers/media/rc/igorplugusb.c                     |   3 +-
 drivers/media/rc/iguanair.c                        |   1 +
 drivers/media/rc/img-ir/img-ir-hw.c                |   3 +-
 drivers/media/rc/img-ir/img-ir-raw.c               |   3 +-
 drivers/media/rc/imon.c                            |   3 +-
 drivers/media/rc/ir-hix5hd2.c                      |   2 +-
 drivers/media/rc/ir_toy.c                          |   1 +
 drivers/media/rc/ite-cir.c                         |   2 +-
 drivers/media/rc/mceusb.c                          |   1 +
 drivers/media/rc/rc-ir-raw.c                       |   5 -
 drivers/media/rc/rc-loopback.c                     |   1 +
 drivers/media/rc/rc-main.c                         |   6 +-
 drivers/media/rc/redrat3.c                         |   4 +-
 drivers/media/rc/st_rc.c                           |   2 +-
 drivers/media/rc/streamzap.c                       |   7 +-
 drivers/media/rc/sunxi-cir.c                       |   1 +
 drivers/media/rc/ttusbir.c                         |   4 +-
 drivers/media/rc/winbond-cir.c                     |   2 +-
 drivers/media/rc/xbox_remote.c                     |   5 +-
 drivers/media/usb/au0828/au0828-input.c            |   1 +
 drivers/media/usb/dvb-usb-v2/dvb_usb_core.c        |   1 +
 drivers/media/usb/dvb-usb/dvb-usb-remote.c         |   6 +-
 drivers/media/usb/em28xx/em28xx-input.c            |   1 +
 drivers/misc/fastrpc.c                             | 107 +++---
 drivers/mmc/core/mmc.c                             |   4 +-
 drivers/mmc/host/litex_mmc.c                       |  20 +-
 drivers/mmc/host/renesas_sdhi_internal_dmac.c      |   1 +
 drivers/mmc/host/sdhci.c                           |   1 +
 drivers/net/bonding/bond_main.c                    |  12 +-
 drivers/net/ethernet/amd/pcnet32.c                 |   4 +-
 drivers/net/ethernet/broadcom/bnxt/bnxt.c          |   2 +-
 drivers/net/ethernet/freescale/fec_main.c          |   3 +-
 drivers/net/ethernet/intel/ice/ice_virtchnl.c      |   2 +-
 drivers/net/ethernet/marvell/mv643xx_eth.c         |   2 +-
 drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c    |  75 +++--
 drivers/net/ethernet/marvell/octeontx2/af/cgx.c    |  13 +-
 drivers/net/ethernet/marvell/octeontx2/af/rvu.c    |   2 +-
 drivers/net/ethernet/marvell/octeontx2/af/rvu.h    |   1 +
 .../net/ethernet/marvell/octeontx2/af/rvu_npc.c    |  32 +-
 .../net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c |   2 +-
 .../ethernet/marvell/octeontx2/nic/otx2_common.c   |   2 +
 drivers/net/ethernet/mediatek/mtk_eth_soc.c        |   2 +-
 drivers/net/ethernet/mellanox/mlx4/cq.c            |   9 +-
 drivers/net/ethernet/mellanox/mlx5/core/cmd.c      |   6 +-
 drivers/net/ethernet/mellanox/mlx5/core/eswitch.c  |  13 +-
 drivers/net/ethernet/mellanox/mlx5/core/vport.c    |  72 +++-
 drivers/net/ethernet/microchip/lan743x_main.c      |  32 ++
 drivers/net/ethernet/microchip/lan743x_main.h      |   1 +
 drivers/net/ethernet/microsoft/mana/mana_en.c      |  72 ++--
 drivers/net/ethernet/ti/cpsw_new.c                 |   4 +-
 drivers/net/hyperv/netvsc.c                        |  19 +-
 drivers/net/macsec.c                               |   3 +-
 drivers/net/phy/mscc/mscc.h                        |   8 +-
 drivers/net/phy/mscc/mscc_main.c                   |  23 +-
 drivers/net/phy/phy_device.c                       |   6 +
 drivers/net/tap.c                                  |   2 +
 drivers/net/tun.c                                  |   5 +-
 drivers/net/usb/r8152.c                            |   7 +-
 drivers/net/vxlan/vxlan_core.c                     |   4 +-
 drivers/net/vxlan/vxlan_vnifilter.c                |   5 +-
 drivers/net/wireguard/send.c                       |  20 +-
 drivers/nfc/nxp-nci/i2c.c                          |  21 +-
 drivers/nvmem/layouts/onie-tlv.c                   |   3 +-
 drivers/of/kexec.c                                 |  15 +-
 drivers/parport/share.c                            |  11 +-
 drivers/platform/x86/intel/vsec.c                  |  34 +-
 drivers/ptp/ptp_vclock.c                           |  14 +-
 drivers/scsi/fcoe/fcoe_ctlr.c                      |   2 +-
 drivers/scsi/scsi_lib.c                            |  27 +-
 drivers/scsi/scsi_transport_fc.c                   |  77 +++--
 drivers/slimbus/qcom-ngd-ctrl.c                    |   5 +-
 drivers/soc/qcom/ice.c                             |  36 +-
 drivers/soc/tegra/pmc.c                            | 104 ++++--
 drivers/staging/greybus/hid.c                      |   2 +-
 drivers/staging/media/av7110/av7110_ir.c           |   1 +
 drivers/target/iscsi/iscsi_target.c                |   6 +-
 drivers/target/iscsi/iscsi_target_auth.c           |  19 +-
 drivers/target/iscsi/iscsi_target_nego.c           |   7 +-
 drivers/target/iscsi/iscsi_target_parameters.c     |  62 +++-
 drivers/target/iscsi/iscsi_target_parameters.h     |   2 +-
 drivers/tee/optee/supp.c                           | 107 ++++--
 drivers/thunderbolt/property.c                     |  38 ++-
 drivers/thunderbolt/xdomain.c                      |  14 +-
 drivers/tty/serdev/core.c                          |  23 +-
 drivers/tty/serial/altera_jtaguart.c               |   7 +-
 drivers/tty/serial/dz.c                            | 171 +++++-----
 drivers/tty/serial/fsl_lpuart.c                    |  15 +-
 drivers/tty/serial/pch_uart.c                      |  19 +-
 drivers/tty/serial/qcom_geni_serial.c              |  17 +-
 drivers/tty/serial/samsung_tty.c                   | 129 ++++---
 drivers/tty/serial/sh-sci.c                        |   2 +-
 drivers/tty/serial/zs.c                            | 218 +++++-------
 drivers/tty/serial/zs.h                            |   1 -
 drivers/usb/cdns3/cdns3-gadget.c                   |  12 +-
 drivers/usb/cdns3/cdns3-plat.c                     |  11 +-
 drivers/usb/chipidea/core.c                        |  16 +-
 drivers/usb/class/cdc-acm.c                        |   2 -
 drivers/usb/class/cdc-acm.h                        |   2 +
 drivers/usb/class/usbtmc.c                         |  14 +
 drivers/usb/core/config.c                          |   9 +-
 drivers/usb/core/hcd.c                             |   4 +-
 drivers/usb/core/quirks.c                          |   4 +
 drivers/usb/dwc2/hcd.c                             |   4 +-
 drivers/usb/dwc3/dwc3-xilinx.c                     |  26 +-
 drivers/usb/gadget/composite.c                     |   5 +-
 drivers/usb/gadget/function/f_fs.c                 |   2 +-
 drivers/usb/gadget/function/f_hid.c                |   3 +-
 drivers/usb/gadget/function/f_ncm.c                |  33 +-
 drivers/usb/gadget/function/f_uvc.c                |  26 +-
 drivers/usb/gadget/function/u_ether.c              |  28 +-
 drivers/usb/gadget/function/u_ether.h              |  26 ++
 drivers/usb/gadget/function/u_ncm.h                |   2 +-
 drivers/usb/gadget/udc/dummy_hcd.c                 |   4 +
 drivers/usb/gadget/udc/net2280.c                   |   4 +-
 drivers/usb/host/xhci-tegra.c                      |  77 +++--
 drivers/usb/musb/omap2430.c                        |   3 +-
 drivers/usb/serial/belkin_sa.c                     |   3 +
 drivers/usb/serial/cypress_m8.c                    |  20 +-
 drivers/usb/serial/digi_acceleport.c               |  23 +-
 drivers/usb/serial/io_ti.c                         |  11 +
 drivers/usb/serial/keyspan.c                       |   4 +
 drivers/usb/serial/kl5kusb105.c                    |   4 +-
 drivers/usb/serial/mct_u232.c                      |  26 +-
 drivers/usb/serial/mxuport.c                       |   8 +
 drivers/usb/serial/omninet.c                       |   9 +-
 drivers/usb/serial/option.c                        |  12 +-
 drivers/usb/serial/safe_serial.c                   |  11 +
 drivers/usb/storage/unusual_uas.h                  |   7 +
 drivers/usb/typec/altmodes/displayport.c           |   2 +
 drivers/usb/typec/tcpm/tcpci_maxim_core.c          |   9 +
 drivers/usb/typec/tcpm/wcove.c                     |  13 +-
 drivers/usb/typec/ucsi/displayport.c               |   4 +
 drivers/usb/typec/ucsi/ucsi.c                      |  24 +-
 drivers/usb/typec/ucsi/ucsi_ccg.c                  |   5 +
 drivers/usb/usbip/vudc_dev.c                       |   1 +
 drivers/usb/usbip/vudc_transfer.c                  |   3 +-
 drivers/video/fbdev/Kconfig                        |   1 +
 drivers/video/fbdev/core/fbcon.c                   |   9 +
 drivers/video/fbdev/vt8500lcdfb.c                  |   4 +-
 fs/fcntl.c                                         |   8 +-
 fs/fuse/dev.c                                      |   9 +-
 fs/hpfs/alloc.c                                    |   2 +-
 fs/iomap/buffered-io.c                             |   4 -
 fs/smb/client/netlink.c                            |   6 +-
 fs/smb/server/oplock.c                             |  15 +-
 fs/smb/server/smb2pdu.c                            | 143 ++++++--
 fs/smb/server/smbacl.c                             |  51 ++-
 fs/smb/server/smbacl.h                             |   2 +
 include/drm/display/drm_dp.h                       |   1 +
 include/drm/drm_fourcc.h                           |   5 +-
 include/linux/bpf_verifier.h                       |   4 +
 include/linux/compat.h                             |   4 +
 include/linux/compiler-clang.h                     |   6 +
 include/linux/compiler_attributes.h                |  11 +
 include/linux/compiler_types.h                     |   4 +
 include/linux/hid.h                                |  15 +-
 include/linux/hid_bpf.h                            |   4 +-
 include/linux/hugetlb.h                            |  16 +-
 include/linux/ima.h                                |   1 +
 include/linux/mlx5/vport.h                         |   4 +-
 include/linux/mm.h                                 |   8 -
 include/linux/parport.h                            |   1 +
 include/linux/serdev.h                             |   1 +
 include/linux/syscalls.h                           |   4 +
 include/media/rc-core.h                            |   2 -
 include/net/act_api.h                              |   1 +
 include/net/bluetooth/l2cap.h                      |   1 +
 include/net/genetlink.h                            |   9 +-
 include/net/inet_frag.h                            |  18 +-
 include/net/ip_vs.h                                |   3 +-
 include/net/ipv6_frag.h                            |   9 +-
 include/net/netfilter/nf_conntrack_core.h          |   5 +
 include/net/netfilter/nf_conntrack_helper.h        |   1 +
 include/net/netfilter/nf_tables.h                  |   7 +
 include/net/sock.h                                 |   1 +
 include/net/xfrm.h                                 |   3 +-
 include/rdma/ib_umem.h                             |  44 +--
 include/rdma/ib_verbs.h                            |  48 ---
 include/rdma/iter.h                                |  88 +++++
 include/uapi/linux/netfilter/nf_tables.h           |  18 +-
 ipc/shm.c                                          |  10 +-
 ipc/util.c                                         |   2 +-
 kernel/bpf/verifier.c                              | 369 +++++++++++++--------
 kernel/cgroup/cpuset.c                             |   8 +-
 kernel/events/core.c                               |  16 +-
 kernel/pid.c                                       |   8 +-
 kernel/signal.c                                    |   1 +
 kernel/time/time.c                                 |   2 +-
 kernel/trace/trace_probe.c                         |   2 -
 lib/debugobjects.c                                 |   2 +-
 mm/damon/ops-common.c                              |   4 +-
 mm/damon/sysfs-schemes.c                           |   8 +-
 mm/gup.c                                           |   2 +-
 mm/huge_memory.c                                   |   2 +
 mm/hugetlb.c                                       | 118 ++++---
 mm/memfd.c                                         |  12 +-
 mm/memory-failure.c                                |  94 +++---
 mm/memory.c                                        |   2 +-
 mm/memory_hotplug.c                                |   2 +-
 mm/mempolicy.c                                     |   2 +-
 mm/migrate.c                                       |  18 +-
 mm/page_alloc.c                                    |   1 +
 net/6lowpan/iphc.c                                 |   4 +-
 net/802/garp.c                                     |   2 +-
 net/802/mrp.c                                      |   9 +
 net/batman-adv/bat_iv_ogm.c                        |  82 ++++-
 net/batman-adv/bat_v_ogm.c                         |  59 ++--
 net/batman-adv/bridge_loop_avoidance.c             |  57 +++-
 net/batman-adv/soft-interface.c                    |   1 +
 net/batman-adv/tp_meter.c                          |  67 ++--
 net/batman-adv/translation-table.c                 |  43 ++-
 net/batman-adv/tvlv.c                              |  28 +-
 net/batman-adv/tvlv.h                              |   2 +-
 net/batman-adv/types.h                             |  42 ++-
 net/bluetooth/6lowpan.c                            |   2 +
 net/bluetooth/bnep/core.c                          |  50 ++-
 net/bluetooth/hci_conn.c                           |   8 +-
 net/bluetooth/hci_sync.c                           |   9 +-
 net/bluetooth/hci_sysfs.c                          |   6 +-
 net/bluetooth/hidp/core.c                          |  23 +-
 net/bluetooth/iso.c                                |  12 +-
 net/bluetooth/l2cap_core.c                         |  87 ++++-
 net/bluetooth/l2cap_sock.c                         |  16 +-
 net/bluetooth/mgmt.c                               |  17 +-
 net/bluetooth/rfcomm/core.c                        |  69 ++--
 net/bluetooth/rfcomm/sock.c                        |  26 +-
 net/bridge/netfilter/ebt_snat.c                    |   3 +
 net/bridge/netfilter/ebtables.c                    |  30 ++
 net/core/drop_monitor.c                            |   2 +-
 net/core/filter.c                                  |  17 +-
 net/core/skbuff.c                                  |  20 +-
 net/core/sock.c                                    |  13 +-
 net/ethtool/eeprom.c                               |  10 +-
 net/hsr/hsr_forward.c                              |   4 +-
 net/hsr/hsr_framereg.c                             |  10 +-
 net/ieee802154/6lowpan/tx.c                        |   5 +
 net/ipv4/ah4.c                                     |   2 +-
 net/ipv4/esp4.c                                    |   4 +-
 net/ipv4/inet_fragment.c                           |  54 ++-
 net/ipv4/ip_fragment.c                             |  21 +-
 net/ipv4/ip_options.c                              |   4 +
 net/ipv4/ip_tunnel_core.c                          |  22 +-
 net/ipv4/netfilter/arp_tables.c                    |  15 +-
 net/ipv4/netfilter/ip_tables.c                     |  15 +-
 net/ipv4/netfilter/nf_nat_h323.c                   |   2 +
 net/ipv4/netfilter/nft_fib_ipv4.c                  |   2 +-
 net/ipv4/sysctl_net_ipv4.c                         |   2 +-
 net/ipv4/udp.c                                     |   8 +
 net/ipv6/addrconf.c                                |  53 +--
 net/ipv6/ah6.c                                     |   2 +-
 net/ipv6/datagram.c                                |  54 ++-
 net/ipv6/esp6.c                                    |   4 +-
 net/ipv6/exthdrs.c                                 |  35 +-
 net/ipv6/ioam6.c                                   |   8 +-
 net/ipv6/ip6_input.c                               |   2 +-
 net/ipv6/ip6_vti.c                                 |  25 +-
 net/ipv6/mcast.c                                   |  22 +-
 net/ipv6/ndisc.c                                   |  18 +-
 net/ipv6/netfilter/ip6_tables.c                    |  15 +-
 net/ipv6/netfilter/nft_fib_ipv6.c                  |   2 +-
 net/ipv6/route.c                                   |   5 +
 net/ipv6/seg6_hmac.c                               |   8 +-
 net/ipv6/sit.c                                     |   1 +
 net/iucv/af_iucv.c                                 |  20 +-
 net/key/af_key.c                                   |  58 ++--
 net/mctp/device.c                                  |   1 +
 net/mctp/neigh.c                                   |   1 +
 net/mctp/route.c                                   |   1 +
 net/mptcp/options.c                                |  73 ++--
 net/mptcp/pm.c                                     |  49 ++-
 net/mptcp/pm_netlink.c                             |  18 +-
 net/mptcp/protocol.c                               | 102 ++++--
 net/mptcp/protocol.h                               |  17 +-
 net/mptcp/sockopt.c                                |   8 +-
 net/mptcp/subflow.c                                |  20 +-
 net/netfilter/ipvs/ip_vs_ctl.c                     |  13 +-
 net/netfilter/ipvs/ip_vs_proto_sctp.c              |  18 +-
 net/netfilter/ipvs/ip_vs_proto_tcp.c               |  21 +-
 net/netfilter/ipvs/ip_vs_proto_udp.c               |  20 +-
 net/netfilter/ipvs/ip_vs_sched.c                   |  14 +-
 net/netfilter/nf_conntrack_ecache.c                |   2 +
 net/netfilter/nf_conntrack_expect.c                |  10 +-
 net/netfilter/nf_conntrack_helper.c                |  19 ++
 net/netfilter/nf_conntrack_irc.c                   |   4 +-
 net/netfilter/nf_conntrack_netlink.c               |  28 +-
 net/netfilter/nf_conntrack_proto_tcp.c             |   3 +-
 net/netfilter/nf_log_syslog.c                      |   4 +-
 net/netfilter/nf_nat_core.c                        |   2 +
 net/netfilter/nf_nat_sip.c                         |   1 +
 net/netfilter/nf_synproxy_core.c                   |  26 +-
 net/netfilter/nft_bitwise.c                        | 184 ++++++++--
 net/netfilter/nft_byteorder.c                      |  13 +-
 net/netfilter/nft_ct.c                             |   8 +-
 net/netfilter/nft_ct_fast.c                        |   2 +-
 net/netfilter/nft_exthdr.c                         |   3 +
 net/netfilter/nft_fib.c                            |   6 +
 net/netfilter/nft_tunnel.c                         |   2 +-
 net/netfilter/xt_NFQUEUE.c                         |   2 +-
 net/netfilter/xt_cpu.c                             |   2 +-
 net/netlabel/netlabel_unlabeled.c                  |  30 +-
 net/netlink/af_netlink.c                           |  11 +-
 net/netlink/genetlink.c                            |   4 +-
 net/nfc/hci/core.c                                 |  10 +
 net/nfc/llcp_core.c                                |  11 +
 net/nfc/llcp_sock.c                                |   2 +
 net/nfc/nci/hci.c                                  |  10 +
 net/openvswitch/datapath.c                         |   1 +
 net/psample/psample.c                              |   2 +-
 net/qrtr/af_qrtr.c                                 |   4 +-
 net/rds/ib_cm.c                                    |   1 +
 net/rds/ib_send.c                                  |   2 +
 net/rds/info.c                                     |   2 +-
 net/rxrpc/ar-internal.h                            |  12 +-
 net/rxrpc/call_event.c                             |  27 +-
 net/rxrpc/call_object.c                            |   2 +
 net/rxrpc/conn_event.c                             |  30 +-
 net/rxrpc/insecure.c                               |   8 +-
 net/rxrpc/recvmsg.c                                |  68 +++-
 net/rxrpc/rxkad.c                                  | 115 +++----
 net/sched/act_api.c                                |   7 +-
 net/sched/cls_fw.c                                 |   6 +-
 net/sched/sch_netem.c                              |  40 ---
 net/sched/sch_sfb.c                                |   2 +-
 net/sctp/diag.c                                    |  17 +-
 net/sctp/input.c                                   |   8 +
 net/sctp/sm_statefuns.c                            |   6 +-
 net/sctp/socket.c                                  |   2 +
 net/sctp/stream.c                                  |   6 +-
 net/smc/af_smc.c                                   |  21 +-
 net/socket.c                                       |  11 +-
 net/unix/af_unix.c                                 |  38 +--
 net/vmw_vsock/af_vsock.c                           |  49 ++-
 net/vmw_vsock/hyperv_transport.c                   |   9 +-
 net/vmw_vsock/virtio_transport_common.c            |  14 +-
 net/vmw_vsock/vmci_transport.c                     |  12 +-
 net/wireless/nl80211.c                             |   3 +
 net/xfrm/espintcp.c                                |   4 +
 net/xfrm/xfrm_input.c                              |  16 +-
 net/xfrm/xfrm_policy.c                             |  15 +-
 net/xfrm/xfrm_state.c                              |  23 +-
 net/xfrm/xfrm_user.c                               |   5 +-
 security/integrity/ima/ima_kexec.c                 |  35 ++
 security/landlock/errata/abi-1.h                   |  16 +
 security/landlock/fs.c                             |  40 ++-
 sound/core/pcm_native.c                            |   7 +-
 sound/core/timer.c                                 |   1 +
 .../motu/motu-register-dsp-message-parser.c        |  14 +-
 sound/pci/hda/patch_hdmi.c                         |   1 +
 sound/soc/codecs/simple-mux.c                      |   2 +-
 sound/soc/codecs/wm_adsp.c                         |   3 +
 sound/soc/fsl/fsl_sai.c                            |   2 +-
 sound/soc/intel/boards/bytcht_es8316.c             |  29 +-
 sound/soc/qcom/qdsp6/q6asm-dai.c                   |  43 +--
 .../selftests/bpf/progs/verifier_scalar_ids.c      | 333 ++++++++++++-------
 .../selftests/bpf/progs/verifier_spill_fill.c      |   4 +-
 .../bpf/progs/verifier_subprog_precision.c         |   2 +-
 tools/testing/selftests/bpf/verifier/precise.c     |   2 +-
 .../test.d/dynevent/eprobes_syntax_errors.tc       |   2 +-
 tools/testing/selftests/mm/hmm-tests.c             |  50 +++
 tools/testing/selftests/net/mptcp/mptcp_connect.sh |   6 +-
 tools/testing/selftests/net/mptcp/mptcp_join.sh    |   4 +
 tools/testing/selftests/ptp/testptp.c              |  62 +---
 tools/verification/rv/src/in_kernel.c              |   2 +-
 virt/kvm/kvm_main.c                                |   3 +-
 508 files changed, 5864 insertions(+), 3002 deletions(-)

Read the cover letter in its thread