6.12.109-rc1 review

Greg Kroah-Hartman linux-patches lkml stable 1 version Sep 4 In review

Get series with b4

b4 am [email protected]

Versions newest first

v1 Latest Sep 4403 patches 25 repliesIn review

Patches in v1 No applies recorded yet

#	Subject and files	Size	Replies
1/403	bnxt_en: Mask the bd_cnt field in the TX BD properly`drivers/net/ethernet/broadcom/bnxt/bnxt.c` `drivers/net/ethernet/broadcom/bnxt/bnxt.h` `drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c`	+5 -4	0 replies
2/403	md: make rdev_addable usable for rcu mode`drivers/md/md.c`	+7 -1	0 replies
3/403	f2fs: fix potential deadloop in prepare_compress_overwrite()`fs/f2fs/compress.c` `fs/f2fs/data.c`	+7 -4	0 replies
4/403	block: mark GFP_NOIO around sysfs ->store()`block/blk-sysfs.c`	+3 -0	0 replies
5/403	drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1`drivers/gpu/drm/amd/display/dc/dml2/dml2_translation_helper.c`	+1 -1	0 replies
6/403	perf/x86/intel/uncore: Fix die ID init and look up bugs`arch/x86/events/intel/uncore.c` `arch/x86/events/intel/uncore_snbep.c`	+7 -7	0 replies
7/403	wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req()`drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c` `drivers/net/wireless/mediatek/mt76/mt7915/mcu.c` `drivers/net/wireless/mediatek/mt76/mt7925/mcu.c`	+18 -6	0 replies
8/403	wifi: ath11k: fix memory leaks in beacon template setup`drivers/net/wireless/ath/ath11k/mac.c`	+17 ~~-11~~	0 replies
9/403	drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths`drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c`	+8 -2	0 replies
10/403	alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally`arch/alpha/include/uapi/asm/fpu.h`	+6 -2	0 replies
11/403	alpha: dont leak hardware-fabricated FP exception bits to user space`arch/alpha/kernel/traps.c` `arch/alpha/math-emu/math.c`	+80 ~~-14~~	0 replies
12/403	clocksource/drivers/timer-sun4i: Advertise a real minimum delta`drivers/clocksource/timer-sun4i.c`	+1 -1	0 replies
13/403	fs: fix user path of nested backing files`fs/backing-file.c`	+1 -1	0 replies
14/403	powerpc/pseries/iommu: switch to Default DMA window during kdump`arch/powerpc/platforms/pseries/iommu.c`	+12 ~~-11~~	0 replies
15/403	timers/itimer: Zero-init old itimerval before copy to userspace`kernel/time/itimer.c`	+1 -1	0 replies
16/403	rust: cfi: disable function merging if CFI is enabled`Makefile`	+2 -1	0 replies
17/403	apparmor: fix cred UAF caused by begin_current_label_crit_section()`security/apparmor/include/cred.h` `security/apparmor/include/task.h` `security/apparmor/task.c`	+39 -9	0 replies
18/403	apparmor: fix out-of-bounds write when null terminating a label vec`security/apparmor/include/label.h`	+3 -3	0 replies
19/403	include/linux/list.h: mark list_add and __list_add as __always_inline`include/linux/list.h`	+11 -4	0 replies
20/403	mm/kmemleak: avoid soft lockup when scanning task stacks`mm/kmemleak.c`	+38 ~~-13~~	0 replies
21/403	mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()`mm/migrate.c`	+1 -1	0 replies
22/403	mm/migrate: use huge_ptep_get() in remove_migration_pte()`mm/migrate.c`	+5 -1	0 replies
23/403	mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg()`mm/page_owner.c`	+7 -3	2 replies
24/403	mm/page_vma_mapped: use huge_ptep_get() for hugetlb`mm/page_vma_mapped.c`	+7 -1	0 replies
25/403	mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec()`mm/vmscan.c`	+1 -1	0 replies
26/403	mm/zswap: fix global shrinker when memory cgroup is disabled`mm/zswap.c`	+7 -6	0 replies
27/403	mm: memcg: stop reclaim when a limit update is superseded`mm/memcontrol.c`	+6 -0	0 replies
28/403	mm: mempolicy: fix automatic numa balancing for shmem`mm/mempolicy.c`	+6 ~~-15~~	0 replies
29/403	tools/compiler: match glibc 2.42 definition of __attribute_const__`tools/include/linux/compiler.h`	+1 -1	0 replies
30/403	x86/tdx: Fix off-by-one in port I/O handling`arch/x86/coco/tdx/tdx.c`	+2 -2	0 replies
31/403	x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg()`arch/x86/include/asm/insn-eval.h` `arch/x86/kvm/emulate.c`	+40 ~~-22~~	0 replies
32/403	x86/tdx: Fix zero-extension for 32-bit port I/O`arch/x86/coco/tdx/tdx.c`	+3 -5	0 replies
33/403	hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start()`drivers/hwtracing/ptt/hisi_ptt.c`	+13 -7	0 replies
34/403	tracing/user_events: Clear copied tracing state before fork duplication`kernel/trace/trace_events_user.c`	+3 -0	0 replies
35/403	tracing: Fix crash passing ERR_PTR to kthread_stop()`kernel/trace/trace_events.c`	+2 -0	0 replies
36/403	tracing: Fix logged instance name on creation failure`kernel/trace/trace.c`	+2 -1	0 replies
37/403	tracing: Fix use-after-free in trace_pipe read on sub-buffer order change`kernel/trace/trace.c`	+3 -0	0 replies
38/403	tracing: Fix use-after-free with same-name named triggers`kernel/trace/trace_events_hist.c`	+3 -1	0 replies
39/403	cdx: Fix double free when sysfs file creation fails`drivers/cdx/cdx.c`	+5 -2	0 replies
40/403	device property: fix infinite loop in fwnode_for_each_child_node()`drivers/base/property.c`	+16 -3	0 replies
41/403	misc: nsm: bound the device-reported response length`drivers/misc/nsm.c`	+1 -1	0 replies
42/403	powerpc/powermac: fix OF node refcount`arch/powerpc/platforms/powermac/low_i2c.c`	+1 -1	0 replies
43/403	rapidio: mport_cdev: fix use-after-free in dma_req_free()`drivers/rapidio/devices/rio_mport_cdev.c`	+7 -3	0 replies
44/403	Revert "media: v4l2-dev: fix error handling in __video_register_device()"`drivers/media/v4l2-core/v4l2-dev.c`	+7 -7	0 replies
45/403	serial: imx: serialize imx_uart_ports[] lifetime`drivers/tty/serial/imx.c`	+17 -3	0 replies
46/403	staging: greybus: hid: fix SET_REPORT return value`drivers/staging/greybus/hid.c`	+1 -1	0 replies
47/403	usb: dwc2: gadget: Exit partial power down state when changing USB pull-up`drivers/usb/dwc2/gadget.c`	+10 -1	0 replies
48/403	usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed`drivers/usb/gadget/udc/at91_udc.c`	+19 -1	0 replies
49/403	USB: phy: fsl-usb: fix missing static keywords`drivers/usb/phy/phy-fsl-usb.c` `drivers/usb/phy/phy-fsl-usb.h`	+29 ~~-29~~	0 replies
50/403	usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive()`drivers/usb/typec/tcpm/tcpci.c` `include/linux/usb/tcpci.h`	+12 -1	0 replies
51/403	usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion`drivers/usb/typec/ucsi/ucsi.c`	+2 -1	0 replies
52/403	usb: gadget: u_audio: Fix use-after-free on sound card disconnect`drivers/usb/gadget/function/u_audio.c`	+18 -6	0 replies
53/403	usb: gadget: snps_udc_plat: clean up PHY on probe deferral`drivers/usb/gadget/udc/snps_udc_plat.c`	+2 -3	0 replies
54/403	usb: gadget: midi2: remove default configfs groups on teardown`drivers/usb/gadget/function/f_midi2.c`	+2 -0	0 replies
55/403	usb: gadget: f_tcm: fix deadlock in usbg_make_tpg()`drivers/usb/gadget/function/f_tcm.c`	+12 ~~-11~~	0 replies
56/403	usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()`drivers/usb/gadget/function/f_uvc.c`	+6 -1	0 replies
57/403	usb: gadget: f_fs: Prevent deadlock during ep0 read loop`drivers/usb/gadget/function/f_fs.c`	+10 -4	0 replies
58/403	fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write`drivers/fpga/altera-cvp.c`	+6 -4	0 replies
59/403	HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature`drivers/hid/hid-sensor-hub.c`	+26 ~~-18~~	0 replies
60/403	lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()`lib/ucs2_string.c`	+1 -1	0 replies
61/403	media: cec: stm32: prevent out-of-bounds write on RX overflow`drivers/media/cec/platform/stm32/stm32-cec.c`	+2 -1	0 replies
62/403	media: vicodec: fix out-of-bounds write in FWHT encoder`drivers/media/test-drivers/vicodec/vicodec-core.c`	+2 -2	0 replies
63/403	nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation`fs/nilfs2/bmap.c` `fs/nilfs2/bmap.h` `fs/nilfs2/btree.c` +1 more	+36 ~~-11~~	0 replies
64/403	of: fix out-of-bounds read in of_alias_scan() stem parser`drivers/of/base.c`	+1 -1	0 replies
65/403	PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io()`arch/powerpc/kernel/pci-common.c` `drivers/pci/pci-sysfs.c`	+17 ~~-10~~	0 replies
66/403	ubifs: fix out-of-bounds read in signature length check`fs/ubifs/auth.c`	+1 -1	0 replies
67/403	zsmalloc: account for handle size in class lookup`mm/zsmalloc.c`	+7 -4	0 replies
68/403	NFSD: check truncate permission under inode lock`fs/nfsd/vfs.c`	+18 ~~-12~~	0 replies
69/403	NFSD: Encode only the status in NFS-ACL v2 GETACL error replies`fs/nfsd/nfs2acl.c`	+15 ~~-16~~	0 replies
70/403	NFSD: Fix off-by-one in DRC bucket pruning limit`fs/nfsd/nfscache.c`	+1 -1	0 replies
71/403	NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock`fs/nfsd/nfs4state.c`	+25 ~~-19~~	0 replies
72/403	NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check`fs/nfsd/nfsfh.c`	+1 -3	0 replies
73/403	nfsd: guard nfsd_serv deref in nfsd_file_net_dispose`fs/nfsd/filecache.c`	+12 -3	0 replies
74/403	NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path`fs/nfs/pnfs.c`	+1 -0	0 replies
75/403	pNFS: Fix EBUSY check in pnfs_layout_need_return`fs/nfs/pnfs.c`	+1 -1	0 replies
76/403	nfsd: release path refs on follow_down() error`fs/nfsd/vfs.c`	+3 -1	0 replies
77/403	nfsd: Reset write verifier when async COPY writeback fails`fs/nfsd/nfs4proc.c`	+2 -0	0 replies
78/403	nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types`fs/nfsd/nfs4xdr.c`	+13 -0	0 replies
79/403	nfsd: sample writeback error cursor before async COPY loop`fs/nfsd/nfs4proc.c`	+1 -1	0 replies
80/403	nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations`fs/nfsd/nfs4state.c`	+1 -0	0 replies
81/403	nfsd: size fh_verify server sockaddr slot by xpt_locallen`fs/nfsd/trace.h`	+2 -2	0 replies
82/403	nfsd: validate symlink target length in NFSv4 CREATE`fs/nfsd/nfs4xdr.c`	+4 -0	0 replies
83/403	nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()`fs/nfsd/nfsproc.c`	+7 -0	0 replies
84/403	nfsd: add filehandle match check to nfsd4_delegreturn()`fs/nfsd/nfs4state.c`	+4 -0	0 replies
85/403	nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry`fs/nfsd/nfsctl.c`	+7 -4	0 replies
86/403	nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref`fs/nfsd/nfs4proc.c`	+16 -3	0 replies
87/403	nfsd: check client ownership when cancelling a copy-notify stateid`fs/nfsd/nfs4state.c`	+12 -2	0 replies
88/403	nfsd: clear opcnt on compound arg release to prevent OOB read`fs/nfsd/nfs4xdr.c`	+1 -0	0 replies
89/403	nfsd: defer vfree of compound ops to fix rpc_status UAF`fs/nfsd/nfs4xdr.c`	+3 -1	0 replies
90/403	nfsd: drop the stateid, not the stateowner, on seqid_op replay retry`fs/nfsd/nfs4state.c`	+1 -1	0 replies
91/403	nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke`fs/nfsd/nfs4layouts.c`	+9 -3	0 replies
92/403	nfsd: fix cpntf publish race in nfs4_init_cp_state`fs/nfsd/nfs4state.c`	+25 ~~-10~~	0 replies
93/403	nfsd: fix dentry ref leak on V4ROOT export filehandle lookup`fs/nfsd/nfsfh.c`	+6 -2	0 replies
94/403	nfsd: fix nfsd_file leak on inter-server COPY setup failure`fs/nfsd/nfs4proc.c`	+4 -6	0 replies
95/403	nfsd: fix reply size estimate for GET_DIR_DELEGATION`fs/nfsd/nfs4proc.c`	+1 -1	0 replies
96/403	nfsd: fix version mismatch loops in nfsd_acl_init_request()`fs/nfsd/nfssvc.c`	+2 -2	0 replies
97/403	nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget`fs/nfsd/flexfilelayoutxdr.c`	+11 -6	0 replies
98/403	nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo`fs/nfsd/flexfilelayoutxdr.c`	+2 -1	0 replies
99/403	nfsd: gate nfs2 setacl by argp->mask`fs/nfsd/nfs2acl.c`	+13 -8	0 replies
100/403	nfsd: gate nfs3 setacl by argp->mask`fs/nfsd/nfs3acl.c`	+11 -6	0 replies
101/403	nfsd: initialize copy-notify stateid before publishing it`fs/nfsd/nfs4proc.c` `fs/nfsd/nfs4state.c`	+18 -8	0 replies
102/403	nfsd: initialize DRC hash table before registering shrinker`fs/nfsd/nfscache.c`	+2 -2	0 replies
103/403	nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops`fs/nfsd/nfs3proc.c`	+40 -0	0 replies
104/403	nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE`fs/nfsd/nfsxdr.c`	+22 ~~-10~~	0 replies
105/403	nfsd: reject reclaim LOCK after RECLAIM_COMPLETE`fs/nfsd/nfs4state.c`	+3 -0	0 replies
106/403	nfsd: revoke copy-notify stateids before dropping their reference`fs/nfsd/nfs4state.c`	+62 ~~-16~~	0 replies
107/403	NFSD: Prevent lock owner use-after-free during client teardown`fs/nfsd/nfs4state.c`	+13 -3	0 replies
108/403	NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup`fs/nfsd/nfs4state.c`	+6 -0	0 replies
109/403	libceph: validate OSD extent maps before cursor advance`net/ceph/osd_client.c`	+30 -0	0 replies
110/403	libceph: reject buckets with mismatched CRUSH ids`net/ceph/osdmap.c`	+2 -0	0 replies
111/403	ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock`fs/ceph/caps.c`	+9 -2	0 replies
112/403	ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode`fs/ceph/mdsmap.c`	+4 -0	0 replies
113/403	ceph: bound copied dentry name length in NFS export get_name`fs/ceph/export.c`	+17 -9	0 replies
114/403	ceph: bound MDSCapAuth path and fs_name decode in handle_session()`fs/ceph/mds_client.c`	+6 -2	0 replies
115/403	ceph: bound num_export_targets array for mds info v2/v3`fs/ceph/mdsmap.c`	+6 -1	0 replies
116/403	ceph: bound xattr value length in __build_xattrs()`fs/ceph/xattr.c`	+1 -0	0 replies
117/403	ceph: do not repeat ceph_trim_dentries() if no progress possible`fs/ceph/dir.c`	+7 -3	0 replies
118/403	btrfs: drop recovered reloc root refs on recovery failure`fs/btrfs/relocation.c`	+27 -4	0 replies
119/403	audit: avoid dropping live tree ref on fsnotify rule autoremove`kernel/auditfilter.c`	+2 -4	0 replies
120/403	cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0`fs/smb/client/cifsfs.c`	+13 -2	0 replies
121/403	smb: client: clear ce->tgthint in free_tgts()`fs/smb/client/dfs_cache.c`	+2 -0	0 replies
122/403	smb: client: fix ALIGN() overflow in symlink_data() error context loop`fs/smb/client/smb2file.c`	+4 -1	0 replies
123/403	smb: client: fix copy-paste error in WSL EA length accounting for $LXDEV`fs/smb/client/smb1ops.c`	+1 -1	0 replies
124/403	smb: client: harden DFS cache against invalid target hints`fs/smb/client/dfs_cache.c`	+24 -7	0 replies
125/403	HID: picolcd: clamp eeprom debugfs read to bytes actually received`drivers/hid/hid-picolcd_debugfs.c`	+9 -0	0 replies
126/403	HID: roccat: free buffered reports when destroying device`drivers/hid/hid-roccat.c`	+11 -2	0 replies
127/403	HID: sensor: custom: Fix field sysfs group cleanup on failure`drivers/hid/hid-sensor-custom.c`	+8 -1	0 replies
128/403	HID: mcp2221: stop device IO before hid_hw_stop`drivers/hid/hid-mcp2221.c`	+2 -0	0 replies
129/403	HID: mcp2221: validate report size in mcp2221_raw_event()`drivers/hid/hid-mcp2221.c`	+7 -0	0 replies
130/403	eventfs: Initialize ei->children and ei->list in init_ei()`fs/tracefs/event_inode.c`	+2 -5	0 replies
131/403	fs/ntfs3: validate dirty page table on log replay`fs/ntfs3/fslog.c`	+19 -0	0 replies
132/403	fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()`fs/ntfs3/frecord.c`	+9 -0	0 replies
133/403	fs/ntfs3: bound page_lcns[] index by the log record`fs/ntfs3/fslog.c`	+15 -0	0 replies
134/403	eCryptfs: bound the packet-length peek to the user buffer`fs/ecryptfs/miscdev.c`	+3 -2	0 replies
135/403	ecryptfs: fix tag 11 packet exact-fit size check`fs/ecryptfs/keystore.c`	+1 -1	0 replies
136/403	ecryptfs: hold msg ctx list lock when cleaning daemon queue`fs/ecryptfs/messaging.c`	+2 -0	0 replies
137/403	ecryptfs: pass packet set buffer size to parser`fs/ecryptfs/crypto.c` `fs/ecryptfs/ecryptfs_kernel.h` `fs/ecryptfs/keystore.c`	+23 -5	0 replies
138/403	ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet`fs/ecryptfs/keystore.c`	+12 -2	0 replies
139/403	ecryptfs: reject too-small tag 70 packets`fs/ecryptfs/keystore.c`	+6 -0	0 replies
140/403	ecryptfs: release message context on send failure`fs/ecryptfs/messaging.c`	+8 -1	0 replies
141/403	ecryptfs: show filename encryption options`fs/ecryptfs/super.c`	+7 -0	0 replies
142/403	efivarfs: Rate limit statfs() handler`fs/efivarfs/super.c`	+24 -6	0 replies
143/403	fat: restore original value when fat_ent_write failed`fs/fat/misc.c`	+4 -0	0 replies
144/403	fbdev: omapfb: panel-dsi-cm: initialize lock before registering display`drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c`	+2 -2	0 replies
145/403	fbdev: pvr2fb: correct user pointer annotation and sentinel initializer`drivers/video/fbdev/pvr2fb.c`	+2 -2	0 replies
146/403	fbdev: ssd1307fb: defer I2C transfers from damage callbacks`drivers/video/fbdev/ssd1307fb.c`	+67 -5	0 replies
147/403	fbdev: uvesafb: unregister connector callback on init failure`drivers/video/fbdev/uvesafb.c`	+2 -0	0 replies
148/403	forcedeth: fix off-by-one when saving/restoring non-PCI config space`drivers/net/ethernet/nvidia/forcedeth.c`	+2 -2	0 replies
149/403	fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration`drivers/fpga/stratix10-soc.c`	+12 -9	0 replies
150/403	hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device`drivers/hsi/controllers/omap_ssi_core.c`	+6 -0	0 replies
151/403	ACPI: APEI: Fix ERST timeout unit conversion`drivers/acpi/apei/erst.c`	+1 -1	0 replies
152/403	ACPI: APEI: GHES: fix ARM section length accounting after header`drivers/acpi/apei/ghes.c`	+1 -1	0 replies
153/403	ACPI: pfr_update: fix stack buffer overflow in query_capability()`drivers/acpi/pfr_update.c`	+24 ~~-21~~	0 replies
154/403	alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write()`arch/alpha/kernel/pci-sysfs.c`	+3 -3	0 replies
155/403	alpha: marvel: Fix irq_set_status_flags to use correct IRQ number`arch/alpha/kernel/sys_marvel.c`	+2 -2	0 replies
156/403	alpha: marvel: Fix lock ordering in init_io7_irqs()`arch/alpha/kernel/sys_marvel.c`	+12 ~~-13~~	0 replies
157/403	ARM: 9477/1: Disable broken eBPF JIT on the Risc PC`arch/arm/Kconfig`	+1 -1	0 replies
158/403	ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes`drivers/ata/libata-scsi.c`	+14 ~~-14~~	0 replies
159/403	auxdisplay: charlcd: cancel backlight work on registration failure`drivers/auxdisplay/charlcd.c`	+14 -7	0 replies
160/403	block: set QUEUE_FLAG_DYING unconditionally in blk_mark_disk_dead()`block/genhd.c`	+1 -0	0 replies
161/403	Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU`drivers/bluetooth/btusb.c`	+4 -0	2 replies
162/403	Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU`drivers/bluetooth/btusb.c`	+2 -0	0 replies
163/403	Bluetooth: eir: Fix OOB read in eir_get_service_data()`net/bluetooth/eir.c`	+2 -1	0 replies
164/403	bnx2x: fix double free in bnx2x_init_firmware() error path`drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c`	+3 -0	0 replies
165/403	bpf, x86: Fix per-CPU address resolution into an extended register`arch/x86/net/bpf_jit_comp.c`	+1 -1	0 replies
166/403	bpf: Disable preemption in __bpf_get_stack`kernel/bpf/stackmap.c`	+3 -0	0 replies
167/403	bpf: Harden bloom filter sizing and indexing on 32-bit kernels`kernel/bpf/bloom_filter.c`	+9 ~~-10~~	0 replies
168/403	dm-era: fix shadowed superblock leak on take-snap failure`drivers/md/dm-era-target.c`	+5 -0	0 replies
169/403	dm raid1: reserve space for NUL-terminator in build_constructor_string()`drivers/md/dm-log-userspace-base.c`	+1 -0	0 replies
170/403	dm array: validate array block headers on read`drivers/md/persistent-data/dm-array.c`	+29 -8	0 replies
171/403	dm array: reject an array block whose value size is not the callers`drivers/md/persistent-data/dm-array.c`	+16 -0	0 replies
172/403	coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior`drivers/hwtracing/coresight/coresight-etm3x-sysfs.c`	+4 ~~-11~~	0 replies
173/403	cpufreq: schedutil: Fix rate limit overflow`kernel/sched/cpufreq_schedutil.c`	+13 -2	0 replies
174/403	cxl/pmem: Format the nvdimm serial number as unsigned decimal`Documentation/ABI/testing/sysfs-bus-nvdimm` `drivers/cxl/core/pmem.c` `drivers/cxl/cxl.h` +1 more	+11 -7	0 replies
175/403	Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378`drivers/bluetooth/hci_bcm4377.c`	+1 -0	0 replies
176/403	Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative`drivers/bluetooth/hci_bcm.c`	+1 -0	0 replies
177/403	Bluetooth: hci_uart: Fix false success return in hci_uart_setup()`drivers/bluetooth/hci_ldisc.c` `drivers/bluetooth/hci_serdev.c`	+2 -2	0 replies
178/403	Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready`net/bluetooth/iso.c`	+8 -0	0 replies
179/403	Bluetooth: RFCOMM: serialize security confirmation handling`net/bluetooth/rfcomm/core.c`	+7 -1	0 replies
180/403	Bluetooth: hci_conn: re-enable advertising only for peripheral role`net/bluetooth/hci_conn.c`	+2 -1	0 replies
181/403	Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb`net/bluetooth/hci_core.c`	+1 -1	0 replies
182/403	Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection`net/bluetooth/hci_event.c`	+4 -3	0 replies
183/403	Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative`drivers/bluetooth/hci_h5.c`	+3 -1	0 replies
184/403	Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative`drivers/bluetooth/hci_intel.c`	+1 -0	0 replies
185/403	Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request`net/bluetooth/hci_sync.c`	+2 -0	0 replies
186/403	kasan: fix cache shrink race with CPU hotplug`mm/kasan/quarantine.c`	+6 -1	0 replies
187/403	jbd2: bound shrinker scans by examined checkpoint buffers`fs/jbd2/checkpoint.c`	+13 ~~-12~~	0 replies
188/403	jbd2: check need_resched() when skipping busy checkpoint buffers`fs/jbd2/checkpoint.c`	+2 -1	0 replies
189/403	ipip: fix skb leak in collect_md mode when metadata_dst allocation fails`net/ipv4/ipip.c`	+1 -1	0 replies
190/403	ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()`net/ipv6/ip6_tunnel.c`	+2 ~~-13~~	0 replies
191/403	ip6_gre: fix hardware header length for NBMA tunnels`net/ipv6/ip6_gre.c`	+4 -9	0 replies
192/403	ipv6: use RCU iterator to dump route exceptions`net/ipv6/route.c`	+1 -1	0 replies
193/403	libnvdimm/labels: Prevent integer overflow in __nd_label_validate()`drivers/nvdimm/label.c`	+1 -1	0 replies
194/403	mailbox: qcom-ipcc: fix duplicate channel allocation across holes`drivers/mailbox/qcom-ipcc.c`	+11 -6	0 replies
195/403	md/raid10: fix still_degraded being inverted in raid10_sync_request()`drivers/md/raid10.c`	+1 -1	0 replies
196/403	md: do overflow check for sb->bblog_shift in super_1_load()`drivers/md/md.c`	+7 -0	0 replies
197/403	mpls: reload header after pskb_may_pull()`net/mpls/af_mpls.c`	+2 -0	0 replies
198/403	mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction`net/mptcp/syncookies.c`	+1 -0	0 replies
199/403	nouveau/gem: reserve the bo in the info ioctl around the vma lookup`drivers/gpu/drm/nouveau/nouveau_gem.c`	+10 -1	0 replies
200/403	params: fix charp corruption on allocation failure`kernel/params.c`	+8 -6	0 replies
201/403	SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow`net/sunrpc/xdr.c`	+1 -1	0 replies
202/403	SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry`net/sunrpc/auth_gss/svcauth_gss.c`	+3 -0	0 replies
203/403	SUNRPC: svcauth_gss: enforce krb5 token minimum length`net/sunrpc/auth_gss/svcauth_gss.c`	+2 -0	0 replies
204/403	sunrpc: route to a populated pool in svc_pool_for_cpu()`net/sunrpc/svc.c`	+28 -1	0 replies
205/403	SUNRPC: always drain cache_cleaner before destroying a cache_detail`net/sunrpc/cache.c`	+3 -4	0 replies
206/403	SUNRPC: Check svc pool percpu counter allocation`net/sunrpc/svc.c`	+39 -6	0 replies
207/403	SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat`net/sunrpc/auth_gss/svcauth_gss.c`	+2 -0	0 replies
208/403	SUNRPC: harden gss_krb5_unwrap_v2 against short tokens`net/sunrpc/auth_gss/gss_krb5_wrap.c`	+9 -2	0 replies
209/403	SUNRPC: harden gss_unwrap_resp_priv length checks`net/sunrpc/auth_gss/auth_gss.c`	+5 -1	0 replies
210/403	sunrpc: init gssp_lock before publishing proc entry`net/sunrpc/auth_gss/gss_rpc_upcall.c` `net/sunrpc/auth_gss/gss_rpc_upcall.h` `net/sunrpc/auth_gss/svcauth_gss.c` +1 more	+1 -8	0 replies
211/403	SUNRPC: reject duplicate CREDS_VALUE options`net/sunrpc/auth_gss/gss_rpc_xdr.c`	+6 -0	2 replies
212/403	SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field`net/sunrpc/auth_gss/gss_krb5_wrap.c`	+2 -0	0 replies
213/403	SUNRPC: wait for in-flight client TLS handshake callback`net/sunrpc/xprtsock.c`	+11 -1	0 replies
214/403	svcrdma: Fix offset arithmetic in read_chunk_range`net/sunrpc/xprtrdma/svc_rdma_rw.c`	+7 -2	0 replies
215/403	svcrdma: Fix pcl_for_each_segment for empty chunks`include/linux/sunrpc/svc_rdma_pcl.h`	+1 -1	0 replies
216/403	svcrdma: Fix unmatched rn_unregister on failed accept`net/sunrpc/xprtrdma/ib_client.c` `net/sunrpc/xprtrdma/svc_rdma_transport.c`	+44 -8	0 replies
217/403	svcrdma: Reject connection when transport allocation fails`net/sunrpc/xprtrdma/svc_rdma_transport.c`	+10 -6	0 replies
218/403	svcrdma: Reject inline replies that overflow the pull-up buffer`net/sunrpc/xprtrdma/svc_rdma_sendto.c`	+32 ~~-15~~	0 replies
219/403	svcrdma: Use svc_xprt_put to free listener on create failure`net/sunrpc/xprtrdma/svc_rdma_transport.c`	+7 -1	2 replies
220/403	svcrdma: Validate Read chunk positions before reconstruction`net/sunrpc/xprtrdma/svc_rdma_rw.c`	+30 -8	0 replies
221/403	udf: reject VAT indexes equal to the entry count`fs/udf/partition.c`	+1 -1	0 replies
222/403	wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets`drivers/net/wireless/ath/ath6kl/cfg80211.c`	+5 -0	0 replies
223/403	staging: media: tegra-video: fix of_node_put() on VIP parse errors`drivers/staging/media/tegra-video/vip.c`	+3 -7	0 replies
224/403	staging: media: tegra-video: vi: fix probe failure on skipped last port`drivers/staging/media/tegra-video/vi.c`	+5 -4	0 replies
225/403	scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()`drivers/scsi/scsi_lib.c`	+2 -0	0 replies
226/403	rpmsg: glink: smem: order FIFO read after availability check`drivers/rpmsg/qcom_glink_smem.c`	+7 -0	0 replies
227/403	arm64: dts: qcom: sm6115-pro1x: Correct touchscreen GPIO flags`arch/arm64/boot/dts/qcom/sm6115-fxtec-pro1x.dts`	+1 -1	0 replies
228/403	arm64: dts: rockchip: fix eMMC reset polarity on PX30 Ringneck`arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi`	+1 -1	0 replies
229/403	arm64: dts: rockchip: Fix rk3399-roc-pc-plus analog audio`arch/arm64/boot/dts/rockchip/rk3399-roc-pc-plus.dts`	+12 -0	0 replies
230/403	riscv: acpi: Handle LPI architectural context loss flags`arch/riscv/include/asm/acpi.h`	+19 -0	0 replies
231/403	remoteproc: scp: Fix device reference leak on failed lookup`drivers/remoteproc/mtk_scp.c`	+8 -1	0 replies
232/403	qede: Fix NULL pointer dereference in TPA fragment processing`drivers/net/ethernet/qlogic/qede/qede.h` `drivers/net/ethernet/qlogic/qede/qede_fp.c`	+5 -4	0 replies
233/403	RDMA/cxgb4: Cancel reg_work before freeing device on remove`drivers/infiniband/hw/cxgb4/device.c`	+6 -0	0 replies
234/403	RDMA/ucma: Lock the handler in ucma_set_ib_path()`drivers/infiniband/core/ucma.c`	+4 -1	0 replies
235/403	regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer`drivers/regulator/as3722-regulator.c`	+0 -1	0 replies
236/403	regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata`drivers/regulator/max8998.c`	+0 -1	0 replies
237/403	regulator: qcom-refgen: correct the regulator type to CURRENT`drivers/regulator/qcom-refgen-regulator.c`	+2 -2	0 replies
238/403	ring-buffer: Free cpu_buffer::free_page with subbuf_order`kernel/trace/ring_buffer.c`	+1 -1	0 replies
239/403	ring-buffer: Hold cpu_buffer::lock when resizing a subbuf`kernel/trace/ring_buffer.c`	+2 -0	0 replies
240/403	orangefs: fix double-free of trailer_buf on readdir copy failure`fs/orangefs/devorangefs-req.c`	+1 -0	0 replies
241/403	orangefs: skip leading spaces before parsing client debug masks`fs/orangefs/orangefs-debugfs.c`	+1 -0	0 replies
242/403	ocfs2: always run deallocs on copy-on-write completion`fs/ocfs2/refcounttree.c` `fs/ocfs2/xattr.c`	+10 ~~-15~~	0 replies
243/403	ocfs2: bound namelen in dlm_migrate_request_handler`fs/ocfs2/dlm/dlmmaster.c`	+6 -0	0 replies
244/403	ocfs2: validate lengths in dlm_mig_lockres_handler`fs/ocfs2/dlm/dlmrecovery.c`	+9 -0	0 replies
245/403	ocfs2: validate rl_used against rl_count in refcount block validator`fs/ocfs2/refcounttree.c`	+27 -0	0 replies
246/403	ocfs2: cluster: dont sleep while holding o2hb_live_lock in o2hb_region_pin()`fs/ocfs2/cluster/heartbeat.c`	+101 ~~-25~~	0 replies
247/403	ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item`fs/ocfs2/cluster/heartbeat.c` `fs/ocfs2/cluster/nodemanager.c` `fs/ocfs2/cluster/nodemanager.h`	+17 -7	0 replies
248/403	ocfs2: cluster: fix o2hb_dependent_users leak on pin failure`fs/ocfs2/cluster/heartbeat.c`	+6 -1	0 replies
249/403	ocfs2: fix readdir position truncation on 32-bit kernels`fs/ocfs2/dir.c`	+1 -1	0 replies
250/403	openrisc: fix arbitrary kernel memory access via or1k_atomic syscall`arch/openrisc/kernel/entry.S`	+39 -4	0 replies
251/403	openvswitch: only skb_tx_error() a packet we are about to drop`net/openvswitch/datapath.c`	+1 -2	0 replies
252/403	ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion`sound/core/ump_convert.c`	+1 -0	0 replies
253/403	arm64: compat: Fix decrementing LDM/STM alignment emulation`arch/arm64/kernel/compat_alignment.c`	+2 -2	0 replies
254/403	ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC`sound/soc/amd/yc/acp6x-mach.c`	+7 -0	0 replies
255/403	hwmon: (max6621) fix negative temperature offset and crit readings`drivers/hwmon/max6621.c`	+2 -2	0 replies
256/403	hwmon: (max6621) fix temperature clamp range`drivers/hwmon/max6621.c`	+2 -2	0 replies
257/403	lockd: pin next file across nlm_inspect_file lock-drop`fs/lockd/svcsubs.c`	+30 ~~-23~~	0 replies
258/403	lockd: fix NULL dereference on lockowner allocation failure`fs/lockd/clntproc.c`	+3 -0	0 replies
259/403	nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path`drivers/nvme/host/fc.c`	+1 -1	0 replies
260/403	nvme: zero the discard fallback page`drivers/nvme/host/core.c`	+1 -1	0 replies
261/403	nvme-pci: disable controller on admin queue IRQ setup failure`drivers/nvme/host/pci.c`	+1 -0	0 replies
262/403	nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone`drivers/nvme/host/tcp.c`	+3 -1	0 replies
263/403	nvme-tcp: fix host memory disclosure on R2T for a read command`drivers/nvme/host/tcp.c`	+7 -0	0 replies
264/403	nvme-tcp: reject a read that transferred too few bytes`drivers/nvme/host/tcp.c`	+34 -0	0 replies
265/403	sctp: stop processing a packet once its association is deleted`net/sctp/sm_sideeffect.c`	+4 -0	0 replies
266/403	sctp: drop a chunk if its transport was removed`net/sctp/inqueue.c`	+5 -2	0 replies
267/403	sctp: fix NULL deref on untransmitted RECONF completion`net/sctp/stream.c`	+1 -1	0 replies
268/403	sctp: distinguish sequence zero from wildcard in reconf lookup`net/sctp/stream.c`	+6 -5	0 replies
269/403	sctp: fix stream->outcnt underflow on duplicate RECONF responses`include/net/sctp/structs.h` `net/sctp/stream.c`	+29 ~~-12~~	0 replies
270/403	power: supply: bq24257: fix use-after-free on remove`drivers/power/supply/bq24257_charger.c`	+9 -7	0 replies
271/403	power: supply: bq256xx: drain usb_work before freeing the charger`drivers/power/supply/bq256xx_charger.c`	+15 ~~-14~~	0 replies
272/403	power: supply: bq25890: Fix power_supply reference leak`drivers/power/supply/bq25890_charger.c`	+12 -0	0 replies
273/403	power: supply: charger-manager: register regulators before exposing sysfs`drivers/power/supply/charger-manager.c`	+39 ~~-15~~	0 replies
274/403	power: supply: cros_usbpd-charger: bound the EC-reported port count`drivers/power/supply/cros_usbpd-charger.c`	+5 -2	0 replies
275/403	power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS`drivers/power/supply/cros_usbpd-charger.c`	+10 -0	0 replies
276/403	power: supply: lp8727: fix use-after-free in lp8727_release_irq()`drivers/power/supply/lp8727_charger.c`	+2 -2	0 replies
277/403	power: supply: lp8788-charger: fix use-after-free on remove`drivers/power/supply/lp8788-charger.c`	+1 -1	0 replies
278/403	power: supply: qcom_battmgr: terminate the strings from firmware`drivers/power/supply/qcom_battmgr.c`	+1 -1	0 replies
279/403	power: supply: rt9455: quiesce delayed work before teardown`drivers/power/supply/rt9455_charger.c`	+17 -4	0 replies
280/403	power: supply: twl4030_charger: cancel workers via devm`drivers/power/supply/twl4030_charger.c`	+10 -2	0 replies
281/403	power: supply: ucs1002: fix use-after-free on remove`drivers/power/supply/ucs1002_power.c`	+5 -1	0 replies
282/403	power: supply: max17040: propagate register read errors`drivers/power/supply/max17040_battery.c`	+21 -5	0 replies
283/403	power: supply: max17040: drop incorrect I2C functionality check`drivers/power/supply/max17040_battery.c`	+0 -4	0 replies
284/403	power: supply: max17040: synchronize work cancellation on suspend`drivers/power/supply/max17040_battery.c`	+1 -1	0 replies
285/403	s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks`arch/s390/kernel/perf_cpum_cf.c`	+142 ~~-73~~	0 replies
286/403	s390/dasd: Do not complete a failed ESE read as successful`drivers/s390/block/dasd.c`	+4 -2	0 replies
287/403	s390/dasd: Guard sysfs discipline callbacks against unallocated private data`drivers/s390/block/dasd_eckd.c`	+38 -2	0 replies
288/403	s390/dasd: Propagate partial completion length across ERP recovery`drivers/s390/block/dasd_erp.c`	+3 -0	0 replies
289/403	PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk`drivers/pci/quirks.c`	+1 -1	0 replies
290/403	PCI: meson: Fix GPIO state while requesting PERST#`drivers/pci/controller/dwc/pci-meson.c`	+1 -1	0 replies
291/403	PCI: plda: Fix use-after-free of event IRQs during teardown`drivers/pci/controller/plda/pcie-plda-host.c`	+21 -3	0 replies
292/403	PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts()`drivers/pci/controller/plda/pcie-plda-host.c`	+21 -7	0 replies
293/403	PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608]`drivers/pci/quirks.c`	+4 -0	0 replies
294/403	PCI/sysfs: Fix read byte order in pci_read_legacy_io()`drivers/pci/pci-sysfs.c`	+19 -1	0 replies
295/403	PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses`drivers/pci/pci-sysfs.c`	+2 -2	0 replies
296/403	PCI/ASPM: Avoid L0s for Realtek RTS525A`drivers/pci/quirks.c`	+3 -0	2 replies
297/403	PCI/DPC: Allow DPC on all Downstream Ports when OS controls AER`drivers/pci/pcie/portdrv.c`	+1 -1	0 replies
298/403	PCI/MSI: Enable memory decoding before restoring MSI-X messages`drivers/pci/msi/msi.c`	+10 -0	0 replies
299/403	PCI/proc: Avoid spurious runtime PM wakeup on config space accesses`drivers/pci/proc.c`	+6 -0	0 replies
300/403	PCI/proc: Use file_ns_capable() when checking config space read access`drivers/pci/proc.c`	+1 -1	0 replies
301/403	PCI/proc: Warn on writes to kernel-exclusive config space regions`drivers/pci/proc.c`	+8 -0	0 replies
302/403	iommu/amd: Put PCI device after handling PPR faults`drivers/iommu/amd/ppr.c`	+2 -1	0 replies
303/403	iommu/sva: Set handle->dev before the SVA handle is visible`drivers/iommu/iommu-sva.c`	+1 -1	0 replies
304/403	iommu/arm-smmu-v3: Manage teardown with devm`drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c`	+40 ~~-16~~	0 replies
305/403	iommu/vt-d: Fix no_iommu to disable platform opt-in`drivers/iommu/intel/iommu.c`	+3 -3	0 replies
306/403	iommu/vt-d: Force requesting ACS when tboot is enabled`drivers/iommu/intel/dmar.c` `drivers/iommu/intel/iommu.c` `drivers/iommu/intel/iommu.h`	+16 -3	0 replies
307/403	platform/x86: dell-wmi-sysman: Dont hex dump attribute security buffer`drivers/platform/x86/dell/dell-wmi-sysman/biosattr-interface.c`	+0 -1	0 replies
308/403	platform/x86: ISST: Validate level in perf mask ioctls`drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c`	+9 -0	0 replies
309/403	platform/x86: ISST: Validate socket ID in clos_assoc ioctl`drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c`	+3 -1	0 replies
310/403	mmc: via-sdmmc: stop card-detect handling on probe failure`drivers/mmc/host/via-sdmmc.c`	+7 -1	0 replies
311/403	platform/x86: ISST: Add a NULL check for sst_inst[]`drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c`	+2 -0	0 replies
312/403	platform/x86: ISST: Just allow 2 bits for SST feature enable`drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c`	+4 -0	0 replies
313/403	platform/x86: ISST: Use PP level enable mask`drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c`	+14 -2	0 replies
314/403	platform/x86: ISST: Validate logical CPU id and clos id`drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c`	+13 -0	0 replies
315/403	platform/x86: ISST: Validate parameter for core power state`drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c`	+7 -0	0 replies
316/403	platform/x86: ISST: Validate parameter for frequency and priority`drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c`	+12 -0	0 replies
317/403	platform/x86: ISST: Return error during profile addition`drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c`	+7 -3	0 replies
318/403	platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path`drivers/platform/x86/intel/ishtp_eclite.c`	+4 -1	0 replies
319/403	platform/chrome: sensorhub: Bound the EC-reported sensor number`drivers/platform/chrome/cros_ec_sensorhub_ring.c`	+8 -0	0 replies
320/403	platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS`drivers/platform/x86/hp/hp-bioscfg/bioscfg.c` `drivers/platform/x86/hp/hp-bioscfg/bioscfg.h`	+11 -3	0 replies
321/403	platform/x86: hp-bioscfg: advance elem past consumed array elements`drivers/platform/x86/hp/hp-bioscfg/enum-attributes.c` `drivers/platform/x86/hp/hp-bioscfg/int-attributes.c` `drivers/platform/x86/hp/hp-bioscfg/order-list-attributes.c` +2 more	+14 -0	0 replies
322/403	platform/x86: hp-bioscfg: bound ordered-list parsing by the package count`drivers/platform/x86/hp/hp-bioscfg/order-list-attributes.c`	+1 -1	0 replies
323/403	platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store()`drivers/platform/x86/hp/hp-bioscfg/spmobj-attributes.c`	+2 -2	0 replies
324/403	platform/x86: hp-bioscfg: fix heap OOB read on empty password write`drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c`	+1 -1	0 replies
325/403	platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password`drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c`	+1 -1	0 replies
326/403	platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer()`drivers/platform/x86/hp/hp-bioscfg/bioscfg.c`	+1 -1	0 replies
327/403	platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed`drivers/platform/x86/hp/hp-bioscfg/order-list-attributes.c`	+3 -1	0 replies
328/403	platform/x86: hp-bioscfg: pass validated element count to package parsers`drivers/platform/x86/hp/hp-bioscfg/bioscfg.c` `drivers/platform/x86/hp/hp-bioscfg/bioscfg.h` `drivers/platform/x86/hp/hp-bioscfg/enum-attributes.c` +4 more	+27 -7	0 replies
329/403	platform/x86: hp-bioscfg: warn on element type mismatch instead of failing`drivers/platform/x86/hp/hp-bioscfg/enum-attributes.c`	+4 -3	0 replies
330/403	interconnect: Fix use after free in icc_get() and of_icc_get_by_index()`drivers/interconnect/core.c`	+4 -3	0 replies
331/403	ipmi: ipmb: validate write message length`drivers/char/ipmi/ipmb_dev_int.c`	+3 -2	0 replies
332/403	ipmi: si: Fix NULL pointer dereference after failed registration`drivers/char/ipmi/ipmi_msghandler.c`	+1 -0	0 replies
333/403	net/iucv: filter frames in afiucv_hs_rcv() by ingress device`net/iucv/af_iucv.c`	+2 -0	0 replies
334/403	xdp: fix zero-copy frame layout`net/core/xdp.c`	+2 -2	0 replies
335/403	slip: fix use-after-free in sl_sync()`drivers/net/slip/slip.c`	+8 -3	0 replies
336/403	net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition`drivers/net/usb/qmi_wwan.c`	+1 -0	0 replies
337/403	net: tun: bound receive headroom`drivers/net/tun.c`	+16 -5	0 replies
338/403	net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO`drivers/net/dsa/realtek/rtl83xx.c`	+2 -2	0 replies
339/403	net: ipa: fix stalled modem TX queue after runtime resume`drivers/net/ipa/ipa_modem.c`	+17 -1	0 replies
340/403	net: l2tp: do not propagate multicast notification errors`net/l2tp/l2tp_netlink.c`	+8 -8	0 replies
341/403	net: openvswitch: fix flow mask use-after-free on flow deletion`net/openvswitch/datapath.c`	+23 ~~-22~~	0 replies
342/403	net: openvswitch: fix nf_connlabels leak in ovs_ct_init`net/openvswitch/conntrack.c`	+5 -3	0 replies
343/403	net: ravb: avoid dereferencing an invalid PTP clock`drivers/net/ethernet/renesas/ravb.h` `drivers/net/ethernet/renesas/ravb_main.c` `drivers/net/ethernet/renesas/ravb_ptp.c`	+16 -3	0 replies
344/403	net: ravb: serialize PTP clock teardown`drivers/net/ethernet/renesas/ravb.h` `drivers/net/ethernet/renesas/ravb_main.c` `drivers/net/ethernet/renesas/ravb_ptp.c`	+35 ~~-10~~	0 replies
345/403	net: thunderbolt: Release the Rx HopID that was handed out on mismatch`drivers/net/thunderbolt/main.c`	+2 -0	0 replies
346/403	net: thunderbolt: Mark the connection down when bringing it up fails`drivers/net/thunderbolt/main.c`	+10 -0	0 replies
347/403	NTB: ntb_transport: Recycle TX entries before client callbacks`drivers/ntb/ntb_transport.c`	+14 -9	0 replies
348/403	NTB: ntb_transport: Fail TX enqueue when the QP link is down`drivers/ntb/ntb_transport.c`	+1 -2	3 replies
349/403	NTB: ntb_transport: Reject oversized TX buffers`drivers/ntb/ntb_transport.c`	+3 -9	1 reply
350/403	net: ntb_netdev: Avoid double-accounting netif_rx() drops`drivers/net/ntb_netdev.c`	+3 -7	0 replies
351/403	net: ntb_netdev: Count packets dropped on RX refill failure`drivers/net/ntb_netdev.c`	+3 -2	0 replies
352/403	net/smc: do not dereference an unset send buffer on the SMC-D teardown path`net/smc/af_smc.c` `net/smc/smc_tx.h`	+7 -2	0 replies
353/403	net/smc: fix socket refcount leak in smc_switch_conns()`net/smc/smc_core.c`	+7 -7	0 replies
354/403	net/smc: fix use-after-free in smc_rx_pipe_buf_release()`net/smc/smc_rx.c`	+5 -6	0 replies
355/403	net/smc: unregister the connection before draining the rx tasklet`net/smc/smc_core.c`	+7 -6	0 replies
356/403	net: cap advertised IP tunnel headroom`include/net/ip_tunnels.h` `net/ipv4/ip_tunnel.c` `net/ipv6/ip6_gre.c` +2 more	+21 -8	0 replies
357/403	net: fix spurious TX timeout after dev_activate()`net/sched/sch_generic.c`	+1 -1	0 replies
358/403	net: skbuff: dont touch shared zerocopy state in skb_tx_error()`net/core/skbuff.c`	+4 -1	0 replies
359/403	seg6: reset IP6CB after IPv6 decapsulation`net/ipv6/seg6_local.c`	+9 -0	0 replies
360/403	mfd: sm501: Fix potential memory leaks during remove`drivers/mfd/sm501.c`	+2 -0	0 replies
361/403	ALSA: 6fire: bound the MIDI event length from the device`sound/usb/6fire/comm.c`	+6 -3	0 replies
362/403	ALSA: aloop: Check card index validity at probe`sound/drivers/aloop.c`	+6 -0	0 replies
363/403	ALSA: bcd2000: clear the URB pointers on disconnect`sound/usb/bcd2000/bcd2000.c`	+8 -3	0 replies
364/403	ALSA: mpu401: Check card index validity at probe`sound/drivers/mpu401/mpu401.c`	+6 -0	0 replies
365/403	ALSA: mts64: Check card index validity at probe`sound/drivers/mts64.c`	+6 -0	0 replies
366/403	ALSA: pcxhr: initialize mutexes before requesting threaded IRQ`sound/pci/pcxhr/pcxhr.c`	+7 -7	0 replies
367/403	ALSA: portman2x4: Check card index validity at probe`sound/drivers/portman2x4.c`	+6 -0	0 replies
368/403	ALSA: serial-u16550: Check card index validity at probe`sound/drivers/serial-u16550.c`	+6 -0	0 replies
369/403	ALSA: virmidi: Check card index validity at probe`sound/drivers/virmidi.c`	+6 -0	0 replies
370/403	ring-buffer: Fix subbuf resize race with ring buffer readers`kernel/trace/ring_buffer.c`	+104 ~~-58~~	0 replies
371/403	iommu/amd: remove return value of amd_iommu_detect`drivers/iommu/amd/init.c` `include/linux/amd-iommu.h`	+6 -8	0 replies
372/403	x86/sev: Fix broken SNP support with KVM module built-in`arch/x86/include/asm/sev.h` `arch/x86/virt/svm/sev.c` `drivers/iommu/amd/init.c`	+38 ~~-19~~	0 replies
373/403	rust: rust_is_available: warn for `bindgen` < 0.72.1 && libclang >= 22`scripts/rust_is_available.sh` `scripts/rust_is_available_bindgen_libclang_22.h` `scripts/rust_is_available_test.py`	+48 -1	0 replies
374/403	KVM: selftests: Remove duplicate LAUNCH_UPDATE_VMSA call in SEV-ES migrate test`tools/testing/selftests/kvm/x86_64/sev_migrate_tests.c`	+0 -2	0 replies
375/403	PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip`drivers/pci/controller/pci-hyperv.c`	+1 -0	0 replies
376/403	arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map()`drivers/base/arch_numa.c`	+12 -0	0 replies
377/403	dm-stats: fix a crash if allocation of per-cpu data fails`drivers/md/dm-stats.c`	+4 -2	0 replies
378/403	dm-switch: use WRITE_ONCE() in switch_region_table_write()`drivers/md/dm-switch.c`	+1 -1	0 replies
379/403	i3c: master: Fix info leak and UAF in device unregister path`drivers/i3c/master.c`	+5 -4	0 replies
380/403	i3c: master: svc: bound IBI payload to the requested max_payload_len`drivers/i3c/master/svc-i3c-master.c`	+9 -1	0 replies
381/403	i3c: master: Fix potential UAF in i3c_device_uevent()`drivers/i3c/master.c`	+1 -2	4 replies
382/403	wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control()`drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c`	+2 -1	0 replies
383/403	wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop`drivers/net/wireless/realtek/rtl8xxxu/core.c`	+14 -5	0 replies
384/403	crypto: sun8i-ce - Remove crypto_rng interface`drivers/crypto/allwinner/Kconfig` `drivers/crypto/allwinner/sun8i-ce/Makefile` `drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c` +2 more	+0 ~~-254~~	0 replies
385/403	crypto: sun8i-ss - Remove crypto_rng interface`drivers/crypto/allwinner/Kconfig` `drivers/crypto/allwinner/sun8i-ss/Makefile` `drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c` +2 more	+0 ~~-248~~	0 replies
386/403	wifi: mwifiex: Detach sync cmd buffer on interrupted wait`drivers/net/wireless/marvell/mwifiex/sta_ioctl.c`	+12 -0	0 replies
387/403	wifi: rtl818x: initialize eeprom_93cx6 struct to zero`drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c` `drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c`	+2 -2	0 replies
388/403	wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids`drivers/net/wireless/realtek/rtlwifi/rtl8192du/trx.c`	+2 -1	0 replies
389/403	wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars()`drivers/net/wireless/realtek/rtlwifi/rtl8192du/sw.c`	+9 -3	0 replies
390/403	wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb()`drivers/net/wireless/realtek/rtw88/tx.c`	+1 -0	0 replies
391/403	wifi: rtw88: pci: fix resource leak on failed NAPI setup`drivers/net/wireless/realtek/rtw88/pci.c`	+3 -1	0 replies
392/403	wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex`drivers/net/wireless/mediatek/mt76/mt7615/main.c`	+3 -2	0 replies
393/403	vsock/virtio: flush works in dependency order`net/vmw_vsock/virtio_transport.c`	+1 -1	0 replies
394/403	w1: ds28e17: reject an oversize length on an I2C block read`drivers/w1/slaves/w1_ds28e17.c`	+8 -0	0 replies
395/403	xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc()`lib/xarray.c`	+3 -0	0 replies
396/403	tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout`drivers/char/tpm/tpm_i2c_nuvoton.c`	+4 -2	0 replies
397/403	sticon/parisc: Detect default STI graphics card for console output`drivers/video/sticore.c`	+21 -1	0 replies
398/403	signal: avoid shared siginfo namespace rewrites`kernel/signal.c`	+4 -0	0 replies
399/403	smack: fix cred UAF in smack_file_send_sigiotask()`security/smack/smack_lsm.c`	+1 -1	0 replies
400/403	taskstats: fix cpumask parsing cutting off the last character`kernel/taskstats.c`	+1 -2	0 replies
401/403	timer: Keep debugobjects state consistent in migrate_timer_list()`kernel/time/timer.c`	+1 -0	0 replies
402/403	udf: Fix i_lenExtents truncation on 32-bit kernels`fs/udf/inode.c`	+1 -1	0 replies
403/403	platform/chrome: sensorhub: Fix dropped timestamp events and log spam`drivers/platform/chrome/cros_ec_sensorhub_ring.c`	+15 ~~-12~~	0 replies

Reviews trailers per patch

210 of 403 patches have a Reviewed-by or Acked-by.

Patch	Kalesh AP	Somnath Kotur	Andy Gospodarek	Simon Horman	Magnus Lindholm	Indrek Kruusa	Jernej Skrabec	Paul Moore	Ritesh Harjani (IBM)	Sami Tolvanen	Nick Desaulniers	Catalin Marinas	Davidlohr Bueso	Lance Yang	Oleg Nesterov	Zi Yan	Gregory Price	Paul E. McKenney	David Hildenbrand (Arm)	Muchun Song	Vlastimil Babka (SUSE)	Johannes Weiner	Shakeel Butt	Nhat Pham	Yosry Ahmed	Tao Cui	Neha Gholkar	Balbir Singh	Kai Huang	Kuppuswamy Sathyanarayanan	Binbin Wu	Rick Edgecombe	Sean Christopherson	Sizhe Liu	Yicong Yang	Bradley Morgan	Masami Hiramatsu (Google)	[email protected]	Christoph Hellwig	John Garry	Alex Hung	Mark Broadworth	Dapeng Mi	Steve Wahl	Vasanthakumar Thiagarajan	Baochen Qiang	Andy Shevchenko	Xu Yang	Heikki Krogerus	Badhri Jagan Sridharan	Fedor Pchelkin	[email protected]	Xu Yilun	Alexander Graf	Srinivas Pandruvada	Geert Uytterhoeven	Richard Weinberger	Zhihao Cheng	Sergey Senozhatsky	Jeff Layton	NeilBrown	Dan Carpenter	Laurent Pinchart	Frank Li	Nikhil Agarwal	Nipun Gupta	Viacheslav Dubeyko	Alex Markuze	David Sterba	Ricardo Robaina	Namjae Jeon	ChenXiaoSong	Anisse Astier	OGAWA Hirofumi	Zhu Yanjun	Hanjun Guo	Shuai Xue	Linus Walleij	Hannes Reinecke	Paul Menzel	Eduard Zingerman	Ming-Hung Tsai	James Clark	Zhongqiu Han	Dan Williams	Sven Peter	Zhang Yi	Jan Kara	Fernando Fernandez Mancera	Ido Schimmel	Stefano Brivio	Alison Schofield	Mykola Marzhan	Yu Kuai	Matthieu Baerts (NGI0)	Petr Pavlu	Chuck Lever	Andrey Ryabinin	Bart Van Assche	Konrad Dybcio	Joseph Qi	Ilya Maximets	Jongmin Jang	Maurizio Lombardi	Laurence Oberman	Justin Tee	Xin Long	Sudeep Holla	Yixun Lan	Sunil V L	Huisong Li	Lucas Stach	Heiko Carstens	Jan Höppner	Manivannan Sadhasivam	Neil Armstrong	Lukas Wunner	Thomas Gleixner	Niklas Schnelle	Vasant Hegde	Lu Baolu	Kevin Tian	Jason Gunthorpe	Nicolin Chen	Ilpo Järvinen	Tzung-Bi Shih	Benson Leung	Mario Limonciello (AMD)	Breno Leitao	Willem de Bruijn	Alvin Šipraga	Luiz Angelo Daros de Luca	Aaron Conole	Vadim Fedorenko	Mika Westerberg	Dave Jiang	Sidraya Jayagond	Tony Lu	Mahanta Jambigi	Nicolai Buchwitz	Jason Xing	Andrea Mayer	Joerg Roedel	Burak Emir	Aditya Garg	Shradha Gupta	Michael Kelley	Mike Rapoport (Microsoft)	Mukesh Savaliya	Ping-Ke Shih	Andi Shyti	Lorenzo Stoakes (ARM)	Jarkko Sakkinen	Andrew Morton	Tomasz Figa	Brett A C Sheffield	Dominique Martinet	Shuah Khan	Miguel Ojeda
Series																																																																																																																																																												T-b	T-b	T-b	T-b
1/403	R-b	R-b	R-b	R-b
2/403
3/403
4/403																																							R-b	R-b
5/403																																									R-b	T-b
6/403																																											R-b	T-b
7/403
8/403																																													R-b	R-b
9/403																																									R-b
10/403					R-b T-b
11/403					R-b T-b
12/403						T-b	A-b
13/403								T-b
14/403									R-b
15/403
16/403										R-b
17/403
18/403
19/403											R-b T-b
20/403												R-b	R-b	R-b	R-b
21/403																A-b	R-b	R-b	A-b
22/403																			A-b	A-b
23/403																R-b					R-b
24/403																			A-b	R-b
25/403																		R-b				A-b	A-b
26/403																								A-b	A-b
27/403																						A-b				A-b
28/403																	R-b		A-b								T-b	A-b
29/403
30/403																													R-b	R-b	R-b	R-b
31/403																																	A-b
32/403																															R-b
33/403																																		R-b T-b	R-b
34/403																																				R-b
35/403
36/403																																					A-b
37/403																																				R-b		T-b
38/403
39/403																																																																	A-b	A-b
40/403																																															T-b	T-b
41/403																																																						R-b
42/403																																															R-b
43/403																																																														R-b
44/403																																																															R-b
45/403																																																																R-b
46/403
47/403
48/403
49/403
50/403																																																	A-b	R-b
51/403																																																	R-b		R-b
52/403
53/403
54/403																																																				T-b
55/403
56/403
57/403
58/403																																																					R-b
59/403																																																							A-b
60/403
61/403
62/403
63/403
64/403																																																								R-b
65/403
66/403																																																									R-b	R-b
67/403																																																											R-b
68/403
69/403
70/403																																																												R-b	R-b
71/403
72/403
73/403
74/403
75/403
76/403
77/403																																																												R-b
78/403
79/403																																																												R-b
80/403																																																												R-b
81/403
82/403
83/403
84/403
85/403
86/403
87/403
88/403
89/403
90/403
91/403
92/403
93/403
94/403
95/403
96/403
97/403
98/403
99/403
100/403
101/403
102/403
103/403																																																												R-b
104/403
105/403
106/403
107/403																																																												R-b	R-b
108/403																																																												R-b	R-b
109/403																																																																			R-b
110/403																																																																				R-b
111/403																																																																			R-b
112/403																																																																				R-b
113/403																																																																			R-b
114/403																																																																			R-b
115/403																																																																			R-b
116/403																																																																			R-b
117/403																																																																				R-b
118/403																																																																					R-b
119/403																																																																						R-b T-b
120/403																																																																							R-b
121/403																																																																								R-b
122/403
123/403																																																																							A-b
124/403																																																																								R-b
125/403
126/403
127/403																																																							A-b
128/403
129/403
130/403
131/403
132/403
133/403
134/403
135/403
136/403
137/403
138/403
139/403
140/403
141/403
142/403																																																																									R-b
143/403																																																																										A-b
144/403
145/403
146/403
147/403
148/403				R-b																																																																							R-b
149/403																																																					R-b
150/403
151/403																																																																												R-b
152/403																																																																													R-b
153/403
154/403					T-b R-b A-b
155/403					R-b
156/403					R-b
157/403																																																																														R-b
158/403																																																																															R-b
159/403																																																								R-b
160/403																																							R-b
161/403																																																																																R-b
162/403																																																																																R-b
163/403
164/403				R-b
165/403																																																																																	R-b
166/403
167/403
168/403
169/403
170/403																																																																																		R-b
171/403																																																																																		R-b
172/403																																																																																			R-b
173/403																																																																																				R-b
174/403																																																																																					A-b
175/403																																																																																						R-b
176/403
177/403
178/403
179/403
180/403
181/403
182/403
183/403
184/403
185/403
186/403																																																																																																		R-b
187/403																																																																																							R-b	R-b
188/403																																																																																							R-b	R-b
189/403																																																																																									R-b
190/403																																																																																										R-b
191/403																																																																																										R-b
192/403																																																																																										R-b	R-b
193/403																																																																																												R-b
194/403
195/403																																																																																R-b													R-b	R-b
196/403																																																																																														R-b
197/403				R-b
198/403																																																																																															R-b
199/403
200/403																																																																																																R-b
201/403																																																												R-b
202/403																																																												R-b
203/403																																																												R-b
204/403
205/403
206/403																																																												R-b
207/403																																																												R-b
208/403																																																												R-b
209/403																																																												R-b
210/403																																																												R-b
211/403																																																												R-b
212/403																																																												R-b
213/403																																																																																																	R-b
214/403																																																												A-b
215/403																																																												A-b
216/403																																																												A-b
217/403																																																												A-b
218/403
219/403																																																												A-b
220/403																																																												A-b
221/403
222/403
223/403
224/403
225/403																																																																																																			R-b
226/403																																																																																																				R-b
227/403																																																																																																				R-b
228/403
229/403
230/403																																																																																																												A-b	R-b	R-b	R-b
231/403
232/403
233/403
234/403
235/403
236/403
237/403																																																																																																				R-b
238/403																																					R-b
239/403
240/403
241/403
242/403																																																																																																					R-b
243/403																																																																																																					R-b
244/403																																																																																																					R-b
245/403																																																																																																					R-b
246/403
247/403
248/403
249/403																																																																																																					R-b
250/403
251/403																																																																																																						R-b	T-b
252/403
253/403
254/403
255/403
256/403
257/403
258/403
259/403																																																																																																								R-b	R-b	R-b
260/403
261/403																																							R-b
262/403
263/403
264/403
265/403																																																																																																											A-b
266/403																																																																																																											A-b
267/403																																																																																																											A-b
268/403																																																																																																											A-b
269/403
270/403
271/403
272/403
273/403
274/403																																																																																																																														R-b
275/403																																																																																																																															R-b
276/403
277/403
278/403
279/403
280/403
281/403																																																																																																																R-b
282/403
283/403
284/403
285/403																																																																																																																	A-b
286/403																																																																																																																		R-b
287/403																																																																																																																		R-b
288/403																																																																																																																		R-b
289/403																																																																																																																			R-b
290/403																																																																																																																				R-b
291/403
292/403
293/403
294/403
295/403
296/403																																																																																																																			R-b		R-b
297/403																														R-b																																																																																							R-b
298/403																																																																																																																						R-b	R-b
299/403
300/403
301/403
302/403																																																																																																																								R-b
303/403																																																																																																																									R-b	R-b	R-b
304/403																																																																																																																											R-b	R-b
305/403
306/403
307/403																																																																																																																													R-b
308/403																																																							A-b																																																																						R-b
309/403																																																							A-b																																																																						R-b
310/403
311/403																																																																																																																													R-b
312/403																																																																																																																													R-b
313/403																																																																																																																													R-b
314/403																																																																																																																													R-b
315/403																																																																																																																													R-b
316/403																																																																																																																													R-b
317/403																																																																																																																													R-b
318/403																																																							A-b																																																																						R-b
319/403
320/403																																																																																																																													R-b			R-b
321/403																																																																																																																													R-b
322/403																																																																																																																													R-b
323/403																																																																																																																													R-b
324/403																																																																																																																													R-b
325/403																																																																																																																													R-b
326/403																																																																																																																													R-b
327/403																																																																																																																													R-b
328/403																																																																																																																													R-b
329/403																																																																																																																													R-b			R-b
330/403
331/403
332/403
333/403
334/403
335/403
336/403																																																																																																																																	R-b
337/403																																																																																																																																		R-b
338/403																																																																														R-b																																																					R-b	R-b
339/403				R-b
340/403				R-b
341/403																																																																																																																																					R-b
342/403																																																																																																						R-b
343/403																																																																																																																																						R-b
344/403
345/403				R-b																																																																																																																																			A-b
346/403				R-b																																																																																																																																			A-b
347/403																																																																																																																																								R-b
348/403																																																																																																																																								R-b R-b
349/403																																																																																																																																								R-b
350/403
351/403
352/403																																																																																																																																									R-b	R-b
353/403																																																																																																																																	R-b										R-b
354/403				R-b																																																																																																																																							R-b
355/403																																																																																																																																									R-b	R-b
356/403																																																																																										R-b
357/403																																																																																																																																												R-b	R-b
358/403																																																																																																						R-b	T-b																											R-b
359/403																																																																																																																																														R-b
360/403
361/403
362/403
363/403
364/403
365/403
366/403
367/403
368/403
369/403
370/403																																					A-b
371/403																																																																																																																								R-b
372/403																																																																																																																																															A-b
373/403																																																																																																																																																T-b
374/403
375/403																																																																																																																																																	R-b	R-b	R-b
376/403																																																																																																																																																				R-b
377/403
378/403
379/403																																																																R-b
380/403																																																																R-b
381/403																																																																R-b																																																																																					A-b
382/403
383/403
384/403
385/403
386/403
387/403																																																																																																																																																						R-b
388/403
389/403																																																																																																																																																						A-b
390/403																																																																																																																																																						A-b
391/403																																																																																																																																																						A-b
392/403
393/403
394/403																																																																																																																																																							R-b
395/403																						A-b																																																																																																																																		R-b
396/403																																																																																																																																																									R-b
397/403
398/403															A-b
399/403
400/403																																																																																																																																																										R-b
401/403
402/403
403/403																																																																																																																																																											R-b

Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes. Scroll the table sideways for all 159 reviewers.

Read the v1 thread

Cover letter [PATCH 6.12 000/403] 6.12.109-rc1 review

This is the start of the stable review cycle for the 6.12.109 release. There are 403 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Sun, 06 Sep 2026 04:56:59 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.109-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 6.12.109-rc1

Tzung-Bi Shih <[email protected]>
platform/chrome: sensorhub: Fix dropped timestamp events and log spam

Zhan Xusheng <[email protected]>
udf: Fix i_lenExtents truncation on 32-bit kernels

Thomas Gleixner <[email protected]>
timer: Keep debugobjects state consistent in migrate_timer_list()

Bradley Morgan <[email protected]>
taskstats: fix cpumask parsing cutting off the last character

Jann Horn <[email protected]>
smack: fix cred UAF in smack_file_send_sigiotask()

Bradley Morgan <[email protected]>
signal: avoid shared siginfo namespace rewrites

Helge Deller <[email protected]>
sticon/parisc: Detect default STI graphics card for console output

Myeonghun Pak <[email protected]>
tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout

Zi Yan <[email protected]>
xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc()

Maoyi Xie <[email protected]>
w1: ds28e17: reject an oversize length on an I2C block read

Chengfeng Ye <[email protected]>
vsock/virtio: flush works in dependency order

Runyu Xiao <[email protected]>
wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex

Dawei Feng <[email protected]>
wifi: rtw88: pci: fix resource leak on failed NAPI setup

Abdun Nihaal <[email protected]>
wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb()

Abdun Nihaal <[email protected]>
wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars()

Runyu Xiao <[email protected]>
wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids

Stanislaw Gruszka <[email protected]>
wifi: rtl818x: initialize eeprom_93cx6 struct to zero

Fabio Estevam <[email protected]>
wifi: mwifiex: Detach sync cmd buffer on interrupted wait

Eric Biggers <[email protected]>
crypto: sun8i-ss - Remove crypto_rng interface

Eric Biggers <[email protected]>
crypto: sun8i-ce - Remove crypto_rng interface

Fan Wu <[email protected]>
wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop

Abdun Nihaal <[email protected]>
wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control()

Adrian Hunter <[email protected]>
i3c: master: Fix potential UAF in i3c_device_uevent()

Maoyi Xie <[email protected]>
i3c: master: svc: bound IBI payload to the requested max_payload_len

Adrian Hunter <[email protected]>
i3c: master: Fix info leak and UAF in device unregister path

Haotian Zhang <[email protected]>
dm-switch: use WRITE_ONCE() in switch_region_table_write()

Mikulas Patocka <[email protected]>
dm-stats: fix a crash if allocation of per-cpu data fails

Nathan Chancellor <[email protected]>
arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map()

Naman Jain <[email protected]>
PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip

Sean Christopherson <[email protected]>
KVM: selftests: Remove duplicate LAUNCH_UPDATE_VMSA call in SEV-ES migrate test

Miguel Ojeda <[email protected]>

    rust: rust_is_available: warn for `bindgen` < 0.72.1 && libclang >= 22

Ashish Kalra <[email protected]>
x86/sev: Fix broken SNP support with KVM module built-in

Gao Shiyuan <[email protected]>
iommu/amd: remove return value of amd_iommu_detect

Vincent Donnefort <[email protected]>
ring-buffer: Fix subbuf resize race with ring buffer readers

Takashi Iwai <[email protected]>
ALSA: virmidi: Check card index validity at probe

Takashi Iwai <[email protected]>
ALSA: serial-u16550: Check card index validity at probe

Takashi Iwai <[email protected]>
ALSA: portman2x4: Check card index validity at probe

Runyu Xiao <[email protected]>
ALSA: pcxhr: initialize mutexes before requesting threaded IRQ

Takashi Iwai <[email protected]>
ALSA: mts64: Check card index validity at probe

Takashi Iwai <[email protected]>
ALSA: mpu401: Check card index validity at probe

Baul Lee <[email protected]>
ALSA: bcd2000: clear the URB pointers on disconnect

Takashi Iwai <[email protected]>
ALSA: aloop: Check card index validity at probe

Baul Lee <[email protected]>
ALSA: 6fire: bound the MIDI event length from the device

Abdun Nihaal <[email protected]>
mfd: sm501: Fix potential memory leaks during remove

Zhiling Zou <[email protected]>
seg6: reset IP6CB after IPv6 decapsulation

Norbert Szetei <[email protected]>
net: skbuff: don't touch shared zerocopy state in skb_tx_error()

Breno Leitao <[email protected]>
net: fix spurious TX timeout after dev_activate()

Zhiling Zou <[email protected]>
net: cap advertised IP tunnel headroom

Bryam Vargas <[email protected]>
net/smc: unregister the connection before draining the rx tasklet

Hidayath Khan <[email protected]>
net/smc: fix use-after-free in smc_rx_pipe_buf_release()

Hidayath Khan <[email protected]>
net/smc: fix socket refcount leak in smc_switch_conns()

Bryam Vargas <[email protected]>
net/smc: do not dereference an unset send buffer on the SMC-D teardown path

Koichiro Den <[email protected]>
net: ntb_netdev: Count packets dropped on RX refill failure

Koichiro Den <[email protected]>
net: ntb_netdev: Avoid double-accounting netif_rx() drops

Koichiro Den <[email protected]>
NTB: ntb_transport: Reject oversized TX buffers

Koichiro Den <[email protected]>
NTB: ntb_transport: Fail TX enqueue when the QP link is down

Koichiro Den <[email protected]>
NTB: ntb_transport: Recycle TX entries before client callbacks

Fan Ye <[email protected]>
net: thunderbolt: Mark the connection down when bringing it up fails

Fan Ye <[email protected]>
net: thunderbolt: Release the Rx HopID that was handed out on mismatch

Xuanqiang Luo <[email protected]>
net: ravb: serialize PTP clock teardown

Xuanqiang Luo <[email protected]>
net: ravb: avoid dereferencing an invalid PTP clock

Ruoyu Wang <[email protected]>
net: openvswitch: fix nf_connlabels leak in ovs_ct_init

Ilya Maximets <[email protected]>
net: openvswitch: fix flow mask use-after-free on flow deletion

Zihan Xi <[email protected]>
net: l2tp: do not propagate multicast notification errors

Jorijn van der Graaf <[email protected]>
net: ipa: fix stalled modem TX queue after runtime resume

Ahmad Fatoum <[email protected]>
net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO

Asim Viladi Oglu Manizada <[email protected]>
net: tun: bound receive headroom

Fabio Porcedda <[email protected]>
net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition

Aleksandr Khromov <[email protected]>
slip: fix use-after-free in sl_sync()

Weiming Shi <[email protected]>
xdp: fix zero-copy frame layout

Alexandra Winter <[email protected]>
net/iucv: filter frames in afiucv_hs_rcv() by ingress device

Seiji Nishikawa <[email protected]>
ipmi: si: Fix NULL pointer dereference after failed registration

Yousef Alhouseen <[email protected]>
ipmi: ipmb: validate write message length

Kuan-Wei Chiu <[email protected]>
interconnect: Fix use after free in icc_get() and of_icc_get_by_index()

Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: warn on element type mismatch instead of failing

Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: pass validated element count to package parsers

Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed

Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer()

Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password

Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: fix heap OOB read on empty password write

Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store()

Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: bound ordered-list parsing by the package count

Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: advance elem past consumed array elements

Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS

Bryam Vargas <[email protected]>
platform/chrome: sensorhub: Bound the EC-reported sensor number

Ma Ke <[email protected]>
platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path

Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Return error during profile addition

Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Validate parameter for frequency and priority

Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Validate parameter for core power state

Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Validate logical CPU id and clos id

Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Use PP level enable mask

Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Just allow 2 bits for SST feature enable

Srinivas Pandruvada <[email protected]>

    platform/x86: ISST: Add a NULL check for sst_inst[]

Fan Wu <[email protected]>
mmc: via-sdmmc: stop card-detect handling on probe failure

HyeongJun An <[email protected]>
platform/x86: ISST: Validate socket ID in clos_assoc ioctl

HyeongJun An <[email protected]>
platform/x86: ISST: Validate level in perf mask ioctls

HyeongJun An <[email protected]>
platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer

Kevin Tian <[email protected]>
iommu/vt-d: Force requesting ACS when tboot is enabled

Kevin Tian <[email protected]>
iommu/vt-d: Fix no_iommu to disable platform opt-in

Shameer Kolothum <[email protected]>
iommu/arm-smmu-v3: Manage teardown with devm

Shuai Xue <[email protected]>

    iommu/sva: Set handle->dev before the SVA handle is visible

Shuai Xue <[email protected]>
iommu/amd: Put PCI device after handling PPR faults

Krzysztof Wilczyński <[email protected]>
PCI/proc: Warn on writes to kernel-exclusive config space regions

Krzysztof Wilczyński <[email protected]>
PCI/proc: Use file_ns_capable() when checking config space read access

Krzysztof Wilczyński <[email protected]>
PCI/proc: Avoid spurious runtime PM wakeup on config space accesses

Farhan Ali <[email protected]>
PCI/MSI: Enable memory decoding before restoring MSI-X messages

Darshit Shah <[email protected]>
PCI/DPC: Allow DPC on all Downstream Ports when OS controls AER

Max Lee <[email protected]>
PCI/ASPM: Avoid L0s for Realtek RTS525A

Krzysztof Wilczyński <[email protected]>
PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses

Krzysztof Wilczyński <[email protected]>
PCI/sysfs: Fix read byte order in pci_read_legacy_io()

Tim Harvey <[email protected]>

    PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608]

Ali Tariq <[email protected]>
PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts()

Ali Tariq <[email protected]>
PCI: plda: Fix use-after-free of event IRQs during teardown

Ronald Claveau <[email protected]>
PCI: meson: Fix GPIO state while requesting PERST#

Mohamad Raizudeen <[email protected]>
PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk

Stefan Haberland <[email protected]>
s390/dasd: Propagate partial completion length across ERP recovery

Stefan Haberland <[email protected]>
s390/dasd: Guard sysfs discipline callbacks against unallocated private data

Stefan Haberland <[email protected]>
s390/dasd: Do not complete a failed ESE read as successful

Thomas Richter <[email protected]>
s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks

Jianing Li <[email protected]>
power: supply: max17040: synchronize work cancellation on suspend

Jianing Li <[email protected]>
power: supply: max17040: drop incorrect I2C functionality check

Jianing Li <[email protected]>
power: supply: max17040: propagate register read errors

Fan Wu <[email protected]>
power: supply: ucs1002: fix use-after-free on remove

Maoyi Xie <[email protected]>
power: supply: twl4030_charger: cancel workers via devm

Fan Wu <[email protected]>
power: supply: rt9455: quiesce delayed work before teardown

HyeongJun An <[email protected]>
power: supply: qcom_battmgr: terminate the strings from firmware

Fan Wu <[email protected]>
power: supply: lp8788-charger: fix use-after-free on remove

Fan Wu <[email protected]>

    power: supply: lp8727: fix use-after-free in lp8727_release_irq()

Jameson Thies <[email protected]>
power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS

Bryam Vargas <[email protected]>
power: supply: cros_usbpd-charger: bound the EC-reported port count

Fan Wu <[email protected]>
power: supply: charger-manager: register regulators before exposing sysfs

Ma Ke <[email protected]>
power: supply: bq25890: Fix power_supply reference leak

Fan Wu <[email protected]>
power: supply: bq256xx: drain usb_work before freeing the charger

Fan Wu <[email protected]>
power: supply: bq24257: fix use-after-free on remove

Jun Yang <[email protected]>

    sctp: fix stream->outcnt underflow on duplicate RECONF responses

Jun Yang <[email protected]>
sctp: distinguish sequence zero from wildcard in reconf lookup

Weiming Shi <[email protected]>
sctp: fix NULL deref on untransmitted RECONF completion

Hyunwoo Kim <[email protected]>
sctp: drop a chunk if its transport was removed

Hyunwoo Kim <[email protected]>
sctp: stop processing a packet once its association is deleted

Yehyeong Lee <[email protected]>
nvme-tcp: reject a read that transferred too few bytes

Yehyeong Lee <[email protected]>
nvme-tcp: fix host memory disclosure on R2T for a read command

Yehyeong Lee <[email protected]>
nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone

Myeonghun Pak <[email protected]>
nvme-pci: disable controller on admin queue IRQ setup failure

Yehyeong Lee <[email protected]>
nvme: zero the discard fallback page

Ewan D. Milne <[email protected]>
nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path

Shuangpeng Bai <[email protected]>
lockd: fix NULL dereference on lockowner allocation failure

Michael Bommarito <[email protected]>
lockd: pin next file across nlm_inspect_file lock-drop

Cong Nguyen <[email protected]>
hwmon: (max6621) fix temperature clamp range

Cong Nguyen <[email protected]>
hwmon: (max6621) fix negative temperature offset and crit readings

Christopher Tolang <[email protected]>
ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC

Karl Mehltretter <[email protected]>
arm64: compat: Fix decrementing LDM/STM alignment emulation

HyeongJun An <[email protected]>
ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion

Norbert Szetei <[email protected]>
openvswitch: only skb_tx_error() a packet we are about to drop

Ali Ahmet Memis <[email protected]>
openrisc: fix arbitrary kernel memory access via or1k_atomic syscall

Zhan Xusheng <[email protected]>
ocfs2: fix readdir position truncation on 32-bit kernels

Joseph Qi <[email protected]>
ocfs2: cluster: fix o2hb_dependent_users leak on pin failure

Joseph Qi <[email protected]>
ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item

Joseph Qi <[email protected]>
ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin()

Ibrahim Hashimov <[email protected]>
ocfs2: validate rl_used against rl_count in refcount block validator

Bryam Vargas <[email protected]>
ocfs2: validate lengths in dlm_mig_lockres_handler

Bryam Vargas <[email protected]>
ocfs2: bound namelen in dlm_migrate_request_handler

Dmitry Antipov <[email protected]>
ocfs2: always run deallocs on copy-on-write completion

Zhiling Zou <[email protected]>
orangefs: skip leading spaces before parsing client debug masks

Yifei Gao <[email protected]>
orangefs: fix double-free of trailer_buf on readdir copy failure

Vincent Donnefort <[email protected]>
ring-buffer: Hold cpu_buffer::lock when resizing a subbuf

Vincent Donnefort <[email protected]>
ring-buffer: Free cpu_buffer::free_page with subbuf_order

Kathiravan Thirumoorthy <[email protected]>
regulator: qcom-refgen: correct the regulator type to CURRENT

WenTao Liang <[email protected]>
regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata

WenTao Liang <[email protected]>
regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer

Norbert Szetei <[email protected]>
RDMA/ucma: Lock the handler in ucma_set_ib_path()

Fan Wu <[email protected]>
RDMA/cxgb4: Cancel reg_work before freeing device on remove

Vaibhav Nagare <[email protected]>
qede: Fix NULL pointer dereference in TPA fragment processing

Johan Hovold <[email protected]>
remoteproc: scp: Fix device reference leak on failed lookup

Peixin Xie <[email protected]>
riscv: acpi: Handle LPI architectural context loss flags

Fabio Estevam <[email protected]>
arm64: dts: rockchip: Fix rk3399-roc-pc-plus analog audio

Quentin Schulz <[email protected]>
arm64: dts: rockchip: fix eMMC reset polarity on PX30 Ringneck

Krzysztof Kozlowski <[email protected]>
arm64: dts: qcom: sm6115-pro1x: Correct touchscreen GPIO flags

Chunkai Deng <[email protected]>
rpmsg: glink: smem: order FIFO read after availability check

Petr Vaganov <[email protected]>
scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()

Hao-Qun Huang <[email protected]>
staging: media: tegra-video: vi: fix probe failure on skipped last port

Hao-Qun Huang <[email protected]>
staging: media: tegra-video: fix of_node_put() on VIP parse errors

Doruk Tan Ozturk <[email protected]>
wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets

David Lee <[email protected]>
udf: reject VAT indexes equal to the entry count

Chuck Lever <[email protected]>
svcrdma: Validate Read chunk positions before reconstruction

Chuck Lever <[email protected]>
svcrdma: Use svc_xprt_put to free listener on create failure

Chuck Lever <[email protected]>
svcrdma: Reject inline replies that overflow the pull-up buffer

Chuck Lever <[email protected]>
svcrdma: Reject connection when transport allocation fails

Chris Mason <[email protected]>
svcrdma: Fix unmatched rn_unregister on failed accept

Chris Mason <[email protected]>
svcrdma: Fix pcl_for_each_segment for empty chunks

Chris Mason <[email protected]>
svcrdma: Fix offset arithmetic in read_chunk_range

Jérémy Jean <[email protected]>
SUNRPC: wait for in-flight client TLS handshake callback

Chuck Lever <[email protected]>
SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field

Chris Mason <[email protected]>
SUNRPC: reject duplicate CREDS_VALUE options

Chris Mason <[email protected]>
sunrpc: init gssp_lock before publishing proc entry

Chris Mason <[email protected]>
SUNRPC: harden gss_unwrap_resp_priv length checks

Chris Mason <[email protected]>
SUNRPC: harden gss_krb5_unwrap_v2 against short tokens

Chris Mason <[email protected]>
SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat

Chuck Lever <[email protected]>
SUNRPC: Check svc pool percpu counter allocation

Jeff Layton <[email protected]>
SUNRPC: always drain cache_cleaner before destroying a cache_detail

Jeff Layton <[email protected]>
sunrpc: route to a populated pool in svc_pool_for_cpu()

Chris Mason <[email protected]>
SUNRPC: svcauth_gss: enforce krb5 token minimum length

Chris Mason <[email protected]>
SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry

Chris Mason <[email protected]>

    SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow

Jiacheng Yu <[email protected]>
params: fix charp corruption on allocation failure

Dave Airlie <[email protected]>
nouveau/gem: reserve the bo in the info ioctl around the vma lookup

Harshit Varu <[email protected]>
mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction

Qing Ming <[email protected]>
mpls: reload header after pskb_may_pull()

Coly Li <[email protected]>

    md: do overflow check for sb->bblog_shift in super_1_load()

Yunye Zhao <[email protected]>
md/raid10: fix still_degraded being inverted in raid10_sync_request()

Anup Vishwakarma <[email protected]>
mailbox: qcom-ipcc: fix duplicate channel allocation across holes

Bryam Vargas <[email protected]>
libnvdimm/labels: Prevent integer overflow in __nd_label_validate()

Yuyang Huang <[email protected]>
ipv6: use RCU iterator to dump route exceptions

Zhiling Zou <[email protected]>
ip6_gre: fix hardware header length for NBMA tunnels

Zhiling Zou <[email protected]>
ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()

Anton Danilov <[email protected]>
ipip: fix skb leak in collect_md mode when metadata_dst allocation fails

Max Kellermann <[email protected]>
jbd2: check need_resched() when skipping busy checkpoint buffers

Max Kellermann <[email protected]>
jbd2: bound shrinker scans by examined checkpoint buffers

Hui Su <[email protected]>
kasan: fix cache shrink race with CPU hotplug

Ibrahim Abdelkader <[email protected]>
Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request

Guangshuo Li <[email protected]>
Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative

Guangshuo Li <[email protected]>
Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative

Valentin Kindschi <[email protected]>
Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection

Xin Chen <[email protected]>
Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb

Valentin Kindschi <[email protected]>
Bluetooth: hci_conn: re-enable advertising only for peripheral role

Chengfeng Ye <[email protected]>
Bluetooth: RFCOMM: serialize security confirmation handling

Hang Nan <[email protected]>
Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready

Gongwei Li <[email protected]>
Bluetooth: hci_uart: Fix false success return in hci_uart_setup()

Guangshuo Li <[email protected]>
Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative

Lorenzo Stoakes (ARM) <[email protected]>
Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378

Alison Schofield <[email protected]>
cxl/pmem: Format the nvdimm serial number as unsigned decimal

Hui Su <[email protected]>
cpufreq: schedutil: Fix rate limit overflow

Kuan-Wei Chiu <[email protected]>
coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior

Bryam Vargas <[email protected]>
dm array: reject an array block whose value size is not the caller's

Bryam Vargas <[email protected]>
dm array: validate array block headers on read

Ilya Krutskih <[email protected]>
dm raid1: reserve space for NUL-terminator in build_constructor_string()

liyouhong <[email protected]>
dm-era: fix shadowed superblock leak on take-snap failure

Jérémy Jean <[email protected]>
bpf: Harden bloom filter sizing and indexing on 32-bit kernels

Daniel Borkmann <[email protected]>
bpf: Disable preemption in __bpf_get_stack

Vineet Gupta <[email protected]>
bpf, x86: Fix per-CPU address resolution into an extended register

Jiangshan Yi <[email protected]>
bnx2x: fix double free in bnx2x_init_firmware() error path

HyeongJun An <[email protected]>
Bluetooth: eir: Fix OOB read in eir_get_service_data()

Christoph Zwerschke <[email protected]>
Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU

Christoph Zwerschke <[email protected]>
Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU

胡连勤 <[email protected]>
block: set QUEUE_FLAG_DYING unconditionally in blk_mark_disk_dead()

Hongyan Xu <[email protected]>
auxdisplay: charlcd: cancel backlight work on registration failure

Niklas Cassel <[email protected]>
ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes

Ethan Nelson-Moore <[email protected]>
ARM: 9477/1: Disable broken eBPF JIT on the Risc PC

Matt Turner <[email protected]>
alpha: marvel: Fix lock ordering in init_io7_irqs()

Matt Turner <[email protected]>
alpha: marvel: Fix irq_set_status_flags to use correct IRQ number

Krzysztof Wilczyński <[email protected]>
alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write()

Anirudh Prasad <[email protected]>
ACPI: pfr_update: fix stack buffer overflow in query_capability()

TanZheng <[email protected]>
ACPI: APEI: GHES: fix ARM section length accounting after header

Nirmoy Das <[email protected]>
ACPI: APEI: Fix ERST timeout unit conversion

Ivaylo Dimitrov <[email protected]>
hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device

Tien Sung Ang <[email protected]>
fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration

Marek Czernohous <[email protected]>
forcedeth: fix off-by-one when saving/restoring non-PCI config space

Myeonghun Pak <[email protected]>
fbdev: uvesafb: unregister connector callback on init failure

Hui Su <[email protected]>
fbdev: ssd1307fb: defer I2C transfers from damage callbacks

Florian Fuchs <[email protected]>
fbdev: pvr2fb: correct user pointer annotation and sentinel initializer

Runyu Xiao <[email protected]>
fbdev: omapfb: panel-dsi-cm: initialize lock before registering display

Yemu Lu <[email protected]>
fat: restore original value when fat_ent_write failed

Ard Biesheuvel <[email protected]>
efivarfs: Rate limit statfs() handler

Yichong Chen <[email protected]>
ecryptfs: show filename encryption options

Yichong Chen <[email protected]>
ecryptfs: release message context on send failure

Yichong Chen <[email protected]>
ecryptfs: reject too-small tag 70 packets

HanQuan <[email protected]>
ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet

Yichong Chen <[email protected]>
ecryptfs: pass packet set buffer size to parser

Yichong Chen <[email protected]>
ecryptfs: hold msg ctx list lock when cleaning daemon queue

Yichong Chen <[email protected]>
ecryptfs: fix tag 11 packet exact-fit size check

Pengpeng Hou <[email protected]>
eCryptfs: bound the packet-length peek to the user buffer

Konstantin Komarov <[email protected]>

    fs/ntfs3: bound page_lcns[] index by the log record

Samuel Page <[email protected]>
fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()

Xiang Mei <[email protected]>
fs/ntfs3: validate dirty page table on log replay

Deepanshu Kartikey <[email protected]>

    eventfs: Initialize ei->children and ei->list in init_ei()

Jiangshan Yi <[email protected]>
HID: mcp2221: validate report size in mcp2221_raw_event()

Jiangshan Yi <[email protected]>
HID: mcp2221: stop device IO before hid_hw_stop

Haoxiang Li <[email protected]>
HID: sensor: custom: Fix field sysfs group cleanup on failure

Xu Rao <[email protected]>
HID: roccat: free buffered reports when destroying device

Ibrahim Hashimov <[email protected]>
HID: picolcd: clamp eeprom debugfs read to bytes actually received

Fredric Cover <[email protected]>
smb: client: harden DFS cache against invalid target hints

Frank Sorenson <[email protected]>
smb: client: fix copy-paste error in WSL EA length accounting for $LXDEV

Frank Sorenson <[email protected]>
smb: client: fix ALIGN() overflow in symlink_data() error context loop

Fredric Cover <[email protected]>

    smb: client: clear ce->tgthint in free_tgts()

Frank Sorenson <[email protected]>

    cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0

Jérémy Jean <[email protected]>
audit: avoid dropping live tree ref on fsnotify rule autoremove

Guanghui Yang <[email protected]>
btrfs: drop recovered reloc root refs on recovery failure

Max Kellermann <[email protected]>
ceph: do not repeat ceph_trim_dentries() if no progress possible

Michael Bommarito <[email protected]>
ceph: bound xattr value length in __build_xattrs()

Michael Bommarito <[email protected]>
ceph: bound num_export_targets array for mds info v2/v3

Michael Bommarito <[email protected]>
ceph: bound MDSCapAuth path and fs_name decode in handle_session()

Michael Bommarito <[email protected]>
ceph: bound copied dentry name length in NFS export get_name

Jérémy Jean <[email protected]>
ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode

Xiubo Li <[email protected]>
ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock

Jérémy Jean <[email protected]>
libceph: reject buckets with mismatched CRUSH ids

Michael Bommarito <[email protected]>
libceph: validate OSD extent maps before cursor advance

Chuck Lever <[email protected]>
NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup

Chuck Lever <[email protected]>
NFSD: Prevent lock owner use-after-free during client teardown

Jeff Layton <[email protected]>
nfsd: revoke copy-notify stateids before dropping their reference

Jeff Layton <[email protected]>
nfsd: reject reclaim LOCK after RECLAIM_COMPLETE

Robbie Ko <[email protected]>
nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE

Robbie Ko <[email protected]>
nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops

Jeff Layton <[email protected]>
nfsd: initialize DRC hash table before registering shrinker

Jeff Layton <[email protected]>
nfsd: initialize copy-notify stateid before publishing it

Chris Mason <[email protected]>

    nfsd: gate nfs3 setacl by argp->mask

Chuck Lever <[email protected]>

    nfsd: gate nfs2 setacl by argp->mask

Jeff Layton <[email protected]>
nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo

Jeff Layton <[email protected]>
nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget

Jeff Layton <[email protected]>
nfsd: fix version mismatch loops in nfsd_acl_init_request()

Jeff Layton <[email protected]>
nfsd: fix reply size estimate for GET_DIR_DELEGATION

Jeff Layton <[email protected]>
nfsd: fix nfsd_file leak on inter-server COPY setup failure

Jeff Layton <[email protected]>
nfsd: fix dentry ref leak on V4ROOT export filehandle lookup

Chris Mason <[email protected]>
nfsd: fix cpntf publish race in nfs4_init_cp_state

Jeff Layton <[email protected]>
nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke

Jeff Layton <[email protected]>
nfsd: drop the stateid, not the stateowner, on seqid_op replay retry

Jeff Layton <[email protected]>
nfsd: defer vfree of compound ops to fix rpc_status UAF

Jeff Layton <[email protected]>
nfsd: clear opcnt on compound arg release to prevent OOB read

Jeff Layton <[email protected]>
nfsd: check client ownership when cancelling a copy-notify stateid

Jeff Layton <[email protected]>
nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref

Jeff Layton <[email protected]>
nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry

Jeff Layton <[email protected]>
nfsd: add filehandle match check to nfsd4_delegreturn()

Jeff Layton <[email protected]>
nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()

Jeff Layton <[email protected]>
nfsd: validate symlink target length in NFSv4 CREATE

Chris Mason <[email protected]>
nfsd: size fh_verify server sockaddr slot by xpt_locallen

Zhenghang Xiao <[email protected]>
nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations

Chuck Lever <[email protected]>
nfsd: sample writeback error cursor before async COPY loop

Jeff Layton <[email protected]>
nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types

Chuck Lever <[email protected]>
nfsd: Reset write verifier when async COPY writeback fails

Chris Mason <[email protected]>
nfsd: release path refs on follow_down() error

Tim Menninger <[email protected]>
pNFS: Fix EBUSY check in pnfs_layout_need_return

Junrui Luo <[email protected]>
NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path

Chris Mason <[email protected]>
nfsd: guard nfsd_serv deref in nfsd_file_net_dispose

Mike Snitzer <[email protected]>
NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check

Michael Bommarito <[email protected]>
NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock

Chuck Lever <[email protected]>
NFSD: Fix off-by-one in DRC bucket pruning limit

Chuck Lever <[email protected]>
NFSD: Encode only the status in NFS-ACL v2 GETACL error replies

Chuck Lever <[email protected]>
NFSD: check truncate permission under inode lock

Longlong Xia <[email protected]>
zsmalloc: account for handle size in class lookup

Ibrahim Hashimov <[email protected]>
ubifs: fix out-of-bounds read in signature length check

Krzysztof Wilczyński <[email protected]>
PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io()

Abdurrahman Hussain <[email protected]>
of: fix out-of-bounds read in of_alias_scan() stem parser

Ryusuke Konishi <[email protected]>
nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation

Junrui Luo <[email protected]>
media: vicodec: fix out-of-bounds write in FWHT encoder

Weigang He <[email protected]>
media: cec: stm32: prevent out-of-bounds write on RX overflow

Vincent Mailhol <[email protected]>
lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()

Xingrui Li <[email protected]>
HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature

Daisuke Matsuda <[email protected]>
fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write

Neill Kapron <[email protected]>
usb: gadget: f_fs: Prevent deadlock during ep0 read loop

Jeffin Philip <[email protected]>
usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()

Yun Zhou <[email protected]>
usb: gadget: f_tcm: fix deadlock in usbg_make_tpg()

Joshua Crofts <[email protected]>
usb: gadget: midi2: remove default configfs groups on teardown

Myeonghun Pak <[email protected]>
usb: gadget: snps_udc_plat: clean up PHY on probe deferral

Sonali Pradhan <[email protected]>
usb: gadget: u_audio: Fix use-after-free on sound card disconnect

Huang Wei <[email protected]>
usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion

Xu Yang <[email protected]>
usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive()

Johan Hovold <[email protected]>
USB: phy: fsl-usb: fix missing static keywords

Fan Wu <[email protected]>
usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed

Francesco Lavra <[email protected]>
usb: dwc2: gadget: Exit partial power down state when changing USB pull-up

Hao-Qun Huang <[email protected]>
staging: greybus: hid: fix SET_REPORT return value

Karl Mehltretter <[email protected]>

    serial: imx: serialize imx_uart_ports[] lifetime

Hans Verkuil <[email protected]>
Revert "media: v4l2-dev: fix error handling in __video_register_device()"

James Kim <[email protected]>
rapidio: mport_cdev: fix use-after-free in dma_req_free()

Bartosz Golaszewski <[email protected]>
powerpc/powermac: fix OF node refcount

Bryam Vargas <[email protected]>
misc: nsm: bound the device-reported response length

Xu Yang <[email protected]>
device property: fix infinite loop in fwnode_for_each_child_node()

Prasanna Kumar T S M <[email protected]>
cdx: Fix double free when sysfs file creation fails

Hui Su <[email protected]>
tracing: Fix use-after-free with same-name named triggers

Deepanshu Kartikey <[email protected]>
tracing: Fix use-after-free in trace_pipe read on sub-buffer order change

Vincent Donnefort <[email protected]>
tracing: Fix logged instance name on creation failure

Hui Su <[email protected]>
tracing: Fix crash passing ERR_PTR to kthread_stop()

Jérémy Jean <[email protected]>
tracing/user_events: Clear copied tracing state before fork duplication

Sanman Pradhan <[email protected]>
hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start()

Kiryl Shutsemau (Meta) <[email protected]>
x86/tdx: Fix zero-extension for 32-bit port I/O

Kiryl Shutsemau (Meta) <[email protected]>
x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg()

Kiryl Shutsemau (Meta) <[email protected]>
x86/tdx: Fix off-by-one in port I/O handling

Joy H.J. Lee <[email protected]>
tools/compiler: match glibc 2.42 definition of __attribute_const__

Johannes Weiner <[email protected]>
mm: mempolicy: fix automatic numa balancing for shmem

Guopeng Zhang <[email protected]>
mm: memcg: stop reclaim when a limit update is superseded

Hao Jia <[email protected]>
mm/zswap: fix global shrinker when memory cgroup is disabled

Breno Leitao <[email protected]>
mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec()

Dev Jain <[email protected]>
mm/page_vma_mapped: use huge_ptep_get() for hugetlb

Ye Liu <[email protected]>
mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg()

Dev Jain <[email protected]>
mm/migrate: use huge_ptep_get() in remove_migration_pte()

Breno Leitao <[email protected]>
mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()

Breno Leitao <[email protected]>
mm/kmemleak: avoid soft lockup when scanning task stacks

Jordan R Abrahams-Whitehead <[email protected]>
include/linux/list.h: mark list_add and __list_add as __always_inline

Hyunwoo Kim <[email protected]>
apparmor: fix out-of-bounds write when null terminating a label vec

Jann Horn <[email protected]>
apparmor: fix cred UAF caused by begin_current_label_crit_section()

Gary Guo <[email protected]>
rust: cfi: disable function merging if CFI is enabled

Jérémy Jean <[email protected]>
timers/itimer: Zero-init old itimerval before copy to userspace

Gaurav Batra <[email protected]>
powerpc/pseries/iommu: switch to Default DMA window during kdump

Baokun Li <[email protected]>
fs: fix user path of nested backing files

Felix Yan <[email protected]>
clocksource/drivers/timer-sun4i: Advertise a real minimum delta

Matt Turner <[email protected]>
alpha: don't leak hardware-fabricated FP exception bits to user space

Matt Turner <[email protected]>
alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally

Srinivasan Shanmugam <[email protected]>
drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths

Zilin Guan <[email protected]>
wifi: ath11k: fix memory leaks in beacon template setup

Zilin Guan <[email protected]>
wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req()

Zide Chen <[email protected]>
perf/x86/intel/uncore: Fix die ID init and look up bugs

Mario Limonciello <[email protected]>
drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1

Ming Lei <[email protected]>

    block: mark GFP_NOIO around sysfs ->store()

Chao Yu <[email protected]>
f2fs: fix potential deadloop in prepare_compress_overwrite()

Yang Erkun <[email protected]>
md: make rdev_addable usable for rcu mode

Michael Chan <[email protected]>
bnxt_en: Mask the bd_cnt field in the TX BD properly

-------------

Diffstat:

 Documentation/ABI/testing/sysfs-bus-nvdimm         |   3 +-
 Makefile                                           |   7 +-
 arch/alpha/include/uapi/asm/fpu.h                  |   8 +-
 arch/alpha/kernel/pci-sysfs.c                      |   6 +-
 arch/alpha/kernel/sys_marvel.c                     |  25 ++-
 arch/alpha/kernel/traps.c                          |   6 +-
 arch/alpha/math-emu/math.c                         |  88 +++++++-
 arch/arm/Kconfig                                   |   2 +-
 arch/arm64/boot/dts/qcom/sm6115-fxtec-pro1x.dts    |   2 +-
 arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi    |   2 +-
 .../arm64/boot/dts/rockchip/rk3399-roc-pc-plus.dts |  12 ++
 arch/arm64/kernel/compat_alignment.c               |   4 +-
 arch/openrisc/kernel/entry.S                       |  43 +++-
 arch/powerpc/kernel/pci-common.c                   |   9 +-
 arch/powerpc/platforms/powermac/low_i2c.c          |   2 +-
 arch/powerpc/platforms/pseries/iommu.c             |  23 ++-
 arch/riscv/include/asm/acpi.h                      |  19 ++
 arch/s390/kernel/perf_cpum_cf.c                    | 221 ++++++++++++++-------
 arch/x86/coco/tdx/tdx.c                            |  10 +-
 arch/x86/events/intel/uncore.c                     |   1 +
 arch/x86/events/intel/uncore_snbep.c               |  13 +-
 arch/x86/include/asm/insn-eval.h                   |  36 ++++
 arch/x86/include/asm/sev.h                         |   2 +
 arch/x86/kvm/emulate.c                             |  26 +--
 arch/x86/net/bpf_jit_comp.c                        |   2 +-
 arch/x86/virt/svm/sev.c                            |  21 +-
 block/blk-sysfs.c                                  |   3 +
 block/genhd.c                                      |   1 +
 drivers/acpi/apei/erst.c                           |   2 +-
 drivers/acpi/apei/ghes.c                           |   2 +-
 drivers/acpi/pfr_update.c                          |  45 +++--
 drivers/ata/libata-scsi.c                          |  28 +--
 drivers/auxdisplay/charlcd.c                       |  21 +-
 drivers/base/arch_numa.c                           |  12 ++
 drivers/base/property.c                            |  19 +-
 drivers/bluetooth/btusb.c                          |   6 +
 drivers/bluetooth/hci_bcm.c                        |   1 +
 drivers/bluetooth/hci_bcm4377.c                    |   1 +
 drivers/bluetooth/hci_h5.c                         |   4 +-
 drivers/bluetooth/hci_intel.c                      |   1 +
 drivers/bluetooth/hci_ldisc.c                      |   2 +-
 drivers/bluetooth/hci_serdev.c                     |   2 +-
 drivers/cdx/cdx.c                                  |   7 +-
 drivers/char/ipmi/ipmb_dev_int.c                   |   5 +-
 drivers/char/ipmi/ipmi_msghandler.c                |   1 +
 drivers/char/tpm/tpm_i2c_nuvoton.c                 |   6 +-
 drivers/clocksource/timer-sun4i.c                  |   2 +-
 drivers/crypto/allwinner/Kconfig                   |  16 --
 drivers/crypto/allwinner/sun8i-ce/Makefile         |   1 -
 drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c  |  57 ------
 drivers/crypto/allwinner/sun8i-ce/sun8i-ce-prng.c  | 159 ---------------
 drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h       |  29 ---
 drivers/crypto/allwinner/sun8i-ss/Makefile         |   1 -
 drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c  |  39 ----
 drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c  | 177 -----------------
 drivers/crypto/allwinner/sun8i-ss/sun8i-ss.h       |  23 ---
 drivers/cxl/core/pmem.c                            |  10 +-
 drivers/cxl/cxl.h                                  |   3 +-
 drivers/cxl/pmem.c                                 |   2 +-
 drivers/fpga/altera-cvp.c                          |  10 +-
 drivers/fpga/stratix10-soc.c                       |  21 +-
 drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c       |  10 +-
 .../amd/display/dc/dml2/dml2_translation_helper.c  |   2 +-
 drivers/gpu/drm/nouveau/nouveau_gem.c              |  11 +-
 drivers/hid/hid-mcp2221.c                          |   9 +
 drivers/hid/hid-picolcd_debugfs.c                  |   9 +
 drivers/hid/hid-roccat.c                           |  13 +-
 drivers/hid/hid-sensor-custom.c                    |   9 +-
 drivers/hid/hid-sensor-hub.c                       |  46 +++--
 drivers/hsi/controllers/omap_ssi_core.c            |   6 +
 drivers/hwmon/max6621.c                            |   8 +-
 .../hwtracing/coresight/coresight-etm3x-sysfs.c    |  15 +-
 drivers/hwtracing/ptt/hisi_ptt.c                   |  20 +-
 drivers/i3c/master.c                               |  12 +-
 drivers/i3c/master/svc-i3c-master.c                |  10 +-
 drivers/infiniband/core/ucma.c                     |   5 +-
 drivers/infiniband/hw/cxgb4/device.c               |   6 +
 drivers/interconnect/core.c                        |   7 +-
 drivers/iommu/amd/init.c                           |  36 +++-
 drivers/iommu/amd/ppr.c                            |   3 +-
 drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c        |  56 ++++--
 drivers/iommu/intel/dmar.c                         |  15 +-
 drivers/iommu/intel/iommu.c                        |   8 +-
 drivers/iommu/intel/iommu.h                        |   2 +
 drivers/iommu/iommu-sva.c                          |   2 +-
 drivers/mailbox/qcom-ipcc.c                        |  17 +-
 drivers/md/dm-era-target.c                         |   5 +
 drivers/md/dm-log-userspace-base.c                 |   1 +
 drivers/md/dm-stats.c                              |   6 +-
 drivers/md/dm-switch.c                             |   2 +-
 drivers/md/md.c                                    |  15 +-
 drivers/md/persistent-data/dm-array.c              |  53 ++++-
 drivers/md/raid10.c                                |   2 +-
 drivers/media/cec/platform/stm32/stm32-cec.c       |   3 +-
 drivers/media/test-drivers/vicodec/vicodec-core.c  |   4 +-
 drivers/media/v4l2-core/v4l2-dev.c                 |  14 +-
 drivers/mfd/sm501.c                                |   2 +
 drivers/misc/nsm.c                                 |   2 +-
 drivers/mmc/host/via-sdmmc.c                       |   8 +-
 drivers/net/dsa/realtek/rtl83xx.c                  |   4 +-
 drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c   |   3 +
 drivers/net/ethernet/broadcom/bnxt/bnxt.c          |   4 +-
 drivers/net/ethernet/broadcom/bnxt/bnxt.h          |   2 +
 drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c      |   3 +-
 drivers/net/ethernet/nvidia/forcedeth.c            |   4 +-
 drivers/net/ethernet/qlogic/qede/qede.h            |   8 +-
 drivers/net/ethernet/qlogic/qede/qede_fp.c         |   1 +
 drivers/net/ethernet/renesas/ravb.h                |   3 +
 drivers/net/ethernet/renesas/ravb_main.c           |   9 +-
 drivers/net/ethernet/renesas/ravb_ptp.c            |  44 +++-
 drivers/net/ipa/ipa_modem.c                        |  18 +-
 drivers/net/ntb_netdev.c                           |  11 +-
 drivers/net/slip/slip.c                            |  11 +-
 drivers/net/thunderbolt/main.c                     |  12 ++
 drivers/net/tun.c                                  |  21 +-
 drivers/net/usb/qmi_wwan.c                         |   1 +
 drivers/net/wireless/ath/ath11k/mac.c              |  28 ++-
 drivers/net/wireless/ath/ath6kl/cfg80211.c         |   5 +
 .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    |   3 +-
 drivers/net/wireless/marvell/mwifiex/sta_ioctl.c   |  12 ++
 drivers/net/wireless/mediatek/mt76/mt7615/main.c   |   5 +-
 .../net/wireless/mediatek/mt76/mt76_connac_mcu.c   |  16 +-
 drivers/net/wireless/mediatek/mt76/mt7915/mcu.c    |   4 +-
 drivers/net/wireless/mediatek/mt76/mt7925/mcu.c    |   4 +-
 drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c |   2 +-
 drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c |   2 +-
 drivers/net/wireless/realtek/rtl8xxxu/core.c       |  19 +-
 .../net/wireless/realtek/rtlwifi/rtl8192du/sw.c    |  12 +-
 .../net/wireless/realtek/rtlwifi/rtl8192du/trx.c   |   3 +-
 drivers/net/wireless/realtek/rtw88/pci.c           |   4 +-
 drivers/net/wireless/realtek/rtw88/tx.c            |   1 +
 drivers/ntb/ntb_transport.c                        |  38 ++--
 drivers/nvdimm/label.c                             |   2 +-
 drivers/nvme/host/core.c                           |   2 +-
 drivers/nvme/host/fc.c                             |   2 +-
 drivers/nvme/host/pci.c                            |   1 +
 drivers/nvme/host/tcp.c                            |  45 ++++-
 drivers/of/base.c                                  |   2 +-
 drivers/pci/controller/dwc/pci-meson.c             |   2 +-
 drivers/pci/controller/pci-hyperv.c                |   1 +
 drivers/pci/controller/plda/pcie-plda-host.c       |  52 ++++-
 drivers/pci/msi/msi.c                              |  10 +
 drivers/pci/pci-sysfs.c                            |  42 +++-
 drivers/pci/pcie/portdrv.c                         |   2 +-
 drivers/pci/proc.c                                 |  16 +-
 drivers/pci/quirks.c                               |   9 +-
 drivers/platform/chrome/cros_ec_sensorhub_ring.c   |  19 +-
 .../x86/dell/dell-wmi-sysman/biosattr-interface.c  |   1 -
 drivers/platform/x86/hp/hp-bioscfg/bioscfg.c       |  18 +-
 drivers/platform/x86/hp/hp-bioscfg/bioscfg.h       |   8 +
 .../platform/x86/hp/hp-bioscfg/enum-attributes.c   |  15 +-
 .../platform/x86/hp/hp-bioscfg/int-attributes.c    |   6 +-
 .../x86/hp/hp-bioscfg/order-list-attributes.c      |  14 +-
 .../x86/hp/hp-bioscfg/passwdobj-attributes.c       |  14 +-
 .../platform/x86/hp/hp-bioscfg/spmobj-attributes.c |   4 +-
 .../platform/x86/hp/hp-bioscfg/string-attributes.c |   6 +-
 drivers/platform/x86/intel/ishtp_eclite.c          |   5 +-
 .../x86/intel/speed_select_if/isst_tpmi_core.c     |  77 ++++++-
 drivers/power/supply/bq24257_charger.c             |  16 +-
 drivers/power/supply/bq256xx_charger.c             |  29 +--
 drivers/power/supply/bq25890_charger.c             |  12 ++
 drivers/power/supply/charger-manager.c             |  54 +++--
 drivers/power/supply/cros_usbpd-charger.c          |  17 +-
 drivers/power/supply/lp8727_charger.c              |   4 +-
 drivers/power/supply/lp8788-charger.c              |   2 +-
 drivers/power/supply/max17040_battery.c            |  32 ++-
 drivers/power/supply/qcom_battmgr.c                |   2 +-
 drivers/power/supply/rt9455_charger.c              |  21 +-
 drivers/power/supply/twl4030_charger.c             |  12 +-
 drivers/power/supply/ucs1002_power.c               |   6 +-
 drivers/rapidio/devices/rio_mport_cdev.c           |  10 +-
 drivers/regulator/as3722-regulator.c               |   1 -
 drivers/regulator/max8998.c                        |   1 -
 drivers/regulator/qcom-refgen-regulator.c          |   4 +-
 drivers/remoteproc/mtk_scp.c                       |   9 +-
 drivers/rpmsg/qcom_glink_smem.c                    |   7 +
 drivers/s390/block/dasd.c                          |   6 +-
 drivers/s390/block/dasd_eckd.c                     |  40 +++-
 drivers/s390/block/dasd_erp.c                      |   3 +
 drivers/scsi/scsi_lib.c                            |   2 +
 drivers/staging/greybus/hid.c                      |   2 +-
 drivers/staging/media/tegra-video/vi.c             |   9 +-
 drivers/staging/media/tegra-video/vip.c            |  10 +-
 drivers/tty/serial/imx.c                           |  20 +-
 drivers/usb/dwc2/gadget.c                          |  11 +-
 drivers/usb/gadget/function/f_fs.c                 |  14 +-
 drivers/usb/gadget/function/f_midi2.c              |   2 +
 drivers/usb/gadget/function/f_tcm.c                |  23 ++-
 drivers/usb/gadget/function/f_uvc.c                |   7 +-
 drivers/usb/gadget/function/u_audio.c              |  24 ++-
 drivers/usb/gadget/udc/at91_udc.c                  |  20 +-
 drivers/usb/gadget/udc/snps_udc_plat.c             |   5 +-
 drivers/usb/phy/phy-fsl-usb.c                      |  52 ++---
 drivers/usb/phy/phy-fsl-usb.h                      |   6 +-
 drivers/usb/typec/tcpm/tcpci.c                     |  12 +-
 drivers/usb/typec/ucsi/ucsi.c                      |   3 +-
 .../fbdev/omap2/omapfb/displays/panel-dsi-cm.c     |   4 +-
 drivers/video/fbdev/pvr2fb.c                       |   4 +-
 drivers/video/fbdev/ssd1307fb.c                    |  72 ++++++-
 drivers/video/fbdev/uvesafb.c                      |   2 +
 drivers/video/sticore.c                            |  22 +-
 drivers/w1/slaves/w1_ds28e17.c                     |   8 +
 fs/backing-file.c                                  |   2 +-
 fs/btrfs/relocation.c                              |  31 ++-
 fs/ceph/caps.c                                     |  11 +-
 fs/ceph/dir.c                                      |  10 +-
 fs/ceph/export.c                                   |  26 ++-
 fs/ceph/mds_client.c                               |   8 +-
 fs/ceph/mdsmap.c                                   |  11 +-
 fs/ceph/xattr.c                                    |   1 +
 fs/ecryptfs/crypto.c                               |   2 +-
 fs/ecryptfs/ecryptfs_kernel.h                      |   3 +-
 fs/ecryptfs/keystore.c                             |  45 ++++-
 fs/ecryptfs/messaging.c                            |  11 +-
 fs/ecryptfs/miscdev.c                              |   5 +-
 fs/ecryptfs/super.c                                |   7 +
 fs/efivarfs/super.c                                |  30 ++-
 fs/f2fs/compress.c                                 |   1 +
 fs/f2fs/data.c                                     |  10 +-
 fs/fat/misc.c                                      |   4 +
 fs/jbd2/checkpoint.c                               |  28 +--
 fs/lockd/clntproc.c                                |   3 +
 fs/lockd/svcsubs.c                                 |  53 ++---
 fs/nfs/pnfs.c                                      |   3 +-
 fs/nfsd/filecache.c                                |  15 +-
 fs/nfsd/flexfilelayoutxdr.c                        |  20 +-
 fs/nfsd/nfs2acl.c                                  |  52 ++---
 fs/nfsd/nfs3acl.c                                  |  17 +-
 fs/nfsd/nfs3proc.c                                 |  40 ++++
 fs/nfsd/nfs4layouts.c                              |  12 +-
 fs/nfsd/nfs4proc.c                                 |  51 +++--
 fs/nfsd/nfs4state.c                                | 215 +++++++++++++++-----
 fs/nfsd/nfs4xdr.c                                  |  22 +-
 fs/nfsd/nfscache.c                                 |   6 +-
 fs/nfsd/nfsctl.c                                   |  11 +-
 fs/nfsd/nfsfh.c                                    |  12 +-
 fs/nfsd/nfsproc.c                                  |   7 +
 fs/nfsd/nfssvc.c                                   |   4 +-
 fs/nfsd/nfsxdr.c                                   |  32 ++-
 fs/nfsd/trace.h                                    |   4 +-
 fs/nfsd/vfs.c                                      |  34 ++--
 fs/nilfs2/bmap.c                                   |   2 +-
 fs/nilfs2/bmap.h                                   |   2 +-
 fs/nilfs2/btree.c                                  |  39 +++-
 fs/nilfs2/direct.c                                 |   4 +-
 fs/ntfs3/frecord.c                                 |   9 +
 fs/ntfs3/fslog.c                                   |  34 ++++
 fs/ocfs2/cluster/heartbeat.c                       | 150 +++++++++++---
 fs/ocfs2/cluster/nodemanager.c                     |   6 +
 fs/ocfs2/cluster/nodemanager.h                     |   1 +
 fs/ocfs2/dir.c                                     |   2 +-
 fs/ocfs2/dlm/dlmmaster.c                           |   6 +
 fs/ocfs2/dlm/dlmrecovery.c                         |   9 +
 fs/ocfs2/refcounttree.c                            |  47 +++--
 fs/ocfs2/xattr.c                                   |   5 +-
 fs/orangefs/devorangefs-req.c                      |   1 +
 fs/orangefs/orangefs-debugfs.c                     |   1 +
 fs/smb/client/cifsfs.c                             |  15 +-
 fs/smb/client/dfs_cache.c                          |  33 ++-
 fs/smb/client/smb1ops.c                            |   2 +-
 fs/smb/client/smb2file.c                           |   5 +-
 fs/tracefs/event_inode.c                           |   7 +-
 fs/ubifs/auth.c                                    |   2 +-
 fs/udf/inode.c                                     |   2 +-
 fs/udf/partition.c                                 |   2 +-
 include/linux/amd-iommu.h                          |   4 +-
 include/linux/list.h                               |  15 +-
 include/linux/sunrpc/svc_rdma_pcl.h                |   2 +-
 include/linux/usb/tcpci.h                          |   1 +
 include/net/ip_tunnels.h                           |  11 +-
 include/net/sctp/structs.h                         |   2 +-
 kernel/auditfilter.c                               |   6 +-
 kernel/bpf/bloom_filter.c                          |  19 +-
 kernel/bpf/stackmap.c                              |   3 +
 kernel/params.c                                    |  14 +-
 kernel/sched/cpufreq_schedutil.c                   |  15 +-
 kernel/signal.c                                    |   4 +
 kernel/taskstats.c                                 |   3 +-
 kernel/time/itimer.c                               |   2 +-
 kernel/time/timer.c                                |   1 +
 kernel/trace/ring_buffer.c                         | 170 ++++++++++------
 kernel/trace/trace.c                               |   6 +-
 kernel/trace/trace_events.c                        |   2 +
 kernel/trace/trace_events_hist.c                   |   4 +-
 kernel/trace/trace_events_user.c                   |   3 +
 lib/ucs2_string.c                                  |   2 +-
 lib/xarray.c                                       |   3 +
 mm/kasan/quarantine.c                              |   7 +-
 mm/kmemleak.c                                      |  51 +++--
 mm/memcontrol.c                                    |   6 +
 mm/mempolicy.c                                     |  21 +-
 mm/migrate.c                                       |   8 +-
 mm/page_owner.c                                    |  10 +-
 mm/page_vma_mapped.c                               |   8 +-
 mm/vmscan.c                                        |   2 +-
 mm/zsmalloc.c                                      |  11 +-
 mm/zswap.c                                         |  13 +-
 net/bluetooth/eir.c                                |   3 +-
 net/bluetooth/hci_conn.c                           |   3 +-
 net/bluetooth/hci_core.c                           |   2 +-
 net/bluetooth/hci_event.c                          |   7 +-
 net/bluetooth/hci_sync.c                           |   2 +
 net/bluetooth/iso.c                                |   8 +
 net/bluetooth/rfcomm/core.c                        |   8 +-
 net/ceph/osd_client.c                              |  30 +++
 net/ceph/osdmap.c                                  |   2 +
 net/core/skbuff.c                                  |   5 +-
 net/core/xdp.c                                     |   4 +-
 net/ipv4/ip_tunnel.c                               |   2 +-
 net/ipv4/ipip.c                                    |   2 +-
 net/ipv6/ip6_gre.c                                 |  14 +-
 net/ipv6/ip6_tunnel.c                              |  22 +-
 net/ipv6/route.c                                   |   2 +-
 net/ipv6/seg6_local.c                              |   9 +
 net/ipv6/sit.c                                     |   2 +-
 net/iucv/af_iucv.c                                 |   2 +
 net/l2tp/l2tp_netlink.c                            |  16 +-
 net/mpls/af_mpls.c                                 |   2 +
 net/mptcp/syncookies.c                             |   1 +
 net/openvswitch/conntrack.c                        |   8 +-
 net/openvswitch/datapath.c                         |  50 ++---
 net/sched/sch_generic.c                            |   2 +-
 net/sctp/inqueue.c                                 |   7 +-
 net/sctp/sm_sideeffect.c                           |   4 +
 net/sctp/stream.c                                  |  48 +++--
 net/smc/af_smc.c                                   |   3 +-
 net/smc/smc_core.c                                 |  27 +--
 net/smc/smc_rx.c                                   |  11 +-
 net/smc/smc_tx.h                                   |   6 +-
 net/sunrpc/auth_gss/auth_gss.c                     |   6 +-
 net/sunrpc/auth_gss/gss_krb5_wrap.c                |  13 +-
 net/sunrpc/auth_gss/gss_rpc_upcall.c               |   6 -
 net/sunrpc/auth_gss/gss_rpc_upcall.h               |   1 -
 net/sunrpc/auth_gss/gss_rpc_xdr.c                  |   6 +
 net/sunrpc/auth_gss/svcauth_gss.c                  |   8 +-
 net/sunrpc/cache.c                                 |   7 +-
 net/sunrpc/sunrpc_syms.c                           |   1 +
 net/sunrpc/svc.c                                   |  74 ++++++-
 net/sunrpc/xdr.c                                   |   2 +-
 net/sunrpc/xprtrdma/ib_client.c                    |  24 ++-
 net/sunrpc/xprtrdma/svc_rdma_rw.c                  |  47 ++++-
 net/sunrpc/xprtrdma/svc_rdma_sendto.c              |  47 +++--
 net/sunrpc/xprtrdma/svc_rdma_transport.c           |  52 +++--
 net/sunrpc/xprtsock.c                              |  12 +-
 net/vmw_vsock/virtio_transport.c                   |   2 +-
 scripts/rust_is_available.sh                       |  14 ++
 scripts/rust_is_available_bindgen_libclang_22.h    |   5 +
 scripts/rust_is_available_test.py                  |  30 ++-
 security/apparmor/include/cred.h                   |   6 +-
 security/apparmor/include/label.h                  |   6 +-
 security/apparmor/include/task.h                   |  15 +-
 security/apparmor/task.c                           |  27 +++
 security/smack/smack_lsm.c                         |   2 +-
 sound/core/ump_convert.c                           |   1 +
 sound/drivers/aloop.c                              |   6 +
 sound/drivers/mpu401/mpu401.c                      |   6 +
 sound/drivers/mts64.c                              |   6 +
 sound/drivers/portman2x4.c                         |   6 +
 sound/drivers/serial-u16550.c                      |   6 +
 sound/drivers/virmidi.c                            |   6 +
 sound/pci/pcxhr/pcxhr.c                            |  14 +-
 sound/soc/amd/yc/acp6x-mach.c                      |   7 +
 sound/usb/6fire/comm.c                             |   9 +-
 sound/usb/bcd2000/bcd2000.c                        |  11 +-
 tools/include/linux/compiler.h                     |   2 +-
 .../selftests/kvm/x86_64/sev_migrate_tests.c       |   2 -
 366 files changed, 3709 insertions(+), 1854 deletions(-)

Read the cover letter in its thread