6.18.50-rc1 review

Greg Kroah-Hartman linux-arm-kernel linux-fsdevel linux-mm linux-patches linux-um lkml netfs stable 1 version Sep 4 In review

Get series with b4

b4 am [email protected]

Versions newest first

v1 Latest Sep 4552 patches 14 repliesIn review

Patches in v1 No applies recorded yet

#	Subject and files	Size	Replies
1/552	perf/x86/intel/uncore: Fix die ID init and look up bugs`arch/x86/events/intel/uncore.c` `arch/x86/events/intel/uncore_snbep.c`	+7 -7	0 replies
2/552	wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req()`drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c` `drivers/net/wireless/mediatek/mt76/mt7915/mcu.c` `drivers/net/wireless/mediatek/mt76/mt7925/mcu.c`	+18 -6	0 replies
3/552	wifi: ath11k: fix memory leaks in beacon template setup`drivers/net/wireless/ath/ath11k/mac.c`	+17 ~~-11~~	0 replies
4/552	fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free`fs/fuse/dev.c`	+2 -1	0 replies
5/552	ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS`include/linux/netdevice.h` `include/net/ip_tunnels.h`	+24 -9	0 replies
6/552	bpf: Fix incorrect pruning due to atomic fetch precision tracking`kernel/bpf/verifier.c`	+24 -3	0 replies
7/552	nsfs: tighten permission checks for handle opening`fs/nsfs.c`	+1 -1	0 replies
8/552	drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths`drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c`	+8 -2	0 replies
9/552	platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmi_dev_evaluate_int()`drivers/platform/x86/lenovo/wmi-helpers.c`	+2 -2	0 replies
10/552	netfs: Fix missing locking around retry adding new subreqs`fs/netfs/read_retry.c` `fs/netfs/write_retry.c`	+10 -2	0 replies
11/552	drm/amd/display: Skip PHY SSC reduction on some 8K panels`drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c`	+10 -3	0 replies
12/552	drm/amd/display: Refactor amdgpu_dm_connector_detect (v2)`drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c`	+19 ~~-16~~	0 replies
13/552	drm/amd/display: hide Apple Studio Display secondary tile`drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c` `drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c` `drivers/gpu/drm/amd/display/dc/dc_types.h`	+48 -0	0 replies
14/552	drm/amd/display: Prune per-tile Timing from Apple Studio Display Primary Tile`drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c`	+43 -0	0 replies
15/552	alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally`arch/alpha/include/uapi/asm/fpu.h`	+6 -2	0 replies
16/552	rust: time: fix as_micros_ceil() rounding near i64::MAX`rust/kernel/time.rs`	+10 -7	0 replies
17/552	alpha: dont leak hardware-fabricated FP exception bits to user space`arch/alpha/kernel/traps.c` `arch/alpha/math-emu/math.c`	+80 ~~-14~~	0 replies
18/552	clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path`drivers/clocksource/timer-nxp-pit.c`	+3 -1	0 replies
19/552	clocksource/drivers/timer-sun4i: Advertise a real minimum delta`drivers/clocksource/timer-sun4i.c`	+1 -1	0 replies
20/552	fs: fix user path of nested backing files`fs/backing-file.c`	+1 -1	0 replies
21/552	powerpc/pseries/iommu: switch to Default DMA window during kdump`arch/powerpc/platforms/pseries/iommu.c`	+12 ~~-11~~	0 replies
22/552	timers/itimer: Zero-init old itimerval before copy to userspace`kernel/time/itimer.c`	+1 -1	0 replies
23/552	rust: bug: skip arch-specific asm in `testlib` builds`rust/kernel/bug.rs`	+5 -1	0 replies
24/552	rust: bug: fix warn_on macro build error on UML`rust/kernel/bug.rs`	+1 -1	3 replies
25/552	rust: kernel: list: fix incorrect pop_back example comment`rust/kernel/list.rs`	+1 -1	0 replies
26/552	rust: cfi: disable function merging if CFI is enabled`Makefile`	+2 -1	0 replies
27/552	KEYS: trusted: Fix TPM teardown ordering`security/keys/trusted-keys/trusted_tpm1.c`	+1 -1	0 replies
28/552	apparmor: fix cred UAF caused by begin_current_label_crit_section()`security/apparmor/include/cred.h` `security/apparmor/include/task.h` `security/apparmor/task.c`	+39 -9	0 replies
29/552	apparmor: fix out-of-bounds write when null terminating a label vec`security/apparmor/include/label.h`	+3 -3	0 replies
30/552	include/linux/list.h: mark list_add and __list_add as __always_inline`include/linux/list.h`	+11 -4	0 replies
31/552	mm, swap: ratelimit bad swap entry reports`mm/swapfile.c`	+3 -3	0 replies
32/552	mm/gup: fix always draining LRU caches in collect_longterm_unpinnable_folios()`mm/gup.c`	+8 -2	0 replies
33/552	mm/kmemleak: avoid soft lockup when scanning task stacks`mm/kmemleak.c`	+38 ~~-13~~	0 replies
34/552	mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()`mm/migrate.c`	+1 -1	0 replies
35/552	mm/migrate: use huge_ptep_get() in remove_migration_pte()`mm/migrate.c`	+5 -1	0 replies
36/552	mm/mm_init: deferred_grow_zone(): fix out-of-range first_deferred_pfn`mm/mm_init.c`	+6 -3	0 replies
37/552	mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg()`mm/page_owner.c`	+7 -3	0 replies
38/552	mm/page_vma_mapped: use huge_ptep_get() for hugetlb`mm/page_vma_mapped.c`	+7 -1	4 replies
39/552	mm/pagewalk: fix stale walk->action escaping walk_pmd_range()`mm/pagewalk.c`	+2 -4	0 replies
40/552	mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec()`mm/vmscan.c`	+1 -1	0 replies
41/552	mm/zswap: fix global shrinker when memory cgroup is disabled`mm/zswap.c`	+7 -6	0 replies
42/552	mm: compaction: support non-movable compaction for pageblock requests`mm/compaction.c`	+39 -7	0 replies
43/552	mm: memcg-v1: fix wrong linux-mm list address in deprecation warnings`mm/memcontrol-v1.c`	+3 -3	0 replies
44/552	mm: memcg-v1: fix memsw and TCP failcnt accounting`mm/memcontrol.c`	+2 -0	0 replies
45/552	mm: memcg: stop reclaim when a limit update is superseded`mm/memcontrol.c`	+6 -0	0 replies
46/552	mm: memcontrol: update state_local when flushing NMI stats`mm/memcontrol.c`	+5 -0	0 replies
47/552	mm: mempolicy: fix automatic numa balancing for shmem`mm/mempolicy.c`	+6 ~~-15~~	0 replies
48/552	mm: page_alloc: __GFP_FS lockdep annotation for direct compaction`mm/page_alloc.c`	+2 -0	0 replies
49/552	mm: page_alloc: move capture_control to the page allocator`include/linux/compaction.h` `mm/compaction.c` `mm/internal.h` +1 more	+57 ~~-45~~	0 replies
50/552	mm: page_alloc: fix non-movable reclaim storm in defrag_mode`mm/compaction.c` `mm/internal.h` `mm/page_alloc.c`	+33 -6	0 replies
51/552	mm: vmscan: fix node reclaim ignoring swappiness parameter`mm/vmscan.c`	+7 ~~-12~~	0 replies
52/552	tools/compiler: match glibc 2.42 definition of __attribute_const__`tools/include/linux/compiler.h`	+1 -1	0 replies
53/552	x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg()`arch/x86/include/asm/insn-eval.h` `arch/x86/kvm/emulate.c`	+40 ~~-22~~	0 replies
54/552	x86/locking: Use sfence for wmb() if SSE is available`arch/x86/include/asm/barrier.h`	+1 -1	0 replies
55/552	x86/tdx: Fix off-by-one in port I/O handling`arch/x86/coco/tdx/tdx.c`	+2 -2	0 replies
56/552	x86/tdx: Fix zero-extension for 32-bit port I/O`arch/x86/coco/tdx/tdx.c`	+3 -5	0 replies
57/552	hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start()`drivers/hwtracing/ptt/hisi_ptt.c`	+13 -7	0 replies
58/552	tracing/user_events: Clear copied tracing state before fork duplication`kernel/trace/trace_events_user.c`	+3 -0	0 replies
59/552	tracing: Fix crash passing ERR_PTR to kthread_stop()`kernel/trace/trace_events.c`	+2 -0	0 replies
60/552	tracing: Fix logged instance name on creation failure`kernel/trace/trace.c`	+2 -1	0 replies
61/552	tracing: Fix use-after-free in trace_pipe read on sub-buffer order change`kernel/trace/trace.c`	+3 -0	0 replies
62/552	tracing: Fix use-after-free with same-name named triggers`kernel/trace/trace_events_hist.c`	+3 -1	0 replies
63/552	cdx: Fix double free when sysfs file creation fails`drivers/cdx/cdx.c`	+5 -2	0 replies
64/552	device property: fix infinite loop in fwnode_for_each_child_node()`drivers/base/property.c`	+16 -3	0 replies
65/552	misc: nsm: bound the device-reported response length`drivers/misc/nsm.c`	+1 -1	0 replies
66/552	powerpc/powermac: fix OF node refcount`arch/powerpc/platforms/powermac/low_i2c.c`	+1 -1	0 replies
67/552	rapidio: mport_cdev: fix use-after-free in dma_req_free()`drivers/rapidio/devices/rio_mport_cdev.c`	+7 -3	0 replies
68/552	Revert "media: v4l2-dev: fix error handling in __video_register_device()"`drivers/media/v4l2-core/v4l2-dev.c`	+7 -7	0 replies
69/552	serial: imx: serialize imx_uart_ports[] lifetime`drivers/tty/serial/imx.c`	+17 -3	0 replies
70/552	staging: greybus: hid: fix SET_REPORT return value`drivers/staging/greybus/hid.c`	+1 -1	0 replies
71/552	usb: dwc2: gadget: Exit partial power down state when changing USB pull-up`drivers/usb/dwc2/gadget.c`	+10 -1	0 replies
72/552	usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition`drivers/usb/dwc3/gadget.c`	+1 -0	0 replies
73/552	usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed`drivers/usb/gadget/udc/at91_udc.c`	+19 -1	0 replies
74/552	USB: phy: fsl-usb: fix missing static keywords`drivers/usb/phy/phy-fsl-usb.c` `drivers/usb/phy/phy-fsl-usb.h`	+29 ~~-29~~	0 replies
75/552	usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive()`drivers/usb/typec/tcpm/tcpci.c` `include/linux/usb/tcpci.h`	+12 -1	0 replies
76/552	usb: typec: thunderbolt: Disable work before freeing tbt on remove`drivers/usb/typec/altmodes/thunderbolt.c`	+2 -0	0 replies
77/552	usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion`drivers/usb/typec/ucsi/ucsi.c`	+2 -1	0 replies
78/552	usb: gadget: u_audio: Fix use-after-free on sound card disconnect`drivers/usb/gadget/function/u_audio.c`	+18 -6	0 replies
79/552	usb: gadget: snps_udc_plat: clean up PHY on probe deferral`drivers/usb/gadget/udc/snps_udc_plat.c`	+2 -3	0 replies
80/552	usb: gadget: midi2: remove default configfs groups on teardown`drivers/usb/gadget/function/f_midi2.c`	+2 -0	0 replies
81/552	usb: gadget: f_tcm: fix deadlock in usbg_make_tpg()`drivers/usb/gadget/function/f_tcm.c`	+12 ~~-11~~	0 replies
82/552	usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init()`drivers/usb/gadget/function/uvc_video.c`	+1 -1	0 replies
83/552	usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()`drivers/usb/gadget/function/f_uvc.c`	+6 -1	0 replies
84/552	usb: gadget: f_fs: Prevent deadlock during ep0 read loop`drivers/usb/gadget/function/f_fs.c`	+10 -4	0 replies
85/552	fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write`drivers/fpga/altera-cvp.c`	+6 -4	0 replies
86/552	HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature`drivers/hid/hid-sensor-hub.c`	+26 ~~-18~~	0 replies
87/552	lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()`lib/ucs2_string.c`	+1 -1	0 replies
88/552	media: cec: stm32: prevent out-of-bounds write on RX overflow`drivers/media/cec/platform/stm32/stm32-cec.c`	+2 -1	0 replies
89/552	media: vicodec: fix out-of-bounds write in FWHT encoder`drivers/media/test-drivers/vicodec/vicodec-core.c`	+2 -2	0 replies
90/552	nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation`fs/nilfs2/bmap.c` `fs/nilfs2/bmap.h` `fs/nilfs2/btree.c` +1 more	+36 ~~-11~~	0 replies
91/552	of: fix out-of-bounds read in of_alias_scan() stem parser`drivers/of/base.c`	+1 -1	0 replies
92/552	PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io()`arch/powerpc/kernel/pci-common.c` `drivers/pci/pci-sysfs.c`	+17 ~~-10~~	0 replies
93/552	phy: rockchip-samsung-dcphy: fix out-of-range max_register`drivers/phy/rockchip/phy-rockchip-samsung-dcphy.c`	+1 -1	0 replies
94/552	ubifs: fix out-of-bounds read in signature length check`fs/ubifs/auth.c`	+1 -1	0 replies
95/552	zram: validate deflate params`drivers/block/zram/backend_deflate.c`	+9 -1	0 replies
96/552	zsmalloc: account for handle size in class lookup`mm/zsmalloc.c`	+7 -4	0 replies
97/552	NFS/localio: fix ref leak on nfs_uuid_add_file failure`fs/nfs_common/nfslocalio.c`	+15 -1	0 replies
98/552	NFS: fix delegation_hash_table leak when nfs4_server_common_setup() fails`fs/nfs/nfs4client.c`	+12 -5	0 replies
99/552	NFSD: check truncate permission under inode lock`fs/nfsd/vfs.c`	+18 ~~-12~~	0 replies
100/552	NFSD: Encode only the status in NFS-ACL v2 GETACL error replies`fs/nfsd/nfs2acl.c`	+15 ~~-16~~	0 replies
101/552	NFSD: Fix off-by-one in DRC bucket pruning limit`fs/nfsd/nfscache.c`	+1 -1	0 replies
102/552	NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock`fs/nfsd/nfs4state.c`	+25 ~~-19~~	0 replies
103/552	NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check`fs/nfsd/nfsfh.c`	+1 -3	0 replies
104/552	nfsd: guard nfsd_serv deref in nfsd_file_net_dispose`fs/nfsd/filecache.c`	+12 -3	0 replies
105/552	NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path`fs/nfs/pnfs.c`	+1 -0	0 replies
106/552	pNFS: Fix EBUSY check in pnfs_layout_need_return`fs/nfs/pnfs.c`	+1 -1	0 replies
107/552	nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown`fs/nfsd/nfs4callback.c` `fs/nfsd/nfs4state.c` `fs/nfsd/state.h` +1 more	+100 ~~-30~~	0 replies
108/552	nfsd: release path refs on follow_down() error`fs/nfsd/vfs.c`	+3 -1	0 replies
109/552	nfsd: Reset write verifier when async COPY writeback fails`fs/nfsd/nfs4proc.c`	+2 -0	0 replies
110/552	nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types`fs/nfsd/nfs4xdr.c`	+13 -0	0 replies
111/552	nfsd: sample writeback error cursor before async COPY loop`fs/nfsd/nfs4proc.c`	+1 -1	0 replies
112/552	nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations`fs/nfsd/nfs4state.c`	+1 -0	0 replies
113/552	nfsd: size fh_verify server sockaddr slot by xpt_locallen`fs/nfsd/trace.h`	+2 -2	0 replies
114/552	nfsd: validate nseconds in TIME_DELEG decode paths`fs/nfsd/nfs4callback.c` `fs/nfsd/nfs4xdr.c`	+8 -0	0 replies
115/552	nfsd: validate sockaddr length per family in listener_set`fs/nfsd/nfsctl.c`	+65 ~~-12~~	0 replies
116/552	nfsd: validate symlink target length in NFSv4 CREATE`fs/nfsd/nfs4xdr.c`	+4 -0	0 replies
117/552	nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()`fs/nfsd/nfsproc.c`	+7 -0	0 replies
118/552	nfsd: add filehandle match check to nfsd4_delegreturn()`fs/nfsd/nfs4state.c`	+4 -0	0 replies
119/552	nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry`fs/nfsd/nfsctl.c`	+7 -4	0 replies
120/552	nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref`fs/nfsd/nfs4proc.c`	+16 -3	0 replies
121/552	nfsd: check client ownership when cancelling a copy-notify stateid`fs/nfsd/nfs4state.c`	+12 -2	0 replies
122/552	nfsd: clear CALLBACK_RUNNING on failed delegation recall queue`fs/nfsd/nfs4state.c`	+3 -1	0 replies
123/552	nfsd: clear opcnt on compound arg release to prevent OOB read`fs/nfsd/nfs4xdr.c`	+1 -0	0 replies
124/552	nfsd: defer setting NFSD4_CALLBACK_RUNNING in deleg_reaper`fs/nfsd/nfs4state.c`	+2 -2	0 replies
125/552	nfsd: defer vfree of compound ops to fix rpc_status UAF`fs/nfsd/nfs4xdr.c`	+3 -1	0 replies
126/552	nfsd: dont free session slots that are still in use`fs/nfsd/nfs4state.c`	+16 -1	0 replies
127/552	nfsd: drop the stateid, not the stateowner, on seqid_op replay retry`fs/nfsd/nfs4state.c`	+1 -1	0 replies
128/552	nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke`fs/nfsd/nfs4layouts.c`	+9 -3	0 replies
129/552	nfsd: fix cpntf publish race in nfs4_init_cp_state`fs/nfsd/nfs4state.c`	+25 ~~-10~~	0 replies
130/552	nfsd: fix dentry ref leak on V4ROOT export filehandle lookup`fs/nfsd/nfsfh.c`	+6 -2	0 replies
131/552	nfsd: fix FL_SLEEP being set unconditionally for all LOCK types`fs/nfsd/nfs4state.c`	+5 -4	0 replies
132/552	nfsd: fix netlink dumpit error handling for rpc_status_get`fs/nfsd/nfsctl.c`	+26 -6	0 replies
133/552	nfsd: fix nfsd_file leak on inter-server COPY setup failure`fs/nfsd/nfs4proc.c`	+4 -6	0 replies
134/552	nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs`fs/nfsd/nfs4proc.c`	+1 -1	0 replies
135/552	nfsd: fix refcount leak in nfsd_file_lru_add on insertion failure`fs/nfsd/filecache.c`	+5 -2	0 replies
136/552	nfsd: fix reply size estimate for GET_DIR_DELEGATION`fs/nfsd/nfs4proc.c`	+1 -1	0 replies
137/552	nfsd: fix stale s2s_cp_stateids IDR entry for async COPY`fs/nfsd/nfs4proc.c`	+4 -3	0 replies
138/552	nfsd: fix version mismatch loops in nfsd_acl_init_request()`fs/nfsd/nfssvc.c`	+2 -2	0 replies
139/552	nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget`fs/nfsd/flexfilelayoutxdr.c`	+11 -6	0 replies
140/552	nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo`fs/nfsd/flexfilelayoutxdr.c`	+2 -1	0 replies
141/552	nfsd: gate nfs2 setacl by argp->mask`fs/nfsd/nfs2acl.c`	+13 -8	0 replies
142/552	nfsd: gate nfs3 setacl by argp->mask`fs/nfsd/nfs3acl.c`	+11 -6	0 replies
143/552	nfsd: hold rcu across localio cmpxchg retry`fs/nfsd/localio.c`	+7 -1	0 replies
144/552	nfsd: initialize copy-notify stateid before publishing it`fs/nfsd/nfs4proc.c` `fs/nfsd/nfs4state.c`	+18 -8	0 replies
145/552	nfsd: initialize DRC hash table before registering shrinker`fs/nfsd/nfscache.c`	+2 -2	0 replies
146/552	nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd()`fs/nfsd/nfsctl.c`	+5 -4	0 replies
147/552	nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops`fs/nfsd/nfs3proc.c`	+40 -0	0 replies
148/552	nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE`fs/nfsd/nfsxdr.c`	+22 ~~-10~~	0 replies
149/552	nfsd: reject reclaim LOCK after RECLAIM_COMPLETE`fs/nfsd/nfs4state.c`	+3 -0	0 replies
150/552	nfsd: revoke copy-notify stateids before dropping their reference`fs/nfsd/nfs4state.c`	+62 ~~-16~~	0 replies
151/552	NFSD: Prevent lock owner use-after-free during client teardown`fs/nfsd/nfs4state.c`	+13 -3	0 replies
152/552	NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup`fs/nfsd/nfs4state.c`	+6 -0	0 replies
153/552	libceph: validate OSD extent maps before cursor advance`net/ceph/osd_client.c`	+30 -0	0 replies
154/552	libceph: reject buckets with mismatched CRUSH ids`net/ceph/osdmap.c`	+2 -0	0 replies
155/552	ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock`fs/ceph/caps.c`	+9 -2	0 replies
156/552	ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode`fs/ceph/mdsmap.c`	+4 -0	0 replies
157/552	ceph: bound copied dentry name length in NFS export get_name`fs/ceph/export.c`	+17 -9	0 replies
158/552	ceph: bound MDSCapAuth path and fs_name decode in handle_session()`fs/ceph/mds_client.c`	+6 -2	0 replies
159/552	ceph: bound num_export_targets array for mds info v2/v3`fs/ceph/mdsmap.c`	+6 -1	0 replies
160/552	ceph: bound xattr value length in __build_xattrs()`fs/ceph/xattr.c`	+1 -0	0 replies
161/552	ceph: do not repeat ceph_trim_dentries() if no progress possible`fs/ceph/dir.c`	+7 -3	0 replies
162/552	ceph: fix leaked inode reference on writeback abort at umount`fs/ceph/addr.c`	+11 -0	0 replies
163/552	btrfs: drop recovered reloc root refs on recovery failure`fs/btrfs/relocation.c`	+27 -4	0 replies
164/552	btrfs: fix extent map leak in NOCOW direct I/O write`fs/btrfs/direct-io.c`	+13 -6	0 replies
165/552	btrfs: do not overwrite NODATASUM flag when removing NODATACOW flag`fs/btrfs/ioctl.c`	+15 -8	0 replies
166/552	audit: avoid dropping live tree ref on fsnotify rule autoremove`kernel/auditfilter.c`	+2 -4	0 replies
167/552	cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size()`fs/smb/client/inode.c`	+1 -0	0 replies
168/552	cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0`fs/smb/client/cifsfs.c`	+13 -2	0 replies
169/552	cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC`fs/smb/client/file.c`	+1 -0	0 replies
170/552	smb: client: clear ce->tgthint in free_tgts()`fs/smb/client/dfs_cache.c`	+2 -0	0 replies
171/552	smb: client: fix ALIGN() overflow in symlink_data() error context loop`fs/smb/client/smb2file.c`	+4 -1	0 replies
172/552	smb: client: fix copy-paste error in WSL EA length accounting for $LXDEV`fs/smb/client/smb1ops.c`	+1 -1	0 replies
173/552	smb: client: harden DFS cache against invalid target hints`fs/smb/client/dfs_cache.c`	+24 -7	0 replies
174/552	HID: apple: preserve keyboard backlight across T2 resume`drivers/hid/hid-apple.c`	+16 -2	0 replies
175/552	HID: corsair-void: Check size of status and firmware events before reading them`drivers/hid/hid-corsair-void.c`	+17 -0	0 replies
176/552	HID: picolcd: clamp eeprom debugfs read to bytes actually received`drivers/hid/hid-picolcd_debugfs.c`	+9 -0	0 replies
177/552	HID: roccat: free buffered reports when destroying device`drivers/hid/hid-roccat.c`	+11 -2	0 replies
178/552	HID: sensor: custom: Fix field sysfs group cleanup on failure`drivers/hid/hid-sensor-custom.c`	+8 -1	0 replies
179/552	HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind`drivers/hid/hid-sony.c`	+3 -1	0 replies
180/552	HID: universal-pidff: stop the device when force-feedback init fails`drivers/hid/hid-universal-pidff.c`	+3 -1	0 replies
181/552	HID: mcp2221: stop device IO before hid_hw_stop`drivers/hid/hid-mcp2221.c`	+2 -0	0 replies
182/552	HID: mcp2221: validate report size in mcp2221_raw_event()`drivers/hid/hid-mcp2221.c`	+7 -0	0 replies
183/552	HID: intel-thc-hid: intel-quickspi: validate report size before copy`drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c` `drivers/hid/intel-thc-hid/intel-quickspi/quickspi-dev.h` `drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c`	+12 -1	0 replies
184/552	HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer`drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.c` `drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c` `drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.h`	+15 -5	0 replies
185/552	HID: intel-thc-hid: intel-quicki2c: fix autosuspend cleanup during teardown`drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c`	+1 -0	0 replies
186/552	HID: intel-thc-hid: intel-quickspi: fix autosuspend cleanup during teardown`drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c`	+1 -0	0 replies
187/552	eventfs: Initialize ei->children and ei->list in init_ei()`fs/tracefs/event_inode.c`	+2 -5	0 replies
188/552	fs/ntfs3: validate dirty page table on log replay`fs/ntfs3/fslog.c`	+19 -0	0 replies
189/552	fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()`fs/ntfs3/frecord.c`	+9 -0	0 replies
190/552	fs/ntfs3: bound page_lcns[] index by the log record`fs/ntfs3/fslog.c`	+15 -0	0 replies
191/552	eCryptfs: bound the packet-length peek to the user buffer`fs/ecryptfs/miscdev.c`	+3 -2	0 replies
192/552	ecryptfs: fix tag 11 packet exact-fit size check`fs/ecryptfs/keystore.c`	+1 -1	0 replies
193/552	ecryptfs: hold msg ctx list lock when cleaning daemon queue`fs/ecryptfs/messaging.c`	+2 -0	0 replies
194/552	ecryptfs: pass packet set buffer size to parser`fs/ecryptfs/crypto.c` `fs/ecryptfs/ecryptfs_kernel.h` `fs/ecryptfs/keystore.c`	+23 -5	0 replies
195/552	ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet`fs/ecryptfs/keystore.c`	+12 -2	0 replies
196/552	ecryptfs: reject too-small tag 70 packets`fs/ecryptfs/keystore.c`	+6 -0	0 replies
197/552	ecryptfs: release message context on send failure`fs/ecryptfs/messaging.c`	+8 -1	0 replies
198/552	ecryptfs: show filename encryption options`fs/ecryptfs/super.c`	+7 -0	0 replies
199/552	efivarfs: Rate limit statfs() handler`fs/efivarfs/super.c`	+24 -6	0 replies
200/552	fanotify: fix use-after-free of file range info`fs/notify/fanotify/fanotify.c` `fs/notify/fanotify/fanotify.h` `fs/notify/fanotify/fanotify_user.c`	+6 -8	0 replies
201/552	fat: restore original value when fat_ent_write failed`fs/fat/misc.c`	+4 -0	0 replies
202/552	fbdev: omapfb: panel-dsi-cm: initialize lock before registering display`drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c`	+2 -2	0 replies
203/552	fbdev: pvr2fb: correct user pointer annotation and sentinel initializer`drivers/video/fbdev/pvr2fb.c`	+2 -2	0 replies
204/552	fbdev: ssd1307fb: defer I2C transfers from damage callbacks`drivers/video/fbdev/ssd1307fb.c`	+67 -5	0 replies
205/552	fbdev: uvesafb: unregister connector callback on init failure`drivers/video/fbdev/uvesafb.c`	+2 -0	0 replies
206/552	forcedeth: fix off-by-one when saving/restoring non-PCI config space`drivers/net/ethernet/nvidia/forcedeth.c`	+2 -2	0 replies
207/552	fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration`drivers/fpga/stratix10-soc.c`	+12 -9	0 replies
208/552	hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device`drivers/hsi/controllers/omap_ssi_core.c`	+6 -0	0 replies
209/552	hugetlb: only adjust reservation during unmapping if mapcount is 0`mm/hugetlb.c`	+6 -2	0 replies
210/552	accel/rocket: fix NULL dereference and integer overflow in rocket_job_push()`drivers/accel/rocket/rocket_job.c`	+10 -4	0 replies
211/552	accel/rocket: initialize job domain before cleanup paths`drivers/accel/rocket/rocket_job.c`	+2 -2	0 replies
212/552	accel/rocket: Fix error path handling in rocket_job_run()`drivers/accel/rocket/rocket_job.c`	+11 -3	0 replies
213/552	acpi/apei/ghes: Use raw_spinlock_t for CXL CPER work locks`drivers/acpi/apei/ghes.c` `drivers/cxl/core/ras.c` `drivers/cxl/pci.c`	+33 ~~-19~~	0 replies
214/552	ACPI: APEI: Fix ERST timeout unit conversion`drivers/acpi/apei/erst.c`	+1 -1	0 replies
215/552	ACPI: APEI: GHES: fix ARM section length accounting after header`drivers/acpi/apei/ghes.c`	+1 -1	0 replies
216/552	ACPI: pfr_update: fix stack buffer overflow in query_capability()`drivers/acpi/pfr_update.c`	+24 ~~-21~~	0 replies
217/552	alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write()`arch/alpha/kernel/pci-sysfs.c`	+3 -3	0 replies
218/552	alpha: marvel: Fix irq_set_status_flags to use correct IRQ number`arch/alpha/kernel/sys_marvel.c`	+2 -2	0 replies
219/552	alpha: marvel: Fix lock ordering in init_io7_irqs()`arch/alpha/kernel/sys_marvel.c`	+12 ~~-13~~	0 replies
220/552	ARM: 9477/1: Disable broken eBPF JIT on the Risc PC`arch/arm/Kconfig`	+1 -1	0 replies
221/552	ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes`drivers/ata/libata-scsi.c`	+14 ~~-14~~	0 replies
222/552	auxdisplay: charlcd: cancel backlight work on registration failure`drivers/auxdisplay/charlcd.c`	+14 -7	0 replies
223/552	block: set QUEUE_FLAG_DYING unconditionally in blk_mark_disk_dead()`block/genhd.c`	+1 -0	0 replies
224/552	Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU`drivers/bluetooth/btusb.c`	+4 -0	0 replies
225/552	Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU`drivers/bluetooth/btusb.c`	+2 -0	0 replies
226/552	Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728`drivers/bluetooth/btrtl.c` `drivers/bluetooth/btusb.c`	+8 ~~-13~~	0 replies
227/552	Bluetooth: eir: Fix OOB read in eir_get_service_data()`net/bluetooth/eir.c`	+2 -1	0 replies
228/552	bnx2x: fix double free in bnx2x_init_firmware() error path`drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c`	+3 -0	0 replies
229/552	bnxt_en: Write doorbell when linearizing skb fails`drivers/net/ethernet/broadcom/bnxt/bnxt.c`	+2 -5	0 replies
230/552	bpf, x86: Fix per-CPU address resolution into an extended register`arch/x86/net/bpf_jit_comp.c`	+1 -1	0 replies
231/552	bpf: Disable preemption in __bpf_get_stack`kernel/bpf/stackmap.c`	+3 -0	0 replies
232/552	buffer: avoid tail commit walk for uptodate folios`fs/buffer.c`	+3 -0	0 replies
233/552	bpf: Harden bloom filter sizing and indexing on 32-bit kernels`kernel/bpf/bloom_filter.c`	+9 ~~-10~~	0 replies
234/552	dm-io: clone the source bio instead of copying its biovec`drivers/md/dm-io.c`	+24 ~~-43~~	0 replies
235/552	dm-io: report non-retryable errors separatedly`drivers/md/dm-bufio.c` `drivers/md/dm-integrity.c` `drivers/md/dm-io.c` +7 more	+83 ~~-54~~	0 replies
236/552	dm-era: fix shadowed superblock leak on take-snap failure`drivers/md/dm-era-target.c`	+5 -0	0 replies
237/552	dm raid1: reserve space for NUL-terminator in build_constructor_string()`drivers/md/dm-log-userspace-base.c`	+1 -0	0 replies
238/552	dm array: validate array block headers on read`drivers/md/persistent-data/dm-array.c`	+29 -8	0 replies
239/552	dm array: reject an array block whose value size is not the callers`drivers/md/persistent-data/dm-array.c`	+16 -0	0 replies
240/552	coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior`drivers/hwtracing/coresight/coresight-etm3x-sysfs.c`	+4 ~~-11~~	0 replies
241/552	cpufreq: schedutil: Fix rate limit overflow`kernel/sched/cpufreq_schedutil.c`	+13 -2	0 replies
242/552	cxl/features: bound fwctl command payload to the input buffer`drivers/cxl/core/features.c`	+7 -1	0 replies
243/552	cxl/pmem: Format the nvdimm serial number as unsigned decimal`Documentation/ABI/testing/sysfs-bus-nvdimm` `drivers/cxl/core/pmem.c` `drivers/cxl/cxl.h` +1 more	+11 -7	0 replies
244/552	Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378`drivers/bluetooth/hci_bcm4377.c`	+1 -0	0 replies
245/552	Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative`drivers/bluetooth/hci_bcm.c`	+1 -0	0 replies
246/552	Bluetooth: hci_uart: Fix false success return in hci_uart_setup()`drivers/bluetooth/hci_ldisc.c` `drivers/bluetooth/hci_serdev.c`	+2 -2	0 replies
247/552	Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready`net/bluetooth/iso.c`	+8 -0	0 replies
248/552	Bluetooth: RFCOMM: serialize security confirmation handling`net/bluetooth/rfcomm/core.c`	+7 -1	0 replies
249/552	Bluetooth: hci_conn: re-enable advertising only for peripheral role`net/bluetooth/hci_conn.c`	+2 -1	0 replies
250/552	Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb`net/bluetooth/hci_core.c`	+1 -1	0 replies
251/552	Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection`net/bluetooth/hci_event.c`	+4 -3	0 replies
252/552	Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative`drivers/bluetooth/hci_h5.c`	+3 -1	0 replies
253/552	Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative`drivers/bluetooth/hci_intel.c`	+1 -0	0 replies
254/552	Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request`net/bluetooth/hci_sync.c`	+2 -0	0 replies
255/552	kasan: fix cache shrink race with CPU hotplug`mm/kasan/quarantine.c`	+6 -1	0 replies
256/552	jbd2: bound shrinker scans by examined checkpoint buffers`fs/jbd2/checkpoint.c`	+13 ~~-12~~	0 replies
257/552	jbd2: check need_resched() when skipping busy checkpoint buffers`fs/jbd2/checkpoint.c`	+2 -1	0 replies
258/552	ipip: fix skb leak in collect_md mode when metadata_dst allocation fails`net/ipv4/ipip.c`	+1 -1	0 replies
259/552	ip: orphan prefetched skbs before multicast forwarding`net/ipv4/ipmr.c` `net/ipv6/ip6_input.c`	+4 -0	0 replies
260/552	ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()`net/ipv6/ip6_tunnel.c`	+2 ~~-13~~	0 replies
261/552	ip6_gre: fix hardware header length for NBMA tunnels`net/ipv6/ip6_gre.c`	+4 -9	0 replies
262/552	ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv()`net/ipv6/exthdrs.c`	+12 ~~-14~~	0 replies
263/552	ipv6: use RCU iterator to dump route exceptions`net/ipv6/route.c`	+1 -1	0 replies
264/552	landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation`include/uapi/linux/landlock.h` `security/landlock/errata/abi-1.h` `security/landlock/fs.c`	+56 -9	4 replies
265/552	libnvdimm/labels: Prevent integer overflow in __nd_label_validate()`drivers/nvdimm/label.c`	+1 -1	0 replies
266/552	mailbox: qcom-ipcc: fix duplicate channel allocation across holes`drivers/mailbox/qcom-ipcc.c`	+11 -6	0 replies
267/552	md/raid10: fix still_degraded being inverted in raid10_sync_request()`drivers/md/raid10.c`	+1 -1	0 replies
268/552	md: do overflow check for sb->bblog_shift in super_1_load()`drivers/md/md.c`	+7 -0	0 replies
269/552	module: validate string table section types`kernel/module/main.c`	+13 -1	0 replies
270/552	mpls: reload header after pskb_may_pull()`net/mpls/af_mpls.c`	+2 -0	0 replies
271/552	mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction`net/mptcp/syncookies.c`	+1 -0	0 replies
272/552	module/kallsyms: fix nextval for data symbol lookup`kernel/module/kallsyms.c`	+16 -8	0 replies
273/552	nouveau/gem: reserve the bo in the info ioctl around the vma lookup`drivers/gpu/drm/nouveau/nouveau_gem.c`	+10 -1	0 replies
274/552	params: fix charp corruption on allocation failure`kernel/params.c`	+8 -6	0 replies
275/552	phy: fsl-imx8mq-usb: fix typec switch leak on probe error path`drivers/phy/freescale/phy-fsl-imx8mq-usb.c`	+7 ~~-14~~	0 replies
276/552	SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow`net/sunrpc/xdr.c`	+1 -1	0 replies
277/552	SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry`net/sunrpc/auth_gss/svcauth_gss.c`	+3 -0	0 replies
278/552	SUNRPC: svcauth_gss: enforce krb5 token minimum length`net/sunrpc/auth_gss/svcauth_gss.c`	+2 -0	0 replies
279/552	sunrpc: route to a populated pool in svc_pool_for_cpu()`net/sunrpc/svc.c`	+28 -1	0 replies
280/552	SUNRPC: Restore NUMA_NO_NODE for svc thread allocations in global mode`net/sunrpc/svc.c`	+4 -2	0 replies
281/552	SUNRPC: always drain cache_cleaner before destroying a cache_detail`net/sunrpc/cache.c`	+3 -4	0 replies
282/552	SUNRPC: Check svc pool percpu counter allocation`net/sunrpc/svc.c`	+39 -6	0 replies
283/552	sunrpc: defer rq_argp and rq_resp free until after RCU grace period`net/sunrpc/svc.c`	+10 -3	0 replies
284/552	sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir`net/sunrpc/clnt.c`	+17 -5	0 replies
285/552	SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat`net/sunrpc/auth_gss/svcauth_gss.c`	+2 -0	0 replies
286/552	SUNRPC: harden gss_krb5_unwrap_v2 against short tokens`net/sunrpc/auth_gss/gss_krb5_wrap.c`	+9 -2	0 replies
287/552	SUNRPC: harden gss_unwrap_resp_priv length checks`net/sunrpc/auth_gss/auth_gss.c`	+5 -1	0 replies
288/552	sunrpc: init gssp_lock before publishing proc entry`net/sunrpc/auth_gss/gss_rpc_upcall.c` `net/sunrpc/auth_gss/gss_rpc_upcall.h` `net/sunrpc/auth_gss/svcauth_gss.c` +1 more	+1 -8	0 replies
289/552	SUNRPC: reject duplicate CREDS_VALUE options`net/sunrpc/auth_gss/gss_rpc_xdr.c`	+6 -0	0 replies
290/552	SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field`net/sunrpc/auth_gss/gss_krb5_wrap.c`	+2 -0	0 replies
291/552	SUNRPC: wait for in-flight client TLS handshake callback`net/sunrpc/xprtsock.c`	+11 -1	0 replies
292/552	svcrdma: Fix offset arithmetic in read_chunk_range`net/sunrpc/xprtrdma/svc_rdma_rw.c`	+7 -2	0 replies
293/552	svcrdma: Fix pcl_for_each_segment for empty chunks`include/linux/sunrpc/svc_rdma_pcl.h`	+1 -1	0 replies
294/552	svcrdma: Fix unmatched rn_unregister on failed accept`net/sunrpc/xprtrdma/ib_client.c` `net/sunrpc/xprtrdma/svc_rdma_transport.c`	+44 -8	0 replies
295/552	svcrdma: Reject connection when transport allocation fails`net/sunrpc/xprtrdma/svc_rdma_transport.c`	+10 -6	0 replies
296/552	svcrdma: Reject inline replies that overflow the pull-up buffer`net/sunrpc/xprtrdma/svc_rdma_sendto.c`	+32 ~~-15~~	0 replies
297/552	svcrdma: Reject Write/Reply chunks with segcount 0`net/sunrpc/xprtrdma/svc_rdma_pcl.c` `net/sunrpc/xprtrdma/svc_rdma_recvfrom.c`	+7 -4	0 replies
298/552	svcrdma: Use svc_xprt_put to free listener on create failure`net/sunrpc/xprtrdma/svc_rdma_transport.c`	+7 -1	0 replies
299/552	svcrdma: Validate Read chunk positions before reconstruction`net/sunrpc/xprtrdma/svc_rdma_rw.c`	+30 -8	0 replies
300/552	udf: reject VAT indexes equal to the entry count`fs/udf/partition.c`	+1 -1	0 replies
301/552	wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets`drivers/net/wireless/ath/ath6kl/cfg80211.c`	+5 -0	0 replies
302/552	wifi: mt76: mt7925: cancel pending mlo_pm_work`drivers/net/wireless/mediatek/mt76/mt7925/mac.c` `drivers/net/wireless/mediatek/mt76/mt7925/main.c` `drivers/net/wireless/mediatek/mt76/mt7925/pci.c` +1 more	+5 -0	0 replies
303/552	staging: media: tegra-video: fix of_node_put() on VIP parse errors`drivers/staging/media/tegra-video/vip.c`	+3 -7	0 replies
304/552	staging: media: tegra-video: vi: fix probe failure on skipped last port`drivers/staging/media/tegra-video/vi.c`	+5 -4	0 replies
305/552	media: staging/ipu7: fix async notifier UAF on probe error path`drivers/staging/media/ipu7/ipu7-isys.c`	+1 -0	0 replies
306/552	scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()`drivers/scsi/scsi_lib.c`	+2 -0	0 replies
307/552	rpmsg: glink: smem: order FIFO read after availability check`drivers/rpmsg/qcom_glink_smem.c`	+7 -0	0 replies
308/552	Revert "arm64: dts: rockchip: Further describe the WiFi for the Pinephone Pro"`arch/arm64/boot/dts/rockchip/rk3399-pinephone-pro.dts`	+0 ~~-18~~	0 replies
309/552	arm64: dts: qcom: sm6115-pro1x: Correct touchscreen GPIO flags`arch/arm64/boot/dts/qcom/sm6115-fxtec-pro1x.dts`	+1 -1	0 replies
310/552	arm64: dts: qcom: x1-dell-thena: mark l12b and l15b always-on`arch/arm64/boot/dts/qcom/x1-dell-thena.dtsi`	+2 -0	0 replies
311/552	arm64: dts: rockchip: fix eMMC reset polarity on PP-1516`arch/arm64/boot/dts/rockchip/px30-pp1516.dtsi`	+1 -1	0 replies
312/552	arm64: dts: rockchip: fix eMMC reset polarity on PX30 Ringneck`arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi`	+1 -1	0 replies
313/552	arm64: dts: rockchip: fix emmc reset polarity on px30-cobra`arch/arm64/boot/dts/rockchip/px30-cobra.dtsi`	+1 -1	0 replies
314/552	arm64: dts: rockchip: Fix rk3399-roc-pc-plus analog audio`arch/arm64/boot/dts/rockchip/rk3399-roc-pc-plus.dts`	+12 -0	0 replies
315/552	arm64: dts: rockchip: Fix rk3588s-roc-pc audio description`arch/arm64/boot/dts/rockchip/rk3588s-roc-pc.dts`	+16 -7	0 replies
316/552	riscv: acpi: Handle LPI architectural context loss flags`arch/riscv/include/asm/acpi.h`	+19 -0	0 replies
317/552	riscv: unaligned: stop using kthread for check_vector_unaligned_access()`arch/riscv/kernel/unaligned_access_speed.c`	+2 ~~-17~~	0 replies
318/552	remoteproc: scp: Fix device reference leak on failed lookup`drivers/remoteproc/mtk_scp.c`	+8 -1	0 replies
319/552	ptp: vmclock: prevent read-only mappings from becoming writable`drivers/ptp/ptp_vmclock.c`	+6 -0	0 replies
320/552	qede: Fix NULL pointer dereference in TPA fragment processing`drivers/net/ethernet/qlogic/qede/qede.h` `drivers/net/ethernet/qlogic/qede/qede_fp.c`	+5 -4	0 replies
321/552	RDMA/cxgb4: Cancel reg_work before freeing device on remove`drivers/infiniband/hw/cxgb4/device.c`	+6 -0	0 replies
322/552	RDMA/ionic: Cap eq_count to the eth drivers interrupt vector budget`drivers/infiniband/hw/ionic/ionic_lif_cfg.c`	+1 -1	0 replies
323/552	RDMA/ucma: Lock the handler in ucma_set_ib_path()`drivers/infiniband/core/ucma.c`	+4 -1	0 replies
324/552	RDMA/ucma: Lock the handler in ucma_write_cm_event()`drivers/infiniband/core/ucma.c`	+9 -0	0 replies
325/552	RDMA/uverbs: Add UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR`drivers/infiniband/core/uverbs_std_types_mr.c`	+4 -2	0 replies
326/552	regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer`drivers/regulator/as3722-regulator.c`	+0 -1	0 replies
327/552	regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata`drivers/regulator/max8998.c`	+0 -1	0 replies
328/552	regulator: qcom-refgen: correct the regulator type to CURRENT`drivers/regulator/qcom-refgen-regulator.c`	+2 -2	0 replies
329/552	ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page()`kernel/trace/ring_buffer.c`	+1 -1	0 replies
330/552	ring-buffer: Free cpu_buffer::free_page with subbuf_order`kernel/trace/ring_buffer.c`	+1 -1	0 replies
331/552	ring-buffer: Hold cpu_buffer::lock when resizing a subbuf`kernel/trace/ring_buffer.c`	+2 -0	0 replies
332/552	PM: sleep: Unblock runtime PM when device prepare fails`drivers/base/power/main.c`	+1 -0	0 replies
333/552	orangefs: fix double-free of trailer_buf on readdir copy failure`fs/orangefs/devorangefs-req.c`	+1 -0	0 replies
334/552	orangefs: skip leading spaces before parsing client debug masks`fs/orangefs/orangefs-debugfs.c`	+1 -0	0 replies
335/552	ocfs2: always run deallocs on copy-on-write completion`fs/ocfs2/refcounttree.c` `fs/ocfs2/xattr.c`	+10 ~~-15~~	0 replies
336/552	ocfs2: bound namelen in dlm_migrate_request_handler`fs/ocfs2/dlm/dlmmaster.c`	+6 -0	0 replies
337/552	ocfs2: validate lengths in dlm_mig_lockres_handler`fs/ocfs2/dlm/dlmrecovery.c`	+9 -0	0 replies
338/552	ocfs2: validate rl_used against rl_count in refcount block validator`fs/ocfs2/refcounttree.c`	+27 -0	0 replies
339/552	ocfs2: cluster: dont sleep while holding o2hb_live_lock in o2hb_region_pin()`fs/ocfs2/cluster/heartbeat.c`	+101 ~~-25~~	0 replies
340/552	ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item`fs/ocfs2/cluster/heartbeat.c` `fs/ocfs2/cluster/nodemanager.c` `fs/ocfs2/cluster/nodemanager.h`	+17 -7	0 replies
341/552	ocfs2: cluster: fix o2hb_dependent_users leak on pin failure`fs/ocfs2/cluster/heartbeat.c`	+6 -1	0 replies
342/552	ocfs2: fix readdir position truncation on 32-bit kernels`fs/ocfs2/dir.c`	+1 -1	0 replies
343/552	openrisc: fix arbitrary kernel memory access via or1k_atomic syscall`arch/openrisc/kernel/entry.S`	+39 -4	0 replies
344/552	openvswitch: only skb_tx_error() a packet we are about to drop`net/openvswitch/datapath.c`	+1 -2	0 replies
345/552	ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion`sound/core/ump_convert.c`	+1 -0	0 replies
346/552	arm64: compat: Fix decrementing LDM/STM alignment emulation`arch/arm64/kernel/compat_alignment.c`	+2 -2	0 replies
347/552	arm64: proton-pack: Restore the nospectre_bhb command-line option`arch/arm64/kernel/proton-pack.c`	+8 -1	0 replies
348/552	ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC`sound/soc/amd/yc/acp6x-mach.c`	+7 -0	0 replies
349/552	hwmon: (max6621) fix negative temperature offset and crit readings`drivers/hwmon/max6621.c`	+2 -2	0 replies
350/552	hwmon: (max6621) fix temperature clamp range`drivers/hwmon/max6621.c`	+2 -2	0 replies
351/552	i2c: mxs: fix DMA channel leak on probe error`drivers/i2c/busses/i2c-mxs.c`	+1 -4	0 replies
352/552	ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user()`drivers/char/ipmi/ipmi_msghandler.c`	+1 -0	0 replies
353/552	lockd: pin next file across nlm_inspect_file lock-drop`fs/lockd/svcsubs.c`	+30 ~~-23~~	0 replies
354/552	lockd: fix NULL dereference on lockowner allocation failure`fs/lockd/clntproc.c`	+3 -0	0 replies
355/552	nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path`drivers/nvme/host/fc.c`	+1 -1	0 replies
356/552	nvme: zero the discard fallback page`drivers/nvme/host/core.c`	+1 -1	0 replies
357/552	nvme-pci: disable controller on admin queue IRQ setup failure`drivers/nvme/host/pci.c`	+1 -0	0 replies
358/552	nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone`drivers/nvme/host/tcp.c`	+3 -1	0 replies
359/552	nvme-tcp: fix host memory disclosure on R2T for a read command`drivers/nvme/host/tcp.c`	+7 -0	0 replies
360/552	nvme-tcp: reject a read that transferred too few bytes`drivers/nvme/host/tcp.c`	+34 -0	0 replies
361/552	sctp: stop processing a packet once its association is deleted`net/sctp/sm_sideeffect.c`	+4 -0	0 replies
362/552	sctp: drop a chunk if its transport was removed`net/sctp/inqueue.c`	+5 -2	0 replies
363/552	sctp: fix NULL deref on untransmitted RECONF completion`net/sctp/stream.c`	+1 -1	0 replies
364/552	sctp: distinguish sequence zero from wildcard in reconf lookup`net/sctp/stream.c`	+6 -5	0 replies
365/552	sctp: fix stream->outcnt underflow on duplicate RECONF responses`include/net/sctp/structs.h` `net/sctp/stream.c`	+29 ~~-12~~	0 replies
366/552	power: supply: bq24257: fix use-after-free on remove`drivers/power/supply/bq24257_charger.c`	+9 -7	0 replies
367/552	power: supply: bq256xx: drain usb_work before freeing the charger`drivers/power/supply/bq256xx_charger.c`	+15 ~~-14~~	0 replies
368/552	power: supply: bq25890: Fix power_supply reference leak`drivers/power/supply/bq25890_charger.c`	+12 -0	0 replies
369/552	power: supply: charger-manager: register regulators before exposing sysfs`drivers/power/supply/charger-manager.c`	+39 ~~-15~~	0 replies
370/552	power: supply: cros_usbpd-charger: bound the EC-reported port count`drivers/power/supply/cros_usbpd-charger.c`	+5 -2	0 replies
371/552	power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS`drivers/power/supply/cros_usbpd-charger.c`	+10 -0	0 replies
372/552	power: supply: lp8727: fix use-after-free in lp8727_release_irq()`drivers/power/supply/lp8727_charger.c`	+2 -2	0 replies
373/552	power: supply: lp8788-charger: fix use-after-free on remove`drivers/power/supply/lp8788-charger.c`	+1 -1	0 replies
374/552	power: supply: qcom_battmgr: fix use-after-free`drivers/power/supply/qcom_battmgr.c`	+6 -1	0 replies
375/552	power: supply: qcom_battmgr: terminate the strings from firmware`drivers/power/supply/qcom_battmgr.c`	+1 -1	0 replies
376/552	power: supply: rt9455: quiesce delayed work before teardown`drivers/power/supply/rt9455_charger.c`	+17 -4	0 replies
377/552	power: supply: twl4030_charger: cancel workers via devm`drivers/power/supply/twl4030_charger.c`	+10 -2	0 replies
378/552	power: supply: ucs1002: fix use-after-free on remove`drivers/power/supply/ucs1002_power.c`	+5 -1	0 replies
379/552	power: supply: max17040: propagate register read errors`drivers/power/supply/max17040_battery.c`	+21 -5	0 replies
380/552	power: supply: max17040: drop incorrect I2C functionality check`drivers/power/supply/max17040_battery.c`	+0 -4	0 replies
381/552	power: supply: max17040: synchronize work cancellation on suspend`drivers/power/supply/max17040_battery.c`	+1 -1	0 replies
382/552	s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks`arch/s390/kernel/perf_cpum_cf.c`	+142 ~~-73~~	0 replies
383/552	s390/dasd: Do not complete a failed ESE read as successful`drivers/s390/block/dasd.c`	+4 -2	0 replies
384/552	s390/dasd: Guard sysfs discipline callbacks against unallocated private data`drivers/s390/block/dasd_eckd.c`	+38 -2	0 replies
385/552	s390/dasd: Propagate partial completion length across ERP recovery`drivers/s390/block/dasd_erp.c`	+3 -0	0 replies
386/552	PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip`drivers/pci/controller/pci-hyperv.c`	+1 -0	0 replies
387/552	PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk`drivers/pci/quirks.c`	+1 -1	0 replies
388/552	PCI: meson: Fix GPIO state while requesting PERST#`drivers/pci/controller/dwc/pci-meson.c`	+1 -1	0 replies
389/552	PCI: plda: Fix use-after-free of event IRQs during teardown`drivers/pci/controller/plda/pcie-plda-host.c`	+21 -3	0 replies
390/552	PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts()`drivers/pci/controller/plda/pcie-plda-host.c`	+21 -7	0 replies
391/552	PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608]`drivers/pci/quirks.c`	+4 -0	0 replies
392/552	PCI/sysfs: Fix read byte order in pci_read_legacy_io()`drivers/pci/pci-sysfs.c`	+19 -1	0 replies
393/552	PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses`drivers/pci/pci-sysfs.c`	+2 -2	0 replies
394/552	PCI/AER: Emit TLP Log only for unmasked errors`drivers/pci/pcie/aer.c`	+3 -2	0 replies
395/552	PCI/AER: Fix mapping of errors to agent & layer`drivers/pci/pcie/aer.c`	+19 -5	0 replies
396/552	PCI/ASPM: Avoid L0s for Realtek RTS525A`drivers/pci/quirks.c`	+3 -0	0 replies
397/552	PCI/DPC: Allow DPC on all Downstream Ports when OS controls AER`drivers/pci/pcie/portdrv.c`	+1 -1	0 replies
398/552	PCI/MSI: Enable memory decoding before restoring MSI-X messages`drivers/pci/msi/msi.c`	+10 -0	0 replies
399/552	PCI/proc: Avoid spurious runtime PM wakeup on config space accesses`drivers/pci/proc.c`	+6 -0	0 replies
400/552	PCI/proc: Use file_ns_capable() when checking config space read access`drivers/pci/proc.c`	+1 -1	0 replies
401/552	PCI/proc: Warn on writes to kernel-exclusive config space regions`drivers/pci/proc.c`	+8 -0	0 replies
402/552	iommu/amd: Put PCI device after handling PPR faults`drivers/iommu/amd/ppr.c`	+2 -1	0 replies
403/552	iommu/msm: Unwind probe state on registration failure`drivers/iommu/msm_iommu.c`	+8 -2	0 replies
404/552	iommu/sva: Set handle->dev before the SVA handle is visible`drivers/iommu/iommu-sva.c`	+1 -1	0 replies
405/552	iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field`drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c`	+6 -2	0 replies
406/552	iommu/arm-smmu-v3: Manage teardown with devm`drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c`	+40 ~~-16~~	0 replies
407/552	iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add`drivers/iommu/iommu.c`	+1 -1	0 replies
408/552	iommu/vt-d: Fix no_iommu to disable platform opt-in`drivers/iommu/intel/iommu.c`	+3 -3	0 replies
409/552	iommu/vt-d: Force requesting ACS when tboot is enabled`drivers/iommu/intel/dmar.c` `drivers/iommu/intel/iommu.c` `drivers/iommu/intel/iommu.h`	+16 -3	0 replies
410/552	iommufd: Avoid locking internal accesses during unmap`drivers/iommu/iommufd/device.c`	+2 -2	0 replies
411/552	iommufd: Release current IOAS on xa_store() failure`drivers/iommu/iommufd/ioas.c`	+2 -0	0 replies
412/552	iommufd: Fix UAF in selftest IOPF reporting`drivers/iommu/iommufd/selftest.c`	+30 -1	0 replies
413/552	platform/x86: dell-wmi-sysman: Dont hex dump attribute security buffer`drivers/platform/x86/dell/dell-wmi-sysman/biosattr-interface.c`	+0 -1	0 replies
414/552	platform/x86: ISST: Validate level in perf mask ioctls`drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c`	+9 -0	0 replies
415/552	platform/x86: ISST: Validate socket ID in clos_assoc ioctl`drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c`	+3 -1	0 replies
416/552	mmc: via-sdmmc: cancel card-detect work on remove`drivers/mmc/host/via-sdmmc.c`	+4 -0	0 replies
417/552	mmc: via-sdmmc: stop card-detect handling on probe failure`drivers/mmc/host/via-sdmmc.c`	+7 -1	0 replies
418/552	platform/x86: ISST: Add a NULL check for sst_inst[]`drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c`	+2 -0	0 replies
419/552	platform/x86: ISST: Just allow 2 bits for SST feature enable`drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c`	+4 -0	0 replies
420/552	platform/x86: ISST: Use PP level enable mask`drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c`	+14 -2	0 replies
421/552	platform/x86: ISST: Validate logical CPU id and clos id`drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c`	+13 -0	0 replies
422/552	platform/x86: ISST: Validate parameter for core power state`drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c`	+7 -0	0 replies
423/552	platform/x86: ISST: Validate parameter for frequency and priority`drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c`	+12 -0	0 replies
424/552	platform/x86: ISST: Return error during profile addition`drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c`	+7 -3	0 replies
425/552	platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path`drivers/platform/x86/intel/ishtp_eclite.c`	+4 -1	0 replies
426/552	platform/x86: lenovo/ymc: Only match lower byte in WMI lid switch query response`drivers/platform/x86/lenovo/ymc.c`	+7 -1	0 replies
427/552	platform/x86: think-lmi: Fix certificate thumbprint sysfs output`drivers/platform/x86/lenovo/think-lmi.c`	+7 -1	0 replies
428/552	platform/x86: think-lmi: Free system certificate signatures`drivers/platform/x86/lenovo/think-lmi.c`	+4 -0	0 replies
429/552	platform/x86: think-lmi: Fix current password length check`drivers/platform/x86/lenovo/think-lmi.c`	+3 -4	0 replies
430/552	platform/chrome: sensorhub: Bound the EC-reported sensor number`drivers/platform/chrome/cros_ec_sensorhub_ring.c`	+8 -0	0 replies
431/552	platform/x86/amd/pmc: Restore msg_port on amd_stb_s2d_init() error paths`drivers/platform/x86/amd/pmc/mp1_stb.c`	+15 -9	0 replies
432/552	platform/x86/amd/pmc: Propagate SMU errors and validate S2D address`drivers/platform/x86/amd/pmc/mp1_stb.c`	+20 ~~-11~~	0 replies
433/552	platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails`drivers/platform/x86/amd/pmc/pmc.c`	+5 -1	0 replies
434/552	platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS`drivers/platform/x86/hp/hp-bioscfg/bioscfg.c` `drivers/platform/x86/hp/hp-bioscfg/bioscfg.h`	+11 -3	0 replies
435/552	platform/x86: hp-bioscfg: advance elem past consumed array elements`drivers/platform/x86/hp/hp-bioscfg/enum-attributes.c` `drivers/platform/x86/hp/hp-bioscfg/int-attributes.c` `drivers/platform/x86/hp/hp-bioscfg/order-list-attributes.c` +2 more	+14 -0	0 replies
436/552	platform/x86: hp-bioscfg: bound ordered-list parsing by the package count`drivers/platform/x86/hp/hp-bioscfg/order-list-attributes.c`	+1 -1	0 replies
437/552	platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store()`drivers/platform/x86/hp/hp-bioscfg/spmobj-attributes.c`	+2 -2	0 replies
438/552	platform/x86: hp-bioscfg: fix heap OOB read on empty password write`drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c`	+1 -1	0 replies
439/552	platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password`drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c`	+1 -1	0 replies
440/552	platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer()`drivers/platform/x86/hp/hp-bioscfg/bioscfg.c`	+1 -1	0 replies
441/552	platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed`drivers/platform/x86/hp/hp-bioscfg/order-list-attributes.c`	+3 -1	0 replies
442/552	platform/x86: hp-bioscfg: pass validated element count to package parsers`drivers/platform/x86/hp/hp-bioscfg/bioscfg.c` `drivers/platform/x86/hp/hp-bioscfg/bioscfg.h` `drivers/platform/x86/hp/hp-bioscfg/enum-attributes.c` +4 more	+27 -7	0 replies
443/552	platform/x86: hp-bioscfg: warn on element type mismatch instead of failing`drivers/platform/x86/hp/hp-bioscfg/enum-attributes.c`	+4 -3	0 replies
444/552	io_uring/query: cap user size passed to copy_struct_to_user`io_uring/query.c`	+3 -0	0 replies
445/552	interconnect: Fix use after free in icc_get() and of_icc_get_by_index()`drivers/interconnect/core.c`	+4 -3	0 replies
446/552	ipmi: ipmb: validate write message length`drivers/char/ipmi/ipmb_dev_int.c`	+3 -2	0 replies
447/552	ipmi: Remove all sysfs files on registration failure`drivers/char/ipmi/ipmi_msghandler.c`	+1 -0	0 replies
448/552	ipmi: si: Fix NULL pointer dereference after failed registration`drivers/char/ipmi/ipmi_msghandler.c`	+1 -0	0 replies
449/552	ipmi:msghandler: Cancel work cleanly on an error`drivers/char/ipmi/ipmi_msghandler.c`	+1 -0	0 replies
450/552	net/iucv: filter frames in afiucv_hs_rcv() by ingress device`net/iucv/af_iucv.c`	+2 -0	0 replies
451/552	xdp: fix zero-copy frame layout`net/core/xdp.c`	+2 -2	0 replies
452/552	slip: fix use-after-free in sl_sync()`drivers/net/slip/slip.c`	+8 -3	0 replies
453/552	net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition`drivers/net/usb/qmi_wwan.c`	+1 -0	0 replies
454/552	net: tun: bound receive headroom`drivers/net/tun.c`	+16 -5	0 replies
455/552	net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO`drivers/net/dsa/realtek/rtl83xx.c`	+2 -2	0 replies
456/552	net: ibm: emac: mal: fix NAPI locking`drivers/net/ethernet/ibm/emac/mal.c`	+10 -3	0 replies
457/552	net: ipa: fix stalled modem TX queue after runtime resume`drivers/net/ipa/ipa_modem.c`	+17 -1	0 replies
458/552	net: l2tp: do not propagate multicast notification errors`net/l2tp/l2tp_netlink.c`	+8 -8	0 replies
459/552	net: openvswitch: fix flow mask use-after-free on flow deletion`net/openvswitch/datapath.c`	+23 ~~-22~~	0 replies
460/552	net: openvswitch: fix nf_connlabels leak in ovs_ct_init`net/openvswitch/conntrack.c`	+5 -3	0 replies
461/552	net: phylink: correctly validate returned PCS in phylink_inband_caps`drivers/net/phy/phylink.c`	+1 -1	0 replies
462/552	net: ravb: avoid dereferencing an invalid PTP clock`drivers/net/ethernet/renesas/ravb.h` `drivers/net/ethernet/renesas/ravb_main.c` `drivers/net/ethernet/renesas/ravb_ptp.c`	+16 -3	0 replies
463/552	net: ravb: serialize PTP clock teardown`drivers/net/ethernet/renesas/ravb.h` `drivers/net/ethernet/renesas/ravb_main.c` `drivers/net/ethernet/renesas/ravb_ptp.c`	+35 ~~-10~~	0 replies
464/552	net: thunderbolt: Release the Rx HopID that was handed out on mismatch`drivers/net/thunderbolt/main.c`	+2 -0	0 replies
465/552	net: thunderbolt: Mark the connection down when bringing it up fails`drivers/net/thunderbolt/main.c`	+10 -0	0 replies
466/552	NTB: ntb_transport: Recycle TX entries before client callbacks`drivers/ntb/ntb_transport.c`	+14 -9	0 replies
467/552	NTB: ntb_transport: Fail TX enqueue when the QP link is down`drivers/ntb/ntb_transport.c`	+1 -2	0 replies
468/552	NTB: ntb_transport: Reject oversized TX buffers`drivers/ntb/ntb_transport.c`	+3 -9	0 replies
469/552	net: ntb_netdev: Fix TX busy and drop handling`drivers/net/ntb_netdev.c`	+19 -8	0 replies
470/552	net: ntb_netdev: Avoid double-accounting netif_rx() drops`drivers/net/ntb_netdev.c`	+3 -7	0 replies
471/552	net: ntb_netdev: Count packets dropped on RX refill failure`drivers/net/ntb_netdev.c`	+3 -2	0 replies
472/552	net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages`net/smc/smc_llc.c`	+16 -0	0 replies
473/552	net/smc: do not dereference an unset send buffer on the SMC-D teardown path`net/smc/af_smc.c` `net/smc/smc_tx.h`	+7 -2	0 replies
474/552	net/smc: fix socket refcount leak in smc_switch_conns()`net/smc/smc_core.c`	+7 -7	0 replies
475/552	net/smc: fix use-after-free in smc_rx_pipe_buf_release()`net/smc/smc_rx.c`	+5 -6	0 replies
476/552	net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link()`net/smc/smc_llc.c`	+5 -4	0 replies
477/552	net/smc: stop killed, freed and out_of_sync sharing a byte`net/smc/smc.h`	+3 -3	0 replies
478/552	net/smc: unregister the connection before draining the rx tasklet`net/smc/smc_core.c`	+7 -6	0 replies
479/552	net: cap advertised IP tunnel headroom`include/net/ip_tunnels.h` `net/ipv4/ip_tunnel.c` `net/ipv6/ip6_gre.c` +2 more	+21 -8	0 replies
480/552	net: fix spurious TX timeout after dev_activate()`net/sched/sch_generic.c`	+1 -1	0 replies
481/552	net: skbuff: dont touch shared zerocopy state in skb_tx_error()`net/core/skbuff.c`	+4 -1	0 replies
482/552	seg6: reset IP6CB after IPv6 decapsulation`net/ipv6/seg6_local.c`	+9 -0	0 replies
483/552	hwrng: stm32 - Fix runtime PM cleanup on registration failure`drivers/char/hw_random/stm32-rng.c`	+3 -7	0 replies
484/552	mfd: cgbc: Fix teardown ordering in cgbc_remove()`drivers/mfd/cgbc-core.c`	+2 -2	0 replies
485/552	mfd: sm501: Fix potential memory leaks during remove`drivers/mfd/sm501.c`	+2 -0	0 replies
486/552	ALSA: 6fire: bound the MIDI event length from the device`sound/usb/6fire/comm.c`	+6 -3	0 replies
487/552	ALSA: aloop: Check card index validity at probe`sound/drivers/aloop.c`	+6 -0	0 replies
488/552	ALSA: bcd2000: clear the URB pointers on disconnect`sound/usb/bcd2000/bcd2000.c`	+8 -3	0 replies
489/552	ALSA: hda/ext: preserve PPLCCTL bits when clearing reset`sound/hda/core/ext/stream.c`	+2 -2	0 replies
490/552	ALSA: mpu401: Check card index validity at probe`sound/drivers/mpu401/mpu401.c`	+6 -0	0 replies
491/552	ALSA: mts64: Check card index validity at probe`sound/drivers/mts64.c`	+6 -0	0 replies
492/552	ALSA: pcxhr: initialize mutexes before requesting threaded IRQ`sound/pci/pcxhr/pcxhr.c`	+7 -7	0 replies
493/552	ALSA: portman2x4: Check card index validity at probe`sound/drivers/portman2x4.c`	+6 -0	0 replies
494/552	ALSA: serial-u16550: Check card index validity at probe`sound/drivers/serial-u16550.c`	+6 -0	0 replies
495/552	ALSA: virmidi: Check card index validity at probe`sound/drivers/virmidi.c`	+6 -0	0 replies
496/552	ALSA: hda/realtek: Add quirk for TongFang XxAF5xxx`sound/hda/codecs/realtek/alc269.c`	+1 -0	0 replies
497/552	ALSA: hda/realtek: Enable micmute LED on HP EliteBook 6 G1a p/n: AD3Q9ET#UUG`sound/hda/codecs/realtek/alc269.c`	+1 -0	0 replies
498/552	ALSA: hda/realtek: Fix Lenovo Yoga Slim 7 14AKP10 quirk ordering`sound/hda/codecs/realtek/alc269.c`	+4 -1	0 replies
499/552	ring-buffer: Fix subbuf resize race with ring buffer readers`kernel/trace/ring_buffer.c`	+106 ~~-61~~	0 replies
500/552	ovpn: run deferred work on a module-owned workqueue`drivers/net/ovpn/main.c` `drivers/net/ovpn/ovpnpriv.h` `drivers/net/ovpn/peer.c` +1 more	+30 ~~-10~~	0 replies
501/552	rust: rust_is_available: warn for `bindgen` < 0.72.1 && libclang >= 22`scripts/rust_is_available.sh` `scripts/rust_is_available_bindgen_libclang_22.h` `scripts/rust_is_available_test.py`	+48 -1	0 replies
502/552	net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry`net/smc/smc_llc.c` `net/smc/smc_wr.c`	+91 ~~-40~~	0 replies
503/552	arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map()`drivers/base/arch_numa.c`	+12 -0	0 replies
504/552	dm-stats: fix a crash if allocation of per-cpu data fails`drivers/md/dm-stats.c`	+4 -2	0 replies
505/552	dm-switch: use WRITE_ONCE() in switch_region_table_write()`drivers/md/dm-switch.c`	+1 -1	0 replies
506/552	dm-pcache: validate geometry fields from on-disk cache_info`drivers/md/dm-pcache/cache.c`	+14 -0	0 replies
507/552	dm-pcache: validate kset key_num and intra-segment bounds`drivers/md/dm-pcache/cache.h` `drivers/md/dm-pcache/cache_gc.c` `drivers/md/dm-pcache/cache_key.c` +1 more	+38 -9	0 replies
508/552	dm-pcache: validate on-media seg_num against the cache device size`drivers/md/dm-pcache/cache_dev.c`	+21 -1	0 replies
509/552	dm-pcache: bound the persisted tail-position offset`drivers/md/dm-pcache/cache.c`	+4 -0	0 replies
510/552	dm-pcache: clamp the tail kset read to the segment data region`drivers/md/dm-pcache/cache_gc.c` `drivers/md/dm-pcache/cache_key.c` `drivers/md/dm-pcache/cache_writeback.c`	+3 -3	0 replies
511/552	dm-pcache: detect a cycle in the last-kset chain during replay`drivers/md/dm-pcache/cache_key.c`	+6 -1	0 replies
512/552	dm-pcache: only hand out initialized cache segments`drivers/md/dm-pcache/cache_segment.c`	+10 -2	0 replies
513/552	dm-pcache: fix implicit u8 truncation of gc_percent in message handler`drivers/md/dm-pcache/dm_pcache.c`	+2 -2	0 replies
514/552	dm-pcache: fix use-after-free and invalid seg operations in kset_replay()`drivers/md/dm-pcache/cache_key.c`	+6 -7	0 replies
515/552	i3c: master: adi: initialize the lock before enabling interrupts`drivers/i3c/master/adi-i3c-master.c`	+7 -8	0 replies
516/552	i3c: master: Fix info leak and UAF in device unregister path`drivers/i3c/master.c`	+5 -4	0 replies
517/552	i3c: master: svc: bound IBI payload to the requested max_payload_len`drivers/i3c/master/svc-i3c-master.c`	+9 -1	0 replies
518/552	i3c: master: Fix potential UAF in i3c_device_uevent()`drivers/i3c/master.c`	+1 -2	0 replies
519/552	i3c: renesas: Check that the transfer is valid before accessing it`drivers/i3c/master/renesas-i3c.c`	+45 -7	0 replies
520/552	i3c: renesas: Clean DATBAS register on detach`drivers/i3c/master/renesas-i3c.c`	+2 -0	0 replies
521/552	i3c: renesas: Reconfigure the DATBAS register on re-attach`drivers/i3c/master/renesas-i3c.c`	+16 -0	0 replies
522/552	wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control()`drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c`	+2 -1	0 replies
523/552	wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start()`drivers/net/wireless/intel/iwlwifi/dvm/main.c`	+2 -2	0 replies
524/552	wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop`drivers/net/wireless/realtek/rtl8xxxu/core.c`	+14 -5	0 replies
525/552	crypto: sun8i-ce - Remove crypto_rng interface`drivers/crypto/allwinner/Kconfig` `drivers/crypto/allwinner/sun8i-ce/Makefile` `drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c` +2 more	+0 ~~-254~~	0 replies
526/552	crypto: sun8i-ss - Remove crypto_rng interface`drivers/crypto/allwinner/Kconfig` `drivers/crypto/allwinner/sun8i-ss/Makefile` `drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c` +2 more	+0 ~~-248~~	0 replies
527/552	wifi: mwifiex: Detach sync cmd buffer on interrupted wait`drivers/net/wireless/marvell/mwifiex/sta_ioctl.c`	+12 -0	0 replies
528/552	wifi: rtl818x: initialize eeprom_93cx6 struct to zero`drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c` `drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c`	+2 -2	0 replies
529/552	wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids`drivers/net/wireless/realtek/rtlwifi/rtl8192du/trx.c`	+2 -1	0 replies
530/552	wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars()`drivers/net/wireless/realtek/rtlwifi/rtl8192du/sw.c`	+9 -3	0 replies
531/552	wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb()`drivers/net/wireless/realtek/rtw88/tx.c`	+1 -0	0 replies
532/552	wifi: rtw88: pci: fix resource leak on failed NAPI setup`drivers/net/wireless/realtek/rtw88/pci.c`	+3 -1	0 replies
533/552	wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex`drivers/net/wireless/mediatek/mt76/mt7615/main.c`	+3 -2	0 replies
534/552	wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy`drivers/net/wireless/mediatek/mt76/mt7915/mcu.c`	+9 -2	0 replies
535/552	wifi: mt76: mt7925: cancel mlo_pm_work on stop`drivers/net/wireless/mediatek/mt76/mt7925/main.c`	+10 -1	0 replies
536/552	wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames`drivers/net/wireless/mediatek/mt76/mt7996/mac.c`	+25 -1	0 replies
537/552	wifi: mt76: mt7996: validate default EEPROM firmware size`drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c`	+6 -0	0 replies
538/552	vsock/virtio: flush works in dependency order`net/vmw_vsock/virtio_transport.c`	+1 -1	0 replies
539/552	w1: ds28e17: reject an oversize length on an I2C block read`drivers/w1/slaves/w1_ds28e17.c`	+8 -0	0 replies
540/552	xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc()`lib/xarray.c`	+3 -0	0 replies
541/552	zloop: truncate finished zones to zone capacity`Documentation/admin-guide/blockdev/zoned_loop.rst` `drivers/block/zloop.c`	+6 -6	0 replies
542/552	tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout`drivers/char/tpm/tpm_i2c_nuvoton.c`	+4 -2	0 replies
543/552	sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[]`kernel/pid.c` `kernel/reboot.c`	+29 ~~-31~~	0 replies
544/552	sticon/parisc: Detect default STI graphics card for console output`drivers/video/sticore.c`	+21 -1	0 replies
545/552	signal: avoid shared siginfo namespace rewrites`kernel/signal.c`	+4 -0	0 replies
546/552	smack: fix cred UAF in smack_file_send_sigiotask()`security/smack/smack_lsm.c`	+1 -1	0 replies
547/552	taskstats: fix cpumask parsing cutting off the last character`kernel/taskstats.c`	+1 -2	0 replies
548/552	timekeeping: Check the return value of tk_get_aux_ts64 in __do_adjtimex()`kernel/time/timekeeping.c`	+5 -3	0 replies
549/552	timer: Keep debugobjects state consistent in migrate_timer_list()`kernel/time/timer.c`	+1 -0	0 replies
550/552	udf: Fix i_lenExtents truncation on 32-bit kernels`fs/udf/inode.c`	+1 -1	0 replies
551/552	selftests/mm: fix on-fault-limit false failure under sudo-rs`tools/testing/selftests/mm/run_vmtests.sh`	+1 -1	0 replies
552/552	platform/chrome: sensorhub: Fix dropped timestamp events and log spam`drivers/platform/chrome/cros_ec_sensorhub_ring.c`	+15 ~~-12~~	0 replies

Reviews trailers per patch

278 of 552 patches have a Reviewed-by or Acked-by.

Patch	Dapeng Mi	Steve Wahl	Alex Hung	Dan Wheeler	Harry Wentland	Mario Limonciello	Sun peng Li	Wayne Lin	Magnus Lindholm	Andreas Hindborg	Indrek Kruusa	Jernej Skrabec	Paul Moore	Ritesh Harjani (IBM)	Vasanthakumar Thiagarajan	Baochen Qiang	Guillaume Nault	Jeff Layton	Mark Pearson	Ilpo Järvinen	Zi Yan	Gregory Price	Paul E. McKenney	David Hildenbrand (Arm)	Muchun Song	Vlastimil Babka (SUSE)	Lorenzo Stoakes (ARM)	Johannes Weiner	Shakeel Butt	Nhat Pham	Yosry Ahmed	Michal Hocko	Sami Tolvanen	Tao Cui	Neha Gholkar	Balbir Singh	Barry Song	Qi Zheng	Song Hu	Sean Christopherson	Jarkko Sakkinen	Kai Huang	Kuppuswamy Sathyanarayanan	Binbin Wu	Rick Edgecombe	Sizhe Liu	Yicong Yang	Bradley Morgan	Masami Hiramatsu (Google)	[email protected]	Nikhil Agarwal	Nipun Gupta	Andy Shevchenko	Xu Yang	Alexander Graf	Dan Carpenter	Laurent Pinchart	Frank Li	Nick Desaulniers	Kairui Song	Hugh Dickins	Catalin Marinas	Davidlohr Bueso	Lance Yang	Oleg Nesterov	[email protected]	Xu Yilun	Srinivas Pandruvada	Thinh Nguyen	Radhey Shyam Pandey	Geert Uytterhoeven	Sebastian Reichel	Richard Weinberger	Zhihao Cheng	Sergey Senozhatsky	Christoph Hellwig	NeilBrown	Heikki Krogerus	Badhri Jagan Sridharan	Fedor Pchelkin	Viacheslav Dubeyko	Alex Markuze	David Sterba	Namjae Jeon	ChenXiaoSong	Qu Wenruo	Filipe Manana	Even Xu	Anisse Astier	OGAWA Hirofumi	Ricardo Robaina	Simon Horman	Zhu Yanjun	Xiubo Li	Breno Leitao	Rik van Riel	Linus Walleij	Hannes Reinecke	Paul Menzel	Michael Chan	Andy Gospodarek	Eduard Zingerman	Jan Kara	Ming-Hung Tsai	James Clark	Zhongqiu Han	Jason Gunthorpe	Dan Williams	Sven Peter	Dave Jiang	Jonathan Cameron	Tony Luck	Hanjun Guo	Shuai Xue	Andrey Ryabinin	Alison Schofield	Mykola Marzhan	Yu Kuai	Aaron Tomlin	Petr Pavlu	Matthieu Baerts (NGI0)	Zhang Yi	Ren Wei	Chuck Lever	Fernando Fernandez Mancera	Ido Schimmel	Xiang Mei	Stefano Brivio	Konrad Dybcio	Val Packett	Quentin Schulz	Sudeep Holla	Yixun Lan	Sunil V L	Huisong Li	Jesse Taube	Anirudh Srinivasan	Joseph Qi	Ilya Maximets	Jongmin Jang	Bart Van Assche	Xin Long	Tzung-Bi Shih	Benson Leung	Lucas Stach	Heiko Carstens	Jan Höppner	Aditya Garg	Shradha Gupta	Michael Kelley	Manivannan Sadhasivam	Neil Armstrong	Maurizio Lombardi	Laurence Oberman	Justin Tee	Vasant Hegde	Mukesh Ojha	Lu Baolu	Kevin Tian	Nicolin Chen	Lukas Wunner	Francis De Brabandere	Mario Limonciello (AMD)	Thomas Gleixner	Niklas Schnelle	Nilay Shroff	Willem de Bruijn	Alvin Šipraga	Luiz Angelo Daros de Luca	Aaron Conole	Vadim Fedorenko	Mika Westerberg	Sidraya Jayagond	Tony Lu	Mahanta Jambigi	Nicolai Buchwitz	Jason Xing	Andrea Mayer	Gabriel Krisman Bertazi	Burak Emir	Mike Rapoport (Microsoft)	Mukesh Savaliya	Tommaso Merciai	Ping-Ke Shih	Damien Le Moal	Alexey Gladkov	Pavel Tikhomirov	Andrew Morton	Tomasz Figa	Traockl	Andi Shyti	Brett A C Sheffield	Wentao Guan	Shuah Khan	Miguel Ojeda
Series																																																																																																																																																																																																T-b	T-b	T-b	T-b
1/552	R-b	T-b
2/552
3/552															R-b	R-b
4/552
5/552																	R-b
6/552
7/552																		R-b
8/552			R-b
9/552																			R-b	R-b
10/552
11/552			R-b	T-b
12/552					R-b
13/552				T-b		R-b	R-b
14/552				T-b				R-b
15/552									R-b T-b
16/552										A-b
17/552									R-b T-b
18/552
19/552											T-b	A-b
20/552													T-b
21/552														R-b
22/552
23/552
24/552
25/552
26/552																																	R-b
27/552																																									R-b T-b
28/552
29/552
30/552																																																											R-b T-b
31/552																								A-b						R-b							R-b																							A-b
32/552																																																													A-b
33/552																																																														R-b	R-b	R-b	R-b
34/552																					A-b	R-b	R-b	A-b
35/552																								A-b	A-b
36/552
37/552																					R-b					R-b
38/552																								A-b	R-b
39/552																								A-b			R-b
40/552																							R-b					A-b	A-b
41/552																														A-b	A-b
42/552																						R-b				R-b
43/552																									R-b			A-b	A-b			A-b
44/552																												A-b	A-b			A-b		R-b
45/552																												A-b						A-b
46/552																												A-b	A-b					A-b
47/552																						R-b		A-b											T-b	A-b
48/552																										R-b			A-b
49/552																						R-b
50/552																										R-b
51/552																												A-b	A-b								R-b	A-b	T-b R-b
52/552
53/552																																								A-b
54/552
55/552																																										R-b	R-b	R-b	R-b
56/552																																												R-b
57/552																																														R-b T-b	R-b
58/552																																																R-b
59/552
60/552																																																	A-b
61/552																																																R-b		T-b
62/552
63/552																																																			A-b	A-b
64/552																																																					T-b	T-b
65/552																																																							R-b
66/552																																																					R-b
67/552																																																								R-b
68/552																																																									R-b
69/552																																																										R-b
70/552
71/552
72/552																																																																					A-b	R-b
73/552
74/552
75/552																																																																														A-b	R-b
76/552																																																																														A-b
77/552																																																																														R-b		R-b
78/552
79/552
80/552																																																																		T-b
81/552
82/552																																																						R-b
83/552
84/552
85/552																																																																			R-b
86/552																																																																				A-b
87/552
88/552
89/552
90/552
91/552																																																																							R-b
92/552
93/552																																																																								R-b
94/552																																																																									R-b	R-b
95/552
96/552																																																																											R-b
97/552
98/552																																																																												R-b
99/552
100/552
101/552																		R-b																																																											R-b
102/552
103/552
104/552
105/552
106/552
107/552
108/552
109/552																		R-b
110/552
111/552																		R-b
112/552																		R-b
113/552
114/552
115/552
116/552
117/552
118/552
119/552
120/552
121/552
122/552
123/552
124/552
125/552
126/552
127/552
128/552
129/552
130/552
131/552
132/552
133/552
134/552
135/552
136/552
137/552
138/552
139/552
140/552
141/552
142/552
143/552
144/552
145/552
146/552
147/552																		R-b
148/552
149/552
150/552
151/552																		R-b																																																											R-b
152/552																		R-b																																																											R-b
153/552																																																																																	R-b
154/552																																																																																		R-b
155/552																																																																																	R-b
156/552																																																																																		R-b
157/552																																																																																	R-b
158/552																																																																																	R-b
159/552																																																																																	R-b
160/552																																																																																	R-b
161/552																																																																																		R-b
162/552																																																																																														R-b
163/552																																																																																			R-b
164/552																																																																																						R-b	R-b
165/552																																																																																			R-b				R-b
166/552																																																																																											R-b T-b
167/552
168/552																																																																																				R-b
169/552
170/552																																																																																					R-b
171/552
172/552																																																																																				A-b
173/552																																																																																					R-b
174/552
175/552
176/552
177/552
178/552																																																																				A-b
179/552
180/552
181/552
182/552
183/552																																																																																								R-b
184/552																																																																																								R-b
185/552																																																																																								R-b
186/552																																																																																								R-b
187/552
188/552
189/552
190/552
191/552
192/552
193/552
194/552
195/552
196/552
197/552
198/552
199/552																																																																																									R-b
200/552
201/552																																																																																										A-b
202/552
203/552
204/552
205/552
206/552																																																																																												R-b	R-b
207/552																																																																			R-b
208/552
209/552																																																																																															R-b	R-b
210/552
211/552
212/552
213/552																																																																																																														R-b	R-b	R-b
214/552																																																																																																																	R-b
215/552																																																																																																																		R-b
216/552
217/552									T-b R-b A-b
218/552									R-b
219/552									R-b
220/552																																																																																																	R-b
221/552																																																																																																		R-b
222/552																																																																							R-b
223/552																																																																												R-b
224/552																																																																																																			R-b
225/552																																																																																																			R-b
226/552
227/552
228/552																																																																																												R-b
229/552																																																																																																				R-b	R-b
230/552																																																																																																						R-b
231/552
232/552																																																																																																							R-b
233/552
234/552
235/552
236/552
237/552
238/552																																																																																																								R-b
239/552																																																																																																								R-b
240/552																																																																																																									R-b
241/552																																																																																																										R-b
242/552																																																																																																											R-b
243/552																																																																																																												A-b
244/552																																																																																																													R-b
245/552
246/552
247/552
248/552
249/552
250/552
251/552
252/552
253/552
254/552
255/552																																																																																																																			R-b
256/552																																																																																																							R-b																			R-b
257/552																																																																																																							R-b																			R-b
258/552																																																																																																																													R-b
259/552																																																																																																																														R-b
260/552																																																																																																																														R-b
261/552																																																																																																																														R-b
262/552																																																																																												R-b																																			T-b
263/552																																																																																																																														R-b		R-b
264/552
265/552																																																																																																																				R-b
266/552
267/552																																																																																																			R-b																		R-b	R-b
268/552																																																																																																																						R-b
269/552																																																																																																																							R-b	R-b
270/552																																																																																												R-b
271/552																																																																																																																									R-b
272/552																																																																																																																								R-b
273/552
274/552																																																																																																																								R-b
275/552																																																						R-b				R-b
276/552																		R-b
277/552																		R-b
278/552																		R-b
279/552
280/552																		R-b
281/552
282/552																		R-b
283/552
284/552																																																																																																																											R-b
285/552																		R-b
286/552																		R-b
287/552																		R-b
288/552																		R-b
289/552																		R-b
290/552																		R-b
291/552																																																																																																																												R-b
292/552																		A-b
293/552																		A-b
294/552																		A-b
295/552																		A-b
296/552
297/552																		A-b
298/552																		A-b
299/552																		A-b
300/552
301/552
302/552
303/552
304/552
305/552
306/552																																																																																																																																													R-b
307/552																																																																																																																																	R-b
308/552
309/552																																																																																																																																	R-b
310/552																																																																																																																																	R-b	A-b
311/552
312/552
313/552																																																																																																																																			T-b R-b
314/552
315/552
316/552																																																																																																																																				A-b	R-b	R-b	R-b
317/552																																																																																																																																								A-b	T-b
318/552
319/552
320/552
321/552
322/552
323/552
324/552
325/552
326/552
327/552
328/552																																																																																																																																	R-b
329/552
330/552																																																	R-b
331/552
332/552
333/552
334/552
335/552																																																																																																																																										R-b
336/552																																																																																																																																										R-b
337/552																																																																																																																																										R-b
338/552																																																																																																																																										R-b
339/552
340/552
341/552
342/552																																																																																																																																										R-b
343/552
344/552																																																																																																																																											R-b	T-b
345/552
346/552
347/552
348/552
349/552
350/552
351/552																																																										R-b
352/552
353/552
354/552
355/552																																																																																																																																																									R-b	R-b	R-b
356/552
357/552																																																																												R-b
358/552
359/552
360/552
361/552																																																																																																																																														A-b
362/552																																																																																																																																														A-b
363/552																																																																																																																																														A-b
364/552																																																																																																																																														A-b
365/552
366/552
367/552
368/552
369/552
370/552																																																																																																																																															R-b
371/552																																																																																																																																																R-b
372/552
373/552
374/552
375/552
376/552
377/552
378/552																																																																																																																																																	R-b
379/552
380/552
381/552
382/552																																																																																																																																																		A-b
383/552																																																																																																																																																			R-b
384/552																																																																																																																																																			R-b
385/552																																																																																																																																																			R-b
386/552																																																																																																																																																				R-b	R-b	R-b
387/552																																																																																																																																																							R-b
388/552																																																																																																																																																								R-b
389/552
390/552
391/552
392/552
393/552
394/552
395/552
396/552																																																																																																																																																							R-b										R-b
397/552																																											R-b																																																																																																																						R-b
398/552																																																																																																																																																																				R-b	R-b
399/552
400/552
401/552
402/552																																																																																																																																																												R-b
403/552																																																																																																																																																													R-b
404/552																																																																																																											R-b																																																			R-b	R-b
405/552
406/552																																																																																																											R-b																																																					R-b
407/552
408/552
409/552
410/552																																																																																																											R-b																																																				R-b
411/552																																																																																																											R-b																																																				R-b
412/552
413/552																				R-b
414/552																				R-b																																																A-b
415/552																				R-b																																																A-b
416/552
417/552
418/552																				R-b
419/552																				R-b
420/552																				R-b
421/552																				R-b
422/552																				R-b
423/552																				R-b
424/552																				R-b
425/552																				R-b																																																A-b
426/552																				R-b
427/552																			R-b	R-b
428/552																			R-b	R-b
429/552																			R-b	R-b
430/552
431/552																				R-b
432/552																				R-b																																																																																																																																														T-b
433/552																				R-b																																																																																																																																														T-b
434/552																				R-b																																																																																																																																															R-b
435/552																				R-b
436/552																				R-b
437/552																				R-b
438/552																				R-b
439/552																				R-b
440/552																				R-b
441/552																				R-b
442/552																				R-b
443/552																				R-b																																																																																																																																															R-b
444/552																																																																																																																																																																																			R-b
445/552
446/552
447/552
448/552
449/552																																																																																																																																																																						T-b
450/552
451/552
452/552
453/552																																																																																															R-b
454/552																																																																																																																																																																							R-b
455/552																																																																																																	R-b																																																																							R-b	R-b
456/552																																																																																												R-b
457/552																																																																																												R-b
458/552																																																																																												R-b
459/552																																																																																																																																																																										R-b
460/552																																																																																																																																											R-b
461/552
462/552																																																																																																																																																																											R-b
463/552
464/552																																																																																												R-b																																																																																A-b
465/552																																																																																												R-b																																																																																A-b
466/552																																																																																																														R-b
467/552																																																																																																														R-b
468/552																																																																																																														R-b
469/552																																																																																																														R-b
470/552
471/552
472/552																																																																																																																																																																													R-b
473/552																																																																																																																																																																													R-b	R-b
474/552																																																																																															R-b																																																																																R-b
475/552																																																																																												R-b																																																																																			R-b
476/552																																																																																															R-b																																																																														R-b
477/552																																																																																												R-b																																																																																			R-b
478/552																																																																																																																																																																													R-b	R-b
479/552																																																																																																																														R-b
480/552																																																																																																																																																																																R-b	R-b
481/552																																																																																																																																											R-b	T-b																											R-b
482/552																																																																																																																																																																																		R-b
483/552																																																																																																	R-b
484/552
485/552
486/552
487/552
488/552
489/552
490/552
491/552
492/552
493/552
494/552
495/552
496/552
497/552
498/552
499/552																																																	A-b
500/552
501/552																																																																																																																																																																																				T-b
502/552																																																																																																																																																																													R-b
503/552																																																																																																																																																																																					R-b
504/552
505/552
506/552
507/552
508/552
509/552
510/552
511/552
512/552
513/552
514/552
515/552																																																										R-b
516/552																																																										R-b
517/552																																																										R-b
518/552																																																										R-b																																																																																																																												A-b
519/552																																																										R-b																																																																																																																													T-b
520/552																																																										R-b																																																																																																																													T-b
521/552																																																										R-b																																																																																																																													T-b
522/552
523/552
524/552
525/552
526/552
527/552
528/552																																																																																																																																																																																								R-b
529/552
530/552																																																																																																																																																																																								A-b
531/552																																																																																																																																																																																								A-b
532/552																																																																																																																																																																																								A-b
533/552
534/552
535/552																																																																																																																																																																																														T-b
536/552
537/552
538/552
539/552																																																																																																																																																																																															R-b
540/552																											R-b	A-b
541/552																																																																												R-b																																																																																																													R-b
542/552																																									R-b
543/552																																																R-b																																																																																																																																										A-b	R-b
544/552
545/552																																																																	A-b
546/552
547/552																																																																																																																																																																																												R-b
548/552
549/552
550/552
551/552
552/552																																																																																																																																																																																													R-b

Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes. Scroll the table sideways for all 195 reviewers.

Read the v1 thread

Cover letter [PATCH 6.18 000/552] 6.18.50-rc1 review

This is the start of the stable review cycle for the 6.18.50 release. There are 552 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Sun, 06 Sep 2026 04:56:59 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.50-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 6.18.50-rc1

Tzung-Bi Shih <[email protected]>
platform/chrome: sensorhub: Fix dropped timestamp events and log spam

Injae Ryou <[email protected]>
selftests/mm: fix on-fault-limit false failure under sudo-rs

Zhan Xusheng <[email protected]>
udf: Fix i_lenExtents truncation on 32-bit kernels

Thomas Gleixner <[email protected]>
timer: Keep debugobjects state consistent in migrate_timer_list()

Thomas Weißschuh (Schneider Electric) <[email protected]>
timekeeping: Check the return value of tk_get_aux_ts64 in __do_adjtimex()

Bradley Morgan <[email protected]>
taskstats: fix cpumask parsing cutting off the last character

Jann Horn <[email protected]>
smack: fix cred UAF in smack_file_send_sigiotask()

Bradley Morgan <[email protected]>
signal: avoid shared siginfo namespace rewrites

Helge Deller <[email protected]>
sticon/parisc: Detect default STI graphics card for console output

Oleg Nesterov <[email protected]>

    sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[]

Myeonghun Pak <[email protected]>
tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout

Xu Rao <[email protected]>
zloop: truncate finished zones to zone capacity

Zi Yan <[email protected]>
xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc()

Maoyi Xie <[email protected]>
w1: ds28e17: reject an oversize length on an I2C block read

Chengfeng Ye <[email protected]>
vsock/virtio: flush works in dependency order

Laxman Acharya Padhya <[email protected]>
wifi: mt76: mt7996: validate default EEPROM firmware size

Felix Fietkau <[email protected]>
wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames

Devin Wittmayer <[email protected]>
wifi: mt76: mt7925: cancel mlo_pm_work on stop

Bryam Vargas <[email protected]>
wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy

Runyu Xiao <[email protected]>
wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex

Dawei Feng <[email protected]>
wifi: rtw88: pci: fix resource leak on failed NAPI setup

Abdun Nihaal <[email protected]>
wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb()

Abdun Nihaal <[email protected]>
wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars()

Runyu Xiao <[email protected]>
wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids

Stanislaw Gruszka <[email protected]>
wifi: rtl818x: initialize eeprom_93cx6 struct to zero

Fabio Estevam <[email protected]>
wifi: mwifiex: Detach sync cmd buffer on interrupted wait

Eric Biggers <[email protected]>
crypto: sun8i-ss - Remove crypto_rng interface

Eric Biggers <[email protected]>
crypto: sun8i-ce - Remove crypto_rng interface

Fan Wu <[email protected]>
wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop

Dawei Feng <[email protected]>
wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start()

Abdun Nihaal <[email protected]>
wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control()

Claudiu Beznea <[email protected]>
i3c: renesas: Reconfigure the DATBAS register on re-attach

Claudiu Beznea <[email protected]>
i3c: renesas: Clean DATBAS register on detach

Claudiu Beznea <[email protected]>
i3c: renesas: Check that the transfer is valid before accessing it

Adrian Hunter <[email protected]>
i3c: master: Fix potential UAF in i3c_device_uevent()

Maoyi Xie <[email protected]>
i3c: master: svc: bound IBI payload to the requested max_payload_len

Adrian Hunter <[email protected]>
i3c: master: Fix info leak and UAF in device unregister path

Runyu Xiao <[email protected]>
i3c: master: adi: initialize the lock before enabling interrupts

Jianyun Gao <[email protected]>
dm-pcache: fix use-after-free and invalid seg operations in kset_replay()

Jianyun Gao <[email protected]>
dm-pcache: fix implicit u8 truncation of gc_percent in message handler

Bryam Vargas <[email protected]>
dm-pcache: only hand out initialized cache segments

Bryam Vargas <[email protected]>
dm-pcache: detect a cycle in the last-kset chain during replay

Bryam Vargas <[email protected]>
dm-pcache: clamp the tail kset read to the segment data region

Bryam Vargas <[email protected]>
dm-pcache: bound the persisted tail-position offset

Bryam Vargas <[email protected]>
dm-pcache: validate on-media seg_num against the cache device size

Bryam Vargas <[email protected]>
dm-pcache: validate kset key_num and intra-segment bounds

Bryam Vargas <[email protected]>
dm-pcache: validate geometry fields from on-disk cache_info

Haotian Zhang <[email protected]>
dm-switch: use WRITE_ONCE() in switch_region_table_write()

Mikulas Patocka <[email protected]>
dm-stats: fix a crash if allocation of per-cpu data fails

Nathan Chancellor <[email protected]>
arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map()

Yehyeong Lee <[email protected]>
net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry

Miguel Ojeda <[email protected]>

    rust: rust_is_available: warn for `bindgen` < 0.72.1 && libclang >= 22

Ralf Lici <[email protected]>
ovpn: run deferred work on a module-owned workqueue

Vincent Donnefort <[email protected]>
ring-buffer: Fix subbuf resize race with ring buffer readers

Zhang Heng <[email protected]>
ALSA: hda/realtek: Fix Lenovo Yoga Slim 7 14AKP10 quirk ordering

Denis Batishchev <[email protected]>
ALSA: hda/realtek: Enable micmute LED on HP EliteBook 6 G1a p/n: AD3Q9ET#UUG

Eckhart Mohr <[email protected]>
ALSA: hda/realtek: Add quirk for TongFang XxAF5xxx

Takashi Iwai <[email protected]>
ALSA: virmidi: Check card index validity at probe

Takashi Iwai <[email protected]>
ALSA: serial-u16550: Check card index validity at probe

Takashi Iwai <[email protected]>
ALSA: portman2x4: Check card index validity at probe

Runyu Xiao <[email protected]>
ALSA: pcxhr: initialize mutexes before requesting threaded IRQ

Takashi Iwai <[email protected]>
ALSA: mts64: Check card index validity at probe

Takashi Iwai <[email protected]>
ALSA: mpu401: Check card index validity at probe

Xu Rao <[email protected]>
ALSA: hda/ext: preserve PPLCCTL bits when clearing reset

Baul Lee <[email protected]>
ALSA: bcd2000: clear the URB pointers on disconnect

Takashi Iwai <[email protected]>
ALSA: aloop: Check card index validity at probe

Baul Lee <[email protected]>
ALSA: 6fire: bound the MIDI event length from the device

Abdun Nihaal <[email protected]>
mfd: sm501: Fix potential memory leaks during remove

Thomas Richard <[email protected]>
mfd: cgbc: Fix teardown ordering in cgbc_remove()

Can Peng <[email protected]>
hwrng: stm32 - Fix runtime PM cleanup on registration failure

Zhiling Zou <[email protected]>
seg6: reset IP6CB after IPv6 decapsulation

Norbert Szetei <[email protected]>
net: skbuff: don't touch shared zerocopy state in skb_tx_error()

Breno Leitao <[email protected]>
net: fix spurious TX timeout after dev_activate()

Zhiling Zou <[email protected]>
net: cap advertised IP tunnel headroom

Bryam Vargas <[email protected]>
net/smc: unregister the connection before draining the rx tasklet

Hidayath Khan <[email protected]>
net/smc: stop killed, freed and out_of_sync sharing a byte

Yehyeong Lee <[email protected]>
net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link()

Hidayath Khan <[email protected]>
net/smc: fix use-after-free in smc_rx_pipe_buf_release()

Hidayath Khan <[email protected]>
net/smc: fix socket refcount leak in smc_switch_conns()

Bryam Vargas <[email protected]>
net/smc: do not dereference an unset send buffer on the SMC-D teardown path

Yehyeong Lee <[email protected]>
net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages

Koichiro Den <[email protected]>
net: ntb_netdev: Count packets dropped on RX refill failure

Koichiro Den <[email protected]>
net: ntb_netdev: Avoid double-accounting netif_rx() drops

Koichiro Den <[email protected]>
net: ntb_netdev: Fix TX busy and drop handling

Koichiro Den <[email protected]>
NTB: ntb_transport: Reject oversized TX buffers

Koichiro Den <[email protected]>
NTB: ntb_transport: Fail TX enqueue when the QP link is down

Koichiro Den <[email protected]>
NTB: ntb_transport: Recycle TX entries before client callbacks

Fan Ye <[email protected]>
net: thunderbolt: Mark the connection down when bringing it up fails

Fan Ye <[email protected]>
net: thunderbolt: Release the Rx HopID that was handed out on mismatch

Xuanqiang Luo <[email protected]>
net: ravb: serialize PTP clock teardown

Xuanqiang Luo <[email protected]>
net: ravb: avoid dereferencing an invalid PTP clock

Christian Marangi <[email protected]>
net: phylink: correctly validate returned PCS in phylink_inband_caps

Ruoyu Wang <[email protected]>
net: openvswitch: fix nf_connlabels leak in ovs_ct_init

Ilya Maximets <[email protected]>
net: openvswitch: fix flow mask use-after-free on flow deletion

Zihan Xi <[email protected]>
net: l2tp: do not propagate multicast notification errors

Jorijn van der Graaf <[email protected]>
net: ipa: fix stalled modem TX queue after runtime resume

Runyu Xiao <[email protected]>
net: ibm: emac: mal: fix NAPI locking

Ahmad Fatoum <[email protected]>
net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO

Asim Viladi Oglu Manizada <[email protected]>
net: tun: bound receive headroom

Fabio Porcedda <[email protected]>
net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition

Aleksandr Khromov <[email protected]>
slip: fix use-after-free in sl_sync()

Weiming Shi <[email protected]>
xdp: fix zero-copy frame layout

Alexandra Winter <[email protected]>
net/iucv: filter frames in afiucv_hs_rcv() by ingress device

Corey Minyard <[email protected]>
ipmi:msghandler: Cancel work cleanly on an error

Seiji Nishikawa <[email protected]>
ipmi: si: Fix NULL pointer dereference after failed registration

Yuho Choi <[email protected]>
ipmi: Remove all sysfs files on registration failure

Yousef Alhouseen <[email protected]>
ipmi: ipmb: validate write message length

Kuan-Wei Chiu <[email protected]>
interconnect: Fix use after free in icc_get() and of_icc_get_by_index()

Laxman Acharya Padhya <[email protected]>
io_uring/query: cap user size passed to copy_struct_to_user

Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: warn on element type mismatch instead of failing

Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: pass validated element count to package parsers

Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed

Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer()

Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password

Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: fix heap OOB read on empty password write

Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store()

Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: bound ordered-list parsing by the package count

Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: advance elem past consumed array elements

Muhammad Bilal <[email protected]>
platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS

Mario Limonciello <[email protected]>
platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails

Mario Limonciello <[email protected]>
platform/x86/amd/pmc: Propagate SMU errors and validate S2D address

Mario Limonciello <[email protected]>
platform/x86/amd/pmc: Restore msg_port on amd_stb_s2d_init() error paths

Bryam Vargas <[email protected]>
platform/chrome: sensorhub: Bound the EC-reported sensor number

Thorsten Blum <[email protected]>
platform/x86: think-lmi: Fix current password length check

Thorsten Blum <[email protected]>
platform/x86: think-lmi: Free system certificate signatures

Thorsten Blum <[email protected]>
platform/x86: think-lmi: Fix certificate thumbprint sysfs output

Julian Haarmann <[email protected]>
platform/x86: lenovo/ymc: Only match lower byte in WMI lid switch query response

Ma Ke <[email protected]>
platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path

Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Return error during profile addition

Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Validate parameter for frequency and priority

Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Validate parameter for core power state

Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Validate logical CPU id and clos id

Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Use PP level enable mask

Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Just allow 2 bits for SST feature enable

Srinivas Pandruvada <[email protected]>

    platform/x86: ISST: Add a NULL check for sst_inst[]

Fan Wu <[email protected]>
mmc: via-sdmmc: stop card-detect handling on probe failure

Fan Wu <[email protected]>
mmc: via-sdmmc: cancel card-detect work on remove

HyeongJun An <[email protected]>
platform/x86: ISST: Validate socket ID in clos_assoc ioctl

HyeongJun An <[email protected]>
platform/x86: ISST: Validate level in perf mask ioctls

HyeongJun An <[email protected]>
platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer

Peiyang He <[email protected]>
iommufd: Fix UAF in selftest IOPF reporting

Shuai Xue <[email protected]>
iommufd: Release current IOAS on xa_store() failure

Shuai Xue <[email protected]>
iommufd: Avoid locking internal accesses during unmap

Kevin Tian <[email protected]>
iommu/vt-d: Force requesting ACS when tboot is enabled

Kevin Tian <[email protected]>
iommu/vt-d: Fix no_iommu to disable platform opt-in

Peiyang He <[email protected]>
iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add

Shameer Kolothum <[email protected]>
iommu/arm-smmu-v3: Manage teardown with devm

Nicolin Chen <[email protected]>
iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field

Shuai Xue <[email protected]>

    iommu/sva: Set handle->dev before the SVA handle is visible

Weimin Xiong <[email protected]>
iommu/msm: Unwind probe state on registration failure

Shuai Xue <[email protected]>
iommu/amd: Put PCI device after handling PPR faults

Krzysztof Wilczyński <[email protected]>
PCI/proc: Warn on writes to kernel-exclusive config space regions

Krzysztof Wilczyński <[email protected]>
PCI/proc: Use file_ns_capable() when checking config space read access

Krzysztof Wilczyński <[email protected]>
PCI/proc: Avoid spurious runtime PM wakeup on config space accesses

Farhan Ali <[email protected]>
PCI/MSI: Enable memory decoding before restoring MSI-X messages

Darshit Shah <[email protected]>
PCI/DPC: Allow DPC on all Downstream Ports when OS controls AER

Max Lee <[email protected]>
PCI/ASPM: Avoid L0s for Realtek RTS525A

Lukas Wunner <[email protected]>
PCI/AER: Fix mapping of errors to agent & layer

Lukas Wunner <[email protected]>
PCI/AER: Emit TLP Log only for unmasked errors

Krzysztof Wilczyński <[email protected]>
PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses

Krzysztof Wilczyński <[email protected]>
PCI/sysfs: Fix read byte order in pci_read_legacy_io()

Tim Harvey <[email protected]>

    PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608]

Ali Tariq <[email protected]>
PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts()

Ali Tariq <[email protected]>
PCI: plda: Fix use-after-free of event IRQs during teardown

Ronald Claveau <[email protected]>
PCI: meson: Fix GPIO state while requesting PERST#

Mohamad Raizudeen <[email protected]>
PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk

Naman Jain <[email protected]>
PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip

Stefan Haberland <[email protected]>
s390/dasd: Propagate partial completion length across ERP recovery

Stefan Haberland <[email protected]>
s390/dasd: Guard sysfs discipline callbacks against unallocated private data

Stefan Haberland <[email protected]>
s390/dasd: Do not complete a failed ESE read as successful

Thomas Richter <[email protected]>
s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks

Jianing Li <[email protected]>
power: supply: max17040: synchronize work cancellation on suspend

Jianing Li <[email protected]>
power: supply: max17040: drop incorrect I2C functionality check

Jianing Li <[email protected]>
power: supply: max17040: propagate register read errors

Fan Wu <[email protected]>
power: supply: ucs1002: fix use-after-free on remove

Maoyi Xie <[email protected]>
power: supply: twl4030_charger: cancel workers via devm

Fan Wu <[email protected]>
power: supply: rt9455: quiesce delayed work before teardown

HyeongJun An <[email protected]>
power: supply: qcom_battmgr: terminate the strings from firmware

Fan Wu <[email protected]>
power: supply: qcom_battmgr: fix use-after-free

Fan Wu <[email protected]>
power: supply: lp8788-charger: fix use-after-free on remove

Fan Wu <[email protected]>

    power: supply: lp8727: fix use-after-free in lp8727_release_irq()

Jameson Thies <[email protected]>
power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS

Bryam Vargas <[email protected]>
power: supply: cros_usbpd-charger: bound the EC-reported port count

Fan Wu <[email protected]>
power: supply: charger-manager: register regulators before exposing sysfs

Ma Ke <[email protected]>
power: supply: bq25890: Fix power_supply reference leak

Fan Wu <[email protected]>
power: supply: bq256xx: drain usb_work before freeing the charger

Fan Wu <[email protected]>
power: supply: bq24257: fix use-after-free on remove

Jun Yang <[email protected]>

    sctp: fix stream->outcnt underflow on duplicate RECONF responses

Jun Yang <[email protected]>
sctp: distinguish sequence zero from wildcard in reconf lookup

Weiming Shi <[email protected]>
sctp: fix NULL deref on untransmitted RECONF completion

Hyunwoo Kim <[email protected]>
sctp: drop a chunk if its transport was removed

Hyunwoo Kim <[email protected]>
sctp: stop processing a packet once its association is deleted

Yehyeong Lee <[email protected]>
nvme-tcp: reject a read that transferred too few bytes

Yehyeong Lee <[email protected]>
nvme-tcp: fix host memory disclosure on R2T for a read command

Yehyeong Lee <[email protected]>
nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone

Myeonghun Pak <[email protected]>
nvme-pci: disable controller on admin queue IRQ setup failure

Yehyeong Lee <[email protected]>
nvme: zero the discard fallback page

Ewan D. Milne <[email protected]>
nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path

Shuangpeng Bai <[email protected]>
lockd: fix NULL dereference on lockowner allocation failure

Michael Bommarito <[email protected]>
lockd: pin next file across nlm_inspect_file lock-drop

Yifei Gao <[email protected]>
ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user()

Ruoyu Wang <[email protected]>
i2c: mxs: fix DMA channel leak on probe error

Cong Nguyen <[email protected]>
hwmon: (max6621) fix temperature clamp range

Cong Nguyen <[email protected]>
hwmon: (max6621) fix negative temperature offset and crit readings

Christopher Tolang <[email protected]>
ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC

Karl Mehltretter <[email protected]>
arm64: proton-pack: Restore the nospectre_bhb command-line option

Karl Mehltretter <[email protected]>
arm64: compat: Fix decrementing LDM/STM alignment emulation

HyeongJun An <[email protected]>
ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion

Norbert Szetei <[email protected]>
openvswitch: only skb_tx_error() a packet we are about to drop

Ali Ahmet Memis <[email protected]>
openrisc: fix arbitrary kernel memory access via or1k_atomic syscall

Zhan Xusheng <[email protected]>
ocfs2: fix readdir position truncation on 32-bit kernels

Joseph Qi <[email protected]>
ocfs2: cluster: fix o2hb_dependent_users leak on pin failure

Joseph Qi <[email protected]>
ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item

Joseph Qi <[email protected]>
ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin()

Ibrahim Hashimov <[email protected]>
ocfs2: validate rl_used against rl_count in refcount block validator

Bryam Vargas <[email protected]>
ocfs2: validate lengths in dlm_mig_lockres_handler

Bryam Vargas <[email protected]>
ocfs2: bound namelen in dlm_migrate_request_handler

Dmitry Antipov <[email protected]>
ocfs2: always run deallocs on copy-on-write completion

Zhiling Zou <[email protected]>
orangefs: skip leading spaces before parsing client debug masks

Yifei Gao <[email protected]>
orangefs: fix double-free of trailer_buf on readdir copy failure

Shibo Zhu <[email protected]>
PM: sleep: Unblock runtime PM when device prepare fails

Vincent Donnefort <[email protected]>
ring-buffer: Hold cpu_buffer::lock when resizing a subbuf

Vincent Donnefort <[email protected]>
ring-buffer: Free cpu_buffer::free_page with subbuf_order

Vincent Donnefort <[email protected]>
ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page()

Kathiravan Thirumoorthy <[email protected]>
regulator: qcom-refgen: correct the regulator type to CURRENT

WenTao Liang <[email protected]>
regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata

WenTao Liang <[email protected]>
regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer

Jason Gunthorpe <[email protected]>
RDMA/uverbs: Add UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR

Norbert Szetei <[email protected]>
RDMA/ucma: Lock the handler in ucma_write_cm_event()

Norbert Szetei <[email protected]>
RDMA/ucma: Lock the handler in ucma_set_ib_path()

Brett Creeley <[email protected]>
RDMA/ionic: Cap eq_count to the eth driver's interrupt vector budget

Fan Wu <[email protected]>
RDMA/cxgb4: Cancel reg_work before freeing device on remove

Vaibhav Nagare <[email protected]>
qede: Fix NULL pointer dereference in TPA fragment processing

Abdifatah Suruur <[email protected]>
ptp: vmclock: prevent read-only mappings from becoming writable

Johan Hovold <[email protected]>
remoteproc: scp: Fix device reference leak on failed lookup

Nam Cao <[email protected]>
riscv: unaligned: stop using kthread for check_vector_unaligned_access()

Peixin Xie <[email protected]>
riscv: acpi: Handle LPI architectural context loss flags

Fabio Estevam <[email protected]>
arm64: dts: rockchip: Fix rk3588s-roc-pc audio description

Fabio Estevam <[email protected]>
arm64: dts: rockchip: Fix rk3399-roc-pc-plus analog audio

Jakob Unterwurzacher <[email protected]>
arm64: dts: rockchip: fix emmc reset polarity on px30-cobra

Quentin Schulz <[email protected]>
arm64: dts: rockchip: fix eMMC reset polarity on PX30 Ringneck

Quentin Schulz <[email protected]>
arm64: dts: rockchip: fix eMMC reset polarity on PP-1516

Michael Scott <[email protected]>
arm64: dts: qcom: x1-dell-thena: mark l12b and l15b always-on

Krzysztof Kozlowski <[email protected]>
arm64: dts: qcom: sm6115-pro1x: Correct touchscreen GPIO flags

Oren Klopfer <[email protected]>
Revert "arm64: dts: rockchip: Further describe the WiFi for the Pinephone Pro"

Chunkai Deng <[email protected]>
rpmsg: glink: smem: order FIFO read after availability check

Petr Vaganov <[email protected]>
scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()

Cong Nguyen <[email protected]>
media: staging/ipu7: fix async notifier UAF on probe error path

Hao-Qun Huang <[email protected]>
staging: media: tegra-video: vi: fix probe failure on skipped last port

Hao-Qun Huang <[email protected]>
staging: media: tegra-video: fix of_node_put() on VIP parse errors

Wentao Guan <[email protected]>
wifi: mt76: mt7925: cancel pending mlo_pm_work

Doruk Tan Ozturk <[email protected]>
wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets

David Lee <[email protected]>
udf: reject VAT indexes equal to the entry count

Chuck Lever <[email protected]>
svcrdma: Validate Read chunk positions before reconstruction

Chuck Lever <[email protected]>
svcrdma: Use svc_xprt_put to free listener on create failure

Chris Mason <[email protected]>
svcrdma: Reject Write/Reply chunks with segcount 0

Chuck Lever <[email protected]>
svcrdma: Reject inline replies that overflow the pull-up buffer

Chuck Lever <[email protected]>
svcrdma: Reject connection when transport allocation fails

Chris Mason <[email protected]>
svcrdma: Fix unmatched rn_unregister on failed accept

Chris Mason <[email protected]>
svcrdma: Fix pcl_for_each_segment for empty chunks

Chris Mason <[email protected]>
svcrdma: Fix offset arithmetic in read_chunk_range

Jérémy Jean <[email protected]>
SUNRPC: wait for in-flight client TLS handshake callback

Chuck Lever <[email protected]>
SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field

Chris Mason <[email protected]>
SUNRPC: reject duplicate CREDS_VALUE options

Chris Mason <[email protected]>
sunrpc: init gssp_lock before publishing proc entry

Chris Mason <[email protected]>
SUNRPC: harden gss_unwrap_resp_priv length checks

Chris Mason <[email protected]>
SUNRPC: harden gss_krb5_unwrap_v2 against short tokens

Chris Mason <[email protected]>
SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat

Luxiao Xu <[email protected]>
sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir

Jeff Layton <[email protected]>
sunrpc: defer rq_argp and rq_resp free until after RCU grace period

Chuck Lever <[email protected]>
SUNRPC: Check svc pool percpu counter allocation

Jeff Layton <[email protected]>
SUNRPC: always drain cache_cleaner before destroying a cache_detail

Ameer Hamza <[email protected]>
SUNRPC: Restore NUMA_NO_NODE for svc thread allocations in global mode

Jeff Layton <[email protected]>
sunrpc: route to a populated pool in svc_pool_for_cpu()

Chris Mason <[email protected]>
SUNRPC: svcauth_gss: enforce krb5 token minimum length

Chris Mason <[email protected]>
SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry

Chris Mason <[email protected]>

    SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow

Felix Gu <[email protected]>
phy: fsl-imx8mq-usb: fix typec switch leak on probe error path

Jiacheng Yu <[email protected]>
params: fix charp corruption on allocation failure

Dave Airlie <[email protected]>
nouveau/gem: reserve the bo in the info ioctl around the vma lookup

Stanislaw Gruszka <[email protected]>
module/kallsyms: fix nextval for data symbol lookup

Harshit Varu <[email protected]>
mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction

Qing Ming <[email protected]>
mpls: reload header after pskb_may_pull()

Thiébaud Weksteen <[email protected]>
module: validate string table section types

Coly Li <[email protected]>

    md: do overflow check for sb->bblog_shift in super_1_load()

Yunye Zhao <[email protected]>
md/raid10: fix still_degraded being inverted in raid10_sync_request()

Anup Vishwakarma <[email protected]>
mailbox: qcom-ipcc: fix duplicate channel allocation across holes

Bryam Vargas <[email protected]>
libnvdimm/labels: Prevent integer overflow in __nd_label_validate()

Günther Noack <[email protected]>
landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation

Yuyang Huang <[email protected]>
ipv6: use RCU iterator to dump route exceptions

Andrea Mayer <[email protected]>
ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv()

Zhiling Zou <[email protected]>
ip6_gre: fix hardware header length for NBMA tunnels

Zhiling Zou <[email protected]>
ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()

Zhiling Zou <[email protected]>
ip: orphan prefetched skbs before multicast forwarding

Anton Danilov <[email protected]>
ipip: fix skb leak in collect_md mode when metadata_dst allocation fails

Max Kellermann <[email protected]>
jbd2: check need_resched() when skipping busy checkpoint buffers

Max Kellermann <[email protected]>
jbd2: bound shrinker scans by examined checkpoint buffers

Hui Su <[email protected]>
kasan: fix cache shrink race with CPU hotplug

Ibrahim Abdelkader <[email protected]>
Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request

Guangshuo Li <[email protected]>
Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative

Guangshuo Li <[email protected]>
Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative

Valentin Kindschi <[email protected]>
Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection

Xin Chen <[email protected]>
Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb

Valentin Kindschi <[email protected]>
Bluetooth: hci_conn: re-enable advertising only for peripheral role

Chengfeng Ye <[email protected]>
Bluetooth: RFCOMM: serialize security confirmation handling

Hang Nan <[email protected]>
Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready

Gongwei Li <[email protected]>
Bluetooth: hci_uart: Fix false success return in hci_uart_setup()

Guangshuo Li <[email protected]>
Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative

Lorenzo Stoakes (ARM) <[email protected]>
Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378

Alison Schofield <[email protected]>
cxl/pmem: Format the nvdimm serial number as unsigned decimal

Zhenhao Wan <[email protected]>
cxl/features: bound fwctl command payload to the input buffer

Hui Su <[email protected]>
cpufreq: schedutil: Fix rate limit overflow

Kuan-Wei Chiu <[email protected]>
coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior

Bryam Vargas <[email protected]>
dm array: reject an array block whose value size is not the caller's

Bryam Vargas <[email protected]>
dm array: validate array block headers on read

Ilya Krutskih <[email protected]>
dm raid1: reserve space for NUL-terminator in build_constructor_string()

liyouhong <[email protected]>
dm-era: fix shadowed superblock leak on take-snap failure

Mikulas Patocka <[email protected]>
dm-io: report non-retryable errors separatedly

Keith Busch <[email protected]>
dm-io: clone the source bio instead of copying its biovec

Jérémy Jean <[email protected]>
bpf: Harden bloom filter sizing and indexing on 32-bit kernels

Jia Zhu <[email protected]>
buffer: avoid tail commit walk for uptodate folios

Daniel Borkmann <[email protected]>
bpf: Disable preemption in __bpf_get_stack

Vineet Gupta <[email protected]>
bpf, x86: Fix per-CPU address resolution into an extended register

Joe Damato <[email protected]>
bnxt_en: Write doorbell when linearizing skb fails

Jiangshan Yi <[email protected]>
bnx2x: fix double free in bnx2x_init_firmware() error path

HyeongJun An <[email protected]>
Bluetooth: eir: Fix OOB read in eir_get_service_data()

Junjie Cao <[email protected]>
Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728

Christoph Zwerschke <[email protected]>
Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU

Christoph Zwerschke <[email protected]>
Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU

胡连勤 <[email protected]>
block: set QUEUE_FLAG_DYING unconditionally in blk_mark_disk_dead()

Hongyan Xu <[email protected]>
auxdisplay: charlcd: cancel backlight work on registration failure

Niklas Cassel <[email protected]>
ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes

Ethan Nelson-Moore <[email protected]>
ARM: 9477/1: Disable broken eBPF JIT on the Risc PC

Matt Turner <[email protected]>
alpha: marvel: Fix lock ordering in init_io7_irqs()

Matt Turner <[email protected]>
alpha: marvel: Fix irq_set_status_flags to use correct IRQ number

Krzysztof Wilczyński <[email protected]>
alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write()

Anirudh Prasad <[email protected]>
ACPI: pfr_update: fix stack buffer overflow in query_capability()

TanZheng <[email protected]>
ACPI: APEI: GHES: fix ARM section length accounting after header

Nirmoy Das <[email protected]>
ACPI: APEI: Fix ERST timeout unit conversion

Terry Bowman <[email protected]>
acpi/apei/ghes: Use raw_spinlock_t for CXL CPER work locks

ZhaoJinming <[email protected]>
accel/rocket: Fix error path handling in rocket_job_run()

Shuvam Pandey <[email protected]>
accel/rocket: initialize job domain before cleanup paths

Muhammad Bilal <[email protected]>
accel/rocket: fix NULL dereference and integer overflow in rocket_job_push()

Guillaume Morin <[email protected]>
hugetlb: only adjust reservation during unmapping if mapcount is 0

Ivaylo Dimitrov <[email protected]>
hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device

Tien Sung Ang <[email protected]>
fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration

Marek Czernohous <[email protected]>
forcedeth: fix off-by-one when saving/restoring non-PCI config space

Myeonghun Pak <[email protected]>
fbdev: uvesafb: unregister connector callback on init failure

Hui Su <[email protected]>
fbdev: ssd1307fb: defer I2C transfers from damage callbacks

Florian Fuchs <[email protected]>
fbdev: pvr2fb: correct user pointer annotation and sentinel initializer

Runyu Xiao <[email protected]>
fbdev: omapfb: panel-dsi-cm: initialize lock before registering display

Yemu Lu <[email protected]>
fat: restore original value when fat_ent_write failed

Chengfeng Ye <[email protected]>
fanotify: fix use-after-free of file range info

Ard Biesheuvel <[email protected]>
efivarfs: Rate limit statfs() handler

Yichong Chen <[email protected]>
ecryptfs: show filename encryption options

Yichong Chen <[email protected]>
ecryptfs: release message context on send failure

Yichong Chen <[email protected]>
ecryptfs: reject too-small tag 70 packets

HanQuan <[email protected]>
ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet

Yichong Chen <[email protected]>
ecryptfs: pass packet set buffer size to parser

Yichong Chen <[email protected]>
ecryptfs: hold msg ctx list lock when cleaning daemon queue

Yichong Chen <[email protected]>
ecryptfs: fix tag 11 packet exact-fit size check

Pengpeng Hou <[email protected]>
eCryptfs: bound the packet-length peek to the user buffer

Konstantin Komarov <[email protected]>

    fs/ntfs3: bound page_lcns[] index by the log record

Samuel Page <[email protected]>
fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()

Xiang Mei <[email protected]>
fs/ntfs3: validate dirty page table on log replay

Deepanshu Kartikey <[email protected]>

    eventfs: Initialize ei->children and ei->list in init_ei()

Guangshuo Li <[email protected]>
HID: intel-thc-hid: intel-quickspi: fix autosuspend cleanup during teardown

Guangshuo Li <[email protected]>
HID: intel-thc-hid: intel-quicki2c: fix autosuspend cleanup during teardown

HyeongJun An <[email protected]>
HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer

HyeongJun An <[email protected]>
HID: intel-thc-hid: intel-quickspi: validate report size before copy

Jiangshan Yi <[email protected]>
HID: mcp2221: validate report size in mcp2221_raw_event()

Jiangshan Yi <[email protected]>
HID: mcp2221: stop device IO before hid_hw_stop

Baul Lee <[email protected]>
HID: universal-pidff: stop the device when force-feedback init fails

Doruk Tan Ozturk <[email protected]>
HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind

Haoxiang Li <[email protected]>
HID: sensor: custom: Fix field sysfs group cleanup on failure

Xu Rao <[email protected]>
HID: roccat: free buffered reports when destroying device

Ibrahim Hashimov <[email protected]>
HID: picolcd: clamp eeprom debugfs read to bytes actually received

Stuart Hayhurst <[email protected]>
HID: corsair-void: Check size of status and firmware events before reading them

Andre Eikmeyer <[email protected]>
HID: apple: preserve keyboard backlight across T2 resume

Fredric Cover <[email protected]>
smb: client: harden DFS cache against invalid target hints

Frank Sorenson <[email protected]>
smb: client: fix copy-paste error in WSL EA length accounting for $LXDEV

Frank Sorenson <[email protected]>
smb: client: fix ALIGN() overflow in symlink_data() error context loop

Fredric Cover <[email protected]>

    smb: client: clear ce->tgthint in free_tgts()

Frank Sorenson <[email protected]>
cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC

Frank Sorenson <[email protected]>

    cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0

Frank Sorenson <[email protected]>
cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size()

Jérémy Jean <[email protected]>
audit: avoid dropping live tree ref on fsnotify rule autoremove

Qu Wenruo <[email protected]>
btrfs: do not overwrite NODATASUM flag when removing NODATACOW flag

Shuangpeng Bai <[email protected]>
btrfs: fix extent map leak in NOCOW direct I/O write

Guanghui Yang <[email protected]>
btrfs: drop recovered reloc root refs on recovery failure

Matthew Brown <[email protected]>
ceph: fix leaked inode reference on writeback abort at umount

Max Kellermann <[email protected]>
ceph: do not repeat ceph_trim_dentries() if no progress possible

Michael Bommarito <[email protected]>
ceph: bound xattr value length in __build_xattrs()

Michael Bommarito <[email protected]>
ceph: bound num_export_targets array for mds info v2/v3

Michael Bommarito <[email protected]>
ceph: bound MDSCapAuth path and fs_name decode in handle_session()

Michael Bommarito <[email protected]>
ceph: bound copied dentry name length in NFS export get_name

Jérémy Jean <[email protected]>
ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode

Xiubo Li <[email protected]>
ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock

Jérémy Jean <[email protected]>
libceph: reject buckets with mismatched CRUSH ids

Michael Bommarito <[email protected]>
libceph: validate OSD extent maps before cursor advance

Chuck Lever <[email protected]>
NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup

Chuck Lever <[email protected]>
NFSD: Prevent lock owner use-after-free during client teardown

Jeff Layton <[email protected]>
nfsd: revoke copy-notify stateids before dropping their reference

Jeff Layton <[email protected]>
nfsd: reject reclaim LOCK after RECLAIM_COMPLETE

Robbie Ko <[email protected]>
nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE

Robbie Ko <[email protected]>
nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops

Jeff Layton <[email protected]>
nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd()

Jeff Layton <[email protected]>
nfsd: initialize DRC hash table before registering shrinker

Jeff Layton <[email protected]>
nfsd: initialize copy-notify stateid before publishing it

Chris Mason <[email protected]>
nfsd: hold rcu across localio cmpxchg retry

Chris Mason <[email protected]>

    nfsd: gate nfs3 setacl by argp->mask

Chuck Lever <[email protected]>

    nfsd: gate nfs2 setacl by argp->mask

Jeff Layton <[email protected]>
nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo

Jeff Layton <[email protected]>
nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget

Jeff Layton <[email protected]>
nfsd: fix version mismatch loops in nfsd_acl_init_request()

Jeff Layton <[email protected]>
nfsd: fix stale s2s_cp_stateids IDR entry for async COPY

Jeff Layton <[email protected]>
nfsd: fix reply size estimate for GET_DIR_DELEGATION

Jeff Layton <[email protected]>
nfsd: fix refcount leak in nfsd_file_lru_add on insertion failure

Nikol Kuklev <[email protected]>
nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs

Jeff Layton <[email protected]>
nfsd: fix nfsd_file leak on inter-server COPY setup failure

Jeff Layton <[email protected]>
nfsd: fix netlink dumpit error handling for rpc_status_get

Jeff Layton <[email protected]>
nfsd: fix FL_SLEEP being set unconditionally for all LOCK types

Jeff Layton <[email protected]>
nfsd: fix dentry ref leak on V4ROOT export filehandle lookup

Chris Mason <[email protected]>
nfsd: fix cpntf publish race in nfs4_init_cp_state

Jeff Layton <[email protected]>
nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke

Jeff Layton <[email protected]>
nfsd: drop the stateid, not the stateowner, on seqid_op replay retry

Jeff Layton <[email protected]>
nfsd: don't free session slots that are still in use

Jeff Layton <[email protected]>
nfsd: defer vfree of compound ops to fix rpc_status UAF

Jeff Layton <[email protected]>
nfsd: defer setting NFSD4_CALLBACK_RUNNING in deleg_reaper

Jeff Layton <[email protected]>
nfsd: clear opcnt on compound arg release to prevent OOB read

Jeff Layton <[email protected]>
nfsd: clear CALLBACK_RUNNING on failed delegation recall queue

Jeff Layton <[email protected]>
nfsd: check client ownership when cancelling a copy-notify stateid

Jeff Layton <[email protected]>
nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref

Jeff Layton <[email protected]>
nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry

Jeff Layton <[email protected]>
nfsd: add filehandle match check to nfsd4_delegreturn()

Jeff Layton <[email protected]>
nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()

Jeff Layton <[email protected]>
nfsd: validate symlink target length in NFSv4 CREATE

Jeff Layton <[email protected]>
nfsd: validate sockaddr length per family in listener_set

Jeff Layton <[email protected]>
nfsd: validate nseconds in TIME_DELEG decode paths

Chris Mason <[email protected]>
nfsd: size fh_verify server sockaddr slot by xpt_locallen

Zhenghang Xiao <[email protected]>
nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations

Chuck Lever <[email protected]>
nfsd: sample writeback error cursor before async COPY loop

Jeff Layton <[email protected]>
nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types

Chuck Lever <[email protected]>
nfsd: Reset write verifier when async COPY writeback fails

Chris Mason <[email protected]>
nfsd: release path refs on follow_down() error

Jeff Layton <[email protected]>
nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown

Tim Menninger <[email protected]>
pNFS: Fix EBUSY check in pnfs_layout_need_return

Junrui Luo <[email protected]>
NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path

Chris Mason <[email protected]>
nfsd: guard nfsd_serv deref in nfsd_file_net_dispose

Mike Snitzer <[email protected]>
NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check

Michael Bommarito <[email protected]>
NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock

Chuck Lever <[email protected]>
NFSD: Fix off-by-one in DRC bucket pruning limit

Chuck Lever <[email protected]>
NFSD: Encode only the status in NFS-ACL v2 GETACL error replies

Chuck Lever <[email protected]>
NFSD: check truncate permission under inode lock

Nate Prodromou <[email protected]>
NFS: fix delegation_hash_table leak when nfs4_server_common_setup() fails

Chris Mason <[email protected]>
NFS/localio: fix ref leak on nfs_uuid_add_file failure

Longlong Xia <[email protected]>
zsmalloc: account for handle size in class lookup

Sergey Senozhatsky <[email protected]>
zram: validate deflate params

Ibrahim Hashimov <[email protected]>
ubifs: fix out-of-bounds read in signature length check

Jason Yang <[email protected]>
phy: rockchip-samsung-dcphy: fix out-of-range max_register

Krzysztof Wilczyński <[email protected]>
PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io()

Abdurrahman Hussain <[email protected]>
of: fix out-of-bounds read in of_alias_scan() stem parser

Ryusuke Konishi <[email protected]>
nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation

Junrui Luo <[email protected]>
media: vicodec: fix out-of-bounds write in FWHT encoder

Weigang He <[email protected]>
media: cec: stm32: prevent out-of-bounds write on RX overflow

Vincent Mailhol <[email protected]>
lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()

Xingrui Li <[email protected]>
HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature

Daisuke Matsuda <[email protected]>
fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write

Neill Kapron <[email protected]>
usb: gadget: f_fs: Prevent deadlock during ep0 read loop

Jeffin Philip <[email protected]>
usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()

Jeffin Philip <[email protected]>
usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init()

Yun Zhou <[email protected]>
usb: gadget: f_tcm: fix deadlock in usbg_make_tpg()

Joshua Crofts <[email protected]>
usb: gadget: midi2: remove default configfs groups on teardown

Myeonghun Pak <[email protected]>
usb: gadget: snps_udc_plat: clean up PHY on probe deferral

Sonali Pradhan <[email protected]>
usb: gadget: u_audio: Fix use-after-free on sound card disconnect

Huang Wei <[email protected]>
usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion

Fan Wu <[email protected]>
usb: typec: thunderbolt: Disable work before freeing tbt on remove

Xu Yang <[email protected]>
usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive()

Johan Hovold <[email protected]>
USB: phy: fsl-usb: fix missing static keywords

Fan Wu <[email protected]>
usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed

Pei Xiao <[email protected]>
usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition

Francesco Lavra <[email protected]>
usb: dwc2: gadget: Exit partial power down state when changing USB pull-up

Hao-Qun Huang <[email protected]>
staging: greybus: hid: fix SET_REPORT return value

Karl Mehltretter <[email protected]>

    serial: imx: serialize imx_uart_ports[] lifetime

Hans Verkuil <[email protected]>
Revert "media: v4l2-dev: fix error handling in __video_register_device()"

James Kim <[email protected]>
rapidio: mport_cdev: fix use-after-free in dma_req_free()

Bartosz Golaszewski <[email protected]>
powerpc/powermac: fix OF node refcount

Bryam Vargas <[email protected]>
misc: nsm: bound the device-reported response length

Xu Yang <[email protected]>
device property: fix infinite loop in fwnode_for_each_child_node()

Prasanna Kumar T S M <[email protected]>
cdx: Fix double free when sysfs file creation fails

Hui Su <[email protected]>
tracing: Fix use-after-free with same-name named triggers

Deepanshu Kartikey <[email protected]>
tracing: Fix use-after-free in trace_pipe read on sub-buffer order change

Vincent Donnefort <[email protected]>
tracing: Fix logged instance name on creation failure

Hui Su <[email protected]>
tracing: Fix crash passing ERR_PTR to kthread_stop()

Jérémy Jean <[email protected]>
tracing/user_events: Clear copied tracing state before fork duplication

Sanman Pradhan <[email protected]>
hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start()

Kiryl Shutsemau (Meta) <[email protected]>
x86/tdx: Fix zero-extension for 32-bit port I/O

Kiryl Shutsemau (Meta) <[email protected]>
x86/tdx: Fix off-by-one in port I/O handling

Yao Zi <[email protected]>
x86/locking: Use sfence for wmb() if SSE is available

Kiryl Shutsemau (Meta) <[email protected]>
x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg()

Joy H.J. Lee <[email protected]>
tools/compiler: match glibc 2.42 definition of __attribute_const__

Ridong Chen <[email protected]>
mm: vmscan: fix node reclaim ignoring swappiness parameter

Johannes Weiner <[email protected]>
mm: page_alloc: fix non-movable reclaim storm in defrag_mode

Vlastimil Babka (SUSE) <[email protected]>
mm: page_alloc: move capture_control to the page allocator

Johannes Weiner <[email protected]>
mm: page_alloc: __GFP_FS lockdep annotation for direct compaction

Johannes Weiner <[email protected]>
mm: mempolicy: fix automatic numa balancing for shmem

Guopeng Zhang <[email protected]>
mm: memcontrol: update state_local when flushing NMI stats

Guopeng Zhang <[email protected]>
mm: memcg: stop reclaim when a limit update is superseded

Guopeng Zhang <[email protected]>
mm: memcg-v1: fix memsw and TCP failcnt accounting

Guopeng Zhang <[email protected]>
mm: memcg-v1: fix wrong linux-mm list address in deprecation warnings

Johannes Weiner <[email protected]>
mm: compaction: support non-movable compaction for pageblock requests

Hao Jia <[email protected]>
mm/zswap: fix global shrinker when memory cgroup is disabled

Breno Leitao <[email protected]>
mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec()

Hyunwoo Kim <[email protected]>

    mm/pagewalk: fix stale walk->action escaping walk_pmd_range()

Dev Jain <[email protected]>
mm/page_vma_mapped: use huge_ptep_get() for hugetlb

Ye Liu <[email protected]>
mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg()

Alexander Graf <[email protected]>
mm/mm_init: deferred_grow_zone(): fix out-of-range first_deferred_pfn

Dev Jain <[email protected]>
mm/migrate: use huge_ptep_get() in remove_migration_pte()

Breno Leitao <[email protected]>
mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()

Breno Leitao <[email protected]>
mm/kmemleak: avoid soft lockup when scanning task stacks

David Hildenbrand (Arm) <[email protected]>
mm/gup: fix always draining LRU caches in collect_longterm_unpinnable_folios()

Breno Leitao <[email protected]>
mm, swap: ratelimit bad swap entry reports

Jordan R Abrahams-Whitehead <[email protected]>
include/linux/list.h: mark list_add and __list_add as __always_inline

Hyunwoo Kim <[email protected]>
apparmor: fix out-of-bounds write when null terminating a label vec

Jann Horn <[email protected]>
apparmor: fix cred UAF caused by begin_current_label_crit_section()

Chengfeng Ye <[email protected]>
KEYS: trusted: Fix TPM teardown ordering

Gary Guo <[email protected]>
rust: cfi: disable function merging if CFI is enabled

Nikolai Grlica <[email protected]>
rust: kernel: list: fix incorrect pop_back example comment

FUJITA Tomonori <[email protected]>
rust: bug: fix warn_on macro build error on UML

FUJITA Tomonori <[email protected]>
rust: bug: skip arch-specific asm in testlib builds

Jérémy Jean <[email protected]>
timers/itimer: Zero-init old itimerval before copy to userspace

Gaurav Batra <[email protected]>
powerpc/pseries/iommu: switch to Default DMA window during kdump

Baokun Li <[email protected]>
fs: fix user path of nested backing files

Felix Yan <[email protected]>
clocksource/drivers/timer-sun4i: Advertise a real minimum delta

WenTao Liang <[email protected]>
clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path

Matt Turner <[email protected]>
alpha: don't leak hardware-fabricated FP exception bits to user space

FUJITA Tomonori <[email protected]>
rust: time: fix as_micros_ceil() rounding near i64::MAX

Matt Turner <[email protected]>
alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally

Fangzhi Zuo <[email protected]>
drm/amd/display: Prune per-tile Timing from Apple Studio Display Primary Tile

Jerry Zuo <[email protected]>
drm/amd/display: hide Apple Studio Display secondary tile

Timur Kristóf <[email protected]>
drm/amd/display: Refactor amdgpu_dm_connector_detect (v2)

Roman Li <[email protected]>
drm/amd/display: Skip PHY SSC reduction on some 8K panels

David Howells <[email protected]>
netfs: Fix missing locking around retry adding new subreqs

Rong Zhang <[email protected]>
platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmi_dev_evaluate_int()

Srinivasan Shanmugam <[email protected]>
drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths

Christian Brauner <[email protected]>
nsfs: tighten permission checks for handle opening

Daniel Borkmann <[email protected]>
bpf: Fix incorrect pruning due to atomic fetch precision tracking

Eric Dumazet <[email protected]>
ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS

Rochan Avlur <[email protected]>
fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free

Zilin Guan <[email protected]>
wifi: ath11k: fix memory leaks in beacon template setup

Zilin Guan <[email protected]>
wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req()

Zide Chen <[email protected]>
perf/x86/intel/uncore: Fix die ID init and look up bugs

-------------

Diffstat:

 Documentation/ABI/testing/sysfs-bus-nvdimm         |   3 +-
 Documentation/admin-guide/blockdev/zoned_loop.rst  |   9 +-
 Makefile                                           |   7 +-
 arch/alpha/include/uapi/asm/fpu.h                  |   8 +-
 arch/alpha/kernel/pci-sysfs.c                      |   6 +-
 arch/alpha/kernel/sys_marvel.c                     |  25 +-
 arch/alpha/kernel/traps.c                          |   6 +-
 arch/alpha/math-emu/math.c                         |  88 ++++++-
 arch/arm/Kconfig                                   |   2 +-
 arch/arm64/boot/dts/qcom/sm6115-fxtec-pro1x.dts    |   2 +-
 arch/arm64/boot/dts/qcom/x1-dell-thena.dtsi        |   2 +
 arch/arm64/boot/dts/rockchip/px30-cobra.dtsi       |   2 +-
 arch/arm64/boot/dts/rockchip/px30-pp1516.dtsi      |   2 +-
 arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi    |   2 +-
 .../boot/dts/rockchip/rk3399-pinephone-pro.dts     |  18 --
 .../arm64/boot/dts/rockchip/rk3399-roc-pc-plus.dts |  12 +
 arch/arm64/boot/dts/rockchip/rk3588s-roc-pc.dts    |  23 +-
 arch/arm64/kernel/compat_alignment.c               |   4 +-
 arch/arm64/kernel/proton-pack.c                    |   9 +-
 arch/openrisc/kernel/entry.S                       |  43 +++-
 arch/powerpc/kernel/pci-common.c                   |   9 +-
 arch/powerpc/platforms/powermac/low_i2c.c          |   2 +-
 arch/powerpc/platforms/pseries/iommu.c             |  23 +-
 arch/riscv/include/asm/acpi.h                      |  19 ++
 arch/riscv/kernel/unaligned_access_speed.c         |  19 +-
 arch/s390/kernel/perf_cpum_cf.c                    | 221 +++++++++++-------
 arch/x86/coco/tdx/tdx.c                            |  10 +-
 arch/x86/events/intel/uncore.c                     |   1 +
 arch/x86/events/intel/uncore_snbep.c               |  13 +-
 arch/x86/include/asm/barrier.h                     |   2 +-
 arch/x86/include/asm/insn-eval.h                   |  36 +++
 arch/x86/kvm/emulate.c                             |  26 +--
 arch/x86/net/bpf_jit_comp.c                        |   2 +-
 block/genhd.c                                      |   1 +
 drivers/accel/rocket/rocket_job.c                  |  32 ++-
 drivers/acpi/apei/erst.c                           |   2 +-
 drivers/acpi/apei/ghes.c                           |  52 +++--
 drivers/acpi/pfr_update.c                          |  45 ++--
 drivers/ata/libata-scsi.c                          |  28 +--
 drivers/auxdisplay/charlcd.c                       |  21 +-
 drivers/base/arch_numa.c                           |  12 +
 drivers/base/power/main.c                          |   1 +
 drivers/base/property.c                            |  19 +-
 drivers/block/zloop.c                              |   3 +-
 drivers/block/zram/backend_deflate.c               |  10 +-
 drivers/bluetooth/btrtl.c                          |  13 --
 drivers/bluetooth/btusb.c                          |  14 ++
 drivers/bluetooth/hci_bcm.c                        |   1 +
 drivers/bluetooth/hci_bcm4377.c                    |   1 +
 drivers/bluetooth/hci_h5.c                         |   4 +-
 drivers/bluetooth/hci_intel.c                      |   1 +
 drivers/bluetooth/hci_ldisc.c                      |   2 +-
 drivers/bluetooth/hci_serdev.c                     |   2 +-
 drivers/cdx/cdx.c                                  |   7 +-
 drivers/char/hw_random/stm32-rng.c                 |  10 +-
 drivers/char/ipmi/ipmb_dev_int.c                   |   5 +-
 drivers/char/ipmi/ipmi_msghandler.c                |   4 +
 drivers/char/tpm/tpm_i2c_nuvoton.c                 |   6 +-
 drivers/clocksource/timer-nxp-pit.c                |   4 +-
 drivers/clocksource/timer-sun4i.c                  |   2 +-
 drivers/crypto/allwinner/Kconfig                   |  16 --
 drivers/crypto/allwinner/sun8i-ce/Makefile         |   1 -
 drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c  |  57 -----
 drivers/crypto/allwinner/sun8i-ce/sun8i-ce-prng.c  | 159 -------------
 drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h       |  29 ---
 drivers/crypto/allwinner/sun8i-ss/Makefile         |   1 -
 drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c  |  39 ----
 drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c  | 177 --------------
 drivers/crypto/allwinner/sun8i-ss/sun8i-ss.h       |  23 --
 drivers/cxl/core/features.c                        |   8 +-
 drivers/cxl/core/pmem.c                            |  10 +-
 drivers/cxl/core/ras.c                             |   1 -
 drivers/cxl/cxl.h                                  |   3 +-
 drivers/cxl/pci.c                                  |   1 -
 drivers/cxl/pmem.c                                 |   2 +-
 drivers/fpga/altera-cvp.c                          |  10 +-
 drivers/fpga/stratix10-soc.c                       |  21 +-
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c  | 114 ++++++++--
 .../drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c  |  24 +-
 drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c       |  10 +-
 drivers/gpu/drm/amd/display/dc/dc_types.h          |   1 +
 drivers/gpu/drm/nouveau/nouveau_gem.c              |  11 +-
 drivers/hid/hid-apple.c                            |  18 +-
 drivers/hid/hid-corsair-void.c                     |  17 ++
 drivers/hid/hid-mcp2221.c                          |   9 +
 drivers/hid/hid-picolcd_debugfs.c                  |   9 +
 drivers/hid/hid-roccat.c                           |  13 +-
 drivers/hid/hid-sensor-custom.c                    |   9 +-
 drivers/hid/hid-sensor-hub.c                       |  46 ++--
 drivers/hid/hid-sony.c                             |   4 +-
 drivers/hid/hid-universal-pidff.c                  |   4 +-
 .../intel-thc-hid/intel-quicki2c/pci-quicki2c.c    |   1 +
 .../intel-thc-hid/intel-quickspi/pci-quickspi.c    |  10 +-
 .../intel-thc-hid/intel-quickspi/quickspi-dev.h    |   1 +
 .../intel-thc-hid/intel-quickspi/quickspi-hid.c    |   2 +-
 .../intel-quickspi/quickspi-protocol.c             |  19 +-
 .../intel-quickspi/quickspi-protocol.h             |   2 +-
 drivers/hsi/controllers/omap_ssi_core.c            |   6 +
 drivers/hwmon/max6621.c                            |   8 +-
 .../hwtracing/coresight/coresight-etm3x-sysfs.c    |  15 +-
 drivers/hwtracing/ptt/hisi_ptt.c                   |  20 +-
 drivers/i2c/busses/i2c-mxs.c                       |   5 +-
 drivers/i3c/master.c                               |  12 +-
 drivers/i3c/master/adi-i3c-master.c                |  15 +-
 drivers/i3c/master/renesas-i3c.c                   |  70 +++++-
 drivers/i3c/master/svc-i3c-master.c                |  10 +-
 drivers/infiniband/core/ucma.c                     |  14 +-
 drivers/infiniband/core/uverbs_std_types_mr.c      |   6 +-
 drivers/infiniband/hw/cxgb4/device.c               |   6 +
 drivers/infiniband/hw/ionic/ionic_lif_cfg.c        |   2 +-
 drivers/interconnect/core.c                        |   7 +-
 drivers/iommu/amd/ppr.c                            |   3 +-
 drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c        |  56 +++--
 drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c     |   8 +-
 drivers/iommu/intel/dmar.c                         |  15 +-
 drivers/iommu/intel/iommu.c                        |   8 +-
 drivers/iommu/intel/iommu.h                        |   2 +
 drivers/iommu/iommu-sva.c                          |   2 +-
 drivers/iommu/iommu.c                              |   2 +-
 drivers/iommu/iommufd/device.c                     |   4 +-
 drivers/iommu/iommufd/ioas.c                       |   2 +
 drivers/iommu/iommufd/selftest.c                   |  31 ++-
 drivers/iommu/msm_iommu.c                          |  10 +-
 drivers/mailbox/qcom-ipcc.c                        |  17 +-
 drivers/md/dm-bufio.c                              |  10 +-
 drivers/md/dm-era-target.c                         |   5 +
 drivers/md/dm-integrity.c                          |  32 +--
 drivers/md/dm-io.c                                 |  96 ++++----
 drivers/md/dm-kcopyd.c                             |  10 +-
 drivers/md/dm-log-userspace-base.c                 |   1 +
 drivers/md/dm-log.c                                |   4 +-
 drivers/md/dm-pcache/cache.c                       |  18 ++
 drivers/md/dm-pcache/cache.h                       |  21 ++
 drivers/md/dm-pcache/cache_dev.c                   |  22 +-
 drivers/md/dm-pcache/cache_gc.c                    |  10 +-
 drivers/md/dm-pcache/cache_key.c                   |  32 ++-
 drivers/md/dm-pcache/cache_segment.c               |  12 +-
 drivers/md/dm-pcache/cache_writeback.c             |  10 +-
 drivers/md/dm-pcache/dm_pcache.c                   |   4 +-
 drivers/md/dm-raid1.c                              |  26 ++-
 drivers/md/dm-snap-persistent.c                    |   4 +-
 drivers/md/dm-stats.c                              |   6 +-
 drivers/md/dm-switch.c                             |   2 +-
 drivers/md/dm-verity-target.c                      |   2 +-
 drivers/md/dm-writecache.c                         |  14 +-
 drivers/md/md.c                                    |   7 +
 drivers/md/persistent-data/dm-array.c              |  53 ++++-
 drivers/md/raid10.c                                |   2 +-
 drivers/media/cec/platform/stm32/stm32-cec.c       |   3 +-
 drivers/media/test-drivers/vicodec/vicodec-core.c  |   4 +-
 drivers/media/v4l2-core/v4l2-dev.c                 |  14 +-
 drivers/mfd/cgbc-core.c                            |   4 +-
 drivers/mfd/sm501.c                                |   2 +
 drivers/misc/nsm.c                                 |   2 +-
 drivers/mmc/host/via-sdmmc.c                       |  12 +-
 drivers/net/dsa/realtek/rtl83xx.c                  |   4 +-
 drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c   |   3 +
 drivers/net/ethernet/broadcom/bnxt/bnxt.c          |   7 +-
 drivers/net/ethernet/ibm/emac/mal.c                |  13 +-
 drivers/net/ethernet/nvidia/forcedeth.c            |   4 +-
 drivers/net/ethernet/qlogic/qede/qede.h            |   8 +-
 drivers/net/ethernet/qlogic/qede/qede_fp.c         |   1 +
 drivers/net/ethernet/renesas/ravb.h                |   3 +
 drivers/net/ethernet/renesas/ravb_main.c           |   9 +-
 drivers/net/ethernet/renesas/ravb_ptp.c            |  44 +++-
 drivers/net/ipa/ipa_modem.c                        |  18 +-
 drivers/net/ntb_netdev.c                           |  38 ++--
 drivers/net/ovpn/main.c                            |  19 +-
 drivers/net/ovpn/ovpnpriv.h                        |   4 +
 drivers/net/ovpn/peer.c                            |   8 +-
 drivers/net/ovpn/tcp.c                             |   9 +-
 drivers/net/phy/phylink.c                          |   2 +-
 drivers/net/slip/slip.c                            |  11 +-
 drivers/net/thunderbolt/main.c                     |  12 +
 drivers/net/tun.c                                  |  21 +-
 drivers/net/usb/qmi_wwan.c                         |   1 +
 drivers/net/wireless/ath/ath11k/mac.c              |  28 ++-
 drivers/net/wireless/ath/ath6kl/cfg80211.c         |   5 +
 .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    |   3 +-
 drivers/net/wireless/intel/iwlwifi/dvm/main.c      |   4 +-
 drivers/net/wireless/marvell/mwifiex/sta_ioctl.c   |  12 +
 drivers/net/wireless/mediatek/mt76/mt7615/main.c   |   5 +-
 .../net/wireless/mediatek/mt76/mt76_connac_mcu.c   |  16 +-
 drivers/net/wireless/mediatek/mt76/mt7915/mcu.c    |  15 +-
 drivers/net/wireless/mediatek/mt76/mt7925/mac.c    |   1 +
 drivers/net/wireless/mediatek/mt76/mt7925/main.c   |  12 +-
 drivers/net/wireless/mediatek/mt76/mt7925/mcu.c    |   4 +-
 drivers/net/wireless/mediatek/mt76/mt7925/pci.c    |   2 +
 drivers/net/wireless/mediatek/mt76/mt7925/usb.c    |   1 +
 drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c |   6 +
 drivers/net/wireless/mediatek/mt76/mt7996/mac.c    |  26 ++-
 drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c |   2 +-
 drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c |   2 +-
 drivers/net/wireless/realtek/rtl8xxxu/core.c       |  19 +-
 .../net/wireless/realtek/rtlwifi/rtl8192du/sw.c    |  12 +-
 .../net/wireless/realtek/rtlwifi/rtl8192du/trx.c   |   3 +-
 drivers/net/wireless/realtek/rtw88/pci.c           |   4 +-
 drivers/net/wireless/realtek/rtw88/tx.c            |   1 +
 drivers/ntb/ntb_transport.c                        |  38 ++--
 drivers/nvdimm/label.c                             |   2 +-
 drivers/nvme/host/core.c                           |   2 +-
 drivers/nvme/host/fc.c                             |   2 +-
 drivers/nvme/host/pci.c                            |   1 +
 drivers/nvme/host/tcp.c                            |  45 +++-
 drivers/of/base.c                                  |   2 +-
 drivers/pci/controller/dwc/pci-meson.c             |   2 +-
 drivers/pci/controller/pci-hyperv.c                |   1 +
 drivers/pci/controller/plda/pcie-plda-host.c       |  52 ++++-
 drivers/pci/msi/msi.c                              |  10 +
 drivers/pci/pci-sysfs.c                            |  42 +++-
 drivers/pci/pcie/aer.c                             |  29 ++-
 drivers/pci/pcie/portdrv.c                         |   2 +-
 drivers/pci/proc.c                                 |  16 +-
 drivers/pci/quirks.c                               |   9 +-
 drivers/phy/freescale/phy-fsl-imx8mq-usb.c         |  21 +-
 drivers/phy/rockchip/phy-rockchip-samsung-dcphy.c  |   2 +-
 drivers/platform/chrome/cros_ec_sensorhub_ring.c   |  19 +-
 drivers/platform/x86/amd/pmc/mp1_stb.c             |  43 ++--
 drivers/platform/x86/amd/pmc/pmc.c                 |   6 +-
 .../x86/dell/dell-wmi-sysman/biosattr-interface.c  |   1 -
 drivers/platform/x86/hp/hp-bioscfg/bioscfg.c       |  18 +-
 drivers/platform/x86/hp/hp-bioscfg/bioscfg.h       |   8 +
 .../platform/x86/hp/hp-bioscfg/enum-attributes.c   |  15 +-
 .../platform/x86/hp/hp-bioscfg/int-attributes.c    |   6 +-
 .../x86/hp/hp-bioscfg/order-list-attributes.c      |  14 +-
 .../x86/hp/hp-bioscfg/passwdobj-attributes.c       |  14 +-
 .../platform/x86/hp/hp-bioscfg/spmobj-attributes.c |   4 +-
 .../platform/x86/hp/hp-bioscfg/string-attributes.c |   6 +-
 drivers/platform/x86/intel/ishtp_eclite.c          |   5 +-
 .../x86/intel/speed_select_if/isst_tpmi_core.c     |  77 ++++++-
 drivers/platform/x86/lenovo/think-lmi.c            |  19 +-
 drivers/platform/x86/lenovo/wmi-helpers.c          |   4 +-
 drivers/platform/x86/lenovo/ymc.c                  |   8 +-
 drivers/power/supply/bq24257_charger.c             |  16 +-
 drivers/power/supply/bq256xx_charger.c             |  29 +--
 drivers/power/supply/bq25890_charger.c             |  12 +
 drivers/power/supply/charger-manager.c             |  54 +++--
 drivers/power/supply/cros_usbpd-charger.c          |  17 +-
 drivers/power/supply/lp8727_charger.c              |   4 +-
 drivers/power/supply/lp8788-charger.c              |   2 +-
 drivers/power/supply/max17040_battery.c            |  32 ++-
 drivers/power/supply/qcom_battmgr.c                |   9 +-
 drivers/power/supply/rt9455_charger.c              |  21 +-
 drivers/power/supply/twl4030_charger.c             |  12 +-
 drivers/power/supply/ucs1002_power.c               |   6 +-
 drivers/ptp/ptp_vmclock.c                          |   6 +
 drivers/rapidio/devices/rio_mport_cdev.c           |  10 +-
 drivers/regulator/as3722-regulator.c               |   1 -
 drivers/regulator/max8998.c                        |   1 -
 drivers/regulator/qcom-refgen-regulator.c          |   4 +-
 drivers/remoteproc/mtk_scp.c                       |   9 +-
 drivers/rpmsg/qcom_glink_smem.c                    |   7 +
 drivers/s390/block/dasd.c                          |   6 +-
 drivers/s390/block/dasd_eckd.c                     |  40 +++-
 drivers/s390/block/dasd_erp.c                      |   3 +
 drivers/scsi/scsi_lib.c                            |   2 +
 drivers/staging/greybus/hid.c                      |   2 +-
 drivers/staging/media/ipu7/ipu7-isys.c             |   1 +
 drivers/staging/media/tegra-video/vi.c             |   9 +-
 drivers/staging/media/tegra-video/vip.c            |  10 +-
 drivers/tty/serial/imx.c                           |  20 +-
 drivers/usb/dwc2/gadget.c                          |  11 +-
 drivers/usb/dwc3/gadget.c                          |   1 +
 drivers/usb/gadget/function/f_fs.c                 |  14 +-
 drivers/usb/gadget/function/f_midi2.c              |   2 +
 drivers/usb/gadget/function/f_tcm.c                |  23 +-
 drivers/usb/gadget/function/f_uvc.c                |   7 +-
 drivers/usb/gadget/function/u_audio.c              |  24 +-
 drivers/usb/gadget/function/uvc_video.c            |   2 +-
 drivers/usb/gadget/udc/at91_udc.c                  |  20 +-
 drivers/usb/gadget/udc/snps_udc_plat.c             |   5 +-
 drivers/usb/phy/phy-fsl-usb.c                      |  52 ++---
 drivers/usb/phy/phy-fsl-usb.h                      |   6 +-
 drivers/usb/typec/altmodes/thunderbolt.c           |   2 +
 drivers/usb/typec/tcpm/tcpci.c                     |  12 +-
 drivers/usb/typec/ucsi/ucsi.c                      |   3 +-
 .../fbdev/omap2/omapfb/displays/panel-dsi-cm.c     |   4 +-
 drivers/video/fbdev/pvr2fb.c                       |   4 +-
 drivers/video/fbdev/ssd1307fb.c                    |  72 +++++-
 drivers/video/fbdev/uvesafb.c                      |   2 +
 drivers/video/sticore.c                            |  22 +-
 drivers/w1/slaves/w1_ds28e17.c                     |   8 +
 fs/backing-file.c                                  |   2 +-
 fs/btrfs/direct-io.c                               |  19 +-
 fs/btrfs/ioctl.c                                   |  23 +-
 fs/btrfs/relocation.c                              |  31 ++-
 fs/buffer.c                                        |   3 +
 fs/ceph/addr.c                                     |  11 +
 fs/ceph/caps.c                                     |  11 +-
 fs/ceph/dir.c                                      |  10 +-
 fs/ceph/export.c                                   |  26 ++-
 fs/ceph/mds_client.c                               |   8 +-
 fs/ceph/mdsmap.c                                   |  11 +-
 fs/ceph/xattr.c                                    |   1 +
 fs/ecryptfs/crypto.c                               |   2 +-
 fs/ecryptfs/ecryptfs_kernel.h                      |   3 +-
 fs/ecryptfs/keystore.c                             |  45 +++-
 fs/ecryptfs/messaging.c                            |  11 +-
 fs/ecryptfs/miscdev.c                              |   5 +-
 fs/ecryptfs/super.c                                |   7 +
 fs/efivarfs/super.c                                |  30 ++-
 fs/fat/misc.c                                      |   4 +
 fs/fuse/dev.c                                      |   3 +-
 fs/jbd2/checkpoint.c                               |  28 +--
 fs/lockd/clntproc.c                                |   3 +
 fs/lockd/svcsubs.c                                 |  53 +++--
 fs/netfs/read_retry.c                              |   6 +-
 fs/netfs/write_retry.c                             |   6 +-
 fs/nfs/nfs4client.c                                |  17 +-
 fs/nfs/pnfs.c                                      |   3 +-
 fs/nfs_common/nfslocalio.c                         |  16 +-
 fs/nfsd/filecache.c                                |  22 +-
 fs/nfsd/flexfilelayoutxdr.c                        |  20 +-
 fs/nfsd/localio.c                                  |   8 +-
 fs/nfsd/nfs2acl.c                                  |  52 +++--
 fs/nfsd/nfs3acl.c                                  |  17 +-
 fs/nfsd/nfs3proc.c                                 |  40 ++++
 fs/nfsd/nfs4callback.c                             | 113 +++++++--
 fs/nfsd/nfs4layouts.c                              |  12 +-
 fs/nfsd/nfs4proc.c                                 |  62 +++--
 fs/nfsd/nfs4state.c                                | 253 ++++++++++++++++-----
 fs/nfsd/nfs4xdr.c                                  |  26 ++-
 fs/nfsd/nfscache.c                                 |   6 +-
 fs/nfsd/nfsctl.c                                   | 129 ++++++++---
 fs/nfsd/nfsfh.c                                    |  12 +-
 fs/nfsd/nfsproc.c                                  |   7 +
 fs/nfsd/nfssvc.c                                   |   4 +-
 fs/nfsd/nfsxdr.c                                   |  32 ++-
 fs/nfsd/state.h                                    |   3 +-
 fs/nfsd/trace.h                                    |  18 +-
 fs/nfsd/vfs.c                                      |  34 +--
 fs/nilfs2/bmap.c                                   |   2 +-
 fs/nilfs2/bmap.h                                   |   2 +-
 fs/nilfs2/btree.c                                  |  39 +++-
 fs/nilfs2/direct.c                                 |   4 +-
 fs/notify/fanotify/fanotify.c                      |   3 +-
 fs/notify/fanotify/fanotify.h                      |   6 +-
 fs/notify/fanotify/fanotify_user.c                 |   5 +-
 fs/nsfs.c                                          |   2 +-
 fs/ntfs3/frecord.c                                 |   9 +
 fs/ntfs3/fslog.c                                   |  34 +++
 fs/ocfs2/cluster/heartbeat.c                       | 150 +++++++++---
 fs/ocfs2/cluster/nodemanager.c                     |   6 +
 fs/ocfs2/cluster/nodemanager.h                     |   1 +
 fs/ocfs2/dir.c                                     |   2 +-
 fs/ocfs2/dlm/dlmmaster.c                           |   6 +
 fs/ocfs2/dlm/dlmrecovery.c                         |   9 +
 fs/ocfs2/refcounttree.c                            |  47 +++-
 fs/ocfs2/xattr.c                                   |   5 +-
 fs/orangefs/devorangefs-req.c                      |   1 +
 fs/orangefs/orangefs-debugfs.c                     |   1 +
 fs/smb/client/cifsfs.c                             |  15 +-
 fs/smb/client/dfs_cache.c                          |  33 ++-
 fs/smb/client/file.c                               |   1 +
 fs/smb/client/inode.c                              |   1 +
 fs/smb/client/smb1ops.c                            |   2 +-
 fs/smb/client/smb2file.c                           |   5 +-
 fs/tracefs/event_inode.c                           |   7 +-
 fs/ubifs/auth.c                                    |   2 +-
 fs/udf/inode.c                                     |   2 +-
 fs/udf/partition.c                                 |   2 +-
 include/linux/compaction.h                         |   3 +-
 include/linux/dm-io.h                              |   6 +-
 include/linux/list.h                               |  15 +-
 include/linux/netdevice.h                          |   3 +-
 include/linux/sunrpc/svc_rdma_pcl.h                |   2 +-
 include/linux/usb/tcpci.h                          |   1 +
 include/net/ip_tunnels.h                           |  39 +++-
 include/net/sctp/structs.h                         |   2 +-
 include/uapi/linux/landlock.h                      |   1 +
 io_uring/query.c                                   |   3 +
 kernel/auditfilter.c                               |   6 +-
 kernel/bpf/bloom_filter.c                          |  19 +-
 kernel/bpf/stackmap.c                              |   3 +
 kernel/bpf/verifier.c                              |  27 ++-
 kernel/module/kallsyms.c                           |  24 +-
 kernel/module/main.c                               |  14 +-
 kernel/params.c                                    |  14 +-
 kernel/pid.c                                       |  31 ---
 kernel/reboot.c                                    |  29 +++
 kernel/sched/cpufreq_schedutil.c                   |  15 +-
 kernel/signal.c                                    |   4 +
 kernel/taskstats.c                                 |   3 +-
 kernel/time/itimer.c                               |   2 +-
 kernel/time/timekeeping.c                          |   8 +-
 kernel/time/timer.c                                |   1 +
 kernel/trace/ring_buffer.c                         | 177 ++++++++------
 kernel/trace/trace.c                               |   6 +-
 kernel/trace/trace_events.c                        |   2 +
 kernel/trace/trace_events_hist.c                   |   4 +-
 kernel/trace/trace_events_user.c                   |   3 +
 lib/ucs2_string.c                                  |   2 +-
 lib/xarray.c                                       |   3 +
 mm/compaction.c                                    |  98 ++++----
 mm/gup.c                                           |  10 +-
 mm/hugetlb.c                                       |   8 +-
 mm/internal.h                                      |  10 +-
 mm/kasan/quarantine.c                              |   7 +-
 mm/kmemleak.c                                      |  51 +++--
 mm/memcontrol-v1.c                                 |   6 +-
 mm/memcontrol.c                                    |  13 ++
 mm/mempolicy.c                                     |  21 +-
 mm/migrate.c                                       |   8 +-
 mm/mm_init.c                                       |   9 +-
 mm/page_alloc.c                                    |  76 ++++++-
 mm/page_owner.c                                    |  10 +-
 mm/page_vma_mapped.c                               |   8 +-
 mm/pagewalk.c                                      |   6 +-
 mm/swapfile.c                                      |   6 +-
 mm/vmscan.c                                        |  21 +-
 mm/zsmalloc.c                                      |  11 +-
 mm/zswap.c                                         |  13 +-
 net/bluetooth/eir.c                                |   3 +-
 net/bluetooth/hci_conn.c                           |   3 +-
 net/bluetooth/hci_core.c                           |   2 +-
 net/bluetooth/hci_event.c                          |   7 +-
 net/bluetooth/hci_sync.c                           |   2 +
 net/bluetooth/iso.c                                |   8 +
 net/bluetooth/rfcomm/core.c                        |   8 +-
 net/ceph/osd_client.c                              |  30 +++
 net/ceph/osdmap.c                                  |   2 +
 net/core/skbuff.c                                  |   5 +-
 net/core/xdp.c                                     |   4 +-
 net/ipv4/ip_tunnel.c                               |   2 +-
 net/ipv4/ipip.c                                    |   2 +-
 net/ipv4/ipmr.c                                    |   3 +
 net/ipv6/exthdrs.c                                 |  26 +--
 net/ipv6/ip6_gre.c                                 |  14 +-
 net/ipv6/ip6_input.c                               |   1 +
 net/ipv6/ip6_tunnel.c                              |  22 +-
 net/ipv6/route.c                                   |   2 +-
 net/ipv6/seg6_local.c                              |   9 +
 net/ipv6/sit.c                                     |   2 +-
 net/iucv/af_iucv.c                                 |   2 +
 net/l2tp/l2tp_netlink.c                            |  16 +-
 net/mpls/af_mpls.c                                 |   2 +
 net/mptcp/syncookies.c                             |   1 +
 net/openvswitch/conntrack.c                        |   8 +-
 net/openvswitch/datapath.c                         |  50 ++--
 net/sched/sch_generic.c                            |   2 +-
 net/sctp/inqueue.c                                 |   7 +-
 net/sctp/sm_sideeffect.c                           |   4 +
 net/sctp/stream.c                                  |  48 ++--
 net/smc/af_smc.c                                   |   3 +-
 net/smc/smc.h                                      |   6 +-
 net/smc/smc_core.c                                 |  27 +--
 net/smc/smc_llc.c                                  | 122 +++++++---
 net/smc/smc_rx.c                                   |  11 +-
 net/smc/smc_tx.h                                   |   6 +-
 net/smc/smc_wr.c                                   |   6 +-
 net/sunrpc/auth_gss/auth_gss.c                     |   6 +-
 net/sunrpc/auth_gss/gss_krb5_wrap.c                |  13 +-
 net/sunrpc/auth_gss/gss_rpc_upcall.c               |   6 -
 net/sunrpc/auth_gss/gss_rpc_upcall.h               |   1 -
 net/sunrpc/auth_gss/gss_rpc_xdr.c                  |   6 +
 net/sunrpc/auth_gss/svcauth_gss.c                  |   8 +-
 net/sunrpc/cache.c                                 |   7 +-
 net/sunrpc/clnt.c                                  |  22 +-
 net/sunrpc/sunrpc_syms.c                           |   1 +
 net/sunrpc/svc.c                                   |  93 +++++++-
 net/sunrpc/xdr.c                                   |   2 +-
 net/sunrpc/xprtrdma/ib_client.c                    |  24 +-
 net/sunrpc/xprtrdma/svc_rdma_pcl.c                 |   2 +-
 net/sunrpc/xprtrdma/svc_rdma_recvfrom.c            |   9 +-
 net/sunrpc/xprtrdma/svc_rdma_rw.c                  |  47 +++-
 net/sunrpc/xprtrdma/svc_rdma_sendto.c              |  47 ++--
 net/sunrpc/xprtrdma/svc_rdma_transport.c           |  52 +++--
 net/sunrpc/xprtsock.c                              |  12 +-
 net/vmw_vsock/virtio_transport.c                   |   2 +-
 rust/kernel/bug.rs                                 |   8 +-
 rust/kernel/list.rs                                |   2 +-
 rust/kernel/time.rs                                |  17 +-
 scripts/rust_is_available.sh                       |  14 ++
 scripts/rust_is_available_bindgen_libclang_22.h    |   5 +
 scripts/rust_is_available_test.py                  |  30 ++-
 security/apparmor/include/cred.h                   |   6 +-
 security/apparmor/include/label.h                  |   6 +-
 security/apparmor/include/task.h                   |  15 +-
 security/apparmor/task.c                           |  27 +++
 security/keys/trusted-keys/trusted_tpm1.c          |   2 +-
 security/landlock/errata/abi-1.h                   |  23 ++
 security/landlock/fs.c                             |  41 +++-
 security/smack/smack_lsm.c                         |   2 +-
 sound/core/ump_convert.c                           |   1 +
 sound/drivers/aloop.c                              |   6 +
 sound/drivers/mpu401/mpu401.c                      |   6 +
 sound/drivers/mts64.c                              |   6 +
 sound/drivers/portman2x4.c                         |   6 +
 sound/drivers/serial-u16550.c                      |   6 +
 sound/drivers/virmidi.c                            |   6 +
 sound/hda/codecs/realtek/alc269.c                  |   7 +-
 sound/hda/core/ext/stream.c                        |   4 +-
 sound/pci/pcxhr/pcxhr.c                            |  14 +-
 sound/soc/amd/yc/acp6x-mach.c                      |   7 +
 sound/usb/6fire/comm.c                             |   9 +-
 sound/usb/bcd2000/bcd2000.c                        |  11 +-
 tools/include/linux/compiler.h                     |   2 +-
 tools/testing/selftests/mm/run_vmtests.sh          |   2 +-
 498 files changed, 5399 insertions(+), 2514 deletions(-)

Read the cover letter in its thread