Changelog in Linux kernel 6.1.191

 
9p/xen: protect xen_9pfs_front_free against concurrent calls
 
accel/habanalabs: support mapping cb with vmalloc-backed coherent memory
 
ACPI: battery: Pass battery hook pointer to hook callbacks
ACPI: bus: Introduce acpi_bus_get_primary_device()
ACPI: processor_idle: Mark LPI enter functions as __cpuidle
ACPI: TAD: Add locking around AML evaluations
ACPI: TAD: Rearrange RT data validation checking
ACPI: TAD: Split three functions to untangle runtime PM handling
 
afs: Fix lock recursion
afs: Fix reinitialisation of the inode, in particular ->lock_work
 
alpha: do not clear remote MMU contexts in migrate_flush_tlb_page()
alpha: fix user-space corruption during memory compaction
 
ALSA: caiaq: unregister the input device when probe fails
ALSA: hda/cs35l41: Fix firmware load work teardown
ALSA: line6: reject oversized playback packets
ALSA: mixer: oss: Add card disconnect checkpoints
ALSA: mtpav: shut down output timer before card teardown
ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger
ALSA: seq: avoid stale FIFO cells during resize
ALSA: seq: Clean up fifo locking with guard
ALSA: seq: Don't leak the extension cell pointer in the bounce payload
ALSA: seq: Drop superfluous filter argument of get_event_dest_client()
ALSA: seq: fifo: Use guard() for locking
ALSA: seq: Fix kernel heap address leak in bounce_error_event()
ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data
ALSA: seq: oss: Serialize readq reset state with q->lock
ALSA: seq: Serialize compat port-info ioctls
ALSA: ua101: reject mismatched capture/playback packet sizes
ALSA: usb-audio: Apply IGNORE_CTL_ERROR quirk to all Audient devices
ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity
ALSA: usb-audio: Optimize the copy of packet sizes for implicit fb handling
ALSA: usb-audio: Prevent excessive number of frames
 
amt: Don't support cross-netns setup.
amt: send the relay's General Query directly from the receive path
 
AppArmor: Allow apparmor to handle unaligned dfa tables
 
apparmor: Fix & Optimize table creation from possibly unaligned memory
apparmor: fix cred UAF caused by begin_current_label_crit_section()
apparmor: fix deadlock in complain-mode change_hat
apparmor: fix out-of-bounds write when null terminating a label vec
apparmor: make aa_set_current_onexec return void
 
arch: turn off -Werror for architectures with known warnings
 
arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems
 
arm64: allow pte_offset_map() to fail
arm64: entry: fix ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD
arm64: errata: Add Cortex-A725 erratum 3821522 workaround
arm64: errata: Factor out broken AMU const counter cap
arm64: irq: exclude the softirq stack switch from KCOV
arm64: mm: Fix the lockless page-table walk in show_pte()
arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry
 
ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses
 
ASoC: adau1372: allow sleepy powerdown GPIOs
ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes
ASoC: amd: acp-mach-common: Add missing error check for clock acquisition
ASoC: amd: acp: Add setbias level for rt5682s codec in machine driver
ASoC: amd: acp: Refactor dai format implementation
ASoC: amd: acp: Refactor i2s clocks programming sequence
ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P)
ASoC: codecs: rt274: Fix format setting for 44100 rate
ASoC: codecs: rt286: Revert delay value for jack setup
ASoC: cs42l52: Fix the NG Type Switch bit
ASoC: cs42l56: Put the Limiter Cushion control on the limiter register
ASoC: hdac_hda: Fix hlink refcount leak on component registration failure
ASoC: Intel: avs: Do not share the name pointer between components
ASoC: Intel: avs: Reset the stream unless it is already prepared
ASoC: max98371: Fix the Speaker DHT Min Volume bits
ASoC: nau8822: Fix the 128x oversampling switch bits
ASoC: pcm3168a: Fix the DAC zero flag polarity bit
ASoC: qcom: Fix uninitialized pointer dmactl
ASoC: qcom: lpass-cpu: use DAI table index for playback constraints
ASoC: qcom: q6asm: drop DSP responses for closed data streams
ASoC: qcom: q6asm: handle the responses after closing
ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM
ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params
ASoC: SOF: ipc4-pcm: Workaround for crashed firmware on system suspend
ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers
ASoC: stm32: spdifrx: fix synchronization state check
ASoC: tas2562: Validate values for volume writes
ASoC: tegra: Fix ASRC Stream6 input threshold control
ASoC: topology: Check PCM and DAI name strings before use
ASoC: wm8903: Move the DRC QR threshold to the register that holds it
ASoC: wm8978: Fix the 128x oversampling switch bits
 
asymmetric_keys: reject trust keys without IDs
 
ata: libata-core: fix cancellation of a port deferred qc work
ata: libata-scsi: avoid Non-NCQ command starvation
ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning
 
audit: fix exe mark UAF in kill_rules()
 
autofs: ignore notification errors from a replaced pipe
 
ax25: Remove broken autobind
 
binder: fix is_failure flag for superseded transaction cleanup
binder: fix leaked fd fixups on TF_UPDATE_TXN supersede
 
blk-cgroup: delay freeing policy data after rcu grace period
blk-cgroup: dropping parent refcount after pd_free_fn() is done
 
blk-iocost: clear delay state when freeing policy data
 
blk-iolatency: clear delay state when freeing policy data
 
blk-mq: pop cached request if it is usable
 
blktrace: fix __this_cpu_read/write in preemptible context
 
block/rq_qos: protect rq_qos apis with a new lock
 
Bluetooth: 6lowpan: avoid untracked enable work
Bluetooth: 6lowpan: hold L2CAP conn across debugfs control
Bluetooth: af_bluetooth: Fix deadlock
Bluetooth: btintel: fix buffer over-read in btintel_hw_error()
Bluetooth: btintel: validate DDC record lengths
Bluetooth: btmtk: fix urb->setup_packet leak in error paths
Bluetooth: btqcomsmd: Convert to platform remove callback returning void
Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev
Bluetooth: btusb: Add IMC Networks QCA9377 to quirks table
Bluetooth: do not leak an hci_conn when a second LE connect is rejected
Bluetooth: hci_conn: Lock parent access during enhanced SCO setup
Bluetooth: hci_core: Fix inquiry cache timestamps on 64-bit systems
Bluetooth: hci_core: Fix possible buffer overflow
Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained
Bluetooth: hci_core: Fix UAF in hci_unregister_dev()
Bluetooth: hci_core: free the HCI ID if naming fails
Bluetooth: hci_core: Print number of packets in conn->data_q
Bluetooth: hci_core: Serialize ACL scheduling with channel deletion
Bluetooth: hci_core: Serialize fragmented ISO packet queueing
Bluetooth: hci_event: fix simultaneous discovery stuck in FINDING
Bluetooth: hci_event: move wake reason storage into validated event handlers
Bluetooth: hci_sock: Serialize dead-device detachment
Bluetooth: hci_sync: annotate data-races around hdev->req_status
Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister
Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists
Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close
Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls
Bluetooth: ISO: hold sk properly in iso_conn_ready
Bluetooth: ISO: Serialize concurrent connect calls
Bluetooth: ISO: zero the sockaddr before returning it in getname
Bluetooth: L2CAP: access chan->conn safely in get/setsockopt
Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd
Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn
Bluetooth: mgmt: fix race in read_unconf_index_list()
Bluetooth: MGMT: Fix status of pending commands flushed on power off
Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex
Bluetooth: RFCOMM: Fix initial port reference race
Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown
Bluetooth: RFCOMM: free the skb when the DLC has no owner
 
bna: prevent IOC timer rearm during teardown
 
bnxt: fix head underflow on XDP head-grow
bnxt: properly flush XDP redirect lists
 
bnxt_en: fix DMA mapping length for padded small packets
bnxt_en: Fix memory corruption when FW resources change during ifdown
 
bonding: do not set usable_slaves for broadcast mode
bonding: fix type confusion in bond_setup_by_slave()
bonding: fix use-after-free due to enslave fail after slave array update
 
bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing
 
bpf, cgroup: Fix invalid storage access after __cgroup_bpf_attach failed
bpf, cgroup: Fix storage null-ptr-deref after replacing prog
 
bpf, skmsg: fix verdict sk_data_ready racing with ktls rx
 
bpf, x86: Fix trampoline stack size for 128-bit arguments
 
bpf, xdp: move offload check into dev_xdp_install()
 
bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE
bpf: Add sk_is_inet and IS_ICSK check in tls_sw_has_ctx_tx/rx
bpf: Call free_htab_elem() after htab_unlock_bucket()
bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie
bpf: Clear buf on error in __bpf_get_task_stack
bpf: Copy per-CPU map value padding in copy_map_value_long()
bpf: Defer work in bpf_timer_cancel_and_free
bpf: Disable preemption in __bpf_get_stack
bpf: Disable preemption in bpf_get_stackid
bpf: Fail bpf_timer_cancel when callback is being cancelled
bpf: Fix a potential use-after-free in bpf_link_free()
bpf: Fix accesses to uninit stack slots
bpf: Fix incorrect pruning due to atomic fetch precision tracking
bpf: Fix kmemleak warning for percpu hashmap
bpf: Fix mmap_lock leak in irq_work path
bpf: Fix netns reference imbalance in conntrack kfuncs
bpf: Fix OOB in pcpu_init_value
bpf: Fix potential UAF when reading bpf link info
bpf: Fix RCU stall in bpf_fd_array_map_clear()
bpf: Fix stackmap overflow check in __bpf_get_stackid()
bpf: Fix UAF in sock clone early bailouts
bpf: Fix WARNING in bpf_tracing_link_release
bpf: Guard conntrack opts error writes
bpf: Prevent tailcall infinite loop caused by freplace
bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max
bpf: Reject sleepable BPF_LSM_CGROUP programs at load time
bpf: Reject sleepable kprobe_multi programs at attach time
bpf: Retire the struct_ops map kvalue->refcnt.
bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready().
bpf: support deferring bpf_link dealloc to after RCU grace period
bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init()
bpf: Zero queue and stack outputs on lock failure
 
bridge: mcast: Fix use-after-free during router port configuration
 
btrfs: always wait for ordered extents to avoid OE races
btrfs: avoid NULL pointer dereference if no valid csum tree
btrfs: avoid NULL pointer dereference if no valid extent tree
btrfs: check if root is readonly when setting posix acl
btrfs: defrag: fix deadlock between defrag and delalloc space reservation
btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure()
btrfs: do not BUG_ON() when freeing tree block after error
btrfs: do proper folio cleanup when cow_file_range() failed
btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref()
btrfs: drop recovered reloc root refs on recovery failure
btrfs: fix block group refcount race in btrfs_create_pending_block_groups()
btrfs: fix deadlock between reflink and transaction commit when using flushoncommit
btrfs: fix deadlock cloning inline extent when using flushoncommit
btrfs: fix deadlock with fiemap and extent locking
btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation
btrfs: fix extent map leak in NOCOW direct I/O write
btrfs: fix NULL dereference on root when tracing inode eviction
btrfs: fix race between ordered extent completion and fiemap
btrfs: fix zero size inode with non-zero size after log replay
btrfs: harden block_group::bg_list against list_del() races
btrfs: log new dentries when logging parent dir of a conflicting inode
btrfs: lzo: reject compressed segment that overflows the compressed input
btrfs: lzo: reject inline extents without valid headers
btrfs: only release the dirty pages io tree after successful writes
btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data()
btrfs: reject new transactions if the fs is fully read-only
btrfs: rename err to ret in btrfs_recover_relocation()
btrfs: rename ret to err in btrfs_recover_relocation()
btrfs: rename ret to ret2 in btrfs_recover_relocation()
btrfs: reserve enough transaction items for qgroup ioctls
btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()
btrfs: skip global block reserve accounting for rescue mounts
btrfs: take commit root semaphore when iterating in mark_block_group_to_copy()
 
bus: mhi: ep: Update read pointer only after buffer is written
 
can: fix unique skb identifier regression under RPS
can: gs_usb: fix time stamp counter initialization
can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data
 
ceph: bound copied dentry name length in NFS export get_name
ceph: cap delegated inode count in ceph_parse_deleg_inos()
ceph: do not repeat ceph_trim_dentries() if no progress possible
ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size
ceph: fix memory leaks in ceph_mdsc_build_path()
ceph: fix UAF in check_new_map() on session freed during unlock
 
cgroup/cpuset: introduce cpuset-v1.c
cgroup/cpuset: Make nr_deadline_tasks an atomic_t
cgroup/cpuset: move common code to cpuset-internal.h
 
cgroup/rstat: validate cpu before css_rstat_cpu() access
 
cgroup: fix spurious SIGKILL of CLONE_INTO_CGROUP children
 
cifs: add revalidation on FSCTL failure in smb2_duplicate_extents()
cifs: call pagecache_isize_extended() in cifs_setsize() when extending
cifs: client: fix memory leak in smb3_fs_context_parse_param
cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths
cifs: Fix locking usage for tcon fields
cifs: fix memory leak in smb3_fs_context_parse_param error path
cifs: get rid of dns resolve worker
cifs: prevent readdir from changing file size due to stale directory metadata
 
clk: sunxi-ng: h616: Reparent CPU clock during frequency changes
clk: sunxi-ng: h616: Reparent GPU clock during frequency changes
 
clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type
 
Compiler Attributes: Add __counted_by macro
Compiler Attributes: counted_by: Adjust name and identifier expansion
 
coredump: hold RCU while releasing parked threads
 
coresight: ete: Always save state on power down
coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior
coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable
coresight: Fix memory leak in acpi_buffer->pointer
coresight: holding cscfg_csdev_lock while removing cscfg from csdev
 
cpufreq: amd-pstate: add check for cpufreq_cpu_get's return value
 
crypto: af_alg - limit RX SG extraction by receive buffer budget
crypto: drbg - Fix ineffective sanity check
crypto: hisilicon/qm - request reserved interrupt for virtual function
crypto: jitter - replace LFSR with SHA3-256
crypto: jitterentropy - replace long-held spinlock with mutex
crypto: keembay - Fix AEAD unregister count in error path
crypto: qat - protect service table iterations with service_lock
crypto: stm32/cryp - call finalize with bh disabled
crypto: virtio - bound the akcipher result length
crypto: virtio - Drop sign/verify operations
crypto: virtio - Drop superfluous [as]kcipher_ctx pointer
crypto: virtio - Drop superfluous [as]kcipher_req pointer
crypto: virtio - Less function calls in __virtio_crypto_akcipher_do_req() after error detection
 
cxgb4/ch_ktls: disable softirqs around tid_list erases
 
cxl/mbox: Clamp mailbox output allocation to the payload size
cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()
 
cxl/port: Fix delete_endpoint() vs parent unregistration race
cxl/port: Fix use-after-free, permit out-of-order decoder shutdown
 
dcache: don't put a mountpoint on a dentry that's being removed
 
dlm: fix add msg handle in send_queue ordered
dlm: validate length in dlm_search_rsb_tree
 
dm array: validate array block headers on read
 
dm cache: fix demotion stats in passthrough mode
dm cache: fix issue with background work locking
 
dm ioctl: a small code cleanup in list_version_get_info
dm ioctl: don't let data_start run past the buffer
 
dm-crypt: fix a tiny race condition in crypt_dec_pending
dm-crypt: reject the lmk IV mode with AEAD ciphers
 
dm-ebs: fix incorrect device offset check in ebs_ctr()
 
dm-integrity: fix infinite loop on discard with large tag size
dm-integrity: require stable writes for internal hash modes
 
dm-ioctl: fix a possible overflow in list_version_get_info
 
dm-snap: reject the transient exception store for snapshot-merge
 
dm-verity: fix buffer overflow in FEC calculation
 
dm: avoid spaces before function arguments or in favour of tabs
dm: correct block comments format.
dm: fix reading free memory in do_resume
 
dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds
 
dma-direct: cleanup parameters to dma_direct_optimal_gfp_mask
dma-direct: return struct page from dma_direct_alloc_from_pool()
dma-direct: simplify the use atomic pool logic in dma_direct_alloc
 
dmaengine: Add devm_dma_request_chan()
dmaengine: dw-edma-pcie: Reject devices without driver data
dmaengine: dw-edma: eDMA: Add sync read before starting the DMA transfer in remote setup
dmaengine: dw-edma: Terminate all descriptors without callbacks
dmaengine: idxd: fix double free of wq, engine, and group structs
dmaengine: ti: k3-udma-glue: Drop skip_fdq argument from k3_udma_glue_reset_rx_chn
dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout
 
Documentation: networking: Add a caveat to nexthop_compat_mode sysctl
 
driver core: Avoid warning when removing a device while its supplier is unbinding
 
Drivers: hv: Avoid infinite retry loop in init_vp_index()
Drivers: hv: Don't reset VMBus connection state on error/exit paths
Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition
 
drm/amd/amdgpu: Fix errors & warnings in amdgpu _bios, _cs, _dma_buf, _fence.c
drm/amd/amdgpu: Fix errors & warnings in amdgpu _uvd, _vce.c
 
drm/amd/display: Add a dc_state NULL check in dc_state_release
drm/amd/display: Add interface to enable DPIA trace
drm/amd/display: Add missing NULL pointer check within dpcd_extend_address_range
drm/amd/display: Add null check for head_pipe in dcn201_acquire_free_pipe_for_layer
drm/amd/display: Add null check for head_pipe in dcn32_acquire_idle_pipe_for_head_pipe_in_layer
drm/amd/display: Add null check for pipe_ctx->plane_state in dcn20_program_pipe
drm/amd/display: Add NULL test for 'timing generator' in 'dcn21_set_pipe()'
drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths
drm/amd/display: Avoid overflow from uint32_t to uint8_t
drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend
drm/amd/display: Check index for aux_rd_interval before using
drm/amd/display: Check link_index before accessing dc->links[]
drm/amd/display: Check null pointer before try to access it
drm/amd/display: Check null pointers before multiple uses
drm/amd/display: Check null pointers before used
drm/amd/display: Check null pointers before using them
drm/amd/display: Don't replace a sink mode that shares the native totals
drm/amd/display: drop unused function set_abm_event()
drm/amd/display: Ensure array index tg_inst won't be -1
drm/amd/display: Fix 'panel_cntl' could be null in 'dcn21_set_backlight_level()'
drm/amd/display: fix a Null pointer dereference vulnerability
drm/amd/display: Fix dangling pointer in CRTC reset function
drm/amd/display: Fix dangling pointer in plane reset function
drm/amd/display: Fix hang/underflow when transitioning to ODM4:1
drm/amd/display: Fix index may exceed array range within fpu_update_bw_bounding_box
drm/amd/display: Fix null check for pipe_ctx->plane_state in dcn20_program_pipe
drm/amd/display: fix NULL checks for adev->dm.dc in amdgpu_dm_fini()
drm/amd/display: Fix null pointer deref in dcn20_resource.c
drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()
drm/amd/display: Implement bounds check for stream encoder creation in DCN401
drm/amd/display: Mark DCE 6.4 as not APU
drm/amd/display: Pass non-null to dcn20_validate_apply_pipe_split_flags
drm/amd/display: Prevent crash when disable stream
drm/amd/display: Refactor ABM feature
drm/amd/display: Remove unused-but-set variable hubp from
drm/amd/display: Resize MST HDCP per-connector arrays to 32
drm/amd/display: Use kcalloc() instead of kzalloc()
drm/amd/display: Validate function returns
 
drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC
drm/amd/pm/si: Fix updating clock limits on AC/DC
 
drm/amd/pm: Disable MMIO access during SMU Mode 1 reset
drm/amd/pm: fix null pointer access
 
drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read
 
drm/amd: Use attribute groups for PSP flashing attributes
 
drm/amdgpu/gfx6: fix firmware leak on teardown
 
drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring
drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring
drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring
drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring
 
drm/amdgpu/sdma3: Work around POLL_REGMEM / FENCE hang
 
drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages
drm/amdgpu/vcn4: Prevent OOB reads when parsing IB
 
drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings
drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings
drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings
drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring
 
drm/amdgpu: Add vbios attribute only if supported
drm/amdgpu: Add wrapper for freeing vbios memory
drm/amdgpu: Bound GPIO I2C table entry count from VBIOS
drm/amdgpu: change vm->task_info handling
drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks
drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr
drm/amdgpu: ensure no_hw_access is visible before MMIO
drm/amdgpu: fix ACP MFD device leak on init failure
drm/amdgpu: fix aperture mapping leak
drm/amdgpu: fix buffer overflow during vBIOS update
drm/amdgpu: Fix context pstate override handling
drm/amdgpu: fix double free err_addr pointer warnings
drm/amdgpu: fix IP instance memory leak on kobject add failure
drm/amdgpu: fix the idr allocation flags
drm/amdgpu: Fix UVD dpb min size calculation for H264
drm/amdgpu: Fix VCE 3 ring align_mask
drm/amdgpu: force complete the KIQ ring fences on reset
drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM
drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure
drm/amdgpu: limit AV1 to the first instance on VCN4 encode
drm/amdgpu: make Mac FB workaround generic
drm/amdgpu: prevent immediate PASID reuse case
drm/amdgpu: reject oversized IBs with per-ring packet limits
drm/amdgpu: Release VFCT ACPI table reference
drm/amdgpu: Remove usage of the deprecated ida_simple_xx() API
drm/amdgpu: replace PASID IDR with XArray
drm/amdgpu: reset VI ASIC on MacBookPro14,3
drm/amdgpu: reset VI ASIC on MacBookPro15,1
drm/amdgpu: Show vram vendor only if available
drm/amdgpu: Use dbg level for VBIOS check messages
drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw
 
drm/amdkfd: Add bounds check for CRAT subtype length
drm/amdkfd: Add TLB flush after MES queue eviction/suspension
drm/amdkfd: Add upper bound check for num_of_nodes
drm/amdkfd: Check bounds on CRIU restore queue type and mqd size
drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure
drm/amdkfd: debugfs hang_hws skip GPU with MES
drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info
drm/amdkfd: Fix error path at svm_migrate_copy_to_ram
drm/amdkfd: Fix infinite loop parsing CRAT with zero subtype length
drm/amdkfd: fix SMI event cross-process information leak
drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram
drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl
 
drm/aspeed: Balance the display clock enable on teardown
 
drm/bridge: adv7511: fix crash on irq during probe
 
drm/dp: don't mark the AUX backlight enabled when enabling failed
 
drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN
 
drm/gud: don't keep a connector without a CRTC as connector_state
 
drm/i915/bios: range check LFP Data Block panel_type2
 
drm/i915/dmc: Harden DMC firmware payload parsing
 
drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode
 
drm/i915/gem: Prevent overstepping exec array boundary
 
drm/i915/gt: Fix NULL deref on sched_engine alloc failure
drm/i915/gt: Unmask interrupts only when ACTIVE is true
 
drm/i915/hdcp: Add encoder check in hdcp2_get_capability
drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability
 
drm/i915/mst: limit DP MST ESI service loop
 
drm/mediatek: Fix potential NULL dereference in mtk_crtc_destroy()
 
drm/msm/adreno: Assign msm_gpu->pdev earlier to avoid nullptrs
 
drm/msm/dpu: Add callback function pointer check before its call
drm/msm/dpu: Add missing NULL pointer check for pingpong interface
drm/msm/dpu: Add mutex lock in control vblank irq
 
drm/msm/gem: prevent integer overflow in msm_ioctl_gem_submit()
 
drm/msm: always recover the gpu
drm/msm: Only fini scheduler after successful init
drm/msm: Recover HW before retire hung submit
 
drm/nouveau: unsubscribe the channel-kill event before the fence context
 
drm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr()
 
drm/radeon: fix integer overflow in radeon_align_pitch()
drm/radeon: Read the VRAM VBIOS signature with readb()
 
drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port
 
drm/sched: Use struct for drm_sched_init() params
 
drm/sysfb: simpledrm: Improve stride validation
 
drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered
 
drm/v3d: Clear queue->active_job when v3d_fence_create() fails
 
drm/vc4: drain the hangcheck timer and works on V3D unbind
drm/vc4: Fix firmware reference leak in vc4_drm_bind()
drm/vc4: Free the BO cache size list on teardown
drm/vc4: hvs/v3d: Fix null dereference in unbind
drm/vc4: Prevent shader BO mappings from becoming writable
drm/vc4: Shut down BO cache timer before teardown
 
drm/vmwgfx: reject DX_BIND_QUERY without a DX context
drm/vmwgfx: validate pitch coming from userspace
 
drm: zynqmp_kms: Unplug DRM device before removal
 
dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list()
 
EDAC/amd64: Mask UMC chip select to the four implemented selects
 
EDAC/igen6: Fix call trace due to missing release()
 
efi: Don't map the entire mokvar table to determine its size
 
erofs: fix inline data read failure for ztailpacking pclusters
erofs: fix interlaced ztailpacking pclusters
erofs: fix metabuf leak in inode xattr initialization
erofs: fix use-after-free on sbi->sync_decompress
erofs: preserve LZMA decoders on resize failure
erofs: unify lcn as u64 for 32-bit platforms
 
esp: do not unref managed frag pages in esp_ssg_unref()
 
eth: bnxt: fix truesize for mb-xdp-pass case
 
ethtool: fail closed if we can't get max channel used in indirection tables
 
exec: Cleanup POSIX timers right after de_thread()
 
exfat: add cluster chain loop check for dir
exfat: fix handling of damaged volume in exfat_create_upcase_table()
exfat: fix out-of-bounds access of directory entries
exfat: remove unnecessary arguments from exfat_find_dir_entry()
exfat: resolve memory leak from exfat_create_upcase_table()
 
exit: move core of do_wait() into helper
 
ext2: Fix lost inode updates for IS_SYNC inodes
 
ext4: avoid deadlock in fs reclaim with page writeback
ext4: convert bd_bitmap_page to bd_bitmap_folio
ext4: convert bd_buddy_page to bd_buddy_folio
ext4: convert some BUG_ON's in mballoc to use WARN_RATELIMITED instead
ext4: delete redundant calculations in ext4_mb_get_buddy_page_lock()
ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O
ext4: drop extent cache when splitting extent fails
ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find()
ext4: fix circular lock dependency in ext4_ext_migrate
ext4: fix e4b bitmap inconsistency reports
ext4: fix error pointer dereference in ext4_mb_load_buddy_gfp()
ext4: fix kernel BUG in ext4_write_inline_data_end
ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super()
ext4: free the sbi after a grace period
ext4: refactoring to use the unified helper ext4_quotas_off()
ext4: remove unnecessary e4b->bd_buddy_page check in ext4_mb_load_buddy_gfp
ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT
 
f2fs: accurately adjust free_sections during free_segment_range
f2fs: avoid NULL checkpoint thread access in sysfs
f2fs: avoid reading already updated pages during GC
f2fs: convert f2fs_handle_page_eio() to use folio
f2fs: convert to use sysfs_emit
f2fs: don't reset unchangable mount option in f2fs_remount()
f2fs: embed f2fs_gc_kthread in f2fs_sb_info
f2fs: fix data loss caused by incorrect use of nat_entry flag
f2fs: fix dentry folio leak in find_in_level
f2fs: fix fsck inconsistency caused by FGGC of node block
f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage
f2fs: fix node_cnt race between extent node destroy and writeback
f2fs: fix potential deadloop in prepare_compress_overwrite()
f2fs: fix to avoid overflow while left shift operation
f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages()
f2fs: fix to clear dirty flag on folio in error path
f2fs: fix to cover read extent cache access with lock
f2fs: fix to do sanity check on direct node in truncate_dnode()
f2fs: fix to do sanity check on F2FS_INLINE_DATA flag in inode during GC
f2fs: fix to do sanity check on node blkaddr in truncate_node()
f2fs: fix to drop all discards after creating snapshot on lvm device
f2fs: fix to migrate all curseg types during free_segment_range
f2fs: fix to set flush_merge opt and show noflush_merge
f2fs: fix to shrink read extent node in batches
f2fs: fix to truncate first page in error path of f2fs_truncate()
f2fs: fix to truncate meta inode pages forcely
f2fs: introduce f2fs_invalidate_internal_cache() for cleanup
f2fs: introduce f2fs_is_readonly() for readability
f2fs: limit recovery filename logging to stored length
f2fs: split initial and dynamic conditions for extent_cache
f2fs: Use a folio in f2fs_truncate_partial_cluster()
f2fs: use new ioprio Macro to get ckpt thread ioprio level
f2fs: validate MOVE_RANGE destination size
 
fbdev/ssd1307fb: Generate deferred I/O ops
 
fbdev: Add initializer macros for struct fb_ops
fbdev: Don't re-validate info->state in fb_ops implementations
fbdev: fix use-after-free in store_modes()
fbdev: omap2: fix inconsistent lock returns in omapfb_mmap
fbdev: omap2: fix use-after-free in omapfb_mmap
fbdev: ssd1307fb: defer I2C transfers from damage callbacks
fbdev: Use /* */ comment in initializer macro
fbdev: Validate info->screen_{base, buffer} in fb_ops implementations
fbdev: Wrap user-invoked calls to fb_set_var() in helper
 
fcntl: refuse F_SET_RW_HINT on an immutable inode
 
filemap: add helper mapping_max_folio_size()
 
firewire: core: fix memory leak in error path of build_tree()
 
firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit()
firmware: arm_scmi: Add common notifier helpers
firmware: arm_scmi: Add internal platform/channel identifiers
firmware: arm_scmi: Add multiple protocols registration support
firmware: arm_scmi: Avoid IDR updates while cleaning channels
firmware: arm_scmi: Drop handle on protocol bind failures
firmware: arm_scmi: Fix requested device removal race
firmware: arm_scmi: Fix SCMI device destroy lifetimes
firmware: arm_scmi: Fix slab-use-after-free in scmi_bus_notifier()
firmware: arm_scmi: Free transport channel on IDR failure
firmware: arm_scmi: Introduce a new lifecycle for protocol devices
firmware: arm_scmi: Move errors defs and code to common.h
firmware: arm_scmi: Move handle get/set helpers
firmware: arm_scmi: Move protocol registration helpers
firmware: arm_scmi: Protect device request lookup with RCU
firmware: arm_scmi: Publish channel state before callbacks
firmware: arm_scmi: Refactor device create/destroy helpers
firmware: arm_scmi: Refactor protocol device creation
firmware: arm_scmi: Reject out of range DT protocol IDs
firmware: arm_scmi: Simplify chan_available transport operation
firmware: arm_scmi: Unregister device notifier before IDR teardown
firmware: arm_scmi: Unrequest devices if driver registration fails
firmware: arm_scmi: Use channel ID for transport teardown
firmware: arm_scmi: Use dedicated devices to initialize channels
 
flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()
flow_dissector: avoid u16 truncation of skb->len when computing thoff
 
fork: defer linking file vma until vma is fully initialized
 
fs/9p: fix NULL pointer dereference on mkdir
 
fs/mbcache: cancel shrink work before destroying the cache
 
fs/ntfs3: Add more checks in mi_enum_attr (part 2)
fs/ntfs3: cancle set bad inode after removing name fails
fs/ntfs3: Check 'folio' pointer for NULL
fs/ntfs3: fix integer overflow in MFT cluster validation
fs/ntfs3: fix KMSAN uninit-value in ni_create_attr_list
fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()
fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()
fs/ntfs3: handle attr_set_size() errors when truncating files
fs/ntfs3: Keep write operations atomic
fs/ntfs3: Mark inode as bad as soon as error detected in mi_enum_attr()
fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist
fs/ntfs3: resize log->one_page_buf when adopting on-disk page size
 
fs/resctrl: Prevent use-after-free in rdtgroup_kn_put()
 
fs: dlm: cleanup listen sock handling
fs: dlm: remove socket shutdown handling
fs: dlm: use listen sock as dlm running indicator
fs: Free any excess xarray nodes in clear_inode()
fs: new helper: simple_rename_timestamp
fs: refuse fspick() on internal superblocks
fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid
fs: Remove NTFS classic
 
fsnotify: fix inode reference leak in fsnotify_recalc_mask()
fsnotify: prevent mark additions during connector teardown
 
fsverity: add dependency on 64K or smaller pages
 
ftrace: Initialize modname and offset in print_rec()
ftrace: Synchronize the initialization of ftrace_ops
ftrace: Take trace_array reference before accessing its ftrace_ops
 
functionfs, gadgetfs: use simple_recursive_removal()
 
functionfs: fix the open/removal races
 
fuse: check for NULL root inode in fuse_fill_super_submount
 
futex: Fix mm reuse handling for FUT_OFF_MMSHARED
 
gcov: use atomic counter updates to fix concurrent access crashes
 
genetlink: pin family module during policy dump
 
gfs2: fix memory leaks in gfs2_fill_super error path
gfs2: Fix potential glock use-after-free on unmount
 
gpio: exar: initialize the ID before registering its cleanup
gpio: mvebu: fix NULL pointer dereference in suspend/resume
gpio: mvebu: Use IS_REACHABLE instead of IS_ENABLED for CONFIG_PWM
gpio: mxc: enable pad wakeup on i.MX8x platforms
gpio: mxc: fix both_edges bit operations
gpio: mxc: fix wakeup_pads bit operations
gpio: mxc: map Both Edge pad wakeup to Rising Edge
gpio: mxc: use BIT() macro
gpio: mxc: use lock guards for the generic GPIO chip lock
gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock
gpio: xilinx: fix runtime PM leak on request error path
 
greybus: raw: fix use-after-free if write is called after disconnect
greybus: raw: fix use-after-free on cdev close
 
gtp: serialize PDP context updates
 
habanalabs: fix dma-buf release handling if dma_buf_fd() fails
habanalabs: fix UAF in export_dmabuf()
habanalabs: helper function to validate export params
habanalabs: remove support to export dmabuf from handle
 
HID: alps: unregister DualPoint Stick input device on remove
HID: core: Add reserved item tag for main items
HID: core: introduce hid_safe_input_report()
HID: core: Mitigate potential OOB by removing bogus memset()
HID: core: remove #ifdef CONFIG_PM from hid_driver
HID: hid-alps: use default remove for hid device
HID: hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM
HID: hid-steam: Fix cleanup in probe()
HID: hid-steam: Make client_opened a counter
HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients
HID: Intel-ish-hid: Ishtp: Fix sensor reads after ACPI S3 suspend
HID: logitech-hidpp: Fix FF device cleanup on init failure
HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure
HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes
HID: mcp2221: fix OOB write in mcp2221_raw_event()
HID: nintendo: avoid bluetooth suspend/resume stalls
HID: nintendo: register input device after capabilities are set
HID: rate-limit hid_warn to prevent log flooding
HID: sony: clean up device list on probe failure
HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind
HID: steam: Clean up locking
HID: steam: Fully unregister controller when hidraw is opened
HID: steam: Rearrange teardown sequence
HID: steam: Refactor registration
HID: steam: Reject short reads
HID: uhid: convert to hid_safe_input_report()
 
hisi_acc_vfio_pci: bugfix live migration function without VF device driver
 
hsr: Remove WARN_ONCE() in hsr_addr_is_self().
 
hv_netvsc: Don't free decrypted memory
 
hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur
hwmon: (lm90) Add lock protection to lm90_alert
hwmon: (lm90) Stop work before releasing hwmon device
hwmon: (pmbus/core) Protect regulator operations with mutex
hwmon: (pwm-fan) Stop RPM timer before freeing tach data
hwmon: (sht3x) Fix unaligned accesses
 
hwrng: core - fix rng list on registration error
hwrng: core - use RCU and work_struct to fix race condition
hwrng: stm32 - Fix runtime PM cleanup on registration failure
 
i2c: at91: release DMA channels when probe defers
i2c: core: Introduce i2c_client_get_device_id helper function
i2c: mxs: fix DMA channel leak on probe error
i2c: qcom-cci: Fix HALT_ACK reset request being dropped
i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe()
 
i3c: master: Do not treat master device as a duplicate target
i3c: master: Fix recursive locking during device registration
i3c: master: Fix use-after-free of master->this
i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue
i3c: mipi-i3c-hci: Fix race in DMA ring dequeue
i3c: mipi-i3c-hci: Preserve RUN bit when aborting DMA ring
 
i915: Move list_count() to list.h as list_count_nodes() for broader use
 
iavf: fix out-of-bounds writes in iavf_get_ethtool_stats()
 
IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier
 
ibmveth: Always stop tx queues during close
ibmveth: fix TX LTB and filter unwind on open-fail
ibmveth: h_free logical LAN on open-fail after register
 
ice: Don't process extts if PTP is disabled
ice: fix double-free of tx_buf skb
ice: Fix improper extts handling
ice: fix metadata_dst refcount handling on representor teardown
ice: fix Tx scheduler error handling in XDP callback
ice: protect XDP configuration with a mutex
 
ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns()
ieee802154: hwsim: serialize pib updates to fix double-free
 
iio: accel: kxcjk-1013: reject duplicate event disable
iio: accel: sca3000: fix frequency divider condition check
iio: adc: ad_sigma_delta: fix use-after-free on unbind
iio: adc: aspeed: propagate reset deassert errors
iio: adc: aspeed: Simplify with dev_err_probe
iio: adc: axp288: Add TS bias override for Haier HV103H
iio: adc: max1363: sign-extend bipolar differential channel reads
iio: adc: stm32-adc: fix possible division by zero in processed channel
iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure
iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls
iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind
iio: buffer: Ensure bounce buffer used for unaligned case is zeroed.
iio: buffer: serialize buffer teardown with mode claims
iio: cdc: ad7150: fix OF matching and publish module aliases
iio: common: st_sensors: Fix use of uninitialize device structs
iio: frequency: admv1013: fix wrong channel field used in admv1013_read_raw()
iio: gyro: adis16136: fix unprotected debugfs reads
iio: imu: adis16400: fix unprotected debugfs reads
iio: imu: adis16480: fix unprotected debugfs reads
iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection
iio: imu: st_lsm6dsx: fix LSM6DSV sensor description
iio: light: gp2ap020a00f: drain irq_work after free_irq
iio: light: ltrf216a: fix runtime PM reference leak in error path
iio: light: ltrf216a: Return floating point values
iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup
iio: pressure: dps310: fix NULL pointer dereference on ACPI probe
iio: proximity: isl29501: Fix return type of isl29501_register_write
iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure
iio: proximity: sx9324: Correct proximity channel resolution
iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler
iio: st_sensors: core and lsm9ds0 switch to devm_regulator_bulk_get_enable()
iio: st_sensors: relax WhoAmI check in st_sensors_verify_id()
iio: trigger: cancel reenable_work before freeing trigger
 
ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr
ima: verify the previous kernel's IMA buffer lies in addressable RAM
 
inet: control sockets should not use current thread task_frag
 
Input: alps - fix use-after-free bugs caused by dev3_register_work
Input: atkbd - skip deactivate for Lenovo IdeaPad Slim 3 15IWC11
Input: i8042 - add nomux quirk for Fujitsu LIFEBOOK U7410
Input: lkkbd - disable pending work before freeing device
Input: s6sy761 - fix resume ordering and restore sensing
Input: synaptics - add LEN205b entry to smbus_pnp_ids for ThinkPad T490
Input: synaptics - limit T440p InterTouch quirk to LEN0036
 
interconnect: Don't access req_list while it's being manipulated
interconnect: Fix locking for runpm vs reclaim
 
io-wq: order the exit bit against worker creation task work
 
io_uring/cancel: don't forget that the work was running
io_uring/cancel: let CANCEL_ALL find parked requests
io_uring/cancel: recognize "no timeout" on 32-bit
 
io_uring/io-wq: don't exit with a creation pending
io_uring/io-wq: don't hide a link from cancellations
io_uring/io-wq: don't lose the signal that ends work
io_uring/io-wq: don't strand work when a worker exits
io_uring/io-wq: let cancel find picked up hashed work
 
io_uring/poll: avoid retry wakeup loss when dropping ownership
io_uring/poll: don't loop on HUP with multiple references
io_uring/poll: don't lose a cancel as io-wq arms poll
io_uring/poll: drop stale double poll entry on rearm
 
io_uring/sqpoll: let the thread sleep on disabled rings
 
io_uring/timeout: don't flush with the sequence behind the last flush
io_uring/timeout: don't lose a cancel as io-wq arms a timeout
io_uring/timeout: don't put a sequence target behind the last flush
io_uring/timeout: don't skip over reached sequences
 
io_uring/wait: look at all CQ waiters on wake up
 
io_uring: check for overflows in io_pin_pages
io_uring: don't flood a cancelling task with task_work
io_uring: don't pass restart error codes to userspace
io_uring: look up the file before queueing to io-wq
 
iommu/amd: Fix clone_alias() to use the original device's devid
iommu/amd: move wait_on_sem() out of spinlock
iommu/amd: Wait for completion instead of returning early in iommu_completion_wait()
 
iommu/arm-smmu-v3: Manage teardown with devm
 
iommu/msm: Unwind probe state on registration failure
 
iommu/vt-d: Clear Present bit before tearing down context entry
iommu/vt-d: Clear Present bit before tearing down PASID entry
iommu/vt-d: Force requesting ACS when tboot is enabled
 
iommu: Add max_pasids field in struct iommu_device
 
ip6_gre: remove obsolete ERSPAN PMTU update
 
ip6mr: do not clone dst in ip6mr_cache_report()
 
ip: orphan prefetched skbs before multicast forwarding
 
ipmr: account multicast table and route memory
 
ipv4: avoid divide by zero in fib_rebalance
ipv4: do not warn on route notification size race
ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer()
ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()
ipv4: stop PMTU walk when nexthop group shrinks
ipv4: stop route notification sizing when nexthop group shrinks
ipv4: udp: Create exceptions before socket matching
 
ipv6: do not warn on route notification size race
ipv6: flowlabel: cap duplicate leases per socket
ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data()
ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv()
ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel()
ipv6: use RCU in ip6_output()
 
ipvs: bound LBLCR and LBLC cache growth
ipvs: do not create invisible templates
ipvs: do not keep dest_dst if dev is going down
ipvs: filter some flags received in the backup server
ipvs: fix missing counter decrement in lblc
ipvs: revalidate ihl to prevent out-of-bounds access
 
ixgbe: do not configure xps for XDP queues
 
jfs: fix array-index-out-of-bounds read in add_missing_indices
 
kasan: avoid sleepable page allocation from atomic context
kasan: fix cache shrink race with CPU hotplug
kasan: fix lockdep report invalid wait context
kasan: use unchecked __memset internally
 
kcm: fix zero-frag skb in frag_list on partial sendmsg error
 
kernel/params.c: Use kstrtobool() instead of strtobool()
 
keys/trusted_keys: return immediately after TPM unseal failure
 
keys: Avoid the owner account dereference in named keyring lookup
keys: Check the authorization payload in process keyring searches
keys: finalize persistent keyring timeout after link attempt
 
KEYS: Fix add_key() race with keyring restriction
KEYS: Fix key_reject_and_link() race with keyring restriction
 
keys: make keyring indexes independent of kernel addresses
keys: Protect the read method check against type removal
keys: Protect the type name while describing a key
 
KEYS: trusted: Fix blob allocation size in tpm2_key_decode()
KEYS: trusted: Fix TPM teardown ordering
 
kgdboc: Fix tty driver reference leak in configure_kgdboc()
 
kmemleak: drop (age ) from leak record
 
kprobes: Skip disarmed probes when checking optkprobe overlap
 
ksmbd: add chann_lock to protect ksmbd_chann_list xarray
ksmbd: bound DACL dedup walk to copied ACEs
ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size
ksmbd: check outstanding simultaneous SMB operations
ksmbd: defer publishing granted locks to prevent UAF/double-free race
ksmbd: detach blocked lock requests before freeing
ksmbd: fill in FileSysIdentifier in FS_POSIX_INFORMATION
ksmbd: fix heap out-of-bounds write in krb5_authenticate()
ksmbd: fix maximum allowed access checks
ksmbd: fix null pointer dereference in alloc_preauth_hash()
ksmbd: fix OOB write in QUERY_INFO for compound requests
ksmbd: fix path resolution in ksmbd_vfs_kern_path_create
ksmbd: fix r_count dec/increment mismatch
ksmbd: fix refcount leak causing resource not released
ksmbd: fix signededness bug in smb_direct_prepare_negotiation()
ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user()
ksmbd: fix tree connection use-after-free in smb2_tree_connect()
ksmbd: Fix UAF in __close_file_table_ids
ksmbd: fix use-after-free in ksmbd_free_work_struct
ksmbd: free preauth sessions on connection teardown
ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION
ksmbd: pin conn during async oplock break notification
ksmbd: preserve VFS inherited POSIX ACL mask
ksmbd: prevent connection release during oplock break notification
ksmbd: prevent path traversal bypass by restricting caseless retry
ksmbd: prevent rename with empty string
ksmbd: reject undersized DACLs before parsing ACEs
ksmbd: safely discard unregistered deferred locks
ksmbd: serialize oplock close with pending break ownership
ksmbd: use opener credentials for ADS I/O
ksmbd: use opener credentials for delete-on-close
ksmbd: use volume UUID in FS_OBJECT_ID_INFORMATION
ksmbd: validate inherited ACE SID length
ksmbd: validate NTLMv2 response before updating session key
ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl()
ksmbd: validate response sizes in ipc_validate_msg()
ksmbd: validate SID in parent security descriptor during ACL inheritance
ksmbd: vfs: fix race on m_flags in vfs_cache
ksmbd: zero pipe read compound padding
ksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it in
 
KVM: arm64: Don't use the VMA to size stage-2 block mappings for VM_PFNMAP
KVM: arm64: Get rid of userspace_irqchip_in_use
KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save
KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling
KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying
KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN
KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12
KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT
KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state
KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry
KVM: s390: Fix memory corruption by not reinjecting CK machine checks
 
kvm: s390: Reject memory region operations for ucontrol VMs
 
KVM: s390: Zero initialize data structures for inject_pfault_token
KVM: SEV: Drop FOLL_WRITE for encrypted region registration
KVM: SEV: Ignore Port I/O requests of length '0'
KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock
KVM: SEV: Use long-term pin when registering encrypted memory regions
KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception
KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted
KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots
KVM: x86: Use active memslots for the per-vCPU MMIO cache
 
l2tp: fix tunnel and session refcount leak on seq_file release
l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()
l2tp: prevent possible tunnel refcount underflow
 
lan966x: Fix sleeping in atomic context
 
landlock: Fix use-after-free of the source's parent directory
 
leds: an30259a: Use devm_mutex_init() for mutex initialization
 
libceph: Fix potential out-of-bounds access in __ceph_x_decrypt()
 
Linux: Linux 6.1.191
 
lockd, nfsd: RCU-protect nlmsvc_ops dispatch
 
lockd: fix NULL dereference on lockowner allocation failure
lockd: fix swapped arguments in nlmsvc_match_ip()
 
LoongArch: BPF: Don't override subprog's return value
LoongArch: Fix address space mismatch in kexec command line lookup
LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset()
LoongArch: Move jump_label_init() before parse_early_param()
LoongArch: Optimize module load time by optimizing PLT/GOT counting
LoongArch: Update cpu_sibling_map when disabling nonboot CPUs
 
loop: Avoid updating block size under exclusive owner
 
mailbox: Explicitly include correct DT includes
mailbox: zynqmp-ipi: fix an Excess struct member kernel-doc warning
mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop
mailbox: zynqmp: Move buffered IPI setup to of_match selected routine
mailbox: zynqmp: Move of_match structure closer to usage
 
md-cluster: fix NULL pointer dereference in process_metadata_update
 
md/raid10: fix writes_pending and barrier reference leaks on discard failures
md/raid10: fix writes_pending leak on write request failures
md/raid10: Handle bio_split() errors
md/raid10: wait barrier before returning discard request with REQ_NOWAIT
 
md/raid1: create serial pool adding rdev to array with serialize_policy=1
md/raid1: fix writes_pending and barrier reference leaks on write failures
 
md/raid5: avoid R5_Overlap races while breaking stripe batches
 
media: atomisp: gc2235: fix UAF and memory leak
media: av7110: fix a spectre vulnerability
media: hantro: Disable multicore support
media: mediatek: vcodec: Fix H264 stateless decoder smatch warning
media: mediatek: vcodec: Only free buffer VA that is not NULL
media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup
media: rkvdec: Propagate platform_get_irq() errors
media: v4l2-mem2mem: Add a kref to the v4l2_m2m_dev structure
media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC
media: verisilicon: Fix kernel panic due to __initconst misuse
media: videobuf2: Set vma_flags in vb2_dma_sg_mmap
media: vivid: fix cleanup bugs in vivid_init()
 
memstick: core: wait for request completion before freeing card
memstick: rtsx_usb_ms: complete requests after eject instead of dropping them
 
mfd: sm501: Convert to platform remove callback returning void
mfd: sm501: Fix potential memory leaks during remove
mfd: sm501: Remove #ifdef guards for PM related functions
 
MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits
 
mips: unhide uasm_in_compat_space_p() declaration
 
misc: sgi-gru: remove interrupt-context page-table walks
 
mlx5: Fix default values in create CQ
 
mm, madvise: fix potential workingset node list_lru leaks
 
mm/damon/core: do non-safe region walk on kdamond_apply_schemes()
mm/damon/core: don't skip damos_adjust_quota() while esz is not zero
mm/damon/core: fix unconditionally skip last region
 
mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray
mm/filemap: skip to create PMD-sized page cache if needed
 
mm/huge_memory: initialise workingset state before folio split
mm/huge_memory: transfer the pmd dirty bit to the folio on zap
 
mm/hugetlb: fix avoid_reserve to allow taking folio from subpool
mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch
mm/hugetlb: preserve mremap address delta when skipping page tables
 
mm/kmemleak: avoid soft lockup when scanning task stacks
mm/kmemleak: fix UAF bug in kmemleak_scan()
mm/kmemleak: simplify kmemleak_cond_resched() usage
mm/kmemleak: use object_cache instead of kmemleak_initialized to check in set_track_prepare()
 
mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM
 
mm/mglru: fix and remove redundant unevictable folio handling
 
mm/mlock: use the IRQ-safe accessor for NR_MLOCK in __munlock_folio()
 
mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug
 
mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP
mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge
mm/mremap: reset unfaulted VMA page offset for MREMAP_DONTUNMAP
 
mm/page_table_check: skip special zero mappings
 
mm/ptdump: always stabilise against page table freeing using init_mm
 
mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish
 
mm/secretmem: properly account locked pages
 
mm/shmem: disable PMD-sized page cache if needed
 
mm/slub: Avoid list corruption when removing a slab from the full list
 
mm/smaps: fix race between smaps_hugetlb_range and migration
 
mm/userfaultfd: reset ptes when close() for wr-protected ones
 
mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc()
 
mm: clear uffd-wp PTE/PMD state on mremap()
mm: migrate: fix getting incorrect page mapping during page migration
mm: split critical region in remap_file_pages() and invoke LSMs in between
mm: use stack_depot for recording kmemleak's backtrace
mm: use stack_depot_early_init for kmemleak
 
mmc: cavium-octeon: destroy slot platform devices on remove
mmc: cavium-thunderx: destroy slot platform devices on remove
mmc: mtk-sd: Cancel request timeout work on remove
mmc: sdhci-sprd: disable runtime PM on remove
mmc: via-sdmmc: cancel card-detect work on remove
 
mpls: add seqcount to protect the platform_label{,s} pair
 
mptcp: avoid combining some incoming suboptions
mptcp: move the OoO check back into __mptcp_try_fallback()
mptcp: pm: drop match in userspace_pm_append_new_local_addr
mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0
mptcp: pm: reset retrans_time when ADD_ADDR entry is reused
mptcp: pm: userspace: fix address ID overflow
mptcp: prevent race between disconnect() and rtx
mptcp: use sock_kmemdup for address entry
mptcp: userspace pm: use a single point of exit
 
mtd: block2mtd: Fix divide error when erase_size is zero
mtd: call external _get and _put in right order
mtd: Clean refcounting with MTD_PARTITIONED_MASTER
mtd: core: call _get_device() with the master MTD
mtd: fix double free and WARN_ON in add_mtd_device() error paths
mtd: fix use-after-free in mtd release
mtd: maps: vmu-flash: fix fault in unaligned fixup
mtd: maps: vmu-flash: Fix the (mtd core) switch to ref counters
mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ
mtd: rawnand: vf610_nfc: fix false bitflips on reads of erased pages
mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB
mtd: spinand: Enable QE on all dies
mtd: spinand: fix NULL pointer dereference with no ECC engine
mtd: spinand: fix zero oobavail when no ECC engine is used
mtd: use refcount to prevent corruption
 
namespace: check a submount for references right before unmounting it
namespace: check the mounts before reading their parents in pivot_root()
namespace: check the target before walking it in do_mount_setattr()
namespace: don't copy an unmounted mount tree
namespace: don't inherit MNT_UMOUNT in clone_mnt()
namespace: handle mount locking for automounts correctly
namespace: refuse an automount below a mount that is in no namespace
namespace: unhash a dentry before detaching the mounts on it
 
net, sched: Fix SKB_NOT_DROPPED_YET splat under debug config
net, sched: Make tc-related drop reason more flexible
 
net/iucv: fix the recvmsg window update
 
net/liquidio: drop cached VF pci_dev LUT
 
net/mctp: publish the mctp_dev only after it is initialised
 
net/mlx5: Add generic getters for other functions caps
net/mlx5: Fix MCIA register buffer overflow on 32 dword reads
net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list
net/mlx5: Reload only IB representors upon lag disable/enable
 
net/mlx5e: Fix netif state handling
net/mlx5e: Fix publication race for priv->channel_stats[]
net/mlx5e: Order ICOSQ cc update after CQ doorbell
net/mlx5e: Provide intermediate pointer to access IPsec struct
net/mlx5e: Remove skb secpath if xfrm state is not found
net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock
net/mlx5e: xsk: Fix crash on regular rq reactivation
net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure
 
net/ncsi: Disable the ncsi work before freeing the associated structure
 
net/packet: defer vmalloc TX_RING free until skbs finish
net/packet: guard the ll header push in packet_rcv_spkt()
net/packet: prevent TX_RING byte count overflow
 
net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure
net/rds: Fix circular locking dependency in rds_tcp_tune
 
net/sched: account classifier filter allocations to memcg
net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain
net/sched: act_api: release all action references on NEWACTION failure
net/sched: act_ife: Only operate on Ethernet frames
net/sched: act_mirred: use the backlog for mirred ingress
net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload
net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers
net/sched: cls_api: reclaim an empty proto on the error path
net/sched: cls_flower: validate mask pointer after nla_next()
net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds
net/sched: em_text: reject unterminated algo before autoload
net/sched: Fix backlog accounting in qdisc_dequeue_internal
net/sched: Fix mirred deadlock on device recursion
net/sched: fix use-after-free in __tcf_action_put()
net/sched: flower: Fix chain template offload
net/sched: fq: add overflow bounds to quantum and initial quantum
net/sched: fq_codel: match the no-drop threshold to the packet size
net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains
net/sched: initialize noop_qdisc owner
net/sched: sch_codel: match the no-drop threshold to the packet size
net/sched: sch_netem: fix out-of-bounds access in packet corruption
 
net/smc: fix UAF on smcsk after smc_listen_out()
net/smc: initialize close_work early to avoid warning
net/smc: protect clcsock lifetime in smc_getname
net/smc: stop killed, freed and out_of_sync sharing a byte
 
net: add and use skb_get_hash_net
net: add missing ref_tracker_dir_exit() to alloc_netdev_mqs()
net: bcmgenet: fix NULL dereference in set_coalesce before first open
net: bcmgenet: unshare the skb before writing the control block
net: bridge: arp/nd proxy: fix reading neigh ha
net: bridge: avoid recursive multicast port cleanup
net: bridge: mcast: don't truncate the port group walk on teardown
net: bridge: use option bits for CFM/MRP frame handlers
net: decrease cached dst counters in dst_release
net: dsa: b53: do not enable EEE on bcm63xx
net: dsa: microchip: fix KSZ8765 fiber detection
net: dsa: properly keep track of conduit reference
net: ena: Add validation for completion descriptors consistency
net: ena: fix MMIO read buffer leak on probe failure
net: ena: Remove autopolling mode
net: enetc: VFs do not support HWTSTAMP_TX_ONESTEP_SYNC
net: esp: fix bad handling of pages from page_pool
net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller
net: ibmveth: make veth_pool_store stop hanging
net: Introduce sk_use_task_frag in struct sock.
net: ioam6: fix OOB and missing lock
net: ipconfig: bound DHCP option construction
net: ipconfig: Remove outdated comment and indent code block
net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels
net: l2tp: do not propagate multicast notification errors
net: mana: Guard mana_remove against double invocation
net: mana: Reserve extra CQ slot for the fence completion CQE
net: mctp: Don't access ifa_index when missing
net: mctp: unshare packets when reassembling
net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work
net: nexthop: Have all NH notifiers carry NH ID
net: nexthop: Increase weight to u16
net: openvswitch: conntrack: fix helper UAF due to extensions realloc
net: openvswitch: validate transport header presence in set_ipv6_addr
net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind
net: phy: clean the sfp upstream if phy probing fails
net: phy: phy_device: Prevent nullptr exceptions on ISR
net: qlcnic: validate unified ROM sections before loading
net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels
net: ravb: Fix missing rtnl lock in suspend/resume path
net: ravb: serialize PTP clock teardown
net: rds: fix uninitialized trans dereference in CM event handler
net: sched: Add initial TC error skb drop reasons
net: sched: cls_api: add filter counter
net: sched: cls_api: add skip_sw counter
net: sched: cls_api: fix slab-use-after-free in fl_dump_key
net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue
net: sched: Move drop_reason to struct tc_skb_cb
net: sched: refine software bypass handling in tc_run
net: sparx5: make ports inherit the switch base mac address type
net: stmmac: Correctly handle Rx checksum offload errors
net: stmmac: fix oops when split header is enabled
net: stmmac: move the EST lock to struct stmmac_priv
net: stmmac: Prevent DSA tags from breaking COE
net: stmmac: protect updates of 64-bit statistics counters
net: systemport: Fix RUNT MIB counter register offset calculation
net: tap: fix wrong transport_header when sending VLAN-tagged frame
net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp()
net: team: fix NULL pointer dereference in team_xmit during mode change
net: team: Remove unused team_mode_op, port_enabled
net: team: Rename port_disabled team mode op to port_tx_disabled
net: team: stop reusing skb after queue override
net: thunderbolt: Mark the connection down when bringing it up fails
net: thunderbolt: Release the Rx HopID that was handed out on mismatch
net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()
net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync
net: usb: ax88179_178a: fix rx frame length for non-last packets
net: usb: qmi_wwan: add Quectel EG120K-EA
net: use dst_dev_rcu() in sk_setup_caps()
net: use skb_header_pointer() for TCPv4 GSO frag_off check
net: watchdog: fix refcount tracking races
 
net_sched: codel: fix stale state for empty flows in fq_codel
net_sched: sch_fifo: implement lockless __fifo_dump()
 
netfilter: bpf: reject invalid NAT manipulation types
netfilter: bridge: eb_tables: close module init race
netfilter: ctnetlink: do not expose expectation DEAD flag
netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount
netfilter: cttimeout: prevent UAF during module unload
netfilter: ebtables: move to two-stage removal scheme
netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag
netfilter: IDLETIMER: Fix for possible ABBA deadlock
netfilter: ipset: do not update comments from kernel-side adds
netfilter: make nftables drops visible in net dropmonitor
netfilter: nat: use kfree_rcu to release ops
netfilter: nf_conntrack_expect: use conntrack GC to reap expectations
netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()
netfilter: nf_tables: clone set on flush only
netfilter: nf_tables: don't queue packet path object notifications
netfilter: nf_tables: Extend nft_expr_ops::dump callback parameters
netfilter: nf_tables: fix bidirectional offload regression
netfilter: nf_tables: fix dst corruption in same register operation
netfilter: nf_tables: fix memleak in map from abort path
netfilter: nf_tables: set->ops->insert returns opaque set element in case of EEXIST
netfilter: nf_tables: skip double clone set expressions on element insert
netfilter: nf_tables: skip expired catchall elements on insert and delete
netfilter: nf_tables: use list_del_rcu for netlink hooks
netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation
netfilter: nft_compat: ebtables emulation must reject non-bridge targets
netfilter: nft_ct: bail out on template ct in get eval
netfilter: nft_fib: reject fib expression on the netdev egress hook
netfilter: nft_flow_offload: drop flowtable reference on init error path
netfilter: nft_lookup: fix catchall element handling with inverted lookups
netfilter: nft_set_pipapo: restore cloned mapping table memcg accounting
netfilter: revalidate bridge ports
netfilter: synproxy: adjust duplicate timestamp options
netfilter: synproxy: drop packets if timestamp adjustment fails
netfilter: synproxy: fix unaligned memory access in timestamp adjustment
 
netlink: avoid hashing the network namespace pointer
 
netpoll: fix a use-after-free on shutdown path
 
nexthop: Do not return invalid nexthop object during multipath selection
nexthop: Factor out hash threshold fdb nexthop selection
nexthop: Factor out neighbor validity check
 
nfc: nci: complete pending data exchange on device close
 
NFS: Return a delegation the client fails to record
 
nfs: use nfsi->rwsem to protect traversal of the file lock list
 
nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create()
 
NFSD: check truncate permission under inode lock
 
nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke
nfsd: fix clock domain mismatch in clients_still_reclaiming()
nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net
nfsd: fix nfsd_file leak on inter-server COPY setup failure
nfsd: fix stale s2s_cp_stateids IDR entry for async COPY
nfsd: gate nfs2 setacl by argp->mask
nfsd: gate nfs3 setacl by argp->mask
 
NFSD: Prevent client use-after-free during close_lru reaping
NFSD: Prevent client use-after-free during delegation revoke
 
nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops
nfsd: release path refs on follow_down() error
nfsd: release svc_expkey/svc_export with rcu_work
nfsd: size fh_verify server sockaddr slot by xpt_locallen
 
NFSv4.1: zero referring call lists before decoding
 
NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers
 
NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease()
 
nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch
 
nios2: fix __wsum type degradation in csum_fold()
 
nitro_enclaves: fix use-after-free on SLOT_ALLOC failure
 
nouveau/gem: reserve the bo in the info ioctl around the vma lookup
 
nouveau: lock the client object tree.
 
NTB: core: Add .get_dma_dev() callback to ntb_dev_ops
NTB: ntb_transport: Use ntb_get_dma_dev() for DMA buffers
 
ntb: Store original DMA address for future release
 
null_blk: free zones array on device power-off
 
nvdimm: virtio_pmem: refcount requests for token lifetime
 
nvme-apple: Destroy the admin queue on removal
 
nvme-fabrics: fix DHCHAP secret leak on parse failure
nvme-fabrics: use reserved tag for reg read/write command
 
nvme-fc: Do not cancel requests in io target before it is initialized
 
nvme-multipath: fix underflow in ANA log bounds checks
 
nvme-pci: fix race condition between reset and nvme_dev_disable()
 
nvme-rdma: unquiesce admin_q before destroy it
 
nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu()
 
nvme: add missing SRCU grace period in error path
nvme: apple: fix device reference counting
nvme: fix swapped ZRASF zone state values for full and read only
 
nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()
nvmet-auth: reject short AUTH_RECEIVE buffers
nvmet-auth: validate reply message payload bounds against transfer length
 
nvmet-tcp: fix page fragment cache leak in error path
 
nvmet: fix max_qid race between configfs and controller allocation
nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page
nvmet: Introduce nvmet_req_transfer_len()
nvmet: move async event work off nvmet-wq
nvmet: preserve device path on allocation failure
nvmet: return DHCHAP status codes from nvmet_setup_auth()
nvmet: use the local P2P device on metadata allocation failure
 
ocfs2/cluster: keep heartbeat local node stable
 
ocfs2/dlm: Protect the recovery list during debugfs reads
 
ocfs2/heartbeat: fix slot mapping rollback leaks on error paths
 
ocfs2: add extra consistency checks for chain allocator dinodes
ocfs2: add suballoc slot check in ocfs2_validate_inode_block()
ocfs2: Avoid touching renamed directory if parent does not change
ocfs2: correct l_next_free_rec in online check
ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec
ocfs2: o2hb: quiesce negotiate handlers and timeout work
ocfs2: use correct endian in ocfs2_dinode_has_extents
ocfs2: validate DIO orphan slot during inode read
ocfs2: validate directory-index entry counts when reading metadata
ocfs2: validate dx_root extent list fields during block read
ocfs2: validate fast symlink target during inode read
ocfs2: validate i_refcount_loc when refcount flag is set
ocfs2: validate orphan slot during inode read
 
octeontx2-af: Block VFs from clobbering special CGX PKIND state
octeontx2-af: mcs: Fix SC resource cleanup loop
octeontx2-af: npc: Fix size of entry2cntr_map
 
octeontx2-vf: fix workqueue and netdev race in probe/remove
 
of/irq: add missing of_node_put() for interrupt parent node
of/irq: Fix remaining refcount leaks in of_irq_init()
 
of/overlay: don't create "//" paths for fragments targeting the root
of/overlay: don't leak fragment references when changeset init fails
of/overlay: only treat a positive changeset id as registered
of/overlay: put property on deadprops only after changeset add succeeds
 
of: Move of_device_(add|register|unregister) to of_platform.h
of: Move of_device_get_match_data() declaration
of: unittest: Fix memory leak in unittest_data_add()
 
openvswitch: fix soft lockup in the netlink flow dump
openvswitch: prepare for stolen verdict coming from conntrack and nat engine
 
OPP: Fix race between OPP addition and lookup
 
optee: register TEE devices only once fully initialized
 
ovl: check access to copy_file_range source with src mounter creds
 
page_pool: keep frag_offset aligned for odd-sized requests
 
params: Do not go over the limit when getting the string length
params: fix charp corruption on allocation failure
params: Fix multi-line comment style
params: Sort headers
params: Use size_add() for kmalloc()
 
PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store()
PCI/sysfs: Demacrofy pci_dev_resource_resize_attr(n) functions
 
PCI: Accept AtomicOps already enabled by the hypervisor
PCI: Allow per function PCI slots to fix slot reset on s390
PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1
PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry
PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar()
PCI: endpoint: Add missing NULL check for alloc_workqueue()
PCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops
PCI: endpoint: pci-epf-test: Make use of cached 'epc_features' in pci_epf_test_core_init()
PCI: Fix BAR resize for devices on a root bus
PCI: Fix dyn_id add TOCTOU
PCI: Fix Resizable BAR restore order
PCI: Fix UAF when probe runs concurrent to dyn ID removal
PCI: Initialize temporary device in new_id_store()
PCI: Introduce PCI_SLOT_PLACEHOLDER constant for slot_nr placeholder value
PCI: Make pci_match_one_device() match on ID instead of device
 
perf test bpf: Address error about non-null argument for epoll_pwait 2nd arg
 
perf tools: Fix a asan issue in parse_events_multi_pmu_add()
 
perf/core: Detach event groups during remove_on_exec
perf/core: Fix WARN in perf_sigtrap()
 
perf/x86/amd/core: Avoid enabling BRS from the SVM reload path
 
perf/x86/amd/lbr: Fix kernel address leakage
 
perf/x86/intel/uncore: Fix die ID init and look up bugs
 
perf/x86/intel: Fix GRT PEBS load/store direction for latency events, to fix sample classification
perf/x86/intel: Remove anythread_deprecated bit from perf_capabilities
perf/x86/intel: Update event constraints and cache_extra_regsfor ADL
 
perf: Fix addr_filter_ranges lifetime
perf: Fix hang while freeing sigtrap event
perf: Fix race between perf_event_exit_task() and perf_pending_task()
perf: Require kernel access for text poke events
perf: RISC-V: Define helper functions expose hpm counter width and count
perf: RISC-V: store available counter mask as bitmap
perf: RISCV: Fix panic on pmu overflow handler
perf: Track the perf mlock gift separately
 
phy: qcom-qusb2: Fix NULL pointer dereference on early suspend
 
pid_namespace: make zap_pid_ns_processes() freezable
pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper
 
pinctrl: amd: Clear S4 wake bits when firmware has _AEI
pinctrl: freescale: Fix a memory out of bounds when num_configs is 1
pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction
pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip
pinctrl: sunxi: keep a shadow copy of the data register output latches
 
pinmux: fix race causing mux_owner NULL with active mux_usecount
pinmux: Use sequential access to access desc->pinmux data
 
pipe: preserve existing fasync readers on writer setup failure
 
pktgen: use cpus_read_lock() in pg_net_init()
 
platform/x86/amd/pmc: Propagate SMU errors and validate S2D address
 
platform/x86: asus-wmi: fix resource leaks on probe failure
platform/x86: dell-laptop: fix missing cleanups in init error path
platform/x86: dell-smbios: Move request functions for reuse
platform/x86: dell-wmi-base: Fix handling of ultra performance key
platform/x86: int1092: Fix potential memory leak in sar_probe()
platform/x86: intel_sar: Check ACPI_HANDLE() against NULL
platform/x86: lg-laptop: Fix LED resource handling
platform/x86: x86-android-tablets: Unregister devices in reverse order
 
pmdomain: imx8m-blk-ctrl: Serialize power on/off across sibling domains
pmdomain: imx8mp-blk-ctrl: imx8mp_blk: Add fdcc clock to hdmimix domain
pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled
pmdomain: imx93-blk-ctrl: correct remove path
pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI
pmdomain: imx: Fix i.MX8MP VC8000E power up sequence
pmdomain: rockchip: don't ignore clock lookup errors on attach
pmdomain: rockchip: fix clock leak on domain probe failure
pmdomain: rockchip: propagate subdomain add errors
 
pnfs/blocklayout: Fix device leaks on parse failure
 
pNFS: Fix a deadlock when returning a delegation during open()
 
power: supply: charger-manager: Convert to platform remove callback returning void
power: supply: charger-manager: register regulators before exposing sysfs
power: supply: ds2780: Fix ds2780_get_capacity() returning raw value
power: supply: Fix maintenance charge table kernel-doc
power: supply: lp8788-charger: Convert to platform remove callback returning void
power: supply: lp8788-charger: fix use-after-free on remove
power: supply: lp8788: Use devm_power_supply_register() helper
power: supply: max17040: Convert to i2c's .probe_new()
power: supply: max17040: drop incorrect I2C functionality check
power: supply: max17040: propagate register read errors
power: supply: rt9455: Convert to i2c's .probe_new()
power: supply: rt9455: quiesce delayed work before teardown
 
powerpc/64s: Fix unmap race with PMD migration entries
 
powerpc/kexec_file: Prevent kexec range truncation
 
powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW
 
powerpc/xive: add error return value to xive_smp_probe()
powerpc/xive: propagate IPI init errors to prevent use-after-free
 
powerpc: Remove initialisation of readpos
 
ptp: Add a upper bound on max_vclocks
ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog
 
rcu-tasks: Fix access non-existent percpu rtpcp variable in rcu_tasks_need_gpcb()
 
rcu: Fix rcu_read_unlock() deadloop due to IRQ work
rcu: Fix rcu_read_unlock() deadloop due to softirq
 
RDMA/bnxt_re: Fix the page details for the srq created by kernel consumers
 
RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind()
 
RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry()
 
RDMA/erdma: complete object teardown when the destroy command fails
RDMA/erdma: Hold QP references for AE and CM processing
 
RDMA/hns: Fix double destruction of rsv_qp
RDMA/hns: Fix log flood after cmd_mbox failure
RDMA/hns: Fix soft lockup under heavy CEQE load
 
RDMA/irdma: Prevent user-triggered null deref on QP create
RDMA/irdma: Replace waitqueue and flag with completion
 
RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()
 
RDMA/mlx5: Change the cache structure to an RB-tree
RDMA/mlx5: Don't keep umrable 'page_shift' in cache entries
RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error
RDMA/mlx5: Fix a WARN during dereg_mr for DM type
RDMA/mlx5: Fix implicit ODP hang on parent deregistration
RDMA/mlx5: Fix implicit ODP use after free
RDMA/mlx5: Fix the recovery flow of the UMR QP
RDMA/mlx5: Follow rb_key.ats when creating new mkeys
RDMA/mlx5: Implement mkeys management via LIFO queue
RDMA/mlx5: Introduce mlx5r_cache_rb_key
RDMA/mlx5: Move events notifier registration to be after device registration
RDMA/mlx5: Remove implicit ODP cache entry
 
RDMA/rvt: Return NULL after port allocation failure
 
RDMA/rxe: Fix null deref on srq->rq.queue after resize failure
RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp
 
RDMA/siw: Add sendpage_ok() check to disable MSG_SPLICE_PAGES
RDMA/siw: Fix endpoint/socket association handling
RDMA/siw: Introduce siw_destroy_cep_sock
 
rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy
rds: tcp: unregister sysctl before tearing down listen socket
 
rds_tcp: close NULL deref window in rds_tcp_set_callbacks
 
regulator: ltc3676: don't read the write-only HRST and CLIRQ registers
 
reiserfs: Avoid touching renamed directory if parent does not change
reiserfs: convert to simple_rename_timestamp
 
remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3
 
Revert "esp: do not unref managed frag pages in esp_ssg_unref()"
 
Revert "net/smc: Introduce TCP ULP support"
 
Revert "wifi: libertas: reject short monitor TX frames"
 
RISC-V: KVM: Write hgatp register with valid mode bits
 
riscv: probes: save original sp in rethook trampoline
riscv: Remove SHADOW_OVERFLOW_STACK_SIZE macro
riscv: save the SR_SUM status over switches
riscv: use lw when reading int cpu in asm_per_cpu
riscv: VMAP_STACK overflow detection thread-safe
 
rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak
rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe()
rtc: rzn1: Handle unset alarm weekday in rzn1_rtc_read_alarm
rtc: spear: initialize IRQ state before requesting alarm IRQ
 
rv: Use strings in da monitors tracepoints
 
rxrpc: Fix bug due to prealloc collision
rxrpc: Fix conn-level packet handling to unshare RESPONSE packets
rxrpc: Fix data-race warning and potential load/store tearing
rxrpc: Fix delayed ACKs to not set the reference serial number
rxrpc: Fix memory leaks in rxkad_verify_response()
rxrpc: Fix recv-recv race of completed call
 
s390/appldata: remove power management callbacks
 
s390/cpum_sf: move functions from header file to source file
 
s390/ctcm: Prevent XID null dereference
 
s390/dasd: Fix undersized format-check buffer
 
s390/ism: fix concurrency management in ism_cmd()
s390/ism: Fix UAF of sba and ieq during ism_dev_exit()
s390/ism: Introduce struct ism_dmb
 
s390/mm: Add missing secure storage access fixups for donated memory
s390/mm: do not include directly
s390/mm: Fix in_atomic() handling in do_secure_storage_access()
 
s390/pci: Fix leak of uninitialized kernel data in SCLP report
 
s390/pkey: Use kfree_sensitive() to fix Coccinelle warnings
s390/pkey: Wipe copies of clear-key structures on failure
s390/pkey: Wipe copies of protected- and secure-keys
 
s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL
s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects
s390/vfio-ap: Fix NULL deref in status_show() during queue probe
s390/vfio-ap: fix stale pqap_hook pointer on error in vfio_ap_mdev_set_kvm()
 
s390/vfio_ccw: Ensure first IDAW remains constant
s390/vfio_ccw: Limit the number of channel program segments
 
s390/zcrypt: Close speculative mem read possibility
s390/zcrypt: Fix buffer over-read in cca_cipher2protkey
 
s390: include linux/io.h instead of asm/io.h
 
samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify
 
samples: pidfd: fix userprogs typo
 
sched/core: Make core-sched flips wait for in-flight selections
 
sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting
sched/deadline: Fix task_struct reference leak
sched/deadline: Fix warning in migrate_enable for boosted tasks
 
sched/psi: Create the psimon kthread outside of cgroup_mutex
sched/psi: fix race between file release and pressure write
 
sched/rt: Fix race in push_rt_task
 
scsi: block: Improve ioprio value validity checks
scsi: block: Introduce ioprio hints
scsi: block: ioprio: Clean up interface definition
scsi: ch: Do not keep references to data transfer element devices
scsi: core: pair EH runtime PM get and put
scsi: core: wake eh reliably when using scsi_schedule_eh
scsi: hisi_sas: Add function complete_v3_hw()
scsi: hisi_sas: Add SATA_DISK_ERR bit handling for v3 hw
scsi: hisi_sas: Add slave_destroy interface for v3 hw
scsi: hisi_sas: Allocate DFX memory during dump trigger
scsi: hisi_sas: Check before using pointer variables
scsi: hisi_sas: Create all dump files during debugfs initialization
scsi: hisi_sas: Directly call register snapshot instead of using workqueue
scsi: hisi_sas: Fix a deadlock issue related to automatic dump
scsi: hisi_sas: Fix NULL pointer exception during user_scan()
scsi: hisi_sas: Move slot variable definition in hisi_sas_abort_task()
scsi: hisi_sas: Remove redundant checks for automatic debugfs dump
scsi: imm: Fix use-after-free bug caused by unfinished delayed work
scsi: libiscsi: Reject a negative task index from parse_pdu_itt
scsi: libiscsi: Validate the ITT reflected in a Reject PDU
scsi: libiscsi: Validate the task named by a management response
scsi: libsas: Fix SMP IO deadlock during HA resume
scsi: lpfc: Fix use-after-free of mboxq in lpfc_sli4_driver_resource_setup()
scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs
scsi: mpi3mr: Fix possible crash when setting up bsg fails
scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue
scsi: qedi: Initialize callback state before registration
scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size
scsi: qla2xxx: Clear cmds after chip reset
scsi: qla2xxx: Completely fix fcport double free
scsi: qla2xxx: Fix 64G link speed reporting in get_data_rate
scsi: qla2xxx: Fix NVMe abort reference leak on repeated abort
scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking
scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature
scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown
scsi: qla2xxx: Initialize NVMe abort_work once at submission
scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path
scsi: qla2xxx: Quiesce response IRQ before freeing request queue
scsi: qla2xxx: Skip vport under deletion in report ID acquisition
scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot
scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[]
scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak
scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails
scsi: st: Fix use-after-free race between st_remove() and st_open()
scsi: st: Save the visited block for the partition the drive is in
scsi: target: iscsi: Fix race in discovery auth updates
scsi: ufs: core: Validate string descriptors
scsi: ufs: exynos: Disable iocc if dma-coherent property isn't set
scsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3)
scsi: xen/scsifront: Check for a NULL shadow entry on a backend response
 
sctp: add INIT verification after cookie unpacking
sctp: check RCV_SHUTDOWN after the sendmsg connect wait
sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute
sctp: disable BH before calling udp_tunnel_xmit_skb()
sctp: fix addr_wq_timer race in sctp_free_addr_wq()
sctp: revalidate output stream after association connect wait
sctp: validate chunk length in the inqueue parser
sctp: validate embedded INIT chunk and address list lengths in cookie
 
selftests: tls: add getsockopt test
selftests: tls: add rekey tests
selftests: tls: add test with a partially invalid iov
 
selinux: allow multiple opens of /sys/fs/selinux/policy
selinux: avoid dereference of garbage after mount failure
selinux: fix data race on AVC latest_notif
selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts
selinux: reject a permission value exceeding the class permission count
 
seq_buf: Add seq_buf_do_printk() helper
seq_buf: Introduce DECLARE_SEQ_BUF and seq_buf_str()
seq_buf: Make DECLARE_SEQ_BUF() usable
 
serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()
serial: core: clear freed pointers on uart_register_driver() failure
serial: core: do fallible allocations before the console can be registered
serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN
serial: fix TIOCMIWAIT race
serial: imx: Convert to platform remove callback returning void
serial: imx: serialize imx_uart_ports[] lifetime
serial: sc16is7xx: fix TX fifo corruption
serial: tegra: don't clear the Tx FIFO on an Rx-only reset
serial: vt8500: Fix clock reference leak in vt8500_serial_probe()
 
sfc: fix NULL dereferences in ef100_process_design_param()
 
signal: allow taks to temporarily block TIF_NOTIFY_SIGNAL
signal: don't retarget shared signals in a dying thread group
signal: only SIGKILL and the freezers interrupt a coredumping task
 
smb/client: fix chown/chgrp with SMB3 POSIX Extensions
smb/client: flush dirty data before punching a hole
smb/client: pass cifs_open_info_data to SMB2_open()
smb/client: send lease break ACKs thru correct session for multiuser mounts
smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink()
 
smb/server: fix null-ptr-deref in ksmbd_ipc_tree_connect_request()
smb/server: fix session leak in ksmbd_session_register()
 
smb3: make query_on_disk_id open context consistent and move to common code
 
smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()
smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions
smb: client: close completed creates on compound wait errors
smb: client: close handle after create-context parsing failure
smb: client: discard post-EOF pagecache when extending a file via zero range
smb: client: fail DACL rewrite when the new DACL exceeds 64K
smb: client: fix cifsFileInfo reference leak in deferred close
smb: client: fix create context out-of-bounds reads
smb: client: fix double free of TCP_Server_Info::hostname
smb: client: fix file type corruption in cifs_reparse_point_to_fattr()
smb: client: fix heap overflow in DACL owner/group rewrite
smb: client: fix multiuser mount with krb5
smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()
smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()
smb: client: fix potential deadlock when reconnecting channels
smb: client: fix potential UAF in smb2_close_cached_fid()
smb: client: fix races in cifsd thread creation
smb: client: fix request buffer leak in smb2_new_read_req()
smb: client: fix UAF in decryption with multichannel
smb: client: fix use-after-free in smb2_query_info_compound()
smb: client: fix use-after-free of iface in cifs_try_adding_channels()
smb: client: Fix use-after-free of network namespace.
smb: client: fix use-after-free of signing key
smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid
smb: client: let recv_done verify data_offset, data_length and remaining_data_length
smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work)
smb: client: prevent races in ->query_interfaces()
smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked()
smb: client: reject a tree connect response whose byte count is too small
smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races
smb: client: stop flooding dmesg in smb2_calc_signature()
smb: client: use finish_no_open() for non-regular inodes
smb: Don't leak cfid when reconnect races with open_cached_dir
smb: Initialize cfid->tcon before performing network ops
 
smc: Fix use-after-free in tcp_write_timer_handler().
 
soc/xilinx: zynqmp_power: Convert to platform remove callback returning void
 
soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read
soc: qcom: geni-se: Correct QUP Core ICC vote constants
soc: qcom: icc-bwmon: Fix refcount imbalance seen during bwmon_remove
soc: xilinx: Shutdown and free rx mailbox channel
 
sock: add sock_kmemdup helper
 
sockmap: Fix use-after-free in udp_bpf_recvmsg()
 
soundwire: fix bug in sdw_add_element_group_count found by syzkaller
 
spi-rockchip: Fix register out of bounds access
 
spi: bcm63xx: disable clock on resume failure
spi: bcm63xx: switch to use modern name
spi: davinci: switch to managed controller allocation
spi: fsl-qspi: use devm function instead of driver remove
spi: fsl-spi: Convert to platform remove callback returning void
spi: fsl-spi: switch to use modern name
spi: fsl: fix controller deregistration
spi: hisi-kunpeng: Add verification for the max_frequency provided by the firmware
spi: hisi-kunpeng: Convert to platform remove callback returning void
spi: hisi-kunpeng: switch to use modern name
spi: lpspi: Avoid potential use-after-free in probe()
spi: microchip-core-qspi: control built-in cs manually
spi: microchip-core: ensure TX and RX FIFOs are empty at start of a transfer
spi: mpc52xx: Convert to platform remove callback returning void
spi: mpc52xx: fix controller deregistration
spi: mpc52xx: fix use-after-free on registration failure
spi: mpc52xx: switch to use modern name
spi: oc-tiny: switch to managed controller allocation
spi: rspi: Convert to platform remove callback returning void
spi: rspi: fix controller deregistration
spi: spi-dw-dma: fix print error log when wait finish transaction
spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM
spi: spi-qcom-qspi: Support pinctrl sleep states
spi: tegra114: assert CS GPIO for every transfer in a message
spi: tegra210-quad: Protect curr_xfer check in IRQ handler
 
staging: most: remove broken i2c driver
staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()
staging: rtl8723bs: fix spacing around operators
staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths
staging: sm750fb: fix mono image source stride mismatch in lynxfb_ops_imageblit()
 
strparser: make sure __strp_recv isn't running before tearing down the parser
 
SUNRPC: Convert unwrap_priv_data() to use xdr_stream
 
sunrpc: defer rq_argp and rq_resp free until after RCU grace period
 
SUNRPC: fix a memleak in gss_import_v2_context
SUNRPC: Fix crasher in unwrap_integ_data()
SUNRPC: fix gssx_dec_option_array error path bugs
 
sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket
sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir
 
SUNRPC: reject duplicate CREDS_VALUE options
SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2
SUNRPC: Rename automatic variables in unwrap_priv_data()
SUNRPC: svcauth_gss: enforce krb5 token minimum length
 
sunrpc: xprtrdma: Use ERR_CAST() to return
sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE
 
svcrdma: Allocate new transports on device's NUMA node
svcrdma: bound check rq_pages index in inline path
svcrdma: Handle ADDR_CHANGE CM event properly
svcrdma: Refactor the creation of listener CMA ID
svcrdma: Reject connection when transport allocation fails
svcrdma: Reject inline replies that overflow the pull-up buffer
svcrdma: Reject Read lists that exceed the page budget
svcrdma: Reject Write/Reply chunks with segcount 0
svcrdma: Use svc_xprt_put to free listener on create failure
svcrdma: Validate Read chunk positions before reconstruction
 
tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR
tap: Keep hdr_len in tap_get_user()
 
tcp: challenge ACK for non-exact RST in SYN-RECEIVED
tcp: clamp route advmss to TCP_MIN_MSS
tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)
tcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION)
tcp: introduce icsk->icsk_keepalive_timer
tcp: prevent collapsing skbs across boundary in rtx queue
tcp: refresh TS.Recent for accepted old ACKs
tcp: secure_seq: add back ports to TS offset
tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check()
 
tcp_metrics: use dst_dev_net_rcu()
 
team: avoid NETDEV_CHANGEMTU event when unregistering slave
team: fix header_ops type confusion with non-Ethernet ports
 
test_kprobes: clear kprobes between test runs
 
thermal: hwmon: Remove hwmon class device along with its parent
 
thunderbolt: Disable CL states for the Anker Prime TB5 dock
thunderbolt: Fix KASAN reported use-after-free when request is canceled
thunderbolt: Reject oversized XDomain properties responses
 
time/namespace: Validate nanosecond field in proc_timens_set_offset()
 
tipc: avoid busy looping in tipc_exit_net()
tipc: destroy topsrv workqueues before closing connections
tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy()
tipc: hold a reference to nodes found by link name
tipc: prevent GCM nonce reuse on peer key changes
tipc: protect node reset trace dump with node lock
tipc: serialize udp bearer replicast list updates
 
tls: rx: restore msg_iter before TLS 1.3 optimistic retry
 
tools: gpio: fix building from the top level with O=
 
trace/fgraph: Fix the warning caused by missing unregister notifier
 
tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields
tracing/histograms: Verify event_call identity when updating synth_event refcount
 
tracing/user_events: Don't destroy fields when event removal fails
 
tracing: Add recursion protection in kernel stack trace recording
tracing: Bound synthetic-field strings with seq_buf
tracing: Do not initialize tracefs work if tracing is disabled
tracing: Fix 64-bit and signed histogram fields on 32-bit kernels
tracing: Fix hist trigger timestamps for buffered events
tracing: Fix the shift out of bounds in the log2 histogram modifier
tracing: Move readpos from seq_buf to trace_seq
tracing: Reject incomplete event filter expressions
tracing: Save the event file instead of the compatible histogram
tracing: Set the trace clock before registering the histogram trigger
tracing: Take trace_array reference when opening options file
tracing: Unregister field variable histograms when the command fails
 
Treewide: Stop corrupting socket's task_frag
 
tty: abort break signalling on hangup
tty: add break_wait kernel-doc
tty: amiserial: fix broken TIOCMIWAIT
tty: fix saved termios reset race
tty: make tty_class a static const structure
tty: n_gsm: add parameters used with parameter negotiation
tty: n_gsm: Don't block input queue by waiting MSC
tty: n_gsm: introduce macro for minimal unit size
tty: port: fix tty_port_tty_vhangup() race
tty: serial: 8250: protect against NULL uart->port.dev in register
tty: serial: max3100: shut down timer before freeing port
tty: serial: qcom_geni_serial: Keep console RX functional after deep idle
tty: skip cdev_del() when no cdev is registered
tty: tty_port: restore TTY_IO_ERROR on activation failure
tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup
tty: vcc: zero-initialize control packet in vcc_send_ctl()
tty: vt: fix memory leak in vc_allocate()
 
uapi: stddef.h: Fix header guard location
 
ublk: santizize the arguments from userspace when adding a device
 
udmabuf: fix memory leak on last export_udmabuf() error path
 
udp: Deal with race between UDP socket address change and rehash
 
um: fix time-travel syscall scheduling hack
 
unicode: free the map after a grace period
 
USB: cdc-acm: fix racy TIOCMIWAIT implementation
USB: cdc-acm: skip URB restart in port_shutdown if disconnected
 
usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe
usb: cdns3: fix use-after-free in cdns3_gadget_exit()
usb: chipidea: tegra: disable runtime PM on resume failure
usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()
usb: core: clear both ep_in and ep_out for non-ep0 control endpoints
 
USB: dwc2: shut down wakeup timer before freeing HCD state
 
usb: dwc3: am62: Fix runtime PM usage count leak on probe error path
usb: dwc3: gadget: fix IRQ storm on invalid event buffer count
usb: dwc3: gadget: Move vbus draw to workqueue context
usb: free iso schedules on failed submit
usb: gadget: aspeed-vhub: cancel wake work on device removal
usb: gadget: at91_udc: Convert to platform remove callback returning void
usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed
 
USB: gadget: dummy-hcd: Fix wait for outstanding request completions
 
usb: gadget: f_ecm: Fix net_device lifecycle with device_move
usb: gadget: f_eem: Fix net_device lifecycle with device_move
usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC
usb: gadget: f_fs: Fix Use-After-Free in AIO error path
usb: gadget: f_hid: don't call cdev_init while cdev in use
usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers()
usb: gadget: f_midi: Annotate struct f_midi with __counted_by
usb: gadget: f_midi: initialize work in f_midi_alloc()
usb: gadget: f_printer: take kref only for successful open
usb: gadget: f_rndis: Fix net_device lifecycle with device_move
usb: gadget: f_subset: Fix net_device lifecycle with device_move
usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd
 
USB: gadget: ffs: fix mm lifetime handling
 
usb: gadget: ffs: remove ENTER() macro
usb: gadget: function: Simplify diagnostic messaging in printer
usb: gadget: functionfs: Factorize wait-for-endpoint code
usb: gadget: Support already-mapped DMA SGs
usb: gadget: uac: validate rate list length before storing
usb: hub: use shorter 120ms post resume hold for SS root hubs
 
USB: iowarrior: fix use-after-free on disconnect race
 
usb: octeon-hcd: fix the FIFO-flush timeout computation
usb: ohci-da8xx: disable controller wakeup on cleanup
usb: ohci-s3c2410: disable controller wakeup on removal
usb: ohci-spear: disable controller wakeup on removal
usb: ohci-spear: Remove unnecessary NULL check before clk_disable_unprepare()
usb: ohci-st: disable controller wakeup on removal
 
USB: serial: cp210x: add Corsair AX1500i Power Supply
USB: serial: fix driver deregistration order
USB: serial: fix dynamic id driver deregistration race
USB: serial: fix ioctl hangup race
USB: serial: fix port tear down use-after-free
USB: serial: option: add Compal EXC-T1 support
USB: serial: option: add Compal EXM-G1x support
USB: serial: option: add Quectel EG060W
USB: serial: option: add Quectel RG660QB
USB: serial: option: add support for SIMCom SIM8260C
USB: serial: quatech2: fix baud rate overflow
USB: serial: report unsupported break signalling
USB: serial: return errors from break handling
USB: serial: ssu100: fix baud rate overflow
 
usb: storage: realtek_cr: fix use-after-free on disconnect
usb: storage: sierra_ms: reject short SWoC info transfers
usb: typec: anx7411 - stop the IRQ before destroying the workqueue
usb: typec: tcpci_rt1711h: unregister TCPCI port with devres
usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT
usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes()
usb: typec: tcpm: constrain TCPM_SOURCING_VBUS event handling
usb: typec: tcpm: fix debug accessory mode detection for sink ports
usb: typec: tcpm: recover after failure to start the frs ams
usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers
usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect()
usb: typec: ucsi: acpi: Assume UCSI 1.2 on Acer Nitro ANV15-41
usb: typec: ucsi: displayport: Current CAM OOB index fixup
usb: typec: ucsi: Get the connector fwnode based on reg value
usb: typec: ucsi: Limit read size on v1.2
usb: xhci: bail out of setup if the controller is inaccessible
 
userfaultfd: fix checks for huge PMDs
 
vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF
 
vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages()
 
vhost: correct misleading printing information
vhost: fix vhost_get_avail_idx for a non empty ring
vhost: move smp_rmb() into vhost_get_avail_idx()
vhost: move vdpa group bound check to vhost_vdpa
 
vhost_iotlb: bound map allocation in add_range
 
virt: acrn: Fix irqfd use-after-free during eventfd shutdown
 
virtio-mmio: Remove virtqueue list from mmio device
 
virtio: break and reset virtio devices on device_shutdown()
 
virtio_ccw: always take irq_lock in the classic interrupt handler
 
virtio_mmio: disable IRQ wake before free_irq
 
vlan: fix skb_under_panic and races when toggling HW VLAN offload
vlan: require the MAC header to be present in __vlan_insert_inner_tag()
vlan: restore HW VLAN tag insertion with reorder_hdr off
 
vsock/virtio: validate packet source for connected sockets
 
vsock: don't check the listener's sk_err in vsock_accept()
vsock: treat TCP_CLOSING as once-established
 
vt: skip screen update for DEC alignment test on backgroup consoles
 
vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects
vxlan: Fix NPD when refreshing an FDB entry with a nexthop object
vxlan: fix reading neigh ha
vxlan: use one headroom snapshot for neighbour replies
 
watch_queue: Fix note pool publication race in watch_queue_set_size()
 
watchdog: at91sam9_wdt: prevent timer rearm during teardown
watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger
watchdog: rtd119x: Avoid division by zero
watchdog: rtd119x: Use devm_clk_get_enabled() helper
 
wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode
wifi: ath11k: cancel SSR work items during PCI shutdown
wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event()
wifi: ath11k: fix stride mismatch in mac_phy_caps_parse()
wifi: ath11k: reset ar->num_stations on hardware start
wifi: brcmfmac: fix P2P action frame handling without device vif
wifi: brcmfmac: fix P2P device removal race in brcmf_detach()
wifi: cfg80211: add link_station_info structure to support MLO statistics
wifi: cfg80211: avoid double free if updating BSS fails
wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock
wifi: cfg80211: preserve hidden-group beacon IE ownership
wifi: cfg80211: reject duplicate wiphy cipher suite entries
wifi: cfg80211: stop PMSR before P2P and NAN teardown
wifi: cfg80211: use wiphy work for socket owner autodisconnect
wifi: cw1200: fix TX padding OOB read leaking heap data to device
wifi: fix leak if split 6 GHz scanning fails
wifi: ieee80211: validate MLE common info length
wifi: iwlegacy: 3945: free EEPROM data on remove
wifi: iwlwifi: dbg-tlv: fix DRAM data init
wifi: iwlwifi: don't warn when if there is a FW error
wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start()
wifi: iwlwifi: fix debug actions order
wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments
wifi: iwlwifi: mvm: add a check on the tid coming from the firmware
wifi: iwlwifi: mvm: fix a possible underflow
wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif
wifi: iwlwifi: mvm: validate TX_CMD response layout
wifi: iwlwifi: pcie: null RX pointers after free
wifi: libipw: reject TKIP frames without a full MIC
wifi: mac80211: account proxy paths against the mesh path limit
wifi: mac80211: count only matching reservations in reserved switch
wifi: mac80211: defer link RX stats percpu free to RCU
wifi: mac80211: don't WARN for connections on invalid channels
wifi: mac80211: drain PS delivery work during station teardown
wifi: mac80211: handle empty FILS association request payload
wifi: mac80211: ibss: wait for in-flight TX on disconnect
wifi: mac80211: keep fallback association elements alive
wifi: mac80211: keep paired old chanctx alive
wifi: mac80211: minstrel_ht: validate fixed rate index
wifi: mac80211: refactor populating mesh related fields in sinfo
wifi: mac80211: release mesh path quota on failed additions
wifi: mac80211: set info->band for 802.3 encap offload frames
wifi: mac80211: shut down RX BA session timer on teardown
wifi: mt76: cancel reset and rc work on device unregister
wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req()
wifi: mt76: fix non-AQL packet accounting for MLO stations
wifi: mt76: mt7915: allocate vif wcid in the same range as stations
wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy
wifi: mt76: mt7915: Fix an error handling path in mt7915_add_interface()
wifi: mt76: mt7915: set correct background radar capability
wifi: mt76: mt7915: unwind state on add_interface failure
wifi: mt76: mt7921: fix NULL pointer access in mt7921_ipv6_addr_change
wifi: mt76: mt7921: Place upper limit on station AID
wifi: nl80211: clean up color-change beacon data on errors
wifi: p54: validate firmware record lengths
wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop
wifi: rtw88: debugfs: support multiple adapters debugging
wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band()
wifi: rtw89: fix null pointer access when abort scan
wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion
wifi: rtw89: pci: validate sequence number of TX release report
wifi: rtw89: phy: check length before parsing PHY status IE
wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown
wifi: wfx: validate MIB read length before copying to caller
wifi: wilc1000: avoid buffer overflow in WID string configuration
wifi: wlcore: Convert to platform remove callback returning void
wifi: wlcore: Fix runtime PM leak in wlcore_remove()
 
wireguard: noise: reject response consumption after intermediate initiation
wireguard: queueing: preserve tstamp_type when encapsulating packet
 
workqueue: Do not warn when cancelling WQ_MEM_RECLAIM work from !WQ_MEM_RECLAIM worker
workqueue: Fix NULL current_pwq deref in chained work check
 
x86/CPU/AMD: Clear virtualized VMLOAD/VMSAVE on Zen4 client
 
x86/ftrace: Remove SYSTEM_BOOTING exceptions
 
x86/mce: use is_copy_from_user() to determine copy-from-user context
 
x86/PCI: Avoid PME from D3hot/D3cold for AMD Rembrandt and Phoenix USB4
 
xen/events: avoid using info_for_irq() in xen_send_IPI_one()
xen/events: drop xen_allocate_irqs_dynamic()
xen/events: fix error code in xen_bind_pirq_msi_to_irq()
xen/events: modify internal [un]bind interfaces
xen/events: reduce externally visible helper functions
xen/events: remove some simple helpers from events_base.c
xen/events: Return -EEXIST for bound VIRQs
 
xen/netfront: don't leak the skb when xennet_fill_frags() fails
xen/netfront: drop RX packets with a short Ethernet header
 
xen/pvcalls: bound backend response req_id before indexing rsp[]
 
xen: fix UAF in dmabuf_exp_from_pages()
 
xfrm: account XFRMA_IF_ID in aevent size calculation
xfrm: always flush state and policy upon NETDEV_UNREGISTER event
xfrm: Duplicate SPI Handling
xfrm: fix stale skb->prev after async crypto steals a GSO segment
xfrm: hold dev ref until after transport_finish NF_HOOK
xfrm: prevent policy_hthresh.work from racing with netns teardown
xfrm: state: fix out-of-bounds read during lookup
xfrm: Wait for RCU readers during policy netns exit
 
xfs: catch stale AGF/AGF metadata
xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf
xfs: factor out stale buffer item completion
xfs: fix capability check in xfs
xfs: fix cursor and pointer handling when recovering iunlink buckets
xfs: fix unmount hang with unflushable inodes stuck in the AIL
xfs: rearrange code in xfs_buf_item.c
xfs: remove xfs_attr_leaf_hasname
xfs: xfs_ifree_cluster vs xfs_iflush_shutdown_abort deadlock
 
zram: fix out-of-bounds access in read_block_state()
zram: fix out-of-bounds access in writeback_store()
zram: fixup read_block_state()