SUSE-SU-2026:5091-1: Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues:

The following security issues were fixed:

- CVE-2025-68219: cifs: fix memory leak in smb3fscontextparseparam error path (bsc#1255222). - CVE-2026-31708: smb: client: fix OOB read in smb2ioctlqueryinfo QUERYINFO path (bsc#1264022). - CVE-2026-31709: smb: client: validate the whole DACL before rewriting it in cifsacl (bsc#1264024). - CVE-2026-43350: smb: client: require a full NFS mode SID before reading mode bits (bsc#1264985). - CVE-2026-46155: smb/client: fix out-of-bounds read in smb2compoundop() (bsc#1267720). - CVE-2026-64370: posix-cpu-timers: Fix pid refcount leak in docpunanosleep() error path (bsc#1273805). - CVE-2026-64380: smb: client: harden POSIX SID length parsing (bsc#1273557). - CVE-2026-64430: NTB: epf: Avoid calling pciirqvector() from hardirq context (bsc#1274257). - CVE-2026-64435: audit: Fix data races of skbqueuelen() readers on auditqueue (bsc#1274080). - CVE-2026-68186: binfmtmisc: set haveexecfd only once the interpreter is opened (bsc#1274949). - CVE-2026-68436: drm/amd/display: use kvzalloc to allocate struct dc (bsc#1276275). - CVE-2026-68447: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size (bsc#1276280). - CVE-2026-68460: f2fs: fix potential deadlock in f2fsbalancefs() (bsc#1276774). - CVE-2026-72010: cgroup/cpuset: rebind mm mempolicy to effectivemems, not memsallowed (bsc#1276776). - CVE-2026-72073: mmc: vub300: fix use-after-free on probe failure (bsc#1277157). - CVE-2026-72110: bpf,fork: wipe ->bpfstorage before bailouts that access it (bsc#1277357). - CVE-2026-72111: bpf: Reset register bounds before narrowing retval range in checkmemaccess() (bsc#1277389). - CVE-2026-72250: netfilter: nfconntrackreasm: guard macheader adjustment after IPv6 defrag (bsc#1277663). - CVE-2026-72253: netfilter: nfconntracksip: validate skbdst() before accessing it (bsc#1277665). - CVE-2026-72318: cifs: validate DFS referral string offsets (bsc#1275939). - CVE-2026-72405: net: udptunnel: prevent double queueing in udptunnelnicdevicesync (bsc#1278033). - CVE-2026-72416: netfilter: nftcompat: ebtables emulation must reject non-bridge targets (bsc#1278041). - CVE-2026-72428: bpf: Fix stack slot index in nospec checks (bsc#1278050). - CVE-2026-74368: wifi: ath12k: fix memory leak in ath12kwifi7dprxhverifytkipmic() (bsc#1277103). - CVE-2026-74472: ublk: reset kernel-owned devinfo fields in ublkctrladddev() (bsc#1277785). - CVE-2026-74613: vsock/virtio: avoid refilling the RX queue after teardown (bsc#1277903). - CVE-2026-74620: net/sched: actgact, actpolice: range check the fallback control action (bsc#1277044). - CVE-2026-74624: netfilter: nfconntrack: defer invalid log until after unlock (bsc#1277599). - CVE-2026-74715: net: netfilter: Make ct zone opts configurable for bpf ct helpers (bsc#1277890). - CVE-2026-74746: netfilter: flowtable: publish GC-visible tuple last (bsc#1278101). - CVE-2026-74748: netfilter: ipset: fix refcount race between list:set GC and swap (bsc#1277578). - CVE-2026-80572: Input: byd - synchronize timer deletion before freeing private data (bsc#1277338). - CVE-2026-80602: perf/x86/amd/lbr: Fix kernel address leakage (bsc#1278123). - CVE-2026-80637: netfilter: synproxy: fix unaligned memory access in timestamp adjustment (bsc#1278343). - CVE-2026-80717: sctp: validate Adaptation Indication parameter length (bsc#1277836). - CVE-2026-80755: selinux: reject a permission value exceeding the class permission count (bsc#1278415). - CVE-2026-80757: selinux: reject a class permission count below its inherited common (bsc#1278711). - CVE-2026-80808: ext4: stop retrying saturated xattr cache entries (bsc#1279795). - CVE-2026-80809: ocfs2: fix missing metadata reservation for large xattrs (bsc#1279606). - CVE-2026-80855: fuse: fix invalidate lock leak on open OTRUNC DAX failure (bsc#1279564). - CVE-2026-80879: ocfs2: fix circular locking dependency in ocfs2dioendiowrite (bsc#1279494). - CVE-2026-80881: ocfs2: fix buffer head management in ocfs2readblocks() (bsc#1279496). - CVE-2026-80978: ip6gre: fix hardware header length for NBMA tunnels (bsc#1280253). - CVE-2026-89491: ocfs2: cluster: don't sleep while holding o2hblivelock in o2hbregionpin() (bsc#1280472). - CVE-2026-89494: ocfs2: validate lengths in dlmmiglockreshandler (bsc#1280520). - CVE-2026-89495: ocfs2: bound namelen in dlmmigraterequesthandler (bsc#1280569). - CVE-2026-89537: SUNRPC: Reject short RFC 4121 MIC tokens in gsskrb5verifymicv2 (bsc#1280713). - CVE-2026-89560: landlock: Require LANDLOCKACCESSFSMAKEREG for whiteout creation (bsc#1280806). - CVE-2026-89595: fsnotify: Fix stale object mask after concurrent mark updates (bsc#1280834). - CVE-2026-89608: ecryptfs: pass packet set buffer size to parser (bsc#1280826). - CVE-2026-89637: smb: client: fix UAF and buffer leak in cifschecktrans2() for malformed secondary T2 (bsc#1280492). - CVE-2026-89649: ceph: bound xattr value length in buildxattrs() (bsc#1280434). - CVE-2026-89654: ceph: fix UAF in checknewmap() on session freed during unlock (bsc#1280415). - CVE-2026-89655: ceph: fix UAF in kickflushingcaps() on cf entry freed during unlock (bsc#1280398). - CVE-2026-89656: libceph: reject buckets with mismatched CRUSH ids (bsc#1280563). - CVE-2026-89657: libceph: validate OSD extent maps before cursor advance (bsc#1280545). - CVE-2026-89751: x86/tdx: Fix off-by-one in port I/O handling (bsc#1280822). - CVE-2026-89761: apparmor: fix out-of-bounds write when null terminating a label vec (bsc#1280745). - CVE-2026-89786: ext4: fix out-of-bounds read in ext4readinlinedir() (bsc#1280976). - CVE-2026-89787: ext4: check dir entry fits before reading the hash trailer in ext4searchdir() (bsc#1280977). - CVE-2026-90042: ceph: properly decrypt filenames in vmalloc() buffers (bsc#1280948). - CVE-2026-90092: Bluetooth: L2CAP: reject accept queue add unless BTLISTEN (bsc#1281384). - CVE-2026-90128: vdpa/mlx5: fix wrong list iterated in adddirectchain error path (bsc#1281577). - CVE-2026-90148: NFSv4: Fix incorrect argument passed to nfs4deletelease() in nfs4addlease() (bsc#1281551). - CVE-2026-90227: nvme/ioctl: check SUBMITIO with nvmecmdallowed() (bsc#1281705). - CVE-2026-90393: bpf: Fix potential UAF in bpfnetnslinkupdateprog (bsc#1282289). - CVE-2026-93054: uio: Fix stale info pointer in failed registration path (bsc#1282276). - CVE-2026-93228: svcrdma: Reject Write/Reply chunks with segcount 0 (bsc#1282697). - CVE-2026-93262: md/raid5-ppl: fix use-after-free in ppldoflush() (bsc#1283004). - CVE-2026-93795: blk-cgroup: fix leaks and online flag on radixtreeinsert failure (bsc#1283155). - CVE-2026-93798: btrfs: fix reloc root cleanup in mergerelocroots() (bsc#1282769). - CVE-2026-93817: perf: Fix addrfilterranges lifetime (bsc#1283017). - CVE-2026-97575: media: v4l2-ctrls: validate AV1 tile counts (bsc#1283337). - CVE-2026-97605: erofs: preserve LZMA decoders on resize failure (bsc#1283173). - CVE-2026-97926: ufs: validate cylinder group metadata before caching it (bsc#1283887). - CVE-2026-98041: bpf: Don't predict JMP32 pointer vs zero comparisons (bsc#1284064). - CVE-2026-98086: ALSA: ump: do not touch legacyrmidi before it exists (bsc#1283785). - CVE-2026-98264: ALSA: virtio: reset device before deleting virtqueues (bsc#1284363). - CVE-2026-98306: seg6: set IPSKBL3SLAVE from IP6SKBL3SLAVE on IPIP decapsulation (bsc#1284505). - CVE-2026-98368: esp: downgrade zerocopy managed frags before mutating skb frags (bsc#1284498). - CVE-2026-98374: tcp: fix use-after-free of retransmitskbhint in tcpsendsynack() (bsc#1284740). - CVE-2026-98432: ipv4: free inetopt and ireqopt after an RCU grace period (bsc#1285685). - CVE-2026-98471: KVM: SEV: Do cache maintenance on the source VM during intra-host migration (bsc#1286240).

The following non security issues were fixed:

- accel/qaic: reject BO sizes that overflow page count (git-fixes). - ACPI: CPPC: Validate the CPC package header (git-fixes). - ACPI: extlog: Validate elog record length before walking sections (git-fixes). - ACPI: PCI: pcilink: clear driverdata before free (git-fixes). - ACPI: pfrupdate: zero-initialize capability query result (git-fixes). - ACPI: PM: Drop parent state update from acpidevicegetpower() (git-fixes). - ACPI: tables: handle failed initrd override mappings (git-fixes). - ACPI: TAD: Rearrange RT data validation checking (stable-fixes). - ACPI: video: Fix backlight unregistration ordering (git-fixes). - ACPICA: Fix memory leak in acpidscreatefield() (git-fixes). - ACPICA: Fix PCC OperationRegion command offsets (git-fixes). - ALSA: 6fire: take streammutex in the Digital Thru control (git-fixes). - ALSA: aloop: Keep the timer source alive until card release (git-fixes). - ALSA: caiaq: Allow zero-length packet handling for EP1 (git-fixes). - ALSA: caiaq: Fix races at MIDI URB and trigger accesses (git-fixes). - ALSA: caiaq: Fix the Kore controller key map (git-fixes). - ALSA: caiaq: Register card at the final step (git-fixes). - ALSA: caiaq: Serialize access to the EP1 command buffer (git-fixes). - ALSA: compress: add missing OPEN-state gate to SETMETADATA (git-fixes). - ALSA: compress: fix buffer leak on failed SETPARAMS (git-fixes). - ALSA: compress: reject buffer geometry change on gapless nexttrack (git-fixes). - ALSA: control: Fix virtual master creation reference in kernel-doc (git-fixes). - ALSA: cs46xx: fix unit mismatch in DSP code area bounds check (git-fixes). - ALSA: hda/hdmi: clamp numcvts against cvtnids in hdmireadpinconn (git-fixes). - ALSA: hda/hdmi: clamp sadcount in ELD proc write handler (git-fixes). - ALSA: hda: Add NULL check for the driver pointer at unsol event work (git-fixes). - ALSA: hda: Avoid non-operational GPU warning at regular device removal (git-fixes). - ALSA: hda: Fix potential UAF for gating jack (git-fixes). - ALSA: hda: intel: Cancel delayed work at shutdown, too (git-fixes). - ALSA: info: Fix memory leak at card removal (git-fixes). - ALSA: jack: Fix kctl free at error in sndjackkctlnew() (git-fixes). - ALSA: jack: Remove debugfs before freeing unregistered jacks (git-fixes). - ALSA: line6: Clear prevfbuf on capture buffer release (git-fixes). - ALSA: line6: Fix potential OOB write in line6capturecopy() (git-fixes). - ALSA: line6: Reject too small max packet sizes (git-fixes). - ALSA: line6: Use kzalloc() for PCM buffer allocation (git-fixes). - ALSA: pcm: Fix drivertstamp value reporting (git-fixes). - ALSA: pcm: Protect channel-map reads against runtime detach (git-fixes). - ALSA: pcm: Protect delay DMA sync against concurrent HWFREE (git-fixes). - ALSA: pcm: Protect delay DMA sync in forward and rewind, too (git-fixes). - ALSA: pcm: Protect the unregister notifier traversal (git-fixes). - ALSA: pcm: Remove channel-map controls before freeing substreams (git-fixes). - ALSA: pcm: Unlink substreams before releasing them (git-fixes). - ALSA: rawmidi: Drain input work before freeing the runtime (git-fixes). - ALSA: seq: Fix missing direction and umpgroup handling in 32bit compat ioctl (git-fixes). - ALSA: seq: oss: Skip events until fully initialized (git-fixes). - ALSA: ump: Avoid dereference with maxsrcsize=0 (git-fixes). - ALSA: ump: Correct return size of fillrpn() (git-fixes). - ALSA: usb-audio: Use fixed control index for us16x08 mixer elements (git-fixes). - ALSA: via82xx: use helper to activate DXS controls (git-fixes). - ALSA: vmaster: Protect follower lookup and setup (git-fixes). - ASoC: adau17x1: return cache sync errors from resume (git-fixes). - ASoC: ak4642: return cache sync errors from resume (git-fixes). - ASoC: amd: acp: Fix .close() being skipped on rollback (git-fixes). - ASoC: amd: ps: Fix acp63pdmdmaclose() being skipped on rollback (git-fixes). - ASoC: amd: ps: Fix acp63sdwdmaclose() being skipped on rollback (git-fixes). - ASoC: amd: raven: Fix acp3xdmaclose() being skipped on rollback (git-fixes). - ASoC: amd: renoir: Fix acppdmdmaclose() being skipped on rollback (git-fixes). - ASoC: amd: vangogh: Fix acp5xdmaclose() being skipped on rollback (git-fixes). - ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P) (stable-fixes). - ASoC: amd: yc: Fix acp6xpdmdmaclose() being skipped on rollback (git-fixes). - ASoC: arizona-jack: Fix runtime PM imbalance in arizonastarthpdetaccid() (git-fixes). - ASoC: atmel-i2s: fix MCK generator error handling (git-fixes). - ASoC: atmel-i2s: use optional API for gclk (git-fixes). - ASoC: atmel-i2s: use optional API for muxclk (git-fixes). - ASoC: atmel: atmel-pcm-pdc: Fix atmelpcmclose() being skipped on rollback (git-fixes). - ASoC: codecs: da732x: Fix definition of ADC2 EQ Overall Volume control (git-fixes). - ASoC: codecs: lpass-wsa-macro: use v2.5 Compander1 addresses on v2.5+ (git-fixes). - ASoC: codecs: rt5659: propagate GPIO errors (git-fixes). - ASoC: codecs: rt5682s: disable jack detection work on shutdown (git-fixes). - ASoC: codecs: sta32x: Fix definition of Ch2 and Ch3 Volume Bypass controls (git-fixes). - ASoC: codecs: sta32x: Fix definition of limiter threshold controls (git-fixes). - ASoC: codecs: sta350: Fix definition of Ch2 and Ch3 Volume Bypass controls (git-fixes). - ASoC: codecs: sta350: Fix definition of limiter threshold controls (git-fixes). - ASoC: codecs: tlv320adc3xxx: Fix definition of AGC Target Level control (git-fixes). - ASoC: codecs: wcd9335: Fix SLIM interface device leak in wcd9335slimstatus() (git-fixes). - ASoC: codecs: wm5100: Fix definition of EQ3 Band 1 Volume control (git-fixes). - ASoC: codecs: wm8510: Fix definition of ADC Inversion Switch control (git-fixes). - ASoC: codecs: wm8737: Fix definition of zero cross switches (git-fixes). - ASoC: codecs: wm8750: Fix definition of ALC Capture NG Type control (git-fixes). - ASoC: codecs: wm8955: Fix definition of Treble Cutoff control (git-fixes). - ASoC: codecs: wm8983: Fix definition of ADC 128x Oversampling control (git-fixes). - ASoC: codecs: wm8985: Fix definition of ADC 128x Oversampling control (git-fixes). - ASoC: codecs: wm8990: Fix definition of LOMIX AINLMUX Bypass Volume control (git-fixes). - ASoC: codecs: wm8990: Fix definition of right input PGA controls (git-fixes). - ASoC: codecs: wm8991: Fix definition of LOMIX AINLMUX Bypass Volume control (git-fixes). - ASoC: codecs: wm8991: Fix definition of right input PGA controls (git-fixes). - ASoC: codecs: wm8994: Fix definition of WM8958 noise gate hold time controls (git-fixes). - ASoC: codecs: wm8994: Fix runtime PM leak in wm8994micdetect() (git-fixes). - ASoC: codecs: wmhubs: Fix definition of MIXINR to MIXOUTR volume control (git-fixes). - ASoC: dwc: Use OF match data again for StarFive JH7110 (git-fixes). - ASoC: es8316: return cache sync errors from resume (git-fixes). - ASoC: es8326: report resume restore errors (git-fixes). - ASoC: fslasrc: check the second front-end DMA channel (git-fixes). - ASoC: fslasrc: use regmapwritebits to update clock source registers (git-fixes). - ASoC: imx-pcm-rpmsg: Fix imxrpmsgpcmclose() being skipped on rollback (git-fixes). - ASoC: intel: atom: Fix .shutdown() being skipped on rollback (git-fixes). - ASoC: Intel: atom: Fix platform device leak on probe failure (git-fixes). - ASoC: Intel: avs: Prevent module info underflow (git-fixes). - ASoC: Intel: avs: Unprepare a stream when recovery occurs (git-fixes). - ASoC: mediatek: common: Handle constraint return value in FE startup (git-fixes). - ASoC: mediatek: common: Keep codec references until the card is bound (git-fixes). - ASoC: mediatek: mt6797: fix wrong unwind order and error code in enableclock (git-fixes). - ASoC: mediatek: mt8183: Fix APLL enable error handling (git-fixes). - ASoC: mediatek: mt8183: Fix clock handling in mux disable path (git-fixes). - ASoC: mediatek: mt8183: Fix wrong clock cleanup on clksetparent() failure (git-fixes). - ASoC: mediatek: mt8186: Fix AFE clock error handling (git-fixes). - ASoC: mediatek: mt8186: Fix APLL enable error handling (git-fixes). - ASoC: mediatek: mt8186: Fix APLL mux setting error handling (git-fixes). - ASoC: mediatek: mt8186: Fix clock handling in mux disable path (git-fixes). - ASoC: mediatek: mt8186: Fix MCK error handling (git-fixes). - ASoC: mediatek: mt8188: Handle constraint return value in FE startup (git-fixes). - ASoC: mediatek: mt8188: mt8188-afe-clk: Handle clock enable errors (git-fixes). - ASoC: mediatek: mt8188: mt8188-afe-clk: Handle tuner clock enable errors (git-fixes). - ASoC: mediatek: mt8188: mt8188-afe-clk: Propagate regmap update errors (git-fixes). - ASoC: mediatek: mt8188: mt8188-afe-pcm: Handle runtime resume errors (git-fixes). - ASoC: mediatek: mt8192-mt6359: Fix error handling in MTKAIF calibration (git-fixes). - ASoC: mediatek: mt8192: check return values in mt8192afegpioinit() (git-fixes). - ASoC: mediatek: mt8192: fix AFE clock error handling (git-fixes). - ASoC: mediatek: mt8192: fix APLL mux error handling (git-fixes). - ASoC: mediatek: mt8192: fix error handling in APLL enable functions (git-fixes). - ASoC: mediatek: mt8192: fix MCK clock error handling (git-fixes). - ASoC: mediatek: mt8192: Handle regcachesync() failure in runtime resume (git-fixes). - ASoC: mediatek: mt8192: Propagate errors in I2S DAI DAPM event handlers (git-fixes). - ASoC: mediatek: mt8192: Propagate errors in TDM DAI DAPM event handlers (git-fixes). - ASoC: mediatek: mt8192: Propagate mt8192afegpiorequest() errors in ADDA DAI (git-fixes). - ASoC: mediatek: mt8192: switch to devmclkgetoptional() (git-fixes). - ASoC: mediatek: mt8195: Check paired MEMIF clock enable in FE trigger (git-fixes). - ASoC: mediatek: mt8195: Fix ETDM MCLK error handling (git-fixes). - ASoC: mediatek: mt8195: Fix ETDM probe error handling (git-fixes). - ASoC: mediatek: mt8195: Fix ETDM startup error handling (git-fixes). - ASoC: mediatek: mt8195: Fix FE startup error handling (git-fixes). - ASoC: mediatek: mt8195: Fix HDMI TX startup error handling (git-fixes). - ASoC: mediatek: mt8195: Fix main clock error handling (git-fixes). - ASoC: mediatek: mt8195: Fix paired memif clock error handling (git-fixes). - ASoC: mediatek: mt8195: Fix register access clock error handling (git-fixes). - ASoC: mediatek: mt8195: Fix runtime resume error handling (git-fixes). - ASoC: mediatek: mt8195: Fix timing system clock error handling (git-fixes). - ASoC: mediatek: mt8195: Fix tuner clock error handling (git-fixes). - ASoC: mediatek: mt8195: Propagate IRQ lookup errors (git-fixes). - ASoC: mt6359-accdet: manage private workqueues with devres (git-fixes). - ASoC: nau8540: return cache sync errors from resume (git-fixes). - ASoC: ops: Fix return value in sndsoclimitvolume() (git-fixes). - ASoC: qcom: q6apm: clear gapm on driver removal (git-fixes). - ASoC: qcom: q6apm: reset the hw pointer with the fragment queue (git-fixes). - ASoC: rockchip: rockchipi2s: Handle runtime PM resume failures in setfmt (git-fixes). - ASoC: rt711-sdca: always cancel jack work on remove (git-fixes). - ASoC: rt711-sdw: always cancel jack work on remove (git-fixes). - ASoC: rt712-sdca-dmic: fix drvdata type in the gain controls (git-fixes). - ASoC: rt712-sdca: always cancel jack work on remove (git-fixes). - ASoC: rt722-sdca: always cancel jack work on remove (git-fixes). - ASoC: rt1011: return cache sync errors from resume (git-fixes). - ASoC: rt1016: return cache sync errors from resume (git-fixes). - ASoC: rt1305: return cache sync errors from resume (git-fixes). - ASoC: rt1308: return cache sync errors from resume (git-fixes). - ASoC: rt5616: return cache sync errors from resume (git-fixes). - ASoC: rt5659: return cache sync errors from resume (git-fixes). - ASoC: rt5660: return cache sync errors from resume (git-fixes). - ASoC: rt5665: return cache sync errors from resume (git-fixes). - ASoC: rt5682-sdw: always cancel jack work on remove (git-fixes). - ASoC: soc-ac97: Fix error handling in sndsocnewac97component() (git-fixes). - ASoC: soc-component: Fix return type of sndsocpcmcomponentpointer() (git-fixes). - ASoC: soc-topology-test: Check return value of kunitdeviceregister() (git-fixes). - ASoC: SOF: amd: fix amdsofacpremove() teardown ordering (git-fixes). - ASoC: SOF: imx: Prevent stack OOB read in DSP panic dump (git-fixes). - ASoC: ti: davinci-mcasp: Fix runtime PM imbalance in davincimcaspsetclkdiv() (git-fixes). - ASoC: wcd9335: Fix device reference leak in wcd9335slimstatus() (git-fixes). - ASoC: wcd-mbhc-v2: Fix incorrect properties names and typos (git-fixes). - ASoC: wm8994: Fix runtime PM imbalance in wm8994componentprobe() (git-fixes). - asymmetrickeys: reject trust keys without IDs (git-fixes). - ata: libata-scsi: abort multi-sector pass-through commands when multicount is 0 (git-fixes). - ata: libata-scsi: Fix atascsihotplug() reference in kernel-doc (git-fixes). - ata: pataparport: fix parport attach idralloc for (git-fixes). - ata: pataparport: Fix use-after-free in newdevicestore (git-fixes). - ata: satafsl: Fix use-after-free of hostpriv on probe() failure (git-fixes). - backlight: lm3630a: Cancel delayed work before destroying workqueue (git-fixes). - backlight: qcom-wled: Fix NULL pointer dereference in wledremove() (git-fixes). - backlight: qcom-wled: Fix unbalanced OVP IRQ enable at probe (git-fixes). - backlight: qcom-wled: Fix WLED3 brightness register stride (git-fixes). - Bluetooth: 6lowpan: Drain RCU readers on registration failure (git-fixes). - Bluetooth: 6lowpan: Pin module for 6lowpancontrol debugfs file (git-fixes). - Bluetooth: 6LoWPAN: Use RCU-safe device list removal (git-fixes). - Bluetooth: Add missing newline to btdev{err,warn}ratelimited() (git-fixes). - Bluetooth: btintel: fix buffer over-read in btintelhwerror() (git-fixes). - Bluetooth: btintel: validate DDC record lengths (git-fixes). - Bluetooth: btmtk: fix skb double free on ISO padding failure (git-fixes). - Bluetooth: btqcomsmd: Convert to platform remove callback returning void (stable-fixes). - Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hcidev (git-fixes). - Bluetooth: btusb: Add IMC Networks QCA9377 to quirks table (stable-fixes). - Bluetooth: hciconn: Lock parent access during enhanced SCO setup (git-fixes). - Bluetooth: hcicore: free the HCI ID if naming fails (git-fixes). - Bluetooth: hcicore: Keep RCU protection through LTK filtering (git-fixes). - Bluetooth: hcidebugfs: Pin module for debugfs file operations (git-fixes). - Bluetooth: hcisync: don't drain cmdsync backlog on unregister (git-fixes). - Bluetooth: hcisync: Fix inquiry cache use-after-free (git-fixes). - Bluetooth: hcisync: fix mesh adv timeout units (git-fixes). - Bluetooth: hcisync: Protect IRK identity reads with RCU (git-fixes). - Bluetooth: hcisync: Serialize devcoredump reset during device open (git-fixes). - Bluetooth: hcivhci: Pin module for debugfs file operations (git-fixes). - Bluetooth: ISO: Hold the listener during disconnect notification (git-fixes). - Bluetooth: L2CAP: hold chan in l2capecredconnrsp() (git-fixes). - Bluetooth: L2CAP: hold l2capconn::lock in l2capconnectcfm() (git-fixes). - Bluetooth: L2CAP: refuse l2capchanadd if chan already has conn (git-fixes). - Bluetooth: L2CAP: Reject invalid TxWindow in configuration requests (git-fixes). - Bluetooth: L2CAP: Reject mode changes on connected channels (git-fixes). - Bluetooth: L2CAP: Use default TxWindow for zero socket option (git-fixes). - Bluetooth: MGMT: Fix leaking instance on Add Extended Advertising Parameters (git-fixes). - Bluetooth: MGMT: Fix pending state of instances added without HCI traffic (git-fixes). - Bluetooth: MGMT: Reject quality report requests during unregister (git-fixes). - Bluetooth: msft: Lock failed probe cleanup against feature readers (git-fixes). - Bluetooth: MSFT: Serialize handle map cleanup with event processing (git-fixes). - Bluetooth: RFCOMM: Fix initial port reference race (git-fixes). - Bluetooth: selftest: Pin module for selftest debugfs file operations (git-fixes). - bus: arm-cci: Drop cci-control-port node reference in cciacegetport() (git-fixes). - bus: arm-cci: Drop CPU node reference in cciaceinitports() (git-fixes). - bus: fsl-mc: register the object drivers after miscclass exists (git-fixes). - char: scx200gpio: check cdevadd() return value (git-fixes). - comedi: comediparport: validate the IRQ supplied by userspace (git-fixes). - comedi: dmm32at: validate the IRQ supplied by userspace (git-fixes). - comedi: dt2811: fix shift-out-of-bounds in IRQ check (git-fixes). - comedi: dt2814: validate the IRQ supplied by userspace (git-fixes). - comedi: niatmio16d: validate the IRQ supplied by userspace (git-fixes). - comedi: pcmmio: validate the IRQ supplied by userspace (git-fixes). - comedi: pcmuio: validate the IRQs supplied by userspace (git-fixes). - crypto: amlogic - Fix DMA memory leak in cipher error path (git-fixes). - crypto: amlogic - Fix IRQ handler return value and fallthrough logic (git-fixes). - crypto: asymmetrickeys - fix OOB read in pefileparsebinary (git-fixes). - crypto: atmel - handle authenc requests without plaintext (git-fixes). - crypto: atmel-aes - fix AADLENR for standalone GHASH (git-fixes). - crypto: atmel-sha - reject initialization without a device (git-fixes). - crypto: atmel-tdes - sync output bounce buffer before DMA (git-fixes). - crypto: atmel-tdes - zero-initialize device state (git-fixes). - crypto: caam - fix double-free in caamrsasetprivkeyform() (git-fixes). - crypto: ccp - kill v3 IRQ tasklet during teardown (git-fixes). - crypto: ccp - kill v5 IRQ tasklet during teardown (git-fixes). - crypto: hisilicon/hpre - fix ECDH destination DMA mapping (git-fixes). - crypto: hisilicon/hpre - fix GFP flags for dmaalloccoherent (git-fixes). - crypto: hisilicon/hpre - fix pointer dereference before length check (git-fixes). - crypto: hisilicon/hpre - remove dmafreecoherent on NULL req->dst in ECDH (git-fixes). - crypto: hisilicon/hpre - return -EOVERFLOW for small ECDH output buffer (git-fixes). - crypto: qat - avoid OOB read when stripping RSA leading zeros (git-fixes). - crypto: qat - fix activedevs leak on crypto alg registration failure (git-fixes). - crypto: qat - fix use of destroyed vf2pflock on VF restart (git-fixes). - crypto: qat - initialise statelock on every path in adfdevmgradddev() (git-fixes). - crypto: qat - release instance on DH fallback allocation failure (git-fixes). - crypto: qat - zero the VF migration state buffer on save (git-fixes). - crypto: tcrypt - Avoid reading req->base after submission (git-fixes). - Documentation: rs485: Pull uartgetrs485mode() from serialcore.c (git-fixes). - Documentation: virt: Fix the struct snpguestrequestioctl name in sev-guest.rst (git-fixes). - drivers/base/node: fix UAF on deviceregister() failure (git-fixes). - Drivers: hv: vmbus: add VTL2 redirect connection ID (git-fixes). - drm/amd/display: assign missing trace entry in amdgpudmdcclocksstate (git-fixes). - drm/amd/display: disable replay when crc source is enabled (stable-fixes). - drm/amd/display: Fix direct scanout alpha on some DRMFORMATs (stable-fixes). - drm/amd/display: fix vready offset assignment in dcnoptclockunlockstate (git-fixes). - drm/amd/display: Force GAMCOR for subsampled surfaces with PQ/Gamma22/HLG (git-fixes). - drm/amd/display: remove duplicated prevpstatechangesupport assignment (git-fixes). - drm/amd/display: Use kcalloc() instead of kzalloc() (stable-fixes). - drm/amd/display: use right type for amdgpudcperformance event entries (git-fixes). - drm/amd/pm: bound SCLK FCW range entries to the table size (git-fixes). - drm/amdgpu/atombios: drop empty function (stable-fixes). - drm/amdgpu/gfx6: fix firmware leak on teardown (stable-fixes). - drm/amdgpu: Check for multiplication overflow in checkpoint stack (bsc#1276280). - drm/amdgpu: make Mac FB workaround generic (stable-fixes). - drm/amdgpu: Remove unused amdgpui2c functions (stable-fixes). - drm/amdgpu: reset VI ASIC on MacBookPro14,3 (stable-fixes). - drm/amdgpu: reset VI ASIC on MacBookPro15,1 (stable-fixes). - drm/amdgpu: rework i2c init and fini (stable-fixes). - drm/amdgpu: serialize vblank counter reads against GPU reset (stable-fixes). - drm/amdgpu: Update SRIOV Exchange Headers for RAS Telemetry Support (stable-fixes). - drm/amdgpu: Use dbg level for VBIOS check messages (stable-fixes). - drm/amdkfd: Fix checkpoint-restore on multi-xcc (bsc#1276280). - drm/amdkfd: Fix partial migrate issue (stable-fixes). - drm/bridge: analogixdp: Restore mandatory samsung DP DT properties (git-fixes). - drm/exynos/fimd: fix register offset type in fimdtrigger() (git-fixes). - drm/i915/display: convert I915STATEWARN() to struct inteldisplay (stable-fixes). - drm/i915/gmbus: convert to struct inteldisplay (stable-fixes). - drm/i915/vga: Convert VGA code to inteldisplay (stable-fixes). - drm/i915: document rangeoverflows() and rangeendoverflows() macros (stable-fixes). - drm/i915: rename rangeoverflowsend() to rangeendoverflows() (stable-fixes). - drm/imx/lcdc: avoid duplicate clkper enable (git-fixes). - drm/komeda: Fix bits parsing of GLBCOREID (git-fixes). - drm/mali-dp: Fix runtime PM leak in malidpcrtcatomicenable() (git-fixes). - drm/msm/a6xx: Fix secondary rail vote in ARC votes (git-fixes). - drm/msm/a6xx: fix use-after-free of OPP in a6xxpmresume (git-fixes). - drm/msm/dp: don't report link training success after a reinit (git-fixes). - drm/msm/dpu: disable the slave encoder before the master (git-fixes). - drm/msm/hdmiphy: Cleanup after msmhdmiphyresourceenable() failure (git-fixes). - drm/msm/mdp5: drop cursor pipe for msm8x76 (git-fixes). - drm/msm: Properly handle msmioremap() without name (git-fixes). - drm/nouveau/svm: drain fault handler before freeing svmm (git-fixes). - drm/nouveau: cancel the DP IRQ work before freeing the connector (git-fixes). - drm/nouveau: disable the fence uevent work instead of just cancelling it (git-fixes). - drm/nouveau: don't dereference outp before checking it in nouveaudpirq (git-fixes). - drm/nouveau: reject zero-size notifier object allocation (git-fixes). - drm/omap: dsi: avoid sending bta sync all the time in writes (git-fixes). - drm/panel: ebbg-ft8719: Set prepareprevfirst (git-fixes). - drm/panfrost: Explicitly enable MMU interrupts at device init (git-fixes). - drm/panfrost: Prevent division by 0 (git-fixes). - drm/panthor: Fix TOCTOU race between GROUPREGISTERED check and erase (git-fixes). - drm/panthor: Take reqslock in softreset for clearing pendingreqs (git-fixes). - drm/tegra: Don't pass an ERRPTR to drmsyncobjreplacefence() (git-fixes). - drm/tegra: Drop reference on postfence (git-fixes). - drm/tegra: Fix syncobjin wait return value check (git-fixes). - drm/ttm: return an error when kmapping a BO without pages (git-fixes). - drm/vc4: Fix firmware reference leak in vc4drmbind() (git-fixes). - drm/vc4: Use video aperture helpers (stable-fixes). - drm/virtio: Add a helper to map and note the dma addrs and lengths (stable-fixes). - drm/virtio: Use drmgemplanehelperpreparefb() (stable-fixes). - drm/vmwgfx: Stop using devprivate to store driver data (stable-fixes). - drm: of: Fix drmofgetdatalanescountep() return value documentation (git-fixes). - fbdev: atmellcdfb: Prevent FIFO work after removal (git-fixes). - fbdev: gxt4500: Release WC setup on probe failure (git-fixes). - fbdev: shmobilelcdc: check for fbdeferredioinit() error (git-fixes). - fbdev: smscufx: check for fbdeferredioinit() error (git-fixes). - fbdev: ssd1307fb: check for fbdeferredioinit() error (git-fixes). - fbdev: udlfb: check for fbdeferredioinit() error (git-fixes). - fbdev: udlfb: don't rebuild the mode list while the framebuffer is in use (git-fixes). - fbdev: xen-fbfront: check for fbdeferredioinit() error (git-fixes). - firewire: cdev: Fix FWCDEVIOCCREATEISOCONTEXT references in kernel-doc (git-fixes). - firmware: csdsp: clear dsp->running on the csdsprun() error path (git-fixes). - firmware: imx: dsp: fix mailbox channel leak on kasprintf failure (git-fixes). - fpga: Fix offpgamgrget() reference in fpgamgrlock() docs (git-fixes). - gpio: crystalcove: add missing MODULEALIAS() (git-fixes). - gpio: davinci: Clear interrupt status in every bank on suspend (git-fixes). - gpio: pca953x: Preserve wakeup accounting on parent IRQ failure (git-fixes). - HID: alps: unregister DualPoint Stick input device on remove (git-fixes). - HID: amdsfh: Remove unsupported motion-state field from accelerometer report (git-fixes). - HID: amdsfh: Use report type from request node (git-fixes). - HID: core: Add reserved item tag for main items (stable-fixes). - HID: core: Fix out-of-bounds left shift by 32 in s32ton() (git-fixes). - HID: cougar: reject short special-key reports (git-fixes). - HID: cp2112: validate response report lengths (git-fixes). - HID: elo: reject short touchscreen reports (git-fixes). - HID: hid-alps: Use pmptr instead of #ifdef CONFIGPM (stable-fixes). - HID: hid-steam: Make clientopened a counter (stable-fixes). - HID: logitech-dj: validate unnumbered keyboard reports (git-fixes). - HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes (git-fixes). - HID: mcp2221: fix OOB write in mcp2221rawevent() (stable-fixes). - HID: mcp2221: validate response report length (git-fixes). - HID: picoLCD: check for fbdeferredioinit() error (git-fixes). - HID: pxrc: reject short input reports (git-fixes). - HID: rate-limit hidwarn to prevent log flooding (stable-fixes). - HID: roccat: isku: reject short button reports (git-fixes). - HID: roccat: koneplus: reject short button reports (git-fixes). - HID: roccat: konepure: reject short button reports (git-fixes). - HID: roccat: kovaplus: reject short button reports (git-fixes). - HID: roccat: pyra: reject short button reports (git-fixes). - HID: roccat: ryos: reject short special reports (git-fixes). - HID: roccat: savu: reject short special reports (git-fixes). - HID: wacom: fix wacomintuosirq NULL peninput deref (git-fixes). - HID: zydacron: validate key report length (git-fixes). - hostfs: fix devt handling (git-fixes). - hwmon: (coretemp) Refresh the temperature on the first read (git-fixes). - hwmon: (corsair-cpro) Make waitinputreportlock IRQ safe (git-fixes). - hwmon: (lm70) Fix rounding of negative temperatures (git-fixes). - hwmon: (lm95245) Fix negative temperature conversion (git-fixes). - hwmon: (sht3x) Return the consumed count for heater writes (git-fixes). - hwrng: amd - report partial reads in non-blocking mode (git-fixes). - hwrng: ba431 - fix reported byte count (git-fixes). - hwrng: cctrng - Fix runtime PM usage counter leak (git-fixes). - hwrng: core - reject unknown RNG names (git-fixes). - hwrng: intel - return -ENOMEM when ioremap() fails (git-fixes). - hwrng: intel - return -ENOMEM when kmallocobj() fails (git-fixes). - hwrng: starfive - propagate clock and reset errors (git-fixes). - i2c: acpi: Fix adapter reference leak in i2cacpinewdevicebyfwnode() (git-fixes). - i2c: at91: release DMA channels when probe defers (git-fixes). - i2c: designware: queue only one read command for block reads (git-fixes). - i2c: mt7621: fix copying uninitialized kernel stack with reduced pagelen (git-fixes). - i2c: xiic: don't clobber msg->len to signal block-read completion (git-fixes). - i2c: xiic: Relocate xiici2cruntimesuspend and xiici2cruntimeresume to facilitate atomic mode (stable-fixes). - iio: accel: adis16201: fix channel order for buffer mode (git-fixes). - iio: accel: kionix-kx022a: Fix IPOL macro name (git-fixes). - iio: accel: kxcjk-1013: Disable autosuspend on remove (git-fixes). - iio: accel: mma9551: disable autosuspend on remove (git-fixes). - iio: accel: mma9553: disable autosuspend on remove (git-fixes). - iio: adc: aspeed: propagate reset deassert errors (git-fixes). - iio: adc: aspeed: Simplify with deverrprobe (stable-fixes). - iio: adc: at91-sama5d2: disable autosuspend on remove (git-fixes). - iio: adc: stm32: fix minimum sampling time values (git-fixes). - iio: adc: ti-adc128s052: validate SPI match data (git-fixes). - iio: core: add accessors 'masklength' (stable-fixes). - iio: dac: ad5758: Fix alignment for DMA safety (git-fixes). - iio: dac: ad5758: Fix the offset calculation (git-fixes). - iio: dac: ad5758: Reject out-of-range raw values (git-fixes). - iio: humidity: hts221: report available values via readavail() (git-fixes). - iio: imu: adis16400: Check return value of spisetup() (git-fixes). - iio: light: ltrf216a: Return floating point values (stable-fixes). - iio: pressure: dps310: fix CFGREG bit definitions (git-fixes). - iio: temperature: tmp117: fix calibbias cache update on I2C write failure (git-fixes). - Input: atkbd - skip deactivate for Lenovo IdeaPad Slim 3 15IWC11 (stable-fixes). - Input: da7280 - fix input device parent assignment (git-fixes). - Input: drv2665 - fix input device parent assignment (git-fixes). - Input: drv2667 - fix input device parent assignment (git-fixes). - Input: i8042 - add nomux quirk for Fujitsu LIFEBOOK U7410 (stable-fixes). - Input: lkkbd - disable pending work before freeing device (stable-fixes). - Input: maplekeyb - fix key press detection (git-fixes). - Input: maplecontrol - emit EVSYN report after reporting events (git-fixes). - Input: matrix-keymap - reject keycodes above KEYMAX (git-fixes). - Input: synaptics - add LEN205b entry to smbuspnpids for ThinkPad T490 (stable-fixes). - Input: tps6507x-ts - fix input device parent assignment (git-fixes). - Input: xpad - add support for Corsair Novablade Pro (stable-fixes). - kobject: fix out-of-bounds access in kobjectactiontype() (git-fixes). - kobject: Fix the kobjsetname reference in ksetregister() kernel-doc (git-fixes). - KVM: SEV: Do cache maintenance on the source VM before clearing SEV state (git-fixes). - landlock: Always allow signals between threads of the same process (git-fixes). - landlock: Fix cosmetic change (git-fixes). - landlock: Fix non-TCP sockets restriction (git-fixes). - landlock: Fix TCP handling of short AFUNSPEC addresses (git-fixes). - landlock: Fix unmarked concurrent access to socket family (git-fixes). - leds: flash: Prevent using uninitialized variable in flashfaultshow() (git-fixes). - leds: lm3692x: Fix regulator/gpio leak and wrong enabled state on last write failure (git-fixes). - leds: lp8860: Fix devicenode leak in lp8860probe() (git-fixes). - leds: pca9532: Check i2csmbusreadbytedata() return value (git-fixes). - mac80211: tx: Use info->flags in ieee80211txhselectkey() (git-fixes). - media: adv748x: Fix endpoint reference leaks on probe failure (git-fixes). - media: adv7180: Initialize mutex before ancillary clients (git-fixes). - media: adv7604: avoid negative array index in logstatus when cpread fails (git-fixes). - media: amphion: fix runtime PM imbalance on probe failure (git-fixes). - media: amphion: prevent unbind while video instances are open (git-fixes). - media: atmel-isi: release unregistered video device on remove (git-fixes). - media: au0828: Fix media device leak in au0828usbprobe() (git-fixes). - media: au0828: fix use-after-free in bulktimeout timer on disconnect (git-fixes). - media: au0828: Free URBs when starting DVB streaming fails (git-fixes). - media: cx18: Disable PCI device on probe failure (git-fixes). - media: cx88: Disable PCI device on MPEG initialization failure (git-fixes). - media: cx231xx-audio: drain wqtrigger before audio fini (git-fixes). - media: cx231xx: Fix cleanup path on failure (git-fixes). - media: cx23885: Fix use-after-free in cx23885finidev due to race condition (git-fixes). - media: cx23885: unregister DVB bus when SP2 CI setup fails (git-fixes). - media: em28xx: fix double free in em28xxallocurbs (git-fixes). - media: em28xx: reject audio endpoint with zero packet size (git-fixes). - media: exynos4-is: Fix a race between sstream(0) and the interrupt handler (git-fixes). - media: go7007: bound EZ-USB I2C transfers to the usbbuf size (git-fixes). - media: go7007: unregister the I2C adapter on USB probe failure (git-fixes). - media: gspca: use vb2videounregisterdevice() on disconnect (git-fixes). - media: hackrf: fix use-after-free in hackrfallocurbs() error path (git-fixes). - media: hantro: Disable multicore support (stable-fixes). - media: hantro: disable runtime PM before hardware teardown (git-fixes). - media: hantro: Harden MPEG-2 control access against NULL (git-fixes). - media: i2c: ar0521: remove duplicate media entity cleanup (git-fixes). - media: i2c: ov5648: Fix a data race on state->streaming (git-fixes). - media: i2c: ov8856: fix debug message to report actual CSI-2 lane count (git-fixes). - media: i2c: tc358743: add missing color-space strings (git-fixes). - media: imon: fix use-after-free in displayclose via devdbg (git-fixes). - media: imx-jpeg: cancel timeout worker when streaming stops (git-fixes). - media: imx-jpeg: finish the job on devicerun() error paths (git-fixes). - media: ir-hix5hd2: Ensure rdev is setup before interrupts are enabled (git-fixes). - media: irtoy: Validate the maximum tx carrier (git-fixes). - media: m2m-deinterlace: fix default capture field (git-fixes). - media: marvell-cam: fix unmet dependency for VIDEOMMPCAMERA (git-fixes). - media: marvell: manage the MMP camera clock provider (git-fixes). - media: mediatek: jpeg: Avoid context access after job finish (git-fixes). - media: mediatek: jpeg: retry HW selection after successful wait (git-fixes). - media: mediatek: vpu: free IRQ before destroying watchdog workqueue (git-fixes). - media: mediatek: vpu: release reserved memory on remove (git-fixes). - media: meson-ir-tx: Ensure clock is disabled on unbind (git-fixes). - media: meson-ir-tx: Ensure probe error is propagated (git-fixes). - media: meson-ir-tx: Prevent divide by zero in mesonirtxpreparepulse() (git-fixes). - media: meson: vdec: size capture planes from the aligned canvas (git-fixes). - media: microchip-csi2dc: fix async notifier leak on probe error path (git-fixes). - media: microchip-isc: disable histogram and flush AWB work on teardown (git-fixes). - media: microchip-isc: do not touch WB registers when not streaming (git-fixes). - media: microchip-isc: fix PM runtime leak in AWB work handler (git-fixes). - media: microchip-isc: synchronize the IRQ before disabling clocks on stop (git-fixes). - media: mtk-jpeg: Fix runtime PM leak in mtkjpegdecworker() (git-fixes). - media: mtk-jpeg: Fix runtime PM leak in mtkjpegencworker() (git-fixes). - media: platform: mtk-mdp3: Fix device reference leak in mdpcompinit() (git-fixes). - media: pvrusb2: Fix USB parent device leak in classdevcreate() (git-fixes). - media: rc: fintek-cir: process a full RX buffer instead of overflowing it (git-fixes). - media: rc: mcekbd: Fix inconsistent locking of keylock (git-fixes). - media: redrat3: Ensure all urbs are suspended (git-fixes). - media: redrat3: Ensure we don't read beyond the end of the packet (git-fixes). - media: redrat3: fix UAF in probe error path leaving rc device registered (git-fixes). - media: require two-byte Cypress type 04 records (git-fixes). - media: rtl28xxu: fix SDR platform device leak (git-fixes). - media: saa7146: Initialize interrupt lock before requesting IRQ (git-fixes). - media: streamzap: Add missing rcunregisterdevice() (git-fixes). - media: stv090x: bound DiSEqC reply length to msg size (git-fixes). - media: stv0900: bound DiSEqC reply length to msg size (git-fixes). - media: tw68: balance PCI enable on cleanup (git-fixes). - media: tw686x: fix V4L2 device lifetime on probe failure (git-fixes). - media: uvcvideo: Fix NULL deref on events for uninitialized controls (git-fixes). - media: v4l2-common: Fix P010 format info (git-fixes). - media: v4l2-ctrls: do nothing if controls == NULL in cluster functions (git-fixes). - media: venus: Drop session events without an instance (git-fixes). - media: verisilicon: rockchip: Fix leaks in init (git-fixes). - media: vicodec: fix NULL deref on oversized frame (git-fixes). - media: vicodec: fix out-of-bounds write on under-rounded coded dimensions (git-fixes). - media: vicodec: make encoder CAPTURE dimensions read-only (git-fixes). - media: vicodec: zero-initialize stateful decoder heap buffers (git-fixes). - media: vidtv: fix frontend reference leak on unbind (git-fixes). - media: vidtv: fix uaf in vidtvbridgeonnewpktsavail (git-fixes). - media: vim2m: keep transaction buffer count stable while streaming (git-fixes). - media: vivid: round the height down to the vertical subsampling factor (git-fixes). - media: vpifdisplay: Fix i2c adapter reference leak in vpifprobe() (git-fixes). - mei: vsc-tp: initialize IRQ state before requesting interrupt (git-fixes). - mei: vsc: Fix packet CRC computed over pointer size (git-fixes). - mfd: ab8500: Fix child device leaks on probe failure (git-fixes). - mfd: da9150: Balance IRQ wake on teardown (git-fixes). - mfd: intelquarki2cgpio: Manage the fixed-rate clock (git-fixes). - mfd: tps65217: Check return value when masking interrupt sources (git-fixes). - mfd: tps65217: Fix NULL pointer dereference on IRQ init failure (git-fixes). - mfd: wcd934x: Fix NULL pointer dereference on IRQ probe deferral (git-fixes). - mfd: wcd934x: set DMA mask on parent to silence 'DMA mask not set' (git-fixes). - misc: enclosure: fix UAF on deviceregister() failure (git-fixes). - mm, vmscan: flush tlb before large folio is freed (bsc#1250656). - mm: introduce numpagescontiguous() (bsc#1284243). - mtd: amd76xrom: Fix PCI device reference leak in amd76xrominitone() (git-fixes). - mtd: block: prevent reclaim I/O during request processing (git-fixes). - mtd: Call getwunit() on the master partition (git-fixes). - mtd: cficmdset0002: cap the write-buffer chunk at 256 bytes on an x8 device (git-fixes). - mtd: maps: l440gx: Fix double put of the ISA bridge in initl440gx() (git-fixes). - mtd: maps: l440gx: Fix double put of the PM device in initl440gx() (git-fixes). - mtd: maps: pci: balance PCI enable on cleanup (git-fixes). - mtd: parsers: qcom: fix offset/size overflow on large partitions (git-fixes). - mtd: rawnand: atmel: Fix MCK clock leak in atmelnandcontrollerinit() (git-fixes). - mtd: rawnand: pl353: fix clk reference leak in pl35xnfcsetupinterface() (git-fixes). - mtd: rawnand: sunxi: reject ECC maximization on small pages (git-fixes). - mtd: spi-nor: sfdp: check the length of the SCCR map (git-fixes). - mtd: spi-nor: sfdp: check the length of the xSPI Profile 1.0 table (git-fixes). - mtd: spi-nor: Unprepare legacy controllers upon RWW wait interruption (git-fixes). - mtd: spinand: Fix spinandmanufacturerops kernel-doc (git-fixes). - net: usb: lan78xx: reject invalid EEPROM write requests (git-fixes). - net: usb: r8153ecm: reject short register reads (git-fixes). - net: usb: sierranet: reject short firmware attribute reads (git-fixes). - net: wwan: iosm: validate msghead before indexing msgring (git-fixes). - PCI/AER: Fix memory leak in aerrecoverqueue() on kfifo buffer overflow (git-fixes). - PCI/AER: Fix struct pcidev reference leak in aerprocesserrdevices() (git-fixes). - PCI/P2PDMA: Gate the host bridge whitelist warning on verbose (git-fixes). - PCI/P2PDMA: Safely terminate ACS redirect lists (git-fixes). - PCI/sysfs: Handle a malformed DSM result in acpiattrisvisible() (git-fixes). - PCI/sysfs: Pass the device name length in UTF-16 code units (git-fixes). - PCI/sysfs: Stop reporting DSM failures as -EPERM (git-fixes). - PCI: aardvark: Disable PHY on probe failures (git-fixes). - PCI: cadence: Preserve all error codes in cdnsplatpcieprobe() (git-fixes). - PCI: Disable MSI for ULi M1575 EHCI controller (git-fixes). - PCI: dra7xx: Fix clock enable leak on probe failure (git-fixes). - PCI: endpoint: pci-epf-vntb: Pass PF/VF number when BAR programming (git-fixes). - PCI: endpoint: pci-epf-vntb: Serialize virtual PCI bus scan (git-fixes). - PCI: Fix out-of-bounds MMIO read in nvmedisableandflr() (git-fixes). - PCI: qcom: Honor IOMMU provider's #iommu-cells in qcompcieconfigsid190() (git-fixes). - PCI: rockchip-host: Do not attempt 5.0 GT/s retraining (git-fixes). - PCI: xgene: Use managed clock for PCIe controller (git-fixes). - peci: aspeed: Initialize state before requesting IRQ (git-fixes). - phy: core: Fix race-condition between ofphyget() and trymoduleget() (git-fixes). - pinctrl: mediatek: mt7629: fix the 2.4 GHz Wi-Fi pin mode array (git-fixes). - pinctrl: sprd: free maps on DT map failure (git-fixes). - pinctrl: stm32: Fix fwnode reference leak in stm32gpiolibregisterbank() (git-fixes). - platform/chrome: crosecproto: Fix deferred response (git-fixes). - power: supply: charger-manager: Convert to platform remove callback returning void (stable-fixes). - power: supply: lp8788-charger: Convert to platform remove callback returning void (stable-fixes). - power: supply: lp8788-charger: fix use-after-free on remove (git-fixes). - power: supply: lp8788: Use devmpowersupplyregister() helper (stable-fixes). - pwm: mtk-disp: Fix period readback (git-fixes). - RDMA/core: Add rdmarestrackbegin/abort/commitdel() operations (git-fixes). - regulator: ab8500: Fix AB8505 VANA voltage selectors (git-fixes). - regulator: ab8500: Handle AB8505 VINTCORE selector 7 (git-fixes). - regulator: ab8500: Propagate mode enable read errors (git-fixes). - regulator: ab8500: Test dedicated enable bits only (git-fixes). - regulator: ab8500: Treat cut 1.0 VAUX3 as fixed (git-fixes). - regulator: core: Fix crdev reference leak in regulatorresolvecoupling() (git-fixes). - regulator: core: Fix coupled regulators reference leak on removal (git-fixes). - regulator: core: Fix rdev reference leak in regulatorresolvesupply() (git-fixes). - regulator: mp886x: check getvoltagesel() return value (git-fixes). - regulator: mp886x: fix pontential division by zero (git-fixes). - regulator: mp886x: fix vselmask (git-fixes). - regulator: rt6190: Fix runtime PM imbalance in rt6190outenable() (git-fixes). - Reinstate 'resource: avoid unnecessary lookups in findnextiomemres()' (bsc#1284243). - Revert 'wifi: mac80211: do not use old MBSSID elements' (git-fixes). - rtc: ac100: Assign .num before accessing .hws (git-fixes). - rtc: dev: zero-initialize struct rtcwkalrm to prevent information leak (git-fixes). - rtc: mpfs: fix unchecked devmclkget() error pointer in probe() (git-fixes). - rtc: spear: initialize IRQ state before requesting alarm IRQ (git-fixes). - selftests/alsa: Do not take another control's event as our own (git-fixes). - selftests/landlock: Add a new test for setuid() (git-fixes). - selftests/landlock: Fix build with non-default pthread linking (git-fixes). - selftests/landlock: Fix screwed up pointers in the scopedsignaltest (git-fixes). - selftests/landlock: Skip scopedsignal subtest with MSGOOB if not available (git-fixes). - selftests/landlock: Split signalscopingthreads tests (git-fixes). - serial: 8250lpss: do not touch uninitialized line in ehlserialexit() (git-fixes). - serial: core: shut down initialized port on removal (git-fixes). - serial: max310x: don't clobber the TX break bit in settermios (git-fixes). - serial: pmaczilog: push received data to the port that received it (git-fixes). - serial: pmaczilog: report received breaks (git-fixes). - slimbus: messaging: fix leaked PM vote on tid allocation failure (git-fixes). - soc/tegra: flowctrl: Release OF node reference on error (git-fixes). - soc: fsl: cpm1: tsa: Fix clock leak in tsaofparsetdms() (git-fixes). - soc: fsl: dpio: Fix cleanup on IRQ registration failure (git-fixes). - soc: fsl: dpio: Free the IRQ before releasing the I/O object (git-fixes). - soc: qcom: apr: clean up failed service registrations (git-fixes). - soc: ti: k3-ringacc: Correct ring API kernel-doc (git-fixes). - soc: ti: k3-ringacc: Fix DMA ring initialization kernel-doc (git-fixes). - spi: amd: fix len==0 underflow and FIFO overflow (git-fixes). - spi: bcm63xx-hsspi: Disable runtime PM on remove (git-fixes). - spi: Fix the return value in spinewancillarydevice() kernel-doc (git-fixes). - spi: jcore: fix divide-by-zero when speedhz is zero (git-fixes). - spi: mtk-nor: fix runtime PM usage count leak in probe error path (git-fixes). - spi: mxic: fix psclk leak in runtime resume (git-fixes). - spi: npcm-fiu: limit UMA datasize to the 16-byte staging buffer (git-fixes). - spi: omap2-mcspi: Remove unbalanced pmruntimeputsync() calls (git-fixes). - spi: spi-sun4i: sun4ispifillfifo(): always apply A10 FIFO fill level workaround (git-fixes). - spi: spi-sun4i: sun4ispitransferone(): fix transfers for SUN4IFIFODEPTH (git-fixes). - staging: iio: adc: ad7816: Fix DMA safety issues in SPI transfers (git-fixes). - staging: media: av7110: fix corrupted BER reporting in sp8870 (git-fixes). - staging: media: imx: csc-scaler: fix ipuimageconvertrun leak on queue error (git-fixes). - staging: rtl8723bs: clean up redundant & parentheses (stable-fixes). - Staging: rtl8723bs: Delete dead code from updatecurrentnetwork() (stable-fixes). - staging: rtl8723bs: fix buffer over-read in rtwupdateprotection (git-fixes). - staging: rtl8723bs: fix RX buffer OOB write from device-reported length (git-fixes). - Staging: rtl8723bs: Remove dead code from rtwfreenetwork() (stable-fixes). - staging: sm750fb: free cmap on framebuffer release (git-fixes). - thermal/drivers/sprd: validate the sensor id from the device tree (git-fixes). - thermal: intel: int340x: Fix temperature selection around 0 C (git-fixes). - thermal: intel: powerclamp: Reject invalid windowsize values (git-fixes). - thermal: ti-soc-thermal: Fix the return value in tibandgapgetsensordata() kernel-doc (git-fixes). - thunderbolt: Disable CL states for the Anker Prime TB5 dock (stable-fixes). - thunderbolt: Do not RPM complete unrelated subtrees on unplug (git-fixes). - tools/thermal/tmon: Fix string truncation warning in optarg copy (git-fixes). - tpm: fix zero-length read discarding the pending response (git-fixes). - tpm: tpmnsc: fix NULL pointer dereference on init failure (git-fixes). - tpm: tpmnsc: stop using the cleanup callback as dev.release (git-fixes). - tty: add breakwait kernel-doc (git-fixes). - tty: vcc: hold port lock when clearing tty pointer in vcccleanup (stable-fixes). - tty: vcc: zero-initialize control packet in vccsendctl() (stable-fixes). - um: hostfs: avoid issues on inode number reuse by host (git-fixes). - usb-storage: alauda: check the return value of alaudareadmap() (git-fixes). - usb-storage: alauda: do not do DMA from the stack (git-fixes). - usb-storage: alauda: fix out-of-bounds zone index (git-fixes). - USB: cdc-acm: fix urb leak on disconnect (git-fixes). - usb: chipidea: udc: fix DMA and SG cleanup in epnuke() (stable-fixes). - usb: dwc3: clear forceRM when issuing EndTransfer (git-fixes). - usb: dwc3: gadget: Fix use-after-free in dwc3gadgetfreeendpoints due to race condition (git-fixes). - usb: dwc3: gadget: Reinitiate stream for all host NoStream behavior (stable-fixes). - usb: fotg210: validate endpoint index in ep0 handlers (git-fixes). - usb: gadget: composite: avoid warning on aborted delayed status (git-fixes). - usb: gadget: dummyhcd: fix SuperSpeed ep0 maxpacket (git-fixes). - usb: gadget: dummyhcd: prevent unbind via sysfs (git-fixes). - usb: gadget: ffs: Fix Use-After-Free in AIO error path (git-fixes). - usb: gadget: fmassstorage: ignore class requests while inactive (git-fixes). - usb: gadget: fmidi: Annotate struct fmidi with countedby (stable-fixes). - usb: gadget: fmidi: initialize work in fmidialloc() (git-fixes). - USB: gadget: ffs: fix mm lifetime handling (stable-fixes). - usb: gadget: functionfs: Factorize wait-for-endpoint code (stable-fixes). - usb: image: microtek: stop SG processing after transfer errors (git-fixes). - usb: musb: da8xx: depopulate OF children on probe failure (git-fixes). - usb: musb: da8xx: depopulate OF children on remove (git-fixes). - usb: ohci-spear: disable controller wakeup on removal (git-fixes). - usb: ohci-spear: Remove unnecessary NULL check before clkdisableunprepare() (stable-fixes). - USB: pci-quirks: Release EHCI device reference (git-fixes). - USB: serial: cp210x: add Corsair AX1500i Power Supply (stable-fixes). - USB: serial: option: add Compal EXC-T1 support (stable-fixes). - USB: serial: option: add Compal EXM-G1x support (stable-fixes). - USB: serial: option: add Quectel EG060W (stable-fixes). - USB: serial: option: add Quectel RG660QB (stable-fixes). - USB: serial: option: add support for SIMCom SIM8260C (stable-fixes). - USB: serial: sierra: fix urb leak on write completion (git-fixes). - USB: serial: usbwwan: fix urb leak on disconnect (git-fixes). - usb: typec: ucsiccg: Add retry mechanism in ccgread (git-fixes). - USB: usbmon: fix null-ptr-deref in monbusremove() when monbusinit() fails (git-fixes). - usbnet: fix smpprocessorid() use in preemptible context (git-fixes). - vfio/type1: batch vfiofindvpfn() in function vfiounpinpagesremote() (bsc#1284243). - vfio/type1: conditional rescheduling while pinning (bsc#1284243). - vfio/type1: introduce a new member hasrsvd for struct vfiodma (bsc#1284243). - vfio/type1: optimize vfiopinpagesremote() (bsc#1284243). - vfio/type1: optimize vfiounpinpagesremote() (bsc#1284243). - vt: skip screen update for DEC alignment test on backgroup consoles (git-fixes). - watchdog: mediatek: Apply the driver's mode to a watchdog left running (git-fixes). - wifi: ath6kl: don't take RTNL in delvirtualintf (git-fixes). - wifi: ath9k: delete channel-context timers on deinit (git-fixes). - wifi: ath10k: avoid IDR mutation during TX cleanup (git-fixes). - wifi: ath11k: avoid IDR mutation during pending mgmt TX cleanup (git-fixes). - wifi: ath11k: avoid IDR mutation during vif mgmt TX cleanup (git-fixes). - wifi: ath11k: disable interrupts during firmware crash recovery (git-fixes). - wifi: ath11k: fix locking problem in ath11kdprxtiddelfunc() (git-fixes). - wifi: ath11k: fix NULL dereference in ahb remove when QMI init incomplete (git-fixes). - wifi: ath11k: Fix possible memory leak in ath11kdpsrngsetup() (git-fixes). - wifi: ath11k: fix sporadic WLAN initialization failures (git-fixes). - wifi: ath11k: fix unbalanced IRQ enable/disable during suspend/resume (git-fixes). - wifi: ath11k: modify null check logic in ath11kcerxpostpipe() (git-fixes). - wifi: ath11k: reset ar->numstations on hardware start (git-fixes). - wifi: ath11k: unregister PM notifier on QMI init failure path (git-fixes). - wifi: ath12k: avoid IDR mutation during vif mgmt TX cleanup (git-fixes). - wifi: ath12k: fix incorrect TID updation in DP monitor status path (stable-fixes). - wifi: ath12k: fix struct halrxphyrxrssilegacyinfo (stable-fixes). - wifi: ath12k: fix the fetching of combined rssi (git-fixes). - wifi: ath12k: Free allocated CE IRQs on requestirq() failure (git-fixes). - wifi: ath12k: Reserve space for a string terminator (git-fixes). - wifi: b43: don't pass unterminated string to sscanf() (git-fixes). - wifi: b43: fix use-after-free in b43bcmaremove() (git-fixes). - wifi: b43legacy: debugfs: NUL terminate string in debugfs (git-fixes). - wifi: brcmsmac: Adjust txpwrindex value in nphyiparxcalgaintbl2GHz (git-fixes). - wifi: carl9170: NUL terminate string in debugfs (git-fixes). - wifi: cfg80211: allow zero HE OBSS PD offsets (git-fixes). - wifi: cfg80211: preserve hidden-group beacon IE ownership (git-fixes). - wifi: cfg80211: reject duplicate wiphy cipher suite entries (stable-fixes). - wifi: cfg80211: track SSID regardless of country data (git-fixes). - wifi: cw1200: fix TX padding OOB read leaking heap data to device (git-fixes). - wifi: iwlegacy: 3945: free EEPROM data on remove (git-fixes). - wifi: iwlwifi: dvm: pair transport op-mode enter/leave (stable-fixes). - wifi: iwlwifi: mvm: remove mvm prefix from iwlmvmtxresp (stable-fixes). - wifi: iwlwifi: mvm: validate TXCMD response layout (stable-fixes). - wifi: iwlwifi: simplify nested if checks (stable-fixes). - wifi: mac80211: account proxy paths against the mesh path limit (git-fixes). - wifi: mac80211: Add 802.3 multicast encapsulation offload support (stable-fixes). - wifi: mac80211: Add multicast to unicast support for 802.3 path (stable-fixes). - wifi: mac80211: Add sta pointer sanity check in ieee802118023xmit() (stable-fixes). - wifi: mac80211: clear fragment cache entry 'isprotected' (git-fixes). - wifi: mac80211: don't call ieee80211handlereconfigfailure when not needed (stable-fixes). - wifi: mac80211: don't reset the TXQ scheduling round number (git-fixes). - wifi: mac80211: don't send encap offload frames unencrypted (git-fixes). - wifi: mac80211: drain PS delivery work during station teardown (git-fixes). - wifi: mac80211: drop encap offload frames with a tainted key (git-fixes). - wifi: mac80211: Fix a race when expiring a mesh path (git-fixes). - wifi: mac80211: fix encryption tailroom (git-fixes). - wifi: mac80211: fix key selection for encap offload frames (git-fixes). - wifi: mac80211: fix mesh fast xmit path deletion UAF (git-fixes). - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (stable-fixes). - wifi: mac80211: fix swapped fqoverlimit/fqovermemory in aqm debugfs (git-fixes). - wifi: mac80211: Fix the return value in meshpathadd() kernel-doc (git-fixes). - wifi: mac80211: fix typo in HE MCS check (stable-fixes). - wifi: mac80211: fix unauthorised port check for encap offload (git-fixes). - wifi: mac80211: handle empty FILS association request payload (git-fixes). - wifi: mac80211: init radiotap iter after length checks (git-fixes). - wifi: mac80211: kill waketxqstasklet on unregistration (git-fixes). - wifi: mac80211: limit injected HT/VHT MCSes (git-fixes). - wifi: mac80211: log link information in ieee80211determinechanmode (stable-fixes). - wifi: mac80211: mesh: use hlistaddheadrcu() (git-fixes). - wifi: mac80211: minstrelht: validate fixed rate index (git-fixes). - wifi: mac80211: prevent AP VLAN tx from other interfaces (git-fixes). - wifi: mac80211: refactor populating mesh related fields in sinfo (stable-fixes). - wifi: mac80211: release mesh path quota on failed additions (git-fixes). - wifi: mac80211: reserve MME tailroom for protected beacons (git-fixes). - wifi: mac80211: set info->band for 802.3 encap offload frames (git-fixes). - wifi: mac80211: use link address as TA for non-MLO 4-addr station on MLD AP (git-fixes). - wifi: mt76: feed the station RSSI average from the chain signals (git-fixes). - wifi: mt76: fix memory leak in USB TX path (git-fixes). - wifi: mt76: Fix ofnode reference leak in mt76getratepowerlimits() (git-fixes). - wifi: mt76: fix unlocked wcid check in mt76txstatusskbadd() (git-fixes). - wifi: mt76: fix wcid->pktid corruption in mt76wcidcleanup() (git-fixes). - wifi: mt76: mt76x02: validate RX padding before use (git-fixes). - wifi: mt76: mt76x02: validate TX-status rate index before mac80211 handoff (git-fixes). - wifi: mt76: mt792x: fix UAF in SDIO TX path when out of memory (git-fixes). - wifi: mt76: mt7603: don't drop short frames looped back on PS entry (git-fixes). - wifi: mt76: mt7615: cancel reset work during unregister (git-fixes). - wifi: mt76: mt7615: do not tear down BSS/STA state for monitor vifs (git-fixes). - wifi: mt76: mt7615: read MT7663 temperature from the correct offset (git-fixes). - wifi: mt76: mt7615: usb: fix source overread in mt7663ucopy (git-fixes). - wifi: mt76: mt7615: validate MCU response lengths (git-fixes). - wifi: mt76: mt7915: allocate vif wcid in the same range as stations (stable-fixes). - wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy (git-fixes). - wifi: mt76: mt7915: check default EEPROM firmware size before copying (git-fixes). - wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear (git-fixes). - wifi: mt76: mt7915: Fix an error handling path in mt7915addinterface() (git-fixes). - wifi: mt76: mt7915: guard firmware memory dump write on disabled memdump (git-fixes). - wifi: mt76: mt7915: set correct background radar capability (stable-fixes). - wifi: mt76: mt7915: unregister thermal cooling device on hwmon failure (git-fixes). - wifi: mt76: mt7921: check drvpmctrl return in the PCIe reset path (git-fixes). - wifi: mt76: mt7921: fix lock inversion between dev->mutex and iflistmtx (git-fixes). - wifi: mt76: mt7921: fix the lock inversion in suspend and resume (git-fixes). - wifi: mt76: mt7925: check drvpmctrl return in the PCIe reset path (git-fixes). - wifi: mt76: mt7925: fix lock inversion between dev->mutex and iflistmtx (git-fixes). - wifi: mt76: mt7925: fix the lock inversion in suspend and resume (git-fixes). - wifi: mt76: mt7925: honour mac80211's FIFFCSFAIL instead of hardcoding droperr (git-fixes). - wifi: mt76: mt7925: restore the reset state when fwpmctrl fails (git-fixes). - wifi: mt76: mt7996: fix PLE free page and AC queue register offsets (git-fixes). - wifi: mt76: mt7996: validate firmware event lengths before parsing (git-fixes). - wifi: mt76: usb: fix source overread in mt76ucopy (git-fixes). - wifi: mwifiex: append hotfix number to firmware version string (git-fixes). - wifi: rtw88: debugfs: don't vzalloc(0) when rsvdpage is read unconfigured (git-fixes). - wifi: rtw88: debugfs: support multiple adapters debugging (stable-fixes). - wifi: rtw88: fix out-of-bounds CAM write when key table is full (git-fixes). - wifi: rtw88: sdio: zero the padding added to a TX transfer (git-fixes). - wifi: rtw89: 8851b: fix swapped DPK channel/bandwidth backup fields (git-fixes). - wifi: rtw89: cap firmware sectionnum before parsing (git-fixes). - wifi: wfx: fix possible device hang during init (git-fixes). - wifi: wfx: fix use-after-free of the cooling work on device removal (git-fixes). - wifi: wfx: validate MIB read length before copying to caller (git-fixes). - wwan: wwanhwsim: Pin module for debugfs file operations (git-fixes). - x86/hyperv: Avoid using per-cpu output page in hvapicidtovpindex() (git-fixes). - x86/PCI: Disable enhanced atomics on AMD NBIO 7.7 and 7.11 (git-fixes). - xhci: dbc: lock the minor IDR on registration failure (git-fixes).