- Update to 5.10.270.
- 8139cp: fix Rx and Tx not being disabled in cp_suspend
- 9p: skip nlink update in cacheless mode to fix WARN_ON
- accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status()
- accessibility: speakup: unregister tty ldisc on later init failures
- ACPI: move from strlcpy() with unused retval to strscpy()
- ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root
- ACPI: processor: idle: Expand _LPI package sanity checks
- ACPI: processor: validate MADT IOAPIC entry bounds
- ACPI: utils: Document for_each_acpi_dev_match() macro
- af_packet: Don't send zero-byte data in tpacket_snd().
- ALSA: 6fire: bound the MIDI event length from the device
- ALSA: 6fire: Fix UAF at error handling during probe
- ALSA: aloop: Fix racy access at PCM trigger
- ALSA: bcd2000: clear the URB pointers on disconnect
- ALSA: hda: Fix cached processing coefficient verbs
- ALSA: hda: Fix connection list comparison in proc output
- ALSA: hpi: Check transport errors during HPI6000 adapter initialization
- ALSA: lx6464es: fix period byte count for 16-bit streams
- ALSA: mpu401: Check card index validity at probe
- ALSA: mts64: Check card index validity at probe
- ALSA: pcm: Fix race between non-atomic ops and trigger-start
- ALSA: pcm: wake linked drain waiters on unlink
- ALSA: portman2x4: Check card index validity at probe
- ALSA: seq: close a re-opened queue timer in the destructor
- ALSA: serial-u16550: Check card index validity at probe
- ALSA: usb-audio: Clamp frame size in implicit-feedback mode
- ALSA: usb-audio: Evaluate packsize caps at the right place
- ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set
- ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()
- ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()
- ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output()
- ALSA: usb-audio: fix OOB write on Type II inbound URBs
- ALSA: usx2y: bound the hwdep mmap fault offset
- ALSA: usx2y: Fix potential leaks of uninitialized memory
- ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer()
- amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN
- ASoC: bt-sco: fix bt-sco-pcm-wb dai widget don't connect to the endpoint
- ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI
- ASoC: cs35l33: drain threaded IRQ before runtime suspend
- ASoC: cs35l34: drain threaded IRQ before runtime suspend
- ASoC: cs4265: sort the register default table
- ASoC: dapm: Fix off-by-one check on the second enum channel
- ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure
- ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready
- AsoC: intel: sst: fix PCI device reference leak on probe failure
- ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup
- ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup
- ASoC: mediatek: mt8183: Check runtime resume during probe
- ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop
- ASoC: meson: Keep link pointers valid on realloc failure
- ASoC: pxa: Use devm_clk_get_optional() for extclk clock
- ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get
- ASoC: tas2562: fix broken entries in the volume lookup table
- ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup
- ASoC: tas2562: fix DVC coefficient write order
- ASoC: xilinx: formatter_pcm: fix stream_data leak on open error
- ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers
- assoc_array: trim the final shortcut word using the current chunk end
- ata: ahci: work around lost interrupts on Marvell 88SE61xx
- ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes
- ata: pata_sl82c105: fix bridge revision use-after-free
- ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered
- ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts
- ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning
- ata: sata_dwc_460ex: remove variable num_processed
- ath11k: add trace log support
- audit: avoid dropping live tree ref on fsnotify rule autoremove
- audit: fix potential integer overflow in audit_log_n_string()
- audit: fix potential use-after-free in audit_del_rule()
- audit: fix recursive locking deadlock in audit_dupe_exe()
- audit: use 'unsigned int' instead of 'unsigned'
- audit: widen ino fields to u64
- batman-adv: bla: avoid CRC corruption due to parallel claim add
- batman-adv: bla: fix freeing of claims on meshif deletion
- batman-adv: bla: prevent CRC corruptions after claim flush
- batman-adv: dat: avoid unaligned fault in IP extraction
- batman-adv: fix stale receive device on merged fragments
- binfmt_elf_fdpic: only honour the first PT_INTERP
- binfmt_misc: reject a flag character as the field delimiter
- binfmt_misc: restore write access when removing an entry
- binfmt_misc: set have_execfd only once the interpreter is opened
- binfmt_misc: use exe_file_deny_write_access() for the interpreter clone
- bitfield: Add less-checking __FIELD_{GET,PREP}()
- bitfield: Add non-constant field_{prep,get}() helpers
- block/blk-iocost: collect per-cpu latency stats over possible CPUs
- block/blk-stat: drain per-cpu callback stats over possible CPUs
- block/kyber-iosched: flush per-cpu latency buckets over possible CPUs
- Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister
- Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev
- Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX
- Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU
- Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU
- Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855()
- Bluetooth: compute LE flow credits based on recvbuf space
- Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative
- Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection
- Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative
- Bluetooth: hci_uart: Fix false success return in hci_uart_setup()
- Bluetooth: HIDP: reject frames without a transaction header
- Bluetooth: HIDP: validate numbered report payloads
- Bluetooth: L2CAP: Fix send LE flow credits in ACL link
- Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref
- Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp
- Bluetooth: MSFT: validate evt_prefix_len against the response length
- Bluetooth: RFCOMM: Fix session UAF in set_termios
- Bluetooth: RFCOMM: serialize security confirmation handling
- Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept
- Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop
- Bluetooth: SCO: Fix UAF on sco_sock_timeout
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold
- bluetooth/l2cap: sync sock recv cb and release
- bnx2x: fix double free in bnx2x_init_firmware() error path
- bnxt_en: Disable EOP for TPA on all chips to prevent data corruption
- bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips
- bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor
- bonding: initialize err for empty target lists
- bootconfig: do not put quotes on cmdline items unless necessary
- bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline()
- bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c
- bpf: Enforce expected_attach_type for tailcall compatibility
- bpf: Fix ld_{abs,ind} failure path analysis in subprogs
- bpf: Fix pending_pos walk on 32-bit ring position wrap
- bpf: Fix potential UAF in bpf_netns_link_update_prog
- bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops
- bpf: Fix use-after-free in offloaded map/prog info fill
- bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux
- bpf: Guard stack limits against 32bit overflow
- bpf: lwt: Fix dst reference leak on reroute failure
- bpf: Preserve pointer state for commuted arithmetic
- bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized
- bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec()
- bpf: Reject negative optlen in cgroup getsockopt hook
- bpf: Remove tst_run from lwt_seg6local_prog_ops.
- bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()
- bpf, sockmap: Fix sk_redir use-after-free in send verdict
- bpftool: Fix double close in map dump
- bridge: mrp: reject zero test interval to avoid OOM panic
- btrfs: reject free space cache with more entries than pages
- btrfs: remove crc_check logic from free space
- bus: ti-sysc: Fix /chosen node reference leak
- can: bcm: add locking when updating filter and timer values
- can: bcm: add missing device refcount for CAN filter removal
- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF
- can: bcm: extend bcm_tx_lock usage for data and timer updates
- can: bcm: fix CAN frame rx/tx statistics
- can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()
- can: bcm: fix stale rx/tx ops after device removal
- can: bcm: track a single source interface for ANYDEV timeout/throttle ops
- can: bcm: validate frame length in bcm_rx_setup() for RTR replies
- can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure
- can: isotp: check register_netdevice_notifier() error in module init
- can: isotp: fix timer drain order, wakeup handling and tx_gen ordering
- can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER
- can: isotp: serialize TX state transitions under so->rx_lock
- can: j1939: fix lockless local-destination check
- can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer
- can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams()
- can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents
- can: peak_usb: add bounds check for USB channel index
- can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error
- can: peak_usb: validate uCAN receive record lengths
- can: softing: fw_parse(): validate firmware record spans
- can: use skb hash instead of private variable in headroom
- cdrom: fix stack out-of-bounds read in CDROMVOLCTRL
- ceph: avoid fs reclaim while using current->journal_info
- ceph: bound xattr value length in __build_xattrs()
- ceph: fix hanging __ceph_get_caps() with stale mds_wanted
- ceph: fix MDS random selection readiness predicate
- ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()
- ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock
- ceph: rename _to_client() to _to_fs_client()
- char: xilinx_hwicap: unregister class on init errors
- cifs: fix clearing stats for fastest execution of each smb2 command
- clk: hisilicon: reset: Use devm_kzalloc to initialize hisi_reset_controller
- clk: imx: scu: Add A53 frequency scaling support
- clk: imx: scu: Add A72 frequency scaling support
- clk: imx: scu: drop redundant init.ops variable assignment
- clk: meson: align gxbb_32k_clk_sel number of parents with actual count
- clk: moxart: remove unused variables, fix refcount leak
- clk: palmas: Manage external-control prepare with devm
- clk: qcom: gcc-msm8916: Fix enable_reg for gcc_blsp1_sleep_clk
- clk: qcom: gcc-msm8939: Fix enable_reg for gcc_blsp1_sleep_clk
- clk: qcom: gdsc: Bump parent usage count when GDSC is found enabled
- clk: qcom: gdsc: Capture pm_genpd_add_subdomain result code
- clk: qcom: gdsc: enable optional power domain support
- clk: qcom: gdsc: propagate gdsc_check_status() errors from gdsc_poll_status
- clk: qcom: gdsc: propagate gdsc_enable() failure for ALWAYS_ON domains
- clk: qcom: gdsc: Release pm subdomains in reverse add order
- clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister()
- clk: qcom: Return expected ENOMEM error on dynamic allocation failure
- clk: tegra: tegra124-emc: put EMC node on register failure
- clk/x86: pmc_atom: add kasprintf return value check
- clocksource: Unregister subsystem on device registration failure
- clocksource/drivers/armada: Unwind timer clock on init failure
- clocksource/drivers/clps711x: Do not unmap clocksource MMIO
- clocksource/drivers/timer-sun4i: Advertise a real minimum delta
- comedi: comedi_parport: deal with premature interrupt
- counter: microchip-tcb-capture: Fix DT channel validation
- cpu: hotplug: Bound hotplug states sysfs output
- cpufreq: imx6q: fix devres accumulation across driver rebind
- cpufreq: imx6q: fix out-of-bounds write when probed more than once
- cpufreq: intel_pstate: Simplify intel_cpufreq_update_pstate()
- cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init()
- cpufreq: schedutil: Add util to struct sg_cpu
- cpufreq: schedutil: Fix rate limit overflow
- cpufreq: schedutil: Fix self-contradictory comment in sugov_iowait_apply()
- cpufreq: spear: Fix an IS_ERR() vs NULL bug in spear1340_set_cpu_rate()
- crypto: atmel-ecc - clean up and improve ECDH comments
- crypto: atmel-ecc - reject hardware ECDH without a public key
- crypto: atmel-ecc - replace min_t with min
- crypto: atmel-ecc - Struct headers need to start with keyword 'struct'
- crypto: atmel-sha204a - fix heap info leak on I2C transfer failure
- crypto: atmel-tdes - use scatterlist length before DMA mapping
- crypto: ccm - Set rfc4309 maxauthsize from child
- crypto: ecdh - extend 'cra_driver_name' with curve name
- crypto: ecdh - fix 'ecdh_init'
- crypto: ecdh - fix ecdh-nist-p192's entry in testmgr
- crypto: ecdh - move curve_id of ECDH from the key to algorithm name
- crypto: mxs-dcp - fix source scatterlist length access
- crypto: qce - fix error path in devm_qce_register_algs
- crypto: rsa-pkcs1pad: Don't WARN on an empty digest
- crypto: sa2ul - stop probe if context pool creation fails
- crypto: sa2ul - Use the defined variable to clean code
- crypto: testmgr - fix initialization of 'secret_size'
- csky: Fix a4/a5 restoration in syscall trace path
- device property: Add fwnode_irq_get_byname
- dm array: reject an array block whose value size is not the caller's
- dm: fix resume-vs-remove race
- dm raid1: reserve space for NUL-terminator in build_constructor_string()
- dma-buf/drivers: make reserving a shared slot mandatory v4
- dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning
- dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK
- dmaengine: dw-edma: Clear stale requests on termination
- dmaengine: dw-edma: Complete descriptors before pausing
- dmaengine: dw-edma: Improve the linked list and data blocks definition
- dmaengine: dw-edma: Remove unused irq field in struct dw_edma_chip
- dmaengine: dw-edma: Serialize abort state updates
- dmaengine: dw-edma: Serialize channel state checks
- dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe
- dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure
- dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+
- dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal
- dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA
- dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers
- dm-era: fix shadowed superblock leak on take-snap failure
- dm-integrity: don't increment hash_offset twice
- dm-stats: fix a crash if allocation of per-cpu data fails
- dm-switch: use WRITE_ONCE() in switch_region_table_write()
- dm-verity: make error counter atomic
- driver core: platform: change logic implementing platform_driver_probe
- driver core: platform: don't oops in platform_shutdown() on unbound devices
- driver core: platform: Emit a warning if a remove callback returned non-zero
- driver core: platform: reorder functions
- driver core: platform: use bus_type functions
- driver core: soc: remove layering violation for the soc_bus
- driver core: soc: Unregister bus on early device registration failure
- drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used
- drm: fix race between partial drm_dev_register() failure and ioctl
- drm/amd/display: avoid divide-by-zero in __is_lut_linear()
- drm/amdgpu: cap GTT size to physical RAM on APUs
- drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved
- drm/amdgpu: fix division by zero with invalid uvd dimensions
- drm/amdgpu: Fix UVD decode image min size calculation
- drm/amdgpu: Fix VFCT bus number matching with soft filter
- drm/amdgpu: Implement insert_end for VCE 3
- drm/amdgpu: invoke pm_genpd_remove() before freeing genpd
- drm/amdgpu: Reject UVD message with dimensions above 4096
- drm/amdgpu: Reject UVD message with invalid number of h265 refs
- drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT
- drm/amdgpu: validate GEM_CREATE domain combinations
- drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON()
- drm/amdgpu/gfx6: Fixup emit_cntxcntl()
- drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets
- drm/amdgpu/gfx6: Use PFP on the compute queues too
- drm/amdgpu/gfx8: drop unecessary BUG_ON()
- drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON()
- drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup
- drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup
- drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON()
- drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON()
- drm/amd/pm: fix torn gpu metrics reads
- drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X)
- drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure
- drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure
- drm/bridge: tc358767: clamp the reported AUX read size to the request
- drm/displayid: fix Tiled Display Topology ID size
- drm/dp/mst: fix buffer overflows in sideband chunk accumulation
- drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers
- drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers
- drm/hibmc: Fix list of formats on the primary plane
- drm/i915/gt: use correct selftest config symbol
- drm/i915/hdcp: require monotonically increasing seq_num_v
- drm/i915/selftests: Fix GT PM sort comparators
- drm/lima: call drm_mm_init() with a valid allocation range
- drm/msm/dsi: Drop dev_pm_opp_set_rate(0)
- drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit()
- drm/panel: samsung-s6d16d0: Power off on prepare failure
- drm/radeon: fix autosuspend cleanup during teardown
- drm/radeon: fix r100_copy_blit for large BOs
- drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video()
- drm/sun4i: crtc: Propagate layer initialization error
- drm/sun4i: dw-hdmi: Drop TCON TOP port reference
- drm/sun4i: fix refcount leak in sun4i_backend_init_sat()
- drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz
- drm/sun4i: tcon: Drop remote endpoint reference
- drm/sun4i: tcon: Drop TCON TOP device reference
- drm/sun4i: vi scaler: Fix coefficient selection
- drm/tegra: fbdev: Remove offset into framebuffer memory
- drm/tve200: add OF module alias for autoloading
- drm/vc4: Zero the tile state data array before each BIN job
- drm/virtio: bound EDID block reads to the response buffer
- drm/virtio: Return proper error codes instead of -1
- drm/virtio: use uninterruptible resv lock for plane updates
- drm/vmwgfx: bound DMA command body size against suffix pointer
- drm/vmwgfx: drop dma_buf reference on foreign-fd prime import
- drm/vmwgfx: validate DRAW_PRIMITIVES header size before division
- drm/vmwgfx: Validate vmw_surface_metadata::array_size
- e1000: fix memory leak in e1000_probe()
- eCryptfs: bound the packet-length peek to the user buffer
- ecryptfs: fix tag 11 packet exact-fit size check
- ecryptfs: hold msg ctx list lock when cleaning daemon queue
- ecryptfs: pass packet set buffer size to parser
- ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet
- ecryptfs: reject too-small tag 70 packets
- ecryptfs: release message context on send failure
- ecryptfs: show filename encryption options
- entry: Fix seccomp bypass after ptrace with TSYNC
- espintcp: remove encap socket caching to avoid reference leak
- espintcp: use sk_msg_free_partial to fix partial send
- exec: fix unsigned loop counter wrap in transfer_args_to_stack()
- ext4: clear error before retrying inode xattr space fallback
- ext4: don't enable DAX on new encrypted files
- ext4: drain in-flight DIO before buffered write fallback
- ext4: propagate errors from fast commit range replay
- ext4: skip extra isize expansion during mount to prevent deadlock
- ext4: stop retrying saturated xattr cache entries
- f2fs: fix i_size when pinned fallocate partially fails
- f2fs: fix UAF issue in f2fs_merge_page_bio()
- f2fs: reject overlapping move range after len expansion
- f2fs: return symlink writeback errors
- fanotify: report full event length for FIONREAD
- fat: release buffer head after rebuilding parent
- fat: restore original value when fat_ent_write failed
- fbdev: bitblit: bound-check glyph index in bit_cursor()
- fbdev: kyro: Validate overlay viewport coordinates
- fbdev: omapfb: panel-dsi-cm: initialize lock before registering display
- fbdev: pvr2fb: correct user pointer annotation and sentinel initializer
- fbdev: uvesafb: unregister connector callback on init failure
- firewire: net: Fix fragmented datagram reassembly
- firmware: coreboot: Check size of table entry and use flex-array
- firmware: coreboot: Validate table bounds
- firmware: google: Add bounds checks in coreboot_table_populate()
- firmware: stratix10-svc: Add mutex in stratix10 memory management
- firmware: stratix10-svc: fix memory leaks and list corruption bugs
- firmware_loader: Check fw_state_is_done in loading_store
- firmware_loader: do not queue completed sysfs fallback requests
- firmware_loader: introduce __free() cleanup hanler
- forcedeth: fix off-by-one when saving/restoring non-PCI config space
- forcedeth: fix UAF of txrx_stats in nv_remove
- forcedeth: stop the tx_timeout register dump past the requested window
- fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write
- fpga: dfl: fme: add error handling
- fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()
- fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration
- fs: don't block write during exec on pre-content watched files
- fscrypt: Replace mk_users keyring with simple list
- fsnotify: Fix stale object mask after concurrent mark updates
- fsnotify: opt-in for permission events at file open time
- fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list
- ftrace: Add global mutex to serialize trace_parser access
- ftrace: Fix off-by-one fentry site disable in ftrace_free_mem()
- futex: Prevent robust futex exit race some more
- geneve: require CAP_NET_ADMIN in the device netns for changelink
- gpio: ml-ioh: use raw_spinlock_t for the register lock
- gpio: pch: use raw_spinlock_t for the register lock
- gpio: tegra: do not call pinctrl for GPIO direction
- gpu: host1x: Avoid stack over-read in debug output helpers
- gpu: host1x: Fix offset calculation in trace_write_gather
- greybus: audio: bound the topology section sizes against the fetched size
- gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free
- hfsplus: validate thread record before delete key rebuild
- HID: core: fix number/pointer type confusion on long items
- HID: core: fix OOB read of field->usage in hid_set_field()
- HID: core: quiesce input in hid_hw_stop() to prevent use-after-free
- HID: ensure timely release of driver-allocated resources
- HID: fix an error code in hid_check_device_match()
- HID: hyperv: validate initial device info bounds
- HID: i2c-hid: Fix "(null)" output when reading report descriptor fails
- HID: i2c-hid: Switch i2c_hid_parse() to goto style error handling
- HID: input: read battery capacity from its actual report offset
- HID: lg4ff: validate report length before fixed offsets
- HID: logitech-dj: Fix maxfield check in DJ short report validation
- HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report
- HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write
- HID: logitech-dj: Standardise hid_report_enum variable nomenclature
- HID: magicmouse: do not keep a stale msc->input if no input is claimed
- HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID
- HID: mcp2221: validate report size in mcp2221_raw_event()
- HID: picolcd: clamp eeprom debugfs read to bytes actually received
- HID: rmi: fix OOB access with undersized RMI reports
- HID: roccat: bound device-supplied profile index
- HID: roccat: free buffered reports when destroying device
- HID: sensor: custom: Fix field sysfs group cleanup on failure
- HID: sensor: custom: Fix use-after-free in enable_sensor
- HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature
- HID: split apart hid_device_probe to make logic more apparent
- HID: synchronize input before cleaning up a failed probe
- HID: wacom: validate report length in wacom_intuos_pro2_bt_irq
- highmem: Provide generic variant of kmap_atomic*
- hinic: remove unused ethtool RSS user configuration buffers
- hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device
- hsr: Use a single struct for self_node.
- hugetlbfs: release subpool on fill_super failure
- hwmon: (adt7470) Add missing dependency on REGMAP_I2C
- hwmon: (adt7470) Convert to use regmap
- hwmon: (adt7470) Create functions for updating readings and limits
- hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread
- hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors
- hwmon: (adt7470) Fix PWM auto temp state array and bounds check
- hwmon: (adt7470) Fix some style issues
- hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks
- hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop
- hwmon: (emc1403) Add support for EMC1442
- hwmon: (max6621) fix negative temperature offset and crit readings
- hwmon: (max6621) fix temperature clamp range
- hwmon: (nct6775-core) Prevent access to unsupported weight registers
- hwmon: (npcm750-pwm-fan): stop fan timer on device detach
- hwmon: (pmbus) Fix return value from pmbus_update_byte_data()
- hwrng: ks-sa - access private data via struct hwrng
- hwrng: ks-sa - Fix runtime PM cleanup on registration failure
- hwspinlock: propagate errno when registering single lock
- i2c: amd-mp2: Unregister callback on adapter add failure
- i2c: bcm-iproc: remove printout on handled timeouts
- i2c: davinci: Unregister cpufreq notifier on probe failure
- i2c: imx: fix locked bus on SMBus block-read of 0 (atomic)
- i2c: imx: separate atomic, dma and non-dma use case
- i2c: iproc: reset bus after timeout if START_BUSY is stuck
- i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock
- i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure
- i2c: mux: Fix channel node leak on adapter add failure
- i2c: smbus: Check for parent device before dereference
- i2c: smbus: Use device_*() functions instead of of_*()
- i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices
- i3c: master: Fix device_register() error path
- i3c: master: Fix info leak and UAF in device unregister path
- IB/isert: delay the final Login Response until the session is registered
- IB/isert: post the full-feature receive buffers after session registration
- IB/isert: reject login PDUs declaring more data than was received
- IB/isert: reject PDUs declaring more data than was received
- IB/mad: Drop unmatched RMPP responses before reassembly
- ice: fix memory leak in ice_lbtest_prepare_rings()
- ice: fix VF interrupts cleanup
- igbvf: Fix leak in TX DMA error cleanup
- iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE
- iio: chemical: sgp30: Handle IAQ thread creation failure
- iio: dac: m62332: Fix regulator reference count imbalance
- iio: gyro: mpu3050: fix sign of raw angular velocity readings
- iio: light: cm32181: return zero after writing calibscale
- iio: light: gp2ap002: Disable regulators on resume failure
- iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes
- iio: light: gp2ap002: re-enable irq if runtime suspend fails
- iio: light: isl29028: return zero in write_raw() on success
- iio: light: tsl2583: return zero in write_raw() on success
- iio: light: tsl2772: fix ALS calibscale readback
- iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure
- iio: srf04: fix pm_runtime handling on probe error path
- iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register()
- ila: reload IPv6 header after pskb_may_pull in checksum adjust
- ima: fix out-of-bounds read in xattr_verify()
- include/linux/list.h: mark list_add and __list_add as __always_inline
- inet: frags: publish queues before arming timer
- inet: frags: strip GSO state from fragments before reassembly
- Input: aiptek - validate raw macro indices before updating state
- Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard
- Input: evdev - fix information leak in evdev_pass_values()
- Input: evdev - sanitize event type index when fetching event masks
- Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet
- Input: iforce - validate input packet lengths
- Input: ims-pcu - fix firmware leak in async update
- Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()
- Input: ims-pcu - fix logic error in packet reset
- Input: ims-pcu - fix race condition in reset_device sysfs callback
- Input: mms114 - reject an oversized device packet size
- Input: psxpad-spi - set driver data before use
- Input: sur40 - fix input device registration ordering
- Input: sur40 - fix V4L error path cleanup
- Input: synaptics-rmi4 - block s_input when F54 queue is busy
- Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer
- Input: synaptics-rmi4 - fix F55 transmitter electrode count typo
- Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue
- Input: synaptics-rmi4 - zero report size on F54 work error
- intel_th: fix MSC output device reference leak
- interconnect: Fix use after free in icc_get() and of_icc_get_by_index()
- iomap: adjust read range correctly for non-block-aligned positions
- iommu/amd: Add support for Hygon family 18h model 4h IOAPIC
- iommu/amd: Bound the early ACPI HID map
- iommu/amd: Fix false positive in SB IOAPIC IVRS validation
- iommu/amd: Prevent SB IOAPIC from overriding IVRS validation errors
- iommu/dma: Check atomic pool allocation result directly
- iommu/msm: Return -ENOMEM on memory allocation failure in probe
- iommu/qcom: Fix inverted fault report check in qcom_iommu_fault()
- iommu/qcom: Remove sysfs device on probe failure path
- iommu/vt-d: Disallow SVA if page walk is not coherent
- iommu/vt-d: Fix no_iommu to disable platform opt-in
- iommu/vt-d: Fix UCTP context table slot when copying root entries
- io_uring/io-wq: fix worker accounting when canceling creation callbacks
- iov_iter: lift memzero_page() to highmem.h
- ip6_gre: fix hardware header length for NBMA tunnels
- ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
- ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()
- ipmi: ipmb: validate write message length
- ipmi: si: Fix NULL pointer dereference after failed registration
- ipv4: fib: free fib_alias with kfree_rcu() on insert error path
- ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
- ipv4: fix use-after-free in fib_nhc_update_mtu()
- ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup
- ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()
- ipv4: reject undersized MTUs in ip_do_fragment()
- ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump
- ipv6: fix Route Information option length validation
- ipv6: fix use-after-free in ip6_finish_output2()
- ipv6: mcast: Fix use-after-free when processing MLD queries
- ipv6: prevent in6_dev_get() from resurrecting inet6_dev
- ipv6: seg6: clear IPv4 control block on IPIP decapsulation
- ipv6: use RCU iterator to dump route exceptions
- ipvs: add totalconns for dest
- ipvs: clear IPv4 options after rebasing tunnel ICMP errors
- ipvs: do not propagate one-packet flag to synced conns
- ipvs: fix integer overflow in ftp helper port/address parsing
- ipvs: properly update the overload flag on dest edit
- ipvs: reload ip header after head reallocation
- ipvs: separate destination availability state
- irqchip/gic-v3-its: Fix memleak in its_probe_one()
- irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc()
- irqdomain: Handle additional domain flags in irq_domain_instantiate()
- irqdomain: Introduce irq_domain_instantiate()
- isofs: release zisofs block pointer buffer head
- jbd2: add a helper to find out number of fast commit blocks
- jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit()
- jfs: add check read-only before truncation in jfs_truncate_nolock()
- jfs: add check read-only before txBeginAnon() call
- kcov: fix data corruption and race conditions on PREEMPT_RT
- keys: fix out-of-bounds read in keyring_get_key_chunk()
- keys: make keyring key-chunk byte order agree with keyring_diff_objects()
- KVM: Introduce vcpu->wants_to_run
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR
- KVM: VMX: Make vmread_error_trampoline() uncallable from C code
- KVM: x86: Check for in-kernel xAPIC when querying APICv for directed yield
- KVM: x86: Drop @vcpu parameter from kvm_x86_ops.hwapic_isr_update()
- KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock
- KVM: x86: Move "apicv_active" into "struct kvm_lapic"
- KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN
- KVM: x86/mmu: Fix use-after-free on vendor module reload
- leds: pca9532: Fix inverted GPIO output polarity
- leds: pca9532: Fix phantom device registration on missing hardware
- libceph: add doutc and *_client debug macros support
- libceph: Amend checking to fix `make W=1` build breakage
- libceph: Avoid using invalid osd indices from primary_temp
- libceph: bound get_version reply decode to front len
- libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE
- libceph: fix multiple unsafe decodes in decode_locker()
- libceph: Fix multiplication overflow in decode_new_up_state_weight()
- libceph: fix OOB read in decode_watchers() via missing bounds check
- libceph: fix two unsafe bare decodes in decode_lockers()
- libceph: guard missing CRUSH type name lookup
- libceph: refresh auth->authorizer_buf{,_len} after authorizer update
- libceph: reject buckets with mismatched CRUSH ids
- libceph: reject zero bucket types in crush_decode
- libceph: remove debugfs files before client teardown
- libnvdimm/labels: Bound the on-media label size before the shift
- libnvdimm/labels: Prevent integer overflow in __nd_label_validate()
- lib/string: fix memchr_inv() for large ranges
- lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone
- lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()
- lockd: pin next file across nlm_inspect_file lock-drop
- locking/lockdep: Fix NULL pointer dereference in __lock_set_class()
- lsm: infrastructure management of the sock security
- lsm: use default hook return value in call_int_hook()
- lwt_bpf: Restore reserved headroom after xmit program
- mac80211: add ieee80211_is_tx_data helper function
- mac80211_hwsim: add 6GHz channels
- mac802154: llsec: reject frames shorter than the authentication tag
- macsec: don't read an unset MAC header in macsec_encrypt()
- mailbox: rockchip: disable pclk on probe failure and unbind
- md: do overflow check for sb->bblog_shift in super_1_load()
- md/raid5-ppl: fix use-after-free in ppl_do_flush()
- media: ACPI / bus: Add acpi_dev_get_next_match_dev() and helper macro
- media: airspy: Return queued buffers on start_streaming() failure
- media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref
- media: aspeed: fix missing of_reserved_mem_device_release() on probe failure
- media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash
- media: cec: seco: unregister adapter on IR probe failure
- media: cec: Serialize exclusive follower delivery
- media: cec: stm32: prevent out-of-bounds write on RX overflow
- media: cec-pin: Fix event FIFO ordering
- media: cedrus: clean up media device on probe failure
- media: cedrus: fix memory leak in cedrus_init_ctrls()
- media: cedrus: Fix missing cleanup in error path
- media: cedrus: skip invalid H.264 reference list entries
- media: cobalt: Avoid freeing ALSA private data twice
- media: cx231xx: fix devres lifetime
- media: cx231xx: reject geometry changes while the VBI queue is busy
- media: cx23885: add ioremap return check and cleanup
- media: cx23885: cancel NetUP CI work before teardown
- media: em28xx: defer audio-only extension registration
- media: em28xx: fix use-after-free of dev_next->devlist on disconnect
- media: go7007: defer the ALSA v4l2 put until card release
- media: i2c: imx219: Correct the minimum vblanking value
- media: i2c: imx219: Drop IMX219_VTS_* macros
- media: i2c: imx219: Rename VTS to FRM_LENGTH
- media: i2c: ov7740: fix use-after-destroy in remove
- media: imx219: Fix maximum frame length in lines
- media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define
- media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define
- media: marvell-cam: fix missing pci_disable_device() on remove
- media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization
- media: meson: vdec: Fix memory leak in error path of vdec_open
- media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common
- media: msi2500: Return queued buffers on start_streaming() failure
- media: mtk-vcodec: potential null pointer deference in SCP
- media: pci: dm1105: Free allocated workqueue
- media: pwc: Drain fill_buf on start_streaming() failure
- media: pwc: Return queued buffers on start_streaming() failure
- media: radio-si476x: Unregister v4l2_device on probe failure
- media: rtl2832: fix use-after-free in rtl2832_remove()
- media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure
- media: rtl2832_sdr: Return queued buffers on start_streaming() failure
- media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak
- media: s2255: bound JPEG frame size before copying into the buffer
- media: s2255: check firmware size before reading trailing marker
- media: saa7134: Fix a possible memory leak in saa7134_video_init1
- media: sun4i-csi: Return queued buffers on start_streaming() failure
- media: tda18250: fix possible integer overflow
- media: tegra-video: vi: fix invalid u32 return value in format lookup
- media: usbtv: keep device alive while ALSA card exists
- media: uvcvideo: Fix sequence number when no EOF
- media: uvcvideo: Implement dual stream quirk to fix loss of usb packets
- media: v4l: async: Set owner for async sub-devices
- media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link
- media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor()
- media: vb2: use ssize_t for vb2_read/vb2_write
- media: venus: fix payload size calculation in parse_raw_formats()
- media: venus: fix payload size returned by parse_caps() and parse_alloc_mode()
- media: vicodec: fix out-of-bounds write in FWHT encoder
- media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure
- media: vidtv: fix reference leak on failed device registration
- media: vimc: fix pixel format lookup in enum_framesizes
- media: vimc: fix reference leak on failed device registration
- media: vivid: check for vb2_is_busy() when toggling caps
- mfd: iqs62x: Reject zero-length firmware records
- mfd: rave-sp: validate received frame payload lengths
- MIPS: ptrace: Fix syscall skipping via PTRACE_SYSCALL
- mips: sched: Fix CPUMASK_OFFSTACK memory corruption
- misc: ad525x_dpot: Make ad_dpot_remove() return void
- misc: ad525x_dpot: use driver core groups for sysfs files
- misc: fastrpc: fix channel ctx ref leak when session alloc fails
- misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
- misc: fastrpc: Remove buffer from list prior to unmap operation
- misc: fastrpc: Rework fastrpc_req_munmap
- misc: fastrpc: separate fastrpc device from channel context
- misc: rtsx: add missing write register handling
- misc: rtsx_usb: avoid USB I/O in runtime autosuspend
- misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe()
- mlxsw: fix refcount leak in mlxsw_sp_port_lag_join()
- mlxsw: spectrum: Apply RIF configuration when joining a LAG
- mlxsw: spectrum: On port enslavement to a LAG, join upper's bridges
- mm: memcg: stop reclaim when a limit update is superseded
- mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit
- mmc: sdhci: make tuning_err a signed int
- mmc: sdhci: unmap the bounce buffer before device release
- mmc: via-sdmmc: stop card-detect handling on probe failure
- mmc: vub300: fix use-after-free on disconnect
- mmc: vub300: fix use-after-free on probe failure
- mmc: vub300: rename probe error labels
- mm/highmem: Take kmap_high_get() properly into account
- mm/huge_memory: fix huge_zero_pfn race
- mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios
- mm/hugetlb: fix list corruption in allocate_file_region_entries()
- mm/page_reporting: use system_freezable_wq to fix UAF during suspend
- mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()
- mm/ptdump: always stabilise against page table freeing using init_mm
- mm/swap: reject swapon() on filesystem-level encrypted files
- mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec()
- mm/vmstat: fold stranded per-cpu node stats when a node comes online
- mount: honour SB_NOUSER in the new mount API
- mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n
- mpls: reload header after pskb_may_pull()
- mptcp: decrement subflows counter on failed passive join
- mptcp: fix subflow accounting on close
- mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction
- mptcp: only set DATA_FIN when a mapping is present
- mptcp: options: reset DSS fields in case of unexpected size
- mptcp: pm: ADD_ADDR rtx: always decrease sk refcount
- mptcp: pm: ADD_ADDR rtx: free sk if last
- mtd: afs: validate v2 image info bounds
- mtd: maps: vmu-flash: fix fault in unaligned fixup
- mtd: mtdoops: free page bitmap when the backing MTD is removed
- mtd: mtdswap: Avoid freeing registered blktrans device twice
- mtd: mtdswap: remove debugfs stats file on teardown
- mtd: nand: mtk-ecc: stop on ECC idle timeouts
- mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition()
- mtd: rawnand: validate ONFI extended parameter page sections
- mtd: spi-nor: Fix spi_nor_try_unlock_all()
- mtd: spi-nor: intel: remove global protection flag
- mtd: spi-nor: Move Software Write Protection logic out of the core
- mtd: spi-nor: sst: remove global protection flag
- mtd: spi-nor: swp: Improve locking user experience
- net: Add helper function to parse netlink msg of ip_tunnel_encap
- net: af_key: zero aligned sockaddr tail in PF_KEY exports
- net: atlantic: free RX pages of consumed but not refilled buffers
- net: atlantic: free stranded TX buffers on ring deinit
- net: bridge: Reject descending VLAN tunnel ranges
- net: bridge: stop fast-leave after deleting a port group
- net: bridge: vlan: add support for dumping global vlan options
- net: bridge: vlan: add support for global options
- net: bridge: vlan: fix global vlan option range dumping
- net: bridge: vlan: fix inverted default vlan notification
- net: bridge: vlan: fix vlan range dumps starting with pvid
- net: cap advertised IP tunnel headroom
- net: ethernet: sun4i-emac: Fix IRQ error handling
- net: ethernet: ti: am65-cpsw: add multi port support in mac-only mode
- net: ethernet: ti: am65-cpsw: fix error handling in am65_cpsw_nuss_probe()
- net: ethernet: ti: am65-cpsw: move ale selection in pdata
- net: ethernet: ti: am65-cpsw: move free desc queue mode selection in pdata
- net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
- net: fec: only stop PTP if it was initialized
- net: fix NULL pointer dereference in l3mdev_l3_rcv
- net: gro: fix double aggregation of flush-marked skbs
- net: hip04: fix RX buffer leak on build_skb failure
- net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete
- net: hns3: don't auto enable misc vector
- net: hsr: Use full string description when opening HSR network device
- net: ip6_gre: Remove the unused function ip6gre_tnl_addr_conflict()
- net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink
- net: ipa: fix SMEM state handle leaks in SMP2P init
- net: ipip: require CAP_NET_ADMIN in the device netns for changelink
- net: ipv4: Publish fib_nlmsg_size()
- net: ipv6: clear suppressed fib6 rule result
- net: ipv6: fix dif and sdif mismatch in raw6_icmp_error
- net: kcm: Hold RCU read lock while running BPF parser
- net: marvell: prestera: try to load previous fw version
- net: mpls: initialize rtm_tos in mpls_getroute()
- net: ntb_netdev: Avoid double-accounting netif_rx() drops
- net: ntb_netdev: Count packets dropped on RX refill failure
- net: ntb_netdev: Fix TX busy and drop handling
- net: openvswitch: fix flow mask use-after-free on flow deletion
- net: openvswitch: Fix kerneldoc warnings
- net: openvswitch: fix kernel-doc warnings in flow.c
- net: openvswitch: fix kernel-doc warnings in internal headers
- net: openvswitch: fix nf_connlabels leak in ovs_ct_init
- net: openvswitch: fix potential UAF on meter attach failure
- net: openvswitch: fix skb leak on flow key update failure during ct
- net: openvswitch: fix skb leak on flow key update failure during recirculation
- net: openvswitch: reallocate update replies for mismatched IDs
- net: packet: fix wrong transport_header when sending VLAN-tagged frame
- net: phylink: put link_gpio if phylink_create fails
- net: pktgen: fix code style (WARNING: Block comments)
- net: pktgen: fix proc entry use-after-free
- net: prestera: validate firmware header length
- net: qrtr: ns: Limit the maximum server registration per node
- net: qrtr: ns: Raise lookup limit to 128
- net: qrtr: ns: Raise node count limit to 512
- net: qrtr: restrict socket creation to the initial network namespace
- net: qualcomm: rmnet: restore skb->dev on deaggregated frames
- net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
- net: remove WARN_ON_ONCE() from sk_mc_loop()
- net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()
- net: skbuff: don't touch shared zerocopy state in skb_tx_error()
- net: slip: serialize receive against buffer reallocation
- net: smc: fix splice entry lifetime imbalance in smc_rx_splice
- net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering
- net: stmmac: dwmac4: Account for the primary MAC address for UC filtering
- net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering
- net: stmmac: reset residual action in L3L4 filters on delete
- net: stmmac: selftests: Account for the UC filter list for filtering tests
- net: stmmac: selftests: Check multiple MMC counters
- net: sxgbe: check descriptor ring allocation failures
- net: sxgbe: free TX rings on RX allocation failure
- net: thunderbolt: Count delivered packets in rx_packets and rx_bytes
- net: thunderbolt: Fix frags[] overflow by bounding frame_count
- net: tun: bound receive headroom
- net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition
- net/9p: fix infinite loop in p9_client_rpc on fatal signal
- net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()
- netfilter: bridge: release template ct on non-IP path
- netfilter: ebt_nflog: pin the NFLOG backend
- netfilter: flowtable: publish GC-visible tuple last
- netfilter: ipset: do not update comments from kernel-side hash adds
- netfilter: ipset: fix list type element drift bug
- netfilter: ipset: fix refcount race between list:set GC and swap
- netfilter: nf_conntrack_sip: remove net variable shadowing
- netfilter: nf_conntrack_sip: validate skb_dst() before accessing it
- netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()
- netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet
- netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst
- netfilter: nf_tables: make nft_object rhltable per table
- netfilter: nf_tables: move hardware offload step after building the chain blob
- netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path
- netfilter: nft_payload: fix mask build for partial field offload
- netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited()
- netfilter: xt_cgroup: Make it independent from net_cls
- netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH
- netfilter: xt_HL: add pr_fmt and checkentry validation
- net/iucv: filter frames in afiucv_hs_rcv() by ingress device
- net/iucv: fix use-after-free of a severed iucv_path
- net/iucv: take a reference on the socket found in afiucv_hs_rcv()
- net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule
- net/mlx5: fw_tracer, return NULL on create error
- net/mlx5: Remove second FW tracer check
- net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation
- net/mlx5e: Report zero bandwidth for non-ETS traffic classes
- net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length
- net/openvswitch: check Ethernet header length in key_extract()
- net/packet: avoid fanout hook re-registration after unregister
- net/packet: reset the MAC header on the packet-socket transmit path
- net/rds: use wq_has_sleeper() in rds_cong_map_updated()
- net/sched: act_gact, act_police: range check the fallback control action
- net/sched: act_tunnel_key: Defer dst_release to RCU callback
- net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup
- net/sched: cls_route: fix fastmap use-after-free on filter
- net_sched: export pfifo_fast prio2band[]
- net/sched: fq_codel: clamp default quantum and mtu
- net/sched: fq_pie: clamp default quantum to avoid signed overflow
- net/sched: hhf: clamp quantum before hhf_change() to avoid overflow
- net/sched: reject overly deep qdisc hierarchies
- net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter
- net/sched: sch_codel: clamp default mtu to avoid disabling CoDel
- net_sched: sch_fq: change how @inactive is tracked
- net_sched: sch_fq: struct sched_data reorg
- net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked
- net/sched: sch_teql: restore skb->dev on the slave failure path
- net/sched: serialize qdisc_rtab_list against concurrent get/put
- net/sched: sfq: clamp quantum to avoid signed overflow soft lockup
- net/sched: taprio: avoid calling child->ops->dequeue(child) twice
- net/smc: fix potential panic dues to unprotected smc_llc_srv_add_link()
- net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()
- net/smc: fix socket use-after-free during link group termination
- net/smc: free pending qentry in smc_llc_flow_stop() before memset
- net/smc: rdma write inline if qp has sufficient inline space
- net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot
- net/x25: fix use-after-free in x25_kill_by_neigh()
- net/x25: fix use-after-free of the socket by its timers
- nfc: digital: clamp SENSF_RES length to the destination buffer
- nfc: digital: Do not dump a NULL response in command completion
- nfc: fdp: bound the device-reported read length and fix an skb leak
- nfc: llcp: avoid userspace overflow on invalid optlen
- nfc: llcp: bound SNL TLV parsing to the skb and add length checks
- nfc: llcp: bound the connect_sn TLV walk to the skb
- nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers
- nfc: llcp: read llcp_sock->local under the socket lock in getsockopt
- nfc: llcp: reject PDUs shorter than the LLCP header
- nfc: microread: validate target discovery payload lengths
- nfc: nci: add data_len bound checks to activation parameter extractors
- nfc: nci: fix double completion race in nci_data_exchange_complete
- nfc: nci: fix out-of-bounds write in nci_target_auto_activated()
- nfc: nci: fix uninit-value in the RF discover/activated NTF handlers
- nfc: nci: free destination parameters when closing a connection
- nfc: pn533: hold a reference to the request skb during send_frame
- nfc: pn533: purge fragmented skbs during cleanup
- nfc: st21nfca: validate ATR_REQ length against the received frame
- nfp: Check resource mutex allocation
- NFS: Always clear an invalid mapping when attempting a buffered write
- nfs: move the nfs4_data_server_cache into struct nfs_net
- NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
- nfs: refactor pNFS functions using clear_and_wake_up_bit
- nfs: replace atomic bitops sequence with clear_and_wake_up_bit helper
- nfs4: take a reference on the nfs_client when running FREE_STATEID
- nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()
- nfsd: add filehandle match check to nfsd4_delegreturn()
- nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref
- nfsd: check client ownership when cancelling a copy-notify stateid
- NFSD: Encode only the status in NFS-ACL v2 GETACL error replies
- nfsd: fix cpntf publish race in nfs4_init_cp_state
- NFSD: Fix off-by-one in DRC bucket pruning limit
- nfsd: fix version mismatch loops in nfsd_acl_init_request()
- nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget
- nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo
- nfsd: initialize copy-notify stateid before publishing it
- NFSD: Prevent lock owner use-after-free during client teardown
- nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE
- nfsd: reject reclaim LOCK after RECLAIM_COMPLETE
- NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check
- nfsd: Reset write verifier when async COPY writeback fails
- NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock
- nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types
- nfsd: revoke copy-notify stateids before dropping their reference
- nfsd: sample writeback error cursor before async COPY loop
- nfsd: validate symlink target length in NFSv4 CREATE
- NFSv4: remove callback IDR entry on client allocation failure
- NFSv4.2: fix LAYOUTSTATS send buffer exhaustion
- NFSv4/pnfs: Clean up layout get on open
- NFSv4/pnfs: key the data server cache on the NFS version
- nilfs2: fix infinite loop in nilfs_clean_segments()
- nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation
- nilfs2: prevent out-of-bounds read in super root block parsing
- nilfs2: reject invalid block index in GC ioctl
- NTB: ntb_netdev: Preserve RX queue depth on allocation failure
- NTB: ntb_transport: Fail TX enqueue when the QP link is down
- NTB: ntb_transport: Recycle TX entries before client callbacks
- NTB: ntb_transport: Reject oversized TX buffers
- nvdimm/btt: reject an arena whose nfree is below the lane count
- nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path
- nvme: zero the discard fallback page
- nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request
- nvme-tcp: check the data direction of a C2HData PDU
- nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone
- nvmet-fc: fix invalid free in LS IOD error path
- nvmet-rdma: factor out response resource cleanup
- nvmet-tcp: bound SGL data length before allocating command buffers
- nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations
- nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
- nvmet-tcp: Fix potential UAF when ddgst mismatch
- nvmet-tcp: reject unsolicited H2CData PDUs
- ocfs2: always run deallocs on copy-on-write completion
- ocfs2: bound namelen in dlm_migrate_request_handler
- ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item
- ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin()
- ocfs2: cluster: fix o2hb_dependent_users leak on pin failure
- ocfs2: fix circular locking dependency in ocfs2_init_acl()
- ocfs2: fix missing metadata reservation for large xattrs
- ocfs2: fix readdir position truncation on 32-bit kernels
- ocfs2: synchronize heartbeat callbacks with o2net teardown
- ocfs2: use bitmap API in fill_node_map
- ocfs2: validate lengths in dlm_mig_lockres_handler
- ocfs2: validate rl_used against rl_count in refcount block validator
- octeontx2: Annotate mmio regions as __iomem
- octeontx2-pf: clear stale mailbox IRQ state before request_irq()
- octeontx2-pf: fix SQB pointer leak on init failure
- octeontx2-pf: Set correct sequence for carrier off and tx queue stop
- octeontx2-vf: clear stale mailbox IRQ state before request_irq()
- of: Add cleanup.h based auto release via __free(device_node) markings
- of: fix out-of-bounds read in of_alias_scan() stem parser
- of: property: add missing kerneldoc for of_graph_get_endpoint_count()
- of: property: use unsigned int return on of_graph_get_endpoint_count()
- openrisc: fix arbitrary kernel memory access via or1k_atomic syscall
- openrisc: signal: do not restore privileged SR bits on sigreturn
- openvswitch: Fix CT limit teardown use-after-free
- openvswitch: fix GSO userspace truncation underflow
- openvswitch: only skb_tx_error() a packet we are about to drop
- orangefs: fix double-free of trailer_buf on readdir copy failure
- orangefs: skip leading spaces before parsing client debug masks
- ovl: use linked upper dentry in copy-up tmpfile
- packet: synchronize pressure clearing with ring reconfiguration
- packet: use consistent hard_header_len in non-ring send paths
- packet: use consistent hard_header_len in TX_RING send path
- PCI: Add pci_find_vsec_capability() to find a specific VSEC
- PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk
- PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip
- PCI: meson: Fix GPIO state while requesting PERST#
- PCI/proc: Avoid spurious runtime PM wakeup on config space accesses
- PCI/proc: Use file_ns_capable() when checking config space read access
- PCI/sysfs: Add static PCI resource attribute macros
- PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses
- perf auxtrace: Fix queue grow overflow and old array leak
- perf cs-etm: Avoid truncating AUX buffer sizes to int
- perf cs-etm: Flush thread stacks after decoder reset
- perf dso: Guard against cache underflow on short reads in dso_cache__memcpy()
- perf dso: Guard close() against invalid fd in dso__decompress_kmodule_path()
- perf: Fix cgroup state vs ERROR
- perf: Fix dangling cgroup pointer in cpuctx
- perf intel-bts: Fix off-by-one in auxtrace_info minimum size check
- perf intel-pt: Fix off-by-one in auxtrace_info minimum size check
- perf machine: Check snprintf truncation for guest kallsyms path
- perf machine: Check snprintf truncation in machines__findnew()
- perf machine: Don't abort guest map creation on first inaccessible dir
- perf machine: Free scandir entries in guest kernel map creation
- perf machine: Guard against NULL strlist in machines__findnew()
- perf machine: Reset errno before strtol in guest kernel map creation
- perf machine: Use snprintf() for guestmount path construction
- perf sched: Fix register_pid() overflow, strcpy, and BUG_ON
- perf stat: Clear screen only if output file is a tty
- perf stat: Fix evsel_list leak in cmd_stat
- perf synthetic-events: Fix divide by zero in perf_event__synthesize_threads
- perf synthetic-events: Fix uninitialized pthread_join
- perf thread-stack: Fix heap buffer overflow on branch stack wrap copy
- perf trace-event: Fix buffer overflow in read_string()
- perf trace-event: Fix integer truncation in do_read() and skip()
- perf ui hists: Fix uninitialized stack memory free on pstack allocation failure
- perf/core: Fix group leader use-after-free after sibling detach
- perf/x86/intel: Fix kernel address leakages in LBR stack
- perf/x86/intel/uncore: Keep PCI PMUs working when MMIO/MSR setup fails
- phonet: pep: do not write beyond optlen in getsockopt
- phonet: pep: fix use-after-free in pep_get_sb()
- phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend
- phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask
- phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB
- phy: zynqmp: use read-modify-write for SERDES scrambler bypass
- pinctrl: bcm2835: Don't remove an unregistered GPIO chip
- pinctrl: bm1880: add missing select GENERIC_PINCONF
- pinctrl: devicetree: don't free uninitialized dev_name on error path
- pinctrl: rockchip: Reset the pin count when recalculating SoC data
- platform: Provide a remove callback that returns no value
- platform/chrome: sensorhub: Bound the EC-reported sensor number
- platform/chrome: sensorhub: Fix dropped timestamp events and log spam
- platform/chrome: sensorhub: Fix memory overread in ring handler
- PM: sleep: Fix off-by-one in wakelocks number limit check
- pmdomain: bcm: bcm2835: handle genpd provider registration errors
- power: supply: bd99954: Drop bad register fields
- power: supply: bq27xxx: bq27520g4: fix REG_TTES address
- power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address
- power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address
- power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS
- power: supply: cros_usbpd-charger: bound the EC-reported port count
- power: supply: isp1704_charger: cancel work on remove
- power: supply: lp8727: fix use-after-free in lp8727_release_irq()
- power: supply: max17040: synchronize work cancellation on suspend
- power: supply: sbs-battery: cache constant string properties
- power: supply: sbs-battery: Use a per-device serial number buffer
- power: supply: sc2731_charger: cancel work on remove
- power: supply: sc2731_charger: Convert to platform remove callback returning void
- ppdev: prevent overflow when setting port timeout
- pppoe: reload header pointer after dev_hard_header()
- pppox: drain queued packets on channel handoff
- pps: don't try to wait for negative timeouts in PPS_FETCH
- prctl: fix PR_SET_MM_AUXV losing the forced AT_NULL terminator
- prestera: fix fallback to previous version on same major version
- proc: Fix broken error paths for namespace links
- qede: Fix NULL pointer dereference in TPA fragment processing
- qede: sync udp_tunnel ports outside qede_lock in the recovery path
- rapidio: clear mport->net when rio_add_net() fails
- rapidio: mport_cdev: fix use-after-free in dma_req_free()
- raw: fix a typo in raw_icmp_error()
- raw: remove unused variables from raw6_icmp_error()
- raw: use more conventional iterators
- rbd: Reset positive result codes to zero in object map update path
- RDMA/cma: Fix WARNING in res_to_rt
- RDMA/core: Avoid flush_workqueue(system_unbound_wq) usage
- RDMA/core: Wait for RCU callbacks before unloading ib_core
- RDMA/cxgb4: Cancel reg_work before freeing device on remove
- RDMA/cxgb4: Free debugfs on registration failure
- RDMA/cxgb4: free STAG index when TPT entry write fails
- RDMA/efa: Fix PBL chunk length computation
- RDMA/hfi1: Create workqueues before device initialization
- RDMA/hfi1: Initialize debugfs after probe completes
- RDMA/hfi1: Preserve unit 0 on allocation failure
- RDMA/hfi1: Propagate sdma_txinit_ahg() errors
- RDMA/hfi1: Remove redundant PCI device ID validation
- RDMA/hfi1: Stop flushing the global IB workqueue
- RDMA/hns: Fix potential integer overflow in mhop hem cleanup
- RDMA/ipoib: Drain RCU callbacks during module teardown
- RDMA/mlx5: Fix integer overflow of user QP buffer size
- RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs
- RDMA/mlx5: Send cong param changes to the resolved port mdev
- RDMA/restrack: Fix typos in the comments
- RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg
- RDMA/rxe: Fix a use-after-free problem in rxe_mmap
- RDMA/rxe: Fix OOB in free_rd_atomic_resources()
- RDMA/rxe: Fix over copying in get_srq_wqe
- RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe
- RDMA/rxe: Missing unlock on error in get_srq_wqe()
- RDMA/rxe: Use the correct size of wqe when processing SRQ
- RDMA/siw: Fix use-after-free in siw_accept()
- RDMA/siw: Introduce siw_free_cm_id
- RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ
- RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters
- RDMA/srpt: Pass the mapped task attribute to target_init_cmd()
- RDMA/ucma: Allow path records to exactly fit the output buffer
- RDMA/ucma: Lock the handler in ucma_set_ib_path()
- rds: drop incoming messages that cross network namespace boundaries
- rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled
- rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()
- regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer
- regulator: core: use system_freezable_wq for init complete work
- regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata
- regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling
- remoteproc: Add a rproc_set_firmware() API
- remoteproc: Add new detach() remoteproc operation
- remoteproc: Add new RPROC_ATTACHED state
- remoteproc: core: Attach rproc asynchronously in rproc_add() path via schedule_work()
- remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()
- remoteproc: Fix various kernel-doc warnings
- remoteproc: Introduce function __rproc_detach()
- remoteproc: Introduce function rproc_detach()
- remoteproc: Move resource table data structure to its own header
- remoteproc: Prevent crash handling to race with rproc_del()
- remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdev
- remoteproc: Remove useless check in rproc_del()
- remoteproc: scp: Fix device reference leak on failed lookup
- remoteproc: use freezable workqueue for crash notifications
- remoteproc: use rsc_table_for_each_entry() in rproc_handle_resources()
- remoteproc: Use unbounded workqueue for recovery work
- Revert "ALSA: aoa: Use guard() for mutex locks"
- Revert "Input: ims-pcu - fix race condition in reset_device sysfs callback"
- Revert "irqchip/mbigen: Fix mbigen node address layout"
- Revert "media: v4l2-dev: fix error handling in __video_register_device()"
- Revert "mtd: maps: vmu-flash: fix fault in unaligned fixup"
- Revert "PM: sleep: Use complete() in device_pm_sleep_init()"
- Revert "smb: client: use kvzalloc() for megabyte buffer in simple fallocate"
- Revert "USB: serial: keyspan_pda: fix information leak"
- rhashtable: clear stale iter->p on table restart
- ring-buffer: Remove jump to out label in ring_buffer_swap_cpu()
- ring-buffer: Use current_context for safe per-CPU buffer swap
- rndis_host: add overflow check in rndis_rx_fixup()
- rpmsg: glink: fix deadlock in endpoint destroy during driver detach
- rpmsg: glink: remove duplicate code for rpmsg device remove
- rpmsg: glink: Remove the rpmsg dev in close_ack
- rpmsg: glink: smem: order FIFO read after availability check
- rtc: pcf8563: fix clock provider leak on unbind
- rxrpc: Fix notification vs call-release vs recvmsg
- rxrpc: Fix recv-recv race of completed call
- rxrpc: Fix socket notification race
- rxrpc: serialize kernel accept preallocation with socket teardown
- sc16is7xx: Properly resume TX after stop
- sched/fair: Check CPU capacity before comparing group types during load balance
- sched/fair: Introduce a CPU capacity comparison helper
- sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
- scripts/tags.sh: improve compiled sources generation
- scripts/tags.sh: Prevent binary files appearing in cscope.files
- scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()
- scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer
- scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer
- scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup()
- scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers
- scsi: pm8001: Use rollback index when freeing MSI-X vectors
- scsi: qla2xxx: Avoid double completion in async IOCB timeout
- scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry()
- scsi: qla2xxx: Bound i2c->length in I2C bsg handlers
- scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions()
- scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read
- scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config()
- scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation
- scsi: qla2xxx: Don't query firmware state while chip is down
- scsi: qla2xxx: Drop TARGET_SCF_LOOKUP_LUN_FROM_TAG
- scsi: qla2xxx: Drop vport reference under lock in report ID acquisition
- scsi: qla2xxx: Fix an loop timeout test
- scsi: qla2xxx: Fix cs84xx use-after-free on host teardown
- scsi: qla2xxx: Fix FCE trace enable parsing in debugfs
- scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump
- scsi: qla2xxx: Fix memory leak in __qlt_24xx_handle_abts()
- scsi: qla2xxx: Fix Name Server logout detection on FWI2 adapters
- scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()
- scsi: qla2xxx: Move sess cmd list/lock to driver
- scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path
- scsi: qla2xxx: Serialize flash version read in reset handler
- scsi: qla2xxx: Use coherent DMA buffer for D_Port diagnostics
- scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state()
- scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers
- scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak
- scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write
- scsi: scsi_debug: Negate wrapped memcmp() result
- scsi: scsi_debug: Rename zone type constants
- scsi: sd: sd_zbc: Improve source code documentation
- scsi: sd: sd_zbc: Return early in sd_zbc_check_zoned_characteristics()
- scsi: sd: sd_zbc: Use logical blocks as unit when querying zones
- scsi: target: Bound PR-OUT TransportID parsing to the received buffer
- scsi: target: core: Break up target_submit_cmd_map_sgls()
- scsi: target: core: Generate correct identifiers for PR OUT transport IDs
- scsi: target: core: pr: Initialize arrays at declaration time
- scsi: target: core: Rename transport_init_se_cmd()
- scsi: target: core: Replace in_interrupt() usage in target_submit_cmd_map_sgls()
- scsi: target: iscsi: Reserve a terminator byte for the login payload
- scsi: target: Remove TARGET_SCF_LOOKUP_LUN_FROM_TAG
- scsi: target: srpt: Convert to new submission API
- scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req
- sctp: auth: verify auth requirement when auth_chunk is NULL
- sctp: avoid auth_enable sysctl UAF during netns teardown
- sctp: clear control chunk transport if it is being removed
- sctp: clear new_transport when removing a peer
- sctp: distinguish sequence zero from wildcard in reconf lookup
- sctp: don't free the ASCONF's own transport in DEL-IP processing
- sctp: drop a chunk if its transport was removed
- sctp: extract sctp_v4_err_handle function from sctp_v4_err
- sctp: extract sctp_v6_err_handle function from sctp_v6_err
- sctp: fix addip_serial increment on ASCONF_ACK allocation failure
- sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid
- sctp: fix auth_hmacs array size in struct sctp_cookie
- sctp: fix NULL deref on untransmitted RECONF completion
- sctp: fix stream->outcnt underflow on duplicate RECONF responses
- sctp: fix use-after-free of cached ASCONF chunk
- sctp: keep chunk->transport in step with the list it is queued on
- sctp: prevent peer transport count overflow
- sctp: reject stale cookies with mismatched verification tags
- sctp: remove the unessessary hold for idev in sctp_v6_err
- sctp: stop processing a packet once its association is deleted
- sctp: validate Adaptation Indication parameter length
- sctp: validate stream count in sctp_process_strreset_inreq()
- seg6: reset IP6CB after IPv6 decapsulation
- selftests: timers: leap-a-day: Fix -w option and update usage comment
- selftests/bpf: Fix memory leak in msg_alloc_iov
- selftests/bpf: Fix memory leak in msg_alloc_iov error path
- selftests/clone3: fix wild pointer access of getline due to missing init
- selftests/rseq: Replace glibc-specific __GNUC_PREREQ with portable check
- selftests/zram: fix kernel_gte() for POSIX sh
- selinux: avoid implicit conversions in services code
- selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()
- selinux: do not cancel a policy conversion that never started
- selinux: reject a class permission count below its inherited common
- selinux: reject an unclaimed class value in security_get_classes()
- selinux: require every boolean value to be defined
- selinux: switch two allocations to use kzalloc_objs()
- serial: 8250_dma: Clear stale RX state on shutdown
- serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms
- serial: 8250_mid: Remove unneeded test for ->setup() presence
- serial: amba-pl011: synchronize DMA teardown
- serial: amba-pl011: unprepare console clock on unregister
- serial: max310x: implement gpio_chip::get_direction()
- serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch)
- serial: sc16is7xx: Fill in rs485_supported
- serial: sc16is7xx: fix regression with GPIO configuration
- serial: sc16is7xx: implement gpio get_direction() callback
- serial: sc16is7xx: remove obsolete out_thread label
- signal: avoid shared siginfo namespace rewrites
- skbuff: introduce skb_pull_data
- slip: fix use-after-free in sl_sync()
- smack: deduplicate smackfs/{direct,mapped} file_operations
- smack: fix incorrect task context in smack_msg_queue_msgrcv
- Smack: fix W=1 build warnings
- smack: mark 'smack_enabled' global variable as __initdata
- smack: restrict smackfs/{direct,mapped} values to 0-255
- smack: simplify write handlers of sysfs entries
- smb: client: fix buffer leaks in SMB1 read and write
- smb: client: use kvzalloc() for megabyte buffer in simple fallocate
- smb/client: handle overlapping allocated ranges in fallocate
- soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap()
- software node: Fix software_node_get_reference_args() with index -1
- soundwire: add static port mapping support
- soundwire: qcom: add static port map support
- soundwire: qcom: Fix port exhaustion check in stream_alloc_ports
- soundwire: qcom: update port map allocation bit mask
- speakup: keyhelp: guard letter_offsets possible out-of-range indexing
- spi: img-spfi: don't disable runtime PM on DMA deferred probe
- spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers
- spi: sprd-adi: Fix probe succeeding without registering the controller
- Squashfs: check block offset is not negative
- staging: fbtft: Use sysfs_emit_at() to print to sysfs file
- staging: greybus: audio: correct sscanf() return value check
- staging: greybus: hid: fix SET_REPORT return value
- staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown
- staging: octeon: ethernet-mem: replace pr_warn with dev_warn in free functions
- staging: octeon: fix free_irq dev_id mismatch in cvm_oct_rx_shutdown
- staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()
- staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()
- staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
- staging: rtl8723bs: fix OOB read in WMM_param_handler()
- staging: rtl8723bs: use kfree_sensitive() for key material
- staging: rtl8723bs: validate monitor transmit frame lengths
- staging: sm750fb: gate dualview dataflow using g_dualview
- SUNRPC: always drain cache_cleaner before destroying a cache_detail
- SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6
- SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat
- SUNRPC: harden gss_krb5_unwrap_v2 against short tokens
- SUNRPC: harden gss_unwrap_resp_priv length checks
- sunrpc: init gssp_lock before publishing proc entry
- SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field
- sunrpc: route to a populated pool in svc_pool_for_cpu()
- SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow
- super: fix emergency thaw deadlock on frozen block devices
- taskstats: fill_stats_for_tgid: use for_each_thread()
- taskstats: retain dead thread stats in TGID queries
- tcp: clear sock_ops cb flags before force-closing a child socket
- tcp: fix corruption of urgent data on multi-segment retransmit
- tcp: fix potential race in tcp_v6_syn_recv_sock()
- thermal: int340x_thermal: Consolidate priv->data_vault checks
- thermal: intel: int3400: clean up ODVP on probe failures
- thermal/drivers/imx: Disable clock on runtime resume failure
- thermal/drivers/qoriq: Disable clock on resume failure
- thunderbolt: Bound the DROM dual link port number before indexing sw->ports
- thunderbolt: Keep XDomain reference during the lifetime of a service
- thunderbolt: Prevent XDomain delayed work use-after-free on disconnect
- thunderbolt: Remove XDomain from the bus without holding tb->lock
- timekeeping: Account for monotonicity adjustment in ntp_error
- timer: Keep debugobjects state consistent in migrate_timer_list()
- timers/itimer: Zero-init old itimerval before copy to userspace
- tipc: avoid use-after-free in poll trace queue dumps
- tipc: clear sock->sk on the failed-insert path in tipc_sk_create()
- tipc: fix infinite loop in __tipc_nl_compat_dumpit
- tipc: fix u16 MTU truncation in media and bearer MTU validation
- tipc: fix use-after-free of the discoverer in tipc_disc_rcv()
- tipc: read le->link under the node lock in tipc_node_link_down()
- tipc: restrict socket queue dumps in enqueue tracepoints
- tls: don't abort the connection on signal-interrupted sends
- tls: separate no-async decryption request handling from async
- tools/compiler: match glibc 2.42 definition of __attribute_const__
- tpm: st33zp24: Return zero on status read failure
- tpm: st33zp24: Validate locality read result
- tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout
- tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat()
- tracing: Check return value of __register_event() in trace_module_add_events()
- tracing: Fix crash passing ERR_PTR to kthread_stop()
- tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev
- tracing: Fix resource leak on mmiotrace trace_pipe close
- tracing/filters: Fix false positive match in regex_match_full()
- tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions
- tracing/mmiotrace: Remove reference to unused per CPU data pointer
- tracing/mmiotrace: Reset dropped_count in mmio_reset_data()
- tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args()
- tracing/probes: Fix potential underflow in LEN_OR_ZERO macro
- tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err()
- tty: clear cdev pointer after cdev_add() failure
- ubi: fastmap: Add fastmap control support for module parameter
- ubi: fastmap: Add fastmap control support for 'UBI_IOCATT' ioctl
- ubi: fastmap: Add module parameter to control reserving filling pool PEBs
- ubi: fastmap: Allocate memory with GFP_NOFS in ubi_update_fastmap
- ubi: fastmap: erase_block: Get erase counter from wl_entry rather than flash
- ubi: fastmap: Fix lapsed wear leveling for first 64 PEBs
- ubi: fastmap: Fix missed ec updating after erasing old fastmap data block
- UBI: fastmap: Pass to_be_tortured when reusing old fastmap PEBs
- ubi: fastmap: Use the bitmap API to allocate bitmaps
- ubi: fastmap: Wait until there are enough free PEBs before filling pools
- ubi: Fix repeated words in comments
- ubi: Fix rollback for explicit UBI device numbers
- UBI: fix two issues in the ubi.mtd MODULE_PARM_DESC
- UBI: Preserve torture flag when rescheduling failed erasures
- ubi: Replace erase_block() with sync_erase()
- ubi: Simplify bool conversion
- ubifs: fix out-of-bounds read in signature length check
- udf: Fix i_lenExtents truncation on 32-bit kernels
- udf: Mark LVID buffer as uptodate before marking it dirty
- udf: reject VAT indexes equal to the entry count
- UDF symlink pathComponent header OOB read
- udmabuf: Do not create malformed scatterlists
- udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf()
- udp: fix potential use-after-free in tunnel segmentation
- uio: Fix stale info pointer in failed registration path
- um: vector: fix use-after-free in vector_mmsg_rx()
- usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
- usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect
- usb: atm: usbatm: fix invalid ci_range initialization
- USB: c67x00: fix use-after-free in c67x00_add_iso_urb()
- usb: chipidea: fix usage_count leak when autosuspend_delay is negative
- usb: core: Add lock to usb_wakeup_notification()
- usb: core: Strengthen error handling in hub_hub_status()
- usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns()
- usb: gadget: bdc: fix checkpatch.pl spacing error
- usb: gadget: configfs: fix out-of-bounds read of qw_sign
- usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback
- usb: gadget: f_fs: Prevent deadlock during ep0 read loop
- USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()
- usb: gadget: fix null pointer dereference in usb_put_function_instance()
- usb: gadget: f_midi: cancel pending IN work before freeing the midi object
- usb: gadget: f_ncm: Use unsigned int for ndp_index
- usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb()
- USB: gadget: fsl-udc: fix device name leak on probe failure
- usb: gadget: f_tcm: fix deadlock in usbg_make_tpg()
- usb: gadget: f_tcm: keep port count until LUN teardown completes
- usb: gadget: f_tcm: synchronize delayed set_alt with teardown
- usb: gadget: f_uac1_legacy: remove broken string configfs attributes
- usb: gadget: printer: fix infinite loop in printer_read()
- usb: gadget: r8a66597: avoid double free of ep0_req in probe error path
- USB: gadget: snps-udc: fix device name leak on probe failure
- usb: gadget: snps_udc_plat: clean up PHY on probe deferral
- usb: gadget: u_audio: Fix use-after-free on sound card disconnect
- usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown
- usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer
- usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()
- usb: image: mdc800: change kmalloc() to kzalloc()
- USB: phy: fsl-usb: fix missing static keywords
- usb: renesas_usbhs: Fix power-off ordering on unbind
- USB: serial: ftdi_sio: add support for E+H FXA291
- USB: serial: io_edgeport: cap received transmit credits
- USB: serial: keyspan_pda: add write-fifo support
- USB: serial: keyspan_pda: clean up comments and whitespace
- USB: serial: keyspan_pda: fix data loss on receive throttling
- USB: serial: keyspan_pda: fix information leak
- USB: serial: keyspan_pda: fix write implementation
- USB: serial: keyspan_pda: refactor write-room handling
- USB: serial: option: add TDTECH MT5710-CN
- USB: serial: option: fix slab OOB read in interrupt URB callback
- USB: serial: spcp8x5: drop broken carrier detect support
- USB: storage: add NO_ATA_1X quirk for Longmai USB Key
- usb: typec: ucsi: displayport: Fix OOB altmode array index
- usb: usbfs: fix use-after-free of usb_device in usbdev_release()
- usb: usbtest: disable dynamic ID support
- usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits
- usb-storage: ene_ub6250: fix race between scan work and probe
- vdpa/mlx5: fix wrong list iterated in add_direct_chain error path
- vfio/pci: clear vdev->msi_perm after freeing it on init failure
- VFS/audit: introduce kern_path_parent() for audit
- vhost: reset the vring metadata cache on vring reconfiguration
- virtio_balloon: disable indirect descriptors
- vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets
- vsock: use sock_error() to consume sk_err after a failed connect
- vsock/virtio: avoid refilling the RX queue after teardown
- vsock/virtio: flush works in dependency order
- vt: add permission check for KDSKBMETA ioctl
- vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
- vxlan: re-fetch eth header after route_shortcircuit()
- vxlan: require CAP_NET_ADMIN in the device netns for changelink
- vxlan: unclone skb head before modifying eth header in route_shortcircuit()
- vxlan: use neigh_ha_snapshot() in route_shortcircuit()
- vxlan: use pskb_network_may_pull() in route_shortcircuit()
- w1: ds2482: Fix signedness bug in ds2482_w1_triplet()
- w1: ds28e17: reject an oversize length on an I2C block read
- wan: wanxl: Only reset hardware after BAR mapping
- watchdog: pretimeout: Fix UAF in watchdog_unregister_governor()
- wifi: at76c50x-usb: avoid length underflow in at76_guess_freq()
- wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump
- wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx()
- wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate
- wifi: ath11k: Correctly copy the hint BSSID in WMI scan request
- wifi: ath11k: fix leak in ath11k_service_ready_ext_event()
- wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get()
- wifi: ath6kl: avoid buffer overreads in WMI event handlers
- wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets
- wifi: ath6kl: fix OOB access from firmware ADDBA window size
- wifi: ath6kl: fix OOB read from firmware IE lengths in connect event
- wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler
- wifi: ath6kl: fix use-after-free in aggr_reset_state()
- wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request
- wifi: brcmfmac: drain bus_reset work on device removal
- wifi: brcmfmac: fix 802.1X-SHA256 call trace warning
- wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control()
- wifi: brcmfmac: initialize SDIO data work before cleanup
- wifi: brcmfmac: make release_scratchbuffers idempotent
- wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read
- wifi: carl9170: fix buffer overflow in rx_stream failover path
- wifi: carl9170: fix OOB read from off-by-two in TX status handler
- wifi: cfg80211: bound element ID read when checking non-inheritance
- wifi: cfg80211: reject unsupported PMSR FTM location requests
- wifi: cfg80211: validate PMSR FTM preamble range
- wifi: cfg80211: validate PMSR measurement type data
- wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one()
- wifi: libertas: fix memory leak in helper_firmware_cb()
- wifi: libertas_tf: fix use-after-free in lbtf_free_adapter()
- wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock
- wifi: mac80211: recalculate TIM when a station enters power save
- wifi: mac80211_hwsim: clamp virtio RX length before skb_put
- wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses
- wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length
- wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss
- wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields
- wifi: mwifiex: bound uAP association event IEs to the event buffer
- wifi: mwifiex: Detach sync cmd buffer on interrupted wait
- wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper
- wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames
- wifi: p54: validate RX frame length in p54_rx_eeprom_readback()
- wifi: rtl818x: initialize eeprom_93cx6 struct to zero
- wifi: rtlwifi: pci: fix error path in rtl_pci_probe()
- wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb()
- wifi: wilc1000: validate assoc response length before subtracting header
- wifi: zd1211rw: reject secondary interfaces to prevent conflicts
- x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg()
- x86/pkeys: Fix pkey_alloc() return value when pkeys are not supported
- xdp: fix zero-copy frame layout
- xenbus: Unregister reboot notifier on init failure
- xfrm: ah6: validate routing header segments_left
- xfrm: drop ESP-in-TCP packets with no ingress device
- xfrm: espintcp: fix UAF during close
- xfrm: fix sk_dst_cache double-free in xfrm_user_policy()
- xfrm: fix xfrm_state_construct() auth-trunc leak
- xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert
- xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full
- xfs: bounds-check buffer log item's dirty bitmap
- xfs: check v5 superblock features early
- xfs: fix ilock leak on error in xfs_dq_get_next_id
- xfs: validate attr entry pointer before field access
- xhci: fix lost bounce buffers on TDs spanning several ring segments
- y2038: uapi: Use 64-bit __kernel_old_timespec::tv_nsec on x32