-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 20 Jun 2026 09:03:06 +0200 Source: linux Binary: bpftool bpftool-dbgsym libcpupower-dev libcpupower1 libcpupower1-dbgsym linux-config-6.12 linux-cpupower linux-cpupower-dbgsym linux-headers-6.12.94+deb13-rpi linux-headers-rpi linux-image-6.12.94+deb13-rpi linux-image-6.12.94+deb13-rpi-dbg linux-image-rpi linux-image-rpi-dbg linux-kbuild-6.12.94+deb13 linux-kbuild-6.12.94+deb13-dbgsym linux-perf linux-perf-dbgsym usbip usbip-dbgsym Architecture: armel Version: 6.12.94-1 Distribution: trixie-security Urgency: high Maintainer: armel Build Daemon (arm-ubc-04) Changed-By: Salvatore Bonaccorso Description: bpftool - Inspection and simple manipulation of BPF programs and maps libcpupower-dev - CPU frequency and voltage scaling tools for Linux (development fi libcpupower1 - CPU frequency and voltage scaling tools for Linux (libraries) linux-config-6.12 - Debian kernel configurations for Linux 6.12 linux-cpupower - CPU power management tools for Linux linux-headers-6.12.94+deb13-rpi - Header files for Linux 6.12.94+deb13-rpi linux-headers-rpi - Header files for Linux rpi configuration (meta-package) linux-image-6.12.94+deb13-rpi - Linux 6.12 for Raspberry Pi Zero, Zero W and 1 linux-image-6.12.94+deb13-rpi-dbg - Debug symbols for linux-image-6.12.94+deb13-rpi linux-image-rpi - Linux for Raspberry Pi Zero, Zero W and 1 (meta-package) linux-image-rpi-dbg - Debugging symbols for Linux rpi configuration (meta-package) linux-kbuild-6.12.94+deb13 - Kbuild infrastructure for Linux 6.12.94+deb13 linux-perf - Performance analysis tools for Linux usbip - USB device sharing system over IP network Closes: 1130365 Changes: linux (6.12.94-1) trixie-security; urgency=high . * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.91 - io_uring/kbuf: use mem_is_zero() - blk-cgroup: wait for blkcg cleanup before initializing new disk - fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START - fs/mbcache: cancel shrink work before destroying the cache - md/raid1: fix the comparing region of interval tree - drbd: Balance RCU calls in drbd_adm_dump_devices() - loop: fix partition scan race between udev and loop_reread_partitions() - nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty() - blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() - pstore/ram: fix resource leak when ioremap() fails - md: wake raid456 reshape waiters before suspend - btrfs: pass struct btrfs_inode to clone_copy_inline_extent() - btrfs: fix deadlock between reflink and transaction commit when using flushoncommit - [amd64] ACPI: x86: cmos_rtc: Clean up address space handler driver - [amd64] ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver - devres: fix missing node debug info in devm_krealloc() - thermal/drivers/spear: Fix error condition for reading st,thermal-flags - debugfs: check for NULL pointer in debugfs_create_str() - debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str() - soundwire: debugfs: initialize firmware_file to empty string - PCI: use generic driver_override infrastructure - platform/wmi: use generic driver_override infrastructure - [s390x] cio: use generic driver_override infrastructure - bus: fsl-mc: use generic driver_override infrastructure - irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter - hrtimers: Update the return type of enqueue_hrtimer() - hrtimer: Avoid pointless reprogramming in __hrtimer_start_range_ns() - hrtimer: Reduce trace noise in hrtimer_start() - locking: Fix rwlock support in - firmware: dmi: Correct an indexing error in dmi.h - wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet - bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap - dpaa2: add independent dependencies for FSL_DPAA2_SWITCH - dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n - [s390x] bpf: Zero-extend bpf prog return values and kfunc arguments - params: Replace __modinit with __init_or_module - module: Fix freeing of charp module parameters when CONFIG_SYSFS=n - wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr() - wifi: mt76: mt7925: Fix incorrect MLO mode in firmware control - wifi: mt76: mt7615: fix use_cts_prot support - wifi: mt76: mt7915: fix use_cts_prot support - wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_tx_check_aggr() - wifi: mt76: mt7925: prevent NULL vif dereference in mt7925_mac_write_txwi - wifi: mt76: mt7996: fix FCS error flag check in RX descriptor - wifi: mt76: mt7921: Place upper limit on station AID - [arm64] cpufeature: Make PMUVer and PerfMon unsigned - wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event - wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() - wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work() - wifi: mt76: mt7921: fix 6GHz regulatory update on connection - bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path - bpf: Fix variable length stack write over spilled pointers - bpf,arc_jit: Fix missing newline in pr_err messages - wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() - r8152: fix incorrect register write to USB_UPHY_XTAL - [powerpc*] crash: fix backup region offset update to elfcorehdr - [powerpc*] crash: Update backup region offset in elfcorehdr on memory hotplug - macvlan: annotate data-races around port->bc_queue_len_used - bpf: fix end-of-list detection in cgroup_storage_get_next_key() - bpf: Fix stale offload->prog pointer after constant blinding - wifi: brcmfmac: Fix error pointer dereference - wifi: mac80211: handle VHT EXT NSS in ieee80211_determine_our_sta_mode() - bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks - bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() - wifi: ath10k: fix station lookup failure during disconnect - ACPI: AGDI: fix missing newline in error message - [arm64] kexec: Remove duplicate allocation for trans_pgd - net: bcmgenet: fix off-by-one in bcmgenet_put_txcb - net: bcmgenet: add bcmgenet_has_* helpers - net: bcmgenet: move DESC_INDEX flow to ring 0 - net: bcmgenet: support reclaiming unsent Tx packets - net: bcmgenet: switch to use 64bit statistics - net: bcmgenet: fix racing timeout handler - eth: fbnic: Use wake instead of start - netfilter: xt_socket: enable defrag after all other checks - netfilter: nft_fwd_netdev: check ttl/hl before forwarding - bpf: fix mm lifecycle in open-coded task_vma iterator - bpf: switch task_vma iterator from mmap_lock to per-VMA locks - bpf: return VMA snapshot from task_vma iterator - bpf: Fix RCU stall in bpf_fd_array_map_clear() - net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf - bpf: Relax scalar id equivalence for state pruning - bpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars - net/sched: act_ct: Only release RCU read lock after ct_ft - net: airoha: Implement BQL support - net: airoha: Add missing RX_CPU_IDX() configuration in airoha_qdma_cleanup_rx_queue() - bpf: Allow instructions with arena source and non-arena dest registers - net/rds: Optimize rds_ib_laddr_check - net/rds: Restrict use of RDS/IB to the initial network namespace - bpf: Fix OOB in pcpu_init_value - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls - net: ipa: Fix programming of QTIME_TIMESTAMP_CFG - net: ipa: Fix decoding EV_PER_EE for IPA v5.0+ - dt-bindings: net: dsa: nxp,sja1105: make spi-cpol optional for sja1110 - net: phy: fix a return path in get_phy_c45_ids() - net/mlx5e: Fix features not applied during netdev registration - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() - bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb - Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp - Bluetooth: SCO: check for codecs->num_codecs == 1 before assigning to sco_pi(sk)->codec - net: phy: qcom: at803x: Use the correct bit to disable extended next page - ipv4: udp: fix typos in comments - ipv6: udp: fix typos in comments - udp: Force compute_score to always inline - tcp: Don't set treq->req_usec_ts in cookie_tcp_reqsk_init(). - sctp: fix missing encap_port propagation for GSO fragments - net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master - drm/komeda: fix integer overflow in AFBC framebuffer size check - ASoC: SOF: ipc3: Use standard dev_dbg API - ASoC: add symmetric_ prefix for dai->rate/channels/sample_bits - ASoC: soc-compress: use function to clear symmetric params - drm/sun4i: backend: fix error pointer dereference - ASoC: sti: Return errors from regmap_field_alloc() - ASoC: sti: use managed regmap_field allocations - dm cache: fix null-deref with concurrent writes in passthrough mode - dm cache: fix write path cache coherency in passthrough mode - dm cache: fix write hang in passthrough mode - dm cache policy smq: fix missing locks in invalidating cache blocks - dm cache: fix concurrent write failure in passthrough mode - dm cache: support shrinking the origin device - dm cache: fix dirty mapping checking in passthrough mode switching - platform/chrome: chromeos_tbmc: Drop wakeup source on remove - PCI: endpoint: Align pci_epc_set_msix(), pci_epc_ops::set_msix() nr_irqs encoding - PCI: dwc: ep: Fix MSI-X Table Size configuration in dw_pcie_ep_set_msix() - PCI: dwc: Invoke post_init in dw_pcie_resume_noirq() - PCI: dwc: Perform cleanup in the error path of dw_pcie_resume_noirq() - dm cache metadata: fix memory leak on metadata abort retry - dm log: fix out-of-bounds write due to region_count overflow - drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() - drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs - drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check - spi: spi-nxp-fspi: enable runtime pm for fspi - spi: nxp-fspi: Use reinit_completion() for repeated operations - spi: fsl-qspi: Use reinit_completion() for repeated operations - media: i2c: og01a1b: Replace client->dev usage - media: i2c: og01a1b: Fix V4L2 subdevice data initialization on probe - drm/v3d: Handle error from drm_sched_entity_init() - drm/sun4i: Fix resource leaks - drm/amdgpu: Add default case in DVI mode validation - dm init: ensure device probing has finished in dm-mod.waitfor= - fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break - crypto: tegra - finalize crypto req on error - crypto: tegra - Transfer HASH init function to crypto engine - crypto: tegra - Reserve keyslots to allocate dynamically - crypto: tegra - Disable softirqs before finalizing request - crypto: atmel - Use unregister_{aeads,ahashes,skciphers} - crypto: atmel-aes - guard unregister on error in atmel_aes_register_algs - padata: Remove cpu online check from cpu add and removal - padata: Put CPU offline callback in ONLINE section to allow failure - PCI: dwc: rcar-gen4: Change EPC BAR alignment to 4K as per the documentation - drm/amdgpu/gfx10: look at the right prop for gfx queue priority - drm/amdgpu/gfx11: look at the right prop for gfx queue priority - spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo - drm/imagination: Switch reset_reason fields from enum to u32 - iommu/tegra241-cmdqv: Set supports_cmd op in tegra241_vcmdq_hw_init() - [arm64] drm/msm/dpu: fix mismatch between power and frequency - [arm64] drm/msm/dsi: add the missing parameter description - [arm64] drm/msm/dsi: fix bits_per_pclk - [arm64] drm/msm/dsi: fix hdisplay calculation for CMD mode panel - [arm64] drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 - drm/panel: sharp-ls043t1le01: make use of prepare_prev_first - drm/panel: simple: Correct G190EAN01 prepare timing - PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion support - ALSA: core: Validate compress device numbers without dynamic minors - drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled - drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs - drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock - drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 - drm/amd/pm/ci: Clear EnabledForActivity field for memory levels - drm/amd/pm/ci: Fill DW8 fields from SMC - drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board - drm/amdgpu: add amdgpu_device reference in ip block - drm/amdgpu: update the handle ptr in dump_ip_state - drm/amdgpu: update the handle ptr in early_init - drm/amdgpu/uvd4.2: Don't initialize UVD 4.2 when DPM is disabled - hwmon: Switch back to struct platform_driver::remove() - hwmon: (aspeed-g6-pwm-tach): remove redundant driver remove callback - ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') - [amd64] ASoC: SOF: Intel: hda: Place check before dereference - [arm64] drm/msm/a6xx: Fix HLSQ register dumping - [arm64] drm/msm/shrinker: Fix can_block() logic - [arm64] drm/msm/a6xx: Fix dumping A650+ debugbus blocks - [arm64] drm/msm/a6xx: Use barriers while updating HFI Q headers - pmdomain: ti: omap_prm: Fix a reference leak on device node - pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe() - PM: domains: De-constify fields in struct dev_pm_domain_attach_data - ASoC: fsl_micfil: Add access property for "VAD Detected" - ASoC: fsl_micfil: Fix event generation in hwvad_put_enable() - ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode() - ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state() - ASoC: fsl_micfil: Fix event generation in micfil_quality_set() - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() - ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() - ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() - ASoC: fsl_easrc: Change the type for iec958 channel status controls - [amd64] iommu/amd: Remove protection_domain.dev_cnt variable - [amd64] iommu/amd: xarray to track protection_domain->iommu list - [amd64] iommu/amd: Do not detach devices in domain free path - [amd64] iommu/amd: Reduce domain lock scope in attach device path - [amd64] iommu/amd: Rearrange attach device code - [amd64] iommu/amd: Convert dev_data lock from spinlock to mutex - [amd64] iommu/amd: Introduce helper function to update 256-bit DTE - [amd64] iommu/amd: Introduce helper function get_dte256() - [amd64] iommu/amd: Fix clone_alias() to use the original device's devid - [arm64] ASoC: qcom: qdsp6: topology: check widget type before accessing data - crypto: qat - introduce fuse array - crypto: qat - disable 4xxx AE cluster when lead engine is fused off - crypto: qat - disable 420xx AE cluster when lead engine is fused off - crypto: qat - fix type mismatch in RAS sysfs show functions - crypto: qat - use swab32 macro - ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] - PCI: Enable AtomicOps only if Root Port supports them - PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found - Documentation: fix a hugetlbfs reservation statement - ALSA: scarlett2: Add missing sentinel initializer field - ASoC: SOF: compress: return the configured codec from get_params - PCI/NPEM: Set LED_HW_PLUGGABLE for hotplug-capable ports - PCI: tegra194: Fix polling delay for L2 state - PCI: tegra194: Increase LTSSM poll time on surprise link down - PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down - PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in tegra_pcie_downstream_dev_to_D0() - PCI: tegra194: Don't force the device into the D0 state before L2 - PCI: tegra194: Disable PERST# IRQ only in Endpoint mode - PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select" - PCI: tegra194: Disable direct speed change for Endpoint mode - PCI: tegra194: Set LTR message request before PCIe link up in Endpoint mode - PCI: tegra194: Allow system suspend when the Endpoint link is not up - PCI: tegra194: Free up Endpoint resources during remove() - PCI: tegra194: Use DWC IP core version - PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well - PCI: tegra194: Fix CBB timeout caused by DBI access before core power-on - spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback - ALSA: sc6000: Keep the programmed board state in card-private data - dm cache: fix missing return in invalidate_committed's error path - crypto: jitterentropy - replace long-held spinlock with mutex - ALSA: hda/realtek - fixed speaker no sound update - gfs2: Call unlock_new_inode before d_instantiate - net/socket.c: switch to CLASS(fd) - fdget(), trivial conversions - fanotify: call fanotify_events_supported() before path_permission() and security_path_notify() - quota: Fix race of dquot_scan_active() with quota deactivation - gfs2: add some missing log locking - gfs2: prevent NULL pointer dereference during unmount - efi/capsule-loader: fix incorrect sizeof in phys array reallocation - ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine - [arm64] dts: mediatek: mt8365: Describe infracfg-nao as a pure syscon - memory: tegra124-emc: Fix dll_change check - memory: tegra30-emc: Fix dll_change check - [arm64] dts: imx8-apalis: Fix LEDs name collision - [arm64] dts: rockchip: Make Jaguar PCIe-refclk pin use pull-up config - [arm64] dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO (M.2 W_DISABLE1) - iommufd: vfio compatibility extension check for noiommu mode - [arm64] dts: mediatek: mt6795: Fix gpio-ranges pin count - [arm64] dts: mediatek: mt7981b: Fix gpio-ranges pin count - [arm64] dts: mediatek: mt7986a: Fix gpio-ranges pin count - [arm64] dts: qcom: msm8953-xiaomi-vince: correct wled ovp value - [arm64] dts: qcom: msm8953-xiaomi-daisy: fix backlight - [arm64] dts: rockchip: Fix Bluetooth stability on LCKFB TaiShan Pi - [arm64] dts: rockchip: Correct Fan Supply for Gameforce Ace - [arm64] dts: rockchip: Correct Joystick Axes on Gameforce Ace - [arm64] soc: qcom: ocmem: make the core clock optional - [arm64] soc: qcom: ocmem: register reasons for probe deferrals - [arm64] soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available - bus: rifsc: fix RIF configuration check for peripherals - [arm64] dts: qcom: sm8450: Fix GIC_ITS range length - [arm64] dts: qcom: sm8550: Fix GIC_ITS range length - [arm64] dts: qcom: sm8650: Fix GIC_ITS range length - [arm64] dts: qcom: sm8550: Fix xo clock supply of platform SD host controller - [arm64] dts: qcom: sm8650: Fix xo clock supply of SD host controller - [arm64] dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes - [arm64] dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes - [arm64] dts: qcom: sm8650: Enable UHS-I SDR50 and SDR104 SD card modes - [arm64] dts: qcom: sm7225-fairphone-fp4: Fix conflicting bias pinctrl - [arm64] dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered during boot - [arm64] dts: ti: k3-am62p5-sk: Disable MMC1 internal pulls on data pins - [arm64] dts: ti: k3-am62-lp-sk: Enable internal pulls for MMC0 data pins - [arm64] dts: ti: k3-am62-verdin: Fix SPI_1 GPIO CS pinctrl label - [arm64] dts: freescale: imx8mp-tqma8mpql-mba8mp-ras314: fix UART1 RTS/CTS muxing - [arm64] dts: lx2160a: change i2c0 (iic1) pinmux mask to one bit - [arm64] dts: lx2160a: remove duplicate pinmux nodes - [arm64] dts: lx2160a: rename pinmux nodes for readability - [arm64] dts: lx2160a: add sda gpio references for i2c bus recovery - [arm64] dts: lx2160a: change zeros to hexadecimal in pinmux nodes - [arm64] dts: lx2160a: complete pinmux for rcwsr12 configuration word - [arm64] dts: imx8qm-mek: switch Type-C connector power-role to dual - [arm64] dts: imx8qxp-mek: switch Type-C connector power-role to dual - soc/tegra: cbb: Set ERD on resume for err interrupt - unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure - ocfs2/dlm: validate qr_numregions in dlm_match_regions() - ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison - soc: qcom: llcc: fix v1 SB syndrome register offset - [arm64] soc: qcom: aoss: compare against normalized cooling state - [arm64] dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP - [arm64] xor: fix conflicting attributes for xor_block_template - firmware: arm_ffa: Use the correct buffer size during RXTX_MAP - ocfs2: fix listxattr handling when the buffer is full - ocfs2: validate bg_bits during freefrag scan - ocfs2: validate group add input before caching - dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function - soundwire: bus: demote UNATTACHED state warnings to dev_dbg() - dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() - soundwire: cadence: Clear message complete before signaling waiting thread - tracing: Rebuild full_name on each hist_field_name() call - hte: tegra194: remove Kconfig dependency on Tegra194 SoC - remoteproc: xlnx: Fix sram property parsing - ima: check return value of crypto_shash_final() in boot aggregate - HID: asus: make asus_resume adhere to linux kernel coding standards - HID: asus: do not abort probe when not necessary - mtd: physmap_of_gemini: Fix disabled pinctrl state check - ima_fs: don't bother with removal of files in directory we'll be removing - ima_fs: get rid of lookup-by-dentry stuff - ima_fs: Correctly create securityfs files for unsupported hash algos - dt-bindings: interrupt-controller: arm,gic-v3: Fix EPPI range - mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations - mtd: spi-nor: sfdp: introduce smpt_read_dummy fixup hook - mtd: spi-nor: sfdp: introduce smpt_map_id fixup hook - mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation - mtd: spi-nor: swp: check SR_TB flag when getting tb_mask - mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path - mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions - cxl/pci: Check memdev driver binding status in cxl_reset_done() - mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob - HID: usbhid: fix deadlock in hid_post_reset() - ext4: fix possible null-ptr-deref in mbt_kunit_exit() - [arm64] bpf, arm64: Fix off-by-one in check_imm signed range check - bpf, sockmap: Fix af_unix iter deadlock - bpf, sockmap: Fix af_unix null-ptr-deref in proto update - bpf, sockmap: Take state lock for af_unix iter - bpf: Fix precedence bug in convert_bpf_ld_abs alignment check - bpf: Fix NULL deref in map_kptr_match_type for scalar regs - bpf: allow UTF-8 literals in bpf_bprintf_prepare() - bpf: Validate node_id in arena_alloc_pages() - bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT - pinctrl: pinctrl-pic32: Fix resource leak - pinctrl: cy8c95x0: remove duplicate error message - pinctrl: cy8c95x0: Unify messages with help of dev_err_probe() - pinctrl: cy8c95x0: Avoid returning positive values to user space - perf branch: Avoid incrementing NULL - perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace - pinctrl: realtek: Fix function signature for config argument - pinctrl: abx500: Fix type of 'argument' variable - pinctrl: renesas: rzg2l: Fix save/restore of {IOLH,IEN,PUPD,SMT} registers - perf lock: Fix option value type in parse_max_stack - perf stat: Fix opt->value type for parse_cache_level - perf tools: Fix module symbol resolution for non-zero .text sh_addr - perf expr: Return -EINVAL for syntax error in expr__find_ids() - ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure - ipmi: ssif_bmc: fix message desynchronization after truncated response - ipmi: ssif_bmc: change log level to dbg in irq callback - perf evsel: Add alternate_hw_config and use in evsel__match - perf tool_pmu: Factor tool events into their own PMU - perf python: Add parse_events function - perf cgroup: Update metric leader in evlist__expand_cgroup - perf maps: Fix copy_from that can break sorted by name order - perf util: Kill die() prototype, dead for a long time - reset: replace boolean parameters with flags parameter - reset: Add devres helpers to request pre-deasserted reset controls - i3c: master: dw-i3c: Fix missing reset assertion in remove() callback - i3c: dw: Fix memory leak in dw_i3c_master_i3c_xfers() - i3c: mipi-i3c-hci: fix IBI payload length calculation for final status - backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() - platform/surface: surfacepro3_button: Drop wakeup source on remove - leds: lgm-sso: Remove duplicate assignments for priv->mmap - tty: hvc_iucv: fix off-by-one in number of supported devices - platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup - mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() - nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist() - [amd64] platform/x86: asus-wmi: adjust screenpad power/brightness handling - [amd64] platform/x86: asus-wmi: fix screenpad brightness range - tty: serial: ip22zilog: Fix section mispatch warning - fs/ntfs3: terminate the cached volume label after UTF-8 conversion - [amd64] platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() - [amd64] platform/x86: dell-wmi-sysman: bound enumeration string aggregation - RDMA/core: Prefer NLA_NUL_STRING - clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source - scsi: sg: Fix sysctl sg-big-buff register during sg_init() - scsi: sg: Resolve soft lockup issue when opening /dev/sgX - clk: qcom: dispcc-sc8280xp: remove CLK_SET_RATE_PARENT from byte_div_clk_src dividers - clk: qcom: dispcc-sm4450: Fix DSI byte clock rate setting - scsi: target: core: Fix integer overflow in UNMAP bounds check - dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs - clk: qcom: gcc-sc8180x: Add missing GDSCs - clk: qcom: gcc-sc8180x: Use retention for USB power domains - clk: qcom: gcc-sc8180x: Use retention for PCIe power domains - clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk - clk: qcom: dispcc-sm8250: Enable parents for pixel clocks - clk: imx: imx6q: Fix device node reference leak in pll6_bypassed() - clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels() - clk: imx8mq: Correct the CSI PHY sels - [amd64] x86/um/vdso: Drop VDSO64-y from Makefile - clk: qoriq: avoid format string warning - clk: xgene: Fix mapping leak in xgene_pllclk_init() - dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets - clk: qcom: dispcc-sc7180: Add missing MDSS resets - lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() - clk: qcom: gcc-x1e80100: Keep GCC USB QTB clock always ON - clk: visconti: pll: initialize clk_init_data to zero - f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show() - [amd64] drm/i915: Relocate the SKL wm sanitation code - [amd64] drm/i915/wm: Verify the correct plane DDB entry - crypto: sa2ul - Fix AEAD fallback algorithm names - crypto: ccp - copy IV using skcipher ivsize - erofs: add encoded extent on-disk definition - erofs: do sanity check on m->type in z_erofs_load_compact_lcluster() - erofs: avoid infinite loops due to corrupted subpage compact indexes (CVE-2025-68251) - erofs: unify lcn as u64 for 32-bit platforms - [arm64] dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT - [arm64] dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT - [arm64] dts: imx8mp-navqp: Correct PAD settings for PMIC_nINT - [arm64] dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT - [arm64] dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT - [arm64] dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for PMIC_nINT - PCMCIA: Fix garbled log messages for KERN_CONT - [arm64] dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT - [arm64] dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT - [arm64] dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT - [arm64] dts: marvell: armada-37xx: use 'usb2-phy' in USB3 controller's phy-names - net/sched: act_mirred: fix wrong device for mac_header_xmit check in tcf_blockcast_redir - macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF - net/sched: sch_cake: fix NAT destination port not being updated in cake_update_flowkeys - nexthop: fix IPv6 route referencing IPv4 nexthop - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch - tcp: add data-race annotations around tp->data_segs_out and tp->total_retrans - tcp: add data-race annotations for TCP_NLA_SNDQ_SIZE - tcp: annotate data-races around tp->bytes_sent - tcp: annotate data-races around tp->bytes_retrans - tcp: annotate data-races around tp->dsack_dups - tcp: annotate data-races around (tp->write_seq - tp->snd_nxt) - tcp: annotate data-races around tp->plb_rehash - ice: update PCS latency settings for E825 10G/25Gb modes - ice: Remove jumbo_remove step from TX path - ice: fix double-free of tx_buf skb - ice: fix ICE_AQ_LINK_SPEED_M for 200G - i40e: don't advertise IFF_SUPP_NOFCS - e1000e: Unroll PTP in probe error handling - ipv6: fix possible UAF in icmpv6_rcv() - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks - pppoe: drop PFC frames - net/mlx5: Fix HCA caps leak on notifier init failure - openvswitch: cap upcall PID array size and pre-size vport replies - netfilter: nft_osf: restrict it to ipv4 - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO - netfilter: conntrack: remove sprintf usage - netfilter: xtables: restrict several matches to inet family - ipvs: fix MTU check for GSO packets in tunnel mode - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check - slip: reject VJ receive packets on instances with no rstate array - slip: bound decode() reads against the compressed packet length - [arm64] dts: meson-gxl-p230: fix ethernet PHY interrupt number - pwm: atmel-tcb: Cache clock rates and mark chip as atomic - ksmbd: destroy tree_conn_ida in ksmbd_session_destroy() - ksmbd: destroy async_ida in ksmbd_conn_free() - ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open - ksmbd: scope conn->binding slowpath to bound sessions only - net/rds: zero per-item info buffer before handing it to visitors - ice: fix timestamp interrupt configuration for E825C - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g - net_sched: sch_hhf: annotate data-races in hhf_dump_stats() - net/sched: sch_pie: annotate data-races in pie_dump_stats() - net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats() - net/sched: sch_red: annotate data-races in red_dump_stats() - net/sched: sch_sfb: annotate data-races in sfb_dump_stats() - net: dsa: realtek: rtl8365mb: fix mode mask calculation - net: airoha: Move ndesc initialization at end of airoha_qdma_init_rx_queue() - virtio_net: Split struct virtio_net_rss_config - virtio_net: Fix endian with virtio_net_ctrl_rss - virtio_net: Use new RSS config structs - virtio_net: sync rss_trailer.max_tx_vq on queue_pairs change via VQ_PAIRS_SET - nfp: fix swapped arguments in nfp_encode_basic_qdr() calls - tipc: fix double-free in tipc_buf_append() - vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll() - fs/adfs: validate nzones in adfs_validate_bblk() - rtc: abx80x: Disable alarm feature if no interrupt attached - kbuild: builddeb - avoid recompiles for non-cross-compiles - fbdev: offb: fix PCI device reference leak on probe failure - mailbox: mtk-cmdq: Fix CURR and END addr for task insert case - mailbox: mailbox-test: free channels on probe error - cgroup/rdma: fix integer overflow in rdmacg_try_charge() - mailbox: add sanity check for channel array - mailbox: mailbox-test: don't free the reused channel - mailbox: mailbox-test: initialize struct earlier - mailbox: mailbox-test: make data_ready a per-instance variable - fsnotify: fix inode reference leak in fsnotify_recalc_mask() - btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent() - cgroup: Increment nr_dying_subsys_* from rmdir context - tracing: branch: Fix inverted check on stat tracer registration - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers - netfilter: arp_tables: fix IEEE1394 ARP payload parsing - nvme-pci: fix missed admin queue sq doorbell write - drm/amdgpu/gmc: Fix AMDGPU_GART_PLACEMENT_LOW to not overlap with VRAM - drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG - drm/amdgpu: fix spelling typos - drm/amdgpu/uvd3.1: Don't validate the firmware when already validated - drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) - netfilter: xt_policy: fix strict mode inbound policy matching - netfilter: nf_conntrack_sip: don't use simple_strtoul - [amd64] ASoC: amd: acp: Add DMI quirk for Valve Steam Deck OLED - spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ - drm/sysfb: ofdrm: fix PCI device reference leaks - arm64/scs: Fix potential sign extension issue of advance_loc4 - cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro() - netdevsim: zero initialize struct iphdr in dummy sk_buff - net/sched: netem: fix probability gaps in 4-state loss model - net/sched: netem: fix queue limit check to include reordered packets - net/sched: netem: only reseed PRNG when seed is explicitly provided - net/sched: netem: validate slot configuration - net/sched: netem: fix slot delay calculation overflow - net/sched: netem: check for negative latency and jitter - net/sched: sch_choke: annotate data-races in choke_dump_stats() - net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats() - vrf: Fix a potential NPD when removing a port from a VRF - net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() - net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit - NFC: trf7970a: Ignore antenna noise when checking for RF field - net/sched: taprio: fix NULL pointer dereference in class dump - neigh: let neigh_xmit take skb ownership - tcp: make probe0 timer handle expired user timeout - net, treewide: define and use MAC_ADDR_STR_LEN - netconsole: allow selection of egress interface via MAC address - netpoll: Extract carrier wait function - netpoll: extract IPv4 address retrieval into helper function - netpoll: fix IPv6 local-address corruption - ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams - sched/fair: Clear rel_deadline when initializing forked entities - net: mctp i2c: check length before marking flow active - net: phy: dp83869: fix setting CLK_O_SEL field. - drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.5 enc ring - drm/amdgpu/vcn: set no_user_fence for VCN v5.0.0 enc ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.5 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.0 ring - ASoC: codecs: ab8500: Fix casting of private data - netfilter: skip recording stale or retransmitted INIT - sctp: discard stale INIT after handshake completion - bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() - net/sched: sch_cake: annotate data-races in cake_dump_stats() (V) - netconsole: propagate device name truncation in dev_name_store() - ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 - ALSA: hda/conexant: Fix missing error check for jack detection - ALSA: hda: cs35l56: Fix uninitialized value in cs35l56_hda_read_acpi() - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup - drm/amd/display: Allow DCE link encoder without AUX registers - drm/amd/display: Read EDID from VBIOS embedded panel info - drm/xe/debugfs: Correct printing of register whitelist ranges - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() - drm/xe/gsc: Fix BO leak on error in query_compatibility_version() - page_pool: Set `dma_sync` to false for devmem memory provider - net: page_pool: create hooks for custom memory providers - page_pool: fix memory-provider leak in page_pool_create_percpu() error path - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING - iavf: stop removing VLAN filters from PF on interface down - iavf: wait for PF confirmation before removing VLAN filters - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler - ice: fix NULL pointer dereference in ice_reset_all_vfs() - net: tls: fix strparser anchor skb leak on offload RX setup failure - sfc: fix error code in efx_devlink_info_running_versions() - net/sched: cls_flower: revert unintended changes - [arm64] Reserve an extra page for early kernel mapping - smb: client: correctly handle ErrorContextData as a flexible array - smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613) - LoongArch: KVM: Compile switch.S directly into the kernel - ntfs: ->d_compare() must not block - PCI: Initialize temporary device in new_id_store() - net: bcmgenet: Initialize u64 stats seq counter - net: bcmgenet: fix leaking free_bds - [amd64] iommu/amd: Reorder attach device code - [amd64] iommu/amd: Put list_add/del(dev_data) back under the domain->lock - perf tool_pmu: Fix aggregation on duration_time - net/sched: sch_pie: annotate more data-races in pie_dump_stats() - netpoll: Extract IPv6 address retrieval function - netpoll: pass buffer size to egress_dev() to avoid MAC truncation - page_pool: fix incorrect mp_ops error handling - crypto: af_alg - Cap AEAD AD length to 0x80000000 - i40e: Cleanup PTP pins on probe failure - workqueue: Fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path - netfilter: nf_conntrack_sip: get helper before allocating expectation - audit: fix incorrect inheritable capability in CAPSET records - Revert "ACPI: CPPC: Adjust debug messages in amd_set_max_freq_ratio() to warn" - netfilter: nft_ct: fix missing expect put in obj eval - net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled - audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV - KVM: Reject wrapped offset in kvm_reset_dirty_gfn() - [s390x] KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic - [amd64] KVM: x86: Fix Xen hypercall tracepoint argument assignment - netfilter: nf_tables: unconditionally bump set->nelems before insertion (CVE-2026-23272) - ata: libata-scsi: fix requeue of deferred ATA PASS-THROUGH commands - smb/client: fix possible infinite loop and oob read in symlink_data() - [amd64] drm/i915/dp: Fix VSC dynamic range signaling for RGB formats - ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans - ALSA: usb-audio: Bound MIDI endpoint descriptor scans - ceph: fix a buffer leak in __ceph_setxattr() - ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size - io-wq: check that the predecessor is hashed in io_wq_remove_pending() - [powerpc*] warp: Fix error handling in pika_dtm_thread - netfs: fix error handling in netfs_extract_user_iter() - irqchip/riscv-imsic: Clear interrupt move state during CPU offlining - libceph: Fix potential out-of-bounds access in osdmap_decode() - libceph: Fix potential null-ptr-deref in decode_choose_args() - libceph: Fix potential out-of-bounds access in crush_decode() - libceph: handle rbtree insertion error in decode_choose_args() - [amd64] iommu/vt-d: Disable DMAR for Intel Q35 IGFX - [amd64] drm/i915: skip __i915_request_skip() for already signaled requests - drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() - drm/xe/dma-buf: handle empty bo and UAF races - drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup - drm/gma500/oaktrail_lvds: fix hang on init failure - drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init - iommufd: Fix return value of iommufd_fault_fops_write() - eventfs: Use list_add_tail_rcu() for SRCU-protected children list - drm/v3d: Reject empty multisync extension to prevent infinite loop - btrfs: use inode already stored in local variable at btrfs_rmdir() - btrfs: use btrfs inodes in btrfs_rmdir() to avoid so much usage of BTRFS_I() - btrfs: fix missing last_unlink_trans update when removing a directory - smb: client: Use FullSessionKey for AES-256 encryption key derivation - btrfs: do not mark inode incompressible after inline attempt fails - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() - sched_ext: Guard scx_dsq_move() against NULL kit->dsq after failed iter_new - mptcp: pm: prio: skip closed subflows - mptcp: drop __mptcp_fastopen_gen_msk_ackseq() - mptcp: fix rx timestamp corruption on fastopen - f2fs: fix incorrect file address mapping when inline inode is unwritten - f2fs: fix false alarm of lockdep on cp_global_sem lock - spi: sifive: Simplify clock handling with devm_clk_get_enabled() - spi: sifive: fix controller deregistration - mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 - mptcp: pm: ADD_ADDR rtx: fix potential data-race - mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker - netfs: Fix potential uninitialised var in netfs_extract_user_iter() https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.92 - mptcp: sync the msk->sndbuf at accept() time - mptcp: pm: ADD_ADDR rtx: allow ID 0 - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount (CVE-2026-46158) - mptcp: pm: ADD_ADDR rtx: free sk if last (CVE-2026-46170) - ksmbd: validate owner of durable handle on reconnect (CVE-2026-31717) - drm/xe/hdcp: Add NULL check for media_gt in intel_hdcp_gsc_check_status() (CVE-2026-46216) - [s390x] debug: Reject zero-length input before trimming a newline - Revert "perf cgroup: Update metric leader in evlist__expand_cgroup" - Revert "perf tool_pmu: Fix aggregation on duration_time" - Revert "perf python: Add parse_events function" - Revert "perf tool_pmu: Factor tool events into their own PMU" - bridge: mrp: reject zero test interval to avoid OOM panic (CVE-2026-31420) - spi: spi-dw-dma: fix print error log when wait finish transaction (CVE-2026-31560) - Revert "x86/vdso: Fix output operand size of RDPID" - sched/deadline: Less agressive dl_server handling - sched/deadline: Fix dl_server_stopped() - sched/deadline: Fix dl_server getting stuck - sched/deadline: Fix dl_server behaviour - sched/deadline: Stop dl_server before CPU goes offline - ksmbd: close durable scavenger races against m_fp_list lookups - af_unix: Give up GC if MSG_PEEK intervened. (CVE-2026-23394) - drm/imagination: Synchronize interrupts before suspending the GPU (CVE-2026-23469) - ata: libata-scsi: improve readability of ata_scsi_qc_issue() - ata: libata-scsi: do not use the deferred QC feature for ATA_DEFER_PORT - ata: libata-scsi: do not use the deferred QC feature on PMPs with CBS - ata: libata-scsi: do not needlessly defer commands when using PMP with FBS - perf parse-events: Expose/rename config_term_name - Revert "ice: fix double-free of tx_buf skb" - Revert "ice: Remove jumbo_remove step from TX path" - tracing: Fix the bug where bpf_get_stackid returns -EFAULT on the ARM64 - net/mlx5e: Trigger neighbor resolution for unresolved destinations - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init - [amd64] x86/fgraph: Fix return_to_handler regs.rsp value - [amd64] iommu/vt-d: Draining PRQ in sva unbind path when FPD bit set - [riscv64] fgraph: Select HAVE_FUNCTION_GRAPH_TRACER depends on HAVE_DYNAMIC_FTRACE_WITH_ARGS - [riscv64] fgraph: Fix stack layout to match __arch_ftrace_regs argument of ftrace_return_to_handler (CVE-2025-22069) - hwmon: (pmbus/core) Protect regulator operations with mutex - [arm64] Kconfig: Remove selecting replaced HAVE_FUNCTION_GRAPH_RETVAL - sysfs: don't remove existing directory on update failure - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() - ksmbd: fix null pointer dereference in compare_guid_key() - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow - ksmbd: validate SID in parent security descriptor during ACL inheritance - smb: client: require net admin for CIFS SWN netlink - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() - smb: client: use data_len for SMB2 READ encrypted folioq copy - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX - ALSA: ua101: Reject too-short USB descriptors - ALSA: pcm: Don't setup bogus iov_iter for silencing - ALSA: asihpi: Fix potential OOB array access at reading cache - efi: Allocate runtime workqueue before ACPI init - io_uring/waitid: clear waitid info before copying it to userspace - drivers/base/memory: fix memory block reference leak in poison accounting - ipv6: ioam: refresh hdr pointer before ioam6_event() - mm/memory_hotplug: fix memory block reference leak on remove - net: wwan: iosm: fix potential memory leaks in ipc_imem_init() - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START - Bluetooth: bnep: Fix UAF read of dev->name - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths - Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer - Bluetooth: MGMT: validate Add Extended Advertising Data length - Bluetooth: serialize accept_q access - phonet/pep: disable BH around forwarded sk_receive_skb() - net: bcmgenet: keep RBUF EEE/PM disabled - net: ifb: report ethtool stats over num_tx_queues - net: pse-pd: fix sign on -ENOENT check in of_load_pse_pis() - netfilter: ip6t_hbh: reject oversized option lists - netfilter: nf_queue: hold bridge skb->dev while queued - netfilter: ipset: stop hash:* range iteration at end - netfilter: nft_inner: Fix IPv6 inner_thoff desync - sched_ext: Fix missing warning in scx_set_task_state() default case - sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path - cgroup/cpuset: Reset DL migration state on can_attach() failure - fs/ntfs3: handle attr_set_size() errors when truncating files - l2tp: use list_del_rcu in l2tp_session_unhash - qed: fix double free in qed_cxt_tables_alloc() - ring-buffer: Fix reporting of missed events in iterator - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() - vsock/vmci: fix UAF when peer resets connection during handshake - vsock/virtio: reset connection on receiving queue overflow - wifi: ath11k: clear shared SRNG pointer state on restart - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 - ixgbevf: fix use-after-free in VEPA multicast source pruning - rbd: eliminate a race in lock_dwork draining on unmap - lsm: hold cred_guard_mutex for lsm_set_self_attr() - [arm64] octeontx2-af: CGX: add bounds check to cgx_speed_mbps index - ice: fix setting promisc mode while adding VID filter - ice: restore PTP Rx timestamp config after ethtool set-channels - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() - wifi: mac80211: consume only present negotiated TTLM maps - cifs: Fix busy dentry used after unmounting - tracing: Do not call map->ops->elt_free() if elt_alloc() fails - [arm64] probes: Handle probes on hinted conditional branch instructions - [arm64] KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits - [arm64] KVM: arm64: vgic: Free private_irqs when init fails after allocation - [riscv64] kvm: return SBI_ERR_FAILURE for pmu_snapshot_set_shmem() when OOM - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe - spi: qup: fix error pointer deref after DMA setup failure - [arm64] phy: tegra: xusb: Fix per-pad high-speed termination calibration - scsi: isci: Fix use-after-free in device removal path - spi: ep93xx: fix error pointer deref after DMA setup failure - spi: sprd: fix error pointer deref after DMA setup failure - spi: ti-qspi: fix use-after-free after DMA setup failure - RDMA/siw: Reject MPA FPDU length underflow before signed receive math - device property: set fwnode->secondary to NULL in fwnode_init() - drm/virtio: use uninterruptible resv lock for plane updates - drm/amdgpu/vpe: Force collaborate sync after TRAP - drm/bridge: it66121: acquire reset GPIO in probe - drm/bridge: megachips: remove bridge when irq request fails - drm/amd/display: Fix integer overflow in bios_get_image() - drm/amd/display: Validate GPIO pin LUT table size before iterating - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async - batman-adv: mcast: fix use-after-free in orig_node RCU release - batman-adv: clear current gateway during teardown - batman-adv: dat: handle forward allocation error - batman-adv: fix fragment reassembly length accounting - batman-adv: fix tp_meter counter underflow during shutdown - batman-adv: frag: disallow unicast fragment in fragment - batman-adv: bla: fix report_work leak on backbone_gw purge - batman-adv: tp_meter: avoid use of uninit sender vars - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown - batman-adv: tp_meter: fix race condition in send error reporting - batman-adv: tt: fix negative last_changeset_len - batman-adv: tt: fix negative tt_buff_len - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock - hwmon: (pmbus/adm1266) reject implausible blackbox record_count - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors - [arm64] pinctrl: renesas: rzg2l: Fix incorrect PUPD register offset for high pins during suspend/resume - HID: uclogic: Fix regression of input name assignment - [riscv64] mm: Fixup no5lvl failure when vaddr is invalid - [arm64] pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 - ALSA: hda: cs35l56: Put ACPI device after setting companion - ALSA: hda: cs35l41: Put ACPI device on missing physical node - btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() - netfilter: x_tables: unregister the templates first - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist() - tcp: Fix imbalanced icsk_accept_queue count. - ice: fix setting RSS VSI hash for E830 - ice: fix locking in ice_dcb_rebuild() - net: lan966x: avoid unregistering netdev on register failure - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access - NFSD: Fix infinite loop in layout state revocation - irqchip/ath79-cpu: Remove unused function - ublk: reject max_sectors smaller than PAGE_SECTORS in parameter validation - nsfs: fix wrong error code returned for pidns ioctls - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT - zonefs: handle integer overflow in zonefs_fname_to_fno - tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key(). - [powerpc*] fix dead default for GUEST_STATE_BUFFER_TEST - netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call - netfs: Fix overrun check in netfs_extract_user_iter() - netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone - netfs: Defer the emission of trace_netfs_folio() - netfs: Fix streaming write being overwritten - netfs: Fix potential deadlock in write-through mode - netfs: Fix write streaming disablement if fd open O_RDWR - netfs: Fix early put of sink folio in netfs_read_gaps() - netfs: Fix partial invalidation of streaming-write folio - netfs: Fix a few minor bugs in netfs_page_mkwrite() - netfs: Remove unnecessary references to pages - netfs: Fix folio->private handling in netfs_perform_write() - net: ethernet: cortina: Make RX SKB per-port - net: ethernet: cortina: Drop half-assembled SKB - net: ethernet: cortina: Carry over frag counter - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference - wifi: ath11k: fix error path leaks in some WMI WOW calls - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() - wifi: ath10k: skip WMI and beacon transmission when device is wedged - blk-integrity: remove seed for user mapped buffers - block: don't overwrite bip_vcnt in bio_integrity_copy_user() - block: recompute nr_integrity_segments in blk_insert_cloned_request - HID: quirks: really enable the intended work around for appledisplay - block: modify bio_integrity_map_user to accept iov_iter as argument - block: drop direction param from bio_integrity_copy_user() - blk-integrity: use simpler alignment check - blk-integrity: enable p2p source and destination - block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user() - accel/qaic: Add overflow check to remap_pfn_range during mmap - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics - [arm64] drm/msm/dsi: don't dump registers past the mapped region - [arm64] drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN - [powerpc*] time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring - net: tls: prevent chain-after-chain in plain text SG - net: phy: DP83TC811: add reading of abilities - [amd64] x86/xen: Fix xen_e820_swap_entry_with_ram() - tls: Preserve sk_err across recvmsg() when data has been copied - net/mlx5: Do not restore destination-less TC rules - scsi: sd: Fix return code handling in sd_spinup_disk() - ALSA: scarlett2: Add missing error check when initialise Autogain Status - io_uring/net: punt IORING_OP_BIND async if it needs file create - btrfs: fix squota accounting during enable generation - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() - [arm64] drm/msm/snapshot: fix dumping of the unaligned regions - drm/xe/gsc: Fix double-free of managed BO in error path - drm/xe/vf: Fix signature of print functions - drm/xe/pf: Fix CFI failure in debugfs access - wifi: ath11k: fix peer resolution on rx path when peer_id=0 - ice: ptp: serialize E825 PHY timer start with PTP lock - [amd64] drm/i915/dp: Fix readback for target_rr in Adaptive Sync SDP - [arm64] net: dsa: mt7530: fix FDB entries not aging out with short timeout - [arm64] net: dsa: mt7530: preserve VLAN tags on trapped link-local frames - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer - platform/surface: aggregator_registry: omit battery & AC nodes on Surface Laptop 7 - [amd64] platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL - [amd64] platform/x86: hp_accel: Check ACPI_COMPANION() against NULL - [amd64] platform/x86: intel-hid: Check ACPI_HANDLE() against NULL - [amd64] platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL - RDMA/rtrs: Fix use-after-free in path file creation cleanup - net: bridge: Flush multicast groups when snooping is disabled - bridge: mcast: Fix a possible use-after-free when removing a bridge port - pds_core: fix error handling in pdsc_devcmd_wait - pds_core: fix debugfs_lookup dentry leak and error handling - wifi: mac80211: fix MLE defragmentation - ALSA: seq: Serialize UMP output teardown with event_input - tracing: Avoid NULL return from hist_field_name() on truncation - Bluetooth: btmtk: fix urb->setup_packet leak in error paths - net: ag71xx: check error for platform_get_irq - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() - drm/xe/oa: Fix exec_queue leak on width check in stream open - [arm64] octeontx2-af: npc: Fix allmulticast skip logic for LBK and SDP VFs - net: mana: validate rx_req_idx to prevent out-of-bounds array access - pds_core: ensure null-termination for firmware version strings - net: gro: don't merge zcopy skbs - landlock: Fix TCP handling of short AF_UNSPEC addresses - block: make bio_integrity_map_user() static inline - security/keys: fix missed RCU read section on lookup https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.93 - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size - [arm64] drm/v3d: Fix use-after-free of CPU job query arrays on error path - [arm64] drm/v3d: Release indirect CSD GEM reference on CPU job free - net/sched: cls_fw: fix NULL dereference of "old" filters before change() - net: mctp: ensure our nlmsg responses are initialised (CVE-2026-45930) - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit - net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked - bcache: fix uninitialized closure object - net: cpsw_new: Fix potential unregister of netdev that has not been registered yet (CVE-2026-43219) - [arm64] Introduce esr_is_ubsan_brk() - [arm64] debug: clean up single_step_handler logic - [arm64] refactor aarch32_break_handler() - [arm64] debug: call software breakpoint handlers statically - [arm64] debug: call step handlers statically - [arm64] debug: remove break/step handler registration infrastructure - [arm64] entry: Add entry and exit functions for debug exceptions - [arm64] debug: split hardware breakpoint exception entry - [arm64] debug: refactor reinstall_suspended_bps() - [arm64] debug: split single stepping exception entry - [arm64] debug: split hardware watchpoint exception entry - [arm64] debug: split brk64 exception entry - [arm64] debug: split bkpt32 exception entry - [arm64] debug: remove debug exception registration infrastructure - [arm64] debug: always unmask interrupts in el0_softstp() - nfc: llcp: Fix use-after-free in llcp_sock_release() - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() - xfrm: Check for underflow in xfrm_state_mtu - nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems - netfilter: synproxy: refresh tcphdr after skb_ensure_writable - netfilter: xt_cpu: prefer raw_smp_processor_id - netfilter: ebtables: fix OOB read in compat_mtw_from_user - tun: free page on short-frame rejection in tun_xdp_one() (CVE-2026-46321) - tun: free page on build_skb failure in tun_xdp_one() (CVE-2026-46322) - vsock: keep poll shutdown state consistent - net: netlink: fix sending unassigned nsid after assigned one - net: netlink: don't set nsid on local notifications - net/smc: Do not re-initialize smc hashtables - [s390x] net/iucv: fix locking in .getsockopt - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() - ALSA: pcm: oss: Fix setup list UAF on proc write error - [amd64] ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors - net: hsr: fix potential OOB access in supervision frame handling - [amd64] accel/ivpu: prevent uninitialized data bug in debugfs - gpio: mxc: fix irq_high handling - net: Avoid checksumming unreadable skb tail on trim - ethtool: rss: fix hkey leak when indir_size is 0 - ethtool: module: avoid leaking a netdev ref on module flash errors - ethtool: module: check fw_flash_in_progress under rtnl_lock - ethtool: module: fix cleanup if socket used for flashing multiple devices - ethtool: cmis: require exact CDB reply length - ethtool: cmis: fix u16-to-u8 truncation of msleep_pre_rpl - net: ethtool: Add new parameters and a function to support EPL - net: ethtool: Add support for writing firmware blocks using EPL payload - ethtool: cmis: validate start_cmd_payload_size from module - ethtool: cmis: validate fw->size against start_cmd_payload_size - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() - ASoC: codecs: simple-mux: Fix enum control bounds check - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() - bonding: refuse to enslave CAN devices - ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES - ethtool: linkstate: fix unbalanced ethnl_ops_complete() on PHY lookup error - ethtool: pse-pd: fix missing ethnl_ops_complete() - ethtool: strset: fix header attribute index in ethnl_req_get_phydev() - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback - ethtool: eeprom: add more safeties to EEPROM Netlink fallback - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() - net/sched: Revert "net/sched: Restrict conditions for adding duplicating netems to qdisc tree" - net/sched: fix packet loop on netem when duplicate is on - net/sched: act_mirred: Move the recursion counter struct netdev_xmit - net/sched: act_mirred: add loop detection - net: Introduce skb tc depth field to track packet loops - net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loop - net/sched: act_mirred: Fix return code in early mirred redirect error paths - net/handshake: Use spin_lock_bh for hn_lock - nvme-tcp: store negative errno in queue->tls_err - net/handshake: Pass negative errno through handshake_complete() - remove pointless includes of - net/handshake: Take a long-lived file reference at submit - net/handshake: Drain pending requests at net namespace exit - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close - [arm64,armhf] gpio: rockchip: convert bank->clk to devm_clk_get_enabled() - [amd64,arm64] net: mana: Add NULL guards in teardown path to prevent panic on attach failure - sctp: fix race between sctp_wait_for_connect and peeloff - ipv6: fix possible infinite loop in rt6_fill_node() - ipv6: fix possible infinite loop in fib6_select_path() - net: skbuff: fix pskb_carve leaking zcopy pages - perf: Fix dangling cgroup pointer in cpuctx - batman-adv: v: stop OGMv2 on disabled interface - batman-adv: tvlv: abort OGM send on tvlv append failure - batman-adv: tt: reject oversized local TVLV buffers - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface - batman-adv: tvlv: reject oversized TVLV packets - batman-adv: iv: recover OGM scheduling after forward packet error - batman-adv: tp_meter: avoid role confusion in tp_list - [s390x] cio: Restore GFP_DMA for CHSC allocation - batman-adv: tp_meter: directly shut down timer on cleanup - batman-adv: tt: fix TOCTOU race for reported vlans - batman-adv: tt: avoid empty VLAN responses - batman-adv: bla: avoid double decrement of bla.num_requests - mm/page_alloc: clear page->private in free_pages_prepare() (CVE-2026-43303) - media: rc: fix race between unregister and urb/irq callbacks - media: rc: ttusbir: fix inverted error logic - inet: frags: add inet_frag_queue_flush() - inet: frags: flush pending skbs in fqdir_pre_exit() (CVE-2025-68768) - HID: core: Add printk_ratelimited variants to hid_warn() etc - HID: pass the buffer size to hid_report_raw_event - HID: core: introduce hid_safe_input_report() - HID: core: Fix size_t specifier in hid_report_raw_event() - [amd64] drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register - [amd64] drm/i915/psr: Read Intel DPCD workaround register - drm/dp: Add eDP 1.5 bit definition - [amd64] drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used - [arm64] io: Rename ioremap_prot() to __ioremap_prot() - [arm64] io: Extract user memory type in ioremap_prot() (CVE-2026-23346) - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X - batman-adv: tt: prevent TVLV entry number overflow - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer - usb: typec: ucsi: ccg: reject firmware images without a ':' record header - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO - usb: typec: altmodes/displayport: validate count before reading Status Update VDO - usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT - usb: typec: ucsi: validate connector number in ucsi_connector_change() - USB: serial: safe_serial: fix memory corruption with small endpoint - media: rc: igorplugusb: fix control request setup packet - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse - Bluetooth: btusb: Allow firmware re-download when version matches - hpfs: fix a crash if hpfs_map_dnode_bitmap fails - ipc: limit next_id allocation to the valid ID range - auxdisplay: line-display: fix OOB read on zero-length message_store() - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn - Bluetooth: HIDP: fix missing length checks in hidp_input_report() - Bluetooth: ISO: fix UAF in iso_recv_frame - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync - Input: xpad - fix out-of-bounds access for Share button - parport: Fix race between port and client registration (Closes: #1130365) - USB: cdc-acm: Fix bit overlap and move quirk definitions to header - [arm64] KVM: arm64: PMU: Preserve AArch32 counter low bits - [amd64] KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC - [amd64] KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use - [amd64] KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests - [amd64] KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 - [amd64] KVM: SEV: Compute the correct max length of the in-GHCB scratch area - [amd64] KVM: SEV: Check PSC request indices against the actual size of the buffer - [amd64] KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer - [amd64] KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux - iio: adc: npcm: fix unbalanced clk_disable_unprepare() - iio: dac: max5821: fix return value check in powerdown sync - iio: dac: ad5686: fix input raw value check - iio: dac: ad5686: acquire lock when doing powerdown control - iio: adc: mt6359: fix unchecked return value in mt6358_read_imp - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw - iio: gyro: itg3200: fix i2c read into the wrong stack location - iio: gyro: adis16260: fix division by zero in write_raw - iio: ssp_sensors: cancel delayed work_refresh on remove - iio: temperature: tsys01: fix broken PROM checksum validation - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL - iio: light: cm3323: fix reg_conf not being initialized correctly - iio: buffer: hw-consumer: fix use-after-free in error path - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() - USB: serial: omninet: fix memory corruption with small endpoint - usb: cdns3: gadget: fix request skipping after clearing halt - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles - usb: dwc2: Fix use after free in debug code - Input: elan_i2c - validate firmware size before use - wireguard: send: append trailer after expanding head - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data - macsec: fix replay protection at XPN lower-PN wrap - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() - [arm64] ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params - ipv6: exthdrs: refresh nh after handling HAO option - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). - ipv6: validate extension header length before copying to cmsg - xfrm: input: hold netns during deferred transport reinjection - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname - ip6: vti: Use ip6_tnl.net in vti6_changelink(). - net: skbuff: fix missing zerocopy reference in pskb_carve helpers - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() - nfc: hci: fix out-of-bounds read in HCP header parsing - xfrm: route MIGRATE notifications to caller's netns - xfrm: ah: use skb_to_full_sk in async output callbacks - ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware 2417 - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check - [arm64] ASoC: qcom: q6asm-dai: close stream only when running - [arm64] ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks - xfrm: esp: restore combined single-frag length gate - Input: xpad - add "Nova 2 Lite" from GameSir - Input: xpad - add support for ASUS ROG RAIKIRI II - ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 - [amd64] comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() - [amd64] comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() - counter: Fix refcount leak in counter_alloc() error path - tty: serial: pch_uart: add check for dma_alloc_coherent() - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers - usb: chipidea: core: convert ci_role_switch to local variable - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers - usb: storage: Add quirks for PNY Elite Portable SSD - usbip: vudc: Fix use after free bug in vudc_remove due to race condition - usb: usbtmc: check URB actual_length for interrupt-IN notifications - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize - usb: typec: tcpm: improve handling of DISCOVER_MODES failures - USB: serial: option: add MeiG SRM813Q - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL - USB: serial: belkin_sa: validate interrupt status length - USB: serial: cypress_m8: validate interrupt packet headers - USB: serial: keyspan: fix missing indat transfer sanity check - USB: serial: mxuport: fix memory corruption with small endpoint - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind - usb: gadget: net2280: Fix double free in probe error path - usb: gadget: f_hid: fix device reference leak in hidg_alloc() - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports - usb: gadget: f_fs: copy only received bytes on short ep0 read - usb: gadget: f_fs: serialize DMABUF cancel against request completion - [amd64] thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() - [amd64] thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf - scsi: target: iscsi: Validate CHAP_R length before base64 decode - drm/hyperv: validate resolution_count and fix WIN8 fallback - drm/hyperv: validate VMBus packet size in receive callback - [amd64] drm/i915: Fix potential UAF in TTM object purge - drm/amd/pm/si: Disregard vblank time when no displays are connected - serial: altera_jtaguart: handle uart_add_one_port() failures - serial: qcom-geni: fix UART_RX_PAR_EN bit position - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ - serial: sh-sci: fix memory region release in error path - serial: zs: Fix swapped RI/DSR modem line transition counting - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger - drm/amdkfd: Check for pdd drm file first in CRIU restore path - serial: dz: Fix bootconsole message clobbering at chip reset - serial: dz: Fix bootconsole handover lockup - serial: dz: Convert to use a platform device - serial: zs: Fix bootconsole handover lockup - serial: zs: Switch to using channel reset - serial: zs: Convert to use a platform device - USB: serial: cypress_m8: fix memory corruption with small endpoint - USB: serial: digi_acceleport: fix memory corruption with small endpoints - xhci: tegra: Fix ghost USB device on dual-role port unplug - iommu: Skip PASID validation for devices without PASID capability - [amd64] x86/boot: Disable stack protector for early boot code - [amd64] x86/kexec: Disable KCOV instrumentation after load_segments() (CVE-2026-43331) - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer - serdev: Provide a bustype shutdown function - Bluetooth: hci_qca: Migrate to serdev specific shutdown function - Bluetooth: hci_qca: Convert timeout from jiffies to ms - ALSA: scarlett2: Return ENOSPC for out-of-bounds flash writes - ALSA: scarlett2: Allow flash writes ending at segment boundary - mm/memory: fix spurious warning when unmapping device-private/exclusive pages - [amd64] platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery - net: hsr: defer node table free until after RCU readers - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient - ice: fix VF queue configuration with low MTU values - ring-buffer: Flush and stop persistent ring buffer on panic - mptcp: cleanup fallback dummy mapping generation - mptcp: reset rcv wnd on disconnect - [arm64] tlb: Flush walk cache when unsharing PMD tables - [arm64] octeontx2-pf: avoid double free of pool->stack on AQ init failure - mptcp: introduce the mptcp_init_skb helper - mptcp: handle first subflow closing consistently - mptcp: do not drop partial packets - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() - iio: chemical: scd30: Use guard(mutex) to allow early returns - iio: chemical: scd30: fix division by zero in write_raw - iio: dac: ad5686: fix ref bit initialization for single-channel parts - ALSA: firewire-motu: Protect register DSP event queue positions - [arm64] usb: dwc3: xilinx: fix error handling in zynqmp init error paths - usb: musb: omap2430: Fix use-after-free in omap2430_probe() - usb: typec: ucsi: Check if power role change actually happened before handling - [amd64] thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() - usb: typec: ucsi: Don't update power_supply on power role change if not connected - [amd64] x86/alternatives: Rename 'apply_relocation()' to 'text_poke_apply_relocation()' - [amd64] x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines - hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read with pmbus_lock - hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - mm: perform all memfd seal checks in a single place - mm/memfd: fix spelling and grammatical issues - memfd: deny writeable mappings when implying SEAL_WRITE - usb: core: Fix SuperSpeed root hub wMaxPacketSize - ethtool: cmis_cdb: Fix incorrect read / write length extension - net/sched: act_mirred: Fix blockcast recursion bypass leading to stack overflow - [arm64] KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CVE-2026-46316) https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.94 - bpf: Free reuseport cBPF prog after RCU grace period. (CVE-2026-52910) - USB: serial: mct_u232: fix memory corruption with small endpoint - [armhf] group is_permission_fault() with is_translation_fault() - [armhf] allow __do_kernel_fault() to report execution of memory faults - [armhf] fix hash_name() fault - [armhf] fix branch predictor hardening - net: phy: micrel: fix LAN8814 QSGMII soft reset - wifi: remove zero-length arrays - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl - ipv6: mcast: Fix use-after-free when processing MLD queries - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS - [arm64] tee: optee: prevent use-after-free when the client exits before the supplicant - [arm64]soc: qcom: ice: Return -ENODEV if the ICE platform device is not found - erofs: add sysfs node to drop internal caches - erofs: tidy up synchronous decompression - erofs: fix use-after-free on sbi->sync_decompress - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id - ipvs: clear the svc scheduler ptr early on edit - netfilter: synproxy: add mutex to guard hook reference counting - netfilter: conntrack_irc: fix possible out-of-bounds read - netfilter: nft_ct: bail out on template ct in get eval - netfilter: bridge: make ebt_snat ARP rewrite writable - dm cache policy smq: check allocation under invalidate lock - net/sched: act_api: use RCU with deferred freeing for action lifecycle - 6lowpan: fix off-by-one in multicast context address compression - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() - devlink: Release nested relation on devlink free - [arm64] drm/imx: Fix three kernel-doc warnings in dcss-scaler.c - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap - pcnet32: stop holding device spin lock during napi_complete_done - net: Annotate sk->sk_write_space() for UDP SOCKMAP. - hsr: Remove WARN_ONCE() in hsr_addr_is_self(). - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr - net: lan743x: permit VLAN-tagged packets up to configured MTU - net: fec: fix pinctrl default state restore order on resume - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() - Bluetooth: MGMT: validate advertising TLV before type checks - Bluetooth: RFCOMM: validate skb length in MCC handlers - Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling - Bluetooth: bnep: reject short frames before parsing - Bluetooth: fix memory leak in error path of hci_alloc_dev() - Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync - Bluetooth: ISO: Fix not using bc_sid as advertisement SID - Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls - Bluetooth: MGMT: Fix backward compatibility with userspace - [arm64] octeontx2-pf: Fix NDC sync operation errors - [arm64] octeontx2-af: Fix initialization of mcam's entry2target_pffunc field - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options - ptp: vclock: Switch from RCU to SRCU - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown - net_sched: act_pedit: use RCU in tcf_pedit_dump() - net/sched: fix pedit partial COW leading to page cache corruption (CVE-2026-46331) - [arm64] octeontx2-af: npc: Fix CPT channel mask in npc_install_flow - vxlan: vnifilter: send notification on VNI add - vxlan: vnifilter: fix spurious notification on VNI update - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr - sctp: purge outqueue on stale COOKIE-ECHO handling - ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() - time: Fix off-by-one in settimeofday() usec validation - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams - ALSA: seq: dummy: fix UMP event stack overread - ima: kexec: skip IMA segment validation after kexec soft reboot - ima: kexec: move IMA log copy from kexec load to execute - spi: cadence-quadspi: fix unclocked access on unbind (CVE-2026-46203) - tools/rv: Fix cleanup after failed trace setup - tap: free page on error paths in tap_get_user_xdp() (CVE-2026-46320) - [arm64] tlb: Allow XZR argument to TLBI ops - [arm64] tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI - iomap: don't revert iov_iter on partially completed buffered writes - dma-debug: fix physical address retrieval in debug_dma_sync_sg_for_device - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() - netlabel: validate unlabeled address and mask attribute lengths - gpio: mvebu: fix NULL pointer dereference in suspend/resume - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls - tcp: restrict SO_ATTACH_FILTER to priv users - net: add pskb_may_pull() to skb_gro_receive_list() - net/mlx4: avoid GCC 10 __bad_copy_from() false positive - net: ibm: emac: Fix use-after-free during device removal - netdev: fix double-free in netdev_nl_bind_rx_doit() - net: phy: clean the sfp upstream if phy probing fails - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure - net/mlx5: Use effective affinity mask for IRQ selection - ipv6: sit: reload inner IPv6 header after GSO offloads - net: openvswitch: fix possible kfree_skb of ERR_PTR - r8152: handle the return value of usb_reset_device() - gpio: zynq: fix runtime PM leak on remove - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() - net: guard timestamp cmsgs to real error queue skbs - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() - rds: mark snapshot pages dirty in rds_info_getsockopt() - netfilter: revalidate bridge ports - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister - netfilter: x_tables: avoid leaking percpu counter pointers - netfilter: nf_log: validate MAC header was set before dumping it - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag - [arm64,armhf] net: mvpp2: sync RX data at the hardware packet offset - [arm64,armhf] net: mvpp2: limit XDP frame size to the RX buffer - [arm64,armhf] net: mvpp2: Add metadata support for xdp mode - [arm64,armhf] net: mvpp2: refill RX buffers before XDP or skb use - [arm64,armhf] net: mvpp2: build skb from XDP-adjusted data on XDP_PASS - ipv6: Fix a potential NPD in cleanup_prefix_route() - netfilter: ctnetlink: ensure safe access to master conntrack (CVE-2026-43116) - writeback: Avoid contention on wb->list_lock when switching inodes - writeback: Fix use after free in inode_switch_wbs_work_fn() - xfrm: hold device only for the asynchronous decryption - xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663) - [amd64] KVM: VMX: Update SVI during runtime APICv activation - [arm64] clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from getting parked - clk: samsung: gs101: Fix missing USI7_USI DIV clock in peric0_clk_regs - [arm64] clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time - drm/virtio: Fix driver removal with disabled KMS - [arm64,armhf] drm/vc4: fix krealloc() memory leak - drm/xe: fix refcount leak in xe_range_fence_insert() - netfilter: nft_tunnel: fix use-after-free on object destroy - [arm64] tee: shm: fix shm leak in register_shm_helper() - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig - [arm64] soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() - [amd64] accel/ivpu: Add bounds checks for firmware log indices - [amd64] accel/ivpu: Add buffer overflow check in MS get_info_ioctl - [amd64] accel/ivpu: Fix signed integer truncation in IPC receive - tracing/probes: Point the error offset correctly for eprobe argument error - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying - [amd64] KVM: SEV: Decouple the need to sync the GHCB SA from the need to free the SA - [amd64] drm/i915/gem: Fix phys BO pread/pwrite with offset - pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL - xfrm: espintcp: do not reuse an in-progress partial send - USB: serial: io_ti: fix heap overflow in get_manuf_info() - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() - USB: serial: option: add usb-id for Dell Wireless DW5826e-m - USB: serial: kl5kusb105: fix bulk-out buffer overflow - ALSA: timer: Forcibly close timer instances at closing - ALSA: timer: Fix UAF at snd_timer_user_params() - io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries - drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() - mm/huge_memory: update file PMD counter before folio_put() - mm/damon/ops-common: call folio_test_lru() after folio_get() - RDMA/srp: bound SRP_RSP sense copy by the received length - zram: fix use-after-free in zram_bvec_write_partial() - udp: clear skb->dev before running a sockmap verdict - mptcp: fix retransmission loop when csum is enabled - mptcp: close TOCTOU race while computing rcv_wnd - mptcp: allow subflow rcv wnd to shrink - mptcp: sockopt: check timestamping ret value - mptcp: add-addr: always drop other suboptions - wifi: nl80211: reject oversized EMA RNR lists - vsock/vmci: fix sk_ack_backlog leak on failed handshake - timers/migration: Fix livelock in tmigr_handle_remote_up() - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write - bnxt_en: Fix NULL pointer dereference - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush - pidfd: refuse access to tasks that have started exiting harder - fs/qnx6: fix pointer arithmetic in directory iteration - fuse: reject fuse_notify() pagecache ops on directories - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter - i2c: tegra: Fix NOIRQ suspend/resume - Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK) - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard - ipc/shm: serialize orphan cleanup with shm_nattch updates - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context - misc: fastrpc: fix use-after-free race in fastrpc_map_create - misc: fastrpc: fix DMA address corruption due to find_vma misuse - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback - net/mlx5: Reorder completion before putting command entry in cmd_work_handler - net: bonding: fix NULL pointer dereference in bond_do_ioctl() - net: mv643xx: fix OF node refcount - net: rds: clear i_sends on setup unwind - nvmem: core: fix use-after-free bugs in error paths - nvmem: layouts: onie-tlv: fix hang on unknown types - [arm64] octeontx2-af: fix memory leak in rvu_setup_hw_resources() - io_uring/kbuf: don't truncate end buffer for bundles - io_uring/wait: fix min_timeout behavior - mm/hugetlb: restore reservation on error in hugetlb folio copy paths - mmc: core: Fix host controller programming for fixed driver type - mmc: dw_mmc-rockchip: Add missing private data for very old controllers - mmc: litex_mmc: Set mandatory idle clocks before CMD0 - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC - mmc: sdhci: add signal voltage switch in sdhci_resume_host - pmdomain: imx: fix OF node refcount - rtase: Avoid sleeping in get_stats64() - rtase: Reset TX subqueue when clearing TX ring - sctp: diag: reject stale associations in dump_one path - sctp: stream: fully roll back denied add-stream state - [amd64] thunderbolt: Reject zero-length property entries in validator - [amd64] thunderbolt: Bound root directory content to block size - [amd64] thunderbolt: Clamp XDomain response data copy to allocation size - [amd64] thunderbolt: Validate XDomain request packet size before type cast - [amd64] thunderbolt: Limit XDomain response copy to actual frame size - [arm64] slimbus: qcom-ngd-ctrl: fix OF node refcount - [arm64] slimbus: qcom-ngd-ctrl: Fix up platform_driver registration - [arm64] slimbus: qcom-ngd-ctrl: Fix probe error path ordering - [arm64] slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd - [arm64] slimbus: qcom-ngd-ctrl: Initialize controller resources in controller - [arm64] slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership - [arm64] slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD - [arm64] slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock - drm/amdkfd: fix NULL dereference in get_queue_ids() - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 - drm/xe: Clear pending_disable before signaling suspend fence - [arm64,armhf] drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups - drm/amdgpu: restart the CS if some parts of the VM are still invalidated - drm/amd/pm: fix smu13 power limit default/cap calculation - drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2 - drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in set_soft_freq_limited_range - drm/amd/display: Bound VBIOS record-chain walk loops - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size - drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs - drm/amd/display: Use krealloc_array() in dal_vector_reserve() - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling - driver core: reject devices with unregistered buses - mailbox: Fix NULL message support in mbox_send_message() - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf - sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task() - netfilter: nft_fib: fix stale stack leak via the OIFNAME register - mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison - RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper - RDMA/umem: Move umem dmabuf revoke logic into helper function - RDMA/umem: Add helpers for umem dmabuf revoke lock - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible - RDMA/umem: fix kernel-doc warnings - RDMA: Move DMA block iterator logic into dedicated files - RDMA/umem: Fix truncation for block sizes >= 4G - mm/hugetlb: avoid false positive lockdep assertion - mptcp: fix missing wakeups in edge scenarios - ipmi:ssif: Remove unnecessary indention - ipmi:ssif: NULL thread on error - ipvs: skip ipv6 extension headers for csum checks (CVE-2026-45850) - vsock/virtio: fix potential unbounded skb queue - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc - block: fix handling of dead zone write plugs - [arm64] cputype: Add NVIDIA Olympus definitions - [arm64] cputype: Add C1-Ultra definitions - [arm64] cputype: Add C1-Premium definitions - [arm64] errata: Mitigate TLBI errata on various Arm CPUs - [arm64] errata: Mitigate TLBI errata on NVIDIA Olympus CPU - [arm64] errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU - net: introduce EXPORT_IPV6_MOD() and EXPORT_IPV6_MOD_GPL() - tcp: use EXPORT_IPV6_MOD[_GPL]() - tcp: secure_seq: add back ports to TS offset (CVE-2026-23247) - mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation - vsock/virtio: fix skb overhead overflow on 32-bit builds - netfilter: require Ethernet MAC header before using eth_hdr() . [ Salvatore Bonaccorso ] * [rt] Refresh "ARM: enable irq in translation/section permission fault" * ip6_vti: set netns_immutable on the fallback device. (CVE-2026-52909) Checksums-Sha1: 19fef6c31e49f19829f84bc7ab50661319bccbdb 942576 bpftool-dbgsym_7.5.0+6.12.94-1_armel.deb 6a5491b8520042029f45b82c84e8af8eef49c6e7 1539488 bpftool_7.5.0+6.12.94-1_armel.deb 4594bcf0955f83b1968be2ceadbf7961f4d9b00d 1293440 libcpupower-dev_6.12.94-1_armel.deb 72ca42370bee72e2eb756a10b18713022be1f6ca 32776 libcpupower1-dbgsym_6.12.94-1_armel.deb ec67b61925a3533aeec3245f1f80b85a237ed725 1299704 libcpupower1_6.12.94-1_armel.deb 6b6bcb89c7d2230839aef24a7561bae2cdd8acf1 1334516 linux-config-6.12_6.12.94-1_armel.deb 0f6d75baa24e8a5f37dee858b540ffc350a67547 66104 linux-cpupower-dbgsym_6.12.94-1_armel.deb a68a53a0e61358352aa73467e919db70a011247b 1337608 linux-cpupower_6.12.94-1_armel.deb b299d07f7390e8d8aec6658ea11a1a01e244e6ba 1694924 linux-headers-6.12.94+deb13-rpi_6.12.94-1_armel.deb 1bebe16105d885752924af083bcee2853e65bd88 1144 linux-headers-rpi_6.12.94-1_armel.deb b7ca87db1e47a9026a1d462bc29e08376aa21c80 412738956 linux-image-6.12.94+deb13-rpi-dbg_6.12.94-1_armel.deb 71538d8501e3ecb5dbab953f94f8439cc870fdb3 33338500 linux-image-6.12.94+deb13-rpi_6.12.94-1_armel.deb 19b08f6d65a708efbd8d4ee508bcc0359c099118 1164 linux-image-rpi-dbg_6.12.94-1_armel.deb f8c55147be7a92daacbdf4bd98eac29c55d4129f 1436 linux-image-rpi_6.12.94-1_armel.deb 89398e8285c1ae2c4a8baddf55f41d11b926af53 1891164 linux-kbuild-6.12.94+deb13-dbgsym_6.12.94-1_armel.deb 78066178ee6e9575af3233ebfce5cd8f0d4d355c 1670608 linux-kbuild-6.12.94+deb13_6.12.94-1_armel.deb 887ce9779eb0734554c151e91b5f2b480073b919 11972264 linux-perf-dbgsym_6.12.94-1_armel.deb 6bcae4a842fbefcdee33e6d15fee8ab512538c6a 3154008 linux-perf_6.12.94-1_armel.deb dbee29a4d51e9c3372b31f2005753098e49544a8 16565 linux_6.12.94-1_armel-buildd.buildinfo 9c4e111a93ff61ea993ebe3f2716444a96984c45 151460 usbip-dbgsym_2.0+6.12.94-1_armel.deb 3aa50b759aa7acda37fdf9c1ad0d2e4d6f323542 1329504 usbip_2.0+6.12.94-1_armel.deb Checksums-Sha256: 0d8d06b766ef99e9d3828a5cf8dceccf930c8e762579855f4775e44ce1ee3751 942576 bpftool-dbgsym_7.5.0+6.12.94-1_armel.deb 01df507c63f7190ba9f138e73b7a4a94486d59d1d3a44f77e37a2483f6d75bc6 1539488 bpftool_7.5.0+6.12.94-1_armel.deb c24e4e34ea052304d9dc42b7d786d60cd067629ea8e55275f5442e32f4f1aa58 1293440 libcpupower-dev_6.12.94-1_armel.deb 3789a28e62e359b65b367b2434ae4a8cfd40c6d353a3df7e768eee7380082e6d 32776 libcpupower1-dbgsym_6.12.94-1_armel.deb 6e310087f17b6164a003ea825045b671db6269d3392317ac9fbf924eeb33db85 1299704 libcpupower1_6.12.94-1_armel.deb a0ef20d47f79b322fc7cce8d9fda6a2ad080cd8c0c4bcb6f2a25e12329b3934a 1334516 linux-config-6.12_6.12.94-1_armel.deb ca6c407c39020651b78b63870cfe7310063289a1e4a0694a683529fb81daeaa1 66104 linux-cpupower-dbgsym_6.12.94-1_armel.deb e22e7480eead0b47471ff5df4161079795918fe41379fde15f464248e8030768 1337608 linux-cpupower_6.12.94-1_armel.deb 7029d0fcaed4519810631098554f00a4705f2e6ce3e67cb6afca7e6ab4303668 1694924 linux-headers-6.12.94+deb13-rpi_6.12.94-1_armel.deb e4205d594a7e8f847bf7a3e327f6f9ba8abedfaac810f06d0812c90172f165bd 1144 linux-headers-rpi_6.12.94-1_armel.deb 4d05659bfdb857949e59d0f209ab4759fa5203d9439066202058b42f189c3e43 412738956 linux-image-6.12.94+deb13-rpi-dbg_6.12.94-1_armel.deb 20c2e5634a44b07978443440a1ddc3569c4f06e532cf1f085d70dc22bfb7ebee 33338500 linux-image-6.12.94+deb13-rpi_6.12.94-1_armel.deb 3fbac10829847f2f46036cc5eb6fc57d6da8532957d46abdb9b1e16427327584 1164 linux-image-rpi-dbg_6.12.94-1_armel.deb 392f21aa013380360095bd1b58e7e3af7b896b3c33c287bc18cf344124a61139 1436 linux-image-rpi_6.12.94-1_armel.deb cb1bea96dfc7623f08444b6a69d124ba9dbcc3243c80eb2acc14e9c0b4bc50cb 1891164 linux-kbuild-6.12.94+deb13-dbgsym_6.12.94-1_armel.deb 228ddaaba168f1f1fbe6aea8f1e92c40562b0c670e3c2fb51ae8c92133498c7e 1670608 linux-kbuild-6.12.94+deb13_6.12.94-1_armel.deb eb5b0195b64ba3072b9b317d318e6f6453b6733b6e85bebc9eb048f76604d0c4 11972264 linux-perf-dbgsym_6.12.94-1_armel.deb cf13f4827e036595e2bdd24e2f1a1c0347257471501282dfb62220e6ad25a608 3154008 linux-perf_6.12.94-1_armel.deb d310cc8fb0df323eca837b270fa0c199e1c56224aed045f37a0f2bf9f18f0f66 16565 linux_6.12.94-1_armel-buildd.buildinfo c6ed88dfff2c62b5b8614e4f9b4798c7c2c27c37d63f52042ef019bc7efd777a 151460 usbip-dbgsym_2.0+6.12.94-1_armel.deb 937ed8a98791ddbd7ea0c0b090d0101689d6fad8f67102855c47bc70e7696533 1329504 usbip_2.0+6.12.94-1_armel.deb Files: e040d2d19d0839e04ce84169c7a8a3e2 942576 debug optional bpftool-dbgsym_7.5.0+6.12.94-1_armel.deb 88a4aa216a4f2b6310515a4b19fbc867 1539488 devel optional bpftool_7.5.0+6.12.94-1_armel.deb 0514c3a0abbd5efa63712b31d6d3f3ed 1293440 libdevel optional libcpupower-dev_6.12.94-1_armel.deb 71a56393456296a228a99f1094e48e9f 32776 debug optional libcpupower1-dbgsym_6.12.94-1_armel.deb e58cfe047fcf809c1dc2f56a8bdaa0a1 1299704 libs optional libcpupower1_6.12.94-1_armel.deb 41fea42d871b30c6aa63d39b7302bd10 1334516 kernel optional linux-config-6.12_6.12.94-1_armel.deb 4c6dfeb06f2135f823ee0be3f11256ed 66104 debug optional linux-cpupower-dbgsym_6.12.94-1_armel.deb 1933c91f8e1db85f40c45ccd560a1c03 1337608 admin optional linux-cpupower_6.12.94-1_armel.deb 0d1c4233f9abea11bbd67cf07264792b 1694924 kernel optional linux-headers-6.12.94+deb13-rpi_6.12.94-1_armel.deb 1cecc8bf20ee028b497b263818e697fd 1144 kernel optional linux-headers-rpi_6.12.94-1_armel.deb cf5b4215e3cb530963e65e467aee0e30 412738956 debug optional linux-image-6.12.94+deb13-rpi-dbg_6.12.94-1_armel.deb 3659cfc79b3ebb6464fdaae1962ecc9b 33338500 kernel optional linux-image-6.12.94+deb13-rpi_6.12.94-1_armel.deb ac850561d28e370a1b0ba20b44f53955 1164 kernel optional linux-image-rpi-dbg_6.12.94-1_armel.deb 4686588907d68a6fba93c193d51e19fd 1436 kernel optional linux-image-rpi_6.12.94-1_armel.deb 4681b91f9310b076c31a14a17d8f5440 1891164 debug optional linux-kbuild-6.12.94+deb13-dbgsym_6.12.94-1_armel.deb 591bbe6aef5523effbc9b119aaf2f318 1670608 kernel optional linux-kbuild-6.12.94+deb13_6.12.94-1_armel.deb 4f3247e1f8abda2bdc8e1be10baf15a6 11972264 debug optional linux-perf-dbgsym_6.12.94-1_armel.deb 004f1ff14e2241945999c69364ee8db2 3154008 devel optional linux-perf_6.12.94-1_armel.deb 077cde6c1a1ee91f3f26c3772d9d0073 16565 kernel optional linux_6.12.94-1_armel-buildd.buildinfo f99d302fb1e5cc5d954fb8b5c4006ee5 151460 debug optional usbip-dbgsym_2.0+6.12.94-1_armel.deb 65842aba2cc0e76c8aa62efdcc3c481c 1329504 admin optional usbip_2.0+6.12.94-1_armel.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEECx5fXZYVNP9tMtwlK1PZBedPspoFAmo2UPgACgkQK1PZBedP spqfsA//WaJm181zFPQ4dsMomaS6cuPpzxpnvHhqJbs2YFbe6FhoE+F/TXvkA78L bO48goSe5QH0VVt+9u0xsCUJ961oKFqEzhUopZJayPtONy3HxOtPk0OFY5PsWTDA SeW75CntZVmOEb6J8WKlZ5XjW4atYE9iBDeIa21cadygOt4KkUiZICQm5z8Vzh/3 Y6qGhqeaFdcFR6hC+0BSQmh2FSEUPE3rZ4M0vfwP4T6Gli8u4daOVpkO/kur4q5A ADMcqjcwpP4+bcgIf7COg28SN1LzZjLS1IQAWdC222xzDwyl3mSIyUusjSoMeA04 fTmexbYS+liNRa3o/1LMbeoaVPbJ0RIHBx48c8Tw9K9c1p7+F8XQaDPOw9hke3F3 336hxgcZbpfs+X4AM9BD8IMe86Do2N3tLngvasc8GeT9eT3IUgZWopGrZukiLmco +zVL+IJ+sRfTO1onLEWj342xAj7v7gI+dHKzRbYgwNdrwXsXhX4K9IoaAELp6Bxd weOjMnJVUoVvIOaM1FWaxn3pZt/3RQqO7xF4quxZvp03g36XXl79G3Dku3dpO4xN 52TlO1GJWAhNzwRlij12C57MBv/uR5fvmuJVJDevMLtO5KGp/904blT2W61hDbNs 3hGWIqect9BUInP9+vTprUlh1vdE43yBIKtpLZwHmwUiltKhIlc= =YTOR -----END PGP SIGNATURE-----