-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Thu, 15 Oct 2026 17:02:11 +0200 Source: linux-signed-amd64 Architecture: source Version: 6.12.113+1 Distribution: trixie-security Urgency: high Maintainer: Debian Kernel Team <[email protected]> Changed-By: Salvatore Bonaccorso <[email protected]> Changes: linux-signed-amd64 (6.12.113+1) trixie-security; urgency=high . * Sign kernel from linux 6.12.113-1 . * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.112 - Revert "hwmon: (emc1403) Drop hysteresis for low limit temperature" - Revert "hwmon: (emc1403) Rely on subsystem locking" - landlock: Fix TCP Fast Open connection bypass - [s390x] boot: Add sized_strscpy() to enable strscpy() usage - [s390x] boot: Avoid IPL parameter append past command line - sunvdc: fix -EIO issue due to lack of retries - net: cpsw_new: Execute ndo_set_rx_mode callback in a work queue - net: cpsw: Execute ndo_set_rx_mode callback in a work queue - ipv6: mcast: Use in6_dev_get() in ipv6_dev_mc_dec(). - ipv6: mcast: Don't hold RTNL for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP. - ipv6: mcast: Don't hold RTNL for IPV6_DROP_MEMBERSHIP and MCAST_LEAVE_GROUP. - ipv6: mcast: Don't hold RTNL for MCAST_ socket options. - ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source() (CVE-2026-98101) - media: video-i2c: fix buffer queue ordering - ipv6: Select best matching nexthop object in fib6_table_lookup() - ipv6: Honor oif when choosing nexthop for locally generated traffic - pidfd: hold exec_update_lock around namespace ioctl (CVE-2026-89766) - xfrm: avoid RCU warnings around the per-netns netlink socket - xfrm: fix compat ALLOCSPI request use-after-free - xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject() - esp: downgrade zerocopy managed frags before mutating skb frags - RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept - RDMA/rxe: validate access flags before swapping the MR's PD - RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access - [arm64] firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS - clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate - RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds - RDMA/core: Reject unregistering netdevs in ib_get_eth_speed - IB/iser: reject a remote invalidation of an unregistered direction - IB/isert: wait for deferred control PDU completions before releasing the connection - RDMA/mad: Fix receive buffer leak when PKey enforcement fails - RDMA/irdma: Enforce local fence for IB_WR_REG_MR - RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted - dmaengine: sprd: Fix runtime PM reference leak in probe - wifi: virt_wifi: free skb when disconnected - wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path - wifi: libipw: reject too-short beacon and probe responses - wifi: libipw: reject too-short association responses - IB/IPoIB: Avoid restoring OPER_UP after multicast flush - wifi: cfg80211: don't get the radio mask for netdev-less wdevs - wifi: cfg80211: check IP header size in cfg80211_classify8021d() - soundwire: cadence_master: wait and cancel cdns->work before clock stop - dma-coherent: Warn if OF reserved memory is beyond current coherent DMA mask - dma-coherent: report a failed reserved memory assignment - dmaengine: Fix device kref underflow in dma_chan_put() - dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() - dmaengine: wait for RCU readers before releasing dma_device - wifi: cfg80211: only group hidden BSSes with beacon entries - wifi: cfg80211: don't filter by BSS type when removing stale entries - wifi: mac80211: don't start a ROC while scanning - wifi: cfg80211: add option for vif allowed radios - wifi: mac80211: use vif radio mask to limit ibss scan frequencies - wifi: mac80211: don't warn when an IBSS has no channel to scan - wifi: mac80211: don't offload TC setup on AP_VLAN interfaces - wifi: mac80211: suppress chanctx warning for debugfs reset - wifi: mac80211: abort chanswitch when leaving a mesh - wifi: mac80211: reset state when starting AP fails - wifi: mac80211: unlist vifs when their netdev is unregistered - wifi: mac80211_hwsim: don't hand frames to mac80211 while stopping - wifi: cfg80211: skip regulatory for punctured subchannels - wifi: cfg80211: expose cfg80211_chandef_get_width() - wifi: mac80211: don't allow injecting frames wider than the chanctx - wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown - wifi: mac80211: require a peer station for TDLS setup confirm - wifi: mac80211: don't allow link changes when iface is down - wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set - wifi: mac80211: don't access the TSF of a down interface - wifi: mac80211: add HE 6 GHz capability in the scan elems len - wifi: mac80211: mesh: reset the CSA state when leaving - wifi: mac80211: mesh: release the channel if start fails - wifi: mac80211: set up the TX info early to fix failure paths - mm: memblock: show all region flags in debugfs - scsi: qla2xxx: Fix the ql2xfc2target parameter description - dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order - dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA - RDMA/efa: Keep admin queues alive while IRQ is registered - RDMA/efa: Keep EQ resources alive while IRQ is registered - RDMA/siw: Bound fragmented header copies by the remaining length - netfilter: nft_nat: fully initialise new_addr in netmap setup - netfilter: flowtable: hold reference on ct until flow is released - perf/arm-cmn: Fix wp_dev_sel2 setting for multi-DTM configurations - [arm64] hibernate: clone only the linear map that exists at runtime - drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr - keys: fix lost wakeup when reaping a dead key type - ALSA: bcd2000: Fix race between rawmidi and disconnect - [arm64] phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow - [arm64] phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting - ALSA: pcm: set timer->private_data before registering the PCM timer - ASoC: Rename snd_soc_dai_link_ch_map.ch_mask to cpu_ch_mask - ASoC: Add codec_ch_mask to snd_soc_dai_link_ch_map - ASoC: soc-pcm: Apply snd_soc_dai_link_ch_map.codec_ch_mask to codec params - Input: trackpoint - fix the inertia attribute name in the ABI document - gpio: virtuser: skip free_irq when no IRQ is installed - ALSA: 6fire: Clean ups with guard() - ALSA: usb: 6fire: Avoid embedded URBs - ALSA: 6fire: fix OOB write from device-reported iso length - wifi: virt_wifi: don't transfer operstate before register - drm/vc4: Use managed KMS polling to fix UAF on unbind - ALSA: hda: trace PCM open only after assigning a stream - wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all() - btrfs: tree-checker: print dev extent offset in error message - [arm64] drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL - seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation - ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup - net: fddi: skfp: fix NULL deref when setting the MAC address while down - wifi: brcmfmac: fix lost 802.1x TX completion wakeup - net: bridge: mst: move switchdev call outside rcu - tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv(). - tcp: do not let tcp_rmem be set below 4096 - ksmbd: return buffer overflow for partial filesystem info - ksmbd: fix partial file information responses - ksmbd: keep compound responses on query info errors - dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() - Bluetooth: hci_core: Print number of packets in conn->data_q - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained - Bluetooth: coredump: Quiesce dump work on unregister - Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() - Bluetooth: ISO: set BT_LISTEN before requesting a BIG sync - Bluetooth: btmtk: fix wrong status for short WMT FUNC_CTRL events - Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown - Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit - Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup - pppoatm: ensure a writable skb header and linear data - drop_monitor: synchronize tracepoint unregistration on error path - drop_monitor: fix out-of-bounds write in reset_per_cpu_data() - net: stmmac: do not overwrite phc_index when no PTP clock is registered - [powerpc*] KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid() - [powerpc*] KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure - [powerpc*] iommu: Fix the overflow validation in iommu_tce_check_ioba - ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments - ASoC: hdmi-codec: Report a change when the channel status moves - net: netsec: fix device_node reference leak on phy_np - net: lock the socket in sock_gettstamp() - net: ethernet: cortina: Ack RX overrun interrupt correctly - net: stmmac: propagate FPE preemption-class mapping errors - net: macb: fix ordering around PTP timestamp read - net: mvpp2: prevent buffer overflow in page_pool allocation - net: skbuff: do not leave stale header offsets after pskb_carve() - drm/amdgpu: check ras and obj before dereference - btrfs: abort transaction on failure to update inode for hole punching and reflinking - [amd64] x86/fred: Reconstruct the #GP context for rejected INT instructions - mm/huge_memory: use folio's memcg inside __folio_split() - wifi: rtw88: TX QOS Null data the same way as Null data - wifi: rtw88: Fix the random "error beacon valid" messages for USB - Input: xpad - add support for Victrix Pro BFG Controller - Input: xpad - add support for Azeron devices - Input: xpad - fix PDP Marvel Xbox 360 controller - ALSA: core: Fix potential UAF after asynchronous card release - ALSA: virtio: reset device before deleting virtqueues - ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type - ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY - ata: libahci_platform: Fix device reference leak in ahci_platform_get_resources() - cifs: Fix server use-after-free in cifs_chan_skip_or_disable() - exec: Cleanup POSIX timers right after de_thread() - rds: ib: use rds_conn_drop() on protocol version mismatch - [amd64] x86/microcode/intel: Reject problematic loading on Granite Rapids systems - tcp: exclude old ACKs from tcp fast path - RDMA/ucma: Serialize join and leave on copy_to_user failure - RDMA/core: fix refcount bug in iwpm_get_nlmsg_request() - openvswitch: avoid reallocating confirmed conntrack labels - net: xfrm: reject unrepresentable espintcp transport headers - HID: logitech-hidpp: fix race condition when accessing stale stack pointer - [arm64] hibernate: pass HVC_SET_VECTORS args to the resume hvc - [arm64] dts: renesas: r8a779f0: Set UFS lane count - [arm64] percpu: Fix this_cpu_write() casting - [arm64] percpu: Fix this_cpu_and() mask generation - Bluetooth: btusb: fix NXP IW610 composite device handling - Bluetooth: eir: validate service data length before reading UUID - Bluetooth: hci_codec: validate vendor codec count length - Bluetooth: hci_sync: Serialize local codec list cleanup - dmaengine: sun6i: fix non-atomic read of DMA position registers - dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status - dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() - ipv6: xfrm: use full sockets in local error paths - net: lan743x: fix RX checksum use-after-free - net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() - net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain - net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value - net/sched: act_api: release tail references on DELACTION failure - net/sched: hhf: cap hh_flows_limit at change time - net/packet: clear RX owner on VNET header error - net/packet: avoid truncating TPACKET_V3 private size - scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable() - xfrm: serialize state GC with device state flush - xfrm: use hlist_del_init_rcu for state_cache and state_cache_input - memstick: ms_block: destroy io_queue workqueue on removal - mm/mlock: use the IRQ-safe accessor for NR_MLOCK in __munlock_folio() - KEYS: encrypted: fix integer overflow of datablob_len - keys: translate request_key_auth pid for the reading procfs instance - KEYS: trusted: Fix tpm2_load_cmd() boundary check - i2c: at91: release DMA channels on remove and probe error - i2c: atr: fix dangling adapter pointer on add failure - i2c: imx: release DMA channels on probe error - i2c: imx: disable autosuspend on remove - IB/mlx4: Fix use-after-free on pkey sysfs registration failure - IB/hfi1: Resolve the credit-return buffer through the send context's node - IB/hfi1: Fix the PIO_CRED credit-return mmap - selinux: preserve user SID across nested backing files - selinux: recheck intermediate backing files on mprotect() - selinux: always fill AVC decision in avc_has_perm_noaudit() - power: sequencing: don't call .post_enable() if pwrseq_unit_enable() failed - power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new() - power: sequencing: fix NULL-pointer dereference in pwrseq_device_register() - mmc: core: Cancel SDIO IRQ work before freeing host - mmc: core: Fix OF node reference leak on card add failure - mmc: hsq: Fix use-after-free in retry work - mmc: mmci: Fix use-after-free in busy-timeout work - mmc: mxcmmc: cancel data work and watchdog on remove - mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260 - mmc: sdhci-of-aspeed: Remove children before releasing SDC resources - mmc: sdio_uart: fix xmit_fifo leak when the port table is full - mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt - mmc: spi: reset bytes_xfered before retrying CRC failures - mmc: sdhci_am654: Move tuning_loop to local variable - mmc: sdhci_am654: Reset command and data lines on failed tuning - mmc: sdhci_am654: Clear ITAPDLY on tuning failure - mmc: sdhci_am654: Fallback to DT-provided itap delay on DDR50 tuning failure - Input: adp5588-keys - cache GPIO state before registering the gpiochip - Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026 - Input: cyttsp5 - clamp the HID report size before memcpy - Input: evdev - zero absinfo before partial copy in EVIOCSABS - Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P - Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() - Input: soc_button_array - fix MS Surface Pro 11 probe failure - Input: soc_button_array - check btns_desc->package.count - Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722) - Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound - Input: zero ff_effect before compat copy in input_ff_effect_from_user - hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show() - hwmon: (pmbus/core) increase number of phases and add new mask - hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding - hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676 - hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove - hwmon: (w83793) release probe data through kref - watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog - watchdog: digicolor: Avoid division by zero - watchdog: msc313e: Fix premature reset during timeout update - watchdog: msc313e: Propagate error code in resume() - watchdog: rtd119x: Avoid division by zero - watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init() - watchdog: starfive-wdt: Fix runtime PM leak in starfive_wdt_pm_start() - wifi: brcmsmac: fix UAF in brcms_free_timer() - wifi: iwlegacy: fix broadcast stations deallocation - wifi: libertas_tf: fix UAF in lbtf_free_adapter() - wifi: rsi: fix heap OOB write on key removal - wifi: wlcore: release runtime PM ref on regdomain config failure - wifi: wilc1000: fix out-of-bounds read in P2P public action frames - wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() - wifi: p54: validate curve data length in the calibration curve converters - wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST - wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length - wifi: mwifiex: validate scan response extents - wifi: mwifiex: prevent authentication frame length truncation - wifi: mwifiex: validate action frame fixed fields - wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver - drm/gud: fix out-of-bounds write in gud_plane_atomic_check() - [arm64] drm/msm/adreno: fix autosuspend cleanup during teardown - [arm64] drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure - smb: client: cancel reconnect work in clean_demultiplex_info() - smb: client: fix rlist race and missing initialization - smb: client: reject short Next offsets in parse_server_interfaces() - smb: client: fix smbd_connection leak on cifs_get_tcp_session() error - smb: client: fix unaligned access in WSL reparse point parser - smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs - smb: client: fix potential OOB read in smb3_enum_snapshots() - smb: client: fix server->total_read for compound encrypted PDUs - smb: client: fix missing lower-bound check on DFS referral string offsets - smb: client: fix missing iov bounds check in parse_posix_sids() - HID: asus: fortify keyboard handshake (Closes: #1149499) - ksmbd: fix partial normalized name responses - spi: spi-zynqmp-gqspi: stop the controller on shutdown - smb: client: fix busy dentry warning on unmount after DIO (CVE-2026-72315) - xfs: don't stash removename operations with unknown ftype - erofs: fix large folio race in erofs_fscache_req_complete - ALSA: hda/realtek: Limit Star Labs internal mic boost - ALSA: hda/realtek: Add StarFighter HDA SSID - netfilter: nf_tables: Tolerate chains with no remaining hooks - netfilter: nf_tables: Simplify chain netdev notifier - xfrm: Refactor xfrm_input lock to reduce contention with RSS - xfrm: Fix dev use-after-free in xfrm async resumption (CVE-2026-72463) (Closes: #1150891) - xfrm: save input state data before secpath resets - remoteproc: qcom_q6v5_adsp: Fix iommu_unmap() usage - [s390x] KVM: s390: Fix IRQ injection with SIGP Stop and Store Status - bpf: Fix bpf_skb_change_tail wrt csum partial skbs - bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL - bpf: Fix divide-by-zero in btf_struct_walk() - bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy() - tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context - HID: elecom: fix bus type for M-XGL20DLBK - [amd64] KVM: x86/pmu: Move Intel PMU global MSRs to intel_is_valid_msr() - bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch() - bpf: Fix out-of-bounds read of rtt_min in sock_ops - bpf: Remove migrate_{disable|enable} in ->map_for_each_callback - bpf: Bail out early in __htab_map_lookup_and_delete_elem() - bpf: Factor out htab_elem_value helper() - bpf: Register dtor for freeing special fields - bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk - bpf, sockmap: Fix self-redirect copied_seq double-counting - [arm64] bpf, arm64: set up the frame pointer for the exception callback - pinctrl: meson: Fix typo in s4 group name - [amd64] HID: amd_sfh: Validate PCI BAR size before mapping - HID: bpf: fix __hid_bpf_hw_check_params report length - [riscv64] KVM: Preserve firmware counter value across stop/start - [riscv64] KVM: Report snapshot write failure to the guest - [riscv64] KVM: Fix perf-backed counter accounting across stop and read - [arm64] KVM: arm64: vgic-its: Free the caches when GITS_BASER changes - [arm64] KVM: arm64: vgic-its: Add stronger type-checking to the ITS entry sizes - [arm64] KVM: arm64: vgic-its: Skip unreachable devices instead of failing the save - [arm64] KVM: arm64: Return -EINVAL for an empty SMCCC filter range at base 0 - [arm64] KVM: arm64: Fix FGT mapping for HFGITR_EL2.nGCSEPP - squashfs: Add dictionary size range check to prevent shift-out-of-bounds - scsi: sd_zbc: Reject disks with too many zones - Bluetooth: SMP: reject Security Request over BR/EDR - Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel - cgroup: selftests: Move memcontrol specific helpers out of common cgroup_util.c - scsi: megaraid_sas: Protect megasas_get_ctrl_info() in megasas_resume() - docs: s390/pci: Improve and update PCI documentation - [s390x] pci/docs: Fix sriov_numvfs attribute name - [s390x] cio: Fix cio_update_schib() to not cache invalid schib - [s390x] cio: Check pmcw.dnv before pmcw.ena in I/O entry points - [s390x] cio: Guard PMCW field accesses with dnv check - xsk: Use a 32-bit compare in xsk_map_gen_lookup - bpf: Skip unsettled links in link iterator - net/sched: cls_u32: fix manual hash table handle IDR aliasing - net/mlx5: devcom, Base component size on linked devices - bpf: Restrict CO-RE poisoning to relocatable instructions - libbpf: Reject truncated ldimm64 CO-RE relocations - netfilter: flowtable: publish HW_DEAD after worker is done - netfilter: nfnetlink_queue: hold nfnl mutex in event notifier - netfilter: nft_synproxy: use the family-aware checksum helper - ipvs: revalidate ihl before icmp_send - netfilter: ctnetlink: fix suspicious RCU usage in expect_iter_name - [arm64] io: Reject non-user protection in ioremap_prot() - ocfs2: make ocfs2_calc_xattr_init() return void - drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update - drm/nouveau/clk: don't clobber reclock status when restoring volt/fan - drm/nouveau/disp: don't reject HDMI config on cards without SCDC - net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure - net: gue: reject invalid REMCSUM offsets - net: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure - ip6_gre: Call ip6erspan_tunnel_unlink_md() in ip6erspan_changelink(). - eth: fbnic: Handle maximum standalone channels - eth: fbnic: Set AW_FLUSH_MODE alongside AW_FLUSH when flushing the mailbox - sctp: avoid livelock while updating retransmit path - bpf: Bound ownership depth through local kptrs and graph roots - net: usb: catc: bound the RX packet length in catc_rx_done() - bpf: Check params size before reading reserved fields - net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget - drm/virtio: fix object leak when drm_gem_handle_create() fails - drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() - drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() - drm/virtio: release the GEM object on virtio_gpu_vram_create() errors - drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach - Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough - Bluetooth: btintel_pcie: validate device-supplied DMA indices - Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() - octeontx2-af: Fix memory scaling limitation in SR-IOV mode - dpll: use exact lookup for reference sync pin id - net: usb: sr9700: include receive overhead in the length check - ipv6: Fix dst leak for uncached routes. - tg3: clean up PHYLIB resources on probe failure - [amd64] drm/i915/psr: Add new SU area calculation helper to apply workarounds - [amd64] drm/i915/psr: Clear stale sel fetch enable bits on sel fetch disable - [s390x] debug: Do not register views for failed static debug areas - [s390x] debug: Fix NULL pointer dereference in debug_info_copy() - net: ethernet: ti: netcp: fix pm_runtime usage counter leak on error - genetlink: report the real command id for dump-only ops in policy dumps - net: pcs: xpcs: fix clock reference leak on xpcs_init_clks failure - thermal: gov_step_wise: Fix stale mitigation vote with non-zero lower bounds - bpf: Fix bounds check for skb-backed dynptrs - bpf: Fix bpf_sock context code generation - bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc - net/mlx5: Bridge, don't fail switchdev events of sibling eswitch ports - net/mlx5: Bridge, don't fail unlink of untracked/unsupported peer ports - sctp: hold asoc or transport before mod_timer() in timer handlers - net: stmmac: dwmac4: Use the correct bufzise when the len is exactly 8K - bpf: Reject dev-bound-only programs on other devices - nfc: nfcmrvl: validate helper command length before pull - nfc: st21nfca: validate received frame size - nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() - nfc: llcp: Fix race condition in accept_queue lifecycle - nfc: virtual_ncidev: Add missing ioctl compat handler - nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure - nfc: st21nfca: validate ISO15693 inventory length - nfc: llcp: fix -ENOMEM on connect with zero-length service name - nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() - nfc: llcp: fix slab-out-of-bounds reads when logging service names - nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() - net/sched: act_gate: budget the per-entry list in get_fill_size - veth: manage XDP program pointers during channel resize - net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() - vrf: Stop corrupting skb->csum when capturing CHECKSUM_COMPLETE packets - bpf: Fix immediate JMP JEQ/JNE on MIPS32 - bpf: Fix BSWAP 32 and 16 on MIPS64 - driver core: Add device probe log helper dev_warn_probe() - tg3: use random MAC address when tg3_get_device_address fails - net: bcmgenet: fix 64-bit RTNL stats reading in ethtool on 32-bit systems - net: bcmgenet: initialize u64 stats seq counter for all queues - net: bcmgenet: move bcmgenet_power_up into resume_noirq - net: bcmgenet: allow return of power up status - net: bcmgenet: do not skip WoL power up on GENET V1 - net: bcmgenet: validate Ethernet address in bcmgenet_set_mac_addr - net: bcmgenet: mask DMA_TIMEOUT_MASK when reading DMA_RING0_TIMEOUT - ip_gre: Reject enabling collect metadata through changelink - vxlan: use one headroom snapshot for neighbour replies - net: xps: reject an out of range traffic class - drm/imagination: clamp freelist reconstruction requests - bonding: crypto offload enabled, non-offload slave failover, rekey failed - net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621 - tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() - nfp: hold IPsec RX state under the XArray lock - net/smc: fix UAF on lgr list traversal in smcr_port_err() - tipc: Fix a data race on mon->peer_cnt in mon_timeout() - net: ethernet: stmmac: dwmac-rk: fix bulk clock leak when the PHY clock fails - llc: fix skb UAF and leaks on llc_mac_hdr_init() failure - bridge: check llc_mac_hdr_init() return value in br_send_bpdu() - net/sched: sch_teql: fix shadowed err in __teql_resolve() - vlan: ensure sufficient headroom in vlan_dev_hard_header() - autofs: fix sbi->pipe file reference leak in autofs_kill_sb() - [amd64] perf/x86/intel: Ensure KVM guest PEBS path doesn't set unwanted PERF_GLOBAL_CTRL bits - [amd64] perf/x86/intel: Don't write PEBS_ENABLED on host<=>guest xfers if CPU has PEBS isolation, to fix stuck PEBS_ENABLED - [amd64] perf/x86/intel: Don't pointlessly context switch DS_AREA (and PEBS config) if PEBS is unused - [amd64] perf/x86/intel: Make @data a mandatory param for intel_guest_get_msrs() - mptcp: return sk_wait_data() errors from recvmsg() - rculist: add list_splice_rcu() for private lists - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (CVE-2026-52988) - [amd64] x86/mce: Fix hardware debug register corruption on task migration - [amd64] x86/PCI: Disable enhanced atomics on AMD NBIO 7.7 and 7.11 - virtio_net: copy zerocopy frags in start_xmit without NAPI - tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow - tcp: prevent collapsing skbs across boundary in rtx queue - sctp: discard the rest of the packet on a stale-cookie error - af_packet: fix integer overflow in prb_calc_retire_blk_tmo() - ata: libata-scsi: bound the ATA passthru sense descriptor writes - cgroup/pids: Restore pids.events notifications in local mode - fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT - fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's "WARNING in do_new_mount" saga - writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes - workqueue: Fix NULL current_pwq deref in flush dependency check - writeback: report a Tasks-RCU quiescent state per cgwb drain pass - fsl/fman: Fix clk reference leak in read_dts_node() - ipe: protect the dm-verity root hash with RCU - ipv6: do not let ipv6_find_hdr() return an offset past the packet end - ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST - gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out() - gpio: zynq: fix runtime PM leak on request error path - llc: reserve device headroom for allocated frames - mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag() - rds: ib: Clear the sg list when mapping an MR fails - [amd64] drm/i915: fix incorrect RCU teardown order - drm/amd/display: Fix dc stream excess put in dm_update_crtc_state() - drm/amd/display: Bump frame warning limit for clang builds of dml - drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init() - drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show() - drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init() - drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM - drm/nouveau: fix autosuspend cleanup during teardown - drm/nouveau: Fix bridge reference leak in nv1a_ram_new() - drm/nouveau: fix double-free in nvif_vmm_dtor - drm/nouveau: Fix gem reference leak in validate_init() - drm/nouveau: Fix runtime PM leak in nouveau_connector_detect() - drm/nouveau: RCU-free the scheduler-containing nouveau_sched - drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() - drm/xe: Limit sg segment size to PAGE_SIZE on Xen PV - drm/virtio: fix memory leak of fence event on execbuffer failure - drm/virtio: fix NULL pointer dereference on fence allocation failure - gpio: tps65219: Fix GPIO input value reads - mm/hugetlb: preserve mremap address delta when skipping page tables - PCI: of_property: Omit bus properties without a subordinate bus - HID: alps: fix use-after-free on input2 registration failure - HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard - HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() - net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get() - net/mlx5e: advertise MACsec offload only when supported - net/sched: reject IDR error pointers when deleting actions - net: arp: terminate device name before lookup - net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read - net: hisilicon: hns_dsaf_mac: fix mdio device leak in hns_mac_register_phy() - net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry - net: openvswitch: conntrack: remove 'add_helper' dead code - net: openvswitch: conntrack: fix helper UAF due to extensions realloc - net: atl1c: fix soft lockup on out-of-range tpd_cons read - net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read - net: bridge: mdb: restart port group walk after deletion - net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist - net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs() - netfilter: ip6t_rpfilter: reject routes without inet6_dev - netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read - netfilter: nf_tables: skip expired catchall elements on insert and delete - nfc: fix use-after-free in nfc_get_local_general_bytes - nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() - nfc: port100: reject frames whose declared length exceeds the received data - scsi: libiscsi_tcp: Check the data direction of a Data-In PDU - perf/core: Fix NULL pmu_ctx passed to pmu->sched_task() - perf/core: Run sched_task() for PMUs with only CPU-wide events - pinctrl: single: free the IRQ on domain creation failure - pinctrl: sunxi: keep a shadow copy of the data register output latches - [s390x] cio: Fix NULL pointer dereference in ccw_device_get_util_str() - [s390x] cmf: Fix virtual vs physical address confusion - [s390x] vfio-ap: fix KVM GISC and page leak when queue removed from host config - KVM: Ensure memory attributes xarray nodes are accounted to the caller's memcg - KVM: Don't treat reserved xarray entries as having memory attributes - [arm64] KVM: arm64: Fix spurious warning for benign stage 2 teardown race - [riscv64] KVM: Synchronize hrtimer callback during teardown - [riscv64] KVM: Fix HSM hart status error propagation - Bluetooth: hci_conn: fix CIS hold ownership on reuse - Bluetooth: hci_sock: validate event length before filtering - Bluetooth: hci_sock: reject out-of-range OCF values - Bluetooth: ISO: balance the parent hold in hci_bind_bis() - Bluetooth: L2CAP: validate frame length before control and FCS access - Bluetooth: mgmt: fix race in read_unconf_index_list() - Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO - smb: client: fix create context out-of-bounds reads - smb: client: clean up failed cached directory opens - smb: client: validate POSIX create context length - xfs: don't assert when XFS_SCRUB_TYPE_HEALTHY scans return corruption - xfs: fix attr fork block count checks in xrep_inode_blockcounts - xfs: release orphanage dir inode if chown fails - xfs: use correct jiffies comparison function in xchk_maybe_relax - xfs: check padding field in xfs_ioc_commit_range - xfs: don't call xfs_exchange_range_finish for a dry run - xfs: check di_forkoff correctly in scrub - xfs: fix blockgc group quota scanning when usrquota isn't enforced - net: tls: fix silent data drop under pipe back-pressure - ring-buffer: Add helper functions for allocations - ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page() (CVE-2026-89503) - sched: Rework prev_balance() to avoid stale prev references - sched/core: Make core-sched flips wait for in-flight selections (CVE-2026-89520) - ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page (CVE-2026-89500) - dmaengine: Add devm_dma_request_chan() - i2c: mxs: fix DMA channel leak on probe error - lockd: fix swapped arguments in nlmsvc_match_ip() (CVE-2026-93231) - [arm64] firmware: qcom_scm: Rename peripheral as pas_id - remoteproc: pas: Replace metadata context with PAS context structure - remoteproc: qcom: pas: Guard dtb metadata release with dtb_pas_id check - power: supply: ab8500_fg: Remove redundant dev_err()/dev_err_probe() - power: supply: ab8500_fg: fix use-after-free on remove (CVE-2026-89797) - [riscv64] PCI: starfive: Use regulator APIs to control the 3v3 power supply of PCIe slots - [riscv64] PCI: starfive: Fix resource leaks on error paths in host_init() - iommu/msm: Use helper function devm_clk_get_prepared() - iommu/msm: Unwind probe state on registration failure (CVE-2026-89452) - iommufd: Pass @pasid through the device attach/replace path - iommufd: Fix UAF in selftest IOPF reporting (CVE-2026-89445) - [amd64] platform/x86: ISST: Check for admin capability for write commands - [amd64] platform/x86: ISST: Validate max level for set feature - mmc: via-sdmmc: cancel card-detect work on remove (CVE-2026-89441) - PCI: Introduce PCI_SLOT_PLACEHOLDER constant for slot_nr placeholder value - PCI: Allow per function PCI slots to fix slot reset on s390 (CVE-2026-89795) - [amd64] platform/x86: think-lmi: Fix current password length check - [amd64] platform/x86: think-lmi: improve check if BIOS account security enabled - [amd64] platform/x86: think-lmi: Fix certificate thumbprint sysfs output - [amd64] platform/x86: intel_sar: Check ACPI_HANDLE() against NULL - [amd64] platform/x86: int1092: Fix potential memory leak in sar_probe() (CVE-2026-89437) - [amd64] platform/x86/amd/pmc: Move STB block into amd_pmc_s2d_init() - [amd64] platform/x86/amd/pmc: Move STB functionality to a new file for better code organization - [amd64] platform/x86/amd/pmc: Define enum for S2D/PMC msg_port and add helper function - [amd64] platform/x86/amd/pmc: Restore msg_port on amd_stb_s2d_init() error paths - [amd64] platform/x86/amd/pmc: Propagate SMU errors and validate S2D address (CVE-2026-81016) - io_uring/waitid: have io_waitid_complete() remove wait queue entry - io_uring/waitid: avoid siginfo copy during ring teardown - power: supply: qcom_battmgr: fix use-after-free (CVE-2026-89467) - net/smc: Address spelling errors - net/smc: stop killed, freed and out_of_sync sharing a byte (CVE-2026-80980) - net/mlx5e: SHAMPO, Always calculate page size - net/mlx5e: do not HW-GRO coalesce small frames - ALSA: hda/ext: preserve PPLCCTL bits when clearing reset - hwrng: drivers - Switch back to struct platform_driver::remove() - hwrng: stm32 - Fix runtime PM cleanup on registration failure - i3c: master: Do not treat master device as a duplicate target (CVE-2026-93199) - wifi: mt76: mt7915: set correct background radar capability - wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy (CVE-2026-80937) - i3c: master: Fix use-after-free of master->this (CVE-2026-93200) - udf: Move udf_map_block() up - udf: Fix data loss when converting inline inodes to out of line - usb: dwc3: gadget: Reinitiate stream for all host NoStream behavior - usb: dwc3: clear forceRM when issuing EndTransfer (CVE-2026-90030) - wifi: rtw89: cleanup unused rtwdev::roc_work - wifi: rtw89: Hide some errors when the device is unplugged - wifi: rtw89: pci: add .shutdown callback to stop rfkill polling on reboot (CVE-2026-80939) - usb: typec: tcpm: fix debug accessory mode detection for sink ports - usb: typec: tcpm: constrain TCPM_SOURCING_VBUS event handling - wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy (CVE-2026-80935) - xhci: Cleanup Candence controller PCI device and vendor ID usage - usb: cdns3: rename hibernated argument of role->resume() to lost_power - usb: cdnsp: fix wakeup from S3 after controller context loss - usb: storage: realtek_cr: fix use-after-free on disconnect (CVE-2026-90029) - usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers() (CVE-2026-90023) - staging: rtl8723bs: fix spacing around operators - staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie() (CVE-2026-90016) - staging: sm750fb: fix mono image source stride mismatch in lynxfb_ops_imageblit() - tracing/probes: Fix anon_stack check for unnamed bitfields in btf_find_struct_member - Documentation: tracing: Add documentation about eprobes - tracing/probes: Fix BTF kflag check for anonymous struct member access - tracing: Clean up use of trace_create_maxlat_file() - tracing: Take trace_array reference when opening options file (CVE-2026-90013) - ftrace: Take trace_array reference before accessing its ftrace_ops (CVE-2026-90002) - dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds (CVE-2026-89996) - compiler_types: Move lock checking attributes to compiler-context-analysis.h - futex: Provide rt_mutex_.*_schedule() equivalents for futex scheduling - rtc: rzn1: Handle unset alarm weekday in rzn1_rtc_read_alarm - perf/aux: Allocate non-contiguous AUX pages by default - [amd64] perf/x86/intel: Remove anythread_deprecated bit from perf_capabilities - ring-buffer: Show persistent buffer dropped events in trace_pipe file - ring-buffer: Allow splice reads on static buffers - nvme: add missing SRCU grace period in error path (CVE-2026-89972) - nvme: all namespaces in a subsystem must adhere to a common atomic write size - nvme: refactor the atomic write unit detection - nvme: fix atomic write size validation - nvme: skip the zoned limits update if the zone info query failed (CVE-2026-89971) - [s390x] vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects (CVE-2026-89956) - mm: fix incorrect vm_flags usage when checking allowable orders for tmpfs - nvdimm: preserve flush callback -ENOMEM - nvdimm: pmem: keep PREFLUSH before data writes (CVE-2026-98161) - nvdimm: virtio_pmem: stop allocating child flush bio - nvdimm: virtio_pmem: always wake -ENOSPC waiters - nvdimm: virtio_pmem: use READ_ONCE()/WRITE_ONCE() for wait flags - nvdimm: virtio_pmem: refcount requests for token lifetime (CVE-2026-93196) - mtd: rawnand: pl353: Add message about ECC mode - mtd: rawnand: pl353: Make sure we use the monolithic helpers for raw accesses - clk: qcom: Fix test_ctl_hi field for DEFAULT_EVO PLLs - mm/mremap: reset unfaulted VMA page offset for MREMAP_DONTUNMAP - [amd64] KVM: x86/mmu: Dynamically allocate shadow MMU's hashed page list - [amd64] KVM: x86/mmu: Split kvm_mmu_zap_all_fast() into "front" and "back" halves - [amd64] KVM: x86: Extract REGS and SREGS runtime sync code to helpers - [amd64] KVM: x86: Rename __{g,s}et_sregs2() => kvm_vcpu_ioctl_x86_{g,s}et_sregs2() - [amd64] KVM: x86: Move the bulk of register specific code from x86.c to regs.c - [amd64] KVM: x86: Check EFER validity on KVM_SET_SREGS* - media: i2c: imx355: Replace client->dev usage - media: imx355: Avoid calling imx355_power_off twice in error path - media: rkvdec: Propagate platform_get_irq() errors - [s390x] KVM: s390: Zero initialize data structures for inject_pfault_token (CVE-2026-89921) - [amd64] KVM: x86: Disallow EFER.LME and EFER.LMA if long mode is not supported - scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak (CVE-2026-89859) - scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking (CVE-2026-97537) - scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown (CVE-2026-97536) - scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path (CVE-2026-97532) - scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size (CVE-2026-97535) - media: chips-media: wave5: Add timeout while stop_streaming (CVE-2026-89868) - scsi: qla2xxx: Use ring-slot helpers in __qla2x00_alloc_iocbs - scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot - scsi: qla2xxx: Fix 64G link speed reporting in get_data_rate - scsi: qla2xxx: Skip vport under deletion in report ID acquisition (CVE-2026-97531) - scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature (CVE-2026-97530) - scsi: qla2xxx: Clamp max_npiv_vports to VP_CTRL bitmap capacity - scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error (CVE-2026-97528) - scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock (CVE-2026-97527) - scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[] (CVE-2026-97529) - f2fs: validate MOVE_RANGE destination size (CVE-2026-89840) - f2fs: convert F2FS_I_SB to sbi in f2fs_setattr() - f2fs: don't allow unaligned truncation to smaller/equal size on pinned file - f2fs: fix to avoid potential section-unaligned pinfile - f2fs: dirty directory inodes on mtime/ctime update - f2fs: limit recovery filename logging to stored length (CVE-2026-89838) - f2fs: fix dentry folio leak in find_in_level (CVE-2026-89837) - f2fs: embed f2fs_gc_kthread in f2fs_sb_info (CVE-2026-93285) - f2fs: Convert clear_node_page_dirty() to clear_node_folio_dirty() - f2fs: fix to clear dirty flag on folio in error path (CVE-2026-89832) - f2fs: accurately adjust free_sections during free_segment_range (CVE-2026-97534) - drm/amdgpu: Fix missing unwind in amdgpu_ib_schedule() error path - drm/amdgpu: add a helper to calculate ring distance - drm/amdgpu: plumb timedout fence through to force completion - drm/amdgpu: avoid force-completing uninitialized UVD rings (CVE-2026-89827) - drm/nouveau/disp/r535: Add scanline position support + head state support - drm/amd/display: Set gpuvm min page size to 4K on dcn35/36 - drm/sysfb: simpledrm: Improve panel-size validation - drm/sysfb: simpledrm: Improve stride validation (CVE-2026-93244) - firmware: sysfb: Move bpp-depth calculation into screen_info helper - drm/sysfb: simpledrm: Improve framebuffer-size validation - drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation (CVE-2026-89806) - drm/sysfb: ofdrm: Fix is_avivo() constant comparison bug - configfs:get_target() - release path as soon as we grab configfs_item reference - configfs: pin the symlink target's dirent instead of chasing ->ci_dentry (CVE-2026-97950) - tracing: Fix memory corruption from a "STACKTRACE" histogram key (CVE-2026-97934) - ipmr: account multicast table and route memory (CVE-2026-97939) - sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[] - reboot: fix cad_pid use-after-free race (CVE-2026-97938) - configfs: unhash the dentry before dropping the item in rmdir (CVE-2026-97949) - tracing: Constify struct event_trigger_ops - tracing: Remove get_trigger_ops() and add count_func() from trigger ops - tracing: Merge struct event_trigger_ops into struct event_command - tracing: Set the trace clock before registering the histogram trigger (CVE-2026-97935) - virtio-mmio: Remove virtqueue list from mmio device - virtio_mmio: disable IRQ wake before free_irq - tools/bootconfig: Cleanup bootconfig footer size calculations - tools/bootconfig: Fix integer overflow and truncation in size checks - tracing: Take trace_array reference when opening a tracer options file (CVE-2026-97933) - tracing: Take the reference before publishing the named histogram trigger (CVE-2026-97919) - tracing: Undo the registration when enabling the histogram trigger fails (CVE-2026-97918) - EDAC/altera: Use ECC manager compatible to select A10/S10 IRQ layout - EDAC/altera: Use parent device for devres in altr_portb_setup() - genetlink: pin family module during policy dump (CVE-2026-97901) - drm/bridge: tc358768: Enforce input bus flags via atomic_check - io_uring/rw: end write accounting from ->ki_complete (CVE-2026-97619) - io_uring/net: don't overconsume buffers when using MSG_TRUNC (CVE-2026-97618) - bootconfig: Fix integer overflow in initrd size check (CVE-2026-97906) - net: bridge: use option bits for CFM/MRP frame handlers (CVE-2026-97615) - drm/xe: Flush LSC untyped L1 dataport cache after rcs/ccs batches (CVE-2026-97620) - netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount (CVE-2026-74347) - netfilter: cttimeout: prevent UAF during module unload (CVE-2026-97609) - net: macb: Replace open-coded implementation with napi_schedule() - net: macb: Use netif_napi_add_tx() instead of netif_napi_add() for TX NAPI - net: macb: unify device pointer naming convention - net: macb: initialize PTP state before registering clock - erofs: add sysfs feature entry for xattr prefixes - [amd64,arm64] idpf: Fix kernel-doc descriptions to avoid warnings - [amd64,arm64] idpf: introduce idpf_q_vec_rsrc struct and move vector resources to it - [amd64,arm64] idpf: disable DIM work before freeing q_vectors (CVE-2026-97603) - ipv6: make ipv6_pinfo.saddr_cache a boolean - ipv6: reorganise struct ipv6_pinfo - ipv6: Move ipv6_fl_list from ipv6_pinfo to inet_sock. - ipv6: flowlabel: cap duplicate leases per socket (CVE-2026-97597) - landlock: Clarify documentation for the IOCTL access right - landlock: Fix use-after-free of the source's parent directory (CVE-2026-97594) - netmem: add a couple of page helper wrappers - net: page_pool: rename page_pool_alloc_netmem to *_netmems - page_pool: disable sync for cpu for dmabuf memory provider - bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc() (CVE-2026-97571) - mptcp: pm: drop match in userspace_pm_append_new_local_addr - sock: add sock_kmemdup helper - mptcp: use sock_kmemdup for address entry - mptcp: pm: userspace: fix address ID overflow - bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips - eth: bnxt: store rx buffer size per queue - bnxt: fix memory leak in bnxt_queue_mem_alloc error cases - bnxt_en: Don't free the live ring's TPA state on queue restart failure (CVE-2026-97574) - mptcp: pm: reset retrans_time when ADD_ADDR entry is reused - mptcp: pm: use for_each_subflow helper - mptcp: pm: rename add_entry structure to add_addr - mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0 (CVE-2026-97566) - tcp: introduce icsk->icsk_keepalive_timer - mptcp: do not reschedule the RTX timer for fallback sockets - smb: client: refactor ACL setting control flow in id_mode_to_cifs_acl() - smb/client: fix security flag calculation when setting security descriptors - smb: client: fail DACL rewrite when the new DACL exceeds 64K (CVE-2026-97559) - xfs: report healthy filesystem events in scrub stats - xfs: fix short ifork reaping computation in xreap_bmapi_binval - xfs: strengthen the "is cow staging" helpers in scrub - xfs: remove the i_ino field in struct xfs_inode - xfs: fix under-reservation of blocks when repairing sf directories (CVE-2026-97549) - xfs: fix backwards mergeability logic in refcount scrubber - cifs: Fix specification of function pointers - 9p: Fix v9fs_issue_write() to update i_size and remote_i_size - [arm64] phy: renesas: rcar-gen3-usb2: Avoid long delay in atomic context - ALSA: usb-audio: Optimize the copy of packet sizes for implicit fb handling - ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity - swiotlb: use the adjusted address for the highmem page lookup - net: phy: mediatek: do not report link and per-speed LED rules together - btrfs: take commit root semaphore when iterating in mark_block_group_to_copy() - [arm64] Use load LSE atomics for the non-return per-CPU atomic operations - [arm64] percpu: Fix LSE operations on {8,16}-bit types - [arm64] i2c: qcom-cci: Stop complaining about DT set clock rate - [arm64] i2c: qcom-cci: Remove the unused variable cci_clk_rate - [arm64] i2c: qcom-cci: fix device_node refcount leak in cci_probe()/cci_remove() - scsi: fnic: Fix missed link-up when critical IRQ targets offline CPU - Input: hp_sdc - shut down kicker timer on module exit - wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown - hwmon: (pwm-fan) Stop RPM timer before freeing tach data - drm/msm/dpu: clear pending peripheral flush state - wifi: libipw: reject TKIP frames without a full MIC - wifi: mac80211: track MU-MIMO configuration on disabled interfaces - wifi: mac80211: refuse to make a monitor active when it has no queue - smb: mark the new channel addition log as informational log with cifs_info - smb: client: fix use-after-free of iface in cifs_try_adding_channels() - drm/amdgpu: Failed to check various return code - drm/amdgpu/umsch: remove vpe test from umsch - drm/amdgpu: use GFP_NOWAIT for memory allocations - drm/amdgpu: fix rmmio iounmap skipped on device removal - smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs() - drm: add drm_memory_stats_is_zero - drm/amdgpu: hold a runtime PM reference for P2P dma-buf attachments - smb: client: fix reparse buffer bounds in cifs_query_reparse_point() - smb/client: send lease break ACKs thru correct session for multiuser mounts - [arm64] boot: Disable trapping of PMZR_EL0 writes to EL2 - vlan: require the MAC header to be present in __vlan_insert_inner_tag() - gpio: cdev: fix kernel stack leak to user-space in error path - ipe: fix use-after-free when auditing a newly loaded policy - bna: prevent IOC timer rearm during teardown - i2c: qcom-geni: Fix hardcoded clock index in SE_GENI_CLK_SEL - drm/amdgpu: Fix acpi device leak in amdgpu_acpi_enumerate_xcc() - drm/client: Pass force parameter to client restore - drm/client: fix restore of partially initialized client - [amd64] drm/i915/mst: add mst sub-struct to struct intel_dp - [amd64] drm/i915/dp_mst: Fix configuring FEC for a disconnected stream - mm/rmap: allocate anon_vma_chain objects unlocked when possible - mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish - drm/xe/vm: nuke PTs only after unlinking contested VMAs - mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold() - mm/hugetlb: fix surplus pages in dissolve_free_huge_page() - mm/hugetlb: create hstate_is_gigantic_no_runtime helper - mm/hugetlb: do not dissolve gigantic pages without runtime support - super: make iterate_supers_type() deletion-safe - PCI: Fix Resizable BAR restore order - PCI: Fix BAR resize for devices on a root bus - packet: use ubuf_info completion for TX_RING packets - HID: hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM - HID: alps: unregister DualPoint Stick input device on remove - net/sched: act_ct: fix helper UAF due to extensions realloc - net/sched: act_ct: avoid modifying shared unconfirmed ct entry - net: ipconfig: Remove outdated comment and indent code block - net: ipconfig: bound DHCP option construction - net: ena: Remove autopolling mode - net: ena: fix MMIO read buffer leak on probe failure - [amd64] perf/x86/intel: Update event constraints and cache_extra_regsfor LNL - [amd64] perf/x86/intel: Remove incorrect LionCove PEBS data-source constraints - [amd64] perf/x86/intel: Update event constraints and cache_extra_regsfor ADL - [amd64] perf/x86/intel: Fix GRT PEBS load/store direction for latency events, to fix sample classification - [riscv64] KVM: Fix null pointer dereference in kvm_riscv_aia_imsic_rw_attr() - [riscv64] KVM: Serialize IMSIC attributes with vCPU migration - rose: fix dev_put() leak in rose_loopback_timer() - rose: hold loopback neighbour reference across timer callback - rose: fix race between loopback timer and module removal - rose: clear neighbour pointer after rose_neigh_put() in state machines - rose: guard rose_neigh_put() against NULL in timer expiry - rose: fix netdev double-hold in rose_rx_call_request() - rose: fix notifier unregistered too early in rose_exit() - rose: fix netdev double-hold in rose_make_new() - rose: drop CALL_REQUEST in loopback timer when device is not running - rose: cancel neighbour timers in rose_neigh_put() before freeing - nvme: revert the cross-controller atomic write size validation - bootconfig: Fix negative seeks on 32-bit with LFS enabled - tracing: Move d_max_latency out of CONFIG_FSNOTIFY protection - mtd: rawnand: pl353: Fix debug prints - [amd64] platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails - usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition - bpf: Reject key-less BTF for hash maps - mm/hugetlb: keep max_huge_pages when dissolving surplus folios https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.113 - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (CVE-2026-89633) - smb: client: fix cifsFileInfo reference leak in deferred close (CVE-2026-97558) - [arm64] KVM: arm64: nv: Fix life cycle of the nested_mmus array - [arm64] KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction - smb: client: use finish_no_open() for non-regular inodes - xfs: don't let memory failures leak blocks and kill repairs - [riscv64] KVM: Fix null pointer dereference in kvm_riscv_aia_imsic_has_attr() - bpf, xdp: move offload check into dev_xdp_install() (CVE-2026-90146) - ASoC: sdw_utils: Set snd_soc_dai_link_ch_map.codec_ch_mask for capture - Bluetooth: btusb: Add IMC Networks QCA9377 to quirks table - ASoC: SOF: ipc4-priv: Add kernel doc for fw_context_save of sof_ipc4_fw_data - ASoC: SOF: ipc4/Intel: Add support for library restore firmware functionality - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() - smb/client: pass cifs_open_info_data to SMB2_open() - smb: client: close handle after create-context parsing failure - Bluetooth: ISO: Fix data-race on iso_pi(sk) in socket and HCI event paths - Bluetooth: ISO: release unused CIS holds after channel attach - smb: client: close completed creates on compound wait errors - xfs: fix cursor and pointer handling when recovering iunlink buckets - neighbour: Skip default parms when resumed in neightbl_dump_info(). - ALSA: usb-audio: Apply IGNORE_CTL_ERROR quirk to all Audient devices - audit: fix exe mark UAF in kill_rules() - HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request - kprobes: Skip disarmed probes when checking optkprobe overlap - of/irq: Fix remaining refcount leaks in of_irq_init() - of/overlay: put property on deadprops only after changeset add succeeds - of/overlay: only treat a positive changeset id as registered - net: fix checksum offsets in skb_splice_from_iter() - netfilter: nft_flow_offload: drop flowtable reference on init error path - net/packet: prevent TX_RING byte count overflow - rtc: ac100: Assign .num before accessing .hws - rtc: spear: initialize IRQ state before requesting alarm IRQ - sctp: check RCV_SHUTDOWN after the sendmsg connect wait - tpm: Disable TPM on null key name mismatch - virt: vmgenid: set driver_data before registering notification handlers - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CVE-2026-89638) - rds_tcp: close NULL deref window in rds_tcp_set_callbacks - vt: skip screen update for DEC alignment test on backgroup consoles - wifi: wlcore: Fix runtime PM leak in wlcore_remove() - ALSA: caiaq: unregister the input device when probe fails - ALSA: line6: reject oversized playback packets - mm/secretmem: properly account locked pages (CVE-2026-93243) - perf/core: Fix WARN in perf_sigtrap() - random: vDSO: avoid call to memset() when zeroing reserved parameter - mm/damon/core: don't skip damos_adjust_quota() while esz is not zero - iio: accel: kionix-kx022a: Fix array boundary check - mtd: core: call _get_device() with the master MTD - nvmet: preserve device path on allocation failure - random: fix vgetrandom_opaque_params kernel-doc - of/overlay: don't leak fragment references when changeset init fails - of/overlay: don't create "//" paths for fragments targeting the root - ASoC: wm8903: Move the DRC QR threshold to the register that holds it - wifi: wfx: validate MIB read length before copying to caller - ASoC: tegra: Fix ASRC Stream6 input threshold control - wifi: ath11k: reset ar->num_stations on hardware start - wifi: ath9k: reject short WMI command responses - wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE - rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak - rtc: Switch back to struct platform_driver::remove() - rtc: ac100: Fix clock provider use-after-free on probe failure - rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe() - wifi: cfg80211: preserve hidden-group beacon IE ownership - wifi: mac80211: Add multicast to unicast support for 802.3 path - wifi: mac80211: Add 802.3 multicast encapsulation offload support - wifi: mac80211: prevent AP VLAN tx from other interfaces - ASoC: codecs: rt286: Revert delay value for jack setup - ASoC: codecs: rt274: Fix format setting for 44100 rate - Bluetooth: hci_core: free the HCI ID if naming fails - Bluetooth: btintel: validate DDC record lengths - net/mctp: publish the mctp_dev only after it is initialised - net/sched: cls_api: reclaim an empty proto on the error path - ipv6: fix prefix route expiry in modify_prefix_route() - netfilter: ipset: do not update comments from kernel-side adds - Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister - net: systemport: Fix buffer overflow in bcm_sysport_get_stats() - net: systemport: Fix RUNT MIB counter register offset calculation - net/mlx5: LAG, Refactor lag logic - net/mlx5: Fix slab-out-of-bounds when handling team device events - octeontx2-af: mcs: Fix SC resource cleanup loop - tipc: prevent GCM nonce reuse on peer key changes - memcg: convert memcg->socket_pressure to u64 - mptcp: Fix up subflow's memcg when CONFIG_SOCK_CGROUP_DATA=n. - net: Clean up __sk_mem_raise_allocated(). - net-memcg: Introduce mem_cgroup_from_sk(). - net-memcg: Introduce mem_cgroup_sk_enabled(). - net: restrict SO_RESERVE_MEM to TCP sockets and cap max value - net/sched: fq_codel: match the no-drop threshold to the packet size - net/sched: sch_codel: match the no-drop threshold to the packet size - virtio_blk: set the zone write granularity - net: bcmgenet: fix NULL dereference in set_coalesce before first open - net: cap skb->queue_mapping when the tx queue is picked - net: ethernet: mtk_eth_soc: allocate dummy netdev sooner - tcp: refresh TS.Recent for accepted old ACKs - ipvs: fix missing counter decrement in lblc - ipvs: do not create invisible templates - ipvs: filter some flags received in the backup server - netfilter: bpf: reject invalid NAT manipulation types - netfilter: conntrack: remove skb argument from nf_ct_refresh - netfilter: conntrack: rework offload nf_conn timeout extension logic - netfilter: flowtable: generalize pending status bit - net: microchip: vcap: stop scanning after deleting key field - net: sparx5: make ports inherit the switch base mac address type - net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference - ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel() - xdp, xsk: constify read-only arguments of some static inline helpers - net: mvneta: clear XDP pfmemalloc flag between frames - i2c: at91: release DMA channels when probe defers - perf: Fix race between perf_event_exit_task() and perf_pending_task() - ALSA: core: Define auto-cleanup for snd_card_free() - ALSA: ice1712: Fix the error handling via auto-cleanup at probe - PCI: Accept AtomicOps already enabled by the hypervisor - drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend - drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC - drm/amd/pm/si: Fix updating clock limits on AC/DC - drm/amdgpu/gfx6: fix firmware leak on teardown - drm/radeon: Read the VRAM VBIOS signature with readb() - drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device - drm/mediatek: Fix ovl adaptor platform device leak - drm/mediatek: Fix pdev reference leak in mtk_drm_bind() - drm/amdgpu: fix IP instance memory leak on kobject add failure - drm/amdgpu: fix ACP MFD device leak on init failure - binder: fix is_failure flag for superseded transaction cleanup - binder: fix leaked fd fixups on TF_UPDATE_TXN supersede - kgdboc: Fix tty driver reference leak in configure_kgdboc() - Input: atkbd - skip deactivate for Lenovo IdeaPad Slim 3 15IWC11 - Input: i8042 - add nomux quirk for Fujitsu LIFEBOOK U7410 - Input: s6sy761 - fix resume ordering and restore sensing - Input: synaptics - add LEN205b entry to smbus_pnp_ids for ThinkPad T490 - Input: synaptics - limit T440p InterTouch quirk to LEN0036 - nitro_enclaves: fix use-after-free on SLOT_ALLOC failure - [arm64] soc: qcom: geni-se: Correct QUP Core ICC vote constants - USB: cdc-acm: fix racy TIOCMIWAIT implementation - USB: cdc-acm: skip URB restart in port_shutdown if disconnected - USB: serial: fix port tear down use-after-free - usb: storage: sierra_ms: reject short SWoC info transfers - usb: hub: use shorter 120ms post resume hold for SS root hubs - usb: octeon-hcd: fix the FIFO-flush timeout computation - usb: ohci-da8xx: disable controller wakeup on cleanup - usb: ohci-s3c2410: disable controller wakeup on removal - usb: ohci-st: disable controller wakeup on removal - usb: gadget: midi2: Fix the jack descriptor array sizes - usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd - usb: typec: anx7411 - stop the IRQ before destroying the workqueue - usb: dwc3: am62: Fix runtime PM usage count leak on probe error path - usb: gadget: aspeed-vhub: cancel wake work on device removal - USB: gadget: dummy-hcd: Fix wait for outstanding request completions - usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC - usb: chipidea: tegra: disable runtime PM on resume failure - usb: core: clear both ep_in and ep_out for non-ep0 control endpoints - usb: typec: tcpm: recover after failure to start the frs ams - usb: typec: tipd: don't send GAID when probe fails in APP mode - usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect() - usb: typec: ucsi: glink: fix use-after-free of ucsi on remove - usb: typec: ucsi: Get the connector fwnode based on reg value - usb: typec: ucsi: displayport: Current CAM OOB index fixup - usb: cdns3: fix use-after-free in cdns3_gadget_exit() - usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe - tty: vt: fix memory leak in vc_allocate() - tty: amiserial: fix broken TIOCMIWAIT - tty: vcc: zero-initialize control packet in vcc_send_ctl() - tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup - tty: serial: qcom_geni_serial: Keep console RX functional after deep idle - tty: abort break signalling on hangup - tty: serial: max3100: shut down timer before freeing port - serial: 8250_bcm7271: fix use-after-free in brcmuart_remove() - serial: fix TIOCMIWAIT race - serial: ma35d1: Fix clock reference leak in ma35d1serial_probe() - serial: tegra: don't clear the Tx FIFO on an Rx-only reset - serial: vt8500: Fix clock reference leak in vt8500_serial_probe() - serial: sc16is7xx: fix TX gap caused by kfifo circular buffer wrap-around - serial: sc16is7xx: refill TX FIFO below trigger using fresh TXLVL - ASoC: codecs: max98363: fix uninitialized stream_config->type - ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type - ASoC: qcom: lpass-cpu: use DAI table index for playback constraints - ALSA: seq: Serialize compat port-info ioctls - ALSA: ua101: reject mismatched capture/playback packet sizes - EDAC/altera: Fix memory leak on dci allocation failure - i2c: xiic: don't clobber msg->len to signal block-read completion - Bluetooth: RFCOMM: Fix initial port reference race - Bluetooth: hci_sync: Fix inquiry cache use-after-free - Bluetooth: hci_conn: Lock parent access during enhanced SCO setup - Bluetooth: hci_core: Fix inquiry cache timestamps on 64-bit systems - Bluetooth: hci_core: Serialize ACL scheduling with channel deletion - Bluetooth: hci_core: Serialize fragmented ISO packet queueing - Bluetooth: btintel: fix buffer over-read in btintel_hw_error() - Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame() - Bluetooth: btintel_pcie: reject oversized TX packets in send_frame() - io_uring: fix task_work add use-after-free with SQPOLL - ipvs: bound LBLCR and LBLC cache growth - HID: multitouch: stop the release timer from being rearmed on remove - net: ext2end IPv6 exthdr detection of tunneled packets - tpm: fix off-by-four bounds check in tpm2_get_random() - nvme-multipath: fix underflow in ANA log bounds checks - nvme-pci: add NVME_QUIRK_DMAPOOL_ALIGN_512 for Micron 4100AT - nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() - mtd: block2mtd: Fix divide error when erase_size is zero - mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ - mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB - mtd: spinand: fix zero oobavail when no ECC engine is used - [amd64] KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified - [amd64] KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy - wifi: cw1200: fix TX padding OOB read leaking heap data to device - wifi: iwlegacy: 3945: free EEPROM data on remove - wifi: mac80211: keep paired old chanctx alive - wifi: mac80211: drain PS delivery work during station teardown - wifi: mac80211: account proxy paths against the mesh path limit - wifi: mac80211: keep fallback association elements alive - wifi: mac80211: minstrel_ht: validate fixed rate index - wifi: mac80211: reject invalid 320 MHz CSA bandwidth - wifi: mac80211: release mesh path quota on failed additions - wifi: mac80211: fix mesh fast xmit path deletion UAF - wifi: mac80211: handle empty FILS association request payload - USB: serial: cp210x: add Corsair AX1500i Power Supply - USB: serial: quatech2: fix baud rate overflow - USB: serial: ssu100: fix baud rate overflow - USB: serial: fix dynamic id driver deregistration race - USB: serial: fix driver deregistration order - USB: serial: fix ioctl hangup race - USB: serial: option: add support for SIMCom SIM8260C - USB: serial: option: add Quectel EG060W - USB: serial: option: add Compal EXM-G1x support - USB: serial: option: add Quectel RG660QB - USB: serial: option: add Compal EXC-T1 support - [amd64] thunderbolt: Fix KASAN reported use-after-free when request is canceled - [amd64] thunderbolt: Disable CL states for the Anker Prime TB5 dock - [amd64] thunderbolt: Reject oversized XDomain properties responses - smb: client: discard post-EOF pagecache when extending a file via zero range - smb: client: discard post-EOF pagecache when extending a file via copy range - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races - iio: accel: kxcjk-1013: reject duplicate event disable - iio: accel: sca3000: fix frequency divider condition check - iio: adc: pac1934: check ACPI label duplication - iio: adc: stm32-adc: fix check on internal channel availability - iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure - iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls - iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind - iio: admv1013: initialize callback mutex before registering notifier - iio: buffer: serialize buffer teardown with mode claims - iio: buffer: Ensure bounce buffer used for unaligned case is zeroed. - iio: frequency: admv1013: fix wrong channel field used in admv1013_read_raw() - iio: gyro: adis16136: fix unprotected debugfs reads - iio: health: max30102: fix NULL dereference in interrupt handler - iio: imu: adis16400: fix unprotected debugfs reads - iio: imu: adis16480: fix unprotected debugfs reads - iio: light: gp2ap020a00f: drain irq_work after free_irq - iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup - iio: proximity: aw96103: validate firmware data length - iio: proximity: isl29501: Fix return type of isl29501_register_write - iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure - iio: proximity: sx9324: Correct proximity channel resolution - iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler - iio: trigger: cancel reenable_work before freeing trigger - ipv6: use RCU in ip6_output() (CVE-2025-40158) - jfs: fix array-index-out-of-bounds read in add_missing_indices (CVE-2025-38204) - [arm64] KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save (CVE-2026-89912) - svcrdma: Use svc_xprt_put to free listener on create failure (CVE-2026-89527) - drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read (CVE-2026-93179) - console: introduce console_lock guard()s - tty/vt: use guard()s - vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF - mtd: rawnand: vf610_nfc: fix false bitflips on reads of erased pages - mptcp: prevent race between disconnect() and rtx (CVE-2026-97567) - pfcp: fix socket lifetime on netdevice registration failure - netfs: clear post-EOF pagecache when extending a file via write - mm: shmem: remove __shmem_huge_global_enabled() - mm: factor out the order calculation into a new helper - mm: shmem: change shmem_huge_global_enabled() to return huge order bitmap - mm: shmem: ignore sysfs configs for shmem forced collapse - [arm64] KVM: arm64: vgic-its: Fix MOVALL handling of source redistributor - cifs: Fix handling of a beyond-EOF DIO/unbuffered read over SMB1 - net: usb: qmi_wwan: add Quectel EG120K-EA - xen/netfront: drop RX packets with a short Ethernet header (CVE-2026-98375) - fs,fsverity: reject size changes on fsverity files in setattr_prepare - fs,fsverity: remove check for fsverity being enabled in setattr_prepare() - drm/amd/display: Fix fast updates on DCE 8.1 - usb: dwc3: gadget: fix IRQ storm on invalid event buffer count - tty: fix saved termios reset race - perf: Remove unnecessary parameter of security check - perf/core: Check kernel access when kernel callchains are requested - perf: Require kernel access for text poke events - [arm64] fpsimd: signal: Clear PSTATE.SM when restoring FPSIMD frame only - [arm64] fpsimd: signal: Mandate SVE payload for streaming-mode state - [arm64] fpsimd: signal: Consistently read FPSIMD context - [arm64] fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems - Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown - Bluetooth: Serialize SMP remote OOB data access - [arm64] errata: Factor out broken AMU const counter cap - [arm64] errata: Add Cortex-A725 erratum 3821522 workaround - [arm64] KVM: arm64: Use stage-1 leaf size for VM_PFNMAP - fsverity: add dependency on 64K or smaller pages - drm/amdgpu: reset VI ASIC on MacBookPro15,1 - drm/amdgpu: reset VI ASIC on MacBookPro14,3 - usb: ohci-spear: Remove unnecessary NULL check before clk_disable_unprepare() - usb: ohci-spear: disable controller wakeup on removal - USB: dwc2: shut down wakeup timer before freeing HCD state - drm/amd/display: Preserve eDP mode on initial ASSR failure - usb: typec: ucsi: acpi: Assume UCSI 1.2 on Acer Nitro ANV15-41 - tty: introduce tty_port_tty guard() - tty: tty_port: use guard()s - tty: tty_port: restore TTY_IO_ERROR on activation failure - tty: n_gsm: fix missing modem controls after DLCI open in convergence layer type 2 - perf: Replace perf_event_header__init_id with full header init - ALSA: hda/tegra: Re-enable SDO workaround for Tegra194 - i2c: xiic: Relocate xiic_i2c_runtime_suspend and xiic_i2c_runtime_resume to facilitate atomic mode - i2c: xiic: preserve PEC byte length in SMBus block read setup - drm/amd/display: Mark DCE 6.4 as not APU - mtd: spinand: fix NULL pointer dereference with no ECC engine - wifi: mac80211: shut down RX BA session timer on teardown - mtd: spinand: Enable QE on all dies - nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known - [arm64] KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT - ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432) - bnxt_en: fix DMA mapping length for padded small packets (Closes: #1149564) - tty: port: fix tty_port_tty_vhangup() race - wifi: mac80211: count only matching reservations in reserved switch - fs: Free any excess xarray nodes in clear_inode() - net/mlx5e: Prevent stale XSK buffer release on refill retry - net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry - net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq() - net: mana: Skip WQ object destruction for uninitialized RXQ - net: mana: remove double CQ cleanup in mana_create_rxq error path - [amd64] KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted - wifi: mac80211: Add sta pointer sanity check in ieee80211_8023_xmit() - wifi: mac80211: set info->band for 802.3 encap offload frames - iio: accel: kx022a: Use cleanup.h helpers - iio: accel: kionix-kx022a: Prevent memory leak and fix state - iio: adc: ad_sigma_delta: fix use-after-free on unbind - iio: adc: aspeed: Simplify with dev_err_probe - iio: adc: aspeed: propagate reset deassert errors - iio: adc: max1363: sign-extend bipolar differential channel reads - iio: adc: axp288: Add TS bias override for Haier HV103H - iio: adc: stm32-adc: fix possible division by zero in processed channel - smb: client: only require read lease for size-extending preallocate - iio: buffer-dmaengine: fix sg entry iteration when building dma_vecs - iio: cdc: ad7150: fix OF matching and publish module aliases - iio: bu27034: simplify using guard(mutex) - iio: light: rohm-bu27034: Fix infinite delay on error - iio: light: rohm-bu27034: Fix error return - tools: ynl-gen: use names of constants in generated limits - tools: ynl-gen: support limits using definitions - tools: ynl: add scope qualifier for definitions - doc/netlink: netlink-raw: Add max check - f2fs: fix to reclaim space in f2fs_allocate_pinning_section() - f2fs: fix to shrink gc_lock coverage in f2fs_gc_range() - f2fs: fix to reset all pinned status during fggc - mm/damon/core: do non-safe region walk on kdamond_apply_schemes() - mm/damon/core: fix unconditionally skip last region - Bluetooth: hci_event: fix simultaneous discovery stuck in FINDING - wifi: ath12k: fix reusing m3 memory - crypto: drbg - Fix ineffective sanity check - ipv4: validate checksum_start before completing checksum (CVE-2026-99999) - ipv4: stop PMTU walk when nexthop group shrinks - ipv4: stop exception dump when nexthop group shrinks - ipv4: stop route notification sizing when nexthop group shrinks - ipv4: do not warn on route notification size race - ipv6: do not warn on route notification size race - Input: ati_remote2 - fix type confusion in device attribute handlers - Input: xpad - add support for Corsair Novablade Pro - arm64: irq: exclude the softirq stack switch from KCOV - [amd64] ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P) - btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode() - cipso: adjust cached option offsets when removing CIPSO - dm ioctl: don't let data_start run past the buffer - usb: f81604: fix struct f81604_int_data size mismatch - vsock/virtio: account only unread bytes in read_skb() - wifi: brcmfmac: fix P2P device removal race in brcmf_detach() - wireguard: queueing: preserve tstamp_type when encapsulating packet - wireguard: noise: reject response consumption after intermediate initiation - workqueue: Fix NULL current_pwq deref in chained work check - xen/netfront: don't leak the skb when xennet_fill_frags() fails - tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper() - strparser: make sure __strp_recv isn't running before tearing down the parser - swiotlb: fix default_swiotlb_limit() for non-growable default pool - tcp: reject net_iov in zerocopy receive mapping hints - tipc: destroy topsrv workqueues before closing connections - tipc: hold a reference to nodes found by link name - Revert "wifi: libertas: reject short monitor TX frames" - selinux: fix data race on AVC latest_notif - selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts - sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute - [amd64] EDAC/amd64: Mask UMC chip select to the four implemented selects - gpio: xilinx: fix runtime PM leak on request error path - ibmveth: h_free logical LAN on open-fail after register - ibmveth: fix TX LTB and filter unwind on open-fail - ice: fix metadata_dst refcount handling on representor teardown - keys: finalize persistent keyring timeout after link attempt - KEYS: Fix add_key() race with keyring restriction - memstick: core: wait for request completion before freeing card - memstick: rtsx_usb_ms: complete requests after eject instead of dropping them - dm-crypt: reject the lmk IV mode with AEAD ciphers - dm-snap: reject the transient exception store for snapshot-merge - dm: fix reading free memory in do_resume - mmc: cavium-octeon: destroy slot platform devices on remove - mmc: cavium-thunderx: destroy slot platform devices on remove - mmc: mtk-sd: Cancel request timeout work on remove - mmc: sdhci-sprd: disable runtime PM on remove - net/packet: guard the ll header push in packet_rcv_spkt() - net/smc: protect clcsock lifetime in smc_getname - net: bridge: avoid recursive multicast port cleanup - net: dsa: microchip: fix KSZ8765 fiber detection - net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits() - net: sparx5: free the matchall entry on destroy - net: usb: ax88179_178a: fix rx frame length for non-last packets - nvme: fix swapped ZRASF zone state values for full and read only - openvswitch: fix soft lockup in the netlink flow dump - optee: register TEE devices only once fully initialized - regulator: ltc3676: don't read the write-only HRST and CLIRQ registers - regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4 - pmdomain: imx8m-blk-ctrl: Serialize power on/off across sibling domains - pmdomain: rockchip: don't ignore clock lookup errors on attach - pmdomain: rockchip: fix clock leak on domain probe failure - pmdomain: rockchip: propagate subdomain add errors - scsi: qedi: Initialize callback state before registration - [riscv64] entry: gate shadow call stack reload on sstatus.SPP, not tp - [riscv64] fix load_unaligned_zeropad() fixup for RV32 - Bluetooth: btintel_pcie: use managed IRQ teardown - Bluetooth: hci_sock: Serialize dead-device detachment - Bluetooth: ISO: Reject concurrent BIS listener setup - Bluetooth: ISO: Serialize concurrent connect calls - Bluetooth: MGMT: Fix status of pending commands flushed on power off - Bluetooth: RFCOMM: free the skb when the DLC has no owner - Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown - drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN - drm/gud: don't keep a connector without a CRTC as connector_state - [amd64] drm/i915/gem: Prevent overstepping exec array boundary - [amd64] drm/i915/gt: Unmask interrupts only when ACTIVE is true - drm/imagination: Size page table preallocation by device address - drm/vc4: drain the hangcheck timer and works on V3D unbind - drm/amdkfd: align SDMA doorbell base for shader doorbell writes - drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info - drm/amdgpu: serialize vblank counter reads against GPU reset - drm/amdgpu: make Mac FB workaround generic - drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks - drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs - namespace: don't copy an unmounted mount tree - fs: refuse fspick() on internal superblocks - namespace: check a submount for references right before unmounting it - dcache: don't put a mountpoint on a dentry that's being removed - namespace: don't let a pseudo dentry become the root of a mount - namei: don't reveal overmounted entries in refwalk - namespace: refuse an automount below a mount that is in no namespace - [arm64] dts: lx2160a: fix incorrect pinmux - [arm64] dts: lx2160a: fix IIC1 pinmux submask rejected by pinctrl-single - [arm64] dts: lx2160a: fix the iic5 spi3 pinmux offset and value - Bluetooth: btintel_pcie: fix TX descriptor bounds check - Bluetooth: btintel_pcie: Add recovery mechanism - Bluetooth: btintel_pcie: Add shared HW reset for clean start - drm/dp: don't mark the AUX backlight enabled when enabling failed - gpio: exar: initialize the ID before registering its cleanup - drm/aspeed: Balance the display clock enable on teardown - drm/vc4: Free the BO cache size list on teardown - net/sched: em_text: reject unterminated algo before autoload - amt: send the relay's General Query directly from the receive path - cxgb4/ch_ktls: disable softirqs around tid_list erases - optee: sync secure world ABI headers - [arm64] tee: optee: ffa: support shared memory offsets on large-page kernels - nvmet: use the local P2P device on metadata allocation failure - [arm64] boot: Don't set PMUv3p9 FGT2 bits without PMUv3 - btrfs: fix xattr replace when multiple xattrs are packed in the same item - wifi: mt76: mt7925: restore the legacy BSS after MLO teardown - wifi: mt76: mt7996: fix struct mt7996_mcu_wed_rro_ba_delete_event layout - wifi: mt76: mt7915: disable rx napi when removing device - wifi: mt76: mt7925: don't put the band auto marker in TGID - wifi: mt76: mt792x: treat 0xff ACPI SAR entries as no limit - wifi: mt76: mt792x: pick the SAR table layout from the table itself - ASoC: adau1372: allow sleepy powerdown GPIOs - ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes - ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM - cpuset: separate tmpmasks and cpuset allocation logic - cgroup/cpuset: Call is_in_v2_mode() after acquiring cpuset_mutex in cpuset_handle_hotplug() - flow_dissector: avoid u16 truncation of skb->len when computing thoff - devlink: fix devlink_rel reference leak when notify work is pending - net/sched: cls_route: reject change with no routing attribute - pfcp: make sure the SEID is linear before reading it - bnxt_en: Add bnxt_clear_bars() helper - bnxt_en: Fix driver init in kdump kernel - flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect() - drm/imagination: Fix reference and vm_bo handling in remap() - veth: fix peer NETDEV_XDP_ACT_NDO_XMIT after GRO is toggled while down - net/mlx5e: Order ICOSQ cc update after CQ doorbell - mlxsw: spectrum_flower: Fix port range register leak in tmplt_create() - ptp: ocp: fix PCIe delay estimation calculation - net: openvswitch: validate transport header presence in set_ipv6_addr - vsock: Fix memory leak in vmci_transport_recv_dgram_cb() - drm/vc4: Make v3d paths unavailable on any generation newer than vc4 - drm/vc4: Fix binner slot allocation failing on an idle GPU - drm/panthor: validate userspace queue count against initialized firmware slot count - io_uring/waitid: use io_waitid_remove_wq() consistently - io_uring/waitid: fix KCSAN warning on io_waitid->head - netfilter: conntrack: fix erronous removal of offload bit - netfilter: flowtable: fix offloaded ct timeout never being extended - wifi: mt76: mt7603: initialize global station WCID - can: fix unique skb identifier regression under RPS - drm/amd/display: Don't replace a sink mode that shares the native totals - sched_ext: Generate qseq from a per-task counter - HID: steam: Fully unregister controller when hidraw is opened - HID: steam: Rearrange teardown sequence - HID: steam: Refactor registration - HID: steam: Clean up locking Checksums-Sha1: 9f370bf3b43d02fe1eb1370981f09ebaece7976f 10935 linux-signed-amd64_6.12.113+1.dsc 1511993f41f8960638c71d5cff43f0a97c2a22a5 1076588 linux-signed-amd64_6.12.113+1.tar.xz Checksums-Sha256: e7291238d03b6cbba82249101e32aaf1e72dac3b6f6c9dc043439a63a0155947 10935 linux-signed-amd64_6.12.113+1.dsc 13366afe13770b7781cdebedb0bf4bb2d1aae1072a073cc6ac54927b0f40448d 1076588 linux-signed-amd64_6.12.113+1.tar.xz Files: bb2cd85bedb8dd1974d99b9f9b08c244 10935 kernel optional linux-signed-amd64_6.12.113+1.dsc 3f884a773a0bc1c8ef3bffa912eaa5e7 1076588 kernel optional linux-signed-amd64_6.12.113+1.tar.xz
-----BEGIN PGP SIGNATURE----- iHUEARYKAB0WIQSInBJdRTWyTRy0ztFCTVFtUgONCgUCatEUHAAKCRBCTVFtUgON CppDAP9ae4C9kyvBSL6rkrlMLg2GlGQj3zdrXRWA1hc+WAthzwD6AyzronElpzy1 jo2e7TYXWcwdQnOuvVZ2GtS+biDl5AY= =SRAT -----END PGP SIGNATURE-----
pgpNPEGi7yBx2.pgp
Description: PGP signature
