This is the start of the stable review cycle for the 6.6.143 release. There are 452 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 18 Jun 2026 14:49:57 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.143-rc1... or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y and the diffstat can be found below.
thanks,
greg k-h
------------- Pseudo-Shortlog of commits:
Greg Kroah-Hartman gregkh@linuxfoundation.org Linux 6.6.143-rc1
Borislav Petkov (AMD) bp@alien8.de x86/CPU/AMD: Rename init_amd_zn() to init_amd_zen_common()
Borislav Petkov (AMD) bp@alien8.de x86/CPU/AMD: Call the spectral chicken in the Zen2 init function
Borislav Petkov (AMD) bp@alien8.de x86/CPU/AMD: Move the Zen3 BTC_NO detection to the Zen3 init function
Petr Machata petrm@nvidia.com Revert "selftest/ptp: update ptp selftest to exercise the gettimex options"
Paolo Abeni pabeni@redhat.com mptcp: fix missing wakeups in edge scenarios
Matthieu Baerts (NGI0) matttbe@kernel.org mptcp: add-addr: always drop other suboptions
Will Deacon will@kernel.org arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU
Shanker Donthineni sdonthineni@nvidia.com arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU
Mark Rutland mark.rutland@arm.com arm64: errata: Mitigate TLBI errata on various Arm CPUs
Mark Rutland mark.rutland@arm.com arm64: cputype: Add C1-Premium definitions
Mark Rutland mark.rutland@arm.com arm64: cputype: Add C1-Ultra definitions
Shanker Donthineni sdonthineni@nvidia.com arm64: cputype: Add NVIDIA Olympus definitions
Aaron Erhardt aer@tuxedocomputers.com ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6
Julian Anastasov ja@ssi.bg ipvs: skip ipv6 extension headers for csum checks
Xiang Mei xmei5@asu.edu net: bonding: fix use-after-free in bond_xmit_broadcast()
Jason Gunthorpe jgg@ziepe.ca RDMA/umem: Fix truncation for block sizes >= 4G
Leon Romanovsky leon@kernel.org RDMA: Move DMA block iterator logic into dedicated files
Randy Dunlap rdunlap@infradead.org RDMA/umem: fix kernel-doc warnings
Jason Gunthorpe jgg@ziepe.ca RDMA: During rereg_mr ensure that REREG_ACCESS is compatible
Anton Leontev leontyevantony@gmail.com hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf
Wupeng Ma mawupeng1@huawei.com mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison
Jane Chu jane.chu@oracle.com mm/memory-failure: fix missing ->mf_stats count in hugetlb poison
David Hildenbrand david@redhat.com mm/hugetlb: rename folio_putback_active_hugetlb() to folio_putback_hugetlb()
David Hildenbrand david@redhat.com mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio
David Hildenbrand david@redhat.com mm/hugetlb: rename isolate_hugetlb() to folio_isolate_hugetlb()
Davide Ornaghi d.ornaghi97@gmail.com netfilter: nft_fib: fix stale stack leak via the OIFNAME register
Myrrh Periwinkle myrrhperiwinkle@qtmlabs.xyz usb: typec: ucsi: Don't update power_supply on power role change if not connected
Viken Dadhaniya viken.dadhaniya@oss.qualcomm.com serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ
Michael Bommarito michael.bommarito@gmail.com scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()
Michael Bommarito michael.bommarito@gmail.com thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()
Myrrh Periwinkle myrrhperiwinkle@qtmlabs.xyz usb: typec: ucsi: Check if power role change actually happened before handling
Kai Aizen kai.aizen.dev@gmail.com usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind
Radhey Shyam Pandey radhey.shyam.pandey@amd.com usb: dwc3: xilinx: fix error handling in zynqmp init error paths
Wentao Liang vulab@iscas.ac.cn usb: musb: omap2430: Fix use-after-free in omap2430_probe()
Tudor Ambarus tudor.ambarus@linaro.org tty: serial: samsung: Remove redundant port lock acquisition in rx helpers
Tudor Ambarus tudor.ambarus@linaro.org tty: serial: samsung: use u32 for register interactions
Thomas Gleixner tglx@linutronix.de serial: samsung_tty: Use port lock wrappers
Cássio Gabriel cassiogabrielcontato@gmail.com ALSA: firewire-motu: Protect register DSP event queue positions
Pratyush Yadav (Google) pratyush@kernel.org memfd: deny writeable mappings when implying SEAL_WRITE
Rodrigo Alencar rodrigo.alencar@analog.com iio: dac: ad5686: fix ref bit initialization for single-channel parts
Peter Chen peter.chen@cixtech.com usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure
Antoniu Miclaus antoniu.miclaus@analog.com iio: chemical: scd30: fix division by zero in write_raw
Jonathan Cameron Jonathan.Cameron@huawei.com iio: chemical: scd30: Use guard(mutex) to allow early returns
Antoniu Miclaus antoniu.miclaus@analog.com iio: gyro: adis16260: fix division by zero in write_raw
Paolo Abeni pabeni@redhat.com mptcp: handle first subflow closing consistently
Shuai Zhang shuai.zhang@oss.qualcomm.com Bluetooth: hci_qca: Convert timeout from jiffies to ms
Uwe Kleine-König u.kleine-koenig@baylibre.com Bluetooth: hci_qca: Migrate to serdev specific shutdown function
Uwe Kleine-König u.kleine-koenig@baylibre.com serdev: Provide a bustype shutdown function
Ricardo B. Marliere ricardo@marliere.net serdev: make serdev_bus_type const
SeongJae Park sj@kernel.org mm/damon/sysfs-schemes: delete tried region in regions_rmdirs()
Alistair Popple apopple@nvidia.com mm/memory: fix spurious warning when unmapping device-private/exclusive pages
Shardul Bankar shardul.b@mpiricsoftware.com mptcp: do not drop partial packets
Paolo Abeni pabeni@redhat.com mptcp: introduce the mptcp_init_skb helper
David Carlier devnexen@gmail.com iio: adc: npcm: fix unbalanced clk_disable_unprepare()
Uwe Kleine-König u.kleine-koenig@pengutronix.de iio: adc: npcm: Convert to platform remove callback returning void
Zeng Heng zengheng4@huawei.com arm64: tlb: Flush walk cache when unsharing PMD tables
Dawei Feng dawei.feng@seu.edu.cn octeontx2-pf: avoid double free of pool->stack on AQ init failure
Jann Horn jannh@google.com af_unix: Fix UAF read of tail->len in unix_stream_data_wait()
Kuniyuki Iwashima kuniyu@google.com af_unix: Cache state->msg in unix_stream_read_generic().
David Howells dhowells@redhat.com rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer
David Howells dhowells@redhat.com rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg
Michael Bommarito michael.bommarito@gmail.com net: hsr: defer node table free until after RCU readers
Justin Iurman justin.iurman@gmail.com ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()
Eric Dumazet edumazet@google.com ipv6/addrconf: annotate data-races around devconf fields (II)
Li Xiasong lixiasong1@huawei.com mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient
Jose Ignacio Tornos Martinez jtornosm@redhat.com ice: fix VF queue configuration with low MTU values
Matthieu Baerts (NGI0) matttbe@kernel.org selftests: mptcp: drop nanoseconds width specifier
Paolo Abeni pabeni@redhat.com mptcp: reset rcv wnd on disconnect
Paolo Abeni pabeni@redhat.com mptcp: cleanup fallback dummy mapping generation
Paolo Abeni pabeni@redhat.com mptcp: use plain bool instead of custom binary enum
Sam Daly sam@samdaly.ie octeontx2-af: CGX: add bounds check to cgx_speed_mbps index
Justin Stitt justinstitt@google.com octeontx2-af: replace deprecated strncpy with strscpy
Lukas Wunner lukas@wunner.de platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery
Michael Bommarito michael.bommarito@gmail.com smb: client: require net admin for CIFS SWN netlink
Ido Schimmel idosch@nvidia.com genetlink: Use internal flags for multicast groups
Guopeng Zhang zhangguopeng@kylinos.cn cgroup/cpuset: Reset DL migration state on can_attach() failure
Asim Viladi Oglu Manizada manizada@pm.me ksmbd: fix OOB write in QUERY_INFO for compound requests
Thomas Zimmermann tzimmermann@suse.de fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros
Corey Minyard corey@minyard.net ipmi:ssif: NULL thread on error
Corey Minyard corey@minyard.net ipmi:ssif: Remove unnecessary indention
Yin Tirui yintirui@huawei.com mm/huge_memory: update file PMD counter before folio_put()
Manivannan Sadhasivam manivannan.sadhasivam@oss.qualcomm.com soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get()
Lorenzo Stoakes ljs@kernel.org mm/hugetlb: avoid false positive lockdep assertion
Johan Hovold johan@kernel.org driver core: reject devices with unregistered buses
Mingyu Wang 25181214217@stu.xidian.edu.cn fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling
Harry Wentland harry.wentland@amd.com drm/amd/display: Use krealloc_array() in dal_vector_reserve()
Harry Wentland harry.wentland@amd.com drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs
Harry Wentland harry.wentland@amd.com drm/amd/display: Clamp VBIOS HDMI retimer register count to array size
Harry Wentland harry.wentland@amd.com drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size
Christian König christian.koenig@amd.com drm/amdgpu: restart the CS if some parts of the VM are still invalidated
Andrew Martin andrew.martin@amd.com drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11
Muhammad Bilal meatuni001@gmail.com drm/amdkfd: fix NULL dereference in get_queue_ids()
Bjorn Andersson bjorn.andersson@oss.qualcomm.com slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock
Bartosz Golaszewski bartosz.golaszewski@oss.qualcomm.com slimbus: qcom-ngd-ctrl: fix OF node refcount
Michael Bommarito michael.bommarito@gmail.com thunderbolt: Limit XDomain response copy to actual frame size
Michael Bommarito michael.bommarito@gmail.com thunderbolt: Validate XDomain request packet size before type cast
Michael Bommarito michael.bommarito@gmail.com thunderbolt: Clamp XDomain response data copy to allocation size
Michael Bommarito michael.bommarito@gmail.com thunderbolt: Bound root directory content to block size
Michael Bommarito michael.bommarito@gmail.com thunderbolt: Reject zero-length property entries in validator
Wyatt Feng bronzed_45_vested@icloud.com sctp: stream: fully roll back denied add-stream state
Zhao Zhang zzhan461@ucr.edu sctp: diag: reject stale associations in dump_one path
Jisheng Zhang jszhang@kernel.org mmc: sdhci: add signal voltage switch in sdhci_resume_host
Lad Prabhakar prabhakar.mahadev-lad.rj@bp.renesas.com mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC
Inochi Amaoto inochiama@gmail.com mmc: litex_mmc: Set mandatory idle clocks before CMD0
Kamal Dasu kamal.dasu@broadcom.com mmc: core: Fix host controller programming for fixed driver type
David Carlier devnexen@gmail.com mm/hugetlb: restore reservation on error in hugetlb folio copy paths
Eduard Zingerman eddyz87@gmail.com selftests/bpf: Update comments find_equal_scalars->sync_linked_regs
Eduard Zingerman eddyz87@gmail.com selftests/bpf: Tests for per-insn sync_linked_regs() precision tracking
Eduard Zingerman eddyz87@gmail.com bpf: Remove mark_precise_scalar_ids()
Eduard Zingerman eddyz87@gmail.com bpf: Track equal scalars history on per-instruction level
Dawei Feng dawei.feng@seu.edu.cn octeontx2-af: fix memory leak in rvu_setup_hw_resources()
Andre Heider a.heider@gmail.com nvmem: layouts: onie-tlv: fix hang on unknown types
Yuqi Xu xuyq21@lenovo.com net: rds: clear i_sends on setup unwind
Bartosz Golaszewski bartosz.golaszewski@oss.qualcomm.com net: mv643xx: fix OF node refcount
ZhaoJinming zhaojinming@uniontech.com net: bonding: fix NULL pointer dereference in bond_do_ioctl()
Nikolay Kuratov kniv@yandex-team.ru net/mlx5: Reorder completion before putting command entry in cmd_work_handler
Mukesh Ojha mukesh.ojha@oss.qualcomm.com misc: fastrpc: Fix NULL pointer dereference in rpmsg callback
Junrui Luo moonafterrain@outlook.com misc: fastrpc: fix DMA address corruption due to find_vma misuse
Zhenghang Xiao kipreyyy@gmail.com misc: fastrpc: fix use-after-free race in fastrpc_map_create
Anandu Krishnan E anandu.e@oss.qualcomm.com misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context
Yilin Zhu zylzyl2333@gmail.com ipc/shm: serialize orphan cleanup with shm_nattch updates
Cryolitia PukNgae cryolitia.pukngae@linux.dev Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard
Zeyu WANG zeyu.thomas.wang@gmail.com Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)
Akhil R akhilrajeev@nvidia.com i2c: tegra: Fix NOIRQ suspend/resume
Guillermo Rodríguez guille.rodriguez@gmail.com i2c: stm32f7: fix timing computation ignoring i2c-analog-filter
Vladimir Zapolskiy vladimir.zapolskiy@linaro.org i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()
Jann Horn jannh@google.com fuse: reject fuse_notify() pagecache ops on directories
Christian Brauner brauner@kernel.org pidfd: refuse access to tasks that have started exiting harder
Hyunwoo Kim imv4bel@gmail.com inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush
Michael Bommarito michael.bommarito@gmail.com IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
Kyle Meyer kyle.meyer@hpe.com bnxt_en: Fix NULL pointer dereference
Chancel Liu chancel.liu@nxp.com ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write
Raf Dickson rafdog35@gmail.com vsock/vmci: fix sk_ack_backlog leak on failed handshake
Yuqi Xu xuyuqiabc@gmail.com wifi: nl80211: reject oversized EMA RNR lists
Tao Cui cuitao@kylinos.cn selftests: mptcp: add test for extra_subflows underflow on userspace PM
Matthieu Baerts (NGI0) matttbe@kernel.org mptcp: sockopt: check timestamping ret value
Paolo Abeni pabeni@redhat.com mptcp: allow subflow rcv wnd to shrink
Paolo Abeni pabeni@redhat.com mptcp: close TOCTOU race while computing rcv_wnd
Paolo Abeni pabeni@redhat.com mptcp: fix retransmission loop when csum is enabled
Karl Mehltretter kmehltretter@gmail.com ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow
Karl Mehltretter kmehltretter@gmail.com ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O
Yuho Choi dbgh9129@gmail.com ARM: socfpga: Fix OF node refcount leak in SMP setup
Sechang Lim rhkrqnwk98@gmail.com udp: clear skb->dev before running a sockmap verdict
Cunlong Li shenxiaogll@gmail.com zram: fix use-after-free in zram_bvec_write_partial()
Michael Bommarito michael.bommarito@gmail.com RDMA/srp: bound SRP_RSP sense copy by the received length
SeongJae Park sj@kernel.org mm/damon/ops-common: call folio_test_lru() after folio_get()
Harry Wentland harry.wentland@amd.com drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info()
Wentao Liang vulab@iscas.ac.cn drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait()
Takashi Iwai tiwai@suse.de ALSA: timer: Fix UAF at snd_timer_user_params()
HyeongJun An sammiee5311@gmail.com USB: serial: kl5kusb105: fix bulk-out buffer overflow
Jack Wu jackbb_wu@compal.com USB: serial: option: add usb-id for Dell Wireless DW5826e-m
Adrian Korwel adriank20047@gmail.com USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()
Adrian Korwel adriank20047@gmail.com USB: serial: io_ti: fix heap overflow in get_manuf_info()
Wyatt Feng bronzed_45_vested@icloud.com xfrm: espintcp: do not reuse an in-progress partial send
Gil Portnoy dddhkts1@gmail.com ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL
Joonas Lahtinen joonas.lahtinen@linux.intel.com drm/i915/gem: Fix phys BO pread/pwrite with offset
Sean Christopherson seanjc@google.com KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying
Inochi Amaoto inochiama@gmail.com mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation
Masami Hiramatsu (Google) mhiramat@kernel.org tracing/probes: Point the error offset correctly for eprobe argument error
Michael Bommarito michael.bommarito@gmail.com Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig
Yuqi Xu xuyq21@lenovo.com Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend
Tristan Madani tristan@talencesecurity.com netfilter: nft_tunnel: fix use-after-free on object destroy
Alexander A. Klimov grandmaster@al2klimov.de drm/vc4: fix krealloc() memory leak
Dmitry Osipenko dmitry.osipenko@collabora.com drm/virtio: Fix driver removal with disabled KMS
Pengyu Luo mitltlatltl@gmail.com clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time
Pablo Neira Ayuso pablo@netfilter.org netfilter: ctnetlink: ensure safe access to master conntrack
Ido Schimmel idosch@nvidia.com ipv6: Fix a potential NPD in cleanup_prefix_route()
Til Kaiser mail@tk154.de net: mvpp2: build skb from XDP-adjusted data on XDP_PASS
Til Kaiser mail@tk154.de net: mvpp2: refill RX buffers before XDP or skb use
Lorenzo Bianconi lorenzo@kernel.org net: mvpp2: Add metadata support for xdp mode
Til Kaiser mail@tk154.de net: mvpp2: limit XDP frame size to the RX buffer
Til Kaiser mail@tk154.de net: mvpp2: sync RX data at the hardware packet offset
Florian Westphal fw@strlen.de netfilter: nft_exthdr: fix register tracking for F_PRESENT flag
Xiang Mei xmei5@asu.edu netfilter: nf_log: validate MAC header was set before dumping it
Kyle Zeng kylebot@openai.com netfilter: x_tables: avoid leaking percpu counter pointers
Weiming Shi bestswngs@gmail.com netfilter: nf_conntrack: destroy stale expectfn expectations on unregister
Breno Leitao leitao@debian.org rds: mark snapshot pages dirty in rds_info_getsockopt()
Eric Dumazet edumazet@google.com ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
Weiming Shi bestswngs@gmail.com net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion
Kyle Zeng kylebot@openai.com net: guard timestamp cmsgs to real error queue skbs
Michael Bommarito michael.bommarito@gmail.com sctp: fix uninit-value in __sctp_rcv_asconf_lookup()
Chih Kai Hsu hsu.chih.kai@realtek.com r8152: handle the return value of usb_reset_device()
Adrian Moreno amorenoz@redhat.com net: openvswitch: fix possible kfree_skb of ERR_PTR
Kyle Zeng kylebot@openai.com ipv6: sit: reload inner IPv6 header after GSO offloads
Dragos Tatulea dtatulea@nvidia.com net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list
Mingyu Wang 25181214217@stu.xidian.edu.cn net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove
Maxime Chevallier maxime.chevallier@bootlin.com net: phy: clean the sfp upstream if phy probing fails
Yao Sang sangyao@kylinos.cn net/mlx4: avoid GCC 10 __bad_copy_from() false positive
Eric Dumazet edumazet@google.com tcp: restrict SO_ATTACH_FILTER to priv users
Richard Fitzgerald rf@opensource.cirrus.com ASoC: wm_adsp: Fix NULL dereference when removing firmware controls
Yun Zhou yun.zhou@windriver.com gpio: mvebu: fix NULL pointer dereference in suspend/resume
Chenguang Zhao zhaochenguang@kylinos.cn netlabel: validate unlabeled address and mask attribute lengths
Sanghyun Park sanghyun.park.cnu@gmail.com xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()
Brian Foster bfoster@redhat.com iomap: don't revert iov_iter on partially completed buffered writes
Mark Rutland mark.rutland@arm.com arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI
Mark Rutland mark.rutland@arm.com arm64: tlb: Allow XZR argument to TLBI ops
Marc Zyngier maz@kernel.org KVM: arm64: Remove VPIPT I-cache handling
Weiming Shi bestswngs@gmail.com tap: free page on error paths in tap_get_user_xdp()
Minh Nguyen minhnguyen.080505@gmail.com net: skbuff: fix missing zerocopy reference in pskb_carve helpers
Gabriele Monaco gmonaco@redhat.com tools/rv: Fix cleanup after failed trace setup
Kuen-Han Tsai khtsai@google.com usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo
Kuen-Han Tsai khtsai@google.com usb: gadget: f_ncm: Fix net_device lifecycle with device_move
Ji'an Zhou eilaimemedsnaimel@gmail.com ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams
Naveen Kumar Chaudhary naveen.osdev@gmail.com time: Fix off-by-one in settimeofday() usec validation
Aleksandr Nogikh nogikh@google.com signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()
Rui Qi qirui.001@bytedance.com ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp
Xin Long lucien.xin@gmail.com sctp: purge outqueue on stale COOKIE-ECHO handling
Yizhou Zhao zhaoyz24@mails.tsinghua.edu.cn net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr
Eric Dumazet edumazet@google.com ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()
Andy Roulin aroulin@nvidia.com vxlan: vnifilter: fix spurious notification on VNI update
Andy Roulin aroulin@nvidia.com vxlan: vnifilter: send notification on VNI add
Nithin Dabilpuram ndabilpuram@marvell.com octeontx2-af: npc: Fix CPT channel mask in npc_install_flow
Lorenzo Bianconi lorenzo@kernel.org net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown
Kurt Kanzenbach kurt@linutronix.de ptp: vclock: Switch from RCU to SRCU
Eric Dumazet edumazet@google.com ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options
Luiz Augusto von Dentz luiz.von.dentz@intel.com Bluetooth: MGMT: Fix backward compatibility with userspace
Bharath Reddy kbreddy.rpbc@gmail.com Bluetooth: fix memory leak in error path of hci_alloc_dev()
Zhang Cen rollkingzzc@gmail.com Bluetooth: bnep: reject short frames before parsing
Dudu Lu phx0fer@gmail.com Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling
SeungJu Cheon suunj1331@gmail.com Bluetooth: RFCOMM: validate skb length in MCC handlers
Zhang Cen rollkingzzc@gmail.com Bluetooth: MGMT: validate advertising TLV before type checks
Zhang Cen rollkingzzc@gmail.com Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()
Tapio Reijonen tapio.reijonen@vaisala.com net: fec: fix pinctrl default state restore order on resume
David Thompson davthompson@nvidia.com net: lan743x: permit VLAN-tagged packets up to configured MTU
Yizhou Zhao zhaoyz24@mails.tsinghua.edu.cn net: garp: fix unsigned integer underflow in garp_pdu_parse_attr
Kuniyuki Iwashima kuniyu@google.com hsr: Remove WARN_ONCE() in hsr_addr_is_self().
Kuniyuki Iwashima kuniyu@google.com net: Annotate sk->sk_write_space() for UDP SOCKMAP.
Oscar Maes oscmaes92@gmail.com pcnet32: stop holding device spin lock during napi_complete_done
Yicong Hui yiconghui@gmail.com drm/imx: Fix three kernel-doc warnings in dcss-scaler.c
Yizhou Zhao zhaoyz24@mails.tsinghua.edu.cn 6lowpan: fix off-by-one in multicast context address compression
Jamal Hadi Salim jhs@mojatatu.com net/sched: act_api: use RCU with deferred freeing for action lifecycle
Guangshuo Li lgs201920130244@gmail.com dm cache policy smq: check allocation under invalidate lock
Yiming Qian yimingqian591@gmail.com netfilter: bridge: make ebt_snat ARP rewrite writable
Jiayuan Chen jiayuan.chen@linux.dev netfilter: nft_ct: bail out on template ct in get eval
Florian Westphal fw@strlen.de netfilter: conntrack_irc: fix possible out-of-bounds read
Fernando Fernandez Mancera fmancera@suse.de netfilter: synproxy: add mutex to guard hook reference counting
Julian Anastasov ja@ssi.bg ipvs: clear the svc scheduler ptr early on edit
Fernando Fernandez Mancera fmancera@suse.de netfilter: xt_NFQUEUE: prefer raw_smp_processor_id
Gil Portnoy dddhkts1@gmail.com ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers
Amirreza Zarrabi amirreza.zarrabi@oss.qualcomm.com tee: optee: prevent use-after-free when the client exits before the supplicant
Nicolò Coccia n.coccia96@gmail.com net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS
Ido Schimmel idosch@nvidia.com ipv6: mcast: Fix use-after-free when processing MLD queries
Mingyu Wang 25181214217@stu.xidian.edu.cn i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl
Nathan Chancellor nathan@kernel.org Disable -Wattribute-alias for clang-23 and newer
Guenter Roeck linux@roeck-us.net hwmon: (pmbus/core) Protect regulator operations with mutex
Zhu Yanjun yanjun.zhu@linux.dev RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug
Pauli Virtanen pav@iki.fi Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync
Johan Hovold johan@kernel.org USB: serial: mct_u232: fix memory corruption with small endpoint
Kuniyuki Iwashima kuniyu@google.com bpf: Free reuseport cBPF prog after RCU grace period.
Michal Pecio michal.pecio@gmail.com usb: core: Fix SuperSpeed root hub wMaxPacketSize
Nathan Chancellor nathan@kernel.org HID: core: Fix size_t specifier in hid_report_raw_event()
Benjamin Tissoires bentiss@kernel.org HID: pass the buffer size to hid_report_raw_event
Vicki Pfau vi@endrift.com HID: core: Add printk_ratelimited variants to hid_warn() etc
Maciej W. Rozycki macro@orcam.me.uk serial: zs: Convert to use a platform device
Maciej W. Rozycki macro@orcam.me.uk serial: dz: Convert to use a platform device
Maciej W. Rozycki macro@orcam.me.uk serial: dz: Fix bootconsole handover lockup
Wei-Cheng Chen weichengc@nvidia.com xhci: tegra: Fix ghost USB device on dual-role port unplug
Johan Hovold johan@kernel.org USB: serial: digi_acceleport: fix memory corruption with small endpoints
Mickaël Salaün mic@digikod.net landlock: Fix handling of disconnected directories
Aleksandr Nogikh nogikh@google.com x86/kexec: Disable KCOV instrumentation after load_segments()
Doruk Tan Ozturk doruk@0sec.ai Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync
Johan Hovold johan@kernel.org USB: serial: cypress_m8: fix memory corruption with small endpoint
Maciej W. Rozycki macro@orcam.me.uk serial: zs: Switch to using channel reset
Maciej W. Rozycki macro@orcam.me.uk serial: zs: Fix bootconsole handover lockup
Maciej W. Rozycki macro@orcam.me.uk serial: dz: Fix bootconsole message clobbering at chip reset
David Francis David.Francis@amd.com drm/amdkfd: Check for pdd drm file first in CRIU restore path
Eric Huang jinhuieric.huang@amd.com drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger
Eric Huang jinhuieric.huang@amd.com drm/amdkfd: fix NULL pointer bug in svm_range_set_attr
Shitalkumar Gandhi shital.gandhi45@gmail.com serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma
Maciej W. Rozycki macro@orcam.me.uk serial: zs: Fix swapped RI/DSR modem line transition counting
Hongling Zeng zenghongling@kylinos.cn serial: sh-sci: fix memory region release in error path
Prasanna S prasanna.s@oss.qualcomm.com serial: qcom-geni: fix UART_RX_PAR_EN bit position
Myeonghun Pak mhun512@gmail.com serial: altera_jtaguart: handle uart_add_one_port() failures
Timur Kristóf timur.kristof@gmail.com drm/amd/pm/si: Disregard vblank time when no displays are connected
Janusz Krzysztofik janusz.krzysztofik@linux.intel.com drm/i915: Fix potential UAF in TTM object purge
Berkant Koc me@berkoc.com drm/hyperv: validate VMBus packet size in receive callback
Berkant Koc me@berkoc.com drm/hyperv: validate resolution_count and fix WIN8 fallback
Alexandru Hossu hossu.alexandru@gmail.com scsi: target: iscsi: Validate CHAP_R length before base64 decode
Michael Bommarito michael.bommarito@gmail.com scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf
Michael Bommarito michael.bommarito@gmail.com scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32
Michael Bommarito michael.bommarito@gmail.com scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker
Michael Bommarito michael.bommarito@gmail.com thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow
Michael Bommarito michael.bommarito@gmail.com thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()
Michael Bommarito michael.bommarito@gmail.com usb: gadget: f_fs: copy only received bytes on short ep0 read
Seungjin Bae eeodqql09@gmail.com usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports
Jeremy Erazo mendozayt13@gmail.com usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling
Guangshuo Li lgs201920130244@gmail.com usb: gadget: f_hid: fix device reference leak in hidg_alloc()
Guangshuo Li lgs201920130244@gmail.com usb: gadget: net2280: Fix double free in probe error path
Johan Hovold johan@kernel.org USB: serial: mct_u232: fix missing interrupt-in transfer sanity check
Johan Hovold johan@kernel.org USB: serial: mxuport: fix memory corruption with small endpoint
Johan Hovold johan@kernel.org USB: serial: keyspan: fix missing indat transfer sanity check
Zhang Cen rollkingzzc@gmail.com USB: serial: cypress_m8: validate interrupt packet headers
Zhang Cen rollkingzzc@gmail.com USB: serial: belkin_sa: validate interrupt status length
Wanquan Zhong wanquan.zhong@fibocom.com USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL
Jan Volckaert janvolck@gmail.com USB: serial: option: add MeiG SRM813Q
Heitor Alves de Siqueira halves@igalia.com usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize
Heitor Alves de Siqueira halves@igalia.com usb: usbtmc: check URB actual_length for interrupt-IN notifications
Michael Bommarito michael.bommarito@gmail.com usbip: vudc: Fix use after free bug in vudc_remove due to race condition
Sam Burkels sam@1a38.nl usb: storage: Add quirks for PNY Elite Portable SSD
Stephen J. Fuhry fuhrysteve@gmail.com USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers
Michal Pecio michal.pecio@gmail.com usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval
Xu Yang xu.yang_2@nxp.com usb: chipidea: core: convert ci_role_switch to local variable
Zhaoyang Yu 2426767509@qq.com tty: serial: pch_uart: add check for dma_alloc_coherent()
Guangshuo Li lgs201920130244@gmail.com counter: Fix refcount leak in counter_alloc() error path
Ian Abbott abbotti@mev.co.uk comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest()
Ian Abbott abbotti@mev.co.uk comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest()
Nicolás Bazaes contacto@bazaes.cl Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490
Dmitry Torokhov dmitry.torokhov@gmail.com Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem
Ali Ganiyev ali.qaniyev@gmail.com ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops
Dmitriy Zharov contact@zharov.dev Input: xpad - add support for ASUS ROG RAIKIRI II
Qbeliw Tanaka q.tanaka@gmx.com Input: xpad - add "Nova 2 Lite" from GameSir
Jingguo Tan tanjingguo@huawei.com xfrm: esp: restore combined single-frag length gate
Srinivas Kandagatla srinivas.kandagatla@oss.qualcomm.com ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks
Srinivas Kandagatla srinivas.kandagatla@oss.qualcomm.com ASoC: qcom: q6asm-dai: close stream only when running
Hamza Mahfooz hamzamahfooz@linux.microsoft.com netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check
Michael Bommarito michael.bommarito@gmail.com xfrm: ah: use skb_to_full_sk in async output callbacks
Maoyi Xie maoyixie.tju@gmail.com xfrm: route MIGRATE notifications to caller's netns
Ashutosh Desai ashutoshdesai993@gmail.com nfc: hci: fix out-of-bounds read in HCP header parsing
Arnd Bergmann arnd@arndb.de iommu, debugobjects: avoid gcc-16.1 section mismatch warnings
Lee Jones lee@kernel.org HID: wacom: Fix OOB write in wacom_hid_set_device_mode()
Kuniyuki Iwashima kuniyu@google.com ip6: vti: Use ip6_tnl.net in vti6_changelink().
Zhengchuan Liang zcliangcn@gmail.com xfrm: input: hold netns during deferred transport reinjection
Qi Tang tpluszz77@gmail.com ipv6: validate extension header length before copying to cmsg
Maoyi Xie maoyixie.tju@gmail.com ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().
Zhengchuan Liang zcliangcn@gmail.com ipv6: exthdrs: refresh nh after handling HAO option
Srinivas Kandagatla srinivas.kandagatla@oss.qualcomm.com ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params
Justin Iurman justin.iurman@gmail.com ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()
Junrui Luo moonafterrain@outlook.com macsec: fix replay protection at XPN lower-PN wrap
Yuqi Xu xuyq21@lenovo.com bpf: sockmap: fix tail fragment offset in bpf_msg_push_data
Dmitry Torokhov dmitry.torokhov@gmail.com Input: elan_i2c - validate firmware size before use
Dan Carpenter error27@gmail.com usb: dwc2: Fix use after free in debug code
Peter Chen peter.chen@cixtech.com usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles
Yongchao Wu yongchao.wu@autochips.com usb: cdns3: gadget: fix request skipping after clearing halt
Johan Hovold johan@kernel.org USB: serial: omninet: fix memory corruption with small endpoint
Felix Gu ustc.gu@gmail.com iio: buffer: hw-consumer: fix use-after-free in error path
Aldo Conte aldocontelk@gmail.com iio: light: cm3323: fix reg_conf not being initialized correctly
Advait Dhamorikar advaitd@mechasystems.com iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL
Salah Triki salah.triki@gmail.com iio: temperature: tsys01: fix broken PROM checksum validation
Sanjay Chitroda sanjayembeddedse@gmail.com iio: ssp_sensors: cancel delayed work_refresh on remove
David Carlier devnexen@gmail.com iio: gyro: itg3200: fix i2c read into the wrong stack location
Salah Triki salah.triki@gmail.com iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw
Rodrigo Alencar rodrigo.alencar@analog.com iio: dac: ad5686: acquire lock when doing powerdown control
Rodrigo Alencar rodrigo.alencar@analog.com iio: dac: ad5686: fix input raw value check
Salah Triki salah.triki@gmail.com iio: dac: max5821: fix return value check in powerdown sync
Christofer Jonason christofer.jonason@guidelinegeo.com iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux
Jason A. Donenfeld Jason@zx2c4.com wireguard: send: append trailer after expanding head
Sean Christopherson seanjc@google.com KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC
Qiang Ma maqianga@uniontech.com KVM: arm64: PMU: Preserve AArch32 counter low bits
Wentao Guan guanwentao@uniontech.com USB: cdc-acm: Fix bit overlap and move quirk definitions to header
Ben Hutchings benh@debian.org parport: Fix race between port and client registration
Dmitry Torokhov dmitry.torokhov@gmail.com Input: xpad - fix out-of-bounds access for Share button
Muhammad Bilal meatuni001@gmail.com Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock
Muhammad Bilal meatuni001@gmail.com Bluetooth: ISO: fix UAF in iso_recv_frame
Muhammad Bilal meatuni001@gmail.com Bluetooth: HIDP: fix missing length checks in hidp_input_report()
Siwei Zhang oss@fourdim.xyz Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn
Siwei Zhang oss@fourdim.xyz Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()
Stepan Ionichev sozdayvek@gmail.com auxdisplay: line-display: fix OOB read on zero-length message_store()
Linpu Yu linpu5433@gmail.com ipc: limit next_id allocation to the valid ID range
Mikulas Patocka mpatocka@redhat.com hpfs: fix a crash if hpfs_map_dnode_bitmap fails
Shuai Zhang shuai.zhang@oss.qualcomm.com Bluetooth: btusb: Allow firmware re-download when version matches
hlleng a909204013@gmail.com HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse
Thomas Fourier fourier.thomas@gmail.com Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free()
Henri A contact@henrialfonso.com media: rc: igorplugusb: fix control request setup packet
Johan Hovold johan@kernel.org USB: serial: safe_serial: fix memory corruption with small endpoint
Greg Kroah-Hartman gregkh@linuxfoundation.org usb: typec: ucsi: validate connector number in ucsi_connector_change()
Greg Kroah-Hartman gregkh@linuxfoundation.org usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT
Greg Kroah-Hartman gregkh@linuxfoundation.org usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer()
Greg Kroah-Hartman gregkh@linuxfoundation.org usb: typec: altmodes/displayport: validate count before reading Status Update VDO
Greg Kroah-Hartman gregkh@linuxfoundation.org usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO
Greg Kroah-Hartman gregkh@linuxfoundation.org usb: typec: ucsi: ccg: reject firmware images without a ':' record header
Greg Kroah-Hartman gregkh@linuxfoundation.org iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer
Prathamesh Shete pshete@nvidia.com soc/tegra: pmc: Fix unsafe generic_handle_irq() call
Abdurrahman Hussain abdurrahman@nexthop.ai hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock
Abdurrahman Hussain abdurrahman@nexthop.ai hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock
Harshit Mogalapalli harshit.m.mogalapalli@oracle.com x86/kexec: add a sanity check on previous kernel's ima kexec buffer
Harshit Mogalapalli harshit.m.mogalapalli@oracle.com of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range()
Harshit Mogalapalli harshit.m.mogalapalli@oracle.com ima: verify the previous kernel's IMA buffer lies in addressable RAM
Horatiu Vultur horatiu.vultur@microchip.com phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X
Will Deacon will@kernel.org arm64: io: Extract user memory type in ioremap_prot()
Will Deacon will@kernel.org arm64: io: Rename ioremap_prot() to __ioremap_prot()
Jouni Högander jouni.hogander@intel.com drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used
Suraj Kandpal suraj.kandpal@intel.com drm/dp: Add eDP 1.5 bit definition
Jouni Högander jouni.hogander@intel.com drm/i915/psr: Read Intel DPCD workaround register
Jouni Högander jouni.hogander@intel.com drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register
Jakub Kicinski kuba@kernel.org inet: frags: flush pending skbs in fqdir_pre_exit()
Jakub Kicinski kuba@kernel.org inet: frags: add inet_frag_queue_flush()
Thomas Zimmermann tzimmermann@suse.de drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup
Thomas Zimmermann tzimmermann@suse.de drm/fbdev-helper: Set and clear VGA switcheroo client from fb_info
Oliver Neukum oneukum@suse.com media: rc: ttusbir: fix inverted error logic
Sean Young sean@mess.org media: rc: fix race between unregister and urb/irq callbacks
Mikhail Gavrilov mikhail.v.gavrilov@gmail.com mm/page_alloc: clear page->private in free_pages_prepare()
Sven Eckelmann sven@narfation.org batman-adv: bla: avoid double decrement of bla.num_requests
Sven Eckelmann sven@narfation.org batman-adv: tt: avoid empty VLAN responses
Sven Eckelmann sven@narfation.org batman-adv: tt: fix TOCTOU race for reported vlans
Sven Eckelmann sven@narfation.org batman-adv: tp_meter: directly shut down timer on cleanup
Zhengchuan Liang zcliangcn@gmail.com net: af_key: zero aligned sockaddr tail in PF_KEY exports
Sven Eckelmann sven@narfation.org batman-adv: tp_meter: avoid role confusion in tp_list
Sven Eckelmann sven@narfation.org batman-adv: iv: recover OGM scheduling after forward packet error
Sven Eckelmann sven@narfation.org batman-adv: tvlv: reject oversized TVLV packets
Sven Eckelmann sven@narfation.org batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface
Sven Eckelmann sven@narfation.org batman-adv: tt: reject oversized local TVLV buffers
Sven Eckelmann sven@narfation.org batman-adv: tvlv: abort OGM send on tvlv append failure
Sven Eckelmann sven@narfation.org batman-adv: v: stop OGMv2 on disabled interface
Yeoreum Yun yeoreum.yun@arm.com perf: Fix dangling cgroup pointer in cpuctx
Pavel Begunkov asml.silence@gmail.com net: skbuff: fix pskb_carve leaking zcopy pages
Jiayuan Chen jiayuan.chen@linux.dev ipv6: fix possible infinite loop in fib6_select_path()
Jiayuan Chen jiayuan.chen@linux.dev ipv6: fix possible infinite loop in rt6_fill_node()
Zhenghang Xiao kipreyyy@gmail.com sctp: fix race between sctp_wait_for_connect and peeloff
Dipayaan Roy dipayanroy@linux.microsoft.com net: mana: Add NULL guards in teardown path to prevent panic on attach failure
Marco Scardovi scardracs@disroot.org gpio: rockchip: convert bank->clk to devm_clk_get_enabled()
Luiz Augusto von Dentz luiz.von.dentz@intel.com Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
Zhenghang Xiao kipreyyy@gmail.com Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success
Jamal Hadi Salim jhs@mojatatu.com net/sched: Revert "net/sched: Restrict conditions for adding duplicating netems to qdisc tree"
Rahul Chandelkar rc@rexion.ai ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
Jakub Kicinski kuba@kernel.org ethtool: eeprom: add more safeties to EEPROM Netlink fallback
Jakub Kicinski kuba@kernel.org ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback
Oliver Hartkopp socketcan@hartkopp.net bonding: refuse to enslave CAN devices
Zhao Dongdong zhaodongdong@kylinos.cn Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()
Cássio Gabriel cassiogabrielcontato@gmail.com ASoC: codecs: simple-mux: Fix enum control bounds check
Sean Shen grayhat@foxmail.com ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE
Eric Dumazet edumazet@google.com tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()
Eric Dumazet edumazet@google.com vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()
Eric Dumazet edumazet@google.com tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()
Alexander Stein alexander.stein@ew.tq-group.com gpio: mxc: fix irq_high handling
Luka Gejak luka.gejak@linux.dev net: hsr: fix potential OOB access in supervision frame handling
Cássio Gabriel cassiogabrielcontato@gmail.com ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors
Eric Dumazet edumazet@google.com ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()
David Jeffery djeffery@redhat.com scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues
Breno Leitao leitao@debian.org net/iucv: fix locking in .getsockopt
Alexandra Winter wintera@linux.ibm.com net/smc: Do not re-initialize smc hashtables
Ilya Maximets i.maximets@ovn.org net: netlink: don't set nsid on local notifications
Ilya Maximets i.maximets@ovn.org net: netlink: fix sending unassigned nsid after assigned one
Ziyu Zhang ziyuzhang201@gmail.com vsock: keep poll shutdown state consistent
Weiming Shi bestswngs@gmail.com tun: free page on build_skb failure in tun_xdp_one()
Weiming Shi bestswngs@gmail.com tun: free page on short-frame rejection in tun_xdp_one()
Fernando Fernandez Mancera fmancera@suse.de netfilter: nf_tables: fix dst corruption in same register operation
Jeremy Sowden jeremy@azazel.net netfilter: bitwise: add support for doing AND, OR and XOR directly
Jeremy Sowden jeremy@azazel.net netfilter: bitwise: rename some boolean operation functions
Florian Westphal fw@strlen.de netfilter: ebtables: fix OOB read in compat_mtw_from_user
Florian Westphal fw@strlen.de netfilter: xt_cpu: prefer raw_smp_processor_id
Chris Mason clm@meta.com netfilter: synproxy: refresh tcphdr after skb_ensure_writable
Carl Lee carl.lee@amd.com nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems
David Ahern dahern@nvidia.com xfrm: Check for underflow in xfrm_state_mtu
Lee Jones lee@kernel.org nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()
Lee Jones lee@kernel.org nfc: llcp: Fix use-after-free in llcp_sock_release()
Kevin Hao haokexin@gmail.com net: cpsw_new: Fix potential unregister of netdev that has not been registered yet
Mingzhe Zou mingzhe.zou@easystack.cn bcache: fix uninitialized closure object
Carlos Eduardo Gallo Filho gcarlos@disroot.org drm: Remove plane hsub/vsub alignment requirement for core helpers
Victor Nogueria victor@mojatatu.com net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked
Jeremy Kerr jk@codeconstruct.com.au net: mctp: ensure our nlmsg responses are initialised
Davide Caratti dcaratti@redhat.com net/sched: cls_fw: fix NULL dereference of "old" filters before change()
Greg Kroah-Hartman gregkh@linuxfoundation.org Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size
-------------
Diffstat:
Documentation/arch/arm64/silicon-errata.rst | 48 +++ Makefile | 4 +- arch/arm/include/asm/io.h | 15 +- arch/arm/kernel/entry-armv.S | 2 +- arch/arm/mach-socfpga/platsmp.c | 1 + arch/arm64/Kconfig | 50 +++ arch/arm64/include/asm/cputype.h | 6 + arch/arm64/include/asm/io.h | 25 +- arch/arm64/include/asm/kvm_mmu.h | 5 +- arch/arm64/include/asm/tlb.h | 2 +- arch/arm64/include/asm/tlbflush.h | 64 ++-- arch/arm64/kernel/acpi.c | 2 +- arch/arm64/kernel/cpu_errata.c | 34 +- arch/arm64/kernel/sys_compat.c | 2 +- arch/arm64/kvm/hyp/nvhe/mm.c | 2 +- arch/arm64/kvm/hyp/nvhe/pkvm.c | 2 +- arch/arm64/kvm/hyp/nvhe/tlb.c | 69 +--- arch/arm64/kvm/hyp/pgtable.c | 2 +- arch/arm64/kvm/hyp/vhe/tlb.c | 21 +- arch/arm64/kvm/pmu-emul.c | 4 +- arch/arm64/mm/ioremap.c | 8 +- arch/mips/dec/platform.c | 109 +++++- arch/x86/kernel/Makefile | 14 + arch/x86/kernel/cpu/amd.c | 33 +- arch/x86/kernel/setup.c | 6 + arch/x86/kvm/svm/avic.c | 35 +- arch/x86/mm/Makefile | 2 + drivers/auxdisplay/line-display.c | 2 +- drivers/base/bus.c | 11 +- drivers/block/zram/zram_drv.c | 2 +- drivers/bluetooth/btusb.c | 8 +- drivers/bluetooth/hci_qca.c | 38 +-- drivers/char/ipmi/ipmi_msghandler.c | 2 +- drivers/char/ipmi/ipmi_ssif.c | 29 +- drivers/clk/qcom/dispcc-sc8280xp.c | 4 +- drivers/comedi/drivers/comedi_test.c | 5 +- drivers/counter/counter-core.c | 3 +- drivers/gpio/gpio-mvebu.c | 4 +- drivers/gpio/gpio-mxc.c | 2 +- drivers/gpio/gpio-rockchip.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 4 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 10 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 10 +- drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c | 49 ++- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 3 + .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 5 + drivers/gpu/drm/amd/display/dc/basics/vector.c | 4 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 54 ++- .../gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c | 3 +- drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 4 + drivers/gpu/drm/bridge/sil-sii8620.c | 1 + drivers/gpu/drm/drm_fb_helper.c | 12 +- drivers/gpu/drm/hyperv/hyperv_drm_proto.c | 113 ++++++- drivers/gpu/drm/i915/display/intel_display_types.h | 1 + drivers/gpu/drm/i915/display/intel_dpcd.h | 15 + drivers/gpu/drm/i915/display/intel_psr.c | 34 +- drivers/gpu/drm/i915/gem/i915_gem_phys.c | 19 +- drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 28 +- drivers/gpu/drm/imx/dcss/dcss-scaler.c | 3 + drivers/gpu/drm/vc4/vc4_validate_shaders.c | 13 +- drivers/gpu/drm/virtio/virtgpu_drv.c | 5 +- drivers/gpu/drm/virtio/virtgpu_submit.c | 4 +- drivers/hid/bpf/hid_bpf_dispatch.c | 3 +- drivers/hid/hid-core.c | 35 +- drivers/hid/hid-gfrm.c | 4 +- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-logitech-hidpp.c | 2 +- drivers/hid/hid-multitouch.c | 2 +- drivers/hid/hid-picolcd_cir.c | 1 + drivers/hid/hid-primax.c | 2 +- drivers/hid/hid-quirks.c | 1 + drivers/hid/hid-vivaldi-common.c | 2 +- drivers/hid/wacom_sys.c | 19 +- drivers/hid/wacom_wac.h | 1 + drivers/hwmon/pmbus/adm1266.c | 49 ++- drivers/hwmon/pmbus/pmbus_core.c | 117 +++++-- drivers/i2c/busses/i2c-qcom-cci.c | 2 +- drivers/i2c/busses/i2c-stm32f7.c | 6 +- drivers/i2c/busses/i2c-tegra.c | 53 +-- drivers/i2c/i2c-dev.c | 9 +- drivers/iio/adc/npcm_adc.c | 31 +- drivers/iio/adc/viperboard_adc.c | 4 +- drivers/iio/adc/xilinx-xadc-core.c | 11 +- drivers/iio/buffer/industrialio-hw-consumer.c | 4 +- drivers/iio/chemical/scd30_core.c | 65 ++-- drivers/iio/common/ssp_sensors/ssp_dev.c | 1 + drivers/iio/dac/ad5686.c | 16 +- drivers/iio/dac/ad5686.h | 1 + drivers/iio/dac/max5821.c | 9 +- drivers/iio/gyro/adis16260.c | 3 + drivers/iio/gyro/itg3200_buffer.c | 2 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 2 +- drivers/iio/light/cm3323.c | 5 +- drivers/iio/magnetometer/st_magn_core.c | 13 +- drivers/iio/temperature/tsys01.c | 2 +- drivers/infiniband/core/Makefile | 2 +- drivers/infiniband/core/iter.c | 43 +++ drivers/infiniband/core/umem.c | 16 + drivers/infiniband/core/verbs.c | 38 --- drivers/infiniband/hw/bnxt_re/qplib_res.c | 2 +- drivers/infiniband/hw/cxgb4/mem.c | 2 +- drivers/infiniband/hw/efa/efa_verbs.c | 2 +- drivers/infiniband/hw/erdma/erdma_verbs.c | 2 +- drivers/infiniband/hw/hns/hns_roce_alloc.c | 2 +- drivers/infiniband/hw/hns/hns_roce_mr.c | 4 + drivers/infiniband/hw/irdma/main.h | 2 +- drivers/infiniband/hw/irdma/verbs.c | 4 + drivers/infiniband/hw/mana/mana_ib.h | 2 +- drivers/infiniband/hw/mlx4/mr.c | 5 + drivers/infiniband/hw/mlx5/mem.c | 1 + drivers/infiniband/hw/mlx5/mr.c | 4 + drivers/infiniband/hw/mlx5/umr.c | 1 + drivers/infiniband/hw/mthca/mthca_provider.c | 2 +- drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 2 +- drivers/infiniband/hw/qedr/verbs.c | 2 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma.h | 2 +- drivers/infiniband/sw/rxe/rxe_qp.c | 7 +- drivers/infiniband/sw/rxe/rxe_verbs.c | 5 + drivers/infiniband/ulp/isert/ib_isert.c | 6 + drivers/infiniband/ulp/srp/ib_srp.c | 30 +- drivers/input/joystick/xpad.c | 14 +- drivers/input/keyboard/atkbd.c | 15 + drivers/input/misc/ims-pcu.c | 2 +- drivers/input/mouse/elan_i2c_core.c | 5 + drivers/input/mouse/synaptics.c | 1 + drivers/input/touchscreen/atmel_mxt_ts.c | 2 +- drivers/input/touchscreen/usbtouchscreen.c | 5 + drivers/iommu/io-pgtable-arm-v7s.c | 18 +- drivers/md/bcache/super.c | 3 +- drivers/md/dm-cache-policy-smq.c | 12 +- drivers/media/cec/core/cec-core.c | 2 +- drivers/media/common/siano/smsir.c | 1 + drivers/media/i2c/ir-kbd-i2c.c | 2 + drivers/media/pci/bt8xx/bttv-input.c | 3 +- drivers/media/pci/cx23885/cx23885-input.c | 1 + drivers/media/pci/cx88/cx88-input.c | 3 +- drivers/media/pci/dm1105/dm1105.c | 1 + drivers/media/pci/mantis/mantis_input.c | 1 + drivers/media/pci/saa7134/saa7134-input.c | 1 + drivers/media/pci/smipcie/smipcie-ir.c | 1 + drivers/media/pci/ttpci/budget-ci.c | 1 + drivers/media/rc/ati_remote.c | 6 +- drivers/media/rc/ene_ir.c | 2 +- drivers/media/rc/fintek-cir.c | 3 +- drivers/media/rc/igorplugusb.c | 3 +- drivers/media/rc/iguanair.c | 1 + drivers/media/rc/img-ir/img-ir-hw.c | 3 +- drivers/media/rc/img-ir/img-ir-raw.c | 3 +- drivers/media/rc/imon.c | 3 +- drivers/media/rc/ir-hix5hd2.c | 2 +- drivers/media/rc/ir_toy.c | 1 + drivers/media/rc/ite-cir.c | 2 +- drivers/media/rc/mceusb.c | 1 + drivers/media/rc/rc-ir-raw.c | 5 - drivers/media/rc/rc-loopback.c | 1 + drivers/media/rc/rc-main.c | 6 +- drivers/media/rc/redrat3.c | 4 +- drivers/media/rc/st_rc.c | 2 +- drivers/media/rc/streamzap.c | 7 +- drivers/media/rc/sunxi-cir.c | 1 + drivers/media/rc/ttusbir.c | 4 +- drivers/media/rc/winbond-cir.c | 2 +- drivers/media/rc/xbox_remote.c | 5 +- drivers/media/usb/au0828/au0828-input.c | 1 + drivers/media/usb/dvb-usb-v2/dvb_usb_core.c | 1 + drivers/media/usb/dvb-usb/dvb-usb-remote.c | 6 +- drivers/media/usb/em28xx/em28xx-input.c | 1 + drivers/misc/fastrpc.c | 107 +++--- drivers/mmc/core/mmc.c | 4 +- drivers/mmc/host/litex_mmc.c | 20 +- drivers/mmc/host/renesas_sdhi_internal_dmac.c | 1 + drivers/mmc/host/sdhci.c | 1 + drivers/net/bonding/bond_main.c | 12 +- drivers/net/ethernet/amd/pcnet32.c | 4 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +- drivers/net/ethernet/freescale/fec_main.c | 3 +- drivers/net/ethernet/intel/ice/ice_virtchnl.c | 2 +- drivers/net/ethernet/marvell/mv643xx_eth.c | 2 +- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 75 +++-- drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 13 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 2 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 1 + .../net/ethernet/marvell/octeontx2/af/rvu_npc.c | 32 +- .../net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c | 2 +- .../ethernet/marvell/octeontx2/nic/otx2_common.c | 2 + drivers/net/ethernet/mediatek/mtk_eth_soc.c | 2 +- drivers/net/ethernet/mellanox/mlx4/cq.c | 9 +- drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 6 +- drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 13 +- drivers/net/ethernet/mellanox/mlx5/core/vport.c | 72 +++- drivers/net/ethernet/microchip/lan743x_main.c | 32 ++ drivers/net/ethernet/microchip/lan743x_main.h | 1 + drivers/net/ethernet/microsoft/mana/mana_en.c | 72 ++-- drivers/net/ethernet/ti/cpsw_new.c | 4 +- drivers/net/hyperv/netvsc.c | 19 +- drivers/net/macsec.c | 3 +- drivers/net/phy/mscc/mscc.h | 8 +- drivers/net/phy/mscc/mscc_main.c | 23 +- drivers/net/phy/phy_device.c | 6 + drivers/net/tap.c | 2 + drivers/net/tun.c | 5 +- drivers/net/usb/r8152.c | 7 +- drivers/net/vxlan/vxlan_core.c | 4 +- drivers/net/vxlan/vxlan_vnifilter.c | 5 +- drivers/net/wireguard/send.c | 20 +- drivers/nfc/nxp-nci/i2c.c | 21 +- drivers/nvmem/layouts/onie-tlv.c | 3 +- drivers/of/kexec.c | 15 +- drivers/parport/share.c | 11 +- drivers/platform/x86/intel/vsec.c | 34 +- drivers/ptp/ptp_vclock.c | 14 +- drivers/scsi/fcoe/fcoe_ctlr.c | 2 +- drivers/scsi/scsi_lib.c | 27 +- drivers/scsi/scsi_transport_fc.c | 77 +++-- drivers/slimbus/qcom-ngd-ctrl.c | 5 +- drivers/soc/qcom/ice.c | 36 +- drivers/soc/tegra/pmc.c | 104 ++++-- drivers/staging/greybus/hid.c | 2 +- drivers/staging/media/av7110/av7110_ir.c | 1 + drivers/target/iscsi/iscsi_target.c | 6 +- drivers/target/iscsi/iscsi_target_auth.c | 19 +- drivers/target/iscsi/iscsi_target_nego.c | 7 +- drivers/target/iscsi/iscsi_target_parameters.c | 62 +++- drivers/target/iscsi/iscsi_target_parameters.h | 2 +- drivers/tee/optee/supp.c | 107 ++++-- drivers/thunderbolt/property.c | 38 ++- drivers/thunderbolt/xdomain.c | 14 +- drivers/tty/serdev/core.c | 23 +- drivers/tty/serial/altera_jtaguart.c | 7 +- drivers/tty/serial/dz.c | 171 +++++----- drivers/tty/serial/fsl_lpuart.c | 15 +- drivers/tty/serial/pch_uart.c | 19 +- drivers/tty/serial/qcom_geni_serial.c | 17 +- drivers/tty/serial/samsung_tty.c | 129 ++++--- drivers/tty/serial/sh-sci.c | 2 +- drivers/tty/serial/zs.c | 218 +++++------- drivers/tty/serial/zs.h | 1 - drivers/usb/cdns3/cdns3-gadget.c | 12 +- drivers/usb/cdns3/cdns3-plat.c | 11 +- drivers/usb/chipidea/core.c | 16 +- drivers/usb/class/cdc-acm.c | 2 - drivers/usb/class/cdc-acm.h | 2 + drivers/usb/class/usbtmc.c | 14 + drivers/usb/core/config.c | 9 +- drivers/usb/core/hcd.c | 4 +- drivers/usb/core/quirks.c | 4 + drivers/usb/dwc2/hcd.c | 4 +- drivers/usb/dwc3/dwc3-xilinx.c | 26 +- drivers/usb/gadget/composite.c | 5 +- drivers/usb/gadget/function/f_fs.c | 2 +- drivers/usb/gadget/function/f_hid.c | 3 +- drivers/usb/gadget/function/f_ncm.c | 33 +- drivers/usb/gadget/function/f_uvc.c | 26 +- drivers/usb/gadget/function/u_ether.c | 28 +- drivers/usb/gadget/function/u_ether.h | 26 ++ drivers/usb/gadget/function/u_ncm.h | 2 +- drivers/usb/gadget/udc/dummy_hcd.c | 4 + drivers/usb/gadget/udc/net2280.c | 4 +- drivers/usb/host/xhci-tegra.c | 77 +++-- drivers/usb/musb/omap2430.c | 3 +- drivers/usb/serial/belkin_sa.c | 3 + drivers/usb/serial/cypress_m8.c | 20 +- drivers/usb/serial/digi_acceleport.c | 23 +- drivers/usb/serial/io_ti.c | 11 + drivers/usb/serial/keyspan.c | 4 + drivers/usb/serial/kl5kusb105.c | 4 +- drivers/usb/serial/mct_u232.c | 26 +- drivers/usb/serial/mxuport.c | 8 + drivers/usb/serial/omninet.c | 9 +- drivers/usb/serial/option.c | 12 +- drivers/usb/serial/safe_serial.c | 11 + drivers/usb/storage/unusual_uas.h | 7 + drivers/usb/typec/altmodes/displayport.c | 2 + drivers/usb/typec/tcpm/tcpci_maxim_core.c | 9 + drivers/usb/typec/tcpm/wcove.c | 13 +- drivers/usb/typec/ucsi/displayport.c | 4 + drivers/usb/typec/ucsi/ucsi.c | 24 +- drivers/usb/typec/ucsi/ucsi_ccg.c | 5 + drivers/usb/usbip/vudc_dev.c | 1 + drivers/usb/usbip/vudc_transfer.c | 3 +- drivers/video/fbdev/Kconfig | 1 + drivers/video/fbdev/core/fbcon.c | 9 + drivers/video/fbdev/vt8500lcdfb.c | 4 +- fs/fcntl.c | 8 +- fs/fuse/dev.c | 9 +- fs/hpfs/alloc.c | 2 +- fs/iomap/buffered-io.c | 4 - fs/smb/client/netlink.c | 6 +- fs/smb/server/oplock.c | 15 +- fs/smb/server/smb2pdu.c | 143 ++++++-- fs/smb/server/smbacl.c | 51 ++- fs/smb/server/smbacl.h | 2 + include/drm/display/drm_dp.h | 1 + include/drm/drm_fourcc.h | 5 +- include/linux/bpf_verifier.h | 4 + include/linux/compat.h | 4 + include/linux/compiler-clang.h | 6 + include/linux/compiler_attributes.h | 11 + include/linux/compiler_types.h | 4 + include/linux/hid.h | 15 +- include/linux/hid_bpf.h | 4 +- include/linux/hugetlb.h | 16 +- include/linux/ima.h | 1 + include/linux/mlx5/vport.h | 4 +- include/linux/mm.h | 8 - include/linux/parport.h | 1 + include/linux/serdev.h | 1 + include/linux/syscalls.h | 4 + include/media/rc-core.h | 2 - include/net/act_api.h | 1 + include/net/bluetooth/l2cap.h | 1 + include/net/genetlink.h | 9 +- include/net/inet_frag.h | 18 +- include/net/ip_vs.h | 3 +- include/net/ipv6_frag.h | 9 +- include/net/netfilter/nf_conntrack_core.h | 5 + include/net/netfilter/nf_conntrack_helper.h | 1 + include/net/netfilter/nf_tables.h | 7 + include/net/sock.h | 1 + include/net/xfrm.h | 3 +- include/rdma/ib_umem.h | 44 +-- include/rdma/ib_verbs.h | 48 --- include/rdma/iter.h | 88 +++++ include/uapi/linux/netfilter/nf_tables.h | 18 +- ipc/shm.c | 10 +- ipc/util.c | 2 +- kernel/bpf/verifier.c | 369 +++++++++++++-------- kernel/cgroup/cpuset.c | 8 +- kernel/events/core.c | 16 +- kernel/pid.c | 8 +- kernel/signal.c | 1 + kernel/time/time.c | 2 +- kernel/trace/trace_probe.c | 2 - lib/debugobjects.c | 2 +- mm/damon/ops-common.c | 4 +- mm/damon/sysfs-schemes.c | 8 +- mm/gup.c | 2 +- mm/huge_memory.c | 2 + mm/hugetlb.c | 118 ++++--- mm/memfd.c | 12 +- mm/memory-failure.c | 94 +++--- mm/memory.c | 2 +- mm/memory_hotplug.c | 2 +- mm/mempolicy.c | 2 +- mm/migrate.c | 18 +- mm/page_alloc.c | 1 + net/6lowpan/iphc.c | 4 +- net/802/garp.c | 2 +- net/802/mrp.c | 9 + net/batman-adv/bat_iv_ogm.c | 82 ++++- net/batman-adv/bat_v_ogm.c | 59 ++-- net/batman-adv/bridge_loop_avoidance.c | 57 +++- net/batman-adv/soft-interface.c | 1 + net/batman-adv/tp_meter.c | 67 ++-- net/batman-adv/translation-table.c | 43 ++- net/batman-adv/tvlv.c | 28 +- net/batman-adv/tvlv.h | 2 +- net/batman-adv/types.h | 42 ++- net/bluetooth/6lowpan.c | 2 + net/bluetooth/bnep/core.c | 50 ++- net/bluetooth/hci_conn.c | 8 +- net/bluetooth/hci_sync.c | 9 +- net/bluetooth/hci_sysfs.c | 6 +- net/bluetooth/hidp/core.c | 23 +- net/bluetooth/iso.c | 12 +- net/bluetooth/l2cap_core.c | 87 ++++- net/bluetooth/l2cap_sock.c | 16 +- net/bluetooth/mgmt.c | 17 +- net/bluetooth/rfcomm/core.c | 69 ++-- net/bluetooth/rfcomm/sock.c | 26 +- net/bridge/netfilter/ebt_snat.c | 3 + net/bridge/netfilter/ebtables.c | 30 ++ net/core/drop_monitor.c | 2 +- net/core/filter.c | 17 +- net/core/skbuff.c | 20 +- net/core/sock.c | 13 +- net/ethtool/eeprom.c | 10 +- net/hsr/hsr_forward.c | 4 +- net/hsr/hsr_framereg.c | 10 +- net/ieee802154/6lowpan/tx.c | 5 + net/ipv4/ah4.c | 2 +- net/ipv4/esp4.c | 4 +- net/ipv4/inet_fragment.c | 54 ++- net/ipv4/ip_fragment.c | 21 +- net/ipv4/ip_options.c | 4 + net/ipv4/ip_tunnel_core.c | 22 +- net/ipv4/netfilter/arp_tables.c | 15 +- net/ipv4/netfilter/ip_tables.c | 15 +- net/ipv4/netfilter/nf_nat_h323.c | 2 + net/ipv4/netfilter/nft_fib_ipv4.c | 2 +- net/ipv4/sysctl_net_ipv4.c | 2 +- net/ipv4/udp.c | 8 + net/ipv6/addrconf.c | 53 +-- net/ipv6/ah6.c | 2 +- net/ipv6/datagram.c | 54 ++- net/ipv6/esp6.c | 4 +- net/ipv6/exthdrs.c | 35 +- net/ipv6/ioam6.c | 8 +- net/ipv6/ip6_input.c | 2 +- net/ipv6/ip6_vti.c | 25 +- net/ipv6/mcast.c | 22 +- net/ipv6/ndisc.c | 18 +- net/ipv6/netfilter/ip6_tables.c | 15 +- net/ipv6/netfilter/nft_fib_ipv6.c | 2 +- net/ipv6/route.c | 5 + net/ipv6/seg6_hmac.c | 8 +- net/ipv6/sit.c | 1 + net/iucv/af_iucv.c | 20 +- net/key/af_key.c | 58 ++-- net/mctp/device.c | 1 + net/mctp/neigh.c | 1 + net/mctp/route.c | 1 + net/mptcp/options.c | 73 ++-- net/mptcp/pm.c | 49 ++- net/mptcp/pm_netlink.c | 18 +- net/mptcp/protocol.c | 102 ++++-- net/mptcp/protocol.h | 17 +- net/mptcp/sockopt.c | 8 +- net/mptcp/subflow.c | 20 +- net/netfilter/ipvs/ip_vs_ctl.c | 13 +- net/netfilter/ipvs/ip_vs_proto_sctp.c | 18 +- net/netfilter/ipvs/ip_vs_proto_tcp.c | 21 +- net/netfilter/ipvs/ip_vs_proto_udp.c | 20 +- net/netfilter/ipvs/ip_vs_sched.c | 14 +- net/netfilter/nf_conntrack_ecache.c | 2 + net/netfilter/nf_conntrack_expect.c | 10 +- net/netfilter/nf_conntrack_helper.c | 19 ++ net/netfilter/nf_conntrack_irc.c | 4 +- net/netfilter/nf_conntrack_netlink.c | 28 +- net/netfilter/nf_conntrack_proto_tcp.c | 3 +- net/netfilter/nf_log_syslog.c | 4 +- net/netfilter/nf_nat_core.c | 2 + net/netfilter/nf_nat_sip.c | 1 + net/netfilter/nf_synproxy_core.c | 26 +- net/netfilter/nft_bitwise.c | 184 ++++++++-- net/netfilter/nft_byteorder.c | 13 +- net/netfilter/nft_ct.c | 8 +- net/netfilter/nft_ct_fast.c | 2 +- net/netfilter/nft_exthdr.c | 3 + net/netfilter/nft_fib.c | 6 + net/netfilter/nft_tunnel.c | 2 +- net/netfilter/xt_NFQUEUE.c | 2 +- net/netfilter/xt_cpu.c | 2 +- net/netlabel/netlabel_unlabeled.c | 30 +- net/netlink/af_netlink.c | 11 +- net/netlink/genetlink.c | 4 +- net/nfc/hci/core.c | 10 + net/nfc/llcp_core.c | 11 + net/nfc/llcp_sock.c | 2 + net/nfc/nci/hci.c | 10 + net/openvswitch/datapath.c | 1 + net/psample/psample.c | 2 +- net/qrtr/af_qrtr.c | 4 +- net/rds/ib_cm.c | 1 + net/rds/ib_send.c | 2 + net/rds/info.c | 2 +- net/rxrpc/ar-internal.h | 12 +- net/rxrpc/call_event.c | 27 +- net/rxrpc/call_object.c | 2 + net/rxrpc/conn_event.c | 30 +- net/rxrpc/insecure.c | 8 +- net/rxrpc/recvmsg.c | 68 +++- net/rxrpc/rxkad.c | 115 +++---- net/sched/act_api.c | 7 +- net/sched/cls_fw.c | 6 +- net/sched/sch_netem.c | 40 --- net/sched/sch_sfb.c | 2 +- net/sctp/diag.c | 17 +- net/sctp/input.c | 8 + net/sctp/sm_statefuns.c | 6 +- net/sctp/socket.c | 2 + net/sctp/stream.c | 6 +- net/smc/af_smc.c | 21 +- net/socket.c | 11 +- net/unix/af_unix.c | 38 +-- net/vmw_vsock/af_vsock.c | 49 ++- net/vmw_vsock/hyperv_transport.c | 9 +- net/vmw_vsock/virtio_transport_common.c | 14 +- net/vmw_vsock/vmci_transport.c | 12 +- net/wireless/nl80211.c | 3 + net/xfrm/espintcp.c | 4 + net/xfrm/xfrm_input.c | 16 +- net/xfrm/xfrm_policy.c | 15 +- net/xfrm/xfrm_state.c | 23 +- net/xfrm/xfrm_user.c | 5 +- security/integrity/ima/ima_kexec.c | 35 ++ security/landlock/errata/abi-1.h | 16 + security/landlock/fs.c | 40 ++- sound/core/pcm_native.c | 7 +- sound/core/timer.c | 1 + .../motu/motu-register-dsp-message-parser.c | 14 +- sound/pci/hda/patch_hdmi.c | 1 + sound/soc/codecs/simple-mux.c | 2 +- sound/soc/codecs/wm_adsp.c | 3 + sound/soc/fsl/fsl_sai.c | 2 +- sound/soc/intel/boards/bytcht_es8316.c | 29 +- sound/soc/qcom/qdsp6/q6asm-dai.c | 43 +-- .../selftests/bpf/progs/verifier_scalar_ids.c | 333 ++++++++++++------- .../selftests/bpf/progs/verifier_spill_fill.c | 4 +- .../bpf/progs/verifier_subprog_precision.c | 2 +- tools/testing/selftests/bpf/verifier/precise.c | 2 +- .../test.d/dynevent/eprobes_syntax_errors.tc | 2 +- tools/testing/selftests/mm/hmm-tests.c | 50 +++ tools/testing/selftests/net/mptcp/mptcp_connect.sh | 6 +- tools/testing/selftests/net/mptcp/mptcp_join.sh | 4 + tools/testing/selftests/ptp/testptp.c | 62 +--- tools/verification/rv/src/in_kernel.c | 2 +- virt/kvm/kvm_main.c | 3 +- 508 files changed, 5864 insertions(+), 3002 deletions(-)