# changelog

author: shixuantong <shixuantong1@h-partners.com> - 1.0.3-25
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix residual files exist after the rpms is uninstalled
         merge pyxalarm to sysSentry rpm


author: Funda Wang <fundawang@yeah.net> - 5.3.1-10
changelog:
  - Type:CVE
  - CVE:CVE-2025-2751 CVE-2025-3158 CVE-2025-3196
  - SUG:NA
  - DESC:fix CVE-2025-2751 CVE-2025-3158 CVE-2025-3196


author: mapengyuan <mapengyuan@xfusion.com> - 5.3.1-16
changelog:
  - Type:CVE
  - CVE:CVE-2025-2754 CVE-2025-2756 CVE-2025-5200
  - SUG:NA
  - DESC:fix CVE-2025-2754 CVE-2025-2756 CVE-2025-5200


author: Mingzheng Xing <xingmingzheng@iscas.ac.cn> - 6.6.0-126.0.0.104
changelog:
  - Bugfix: Fix duplicate RISC-V SBI firmware event name
  - Add lrw core JSON file with metric support
  - Add support for Spacemit K3


author: Li Nan <linan122@huawei.com> - 6.6.0-128.0.0.105
changelog:
  - !19097 scsi: mpi3mr: Clear ioctl blocking flag for an unresponsive controller
  - !19095 scsi: mpi3mr: Set MPI request flags appropriately
  - !19092 scsi: mpi3mr: Replace deprecated strncpy() with assignments
  - !19086 scsi: mpi3mr: Fetch correct device dev handle for status reply descriptor
  - !19636  Some bugfixes for interference
  - !19639 ub: ubase: Fix spell error of month
  - ub: ubase: Fix spell error of month
  - !19637 ub: udma: bugfix related to print location.
  - !19637 ub: udma: bugfix related to print location.
  - !19638 ub:ubus: bugfix port reset in cluster mode
  - !19623 iommu/ummu: Fix the issue of uninitialized resources in logic_ummu_viommu
  - ub:ubus: bugfix port reset in cluster mode
  - ub:ubus: add hotplug capability check
  - ub:ubus: bugfix calltrace of killing qemu when rmmod hisi_ubus
  - ub: udma: bugfix related to print location.
  - iommu/ummu: Remove redundant CONFIG_UB_UBRT_PLAT_DEV and code
  - interference: Add version compatibility check between subsystem and cgroup
  - interference: Fix missing interference.stat file in v1 hierarchy
  - interference: Add fallback to sched_clock when TSC is unavailable
  - interference: Add dependency on CONFIG_SCHED_INFO to avoid build error
  - interference: Resolve arm32 build error by restricting IFS to x86/arm64
  - interference: Avoid null pointer dereference in cgroup_ifs_add_files
  - iommu/ummu-core: Duplicate EID are not allowed
  - iommu/ummu: Move tid_type attr to logic ummu
  - iommu/ummu: Fixing the issue of uninitialized resources in logic_ummu_viommu
  - !19634 crypto: hisilicon - some bugfix
  - !19628 ub:ubfi: Fix UBFI memory leak issue
  - !19616 ub: ubase&unic: Fix some bug finding in running the driver
  - !19553 perf arm-spe: Add support for SPE Data Source packet on HiSilicon HIP12
  - crypto: hisilicon - lower priority for hisilicon crypto implementations
  - crypto: hisilicon/zip - remove redundant callback validation and invocation in crypto_wait_req
  - crypto: hisilicon/zip - add algorithm check before soft tfm allocation
  - crypto: hisilicon/zip - fix a callback problem
  - crypto: hisilicon/qm - place the interrupt status interface after the PM usage counter
  - crypto: hisilicon/qm - increment PM usage counter when handling the aeq interrupt
  - crypto: hisilicon/sgl - fix inconsistent map/unmap direction issue
  - crypto: hisilicon/hpre - support curve25519 fallback for hardware queue unavailable
  - crypto: hisilicon - mask all error type when uninit
  - net: unic: Fixed the call trace issue triggered internally by the completion event interrupt
  - !19624  xsched: XCU Partition
  - !19621 ubagg: fix mismatched spin unlock.
  - iommu/ummu: Optimize chip generational compatibility feature
  - iommu/ummu: Fix VM multi-instance problem
  - !19620 iommufd: Prevent ALIGN() overflow
  - ubagg: fix mismatched spin unlock.
  - net: unic: Restore tx and rx stats when setting coalesce parameters
  - ub: ubase: obtain rc_max_cnt from MAMI
  - ub: ubase: fix a issue of udma device's eid deleted when stop rx stream and reset concurrently
  - ub: ubase: add opcode to query ub port_bitmap.
  - net: unic: Restore default queue count per tc when tc number changes.
  - ub: ubase: Fix the issue of mismatch between the ubase aeqe structure and the protocol.
  - ub: ubase: add ip_over_urma API for udma.
  - ub: ubase: optimize print format of fw_ver in debugfs.
  - ub: ubase: Fix the issue of deadlock by quantities of log in the ctrlq crq task.
  - ub: ubase: Remove non-cluster mode code.
  - net: unic: Resolve the bandwidth jitter problem
  - ub:ubfi: Fix UBFI memory leak issue
  - ub:ubus: Matt and MMIO judgments are not performed in cluster
  - ub:ubus: Delete ubc cfg0 config during cluster mode
  - ub:hisi-ubus: Fix ue reg/unreg without lock bug
  - xsched: fix infinite loop caused by invalid CFS group vruntime update
  - xsched: prevent race between enqueue_ctx and xsched_task_free
  - xsched: DEBUG log cleanup
  - xsched: fix divide-by-zero caused by u64 overflow in CFS shares weight calculation
  - xsched: prevent NULL deref by refcounting css and tracking offline state
  - xsched: fix hung_task caused by cgroup_file_show and xcg_mutex deadlock
  - xsched: fix concurrent modification NULL pointer dereference in xcu.sched_class
  - xsched: fix NULL pointer risk on attach entry allocation
  - xsched: refactor CFS per-XCU rq init/deinit paths
  - !19608 ub: ub_fwctl: Modify TP/TA/SCC register query process.
  - !18634 [OLK-6.6]Fix CVE-2025-38706
  - iommufd: Prevent ALIGN() overflow
  - !19400  smb: client: fix mid_q_entry memleak leak with per-mid locking
  - iommu/ummu: NO plbi for grant, config permq need dma_wmb
  - iommu/ummu: Fix compilation option configuration about CONFIG_ACPI
  - iommu/ummu: UMMU doesn't send tect sync after delete eid
  - iommu/ummu: Delete unnecessary commands
  - !19601  net/packet: fix a race in packet_set_ring() and packet_notifier()
  - !19598  ice: Fix a null pointer dereference in ice_copy_and_init_pkg()
  - !19597  ipv6: prevent infinite loop in rt6_nlmsg_size()
  - !19354 [OLK-6.6] Fix CVE-2025-37822
  - !19355 [OLK-6.6] Fix CVE-2025-38361
  - !19563 ub: cdma: fix the timing issue during flow-based deregistration.
  - !19585 crypto: hisilicon/trng - Fix the issue where TRNG cannot be used by multiple threads.
  - !19610 perf: Fix lastup for multi-CPU PG
  - !19609 urma: fixed process exiting uburma driver's private memory UAF
  - !19592  Fix incorrect use of cpuhp_remove_multi_state parameter
  - perf: Fix lastup for multi-CPU PG
  - urma: fixed process exiting uburma driver's private memory UAF
  - !19607 Revert "RDMA/hns: Fix mismatch exception rollback"
  - ub: cdma: modify the compatibility field according to the Linux KABI specification
  - ub: cdma: fix the timing issue during flow-based deregistration.
  - ub: cdma: fix kasan cdma jfae uaf
  - ub: cdma: modify log level about en information
  - ub: ub_fwctl: Modify TP/TA/SCC register query process.
  - Revert "RDMA/hns: Fix mismatch exception rollback"
  - !18664 [OLK-6.6] Fix CVE-2025-22039
  - net/packet: fix a race in packet_set_ring() and packet_notifier()
  - ice: Fix a null pointer dereference in ice_copy_and_init_pkg()
  - ipv6: prevent infinite loop in rt6_nlmsg_size()
  - !19558 obmm: sync obmm default params value to sysfs.
  - !19560 obmm: set MAX Numa Distance to 255
  - !19589 ub:ubus: add active_mutex in ub_entity
  - soc cache: Add compilation config for hisi_soc_l3c
  - soc cache: Don't poll before removing all locks
  - soc cache: Drop redundant vm_pgoff
  - soc cache: fix walk page parameter and drop incorrect check
  - soc cache: Check address while walking pages
  - soc_cache: Fix component removal order to avoid race condition
  - soc cache: cleanup: Remove the redundant check of vm_pgoff
  - soc cache: cleanup: Change type of mnt_type
  - soc cache: cleanup: avoid tag addr from interfering range validation
  - soc cache: cleanup: move judgement of soc cache dev into lock protection
  - soc cache: cleanup: fix memory leakage on error path
  - soc_cache: Fix error code returning from hisi_soc_l3c_do_lock
  - soc_cache: Fix incorrect use of cpuhp_remove_multi_state parameter
  - soc cache: cleanup: replace dynamically allocated param with local variable
  - ub:ubus: add active_mutex in ub_entity
  - !19576  Bugfix for two issues
  - crypto: hisilicon/trng - support tfms sharing the device
  - crypto: hisilicon/trng - use DEFINE_MUTEX() and LIST_HEAD()
  - Revert "crypto: hisilicon/trng - support to obtain random numbers from soft algorithm"
  - Revert "crypto: hisilicon/trng - use DEFINE_MUTEX() for mutex lock"
  - !19557  Fix UAF issue for mfs
  - !19555 ub: bugfix of port, decoder and vfio
  - !19561 obmm: fix granu checking in mmap
  - zcopy: Fix softlockup while attach PUD-SIZE page
  - zcopy: Fix NULL pointer dereference while attach conflict with free
  - ub:unic Adaptation of the port reset interface
  - !19521 uvb: change dir name
  - !19532 net: hns3: add VLAN id validation before using
  - !19271  Squashfs: fix uninit-value in squashfs_get_parent
  - !19269  media: venus: Add a check for packet size after reading from shared memory
  - !19268  eventpoll: Fix semi-unbounded recursion
  - !19267  kernfs: Relax constraint in draining guard
  - !19552  KVM: arm64: Check the untrusted offset in FF-A memory share
  - !19551 add check ack_dono flag for reboot event
  - obmm: sync obmm default params value to module sysfs.
  - obmm: set MAX Numa Distance to 255
  - obmm: fix granu checking in mmap
  - ub:ubus adapt port local ras
  - vfio:ubus vfio-ub support ub entity enable
  - mfs: Fix UAF problem on event object when enable tracepoint
  - ub:ubus: fix bug of msg workqueue null
  - ub:hisi-ubus ub:hisi-ubus: Move the decoder's page table operations to hisi-ubus
  - add check ack_dono flag for reboot event
  - !19517 gmem: fix several issues
  - !19519  arm64/mpam: Reset mbwu_state while creating new monitor group
  - perf arm-spe: Add support for SPE Data Source packet on HiSilicon HIP12
  - perf arm-spe: Backport perf_cpu_map__new_online_cpus()
  - perf arm-spe: Save per CPU information in metadata
  - perf arm-spe: Calculate meta data size
  - perf arm-spe: Define metadata header version 2
  - perf arm-spe: Prepare for adding data source packet implementations for other cores
  - perf arm-spe: Use old behavior when opening old SPE files
  - perf arm-spe: Set sample.addr to target address for instruction sample
  - perf color: Add printf format checking and resolve issues
  - perf arm-spe: Add Cortex CPUs to common data source encoding list
  - perf arm-spe: Add Neoverse-V2 to common data source encoding list
  - perf arm-spe: Remove the unused 'midr' field
  - perf arm-spe: Use metadata to decide the data source feature
  - perf arm-spe: Introduce arm_spe__is_homogeneous()
  - perf arm-spe: Dump metadata with version 2
  - perf arm-spe: Support metadata version 2
  - perf arm-spe: Rename the common data source encoding
  - perf arm-spe: Rename arm_spe__synth_data_source_generic()
  - KVM: arm64: Check the untrusted offset in FF-A memory share
  - !19530  Fix unexpected behavior in resctrl mounting
  - Revert "perf arm-spe: Add support for SPE Data Source packet on HiSilicon HIP12"
  - !19520 ub: udma: bugfix related to init xa flags.
  - !19205 [OLK-6.6] Fix CVE-2025-39732
  - !19156 [OLK-6.6] Fix CVE-2025-39684
  - !19157 [OLK-6.6] Fix CVE-2025-39675
  - net: hns3: add VLAN id validation before using
  - !19526  mm/numa_remote: fix wild-memory-access in numa_remote_hugetlb_nowatermark
  - fs/resctrl: Prevent mounting with unsupported options
  - fs/resctrl: Fix resctrl mount options display in mount list
  - ub: udma: bugfix related to init xa flags.
  - ub: udma: bugfix for rx close.
  - mm/numa_remote: fix wild-memory-access in numa_remote_hugetlb_nowatermark
  - uvb: change dir name
  - !19507  Fix some memory policy bugfix
  - arm64/mpam: Need to reset MPAM component when umounting resctrl
  - arm64/mpam: Remove the redundant prev_val member variable
  - arm64/mpam: Reset mbwu_state while creating new monitor group
  - !19508 ub: ub_fwctl: Modify the problem of incorret data when querying entry
  - !19513  zcopy: fix two issues
  - zcopy: Fix Bad rss-counter state while non-mapping pages attach
  - zcopy: Fix null pointer dereference while attach transhugepage twice to same addr
  - ub: ub_fwctl: Modify the problem of incorret data when querying entry information
  - !19357 ubios_uvb: add msleep in poll thread
  - ubios_uvb: add check for uvb window buffer size
  - !19494  crypto: hisilicon - add reference counting to queues for tfm kernel reuse
  - !19475  task_work: Fix NMI race condition
  - mempolicy: restrict smart grid scheduling to vma_alloc_folio path
  - mempolicy: fix missing mmap_read_unlock() in error path
  - ubios_uvb: add check for cis message and senderid
  - !19486 [OLK-6.6] fix possible crash caused by null pointer when hct get page.
  - crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable
  - crypto: hisilicon/hpre - support the hpre algorithm fallback
  - crypto: hisilicon/zip - support fallback for zip
  - crypto: hisilicon/qm - optimize device selection priority based on queue ref count and NUMA distance
  - crypto: hisilicon/qm - add reference counting to queues for tfm kernel reuse
  - crypto: hisilicon - consolidate qp creation and start in hisi_qm_alloc_qps_node
  - crypto: hisilicon/qm - centralize the sending locks of each module into qm
  - crypto: hisilicon/qm - enhance the configuration of req_type in queue attributes
  - Revert "crypto: hisilicon/hpre - support the hpre algorithm fallback"
  - crypto: hisilicon/hpre: extend tag field to 64 bits for better performance
  - crypto: hisilicon/sec - move backlog management to qp and store sqe in qp for callback
  - crypto: hisilicon/zip - adjust the way to obtain the req in the callback function
  - ubios_uvb: add msleep in poll thread
  - ccp/hct: fix possible crash caused by null pointer when hct get page.
  - task_work: Fix NMI race condition
  - scsi: mpi3mr: Clear ioctl blocking flag for an unresponsive controller
  - scsi: mpi3mr: Set MPI request flags appropriately
  - scsi: mpi3mr: Replace deprecated strncpy() with assignments
  - scsi: mpi3mr: Fetch correct device dev handle for status reply descriptor
  - smb: client: fix mid_q_entry memleak leak with per-mid locking
  - drm/amd/display: Check dce_hwseq before dereferencing it
  - riscv: uprobes: Add missing fence.i after building the XOL buffer
  - Squashfs: fix uninit-value in squashfs_get_parent
  - media: venus: Add a check for packet size after reading from shared memory
  - eventpoll: Fix semi-unbounded recursion
  - kernfs: Relax constraint in draining guard
  - ksmbd: fix overflow in dacloffset bounds check
  - wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask()
  - drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session()
  - comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl()
  - comedi: Fix initialization of data for instructions that write to subdevice
  - gmem: remove reduntant interfaces and use proper mmap flag
  - gmem: gmem_reserve_vma should use vma_flag_clear to remove flag
  - gmem: remove inpropre BUG_ON in do_peer_shared_anonymous_page
  - gmem: hmemcpy should use dma for phy addr
  - ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime()


author: Mingzheng Xing <xingmingzheng@iscas.ac.cn> - 6.6.0-128.0.0.106
changelog:
  - RISC-V kernel upgrade to 6.6.0-128.0.0
  - Update Spacemit K3 DTS
  - Fix LTP test on TH1520
  - Enable CONFIG_ACPI_APEI


author: Li Nan <linan122@huawei.com> - 6.6.0-130.0.0.107
changelog:
  - !19680 LoongArch: Mask all interrupts during kexec/kdump
  - !19682 Loongarch: Enable CONFIG_RANDOMIZE_BASE default
  - !19738  xsched: move xsched types to user-accessible headers
  - !19717 obmm: Race condition fix, mmap rollback fix and export_user flag check.
  - xsched: move xsched types to user-accessible headers
  - obmm: Add FAST flag check for obmm_export_from_user
  - obmm: Rollback mmap_granu when mmap failed
  - !19735 add check ack msg and do sleep
  - add check ack msg and do sleep
  - !18003 [OLK-6.6] PCI: phytium: Add hotplug and hotreset workaround patch for phytium SoCs
  - Loongarch: Enable CONFIG_RANDOMIZE_BASE default
  - LoongArch: Mask all interrupts during kexec/kdump
  - !19714 drm/hisilicon/hibmc: fix PCIe 64-bit bar support
  - obmm: Fix race condition of region release and device release
  - !19688 ub: ubase: CtrlQ retry message uses the same seq
  - !19687 ub: udma: Bugfix related to crq event unregister.
  - !19641 ub:hisi-ubus: fix MUE unreg msg rsp time
  - !19677 ub: libcdma: add eid upi update response
  - drm/hisilicon/hibmc: fix PCIe 64-bit bar support
  - !19709  mm: try skipping pinned page before unmapping in migration
  - mm: try skipping pinned page before unmapping in migration
  - !19657 xsched: simplify logging macros by removing redundant pr_fmt usage
  - !19702  XSched: List Corruption
  - !19617  Handling Kunpeng Chip ARM Spectre-BHB (CVE-2022-23960) Issue
  - xsched/cgroup: move list_del from css_free to css_offline to prevent corruption
  - xsched: protect group member list with xcu_lock to prevent corruption
  - !19696  i40e: remove read access to debugfs files
  - i40e: remove read access to debugfs files
  - ub: udma: Bugfix related to crq event unregister.
  - !19674 obmm: bugfixes of log and race condition
  - !19644 obmm: suppport unaligned PMD mapping
  - ub:ubus: Change create device irq domain debug info
  - !19683  xsched: prevent linked list corruption in RT priority updates
  - ub: ubase: CtrlQ retry message uses the same seq
  - net: unic: Fix the calltrace caused by modifying queue parameters in the MUE scenario
  - xsched: prevent linked list corruption in RT priority updates
  - ub: cdma: add eid upi update response
  - obmm: Remove log pringts of physical address and kernelspace virtual address
  - obmm: Fix race condition between unexport and addr_query_by_pa
  - !19659 ubcore: fix route_list when no full match.
  - !19661 Packet throughput decreases with multiple jetty streams
  - xsched: simplify logging macros by removing redundant pr_fmt usage
  - xsched: Fix compilation by adding xsched_attr to syscalls.h
  - !19562 [OLK-6.6] virtcca: fix incorrect use of the percpu declare
  - ubcore: fix route_list when no full match.
  - obmm: display mmaped region's Pagesize
  - obmm: fix for PMD mapping
  - Packet throughput decreases with multiple jetty streams
  - virtcca: Add missing includes for DECLARE_PER_CPU
  - arm64: Add missing includes for mem_encrypt
  - !19647  fbdev: bitblit: bound-check glyph index in bit_putcs*
  - fbdev: bitblit: bound-check glyph index in bit_putcs*
  - ub:hisi-ubus: fix MUE unreg msg rsp time
  - config: Disable unprivileged BPF syscall by default
  - arm64: Add support for TSV110 Spectre-BHB mitigation
  - PCI: phytium: Add hotplug and hotreset workaround patch for phytium SoCs


author: Li Nan <linan122@huawei.com> - 6.6.0-131.0.0.108
changelog:
  - !19760 ub:ubfi:skipped address of subtable 0 in ubrt
  - !19758 ub: udma: bugfix related to rx close.
  - !19759 ub: ubase: fix ubase activate/deactivate resp timeout
  - ub:ubfi:skipped address of subtable 0 in ubrt
  - ub: ubase: fix ubase activate/deactivate resp timeout
  - ub: udma: bugfix related to rx close.
  - !19752 Repair driver reset work-q uaf
  - !19755 obmm: Register resource for every memdev
  - !19756 ub:ubus delete undefined class code
  - !19754 ub:ubus: Move the decoder's queue operations to hisi-ubus
  - !19757 ub: cdma: add ioctl logs and error codes
  - !19750 ub: udma: Bugfix related to 2M hugepage.
  - !19749 ub: unic & ubase: Fix ethtool configuration error issue and resolve mailbox timeout
  - !19697  iomap: fix dirty range tracking in iomap_folio_mkwrite_iter
  - ub: cdma: add ioctl logs and error codes
  - ub:ubus delete undefined class code
  - obmm: Register resource for every memdev
  - Repair driver reset work-q uaf
  - ub:ubus: fix ub_get_bus_controller getting null
  - ub:ubus: Move the decoder's queue operations to hisi-ubus
  - ub:ubus: hi_msg_sync_wait first pull cq
  - ub: udma: Bugfix related to 2M hugepage.
  - net: unic: Fix ethtool configuration error issue.
  - ub: ubase: Resolve mailbox timeout issue.
  - 删除文件 .本项目已经正式迁移至AtomGit平台/README.md
  - update README.
  - add migrate not
  - iomap: fix dirty range tracking in iomap_folio_mkwrite_iter


author: Li Nan <linan122@huawei.com> - 6.6.0-132.0.0.109
changelog:
  - !19477 iommu: set the default iommu-dma mode as non-strict
  - iommu: set the default iommu-dma mode as non-strict


author: Mingzheng Xing <xingmingzheng@iscas.ac.cn> - 6.6.0-132.0.0.110
changelog:
  - riscv kernel upgrade to 6.6.0-132.0.0
  - Bugfix: iommu/riscv: Fix inconsistencies with the latest spec revision
  - Bugfix: riscv: acpi: avoid errors caused by probing DT devices when ACPI is used
  - Bugfix: Revert "drivers: Add ACPI support for thead-c900-aclint-sswi"


author: Li Nan <linan122@huawei.com> - 6.6.0-134.0.0.112
changelog:
  - !20054 merge topo_kernel_merge_1_1 into OLK-6.6
  - !19916 merge OLK-6.6_new into OLK-6.6
  - !20030 merge topo_kernel_merge into OLK-6.6
  - urma: ubcore support expose/unexpose dev and eid set commands.
  - urma: support uvs query chip_id.
  - urma: add create, delete agg_dev and get name of agg_dev.
  - urma: adapt to new topo info for ubcore/ubagg.
  - !19992 merge patch-1767753584 into OLK-6.6
  - !19763 merge patch-1766378735 into OLK-6.6
  - Revert "NFS: fix up nfs_release_folio() to try to release the page"
  - !19697 merge refs/pull/19697/head into OLK-6.6
  - !19844 merge patch-1766802317 into OLK-6.6
  - !19712 merge refs/pull/19712/head into OLK-6.6
  - !19653 merge refs/pull/19653/head into OLK-6.6
  - !19650 merge refs/pull/19650/head into OLK-6.6
  - !19809 merge patch-1766626818 into OLK-6.6
  - !19839 merge patch-1766740817 into OLK-6.6
  - !19924 merge patch-1767513707 into OLK-6.6
  - !19925 merge patch-1767513733 into OLK-6.6
  - !18476 merge refs/pull/18476/head into OLK-6.6
  - !19871 merge patch-1766998564 into OLK-6.6
  - !19870 merge patch-1766998524 into OLK-6.6
  - !19868 merge patch-1766998223 into OLK-6.6
  - !19831 merge patch-1766714417 into OLK-6.6
  - !19830 merge patch-1766713816 into OLK-6.6
  - !19829 merge patch-1766713004 into OLK-6.6
  - !19828 merge patch-1766712979 into OLK-6.6
  - !19827 merge patch-1766712955 into OLK-6.6
  - !19826 merge patch-1766712919 into OLK-6.6
  - !19711 merge refs/pull/19711/head into OLK-6.6
  - !19810 merge patch-1766626870 into OLK-6.6
  - !19843 merge patch-1766799391 into OLK-6.6
  - !19909 merge patch-1767491328 into OLK-6.6
  - !19799 merge patch-1766495417 into OLK-6.6
  - !19807 merge patch-1766567019 into OLK-6.6
  - !19895 merge patch-1767085921 into OLK-6.6
  - !19926 merge patch-1767515451 into OLK-6.6
  - !19656 merge refs/pull/19656/head into OLK-6.6
  - !19923 merge patch-1767513671 into OLK-6.6
  - !19928 merge patch-1767515719 into OLK-6.6
  - !19859 merge patch-1766977633 into OLK-6.6
  - !19860 merge patch-1766977668 into OLK-6.6
  - !19884 merge patch-1767076134 into OLK-6.6
  - !19913 merge patch-1767493335 into OLK-6.6
  - !19914 merge patch-1767493378 into OLK-6.6
  - !19915 merge patch-1767493397 into OLK-6.6
  - mfs: Avoid UAF on cache object when anon_file is release
  - mfs: avoid deadlock when the cache layer is modified
  - mfs: remove FAROUND event to avoid context switch during map_pages
  - !19612 merge refs/pull/19612/head into OLK-6.6
  - !19733 merge refs/pull/19733/head into OLK-6.6
  - !19729 merge refs/pull/19729/head into OLK-6.6
  - !19720 merge refs/pull/19720/head into OLK-6.6
  - usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer
  - nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot
  - bpf: Free special fields when update [lru_,]percpu_hash maps
  - !19846 merge patch-1766818825 into OLK-6.6
  - !19904 merge patch-1767162173 into OLK-6.6
  - !19845 merge patch-1766818524 into OLK-6.6
  - !19797 merge patch-1766494034 into OLK-6.6
  - !19796 merge patch-1766494001 into OLK-6.6
  - !19800 merge patch-1766541023 into OLK-6.6
  - !19847 merge patch-1766820323 into OLK-6.6
  - !19875 merge patch-1767010708 into OLK-6.6
  - !19761 merge patch-1766371001 into OLK-6.6
  - !19619 merge refs/pull/19619/head into OLK-6.6
  - !19912 merge patch-1767493281 into OLK-6.6
  - net_sched: prio: fix a race in prio_tune()
  - can: j1939: add missing calls in NETDEV_UNREGISTER notification handler
  - can: j1939: implement NETDEV_UNREGISTER notification handler
  - Bluetooth: hci_core: Disable works on hci_unregister_dev
  - iomap: fix dirty range tracking in iomap_folio_mkwrite_iter
  - mm: mem_reliable: prevent excessive direct reclaim loops
  - mm: mem_reliable: use percise count during limit check
  - mm: mem_reliable: fix task reliable counter during fork
  - !19793 merge patch-1766492701 into OLK-6.6
  - !19823 merge tmp into OLK-6.6
  - !19888 merge ubase into OLK-6.6
  - !19898 merge OLK_6.6_velinux_1 into OLK-6.6
  - !19901 merge OLK-6.6 into OLK-6.6
  - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid
  - obmm: Register resource for every memdev
  - !19822 merge master into OLK-6.6
  - !19811 merge OLK-6.6 into OLK-6.6
  - !19818 merge OLK-6.6 into OLK-6.6
  - !19854 merge OLK-6.6 into OLK-6.6
  - !19886 merge OLK-6.6 into OLK-6.6
  - ub: ubase: fix ubase activate/deactivate resp timeout
  - urma inclusion category: bugfix bugzilla: https://gitee.com/openeuler/release-management/issues/ID3WJX
  - bpf: Fix stackmap overflow check in __bpf_get_stackid()
  - bpf: Refactor stack map trace depth calculation into helper function
  - net: unic: Fix ethtool configuration error issue.
  - ub: ubase: Resolve mailbox timeout issue.
  - scsi: qla2xxx: Clear cmds after chip reset
  - ub: udma: bugfix related to rx close.
  - isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe()
  - !19763 ub: udma: bugfix related to spin lock.
  - futex: Don't leak robust_list pointer on exec race
  - Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern()
  - ub: udma: bugfix related to spin lock.
  - Bluetooth: hci_event: validate skb length for unknown CC opcode
  - x86/dumpstack: Prevent KASAN false positive warnings in __show_regs()
  - tracing: Fix memory leaks in create_field_var()
  - ub: udma: Bugfix related to 2M hugepage.
  - ppp: fix race conditions in ppp_fill_forward_path
  - scsi: qla2xxx: Fix improper freeing of purex item
  - coresight: ETR: Fix ETR buffer use-after-free issue
  - arm-spe: Fix typos in the arm_spe_to_htpg()
  - mm/shmem: Fix order passing error in the shmem_alloc_folio()
  - arm64/mpam: Synchronize MPAM Partid to kernel mode
  - !19477 iommu: set the default iommu-dma mode as non-strict
  - ext4: xattr: fix null pointer deref in ext4_raw_inode()
  - jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted
  - fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock
  - ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock()
  - ext4: refresh inline data size before write operations
  - hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat()
  - ub:ubfi:skipped address of subtable 0 in ubrt
  - ub:ubus delete undefined class code
  - !19760 ub:ubfi:skipped address of subtable 0 in ubrt
  - !19758 ub: udma: bugfix related to rx close.
  - !19759 ub: ubase: fix ubase activate/deactivate resp timeout
  - ub:ubfi:skipped address of subtable 0 in ubrt
  - ub: cdma: add ioctl logs and error codes
  - ub: ubase: fix ubase activate/deactivate resp timeout
  - ub:ubus: fix ub_get_bus_controller getting null
  - ub:ubus: Move the decoder's queue operations to hisi-ubus
  - ub:ubus: hi_msg_sync_wait first pull cq
  - ub: udma: bugfix related to rx close.
  - !19752 Repair driver reset work-q uaf
  - perf/x86/intel: Fix KASAN global-out-of-bounds warning
  - mm: migrate: add dma copy offloading for hugetlb
  - !19755 obmm: Register resource for every memdev
  - !19756 ub:ubus delete undefined class code
  - !19754 ub:ubus: Move the decoder's queue operations to hisi-ubus
  - !19757 ub: cdma: add ioctl logs and error codes
  - !19750 ub: udma: Bugfix related to 2M hugepage.
  - !19749 ub: unic & ubase: Fix ethtool configuration error issue and resolve mailbox timeout
  - !19697  iomap: fix dirty range tracking in iomap_folio_mkwrite_iter
  - nvmet-fc: avoid scheduling association deletion twice
  - ub: cdma: add ioctl logs and error codes
  - ub:ubus delete undefined class code
  - obmm: Register resource for every memdev
  - Repair driver reset work-q uaf
  - bpf: Fix invalid prog->stats access when update_effective_progs fails
  - ub:ubus: fix ub_get_bus_controller getting null
  - ub:ubus: Move the decoder's queue operations to hisi-ubus
  - ftrace: Fix softlockup in ftrace_module_enable
  - ub:ubus: hi_msg_sync_wait first pull cq
  - bpf: account for current allocated stack depth in widen_imprecise_scalars()
  - bpf: Add bpf_prog_run_data_pointers()
  - iommu: set the default iommu-dma mode as non-strict
  - ub: udma: Bugfix related to 2M hugepage.
  - net: unic: Fix ethtool configuration error issue.
  - ub: ubase: Resolve mailbox timeout issue.
  - 删除文件 .本项目已经正式迁移至AtomGit平台/README.md
  - update README.
  - timers: Fix NULL function pointer race in timer_shutdown_sync()
  - x86/fpu: Ensure XFD state on signal delivery
  - add migrate not
  - usb: storage: Fix memory leak in USB bulk transport
  - scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show()
  - nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing
  - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()
  - usb: storage: sddr55: Reject out-of-bound new_pba
  - usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget
  - wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode
  - be2net: pass wrb_params in case of OS2BMC
  - driver/coda: Fix possible NULL pointer dereference error.
  - VirtCCA supports Ascend 310P in CoDA scenarios
  - NFSD: Fix crash in nfsd4_read_release()
  - iommu: set the default iommu-dma mode as non-strict
  - configs: Add bus lock detect config in openeuler_config
  - x86/split_lock: Add support for Zhaoxin
  - x86/split_lock: Simplify reenabling
  - x86/split_lock: Fix the delayed detection logic
  - x86/split_lock: Move Split and Bus lock code to a dedicated file


author: Li Nan <linan122@huawei.com> - 6.6.0-135.0.0.113
changelog:
  - !19710 [OLK-6.6] Batch BAR sizing operations
  - !19952  mfs: Add prefetch demo
  - !20138 net:nebula-matrix:add protection of consecutive write regs
  - !20033  ceph: fix crash in process_v2_sparse_read() for encrypted directories
  - !20032  net: atlantic: fix fragment overflow handling in RX path
  - !20031  Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once
  - !20014  xfs: do not propagate ENODATA disk errors into xattr code
  - !20015  Fix CVE-2025-40242
  - !19960  wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb()
  - !20005  cifs: Fix establishing NetBIOS session for SMB2+ connection
  - !20009  ftrace: Fix BPF fexit with livepatch
  - !19983  regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex
  - !19968  EEVDF null pointer
  - !19773  bpf, arm64: Do not audit capability check in do_jit()
  - !19997  mfs: remove FAROUND event for mfsd demo
  - !19942 [virtCCA Live Migration 1]virtcca secure cvm supports live migration
  - !20160 v3  CVE-2025-68304
  - !20141 urma: Fix the bug of exposing devices fails for host network
  - !20148 ubcore: fix route query for container loopback.
  - !20120 urma: fix urma_admin agg del eid failed.
  - !20028 release urma source when the ub device is removed
  - !20017  kernfs: Don't re-lock kernfs_root::kernfs_rwsem in kernfs_fop_readdir().
  - !20115  KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer
  - !20109 uvb: change cis call default poll timeout
  - urma: fix the bug for container.
  - !20154 merge fix_is_err into OLK-6.6
  - Bluetooth: hci_core: lookup hci_conn on RX path on protocol side
  - Bluetooth: ISO: don't leak skb in ISO_CONT RX
  - Bluetooth: ISO: free rx_skb if not consumed
  - Bluetooth: ISO: Use kref to track lifetime of iso_conn
  - Bluetooth: SCO: fix sco_conn refcounting on sco_conn_ready
  - Bluetooth: SCO: remove the redundant sco_conn_put
  - Bluetooth: SCO: Use kref to track lifetime of sco_conn
  - Bluetooth: hci_core: Fix not checking skb length on hci_scodata_packet
  - urma: fix ubcore_cock NULL pointer check.
  - ubcore: fix route query for container loopback.
  - net:nebula-matrix:add protection of consecutive write regs
  - urma: fix urma_admin agg del eid failed.
  - KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer
  - !20100 merge OLK-6.6-v6.6.92-backport into OLK-6.6
  - uvb: change cis call default poll timeout
  - dmaengine: idxd: Fix double free in idxd_setup_wqs()
  - dmaengine: idxd: Fix refcount underflow on module unload
  - dmaengine: idxd: Remove improper idxd_free
  - fs/xattr.c: fix simple_xattr_list()
  - firmware: arm_scmi: Account for failed debug initialization
  - drm/amdgpu: fix pm notifier handling
  - LoongArch: Explicitly specify code model in Makefile
  - usb: typec: ucsi: displayport: Fix deadlock
  - mm/page_alloc: fix race condition in unaccepted memory handling
  - dmaengine: idxd: Refactor remove call with idxd_cleanup() helper
  - dmaengine: idxd: fix memory leak in error handling path of idxd_pci_probe
  - dmaengine: idxd: Add missing idxd cleanup to fix memory leak in remove call
  - dmaengine: idxd: Add missing cleanups in cleanup internals
  - dmaengine: idxd: Add missing cleanup for early error out in idxd_setup_internals
  - dmaengine: idxd: fix memory leak in error handling path of idxd_setup_groups
  - dmaengine: idxd: fix memory leak in error handling path of idxd_setup_engines
  - dmaengine: idxd: fix memory leak in error handling path of idxd_setup_wqs
  - dmaengine: ti: k3-udma: Use cap_mask directly from dma_device structure instead of a local copy
  - net: qede: Initialize qede_ll_ops with designated initializer
  - smb: client: fix memory leak during error handling for POSIX mkdir
  - scsi: sd_zbc: block: Respect bio vector limits for REPORT ZONES buffer
  - phy: renesas: rcar-gen3-usb2: Set timing registers only once
  - phy: renesas: rcar-gen3-usb2: Fix role detection on unbind/bind
  - phy: Fix error handling in tegra_xusb_port_init
  - phy: tegra: xusb: Use a bitmask for UTMI pad power state tracking
  - tracing: samples: Initialize trace_array_printk() with the correct function
  - Drivers: hv: vmbus: Remove vmbus_sendpacket_pagebuffer()
  - Drivers: hv: Allow vmbus_sendpacket_mpb_desc() to create multiple ranges
  - hv_netvsc: Remove rmsg_pgcnt
  - hv_netvsc: Use vmbus_sendpacket_mpb_desc() to send VMBus messages
  - ALSA: usb-audio: Add sample rate quirk for Microdia JP001 USB Camera
  - ALSA: usb-audio: Add sample rate quirk for Audioengine D1
  - ALSA: es1968: Add error handling for snd_pcm_hw_constraint_pow2()
  - drm/amd/display: Avoid flooding unnecessary info messages
  - drm/amd/display: Correct the reply value when AUX write incomplete
  - LoongArch: Fix MAX_REG_OFFSET calculation
  - udf: Make sure i_lenExtents is uptodate on inode eviction
  - NFSv4/pnfs: Reset the layout state after a layoutreturn
  - tsnep: fix timestamping with a stacked DSA driver
  - tsnep: Inline small fragments within TX descriptor
  - octeontx2-af: Fix CGX Receive counters
  - net: ethernet: mtk_eth_soc: fix typo for declaration MT7988 ESW capability
  - octeontx2-pf: macsec: Fix incorrect max transmit size in TX secy
  - qlcnic: fix memory leak in qlcnic_sriov_channel_cfg_cmd()
  - ALSA: sh: SND_AICA should depend on SH_DMA_API
  - nvme-pci: make nvme_pci_npages_prp() __always_inline
  - net: dsa: sja1105: discard incoming frames in BR_STATE_LISTENING
  - ALSA: ump: Fix a typo of snd_ump_stream_msg_device_info
  - ALSA: seq: Fix delivery of UMP events to group ports
  - net: mctp: Ensure keys maintain only one ref to corresponding dev
  - tools/net/ynl: ethtool: fix crash when Hardware Clock info is missing
  - tools: ynl: ethtool.py: Output timestamping statistics from tsinfo-get operation
  - Bluetooth: MGMT: Fix MGMT_OP_ADD_DEVICE invalid device flags
  - spi: loopback-test: Do not split 1024-byte hexdumps
  - HID: thrustmaster: fix memory leak in thrustmaster_interrupts()
  - iio: chemical: sps30: use aligned_s64 for timestamp
  - iio: adc: ad7768-1: Fix insufficient alignment of timestamp.
  - Revert "drm/amd: Stop evicting resources on APUs in suspend"
  - drm/amd: Add Suspend/Hibernate notification callback support
  - drm/amdgpu: trigger flr_work if reading pf2vf data failed
  - drm/amdgpu: Fix the runtime resume failure issue
  - drm/amd: Stop evicting resources on APUs in suspend
  - iio: adc: ad7266: Fix potential timestamp alignment issue.
  - firmware: arm_scmi: Fix timeout checks on polling path
  - firmware: arm_scmi: Track basic SCMI communication debug metrics
  - firmware: arm_scmi: Add support for debug metrics at the interface
  - firmware: arm_scmi: Add message dump traces for bad and unexpected replies
  - firmware: arm_scmi: Add helper to trace bad messages
  - tpm: tis: Double the timeout B to 4s
  - cgroup/cpuset: Extend kthread_is_per_cpu() check to all PF_NO_SETAFFINITY tasks
  - platform/x86: asus-wmi: Fix wlan_ctrl_by_user detection
  - platform/x86/amd/pmc: Declare quirk_spurious_8042 for MECHREVO Wujie 14XA (GX4HRXL)
  - binfmt_elf: Move brk for static PIE even if ASLR disabled
  - binfmt_elf: Honor PT_LOAD alignment for static PIE
  - binfmt_elf: Calculate total_size earlier
  - selftests/exec: Build both static and non-static load_address tests
  - binfmt_elf: Leave a gap between .bss and brk
  - selftests/exec: load_address: conform test to TAP format output
  - binfmt_elf: elf_bss no longer used by load_elf_binary()
  - binfmt_elf: Support segments with 0 filesz and misaligned starts
  - fs/xattr.c: fix simple_xattr_list to always include security.* xattrs
  - !20080 merge OLK-6.6 into OLK-6.6
  - ubcore: fix netdev size limit error.
  - !19254 merge refs/pull/19254/head into OLK-6.6
  - drivers/ub/sentry: release urma source when the ub device is removed
  - ceph: fix crash in process_v2_sparse_read() for encrypted directories
  - net: atlantic: fix fragment overflow handling in RX path
  - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once
  - kernfs: Don't re-lock kernfs_root::kernfs_rwsem in kernfs_fop_readdir().
  - gfs2: Fix unlikely race in gdlm_put_lock
  - gfs2: Add proper lockspace locking
  - xfs: do not propagate ENODATA disk errors into xattr code
  - ftrace: Fix BPF fexit with livepatch
  - cifs: Fix establishing NetBIOS session for SMB2+ connection
  - mfs: remove FAROUND event for mfsd demo
  - [virtCCA Live Migration 1]virtcca secure cvm supports live migration
  - regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex
  - sched: Fix kabi breakage of struct cfs_rq for zero_vruntime
  - sched/eevdf: Fix min_vruntime vs avg_vruntime
  - sched/core: Add comment explaining force-idle vruntime snapshots
  - sched/fair: Forfeit vruntime on yield
  - Revert "sched/fair: Only increment deadline once on yield"
  - sched: Fix kabi breakage of struct cfs_rq for min_vruntime_copy
  - sched/eevdf: Remove min_vruntime_copy
  - sched: Fix kabi breakage of struct sched_entity for on_rq and rel_deadline
  - sched/fair: Avoid re-setting virtual deadline on 'migrations'
  - sched/balancing: Change comment formatting to not overlap Git conflict marker lines
  - wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb()
  - mfs: Add prefetch demo
  - bpf, arm64: Do not audit capability check in do_jit()
  - PCI: Batch BAR sizing operations
  - bpf: Do not audit capability check in do_jit()
  - usb: usbtmc: Fix read_stb function and get_stb ioctl
  - staging: axis-fifo: fix TX handling on copy_from_user() failure
  - staging: axis-fifo: flush RX FIFO on read errors
  - staging: axis-fifo: fix maximum TX packet length check
  - ksmbd: fix stream write failure
  - netfilter: ipset: Remove unused htable_bits in macro ahash_region
  - Documentation: x86/bugs/its: Add ITS documentation
  - x86/speculation: Remove the extra #ifdef around CALL_NOSPEC
  - x86/speculation: Add a conditional CS prefix to CALL_NOSPEC
  - x86/speculation: Simplify and make CALL_NOSPEC consistent
  - x86/bhi: Do not set BHI_DIS_S in 32-bit mode
  - x86/bpf: Add IBHF call at end of classic BPF
  - x86/bpf: Call branch history clearing sequence on exit
  - io_uring: ensure deferred completions are posted for multishot
  - io_uring: always arm linked timeouts prior to issue
  - do_umount(): add missing barrier before refcount checks in sync case
  - drm/panel: simple: Update timings for AUO G101EVN010
  - MIPS: Fix MAX_REG_OFFSET
  - iio: adc: dln2: Use aligned_s64 for timestamp
  - iio: accel: adxl355: Make timestamp 64-bit aligned using aligned_s64
  - types: Complement the aligned types with signed 64-bit one
  - iio: temp: maxim-thermocouple: Fix potential lack of DMA safe buffer.
  - iio: accel: adxl367: fix setting odr for activity time update
  - usb: usbtmc: Fix erroneous generic_read ioctl return
  - usb: usbtmc: Fix erroneous wait_srq ioctl return
  - usb: usbtmc: Fix erroneous get_stb ioctl error returns
  - USB: usbtmc: use interruptible sleep in usbtmc_read
  - usb: typec: ucsi: displayport: Fix NULL pointer access
  - usb: typec: tcpm: delay SNK_TRY_WAIT_DEBOUNCE to SRC_TRYWAIT transition
  - usb: host: tegra: Prevent host controller crash when OTG port is used
  - usb: gadget: Use get_status callback to set remote wakeup capability
  - usb: gadget: tegra-xudc: ACK ST_RC after clearing CTRL_RUN
  - usb: gadget: f_ecm: Add get_status callback
  - usb: cdnsp: fix L1 resume issue for RTL_REVISION_NEW_LPM version
  - usb: cdnsp: Fix issue with resuming from L1
  - ocfs2: stop quota recovery before disabling quotas
  - ocfs2: implement handshaking with ocfs2 recovery thread
  - ocfs2: switch osb->disable_recovery to enum
  - clocksource/i8253: Use raw_spinlock_irqsave() in clockevent_i8253_disable()
  - xenbus: Use kref to track req lifetime
  - xen: swiotlb: Use swiotlb bouncing if kmalloc allocation demands it
  - smb: client: Avoid race in open_cached_dir with lease breaks
  - usb: uhci-platform: Make the clock really optional
  - drm/amdgpu/hdp6: use memcfg register to post the write for HDP flush
  - drm/amdgpu/hdp5: use memcfg register to post the write for HDP flush
  - drm/amdgpu/hdp5.2: use memcfg register to post the write for HDP flush
  - drm/amdgpu/hdp4: use memcfg register to post the write for HDP flush
  - drm/amd/display: Copy AUX read reply data whenever length > 0
  - drm/amd/display: Fix wrong handling for AUX_DEFER case
  - drm/amd/display: Remove incorrect checking in dmub aux handler
  - drm/amd/display: Fix the checking condition in dmub aux handling
  - iio: adis16201: Correct inclinometer channel resolution
  - iio: adc: rockchip: Fix clock initialization sequence
  - iio: adc: ad7606: fix serial register access
  - drm/amd/display: Shift DMUB AUX reply command if necessary
  - staging: axis-fifo: Correct handling of tx_fifo_depth for size validation
  - staging: axis-fifo: Remove hardware resets for user errors
  - staging: iio: adc: ad7816: Correct conditional logic for store mode
  - Input: synaptics - enable InterTouch on TUXEDO InfinityBook Pro 14 v5
  - Input: synaptics - enable SMBus for HP Elitebook 850 G1
  - Input: synaptics - enable InterTouch on Dell Precision M3800
  - Input: synaptics - enable InterTouch on Dynabook Portege X30L-G
  - Input: synaptics - enable InterTouch on Dynabook Portege X30-D
  - Input: xpad - add support for 8BitDo Ultimate 2 Wireless Controller
  - Input: xpad - fix Share button on Xbox One controllers
  - Input: mtk-pmic-keys - fix possible null pointer dereference
  - Input: cyttsp5 - fix power control issue on wakeup
  - Input: cyttsp5 - ensure minimum reset pulse width
  - net: dsa: b53: fix learning on VLAN unaware bridges
  - net: dsa: b53: always rejoin default untagged VLAN on bridge leave
  - net: dsa: b53: fix VLAN ID for untagged vlan on bridge leave
  - net: dsa: b53: fix flushing old pvid VLAN on pvid change
  - net: dsa: b53: fix clearing PVID of a port
  - net: dsa: b53: allow leaky reserved multicast
  - netfilter: ipset: fix region locking in hash types
  - can: gw: fix RCU/BH usage in cgw_create_job()
  - can: mcp251xfd: fix TDC setting for low data bit rates
  - net: ethernet: mtk_eth_soc: reset all TX queues on DMA free
  - netdevice: add netdev_tx_reset_subqueue() shorthand
  - sch_htb: make htb_deactivate() idempotent
  - ksmbd: prevent out-of-bounds stream writes by validating *pos
  - can: mcp251xfd: mcp251xfd_remove(): fix order of unregistration calls
  - wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation
  - can: mcan: m_can_class_unregister(): fix order of unregistration calls
  - arm64: dts: imx8mm-verdin: Link reg_usdhc2_vqmmc to usdhc2
  - dm: add missing unlock on in dm_keyslot_evict()


author: Mingzheng Xing <xingmingzheng@iscas.ac.cn> - 6.6.0-135.0.0.114
changelog:
  - riscv kernel upgrade to 6.6.0-135.0.0
  - Revert "mango pci hack:broadcast when no MSI source known"
  - serial: 8250_core: Remove unneeded ->iotype assignment
  - riscv: openeuler_defconfig: Enable PCIE_EDR
  - iommu/riscv: Fix inconsistencies with the latest spec revision V2
  - Enable gade when iommu has AMO_HWAD cap
  - riscv: openeuler_defconfig: Enable more ACPI_APEI configs
  - Optimize uaccess for riscv
  - Fix k1 boot failed with mmc error
  - Add SDHCI and GMAC support for Spacemit K3


author: Li Nan <linan122@huawei.com> - 6.6.0-136.0.0.115
changelog:
  - !20020  ext4: fix e4b bitmap inconsistency reports
  - !20308  ext4: fix stale data issue on the iomap path
  - !20347  Fix exception when umount with release dev fd
  - mfs: Do not release the async event immediately when read failed
  - mfs: Fix wild-memory-access error when mfs event is destroy.
  - !20336  memcg: avoid the warning in mem_cgroup_migrate
  - !20326  KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight
  - !20059  net/mdiobus: Fix potential out-of-bounds read/write access
  - !20057  net/mdiobus: Fix potential out-of-bounds clause 45 read/write access
  - !20056  net: phy: clear phydev->devlink when the link is deleted
  - !20055  netfilter: nft_set_pipapo: prevent overflow in lookup table allocation
  - !20130  ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple()
  - !20327  s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump
  - !20324  drm/mediatek: Disable AFBC support on Mediatek DRM driver
  - !20276  ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params
  - !20325  atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control().
  - !20330 [OLK-6.6][linux-6.6.y sync] Backport 6.6.98-6.6.99 LTS Patches
  - Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard
  - kasan: use vmalloc_dump_obj() for vmalloc error reports
  - HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155
  - btrfs: don't ignore inode missing when replaying log tree
  - btrfs: fix log tree replay failure due to file with 0 links and extents
  - btrfs: do not assert we found block group item when creating free space tree
  - vsock: fix lock inversion in vsock_assign_transport()
  - ksmbd: fix potential use-after-free in oplock/lease break ack
  - kasan: remove kasan_find_vm_area() to prevent possible deadlock
  - smb: client: fix potential race in cifs_put_tcon()
  - selftests/bpf: adapt one more case in test_lru_map to the new target_free
  - Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID
  - HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY
  - bpf: Adjust free target to avoid global starvation of LRU map
  - vt: add missing notification when switching back to text mode
  - btrfs: fix assertion when building free space tree
  - net: mana: Record doorbell physical address in PF mode
  - HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2
  - net: usb: qmi_wwan: add SIMCom 8230C composition
  - ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100
  - ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic
  - io_uring: make fallocate be hashed work
  - um: vector: Reduce stack usage in vector_eth_configure()
  - atm: idt77252: Add missing `dma_map_error()`
  - ublk: sanity check add_dev input for underflow
  - net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam()
  - can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level
  - net: phy: microchip: limit 100M workaround to link-down events on LAN88xx
  - ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof
  - net: appletalk: Fix device refcount leak in atrtr_create()
  - drm/tegra: nvdec: Fix dma_alloc_coherent error check
  - wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev()
  - cifs: all initializations for tcon should happen in tcon_info_alloc
  - smb: client: fix DFS interlink failover
  - smb: client: avoid unnecessary reconnects when refreshing referrals
  - usb: dwc3: Abort suspend on soft disconnect failure
  - usb: cdnsp: Fix issue with CV Bad Descriptor test
  - usb: cdnsp: Replace snprintf() with the safer scnprintf() variant
  - usb:cdnsp: remove TRB_FLUSH_ENDPOINT command
  - btrfs: fix inode lookup error handling during log replay
  - btrfs: return a btrfs_inode from btrfs_iget_logging()
  - btrfs: remove redundant root argument from fixup_inode_link_count()
  - btrfs: remove redundant root argument from btrfs_update_inode_fallback()
  - btrfs: remove noinline from btrfs_update_inode()
  - erofs: fix to add missing tracepoint in erofs_read_folio()
  - ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked()
  - smb: server: make use of rdma_destroy_qp()
  - x86/rdrand: Disable RDSEED on AMD Cyan Skillfish
  - mm/vmalloc: leave lazy MMU mode on PTE mapping error
  - scripts/gdb: fix interrupts.py after maple tree conversion
  - scripts/gdb: de-reference per-CPU MCE interrupts
  - scripts/gdb: fix interrupts display after MCP on x86
  - mm: fix the inaccurate memory statistics issue for users
  - maple_tree: fix mt_destroy_walk() on root leaf node
  - Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io"
  - drm/gem: Fix race in drm_gem_handle_create_tail()
  - drm/ttm: fix error handling in ttm_buffer_object_transfer
  - memcg: avoid the warning in mem_cgroup_migrate
  - !17578 perf mem/c2c: Add load store event mapping for Hygon
  - !19670 [OLK-6.6] Fix CVE-2025-39833
  - !19669 [OLK-6.6] Fix CVE-2025-39743
  - !19668 [OLK-6.6] Fix CVE-2025-38681
  - !18606 [0LK-6.6] Fix CVE-2025-38699
  - !20332 Fix CVE-2025-68371
  - !19666 [OLK-6.6] Fix CVE-2025-38650
  - !19665 [OLK-6.6] Fix CVE-2025-38578
  - !19649 [olk 6.6] 主线补丁同步，hugememory&khugepaged
  - !20317 Fix CVE-2025-71108
  - scsi: smartpqi: Fix device resources accessed after device removal
  - !20037 [Intel-SIG] DMR new CPU model support
  - wifi: prevent A-MSDU attacks in mesh networks
  - KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight
  - KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table.
  - x86/mce: Make sure CMCI banks are cleared during shutdown on Intel
  - x86/mce: Don't remove sysfs if thresholding sysfs init fails
  - x86/mce/amd: Fix threshold limit reset
  - x86/mce/amd: Add default names for MCA banks and blocks
  - rxrpc: Fix oops due to non-existence of prealloc backlog struct
  - Bluetooth: HCI: Set extended advertising data synchronously
  - perf: build: Setup PKG_CONFIG_LIBDIR for cross compilation
  - maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate()
  - rxrpc: Fix bug due to prealloc collision
  - atm: clip: Fix NULL pointer dereference in vcc_sendmsg()
  - atm: clip: Fix infinite recursive call of clip_push().
  - atm: clip: Fix memory leak of struct clip_vcc.
  - atm: clip: Fix potential null-ptr-deref in to_atmarpd().
  - net: phy: smsc: Fix link failure in forced mode with Auto-MDIX
  - net: phy: smsc: Force predictable MDI-X state on LAN87xx
  - net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap
  - net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2
  - vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local`
  - !19995  net: netpoll: fix incorrect refcount handling causing incorrect cleanup
  - vsock: Fix transport_* TOCTOU
  - !19994  ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe
  - vsock: Fix transport_{g2h,h2g} TOCTOU
  - !19993  net: ipv6: fix field-spanning memcpy warning in AH output
  - vsock: fix `vsock_proto` declaration
  - !19988  udp_tunnel: use netdev_warn() instead of netdev_WARN()
  - fix proc_sys_compare() handling of in-lookup dentries
  - pinctrl: amd: Clear GPIO debounce for suspend
  - Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected
  - Bluetooth: hci_sync: Fix not disabling advertising instance
  - ASoC: cs35l56: probe() should fail if the device ID is not recognized
  - ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode
  - !19146 Backport uncore freq driver fixes and support for agent_types and die_id sysfs attributes
  - !20036 Backport CWF cstate PMU for 6.6
  - !20304 [OLK-6.6][linux-6.6.y sync] Backport 6.6.96-6.6.98 LTS Patches
  - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump
  - !20303 ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan()
  - KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight
  - atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control().
  - drm/mediatek: Disable AFBC support on Mediatek DRM driver
  - !20295  CVE-2025-68296
  - usb: typec: ucsi: Handle incorrect num_connectors capability
  - Input: xpad - set correct controller type for Acer NGR200
  - f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page()
  - smb: client: remove redundant lstrp update in negotiate protocol
  - igc: fix disabling L1.2 PCI-E link substate on I226 on init
  - platform/x86: Fix initialization order for firmware_attributes_class
  - RDMA/mlx5: Fix vport loopback forcing for MPV device
  - ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan()
  - ext4: fix stale data issue on the iomap path
  - !20046  drm/sysfb: Do not dereference NULL pointer in plane reset
  - !20045  binfmt_misc: restore write access before closing files opened by open_exec()
  - f2fs: fix to avoid use-after-free issue in f2fs_filemap_fault
  - powerpc/kernel: Fix ppc_save_regs inclusion in build
  - platform/x86: think-lmi: Fix sysfs group cleanup
  - platform/x86: think-lmi: Fix kobject cleanup
  - platform/x86: think-lmi: Create ksets consecutively
  - powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed
  - iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU
  - Logitech C-270 even more broken
  - dma-buf: fix timeout handling in dma_resv_wait_timeout v2
  - smb: client: fix readdir returning wrong type with POSIX extensions
  - usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume
  - usb: cdnsp: do not disable slot for disabled slot
  - Input: iqs7222 - explicitly define number of external channels
  - Input: xpad - support Acer NGR 200 Controller
  - xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS
  - xhci: dbc: Flush queued requests before stopping dbc
  - xhci: dbctty: disable ECHO flag by default
  - usb: xhci: quirk for data loss in ISOC transfers
  - NFSv4/flexfiles: Fix handling of NFS level errors in I/O
  - module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper
  - platform/x86: hp-bioscfg: Fix class device unregistration
  - platform/x86: hp-bioscfg: Directly use firmware_attributes_class
  - rcu: Return early if callback is not specified
  - wifi: mac80211: drop invalid source address OCB frames
  - aoe: defer rexmit timer downdev work to workqueue
  - regulator: fan53555: add enable_time support and soft-start times
  - ASoC: amd: yc: update quirk data for HP Victus
  - powerpc: Fix struct termio related ioctl macros
  - platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list
  - ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic
  - ata: pata_cs5536: fix build on 32-bit UML
  - ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled
  - ALSA: sb: Force to disable DMAs once when DMA mode is changed
  - ALSA: sb: Don't allow changing the DMA mode during operations
  - drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read
  - drm/simpledrm: Do not upcast in release helpers
  - scsi: ufs: core: Fix clk scaling to be conditional in reset and restore
  - scsi: ufs: core: Add OPP support for scaling clocks and regulators
  - scsi: ufs: core: Fix abnormal scale up after last cmd finish
  - f2fs: fix to zero post-eof page
  - f2fs: convert f2fs_vm_page_mkwrite() to use folio
  - f2fs: prevent writing without fallocate() for pinned files
  - f2fs: add tracepoint for f2fs_vm_page_mkwrite()
  - x86/traps: Initialize DR6 by writing its architectural reset value
  - wifi: mac80211: finish link init before RCU publish
  - wifi: mac80211: Add link iteration macro for link data
  - wifi: mac80211: chan: chandef is non-NULL for reserved
  - smb: client: remove 	 from TP_printk statements
  - btrfs: fix qgroup reservation leak on failure to allocate ordered extent
  - smb: client: fix race condition in negotiate timeout by using more precise timing
  - amd-xgbe: do not double read link status
  - nui: Fix dma_mapping_error() check
  - enic: fix incorrect MTU comparison in enic_change_mtu()
  - amd-xgbe: align CL37 AN sequence as per databook
  - lib: test_objagg: Set error message in check_expect_hints_stats()
  - igc: disable L1.2 PCI-E link substate to avoid performance issue
  - drm/i915/gsc: mei interrupt top half should be in irq disabled context
  - drm/i915/gt: Fix timeline left held on VMA alloc error
  - platform/mellanox: mlxreg-lc: Fix logic error in power state check
  - platform/x86: dell-wmi-sysman: Fix class device unregistration
  - platform/x86: dell-sysman: Directly use firmware_attributes_class
  - platform/x86: think-lmi: Fix class device unregistration
  - platform/x86: think-lmi: Directly use firmware_attributes_class
  - platform/x86: firmware_attributes_class: Simplify API
  - platform/x86: firmware_attributes_class: Move include linux/device/class.h
  - platform/x86: make fw_attr_class constant
  - arm64: dts: qcom: sm8550: add UART14 nodes
  - drm/i915/selftests: Change mock_request() to return error pointers
  - spi: spi-fsl-dspi: Clear completion counter before initiating transfer
  - drm/exynos: fimd: Guard display clock control with runtime PM calls
  - dpaa2-eth: fix xdp_rxq_info leak
  - ethernet: atl1: Add missing DMA mapping error checks and count errors
  - btrfs: use btrfs_record_snapshot_destroy() during rmdir
  - btrfs: propagate last_unlink_trans earlier when doing a rmdir
  - btrfs: rename err to ret in btrfs_rmdir()
  - btrfs: fix iteration of extrefs during log replay
  - btrfs: fix missing error handling when searching for inode refs during log replay
  - Bluetooth: Prevent unintended pause by checking if advertising is active
  - platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message
  - RDMA/mlx5: Fix vport loopback for MPV device
  - RDMA/mlx5: Fix CC counters query for MPV
  - RDMA/mlx5: Fix HW counters query for non-representor devices
  - scsi: ufs: core: Fix spelling of a sysfs attribute name
  - scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu()
  - scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database()
  - platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment
  - arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename
  - mtk-sd: reset host->mrq on prepare_data() error
  - mtk-sd: Prevent memory corruption from DMA map failure
  - mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data
  - Bluetooth: MGMT: mesh_send: check instances prior disabling advertising
  - Bluetooth: MGMT: set_mesh: update LE scan interval and window
  - Bluetooth: hci_sync: revert some mesh modifications
  - mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier
  - mmc: sdhci: Add a helper function for dump register in dynamic debug mode
  - vsock/vmci: Clear the vmci transport packet properly when initializing it
  - s390/pci: Do not try re-enabling load/store if device is disabled
  - rtc: cmos: use spin_lock_irqsave in cmos_interrupt
  - rtc: pcf2127: fix SPI command byte for PCF2131
  - rtc: pcf2127: add missing semicolon after statement
  - !20296 [OLK-6.6][linux-6.6.y sync] Backport 6.6.95-6.6.96 LTS Patches
  - !20298  cifs: Fix memory and information leak in smb3_reconfigure()
  - !20042  RDMA/rxe: Fix null deref on srq->rq.queue after resize failure
  - !20041  Bluetooth: hci_sock: Prevent race in socket write iter and sock bind
  - !19820  usbnet: Prevents free active kevent
  - !20268 urma: fix dereference of null_ptr for uobj
  - Revert "drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1"
  - kallsyms: fix build without execinfo
  - drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe()
  - Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU
  - usb: typec: displayport: Fix potential deadlock
  - NFSv4.2: another fix for listxattr
  - ARM: 9354/1: ptrace: Use bitfield helpers
  - firmware: arm_scmi: Ensure that the message-id supports fastchannel
  - firmware: arm_scmi: Add a common helper to check if a message is supported
  - nvme: always punt polled uring_cmd end_io work to task_work
  - Revert "ipv6: save dontfrag in cork"
  - x86/tools: Drop duplicate unlikely() definition in insn_decoder_test.c
  - Kunit to check the longest symbol length
  - s390/entry: Fix last breaking event handling in case of stack corruption
  - media: uvcvideo: Rollback non processed entities on error
  - ksmbd: remove unsafe_memcpy use in session setup
  - ksmbd: Use unsafe_memcpy() for ntlm_negotiate
  - drm/amdgpu: switch job hw_fence to amdgpu_fence
  - drm/amdgpu: Add kicker device detection
  - drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1
  - drm/amdgpu: amdgpu_vram_mgr_new(): Clamp lpfn to total vram
  - drm/bridge: cdns-dsi: Wait for Clk and Data Lanes to be ready
  - drm/bridge: cdns-dsi: Check return value when getting default PHY config
  - drm/bridge: cdns-dsi: Fix connecting to next bridge
  - drm/bridge: cdns-dsi: Fix phy de-init and flag it so
  - drm/bridge: cdns-dsi: Fix the clock variable for mode_valid()
  - drm/amdkfd: Fix race in GWS queue scheduling
  - drm/msm/gpu: Fix crash when throttling GPU immediately during boot
  - drm/udl: Unregister device before cleaning up on disconnect
  - drm/tegra: Assign plane type before registration
  - drm/etnaviv: Protect the scheduler's pending list with its lock
  - drm/cirrus-qemu: Fix pitch programming
  - drm/ast: Fix comment on modeset lock
  - HID: wacom: fix kobject reference count leak
  - HID: wacom: fix memory leak on sysfs attribute creation failure
  - HID: wacom: fix memory leak on kobject creation failure
  - HID: lenovo: Restrict F7/9/11 mode to compact keyboards only
  - net: libwx: fix the creation of page_pool
  - btrfs: update superblock's device bytes_used when dropping chunk
  - btrfs: fix a race between renames and directory logging
  - dm-raid: fix variable in journal device check
  - Bluetooth: L2CAP: Fix L2CAP MTU negotiation
  - serial: imx: Restore original RXTL for console to fix data loss
  - dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive
  - staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher()
  - EDAC/amd64: Fix size calculation for Non-Power-of-Two DIMMs
  - drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type
  - drm/bridge: ti-sn65dsi86: make use of debugfs_init callback
  - drm/i915: fix build error some more
  - net: selftests: fix TCP packet checksum
  - ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X507UAR
  - net: enetc: Correct endianness handling in _enetc_rd_reg64
  - libbpf: Fix possible use-after-free for externs
  - um: ubd: Add missing error check in start_io_thread()
  - vsock/uapi: fix linux/vm_sockets.h userspace compilation errors
  - af_unix: Don't set -ECONNRESET for consumed OOB skb.
  - wifi: mac80211: fix beacon interval calculation overflow
  - attach_recursive_mnt(): do not lock the covering tree when sliding something under it
  - ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3()
  - lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly()
  - s390/pkey: Prevent overflow in size calculation for memdup_user()
  - ASoC: amd: yc: Add DMI quirk for Lenovo IdeaPad Slim 5 15
  - i2c: robotfuzz-osif: disable zero-length read messages
  - i2c: tiny-usb: disable zero-length read messages
  - af_unix: Don't leave consecutive consumed OOB skbs.
  - af_unix: Don't call skb_get() for OOB skb.
  - af_unix: Define locking order for U_RECVQ_LOCK_EMBRYO in unix_collect_skb().
  - af_unix: Define locking order for U_LOCK_SECOND in unix_state_double_lock().
  - af_unix: Define locking order for unix_table_double_lock().
  - platform/x86: ideapad-laptop: use usleep_range() for EC polling
  - platform/x86: ideapad-laptop: move ACPI helpers from header to source file
  - platform/x86: ideapad-laptop: move ymc_trigger_ec from lenovo-ymc
  - platform/x86: ideapad-laptop: introduce a generic notification chain
  - dummycon: Trigger redraw when switching consoles with deferred takeover
  - tty: vt: make consw::con_switch() return a bool
  - tty: vt: sanitize arguments of consw::con_clear()
  - tty: vt: make init parameter of consw::con_init() a bool
  - PCI: apple: Set only available ports up
  - PCI: apple: Use helper function for_each_child_of_node_scoped()
  - !20288  memcg: avoid dead loop when setting memory.max
  - cifs: Fix memory and information leak in smb3_reconfigure()
  - !19975  Bluetooth: MGMT: cancel mesh send timer when hdev removed
  - !19976  net/mlx5: Clean up only new IRQ glue on request_irq() failure
  - !19977  net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()
  - !19978  net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ
  - uio_hv_generic: Query the ringbuffer size for device
  - Drivers: hv: vmbus: Add utility function for querying ring size
  - f2fs: don't over-report free space or inodes in statvfs
  - btrfs: handle csum tree error with rescue=ibadroots correctly
  - ovl: Check for NULL d_inode() in ovl_dentry_upper()
  - scsi: ufs: core: Don't perform UFS clkscaling during host async scan
  - ceph: fix possible integer overflow in ceph_zero_objects()
  - ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock
  - ALSA: hda: Add new pci id for AMD GPU display HD audio controller
  - ALSA: hda: Ignore unsol events for cards being shut down
  - usb: typec: mux: do not return on EOPNOTSUPP in {mux, switch}_set
  - usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode
  - usb: cdc-wdm: avoid setting WDM_READ for ZLP-s
  - usb: Add checks for snprintf() calls in usb_alloc_dev()
  - usb: common: usb-conn-gpio: use a unique name for usb connector device
  - usb: potential integer overflow in usbg_make_tpg()
  - misc: tps6594-pfsm: Add NULL pointer check in tps6594_pfsm_probe()
  - iio: adc: ad_sigma_delta: Fix use of uninitialized status_pos
  - usb: dwc2: also exit clock_gating when stopping udc while suspended
  - coresight: Only check bottom two claim bits
  - um: use proper care when taking mmap lock during segfault
  - um: Add cmpxchg8b_emu and checksum functions to asm-prototypes.h
  - iio: pressure: zpa2326: Use aligned_s64 for the timestamp
  - bcache: fix NULL pointer in cache_set_flush()
  - amd/amdkfd: fix a kfd_process ref leak
  - md/md-bitmap: fix dm-raid max_write_behind setting
  - PCI: apple: Fix missing OF node reference in apple_pcie_setup_port
  - PCI: dwc: Make link training more robust by setting PORT_LOGIC_LINK_WIDTH to one lane
  - dmaengine: xilinx_dma: Set dma_device directions
  - rust: module: place cleanup_module() in .exit.text section
  - ksmbd: provide zero as a unique ID to the Mac client
  - ksmbd: allow a filename to contain special characters on SMB3.1.1 posix extension
  - hwmon: (pmbus/max34440) Fix support for max34451
  - NFSv4: xattr handlers should check for absent nfs filehandles
  - cxl/region: Add a dev_err() on missing target list entries
  - fuse: fix race between concurrent setattrs from multiple nodes
  - leds: multicolor: Fix intensity setting while SW blinking
  - sunrpc: don't immediately retransmit on seqno miss
  - mfd: max14577: Fix wakeup source leaks on device unbind
  - mailbox: Not protect module_put with spin_lock_irqsave
  - NFSv4.2: fix listxattr to return selinux security label
  - NFSv4: Always set NLINK even if the server doesn't support it
  - cifs: Fix encoding of SMB1 Session Setup NTLMSSP Request in non-UNICODE mode
  - cifs: Fix cifs_query_path_info() for Windows NT servers
  - cifs: Correctly set SMB1 SessionKey field in Session Setup Request
  - !20282 [OLK-6.6][linux-6.6.y sync] Backport 6.6.94-6.6.95 LTS Patches
  - drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup
  - drm/fbdev-helper: Set and clear VGA switcheroo client from fb_info
  - Revert "gpio: mlxbf3: only get IRQ for device instance 0"
  - smb: client: fix warning when reconnecting channel
  - wifi: ath11k: Add missing platform IDs for quirk table
  - power: supply: bq27xxx: restrict no-battery detection to bq27000
  - power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery
  - cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus()
  - Revert "ACPI: battery: negate current when discharging"
  - Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()"
  - cifs: Remove duplicate fattr->cf_dtype assignment from wsl_to_fattr() function
  - gpio: mlxbf3: only get IRQ for device instance 0
  - perf evsel: Missed close() when probing hybrid core PMUs
  - RISC-V: KVM: Don't treat SBI HFENCE calls as NOPs
  - RISC-V: KVM: Fix the size parameter check in SBI SFENCE calls
  - scsi: elx: efct: Fix memory leak in efct_hw_parse_filter()
  - perf: Fix cgroup state vs ERROR
  - s390/pci: Fix __pcilg_mio_inuser() inline assembly
  - platform/loongarch: laptop: Add backlight power control support
  - smb: client: fix first command failure during re-negotiation
  - Revert "cpufreq: tegra186: Share policy per cluster"
  - ARM: dts: am335x-bone-common: Increase MDIO reset deassert delay to 50ms
  - ARM: dts: am335x-bone-common: Increase MDIO reset deassert time
  - platform/x86: ideapad-laptop: add missing Ideapad Pro 5 fn keys
  - serial: sh-sci: Increment the runtime usage counter for the earlycon device
  - net: make for_each_netdev_dump() a little more bug-proof
  - smb: Log an error when close_all_cached_dirs fails
  - dt-bindings: i2c: nvidia,tegra20-i2c: Specify the required properties
  - EDAC/amd64: Correct number of UMCs for family 19h models 70h-7fh
  - net: atm: fix /proc/net/atm/lec handling
  - net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get()
  - net: microchip: lan743x: Reduce PTP timeout on HW failure
  - tcp: fix passive TFO socket having invalid NAPI ID
  - tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior
  - ptp: allow reading of currently dialed frequency to succeed on free-running clocks
  - e1000e: set fixed clock frequency indication for Nahum 11 and Nahum 13
  - net: ice: Perform accurate aRFS flow match
  - pldmfw: Select CRC32 when PLDMFW is selected
  - hwmon: (occ) fix unaligned accesses
  - hwmon: (occ) Rework attribute registration for stack usage
  - memcg: avoid dead loop when setting memory.max
  - drm/nouveau/bl: increase buffer size to avoid truncate warning
  - ionic: Prevent driver/fw getting out of sync on devcmd(s)
  - drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate
  - drm/msm/disp: Correct porch timing for SDM845
  - smb: fix secondary channel creation issue with kerberos by populating hostname when adding channels
  - erofs: remove unused trace event erofs_destroy_inode
  - bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE
  - net: Fix checksum update for ILA adj-transport
  - iio: accel: fxls8962af: Fix temperature calculation
  - ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged
  - ALSA: hda/intel: Add Thinkpad E15 to PM deny list
  - ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card
  - wifi: rtw89: pci: use DBI function for 8852AE/8852BE/8851BE
  - Input: sparcspkr - avoid unannotated fall-through
  - platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL
  - selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len
  - selftests/x86: Add a test to detect infinite SIGTRAP handler loop
  - udmabuf: use sgtable-based scatterlist wrappers
  - net_sched: sch_sfq: reject invalid perturb period
  - scsi: s390: zfcp: Ensure synchronous unit_add
  - scsi: storvsc: Increase the timeouts to storvsc_timeout
  - smb: improve directory cache reuse for readdir operations
  - cifs: do not disable interface polling on failure
  - cifs: serialize other channels when query server interfaces is pending
  - cifs: deal with the channel loading lag while picking channels
  - LoongArch: Avoid using $r0/$r1 as "mask" for csrxchg
  - platform/loongarch: laptop: Unregister generic_sub_drivers on exit
  - platform/loongarch: laptop: Get brightness setting from EC on probe
  - io_uring: fix task leak issue in io_wq_create()
  - Revert "x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2" on v6.6 and older
  - powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery
  - powerpc/vdso: Fix build of VDSO32 with pcrel
  - platform/x86: dell_rbu: Stop overwriting data buffer
  - Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first"
  - tee: Prevent size calculation wraparound on 32-bit kernels
  - ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY
  - bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value
  - watchdog: da9052_wdt: respect TWDMIN
  - wifi: ath12k: Pass correct values of center freq1 and center freq2 for 160 MHz
  - wifi: ath12k: fix incorrect CE addresses
  - wifi: ath12k: fix link valid field initialization in the monitor Rx
  - wifi: ath11k: determine PM policy based on machine model
  - octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer()
  - bpf, sockmap: Fix data lost during EAGAIN retries
  - f2fs: fix to set atomic write status more clear
  - usbnet: asix AX88772: leave the carrier control to phylink
  - ice: fix check for existing switch rule
  - sock: Correct error checking condition for (assign|release)_proto_idx()
  - wifi: ath12k: fix failed to set mhi state error during reboot with hardware grouping
  - pinctrl: mcp23s08: Reset all pins to input at probe
  - net: ethernet: ti: am65-cpsw: handle -EPROBE_DEFER
  - vxlan: Do not treat dst cache initialization errors as fatal
  - net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions
  - net: bridge: mcast: update multicast contex when vlan state is changed
  - wifi: iwlwifi: Add missing MODULE_FIRMWARE for Qu-c0-jf-b0
  - wifi: mac80211: VLAN traffic in multicast path
  - wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled
  - wifi: iwlwifi: pcie: make sure to lock rxq->read
  - iommu/amd: Ensure GA log notifier callbacks finish running before module unload
  - scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands
  - libbpf: Add identical pointer detection to btf_dedup_is_equiv()
  - clk: rockchip: rk3036: mark ddrphy as critical
  - wifi: mac80211: do not offer a mesh path if forwarding is disabled
  - wireless: purelifi: plfxlc: fix memory leak in plfxlc_usb_wreq_asyn()
  - net: vertexcom: mse102x: Return code for mse102x_rx_pkt_spi
  - net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info
  - pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get()
  - pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction()
  - pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction()
  - pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name()
  - net: atlantic: generate software timestamp just before the doorbell
  - ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT
  - tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows
  - tcp: always seek for minimal rtt in tcp_rcv_rtt_update()
  - wifi: rtw89: leave idle mode when setting WEP encryption for AP mode
  - wifi: ath11k: Fix QMI memory reuse logic
  - wifi: ath12k: fix a possible dead lock caused by ab->base_lock
  - wifi: ath12k: fix macro definition HAL_RX_MSDU_PKT_LENGTH_GET
  - net: dlink: add synchronization for stats update
  - i2c: npcm: Add clock toggle recovery
  - cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs
  - sctp: Do not wake readers in __sctp_write_space()
  - wifi: mt76: mt7921: add 160 MHz AP for mt7922 device
  - wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R
  - emulex/benet: correct command version selection in be_cmd_get_stats()
  - wifi: mt76: mt7996: drop fragments with multicast or broadcast RA
  - i2c: designware: Invoke runtime suspend on quick slave re-registration
  - f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx
  - tipc: use kfree_sensitive() for aead cleanup
  - net: macb: Check return value of dma_set_mask_and_coherent()
  - ACPI: battery: negate current when discharging
  - PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn()
  - gpiolib: of: Add polarity quirk for s5m8767
  - ASoC: tegra210_ahub: Add check to of_device_get_match_data()
  - ACPICA: utilities: Fix overflow check in vsnprintf()
  - power: supply: bq27xxx: Retrieve again when busy
  - ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case
  - ACPI: bus: Bail out if acpi_kobj registration fails
  - ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change
  - ACPICA: Avoid sequence overread in call to strncmp()
  - mmc: Add quirk to disable DDR50 tuning
  - power: supply: collie: Fix wakeup source leaks on device unbind
  - clocksource: Fix the CPUs' choice in the watchdog per CPU verification
  - ASoC: amd: yc: Add quirk for Lenovo Yoga Pro 7 14ASP9
  - iio: adc: ad7606_spi: fix reg write value mask
  - iio: imu: inv_icm42600: Fix temperature calculation
  - iio: accel: fxls8962af: Fix temperature scan element sign
  - PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit()
  - PCI: Fix lock symmetry in pci_slot_unlock()
  - PCI: cadence-ep: Correct PBA offset in .set_msix() callback
  - uio_hv_generic: Use correct size for interrupt and monitor pages
  - Drivers: hv: Allocate interrupt and monitor pages aligned to system page boundary
  - cifs: dns resolution is needed only for primary channel
  - cifs: update dstaddr whenever channel iface is updated
  - cifs: reset connections for all channels when reconnect requested
  - remoteproc: core: Release rproc->clean_table after rproc_attach() fails
  - remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach()
  - regulator: max14577: Add error check for max14577_read_reg()
  - mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS
  - staging: iio: ad5933: Correct settling cycles encoding per datasheet
  - KVM: s390: rename PROT_NONE to PROT_TYPE_DUMMY
  - phy: fsl-imx8mq-usb: fix phy_tx_vboost_level_from_property()
  - mtd: rawnand: qcom: Fix read len for onfi param page
  - dm-verity: fix a memory leak if some arguments are specified multiple times
  - dm-mirror: fix a tiny race condition
  - KVM: VMX: Flush shadow VMCS on emergency reboot
  - KVM: SVM: Clear current_vmcb during vCPU free for all *possible* CPUs
  - mtd: nand: sunxi: Add randomizer configuration before randomizer enable
  - mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk
  - mm: fix ratelimit_pages update error in dirty_ratio_handler()
  - clk: meson-g12a: add missing fclk_div2 to spicc
  - parisc: fix building with gcc-15
  - vgacon: Add check for vc_origin address range in vgacon_scroll()
  - parisc/unaligned: Fix hex output to show 8 hex chars
  - EDAC/altera: Use correct write width with the INTTEST register
  - fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var
  - net: ftgmac100: select FIXED_PHY
  - Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer()
  - ext4: ensure i_size is smaller than maxbytes
  - ext4: factor out ext4_get_maxbytes()
  - ext4: fix calculation of credits for extent tree modification
  - bus: fsl-mc: fix GET/SET_TAILDROP command ids
  - bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device
  - cgroup,freezer: fix incomplete freezing when attaching tasks
  - ceph: set superblock s_magic for IMA fsmagic matching
  - can: tcan4x5x: fix power regulator retrieval during probe
  - bus: mhi: host: Fix conflict between power_up and SYSERR
  - bus: mhi: ep: Update read pointer only after buffer is written
  - ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4
  - ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap()
  - arm64/mm: Close theoretical race where stale TLB entry remains valid
  - media: uvcvideo: Fix deferred probing error
  - media: uvcvideo: Send control events for partial succeeds
  - media: uvcvideo: Return the number of processed controls
  - media: imx-jpeg: Reset slot data pointers when freed
  - media: imx-jpeg: Drop the first error frames
  - media: videobuf2: use sgtable-based scatterlist wrappers
  - media: venus: Fix probe error handling
  - media: v4l2-dev: fix error handling in __video_register_device()
  - media: omap3isp: use sgtable-based scatterlist wrappers
  - media: mediatek: vcodec: Correct vsi_core framebuffer size
  - media: gspca: Add error handling for stv06xx_read_sensor()
  - media: davinci: vpif: Fix memory leak in probe error path
  - media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case
  - media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div
  - media: ccs-pll: Start OP pre-PLL multiplier search from correct value
  - media: ccs-pll: Start VT pre-PLL multiplier search from correct value
  - media: i2c: ds90ub913: Fix returned fmt from .set_fmt()
  - media: nxp: imx8-isi: better handle the m2m usage_count
  - media: ov5675: suppress probe deferral errors
  - media: ov8856: suppress probe deferral errors
  - wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723
  - wifi: rtw88: usb: Reduce control message timeout to 500 ms
  - wifi: ath12k: fix ring-buffer corruption
  - SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls
  - wifi: ath11k: fix ring-buffer corruption
  - wifi: ath11k: fix rx completion meta data corruption
  - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid()
  - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr()
  - regulator: max20086: Change enable gpio to optional
  - regulator: max20086: Fix MAX200086 chip id
  - powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states
  - io_uring/kbuf: account ring io_buffer_list memory
  - io_uring: account drain memory to cgroup
  - ASoC: meson: meson-card-utils: use of_property_present() for DT parsing
  - ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params()
  - gfs2: move msleep to sleepable context
  - crypto: marvell/cesa - Do not chain submitted requests
  - configfs: Do not override creating attribute file failure in populate_attrs()
  - !19787  ima: Handle error code returned by ima_filter_rule_match()
  - !20207  *** fix CVE-2025-37800 ***
  - !20248  sched/fair: Track idle balance interval with idle_stamp in balance_fair
  - !20179 v3  oenetcls: add a switch to enable/disable checking NIC ntuple feature
  - ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params
  - !20263 Fix CVE-2025-40311
  - urma: fix dereference of null_ptr for uobj
  - !19549  NFSD: free copynotify stateid in nfs4_free_ol_stateid()
  - !20147  fuse: fix readahead reclaim deadlock
  - !20146  fuse: fix io-uring list corruption for terminated non-committed requests
  - !20145  fuse: missing copy_finish in fuse-over-io-uring argument copies
  - !20144  fsnotify: do not generate ACCESS/MODIFY events on child for special files
  - !19482  NFSD: Define a proc_layoutcommit for the FlexFiles layout type
  - !19483  ksmbd: fix refcount leak causing resource not released
  - !19484  NFSD: fix race between nfsd registration and exports_proc
  - accel/habanalabs: support mapping cb with vmalloc-backed coherent memory
  - !19989  proc: fix missing pde_set_flags() for net proc files
  - sched/fair: Track idle balance interval with idle_stamp in balance_fair
  - !19990  Fix SDEI state machine issue during reboot process
  - !20024 [OLK-6.6] backport irqchip/gic-v4.1: Use local 4_1 ITS to generate VSGI from upstream linux-6.16.rc1
  - !20217 [OLK-6.6][linux-6.6.y sync] Backport 6.6.93-6.6.94 LTS Patches
  - !20070 [OLK-6.6] Merge continuous pages into a large range when notifying range enc status changes
  - ACPI: CPPC: Perform fast check switch only for online CPUs
  - arm64: dts: ti: k3-j721e-sk: Fix pinmux for pin Y1 used by power regulator
  - serial: sh-sci: Check that the DMA cookie is valid
  - thunderbolt: Fix wake on connect at runtime
  - bonding: set random address only when slaves already exist
  - drm/mediatek: Fix device use-after-free on unbind
  - rtc: Optimize calculations in rtc_time64_to_tm()
  - !20170  perf/x86/amd: Check event before enable to avoid GPF
  - !20069 ub: cdma: jfs 64K page table memory adaptation
  - !20224  crypto: af_alg - zero initialize memory allocated via sock_kmalloc
  - !20027 [OLK-6.6]Enhance CMA memory usage reporting for CSV3
  - crypto: af_alg - zero initialize memory allocated via sock_kmalloc
  - drm/meson: Use 1000ULL when operating with mode->clock
  - regulator: dt-bindings: mt6357: Drop fixed compatible requirement
  - xen/arm: call uaccess_ttbr0_enable for dm_op hypercall
  - usb: typec: tcpm/tcpci_maxim: Fix bounds check in process_rx()
  - usb: Flush altsetting 0 endpoints before reinitializating them after reset.
  - usb: cdnsp: Fix issue with detecting USB 3.2 speed
  - usb: cdnsp: Fix issue with detecting command completion event
  - kbuild: Disable -Wdefault-const-init-unsafe
  - Revert "io_uring: ensure deferred completions are posted for multishot"
  - io_uring/rw: fix wrong NOWAIT check in io_rw_init_file()
  - io_uring/rw: allow pollable non-blocking attempts for !FMODE_NOWAIT
  - io_uring: add io_file_can_poll() helper
  - ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1
  - tools/resolve_btfids: Fix build when cross compiling kernel with clang.
  - block: Fix bvec_set_folio() for very large folios
  - bio: Fix bio_first_folio() for SPARSEMEM without VMEMMAP
  - perf: Ensure bpf_perf_link path is properly serialized
  - nvmet-fcloop: access fcpreq only when holding reqlock
  - fs/filesystems: Fix potential unsigned integer underflow in fs_name()
  - net_sched: tbf: fix a race in tbf_change()
  - net/mlx5e: Fix leak of Geneve TLV option object
  - net/mlx5: Fix return value when searching for existing flow group
  - net/mlx5: Ensure fw pages are always allocated on same NUMA
  - Bluetooth: hci_sync: Fix broadcast/PA when using an existing instance
  - Bluetooth: Fix NULL pointer deference on eir_get_service_data
  - net/mdiobus: Fix potential out-of-bounds clause 45 read/write access
  - net/mdiobus: Fix potential out-of-bounds read/write access
  - macsec: MACsec SCI assignment for ES = 0
  - ACPI: CPPC: Fix NULL pointer dereference when nosmp is used
  - i40e: retry VFLR handling if there is ongoing VF reset
  - i40e: return false from i40e_reset_vf if reset is in progress
  - drm/meson: fix more rounding issues with 59.94Hz modes
  - drm/meson: use vclk_freq instead of pixel_freq in debug print
  - drm/meson: fix debug log statement when setting the HDMI clocks
  - drm/meson: use unsigned long long / Hz for frequency types
  - scsi: iscsi: Fix incorrect error path labels for flashnode operations
  - pinctrl: qcom: pinctrl-qcm2290: Add missing pins
  - wifi: ath11k: validate ath11k_crypto_mode on top of ath11k_core_qmi_firmware_ready
  - wifi: ath11k: don't wait when there is no vdev started
  - wifi: ath11k: don't use static variables in ath11k_debugfs_fw_stats_process()
  - wifi: ath11k: avoid burning CPU in ath11k_debugfs_fw_stats_request()
  - wifi: ath11k: convert timeouts to secs_to_jiffies()
  - wifi: ath11k: fix soc_dp_stats debugfs file permission
  - ath10k: snoc: fix unbalanced IRQ enable in crash recovery
  - Bluetooth: hci_core: fix list_for_each_entry_rcu usage
  - serial: sh-sci: Clean sci_ports[0] after at earlycon exit
  - serial: sh-sci: Move runtime PM enable to sci_probe_single()
  - serial: sh-sci: Check if TX data was written to device in .tx_empty()
  - arm64: dts: ti: k3-j721e-sk: Add DT nodes for power regulators
  - arm64: dts: ti: k3-j721e-sk: Add support for multiple CAN instances
  - arm64: dts: ti: k3-j721e-sk: Model CSI2RX connector mux
  - arm64: dts: ti: k3-am65-main: Add missing taps to sdhci0
  - arm64: dts: ti: k3-am65-main: Fix sdhci node properties
  - kasan: use unchecked __memset internally
  - Input: synaptics-rmi - fix crash with unsupported versions of F34
  - pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id()
  - ASoC: ti: omap-hdmi: Re-add dai_link->platform to fix card init
  - ASoC: Intel: avs: Verify content returned by parse_int_array()
  - ASoC: Intel: avs: Fix deadlock when the failing IPC is SET_D0IX
  - ASoC: codecs: hda: Fix RPM usage count underflow
  - scsi: ufs: qcom: Prevent calling phy_exit() before phy_init()
  - wireguard: device: enable threaded NAPI
  - net: dsa: b53: allow RGMII for bcm63xx RGMII ports
  - net: dsa: b53: do not enable RGMII delay on bcm63xx
  - netfilter: nf_nat: also check reverse tuple to obtain clashing entry
  - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO
  - vmxnet3: correctly report gso type for UDP tunnels
  - net: wwan: t7xx: Fix napi rx poll issue
  - net: dsa: tag_brcm: legacy: fix pskb_may_pull length
  - ice: fix rebuilding the Tx scheduler tree for large queue counts
  - ice: create new Tx scheduler nodes for new queues only
  - Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION
  - spi: bcm63xx-hsspi: fix shared reset
  - spi: bcm63xx-spi: fix shared reset
  - net: lan966x: Make sure to insert the vlan tags also in host mode
  - net/mlx4_en: Prevent potential integer overflow calculating Hz
  - driver: net: ethernet: mtk_star_emac: fix suspend/resume issue
  - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt
  - net: stmmac: platform: guarantee uniqueness of bus_id
  - vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl()
  - coresight: prevent deactivate active config while enabling the config
  - counter: interrupt-cnt: Protect enable/disable OPs with mutex
  - MIPS: Loongson64: Add missing '#interrupt-cells' for loongson64c_ls7a
  - iio: adc: ad7124: Fix 3dB filter frequency reading
  - iio: filter: admv8818: Support frequencies >= 2^32
  - iio: filter: admv8818: fix range calculation
  - iio: filter: admv8818: fix integer overflow
  - iio: filter: admv8818: fix band 4, state 15
  - thunderbolt: Fix a logic error in wake on connect
  - rtc: loongson: Add missing alarm notifications for ACPI RTC events
  - PCI/DPC: Initialize aer_err_info before using it
  - PCI: apple: Use gpiod_set_value_cansleep in probe flow
  - PCI: cadence: Fix runtime atomic count underflow
  - PCI: Print the actual delay time in pci_bridge_wait_for_secondary_bus()
  - rtc: sh: assign correct interrupts with DT
  - cifs: Fix validation of SMB1 query reparse point response
  - perf trace: Always print return value for syscalls returning a pid
  - perf record: Fix incorrect --user-regs comments
  - perf tests switch-tracking: Fix timestamp comparison
  - mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE
  - mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove()
  - rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send()
  - remoteproc: k3-r5: Drop check performed in k3_r5_rproc_{mbox_callback/kick}
  - remoteproc: qcom_wcnss_iris: Add missing put_device() on error in probe
  - perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3
  - perf intel-pt: Fix PEBS-via-PT data_src
  - perf trace: Fix leaks of 'struct thread' in set_filter_loop_pids()
  - dm-flakey: make corrupting read bios work
  - dm-flakey: error all IOs when num_features is absent
  - mtd: nand: ecc-mxic: Fix use of uninitialized variable ret
  - dm: free table mempools if not used in __bind
  - dm: don't change md if dm_table_set_restrictions() fails
  - perf ui browser hists: Set actions->thread before calling do_zoom_thread()
  - perf build: Warn when libdebuginfod devel files are not available
  - randstruct: gcc-plugin: Fix attribute addition
  - randstruct: gcc-plugin: Remove bogus void member
  - soc: aspeed: lpc: Fix impossible judgment condition
  - ARM: aspeed: Don't select SRAM
  - arm64: dts: mt6359: Rename RTC node to match binding expectations
  - arm64: dts: renesas: white-hawk-ard-audio: Fix TPU0 groups
  - arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou
  - arm64: defconfig: mediatek: enable PHY drivers
  - ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device
  - ARM: dts: qcom: apq8064: add missing clocks to the timer node
  - dt-bindings: vendor-prefixes: Add Liontron name
  - nilfs2: do not propagate ENOENT error from nilfs_btree_propagate()
  - nilfs2: add pointer check for nilfs_direct_propagate()
  - ocfs2: fix possible memory leak in ocfs2_finish_quota_recovery
  - arm64: dts: ti: k3-j721e-common-proc-board: Enable OSPI1 on J721E
  - arm64: tegra: Drop remaining serial clock-names and reset-names
  - arm64: dts: rockchip: Update eMMC for NanoPi R5 series
  - arm64: dts: qcom: sda660-ifc6560: Fix dt-validate warning
  - arm64: dts: qcom: sdm660-lavender: Add missing USB phy supply
  - arm64: dts: mt6359: Add missing 'compatible' property to regulators node
  - arm64: dts: mediatek: mt6357: Drop regulator-fixed compatibles
  - arm64: dts: imx8mn-beacon: Set SAI5 MCLK direction to output for HDMI audio
  - arm64: dts: imx8mm-beacon: Set SAI5 MCLK direction to output for HDMI audio
  - arm64: dts: imx8mp-beacon: Fix RTC capacitive load
  - arm64: dts: imx8mn-beacon: Fix RTC capacitive load
  - arm64: dts: imx8mm-beacon: Fix RTC capacitive load
  - arm64: dts: qcom: sdm660-xiaomi-lavender: Add missing SD card detect GPIO
  - arm64: dts: mediatek: mt8195: Reparent vdec1/2 and venc1 power domains
  - ARM: dts: at91: at91sam9263: fix NAND chip selects
  - ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select
  - arm64: dts: qcom: sc8280xp-x13s: Drop duplicate DMIC supplies
  - arm64: dts: qcom: sm8250: Fix CPU7 opp table
  - arm64: dts: qcom: sm8350: Reenable crypto & cryptobam
  - arm64: dts: qcom: sdm845-starqltechn: remove excess reserved gpios
  - arm64: dts: qcom: sdm845-starqltechn: refactor node order
  - arm64: dts: qcom: sdm845-starqltechn: fix usb regulator mistake
  - arm64: dts: qcom: sdm845-starqltechn: remove wifi
  - f2fs: fix to correct check conditions in f2fs_cross_rename
  - f2fs: use d_inode(dentry) cleanup dentry->d_inode
  - net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames
  - octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback
  - net: phy: mscc: Fix memory leak when using one step timestamping
  - net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy
  - net: phy: fix up const issues in to_mdio_device() and to_phy_device()
  - net: phy: clear phydev->devlink when the link is deleted
  - net: lan966x: Fix 1-step timestamping over ipv4 or ipv6
  - RISC-V: KVM: lock the correct mp_state during reset
  - netfilter: nft_tunnel: fix geneve_opt dump
  - Bluetooth: MGMT: iterate over mesh commands in mgmt_mesh_foreach()
  - vfio/type1: Fix error unwind in migration dirty bitmap allocation
  - netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy
  - wifi: mt76: mt7996: fix RX buffer size of MCU event
  - wifi: mt76: mt7996: set EHT max ampdu length capability
  - scsi: ufs: mcq: Delete ufshcd_release_scsi_cmd() in ufshcd_mcq_abort()
  - wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event
  - iommu: remove duplicate selection of DMAR_TABLE
  - s390/bpf: Store backchain even for leaf progs
  - clk: qcom: gcc-msm8939: Fix mclk0 & mclk1 for 24 MHz
  - libbpf: Use proper errno value in nlattr
  - ktls, sockmap: Fix missing uncharge operation
  - tracing: Fix error handling in event_trigger_parse()
  - tracing: Rename event_trigger_alloc() to trigger_data_alloc()
  - efi/libstub: Describe missing 'out' parameter in efi_load_initrd
  - clk: qcom: gpucc-sm6350: Add *_wait_val values for GDSCs
  - clk: qcom: gcc-sm6350: Add *_wait_val values for GDSCs
  - clk: qcom: dispcc-sm6350: Add *_wait_val values for GDSCs
  - clk: qcom: camcc-sm6350: Add *_wait_val values for GDSCs
  - bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ
  - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction
  - netfilter: nft_quota: match correctly when the quota just depleted
  - netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it
  - libbpf: Use proper errno value in linker
  - f2fs: fix to detect gcing page in f2fs_is_cp_guaranteed()
  - f2fs: clean up w/ fscrypt_is_bounce_page()
  - bonding: assign random address if device address is same as bond
  - iommu: Protect against overflow in iommu_pgsize()
  - Use thread-safe function pointer in libbpf_print
  - libbpf: Remove sample_period init in perf_buffer
  - wifi: ath12k: Add MSDU length validation for TKIP MIC error
  - wifi: rtw88: do not ignore hardware read error during DPK
  - wifi: rtw88: sdio: call rtw_sdio_indicate_tx_status unconditionally
  - wifi: rtw88: sdio: map mgmt frames to queue TX_DESC_QSEL_MGMT
  - xfrm: Use xdo.dev instead of xdo.real_dev
  - libbpf: Fix buffer overflow in bpf_object__init_prog
  - net: ncsi: Fix GCPS 64-bit member variables
  - wifi: ath12k: Fix WMI tag for EHT rate in peer assoc
  - selftests/bpf: Fix bpf_nf selftest failure
  - IB/cm: use rwlock for MAD agent lock
  - drm/mediatek: mtk_drm_drv: Unbind secondary mmsys components on err
  - drm/mediatek: Fix kobject put for component sub-drivers
  - drm/mediatek: mtk_drm_drv: Fix kobject put for mtk_mutex device ptr
  - scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops
  - x86/cpu: Rename and move CPU model entry for Diamond Rapids
  - x86/cpu: Add two Intel CPU model numbers
  - !20099 v2  xsched: Add XSched manual
  - firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES
  - drm/tegra: rgb: Fix the unbound reference count
  - drm/vkms: Adjust vkms_state->active_planes allocation type
  - drm: rcar-du: Fix memory leak in rcar_du_vsps_init()
  - selftests/seccomp: fix syscall_restart test for arm compat
  - arm64: Support ARM64_VA_BITS=52 when setting ARCH_MMAP_RND_BITS_MAX
  - firmware: psci: Fix refcount leak in psci_dt_init
  - m68k: mac: Fix macintosh_config for Mac II
  - watchdog: exar: Shorten identity name to fit correctly
  - drm/bridge: lt9611uxc: Fix an error handling path in lt9611uxc_probe()
  - arm64/fpsimd: Fix merging of FPSIMD state during signal return
  - arm64/fpsimd: Avoid RES0 bits in the SME trap handler
  - media: rkvdec: Fix frame size enumeration
  - drm/vc4: tests: Use return instead of assert
  - drm/vmwgfx: Add seqno waiter for sync_files
  - ASoC: apple: mca: Constrain channels according to TDM mask
  - spi: sh-msiof: Fix maximum DMA transfer size
  - ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions"
  - PM: sleep: Print PM debug messages during hibernation
  - x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges()
  - PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks()
  - ASoC: SOF: ipc4-pcm: Adjust pipeline_list->pipelines allocation type
  - power: reset: at91-reset: Optimize at91_reset()
  - spi: tegra210-quad: modify chip select (CS) deactivation
  - spi: tegra210-quad: remove redundant error handling code
  - !20076  smb3: fix for slab out of bounds on mount to ksmbd
  - spi: tegra210-quad: Fix X1_X2_X4 encoding and support x4 transfers
  - ASoC: tas2764: Enable main IRQs
  - ACPICA: exserial: don't forget to handle FFixedHW opregions for reading
  - kunit: Fix wrong parameter to kunit_deactivate_static_stub()
  - crypto: sun8i-ce - move fallback ahash_request to the end of the struct
  - crypto: xts - Only add ecb if it is not already there
  - crypto: lrw - Only add ecb if it is not already there
  - rcu/cpu_stall_cputime: fix the hardirq count for x86 architecture
  - btrfs: scrub: fix a wrong error type when metadata bytenr mismatches
  - btrfs: scrub: update device stats when an error is detected
  - crypto: marvell/cesa - Avoid empty transfer descriptor
  - x86/cpu: Sanitize CPUID(0x80000000) output
  - x86/microcode/AMD: Do not return error when microcode update is not necessary
  - powerpc: do not build ppc_save_regs.o always
  - crypto: sun8i-ss - do not use sg_dma_len before calling DMA functions
  - perf/core: Fix broken throttling when max_samples_per_tick=1
  - gfs2: gfs2_create_inode error handling fix
  - crypto: sun8i-ce-hash - fix error handling in sun8i_ce_hash_run()
  - tools/x86/kcpuid: Fix error handling
  - dt-bindings: phy: imx8mq-usb: fix fsl,phy-tx-vboost-level-microvolt property
  - dt-bindings: usb: cypress,hx3: Add support for all variants
  - usb: usbtmc: Fix timeout value in get_stb
  - Bluetooth: hci_qca: move the SoC type check to the right place
  - usb: typec: ucsi: fix Clang -Wsign-conversion warning
  - USB: serial: pl2303: add new chip PL2303GC-Q20 and PL2303GT-2AB
  - usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device
  - usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE
  - rtc: Fix offset calculation for .start_secs < 0
  - rtc: Make rtc_time64_to_tm() support dates before 1970
  - pinctrl: armada-37xx: set GPIO output value before setting direction
  - pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs > 31
  - !18475 [OLK-6.6] x86/kvm: expose CPUID 0xC000_0000 for Zhaoxin "Shanghai" vendor
  - driver core: fix potential NULL pointer dereference in dev_uevent()
  - Revert "Revert "Revert "driver core: Fix uevent_show() vs driver detach race"""
  - !19893  nbd: defer config unlock in nbd_genl_connect
  - !19892  nbd: defer config put in recv_work
  - !19890  md: fix rcu protection in md_wakeup_thread
  - !19889  nvme-multipath: fix lockdep WARN due to partition scan work
  - !19835  blk-cgroup: fix possible deadlock while configuring policy
  - !19815  scsi: sg: Do not sleep in atomic context
  - !20162  tracing: Fix enabling of tracing on file release
  - !20110  macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse
  - !20164  powerpc/kexec: Enable SMT before waking offline CPUs
  - !20149  tracing: Do not register unsupported perf events
  - !20153  iavf: fix off-by-one issues in iavf_config_rss_reg()
  - !20152  e1000: fix OOB in e1000_tbi_should_accept()
  - !20140  mlxsw: spectrum_router: Fix neighbour use-after-free
  - !20139  mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats
  - !20118 [OLK-6.6][linux-6.6.y sync] Backport 6.6.92-6.6.93 LTS Patches
  - !19756  erofs: avoid infinite loops due to corrupted subpage compact indexes
  - !19107 mptcp: Fix proto fallback detection with BPF
  - !20128  NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags
  - !20000  cifs: fix memory leak in smb3_fs_context_parse_param error path
  - !20001  smb: client: fix memory leak in cifs_construct_tcon()
  - !20002  CVE-2025-40328
  - !19999  smb: client: fix potential cfid UAF in smb2_query_info_compound
  - !19998  cifs: client: fix memory leak in smb3_fs_context_parse_param
  - !20094  CVE-2025-40099
  - !20089  smb: client: Fix refcount leak for cifs_sb_tlink
  - !20088  ceph: fix race condition validating r_parent before applying state
  - !20086  smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path
  - !20081  CVE-2025-39798
  - !20078  NFS: Fix filehandle bounds checking in nfs_fh_to_dentry()
  - !20077  NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN
  - !20075  smb: client: fix potential deadlock when reconnecting channels
  - !20074  smb: client: add NULL check in automount_fullpath
  - !20071  smb: client: Avoid race in open_cached_dir with lease breaks
  - !19945  fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
  - !19021  memcg: enable asynchronous reclaim for cgroup-v2
  - net/oenetcls: add a switch to enable/disable checking NIC ntuple feature
  - net/oenetcls: Balancing softirq to improve performance
  - perf/x86/amd: Check event before enable to avoid GPF
  - af_unix: Initialise scc_index in unix_add_edge().
  - wifi: rtw89: avoid circular locking dependency in ser_state_run()
  - Revert "leds: trigger: netdev: Configure LED blink interval for HW offload"
  - ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask()
  - Revert "cpuidle: menu: Avoid discarding useful information"
  - cpuidle: governors: menu: Avoid using invalid recent intervals data
  - ASoC: ops: dynamically allocate struct snd_ctl_elem_value
  - cpufreq: tegra186: Set target frequency for all cpus in policy
  - Revert "mmc: sdhci: Disable SD card clock before changing parameters"
  - soc: qcom: smp2p: Fix fallback to qcom,ipc parse
  - rpmsg: qcom_smd: Fix fallback to qcom,ipc parse
  - Revert "SUNRPC: Don't allow waiting for exiting tasks"
  - nvmem: imx-ocotp: fix MAC address byte length
  - phy: renesas: rcar-gen3-usb2: Fix an error handling path in rcar_gen3_phy_usb2_probe()
  - ksmbd: use list_first_entry_or_null for opinfo_get_list()
  - net: ethernet: ti: am65-cpsw: Lower random mac address error print to info
  - platform/x86: fujitsu-laptop: Support Lifebook S2110 hotkeys
  - NFS: Avoid flushing data while holding directory locks in nfs_rename()
  - nvme-pci: add NVME_QUIRK_NO_DEEPEST_PS quirk for SOLIDIGM P44 Pro
  - spi: spi-sun4i: fix early activation
  - phy: starfive: jh7110-usb: Fix USB 2.0 host occasional detection failure
  - drm/amd/display: fix link_set_dpms_off multi-display MST corner case
  - um: let 'make clean' properly clean underlying SUBARCH as well
  - platform/x86: thinkpad_acpi: Support also NEC Lavie X1475JAS
  - nfs: don't share pNFS DS connections between net namespaces
  - HID: quirks: Add ADATA XPG alpha wireless mouse support
  - dmaengine: idxd: cdev: Fix uninitialized use of sva in idxd_cdev_open
  - coredump: fix error handling for replace_fd()
  - perf/arm-cmn: Initialise cmn->cpu earlier
  - perf/arm-cmn: Fix REQ2/SNP2 mixup
  - arm64: dts: ti: k3-am68-sk: Fix regulator hierarchy
  - arm64: dts: qcom: sm8550: Add missing properties for cryptobam
  - arm64: dts: qcom: sm8450: Add missing properties for cryptobam
  - arm64: dts: qcom: sm8350: Fix typo in pil_camera_mem node
  - arm64: dts: qcom: ipq9574: Add missing properties for cryptobam
  - af_unix: Fix uninit-value in __unix_walk_scc()
  - af_unix: Fix garbage collection of embryos carrying OOB with SCM_RIGHTS
  - af_unix: Add dead flag to struct scm_fp_list.
  - af_unix: Don't access successor in unix_del_edges() during GC.
  - af_unix: Try not to hold unix_gc_lock during accept().
  - af_unix: Remove lock dance in unix_peek_fds().
  - af_unix: Replace garbage collection algorithm.
  - af_unix: Detect dead SCC.
  - af_unix: Assign a unique index to SCC.
  - af_unix: Avoid Tarjan's algorithm if unnecessary.
  - af_unix: Skip GC if no cycle exists.
  - af_unix: Save O(n) setup of Tarjan's algo.
  - af_unix: Fix up unix_edge.successor for embryo socket.
  - af_unix: Save listener for embryo socket.
  - af_unix: Detect Strongly Connected Components.
  - af_unix: Iterate all vertices by DFS.
  - af_unix: Bulk update unix_tot_inflight/unix_inflight when queuing skb.
  - af_unix: Link struct unix_edge when queuing skb.
  - af_unix: Allocate struct unix_edge for each inflight AF_UNIX fd.
  - af_unix: Allocate struct unix_vertex for each inflight AF_UNIX fd.
  - af_unix: Remove CONFIG_UNIX_SCM.
  - af_unix: Remove io_uring code for GC.
  - af_unix: Replace BUG_ON() with WARN_ON_ONCE().
  - af_unix: Try to run GC async.
  - af_unix: Run GC on only one CPU.
  - af_unix: Return struct unix_sock from unix_get_socket().
  - can: kvaser_pciefd: Force IRQ edge in case of nested IRQ
  - drm/gem: Internally test import_attach for imported objects
  - x86/mm/init: Handle the special case of device private pages in add_pages(), to not increase max_pfn and trigger dma_addressing_limited() bounce buffers bounce buffers
  - i3c: master: svc: Fix implicit fallthrough in svc_i3c_master_ibi_work()
  - pinctrl: tegra: Fix off by one in tegra_pinctrl_get_group()
  - watchdog: aspeed: fix 64-bit division
  - serial: sh-sci: Save and restore more registers
  - highmem: add folio_test_partial_kmap()
  - spi: spi-fsl-dspi: Reset SR flags before sending a new message
  - spi: spi-fsl-dspi: Halt the module after a new message transfer
  - spi: spi-fsl-dspi: restrict register range for regmap access
  - Revert "arm64: dts: allwinner: h6: Use RSB for AXP805 PMIC connection"
  - Input: xpad - add more controllers
  - smb: client: Reset all search buffer pointers when releasing buffer
  - arm64: dts: marvell: uDPU: define pinctrl state for alarm LEDs
  - smb: client: Fix use-after-free in cifs_fill_dirent
  - drm/edid: fixed the bug that hdr metadata was not reset
  - thermal: intel: x86_pkg_temp_thermal: Fix bogus trip temperature
  - can: kvaser_pciefd: Continue parsing DMA buf after dropped RX
  - llc: fix data loss when reading from a socket in llc_ui_recvmsg()
  - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14ASP10
  - ASoC: SOF: ipc4-pcm: Delay reporting is only supported for playback direction
  - ASoc: SOF: topology: connect DAI to a single DAI link
  - ASoC: SOF: ipc4-control: Use SOF_CTRL_CMD_BINARY as numid for bytes_ext
  - can: slcan: allow reception of short error messages
  - clk: s2mps11: initialise clk_hw_onecell_data::num before accessing ::hws[] in probe()
  - octeontx2-af: Fix APR entry mapping based on APR_LMT_CFG
  - octeontx2-af: Set LMT_ENA bit for APR table entries
  - octeontx2-pf: Add AF_XDP non-zero copy support
  - io_uring: fix overflow resched cqe reordering
  - net: lan743x: Restore SGMII CTRL register on resume
  - net: dwmac-sun8i: Use parsed internal PHY address instead of 1
  - pinctrl: qcom: switch to devm_register_sys_off_handler()
  - pinctrl: qcom/msm: Convert to platform remove callback returning void
  - ice: Fix LACP bonds without SRIOV environment
  - ice: fix vf->num_mac count with port representors
  - bridge: netfilter: Fix forwarding of fragmented packets
  - Bluetooth: btusb: use skb_pull to avoid unsafe access in QCA dump handling
  - dmaengine: fsl-edma: Fix return code for unhandled interrupts
  - dmaengine: idxd: Fix ->poll() return value
  - xfrm: Sanitize marks before insert
  - clk: sunxi-ng: d1: Add missing divider for MMC mod clocks
  - remoteproc: qcom_wcnss: Fix on platforms without fallback regulators
  - dmaengine: idxd: Fix allowing write() from different address spaces
  - soundwire: bus: Fix race on the creation of the IRQ domain
  - xenbus: Allow PVH dom0 a non-local xenstore
  - wifi: iwlwifi: add support for Killer on MTL
  - tools: ynl-gen: validate 0 len strings from kernel
  - cifs: Fix changing times and read-only attr over SMB1 smb_set_file_info() function
  - cifs: Fix and improve cifs_query_path_info() and cifs_query_file_info()
  - io_uring/fdinfo: annotate racy sq/cq head/tail reads
  - nvme-pci: add quirks for WDC Blue SN550 15b7:5009
  - nvme-pci: add quirks for device 126f:1001
  - ALSA: hda/realtek: Add quirk for HP Spectre x360 15-df1xxx
  - ASoC: Intel: bytcr_rt5640: Add DMI quirk for Acer Aspire SW3-013
  - ASoC: cs42l43: Disable headphone clamps during type detection
  - pinctrl: meson: define the pull up/down resistor value as 60 kOhm
  - book3s64/radix: Fix compile errors when CONFIG_ARCH_WANT_OPTIMIZE_DAX_VMEMMAP=n
  - ASoC: imx-card: Adjust over allocation of memory in imx_card_parse_of()
  - drm: Add valid clones check
  - drm/panel-edp: Add Starry 116KHD024006
  - drm/atomic: clarify the rules around drm_atomic_state->allow_modeset
  - drm: bridge: adv7511: fill stream capabilities
  - wifi: ath12k: Fix end offset bit definition in monitor ring descriptor
  - wifi: ath9k: return by of_get_mac_address
  - accel/qaic: Mask out SR-IOV PCI resources
  - wifi: ath12k: fix ath12k_hal_tx_cmd_ext_desc_setup() info1 override
  - regulator: ad5398: Add device tree support
  - spi: zynqmp-gqspi: Always acknowledge interrupts
  - wifi: rtw89: add wiphy_lock() to work that isn't held wiphy_lock() yet
  - wifi: rtw88: Don't use static local variable in rtw8822b_set_tx_power_index_by_rate
  - wifi: rtl8xxxu: retry firmware download on error
  - perf/amd/ibs: Fix ->config to sample period calculation for OP PMU
  - perf/amd/ibs: Fix perf_ibs_op.cnt_mask for CurCnt
  - firmware: arm_scmi: Relax duplicate name constraint across protocol ids
  - bpftool: Fix readlink usage in get_fd_type
  - drm/ast: Find VBIOS mode from regular display size
  - ASoC: rt722-sdca: Add some missing readable registers
  - ASoC: codecs: pcm3168a: Allow for 24-bit in provider mode
  - arm64: zynqmp: add clock-output-names property in clock nodes
  - HID: usbkbd: Fix the bit shift number for LED_KANA
  - wifi: ath12k: Avoid napi_sync() before napi_enable()
  - scsi: st: Restore some drive settings after reset
  - scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine
  - net/mana: fix warning in the writer of client oob
  - ice: count combined queues using Rx/Tx count
  - rcu: fix header guard for rcu_all_qs()
  - rcu: handle unstable rdp in rcu_read_unlock_strict()
  - rcu: handle quiescent states for PREEMPT_RCU=n, PREEMPT_COUNT=y
  - ice: treat dyn_allowed only as suggestion
  - bridge: mdb: Allow replace of a host-joined group
  - r8169: don't scan PHY addresses > 0
  - ipv4: ip_gre: Fix set but not used warning in ipgre_err() if IPv4-only
  - vxlan: Annotate FDB data races
  - media: qcom: camss: csid: Only add TPG v4l2 ctrl if TPG hardware is available
  - f2fs: introduce f2fs_base_attr for global sysfs entries
  - hwmon: (xgene-hwmon) use appropriate type for the latency value
  - clk: qcom: camcc-sm8250: Use clk_rcg2_shared_ops for some RCGs
  - wifi: rtw88: Fix __rtw_download_firmware() for RTL8814AU
  - wifi: rtw88: Fix download_firmware_validate() for RTL8814AU
  - ext4: remove writable userspace mappings before truncating page cache
  - ext4: don't write back data before punch hole in nojournal mode
  - leds: trigger: netdev: Configure LED blink interval for HW offload
  - pstore: Change kmsg_bytes storage size to u32
  - r8152: add vendor/device ID pair for Dell Alienware AW1022z
  - ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure().
  - arch/powerpc/perf: Check the instruction type before creating sample with perf_mem_data_src
  - powerpc/pseries/iommu: memory notifier incorrectly adds TCEs for pmemory
  - net: fec: Refactor MAC reset to function
  - wifi: mac80211: remove misplaced drv_mgd_complete_tx() call
  - wifi: mac80211: don't unconditionally call drv_mgd_complete_tx()
  - drm/v3d: Add clock handling
  - net/mlx5e: reduce the max log mpwrq sz for ECPF and reps
  - net/mlx5e: reduce rep rxq depth to 256 for ECPF
  - net/mlx5e: set the tx_queue_len for pfifo_fast
  - net/mlx5: Extend Ethtool loopback selftest to support non-linear SKB
  - scsi: target: spc: Fix loop traversal in spc_rsoc_get_descr()
  - drm/amd/display/dm: drop hw_support check in amdgpu_dm_i2c_xfer()
  - drm/amdgpu: enlarge the VBIOS binary size limit
  - drm/amd/display: Initial psr_version with correct setting
  - drm/amd/display: Update CR AUX RD interval interpretation
  - drm/amdgpu: reset psp->cmd to NULL after releasing the buffer
  - drm/amd/display: Don't try AUX transactions on disconnected link
  - drm/amdgpu: Set snoop bit for SDMA for MI series
  - soundwire: amd: change the soundwire wake enable/disable sequence
  - phy: core: don't require set_mode() callback for phy_get_mode() to work
  - serial: sh-sci: Update the suspend/resume support
  - sched: Reduce the default slice to avoid tasks getting an extra tick
  - x86/traps: Cleanup and robustify decode_bug()
  - clk: qcom: clk-alpha-pll: Do not use random stack value for recalc rate
  - clk: qcom: ipq5018: allow it to be bulid on arm32
  - net/mlx4_core: Avoid impossible mlx4_db_alloc() order value
  - media: v4l: Memset argument to 0 before calling get_mbus_config pad op
  - media: i2c: imx219: Correct the minimum vblanking value
  - kunit: tool: Use qboot on QEMU x86_64
  - smack: Revert "smackfs: Added check catlen"
  - smack: recognize ipv4 CIPSO w/o categories
  - pinctrl: devicetree: do not goto err when probing hogs in pinctrl_dt_to_map
  - ASoC: soc-dai: check return value at snd_soc_dai_set_tdm_slot()
  - ASoC: tas2764: Power up/down amp on mute ops
  - ASoC: tas2764: Mark SW_RESET as volatile
  - ASoC: tas2764: Add reg defaults for TAS2764_INT_CLK_CFG
  - ASoC: ops: Enforce platform maximum on initial value
  - firmware: arm_ffa: Reject higher major version as incompatible
  - net/mlx5: Apply rate-limiting to high temperature warning
  - net/mlx5: Modify LSB bitmask in temperature event to include only the first bit
  - media: test-drivers: vivid: don't call schedule in loop
  - vxlan: Join / leave MC group after remote changes
  - PCI: Fix old_size lower bound in calculate_iosize() too
  - eth: mlx4: don't try to complete XDP frames in netpoll
  - bpf: don't do clean_live_states when state->loop_entry->branches > 0
  - can: c_can: Use of_property_present() to test existence of DT property
  - pmdomain: imx: gpcv2: use proper helper for property detection
  - RDMA/core: Fix best page size finding when it can cross SG entries
  - drm/amd/display: Add support for disconnected eDP streams
  - i3c: master: svc: Flush FIFO before sending Dynamic Address Assignment(DAA)
  - EDAC/ie31200: work around false positive build warning
  - wifi: rtw89: fw: propagate error code from rtw89_h2c_tx()
  - wifi: rtw88: Fix rtw_desc_to_mcsrate() to handle MCS16-31
  - wifi: rtw88: Fix rtw_init_ht_cap() for RTL8814AU
  - wifi: rtw88: Fix rtw_init_vht_cap() for RTL8814AU
  - scsi: mpt3sas: Send a diag reset if target reset fails
  - clocksource: mips-gic-timer: Enable counter when CPUs start
  - MIPS: pm-cps: Use per-CPU variables as per-CPU, not per-core
  - MIPS: Use arch specific syscall name match function
  - crypto: skcipher - Zap type in crypto_alloc_sync_skcipher
  - x86/kaslr: Reduce KASLR entropy on most x86 systems
  - net/mlx5: Change POOL_NEXT_SIZE define value and make it global
  - libbpf: Fix out-of-bound read
  - media: tc358746: improve calculation of the D-PHY timing registers
  - media: adv7180: Disable test-pattern control on adv7180
  - cpuidle: menu: Avoid discarding useful information
  - vdpa/mlx5: Fix mlx5_vdpa_get_config() endianness on big-endian machines
  - vhost-scsi: Return queue full for page alloc failures during copy
  - x86/nmi: Add an emergency handler in nmi_desc & use it in nmi_shootdown_cpus()
  - ASoC: mediatek: mt8188: Add reference for dmic clocks
  - ASoC: mediatek: mt8188: Treat DMIC_GAINx_CUR as non-volatile
  - drm/amd/display: handle max_downscale_src_width fail check
  - x86/build: Fix broken copy command in genimage.sh when making isoimage
  - Octeontx2-af: RPM: Register driver with PCI subsys IDs
  - soc: ti: k3-socinfo: Do not use syscon helper to build regmap
  - wifi: ath12k: Improve BSS discovery with hidden SSID in 6 GHz band
  - bonding: report duplicate MAC address in all situations
  - net: xgene-v2: remove incorrect ACPI_PTR annotation
  - net: ethernet: mtk_ppe_offload: Allow QinQ, double ETH_P_8021Q only
  - leds: pwm-multicolor: Add check for fwnode_property_read_u32
  - drm/amdkfd: KFD release_work possible circular locking
  - selftests/net: have `gro.sh -t` return a correct exit code
  - net/mlx5: Avoid report two health errors on same syndrome
  - firmware: arm_ffa: Set dma_mask for ffa devices
  - PCI: brcmstb: Add a softdep to MIP MSI-X driver
  - PCI: brcmstb: Expand inbound window size up to 64GB
  - wifi: ath12k: Report proper tx completion status to mac80211
  - soc: apple: rtkit: Implement OSLog buffers properly
  - soc: apple: rtkit: Use high prio work queue
  - fpga: altera-cvp: Increase credit timeout
  - drm/mediatek: mtk_dpi: Add checks for reg_h_fre_con existence
  - ARM: at91: pm: fix at91_suspend_finish for ZQ calibration
  - hwmon: (gpio-fan) Add missing mutex locks
  - x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2
  - clk: imx8mp: inform CCF of maximum frequency of clocks
  - media: uvcvideo: Handle uvc menu translation inside uvc_get_le_value
  - media: uvcvideo: Add sanity check to uvc_ioctl_xu_ctrl_map
  - drm/rockchip: vop2: Add uv swap for cluster window
  - ipv4: fib: Move fib_valid_key_len() to rtm_to_fib_config().
  - ALSA: hda/realtek: Enable PC beep passthrough for HP EliteBook 855 G7
  - perf/hw_breakpoint: Return EOPNOTSUPP for unsupported breakpoint type
  - net: pktgen: fix mpls maximum labels list parsing
  - net: ethernet: ti: cpsw_new: populate netdev of_node
  - pinctrl: bcm281xx: Use "unsigned int" instead of bare "unsigned"
  - drm/amd/display: Skip checking FRL_MODE bit for PCON BW determination
  - drm/amdgpu: Do not program AGP BAR regs under SRIOV in gfxhub_v1_0.c
  - remoteproc: qcom_wcnss: Handle platforms with only single power domain
  - net: phylink: use pl->link_interface in phylink_expects_phy()
  - drm/gem: Fix kabi-breakage for drm
  - powerpc/kexec: Enable SMT before waking offline CPUs
  - tracing: Fix enabling of tracing on file release
  - iavf: fix off-by-one issues in iavf_config_rss_reg()
  - e1000: fix OOB in e1000_tbi_should_accept()
  - tracing: Do not register unsupported perf events
  - fuse: fix readahead reclaim deadlock
  - fuse: fix io-uring list corruption for terminated non-committed requests
  - fuse: missing copy_finish in fuse-over-io-uring argument copies
  - fsnotify: do not generate ACCESS/MODIFY events on child for special files
  - mlxsw: spectrum_router: Fix neighbour use-after-free
  - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats
  - drm/gem: Test for imported GEM buffers with helper
  - ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple()
  - NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags
  - media: c8sectpfe: Call of_node_put(i2c_bus) only once in c8sectpfe_probe()
  - ARM: tegra: Switch DSI-B clock parent to PLLD on Tegra114
  - ieee802154: ca8210: Use proper setters and getters for bitwise types
  - rtc: ds1307: stop disabling alarms on probe
  - tcp: bring back NUMA dispersion in inet_ehash_locks_alloc()
  - ALSA: seq: Improve data consistency at polling
  - powerpc/prom_init: Fixup missing #size-cells on PowerBook6,7
  - arm64: tegra: Resize aperture for the IGX PCIe C5 slot
  - arm64: tegra: p2597: Fix gpio for vdd-1v8-dis regulator
  - drm/amdkfd: Set per-process flags only once cik/vi
  - watchdog: aspeed: Update bootstatus handling
  - cpufreq: tegra186: Share policy per cluster
  - iommu/amd/pgtbl_v2: Improve error handling
  - ASoC: qcom: sm8250: explicitly set format in sm8250_be_hw_params_fixup()
  - auxdisplay: charlcd: Partially revert "Move hwidth and bwidth to struct hd44780_common"
  - gfs2: Check for empty queue in run_queue
  - drm/amd/display: Fix incorrect DPCD configs while Replay/PSR switch
  - drm/amd/display: calculate the remain segments for all pipes
  - drm/amd/display: remove minimum Dispclk and apply oem panel timing.
  - ipv6: save dontfrag in cork
  - printk: Check CON_SUSPEND when unblanking a console
  - hwmon: (dell-smm) Increment the number of fans
  - usb: xhci: Don't change the status of stalled TDs on failed Stop EP
  - mmc: sdhci: Disable SD card clock before changing parameters
  - mmc: dw_mmc: add exynos7870 DW MMC support
  - arm64/mm: Check PUD_TYPE_TABLE in pud_bad()
  - netfilter: conntrack: Bound nf_conntrack sysctl writes
  - timer_list: Don't use %pK through printk()
  - posix-timers: Add cond_resched() to posix_timer_add() search loop
  - RDMA/uverbs: Propagate errors from rdma_lookup_get_uobject()
  - ext4: do not convert the unwritten extents if data writeback fails
  - ext4: reject the 'data_err=abort' option in nojournal mode
  - ASoC: sun4i-codec: support hp-det-gpios property
  - drm/amdgpu: Update SRIOV video codec caps
  - mfd: tps65219: Remove TPS65219_REG_TI_DEV_ID check
  - pinctrl-tegra: Restore SFSEL bit when freeing pins
  - xen: Add support for XenServer 6.1 platform device
  - net/smc: use the correct ndev to find pnetid by pnetid table
  - dm: restrict dm device size to 2^63-512 bytes
  - crypto: octeontx2 - suppress auth failure screaming due to negative tests
  - kbuild: fix argument parsing in scripts/config
  - ASoC: mediatek: mt6359: Add stub for mt6359_accdet_enable_jack_detect
  - thunderbolt: Do not add non-active NVM if NVM upgrade is disabled for retimer
  - objtool: Fix error handling inconsistencies in check()
  - rtc: rv3032: fix EERD location
  - tcp: reorganize tcp_in_ack_event() and tcp_count_delivered()
  - jbd2: do not try to recover wiped journal
  - bpf: Return prog btf_id without capable check
  - vfio/pci: Handle INTx IRQ_NOTCONNECTED
  - scsi: st: ERASE does not change tape location
  - scsi: st: Tighten the page format heuristics with MODE SELECT
  - hypfs_create_cpu_files(): add missing check for hypfs_mkdir() failure
  - ext4: reorder capability check last
  - um: Update min_low_pfn to match changes in uml_reserved
  - um: Store full CSGSFS and SS register from mcontext
  - dlm: make tcp still work in multi-link env
  - i3c: master: svc: Fix missing STOP for master request
  - drm/amd/display: Guard against setting dispclk low for dcn31x
  - btrfs: send: return -ENAMETOOLONG when attempting a path that is too long
  - btrfs: get zone unusable bytes while holding lock at btrfs_reclaim_bgs_work()
  - btrfs: fix non-empty delayed iputs list on unmount due to async workers
  - btrfs: run btrfs_error_commit_super() early
  - btrfs: avoid linker error in btrfs_find_create_tree_block()
  - btrfs: make btrfs_discard_workfn() block_group ref explicit
  - i2c: pxa: fix call balance of i2c->clk handling routines
  - i2c: qup: Vote for interconnect bandwidth to DRAM
  - x86/stackprotector/64: Only export __ref_stack_chk_guard on CONFIG_SMP
  - wifi: mt76: mt7996: revise TXS size
  - wifi: mt76: only mark tx-status-failed frames as ACKed on mt76x0/2
  - mmc: host: Wait for Vdd to settle on card power off
  - ext4: on a remount, only log the ro or r/w state when it has changed
  - PCI: vmd: Disable MSI remapping bypass under Xen
  - pNFS/flexfiles: Report ENETDOWN as a connection error
  - tools/build: Don't pass test log files to linker
  - PCI: dwc: ep: Ensure proper iteration over outbound map windows
  - objtool: Properly disable uaccess validation
  - lockdep: Fix wait context check on softirq for PREEMPT_RT
  - dql: Fix dql->limit value when reset.
  - thermal/drivers/qoriq: Power down TMU on system suspend
  - SUNRPC: rpcbind should never reset the port to the value '0'
  - SUNRPC: rpc_clnt_set_transport() must not change the autobind setting
  - NFSv4: Treat ENETUNREACH errors as fatal for state recovery
  - cifs: Fix establishing NetBIOS session for SMB2+ connection
  - cifs: add validation check for the fields in smb_aces
  - fbdev: core: tileblit: Implement missing margin clearing for tileblit
  - fbcon: Use correct erase colour for clearing in fbcon
  - fbdev: fsl-diu-fb: add missing device_remove_file()
  - riscv: Allow NOMMU kernels to access all of RAM
  - mailbox: use error ret code of of_parse_phandle_with_args()
  - ACPI: PNP: Add Intel OC Watchdog IDs to non-PNP device list
  - tracing: Mark binary printing functions with __printf() attribute
  - SUNRPC: Don't allow waiting for exiting tasks
  - NFS: Don't allow waiting for exiting tasks
  - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked()
  - fuse: Return EPERM rather than ENOSYS from link()
  - cifs: Fix negotiate retry functionality
  - cifs: Fix querying and creating MF symlinks over SMB1
  - cifs: Add fallback for SMB2 CREATE without FILE_READ_ATTRIBUTES
  - s390/vfio-ap: Fix no AP queue sharing allowed message written to kernel log
  - kconfig: merge_config: use an empty file as initfile
  - samples/bpf: Fix compilation failure for samples/bpf on LoongArch Fedora
  - bpf: fix possible endless loop in BPF map iteration
  - selftests/bpf: Mitigate sockmap_ktls disconnect_after_delete failure
  - drm/amdgpu: Allow P2P access through XGMI
  - ima: process_measurement() needlessly takes inode_lock() on MAY_READ
  - net: enetc: refactor bulk flipping of RX buffers to separate function
  - scsi: mpi3mr: Add level check to control event logging
  - cgroup: Fix compilation issue due to cgroup_mutex not being exported
  - dma-mapping: avoid potential unused data compilation warning
  - intel_th: avoid using deprecated page->mapping, index fields
  - scsi: ufs: Introduce quirk to extend PA_HIBERN8TIME for UFS devices
  - nvmem: qfprom: switch to 4-byte aligned reads
  - nvmem: core: update raw_len if the bit reading is required
  - nvmem: core: verify cell's raw_len
  - nvmem: rockchip-otp: add rk3576 variant data
  - nvmem: rockchip-otp: Move read-offset into variant-data
  - cpufreq: Add SM8650 to cpufreq-dt-platdev blocklist
  - phy: renesas: rcar-gen3-usb2: Assert PLL reset on PHY power off
  - phy: renesas: rcar-gen3-usb2: Lock around hardware registers and driver data
  - phy: renesas: rcar-gen3-usb2: Move IRQ request in probe
  - phy: renesas: rcar-gen3-usb2: Add support to initialize the bus
  - i2c: designware: Fix an error handling path in i2c_dw_pci_probe()
  - i2c: designware: Use temporary variable for struct device
  - i2c: designware: Remove ->disable() callback
  - i2c: designware: Uniform initialization flow for polling mode
  - gpio: pca953x: fix IRQ storm on system wake up
  - gpio: pca953x: Simplify code with cleanup helpers
  - gpio: pca953x: Split pca953x_restore_context() and pca953x_save_context()
  - macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse
  - xsched: Add XSched manual
  - x86/sev: merge continuous pages into a large range when notifying range enc status changes
  - cifs: parse_dfs_referrals: prevent oob on malformed input
  - smb: client: fix return value of parse_dfs_referrals()
  - smb: client: Fix refcount leak for cifs_sb_tlink
  - ceph: fix race condition validating r_parent before applying state
  - smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path
  - NFSv4: Don't clear capabilities that won't be reset
  - NFS: Fix the setting of capabilities when automounting a new filesystem
  - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry()
  - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN
  - smb3: fix for slab out of bounds on mount to ksmbd
  - smb: client: fix potential deadlock when reconnecting channels
  - smb: client: add NULL check in automount_fullpath
  - smb: client: Avoid race in open_cached_dir with lease breaks
  - ub: cdma: jfs 64K page table memory adaptation
  - ub: cdma: ELR code refactoring
  - ub: cdma: add some log print
  - net/mdiobus: Fix potential out-of-bounds read/write access
  - net/mdiobus: Fix potential out-of-bounds clause 45 read/write access
  - net: phy: clear phydev->devlink when the link is deleted
  - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation
  - drm/sysfb: Do not dereference NULL pointer in plane reset
  - binfmt_misc: restore write access before closing files opened by open_exec()
  - RDMA/rxe: Fix null deref on srq->rq.queue after resize failure
  - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind
  - perf/x86/intel/cstate: Add Clearwater Forest support
  - perf/x86/intel/cstate: Add pkg C2 residency counter for Sierra Forest
  - perf/x86/intel: Add missing MODULE_DESCRIPTION() lines
  - perf/x86/intel/cstate: Switch to new Intel CPU model defines
  - irqchip/gic-v4.1: Use local 4_1 ITS to generate VSGI
  - ext4: fix e4b bitmap inconsistency reports
  - x86/csv: Enhance CMA memory usage reporting for CSV3
  - smb: client: fix incomplete backport in cfids_invalidation_worker()
  - smb: client: fix potential UAF in smb2_close_cached_fid()
  - smb: client: fix memory leak in cifs_construct_tcon()
  - cifs: fix memory leak in smb3_fs_context_parse_param error path
  - smb: client: fix potential cfid UAF in smb2_query_info_compound
  - cifs: client: fix memory leak in smb3_fs_context_parse_param
  - net: netpoll: fix incorrect refcount handling causing incorrect cleanup
  - ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe
  - net: ipv6: fix field-spanning memcpy warning in AH output
  - Fix SDEI state machine issue during reboot process
  - Add sdei interface to check event status
  - proc: fix type confusion in pde_set_flags()
  - proc: fix missing pde_set_flags() for net proc files
  - udp_tunnel: use netdev_warn() instead of netdev_WARN()
  - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ
  - net/mlx5e: Reuse per-RQ XDP buffer to avoid stack zeroing overhead
  - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()
  - net/mlx5: Clean up only new IRQ glue on request_irq() failure
  - Bluetooth: MGMT: cancel mesh send timer when hdev removed
  - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
  - nbd: defer config unlock in nbd_genl_connect
  - nbd: defer config put in recv_work
  - md: fix rcu protection in md_wakeup_thread
  - nvme-multipath: fix lockdep WARN due to partition scan work
  - blk-cgroup: fix possible deadlock while configuring policy
  - usbnet: Prevents free active kevent
  - scsi: sg: Do not sleep in atomic context
  - ima: Handle error code returned by ima_filter_rule_match()
  - erofs: avoid infinite loops due to corrupted subpage compact indexes
  - scsi: bfa: Double-free fix
  - mISDN: hfcpci: Fix warning when deleting uninitialized timer
  - jfs: truncate good inode pages when hard link is 0
  - mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd()
  - hfsplus: remove mutex_lock check in hfsplus_free_extents
  - f2fs: fix to avoid UAF in f2fs_sync_inode_meta()
  - mm/khugepaged: use KMEM_CACHE()
  - mm/ksm: cleanup mm_slot_entry() invocation
  - mm/khugepaged: remove definition of struct khugepaged_mm_slot
  - mm/ksm: get mm_slot by mm_slot_entry() when slot is !NULL
  - mm/khugepaged: use list_xxx() helper to improve readability
  - khugepaged: simplify the allocation of slab caches
  - mm/khugepaged: fix comment for default scan sleep duration
  - NFSD: free copynotify stateid in nfs4_free_ol_stateid()
  - NFSD: fix race between nfsd registration and exports_proc
  - ksmbd: fix refcount leak causing resource not released
  - NFSD: Define a proc_layoutcommit for the FlexFiles layout type
  - platform/x86: intel-uncore-freq: fix all header kernel-doc warnings
  - platform/x86/intel: power-domains: Fix error code in tpmi_init()
  - platform/x86/intel-uncore-freq: Present unique domain ID per package
  - platform/x86/intel-uncore-freq: Fix warning in partitioned system
  - platform/x86/intel-uncore-freq: avoid non-literal format string
  - Documentation: admin-guide: pm: Add documentation for die_id
  - platform/x86/intel-uncore-freq: Add attributes to show die_id
  - platform/x86/intel: power-domains: Add interface to get Linux die ID
  - Documentation: admin-guide: pm: Add documentation for agent_types
  - platform/x86/intel-uncore-freq: Add attributes to show agent types
  - mptcp: Fix proto fallback detection with BPF
  - memcg: enable asynchronous reclaim for cgroup-v2
  - memcg: change CONFIG_MEMCG_V1_RECLAIM to CONFIG_MEMCG_QOS
  - x86/kvm: expose CPUID 0xC000_0000 for Zhaoxin "Shanghai" vendor
  - perf mem/c2c: Add load store event mapping for Hygon


author: Li Nan <linan122@huawei.com> - 6.6.0-137.0.0.118
changelog:
  - !20552 ub: udma: fix some code issues.
  - !20313 Fix CVE-2025-40220
  - !20321  nvme: fix admin request_queue lifetime
  - !20512 PM / devfreq: hisi: Fix potential UAF in OPP handling
  - !20544 Fix CVE-2025-71147
  - !20548 v4  net: LTS-6.6 backport
  - !20503 Fix CVE-2025-39713
  - !20133 Fix CVE-2025-39721
  - !20438 Fix CVE-2025-38659
  - !20264 Fix CVE-2025-40277
  - !20340 Fix CVE-2025-40271
  - !20319 Fix CVE-2025-40237
  - !20392  vfs: Don't leak disconnected dentries on umount
  - !20554  iommu/s390: Implement blocking domain
  - !20489 [OLK-6.6][linux-6.6.y sync] Backport 6.6.101-6.6.102 LTS Patches
  - !20513 ACPI: PCC: Fix race condition by removing static qualifier
  - !20468  drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer
  - !20483  rcu: Protect ->defer_qs_iw_pending from data race
  - !20510 drivers/ub/sentry: fix primary eid index value
  - !20553 ub: cdma: support separated page table feature
  - ub: udma: fix some code issues.
  - !20480 iommu/ummu-core: fix error invalidate tid
  - !20561 iommu/ummu: Add ummu sva independent page table parameter
  - ub: udma: bugfix related to 2m_hugepage.
  - ub: udma: support for separate page tables
  - ub: udma: delete debugfs code.
  - ub: udma: bugfix related to ctrlq function.
  - ub: udma: verify get cqe/ae aux info out addr and len.
  - ub: cdma: support separated page table feature
  - iommu/ummu: Add ummu sva independent page table parameter
  - iommu: Adjust PLB refresh timing in 'grant' and 'ungrant'
  - !20505 Fix CVE-2026-23035
  - iommu/s390: Implement blocking domain
  - drivers/ub/sentry: fix primary eid index value
  - !20535  libceph: make decode_pool() more resilient against corrupted osdmaps
  - !20536  mm/page_alloc: change all pageblocks migrate type on coalescing
  - !20537  mm/secretmem: fix use-after-free race in fault handler
  - !20538  wifi: avoid kernel-infoleak from struct iw_point
  - !20539  net: usb: rtl8150: fix memory leak on usb_submit_urb() failure
  - !20440  PCI/AER: Fix NULL pointer access by aer_info
  - !20262 Fix CVE-2025-68176
  - netfilter: nf_reject: don't leak dst refcount for loopback packets
  - net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error
  - page_pool: always add GFP_NOWARN for ATOMIC allocations
  - virtio-net: fix received length check in big packets
  - net: bridge: fix use-after-free due to MST port state bypass
  - vsock: Ignore signal/timeout on connect() if already established
  - tls: make sure to abort the stream if headers are bogus
  - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI
  - xfrm: Duplicate SPI Handling
  - tls: handle data disappearing from under the TLS ULP
  - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing
  - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls
  - Bluetooth: hci_core: Fix use-after-free in vhci_flush()
  - KEYS: trusted: Fix a memory leak in tpm2_load_cmd
  - !20237 Fix CVE-2025-68724
  - !20459 Fix CVE-2025-71131
  - !20525 Fix CVE-2025-68816
  - !20529  CVE-2025-68172
  - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure
  - !20370 Revert "Revert "RDMA/hns: Fix mismatch exception rollback""
  - wifi: avoid kernel-infoleak from struct iw_point
  - mm/secretmem: fix use-after-free race in fault handler
  - mm/page_alloc: change all pageblocks migrate type on coalescing
  - libceph: make decode_pool() more resilient against corrupted osdmaps
  - pps: Fix kabi breakage of struct pps_device for last_fetched_ev
  - sched: Fix kabi breakage of struct task_struct for saved_state
  - crypto: aspeed - fix double free caused by devm
  - !20515  Bluetooth: bcsp: receive data only if registered
  - !20507 Fix CVE-2025-40358
  - !20450 ub: ubase&unic: Fix some bug in concurrent process
  - !20452 iommu/ummu: Fix some bugs and optimize the code implementation
  - !20451 iommu/ummu: Add the function of creating devices with SVA-separated
  - !20500 mm: fix the inaccurate memory statistics issue for users
  - net/mlx5: fw_tracer, Validate format string parameters
  - Bluetooth: bcsp: receive data only if registered
  - ACPI: PCC: Fix race condition by removing static qualifier
  - ACPI: CPPC: Fix missing PCC check for guaranteed_perf
  - iommu/ummu: Add the function of creating devices with SVA-separated
  - iommu/ummu-core: fix error invalidate tid
  - riscv: stacktrace: Disable KASAN checks for non-current tasks
  - !20497  arch_topology: Fix incorrect error check in topology_parse_cpu_capacity()
  - !20496  drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies
  - !20495  iommu/amd: Avoid stack buffer overflow from kernel cmdline
  - !20494  HID: core: Harden s32ton() against conversion to 0 bits
  - !20493  iommu: Fix two issues in iommu_copy_struct_from_user()
  - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv
  - PM / devfreq: hisi: Fix potential UAF in OPP handling
  - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()
  - !20487  interference: Fix uninitialized ifs_clock compiling issue
  - MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow
  - MIPS: mm: Prevent a TLB shutdown on initial uniquification
  - mm: fix the inaccurate memory statistics issue for users
  - mm: add config option for atomic mode in mm counter
  - Revert "mm: fix the inaccurate memory statistics issue for users"
  - !20444  net/mlx5e: Fix crash on profile change rollback failure
  - !20442  net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv
  - arch_topology: Fix incorrect error check in topology_parse_cpu_capacity()
  - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies
  - iommu/amd: Avoid stack buffer overflow from kernel cmdline
  - HID: core: Harden s32ton() against conversion to 0 bits
  - iommu: Fix two issues in iommu_copy_struct_from_user()
  - SUNRPC: call xs_sock_process_cmsg for all cmsg
  - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read
  - !20374 [OLK 6.6]Use Hygon IBRS and IBPB rather than software-based mitigation to mitigate Retbleed and SRSO.
  - !20227  Rename leapioraid to leapraid and release v2.0
  - mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery
  - MIPS: mm: tlb-r4k: Uniquify TLB entries on init
  - x86/fpu: Delay instruction pointer fixup until after warning
  - ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx()
  - ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe()
  - x86/sev: Evict cache lines during SNP memory validation
  - net: usbnet: Fix the wrong netif_carrier_on() call
  - net: usbnet: Avoid potential RCU stall on LINK_CHANGE event
  - Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano
  - sched,freezer: Remove unnecessary warning in __thaw_task
  - freezer,sched: Clean saved_state when restoring it during thaw
  - freezer,sched: Do not restore saved_state of a thawed task
  - freezer,sched: Use saved_state to reduce some spurious wakeups
  - sched/core: Remove ifdeffery for saved_state
  - i2c: stm32f7: unmap DMA mapped buffer
  - i2c: stm32f7: simplify status messages in case of errors
  - i2c: stm32f7: perform most of irq job in threaded handler
  - i2c: stm32f7: use dev_err_probe upon calls of devm_request_irq
  - i2c: stm32f7: Use devm_clk_get_enabled()
  - USB: serial: option: add Foxconn T99W709
  - smb: server: Fix extension string in ksmbd_extract_shortname()
  - ksmbd: fix corrupted mtime and ctime in smb2_open
  - ksmbd: fix Preauh_HashValue race condition
  - ksmbd: fix null pointer dereference error in generate_encryptionkey
  - vsock: Do not allow binding to VMADDR_PORT_ANY
  - selftests/perf_events: Add a mmap() correctness test
  - smb: client: return an error if rdma_connect does not return within 5 seconds
  - smb: client: let recv_done() cleanup before notifying the callers.
  - smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already
  - smb: client: make use of common smbdirect_socket
  - smb: smbdirect: add smbdirect_socket.h
  - smb: client: Correct typos in multiple comments across various files
  - smb: client: Use min() macro
  - smb: server: let recv_done() avoid touching data_transfer after cleanup/move
  - smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already
  - ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out()
  - irqchip: Build IMX_MU_MSI only on ARM
  - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing
  - sunrpc: fix client side handling of tls alerts
  - net/sched: taprio: enforce minimum value for picos_per_byte
  - net: drop UFO packets in udp_rcv_segment()
  - ipv6: reject malicious packets in ipv6_gso_segment()
  - net/mlx5: Correctly set gso_segs when LRO is used
  - netlink: specs: ethtool: fix module EEPROM input/output arguments
  - net: ipa: add IPA v5.1 and v5.5 to ipa_version_string()
  - phy: mscc: Fix parsing of unicast frames
  - netpoll: prevent hanging NAPI when netcons gets enabled
  - md/md-cluster: handle REMOVE message earlier
  - NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY
  - NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate()
  - sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up()
  - pNFS/flexfiles: don't attempt pnfs on fatal DS errors
  - PCI: pnv_php: Fix surprise plug detection and recovery
  - powerpc/eeh: Export eeh_unfreeze_pe()
  - PCI: pnv_php: Work around switches with broken presence detection
  - kconfig: qconf: fix ConfigList::updateListAllforAll()
  - scsi: sd: Make sd shutdown issue START STOP UNIT appropriately
  - scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume
  - scsi: Revert "scsi: iscsi: Fix HW conn removal use after free"
  - scsi: mpt3sas: Fix a fw_event memory leak
  - vfio/pci: Separate SR-IOV VF dev_set
  - vfio/pds: Fix missing detach_ioas op
  - vfio: Prevent open_count decrement to negative
  - vfio: Fix unbalanced vfio_df_close call in no-iommu mode
  - f2fs: fix to calculate dirty data during has_not_enough_free_secs()
  - f2fs: fix to update upper_p in __get_secs_required() correctly
  - f2fs: vm_unmap_ram() may be called from an invalid context
  - f2fs: fix to avoid out-of-boundary access in devs.path
  - f2fs: doc: fix wrong quota mount option description
  - f2fs: fix KMSAN uninit-value in extent_info usage
  - rtc: rv3028: fix incorrect maximum clock rate handling
  - rtc: pcf8563: fix incorrect maximum clock rate handling
  - rtc: pcf85063: fix incorrect maximum clock rate handling
  - rtc: nct3018y: fix incorrect maximum clock rate handling
  - rtc: hym8563: fix incorrect maximum clock rate handling
  - rtc: ds1307: fix incorrect maximum clock rate handling
  - ucount: fix atomic_long_inc_below() argument type
  - module: Restore the moduleparam prefix length check
  - apparmor: fix loop detection used in conflicting attachment resolution
  - apparmor: ensure WB_HISTORY_SIZE value is a power of 2
  - bpf: Check netfilter ctx accesses are aligned
  - bpf: Check flow_dissector ctx accesses are aligned
  - vhost-scsi: Fix log flooding with target does not exist errors
  - mtd: rawnand: atmel: set pmecc data setup time
  - mtd: rawnand: rockchip: Add missing check after DMA map
  - mtd: rawnand: atmel: Fix dma_mapping_error() address
  - jfs: fix metapage reference count leak in dbAllocCtl
  - crypto: qat - fix seq_file position update in adf_ring_next()
  - crypto: qat - fix DMA direction for compression on GEN2 devices
  - perf tools: Remove libtraceevent in .gitignore
  - sh: Do not use hyphen in exported variable name
  - ASoC: fsl_xcvr: get channel status data when PHY is not exists
  - dmaengine: nbpfaxi: Add missing check after DMA map
  - dmaengine: mv_xor: Fix missing check after DMA map and missing unmap
  - fs/orangefs: Allow 2 more characters in do_c_string()
  - PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute
  - soundwire: stream: restore params when prepare ports fail
  - crypto: img-hash - Fix dma_unmap_sg() nents value
  - crypto: keembay - Fix dma_unmap_sg() nents value
  - hwrng: mtk - handle devm_pm_runtime_enable errors
  - watchdog: ziirave_wdt: check record length in ziirave_firm_verify()
  - scsi: isci: Fix dma_unmap_sg() nents value
  - scsi: mvsas: Fix dma_unmap_sg() nents value
  - scsi: elx: efct: Fix dma_unmap_sg() nents value
  - scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value
  - clk: sunxi-ng: v3s: Fix de clock definition
  - perf tests bp_account: Fix leaked file descriptor
  - kernel: trace: preemptirq_delay_test: use offstack cpu mask
  - crypto: inside-secure - Fix `dma_unmap_sg()` nents value
  - perf sched: Fix memory leaks in 'perf sched latency'
  - perf sched: Fix memory leaks for evsel->priv in timehist
  - perf sched: Free thread->priv using priv_destructor
  - perf dso: Add missed dso__put to dso__load_kcore
  - perf tools: Fix use-after-free in help_unknown_cmd()
  - Fix dma_unmap_sg() nents value
  - clk: clk-axi-clkgen: fix fpfd_max frequency for zynq
  - fanotify: sanitize handle_type values when reporting fid
  - pinctrl: sunxi: Fix memory leak on krealloc failure
  - PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails
  - crypto: arm/aes-neonbs - work around gcc-15 warning
  - power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set
  - power: supply: cpcap-charger: Fix null check for power_supply_get_by_name
  - clk: xilinx: vcu: unregister pll_post only if registered correctly
  - media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check
  - mtd: fix possible integer overflow in erase_xfer()
  - crypto: marvell/cesa - Fix engine load inaccuracy
  - crypto: qat - use unmanaged allocation for dc_data
  - crypto: sun8i-ce - fix nents passed to dma_unmap_sg()
  - PCI: rockchip-host: Fix "Unexpected Completion" log message
  - bpf/preload: Don't select USERMODE_DRIVER
  - ipv6: annotate data-races around rt->fib6_nsiblings
  - ipv6: fix possible infinite loop in fib6_info_uses_dev()
  - vrf: Drop existing dst reference in vrf_ip6_input_dst
  - selftests: rtnetlink.sh: remove esp4_offload after test
  - net/mlx5e: Clear Read-Only port buffer size in PBMC before update
  - netfilter: xt_nfacct: don't assume acct name is null-terminated
  - can: kvaser_usb: Assign netdev.dev_port based on device channel index
  - can: kvaser_pciefd: Store device channel index
  - can: peak_usb: fix USB FD devices potential malfunction
  - tools/rv: Do not skip idle in trace
  - Bluetooth: hci_event: Mask data status from LE ext adv reports
  - kcsan: test: Initialize dummy variable
  - wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon()
  - wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE
  - wifi: ath12k: fix endianness handling while accessing wmi service bit
  - wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key()
  - wifi: mac80211: Don't call fq_flow_idx() for management frames
  - wifi: mac80211: Do not schedule stopped TXQs
  - wifi: plfxlc: Fix error handling in usb driver probe
  - wifi: mac80211: reject TDLS operations when station is not associated
  - iommu/amd: Fix geometry.aperture_end for V2 tables
  - mwl8k: Add missing check after DMA map
  - wifi: rtl8xxxu: Fix RX skb size for aggregation disabled
  - tcp: call tcp_measure_rcv_mss() for ooo packets
  - xen/gntdev: remove struct gntdev_copy_batch from stack
  - net_sched: act_ctinfo: use atomic64_t for three counters
  - net/sched: Restrict conditions for adding duplicating netems to qdisc tree
  - um: rtc: Avoid shadowing err in uml_rtc_start()
  - arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX
  - netfilter: nf_tables: adjust lockdep assertions handling
  - netfilter: nf_tables: Drop dead code from fill_*_info routines
  - fbcon: Fix outdated registered_fb reference in comment
  - drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value
  - m68k: Don't unregister boot console needlessly
  - drm/msm/dpu: Fill in min_prefill_lines for SC8180X
  - kselftest/arm64: Fix check for setting new VLs in sve-ptrace
  - net: dst: annotate data-races around dst->input
  - tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range
  - wifi: ath11k: clear initialized flag for deinit-ed srng lists
  - iwlwifi: Add missing check for alloc_ordered_workqueue
  - wifi: iwlwifi: Fix memory leak in iwl_mvm_init()
  - wifi: rtl818x: Kill URBs before clearing tx status queue
  - wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band
  - caif: reduce stack size, again
  - bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure
  - drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel
  - net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain
  - selftests/bpf: fix signedness bug in redir_partial()
  - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls
  - bpf, sockmap: Fix psock incorrectly pointing to sk
  - drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed
  - staging: nvec: Fix incorrect null termination of battery manufacturer
  - interconnect: qcom: sc8180x: specify num_nodes
  - interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg
  - soc: qcom: pmic_glink: fix OF node leak
  - samples: mei: Fix building on musl libc
  - cpufreq: Initialize cpufreq-based frequency-invariance later
  - cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode
  - arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed
  - arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed
  - ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface
  - soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS
  - arm: dts: ti: omap: Fixup pinheader typo
  - usb: early: xhci-dbc: Fix early_ioremap leak
  - powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw()
  - pps: fix poll support
  - staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc()
  - spi: stm32: Check for cfg availability in stm32_spi_probe
  - usb: misc: apple-mfi-fastcharge: Make power supply names unique
  - usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe()
  - ARM: dts: vfxxx: Correctly use two tuples for timer address
  - arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely
  - arm64: dts: qcom: sc7180: Expand IMEM region
  - arm64: dts: qcom: sdm845: Expand IMEM region
  - soc: qcom: QMI encoding/decoding for big endian
  - selftests: Fix errno checking in syscall_user_dispatch test
  - ASoC: mediatek: use reserved memory or enable buffer pre-allocation
  - gfs2: No more self recovery
  - Revert "fs/ntfs3: Replace inode_trylock with inode_lock"
  - hfs: make splice write available again
  - hfsplus: make splice write available again
  - ublk: use vmalloc for ublk_device's __queues
  - fs_context: fix parameter name in infofc() macro
  - audit,module: restore audit logging in load failure case
  - ASoC: amd: yc: add DMI quirk for ASUS M6501RM
  - ASoC: Intel: fix SND_SOC_SOF dependencies
  - ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx
  - ethernet: intel: fix building with large NR_CPUS
  - ASoC: amd: yc: Add DMI quirk for HP Laptop 17 cp-2033dx
  - interference: Fix uninitialized ifs_clock compiling issue
  - iommu/ummu: optimize log printing
  - !20455 Fix compilation failure caused by PR#20174
  - !20302  CVE-2026-22980
  - !20142  CVE-2025-68803
  - !20261  ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency
  - !20435  fix CVE-2026-22998
  - !20433  scsi: target: Reset t_task_cdb pointer in error case
  - !20432  scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path"
  - !20431  block: Use RCU in blk_mq_[un
  - !20307  tpm: Cap the number of PCR banks
  - !20062  xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read
  - !20157 v2  md: backport from mainline
  - rcu: Protect ->defer_qs_iw_pending from data race
  - platform/x86/intel/pmt: fix compilation failure caused by PR#20174
  - iommu/ummu: optimize kv cache memory management
  - iommu/ummu: optimize permission table management
  - iommu/ummu: remove check for eid_type while del eid
  - iommu/ummu: optimize the code implementation
  - drivers/perf: fix ummu-pmu data reading exception
  - iommu/ummu: IOMMU_DOMAIN_BLOCKED type don not sync tct
  - drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer
  - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt
  - net: unic: Notify mami of the bond ip change.
  - ub: ubase: Support for UE link by ctrlq message
  - ub: ubase: send a deactivate req in removing
  - ub: ubase: Querying TPG/TP contexts in the chip is no longer supported after enabling safe mode.
  - ub: ubase: Use an independent thread for the ctrlq workqueue.
  - !20368 ubcore: fix logging and permission for route query.
  - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id
  - !20344  ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr
  - net: unic: Fix the ummu 0xa event that occurs when modifying queues and resetting concurrent scenarios
  - ub: ubase: Add KABI compatibility
  - ub: ubase: fixing the issue of cdma ctp_req_vl parameter configuration
  - ub: ubase: add PMU IDEV interrupt supported abilities.
  - ub: ubase: Delete the tid mask for eq, jfs, jfr, and jfc context
  - ub: ubase: Set the completion event interrupt to auto
  - net: unic: fix poll tx read old skb cause a UAF bug
  - !20249 Fix CVE-2025-38489
  - !20250 Fix CVE-2025-38480
  - !20378 Fix CVE-2025-39838
  - !20430  Fix CVE-2025-39942
  - !20351 Fix CVE-2025-71149
  - !20375 Fix CVE-2025-71150
  - !20323 Fix CVE-2025-38730
  - !20320 Fix CVE-2025-68814
  - !20314 Fix CVE-2025-71072
  - !20315 Fix CVE-2025-68794
  - !20403  bpf: Check skb->transport_header is set in bpf_skb_check_mtu
  - !20402  bpf: Do not let BPF test infra emit invalid GSO types to stack
  - !20401  tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check()
  - !20400  netfilter: nft_ct: add seqadj extension for natted connections
  - !20399  net: xfrm: Fix CVE-2025-40215
  - !20398  net/sched: sch_qfq: Fix null-deref in agg_dequeue
  - !20397  bpf: Reject narrower access to pointer ctx fields
  - !20396  Bluetooth: eir: Fix possible crashes on eir_create_adv_data
  - !20394  IB/mlx5: Fix potential deadlock in MR deregistration
  - !20367 ub: cdma: cdma uaf bugfix
  - net/mlx5e: Fix crash on profile change rollback failure
  - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv
  - PCI/AER: Fix NULL pointer access by aer_info
  - gfs2: No more self recovery
  - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE
  - crypto: qat - flush misc workqueue during device shutdown
  - !20174 Backport PMT spec 3.0 support
  - !20366 [Hygon][6.6][Bugfix]: Resolve FPU state corruption between atomic and non-atomic contexts
  - !19814 [OLK-6.6] Batch flushing user memory encrytion status change
  - !20393 [OLK-6.6][linux-6.6.y sync] Backport 6.6.100-6.6.101 LTS Patches
  - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec
  - nvmet-tcp: remove boilerplate code
  - scsi: target: Reset t_task_cdb pointer in error case
  - scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path"
  - block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock
  - ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size
  - ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer
  - smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection
  - smb: server: remove separate empty_recvmsg_queue
  - !20384 ub:ubus: Fix ubus link message and pool device error
  - !20389  gfs2: Prevent recursive memory reclaim
  - !20388  *** fix CVE-2025-38062 ***
  - !20387  KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced
  - !20386  pinctrl: check the return value of pinmux_ops::get_function_name()
  - !20385  iommu/amd/pgtbl: Fix possible race while increase page table level
  - ub:ubus: Not cfg access during surprise down
  - ub:hisi-ubus: Delete validate_pa err print
  - PCI: cadence: Check for the existence of cdns_pcie::ops before using it
  - can: netlink: can_changelink(): allow disabling of automatic restart
  - Revert "selftests/bpf: Add a cgroup prog bpf_get_ns_current_pid_tgid() test"
  - drm/sched: Remove optimization that causes hang when killing dependent jobs
  - ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS
  - bpf: Check skb->transport_header is set in bpf_skb_check_mtu
  - bpf: Do not let BPF test infra emit invalid GSO types to stack
  - tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check()
  - netfilter: nft_ct: add seqadj extension for natted connections
  - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added
  - xfrm: delete x->tunnel as we delete x
  - x86/hw-vuln:Support hardware-based mitigation for Retbleed and SRSO via Hygon IBRS to avoid performance degradation caused by software-based mitigation.
  - net/sched: sch_qfq: Fix null-deref in agg_dequeue
  - bpf: Reject narrower access to pointer ctx fields
  - Bluetooth: eir: Fix possible crashes on eir_create_adv_data
  - IB/mlx5: Fix potential deadlock in MR deregistration
  - ub:ubus: Fix ubus link message and pool device error
  - ub:hisi-ubus: cq poller maximum handle 64 cqe per time
  - ub:hisi-ubus:Fix vdm message print error
  - ub:ubus:Fix ubus interrupt release issue
  - wifi: mt76: mt7921: prevent decap offload config before STA initialization
  - mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec()
  - iio: hid-sensor-prox: Restore lost scale assignments
  - iio: hid-sensor-prox: Fix incorrect OFFSET calculation
  - crypto: powerpc/poly1305 - add depends on BROKEN for now
  - erofs: address D-cache aliasing
  - drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x
  - ALSA: hda: Add missing NVIDIA HDA codec IDs
  - ALSA: hda/tegra: Add Tegra264 support
  - comedi: comedi_test: Fix possible deletion of uninitialized timers
  - usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach
  - usb: typec: tcpm: allow switching to mode accessory to mux properly
  - usb: typec: tcpm: allow to use sink in accessory mode
  - drm/amdkfd: Don't call mmput from MMU notifier callback
  - mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n
  - selftests: mptcp: connect: also cover checksum
  - selftests: mptcp: connect: also cover alt modes
  - resource: fix false warning in __request_region()
  - gve: Fix stuck TX queue for DQ queue format
  - e1000e: ignore uninitialized checksum word on tgp
  - e1000e: disregard NVM checksum on tgp when valid checksum bit is not set
  - dpaa2-switch: Fix device reference count leak in MAC endpoint handling
  - dpaa2-eth: Fix device reference count leak in MAC endpoint handling
  - ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx
  - sprintf.h requires stdarg.h
  - bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint()
  - i2c: virtio: Avoid hang by using interruptible completion wait
  - i2c: tegra: Fix reset error handling with ACPI
  - platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots
  - can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode
  - can: dev: can_restart(): move debug message and stats after successful restart
  - can: dev: can_restart(): reverse logic to remove need for goto
  - i40e: When removing VF MAC filters, only check PF-set MAC
  - i40e: report VF tx_dropped with tx_errors instead of tx_discards
  - i40e: Add rx_missed_errors for buffer exhaustion
  - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch
  - net/mlx5: Fix memory leak in cmd_exec()
  - staging: vchiq_arm: Make vchiq_shutdown never fail
  - x86/hyperv: Fix usage of cpu_online_mask to get valid cpu
  - regmap: fix potential memory leak of regmap_bus
  - iio: adc: ad7949: use spi_is_bpw_supported()
  - interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node
  - RDMA/core: Rate limit GID cache warning messages
  - virtio_ring: Fix error reporting in virtqueue_resize
  - !20348 [OLK-6.6][linux-6.6.y sync] Backport 6.6.99-6.6.100 LTS Patches
  - !20346  tracing: Fix crash on synthetic stacktrace field usage
  - vfs: Don't leak disconnected dentries on umount
  - !20334 Fix CVE-2025-68780
  - gfs2: Prevent recursive memory reclaim
  - amd/amdkfd: enhance kfd process check in switch partition
  - drm/amdkfd: allow compute partition mode switch with cgroup exclusions
  - KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced
  - pinctrl: check the return value of pinmux_ops::get_function_name()
  - iommu/amd/pgtbl: Fix possible race while increase page table level
  - !19966  nvme-fc: use lock accessing port_state and rport state
  - ASoC: fsl_sai: replace regmap_write with regmap_update_bits
  - comedi: Fix use of uninitialized data in insn_rw_emulate_bits()
  - cifs: prevent NULL pointer dereference in UTF16 conversion
  - ksmbd: Fix refcount leak when invalid session is found on session lookup
  - ubcore: fix logging and permission for route query.
  - !20232 driver/coda: VirtCCA supports MSI device DA
  - Revert "Revert "RDMA/hns: Fix mismatch exception rollback""
  - !20197 ub: udma&ubase: fix a bug that caused long reboot time
  - x86: Resolve FPU state corruption between atomic and non-atomic contexts
  - ub: cdma: cdma uaf bugfix
  - ub: cdma: jfs call trace bugfix
  - !20353  x86/fpu: Clear XSTATE_BV[i
  - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again
  - KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls
  - nvmem: layouts: u-boot-env: remove crc32 endianness conversion
  - i2c: omap: fix deprecated of_property_read_bool() use
  - ASoC: fsl_sai: Force a software reset when starting in consumer mode
  - regulator: pwm-regulator: Manage boot-on with disabled PWM channels
  - regulator: pwm-regulator: Calculate the output voltage for disabled PWMs
  - i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe()
  - i2c: omap: Fix an error handling path in omap_i2c_probe()
  - i2c: omap: Add support for setting mux
  - usb: dwc3: qcom: Don't leave BCR asserted
  - usb: hub: Don't try to recover devices lost during warm reset.
  - usb: hub: Fix flushing of delayed work used for post resume purposes
  - usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm
  - usb: hub: fix detection of high tier USB3 devices behind suspended hubs
  - arm64: Filter out SME hwcaps when FEAT_SME isn't implemented
  - ipv6: make addrconf_wq single threaded
  - !20354 cpufreq/sched: Explicitly synchronize limits_changed flag handling
  - sched/deadline: only set free_cpus for online runqueues
  - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1
  - cpufreq/sched: Explicitly synchronize limits_changed flag handling
  - io_uring/poll: correctly handle io_poll_add() return value on update
  - shmem: fix recovery on rename failures
  - io_uring: fix filename leak in __io_openat_prep()
  - Revert "cgroup_freezer: cgroup_freezing: Check if not frozen"
  - rxrpc: Fix transmission of an abort in response to an abort
  - rxrpc: Fix recv-recv race of completed call
  - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree
  - net: bridge: Do not offload IGMP/MLD messages
  - hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf
  - netfilter: nf_conntrack: fix crash due to removal of uninitialised entry
  - ipv6: mcast: Delay put pmc->idev in mld_del_delrec()
  - net/mlx5: Correctly set gso_size when LRO is used
  - Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID
  - Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout
  - Bluetooth: SMP: If an unallowed command is received consider it a failure
  - Bluetooth: hci_sync: fix connectable extended advertising when using static random address
  - hwmon: (corsair-cpro) Validate the size of the received input buffer
  - selftests: net: increase inter-packet timeout in udpgro.sh
  - wifi: cfg80211: remove scan request n_channels counted_by
  - nvme: fix misaccounting of nvme-mpath inflight I/O
  - net: phy: Don't register LEDs for genphy
  - nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list()
  - rpl: Fix use-after-free in rpl_do_srh_inline().
  - block: fix kobject leak in blk_unregister_queue
  - net: emaclite: Fix missing pointer increment in aligned_read()
  - soundwire: amd: fix for clearing command status register
  - soundwire: amd: fix for handling slave alerts after link is down
  - comedi: Fix use of uninitialized data in insn_rw_emulate_bits()
  - comedi: Fix some signed shift left operations
  - comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large
  - comedi: das6402: Fix bit shift out of bounds
  - comedi: das16m1: Fix bit shift out of bounds
  - comedi: aio_iiro_16: Fix bit shift out of bounds
  - comedi: pcl812: Fix bit shift out of bounds
  - iio: adc: stm32-adc: Fix race in installing chained IRQ handler
  - iio: adc: max1363: Reorder mode_list[] entries
  - iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[]
  - iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush
  - soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled
  - soc: aspeed: lpc-snoop: Cleanup resources in stack-order
  - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again
  - pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov
  - net: libwx: properly reset Rx ring descriptor
  - net: libwx: remove duplicate page_pool_put_full_page()
  - mmc: sdhci_am654: Workaround for Errata i2312
  - mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models
  - mmc: bcm2835: Fix dma_unmap_sg() nents value
  - memstick: core: Zero initialize id_reg in h_memstick_read_dev_id()
  - isofs: Verify inode mode when loading from disk
  - dmaengine: nbpfaxi: Fix memory corruption in probe()
  - af_packet: fix soft lockup issue caused by tpacket_snd()
  - af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd()
  - arm64: dts: rockchip: use cs-gpios for spi1 on ringneck
  - arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on
  - arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency
  - net/mlx5: Update the list of the PCI supported devices
  - phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept()
  - io_uring/poll: fix POLLERR handling
  - ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS
  - drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume
  - tracing/osnoise: Fix crash in timerlat_dump_stack()
  - spi: Add check for 8-bit transfer with 8 IO mode support
  - pch_uart: Fix dma_sync_sg_for_device() nents value
  - thunderbolt: Fix bit masking in tb_dp_port_set_hops()
  - i2c: stm32: fix the device used for the DMA map
  - tracing: Fix crash on synthetic stacktrace field usage
  - usb: musb: fix gadget state on disconnect
  - USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI
  - USB: serial: option: add Foxconn T99W640
  - USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition
  - phy: tegra: xusb: Disable periodic tracking on Tegra234
  - phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode
  - phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode
  - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr
  - fs/proc: fix uaf in proc_readdir_de()
  - io_uring/net: commit partial buffers on retry
  - nvme: fix admin request_queue lifetime
  - fs/notify: call exportfs_encode_fid with s_umount
  - iomap: adjust read range correctly for non-block-aligned positions
  - fuse: fix livelock in synchronous file put from fuseblk workers
  - tpm: Cap the number of PCR banks
  - nfsd: provide locking for v4_end_grace
  - Revert "nfsd: provide locking for v4_end_grace"
  - config: enable config for PMT discovery driver
  - platform/x86/intel/pmt/discovery: use valid device pointer in dev_err_probe
  - platform/x86/intel/pmt: Fix kobject memory leak on init failure
  - platform/x86/intel/pmt: fix a crashlog NULL pointer access
  - platform/x86/intel/pmt: fix build dependency for kunit test
  - platform/x86/intel/pmt/discovery: fix format string warning
  - platform/x86/intel/pmt/discovery: Fix size_t specifiers for 32-bit
  - platform/x86/intel/pmt: KUNIT test for PMT Enhanced Discovery API
  - platform/x86/intel/pmt/telemetry: Add API to retrieve telemetry regions by feature
  - platform/x86/intel/pmt/discovery: Get telemetry attributes
  - platform/x86/intel/tpmi: Get OOBMSM CPU mapping from TPMI
  - platform/x86/intel/vsec: Set OOBMSM to CPU mapping
  - platform/x86/intel/tpmi: Relocate platform info to intel_vsec.h
  - docs: Add ABI documentation for intel_pmt feature directories
  - platform/x86/intel/pmt: Add PMT Discovery driver
  - sysfs: Fix crash on empty group attributes array
  - sysfs: Introduce a mechanism to hide static attribute_groups
  - platform/x86/intel/vsec: Add new Discovery feature
  - platform/x86/intel/vsec: Skip driverless features
  - platform/x86/intel/vsec: Skip absent features during initialization
  - platform/x86/intel/vsec: Add device links to enforce dependencies
  - platform/x86/intel/vsec: Create wrapper to walk PCI config space
  - platform/x86/intel/vsec: Add private data for per-device data
  - MAINTAINERS: Add link to documentation of Intel PMT ABI
  - platform/x86/intel/pmt: allow user offset for PMT callbacks
  - driver/coda: VirtCCA supports MSI device DA
  - ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency
  - Rename leapioraid to leapraid and release v2.0
  - ub: udma: fix a bug that caused long reboot time.
  - ub: ubase: Accelerate when ctrl node is shutting down
  - platform/x86/intel/pmt: Use PMT callbacks
  - platform/x86/intel/vsec: Add PMT read callbacks
  - platform/x86/intel/vsec.h: Move to include/linux
  - md: prevent incorrect update of resync/recovery offset
  - md/raid1: Fix data corruption for degraded array with slow disk
  - md/raid1: set max_sectors during early return from choose_slow_rdev()
  - md-cluster: fix no recovery job when adding/re-adding a disk
  - md-cluster: fix hanging issue while a new disk adding
  - md/raid5: recheck if reshape has finished with device_lock held
  - md-cluster: Constify struct md_cluster_operations
  - md: Remove unneeded semicolon
  - md/raid5: fix spares errors about rcu usage
  - dm-raid: Fix WARN_ON_ONCE check for sync_thread in raid_resume
  - md: pass in max_sectors for pers->sync_request()
  - md: factor out helpers for different sync_action in md_do_sync()
  - md: replace last_sync_action with new enum type
  - md: use new helpers in md_do_sync()
  - md: don't fail action_store() if sync_thread is not registered
  - md: remove parameter check_seq for stop_sync_thread()
  - md: replace sysfs api sync_action with new helpers
  - md: factor out helper to start reshape from action_store()
  - md: add new helpers for sync_action
  - md: add a new enum type sync_action
  - md: rearrange recovery_flags
  - md/raid0: don't free conf on raid0_run failure
  - md: make md_flush_request() more readable
  - md: change the return value type of md_write_start to void
  - md: Revert "md: Fix overflow in is_mddev_idle"
  - md: don't account sync_io if iostats of the disk is disabled
  - md: Fix overflow in is_mddev_idle
  - md: add check for sleepers in md_wakeup_thread()
  - md: add a mddev_is_dm helper
  - md: add a mddev_add_trace_msg helper
  - md: add a mddev_trace_remap helper
  - dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape
  - dm-raid: add a new helper prepare_suspend() in md_personality
  - dm-raid: really frozen sync_thread during suspend
  - md: add a new helper reshape_interrupted()
  - md: export helper md_is_rdwr()
  - md: export helpers to stop sync_thread
  - md: don't clear MD_RECOVERY_FROZEN for new dm-raid until resume
  - md/raid1: factor out helpers to choose the best rdev from read_balance()
  - md/raid1: factor out the code to manage sequential IO
  - md/raid1: factor out choose_bb_rdev() from read_balance()
  - md/raid1: factor out choose_slow_rdev() from read_balance()
  - md/raid1: factor out read_first_rdev() from read_balance()
  - md/raid1-10: factor out a new helper raid1_should_read_first()
  - md/raid1-10: add a helper raid1_check_read_range()
  - md/raid1: fix choose next idle in read_balance()
  - md/raid1: record nonrot rdevs while adding/removing rdevs to conf
  - md/raid1: factor out helpers to add rdev to conf
  - md: add a new helper rdev_has_badblock()
  - md: check mddev->pers before calling md_set_readonly()
  - md: clean up openers check in do_md_stop() and md_set_readonly()
  - md: sync blockdev before stopping raid or setting readonly
  - md: factor out a helper to sync mddev
  - md: return directly before setting did_set_md_closing
  - md: changed the switch of RAID_VERSION to if
  - md: merge the check of capabilities into md_ioctl_valid()
  - md: Don't suspend the array for interrupted reshape
  - md: Don't register sync_thread for reshape directly
  - md: Make sure md_do_sync() will set MD_RECOVERY_DONE
  - md: Don't ignore read-only array in md_check_recovery()
  - md: Don't ignore suspended array in md_check_recovery()
  - md: get rdev->mddev with READ_ONCE()
  - md: remove redundant md_wakeup_thread()
  - md: remove redundant check of 'mddev->sync_thread'
  - md: fix a suspicious RCU usage warning
  - raid: Remove now superfluous sentinel element from ctl_table array
  - NFSD: NFSv4 file creation neglects setting ACL
  - nfsd: set security label during create operations
  - xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read
  - nvme-fc: use lock accessing port_state and rport state
  - x86/mm: Batch flushing user memory encrytion status change


author: Li Nan <linan122@huawei.com> - 6.6.0-138.0.0.119
changelog:
  - !20588 [OLK-6.6] Revert "x86/csv: Enhance CMA memory usage reporting for CSV3"
  - Revert "x86/csv: Enhance CMA memory usage reporting for CSV3"
  - !20576  media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg()
  - !20575  RDMA/cm: Fix leaking the multicast GID table reference
  - !20580  RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly
  - !20551  Fix CVE-2025-68785
  - !20478  f2fs: fix to avoid potential deadlock
  - !20501 [OLK-6.6] backport important bugfix for bnxt driver from upstream linux-6.6.y
  - !20520 Fix CVE-2026-23038
  - !20424  net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup
  - !20425  mlx5: Fix default values in create CQ
  - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly
  - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg()
  - RDMA/cm: Fix leaking the multicast GID table reference
  - net: openvswitch: fix middle attribute validation in push_nsh() action
  - net: openvswitch: remove never-working support for setting nsh fields
  - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()
  - bnxt_en: Fix potential data corruption with HW GRO/LRO
  - f2fs: fix to avoid potential deadlock
  - mlx5: Fix default values in create CQ
  - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup


author: lingsheng <lingsheng1@h-partners.com> - 3.7.1-7
changelog:
  - Type:CVE
  - ID:CVE-2025-5914,CVE-2025-5915,CVE-2025-5916,CVE-2025-5917,CVE-2025-5918
  - SUG:NA
  - DESC:fix CVE-2025-5914 CVE-2025-5915 CVE-2025-5916 CVE-2025-5917 CVE-2025-5918


author: yyjeqhc <jialin.oerv@isrc.iscas.ac.cn> - 1.0.1-6
changelog:
  - Add select local image to build.
  - Add support for setting target architecture during local builds.


author: liyunfei <liyunfei33@huawei.com> - 17.0.6-50
changelog:
  - update to llvm-for-oe-17.0.6-2509.0.2
  - release-note https://gitee.com/openeuler/llvm-project/releases/tag/llvm-for-oE-17.0.6-2509.0.2


author: liyunfei <liyunfei33@huawei.com> - 17.0.6-54
changelog:
  - update to llvm-for-oe-17.0.6-2512.0.1
  - release-note https://gitee.com/openeuler/llvm-project/releases/tag/llvm-for-oE-17.0.6-2512.0.1


author: liyunfei <liyunfei33@huawei.com> - 17.0.6-56
changelog:
  - update to llvm-for-oe-17.0.6-2512.0.2
  - release-note https://gitee.com/openeuler/llvm-project/releases/tag/llvm-for-oE-17.0.6-2512.0.2


author: liyufnei <liyunfei33@huawei.com> - 17.0.6-57
changelog:
  - update to llvm-for-oe-17.0.6-2512.0.3
  - release-note https://gitee.com/openeuler/llvm-project/releases/tag/llvm-for-oE-17.0.6-2512.0.3


author: liyufnei <liyunfei33@huawei.com> - 17.0.6-58
changelog:
  - update to llvm-for-oe-17.0.6-2603.0.1
  - release-note https://gitcode.com/openeuler/llvm-project/releases/llvm-for-oE-17.0.6-2603.0.1


author: zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-17
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:libssh: fix freeing of resources in disconnect
         openssl: fix crash on missing cert password


author: zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-24
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:libssh: fix readdir issues
         h3: fix query of concurrent streams
         noproxy: fix the IPV6 network mask pattern match
         krb5_gssapi: fix memory leak on error path
         openldap: fix memory-leak in error path
         conn: fix hostname move on connection reuse 
         pop3: fix CAPA response termination detection
         libssh: properly free sftp_attributes
         openssl: fix a potential memory leak of params.cert


author: zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-25
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:urlapi: avoid null deref if setting blank host to url
         urlapi: skip appending NULL pointer query


author: zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-26
changelog:
  - Type:CVE
  - CVE:CVE-2025-14017 CVE-2025-14524 CVE-2025-14819 CVE-2025-15079 CVE-2025-15224
  - SUG:NA
  - DESC:fix CVE-2025-14017 CVE-2025-14524 CVE-2025-14819 CVE-2025-15079 CVE-2025-15224


author: yanglu <yanglu72@h-partners.com> - 2:6.6-5
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:ethtool:hibmcge:fix wrong register address in pretty print of ethtool -d command


author: andy <liuyang01@kylinos.cn> - 2:6.6-6
changelog:
  - Type:requirement
  - Id:NA
  - SUG:NA
  - DESC:ethtool: Fix SFF-8472 transceiver module identification
          ethtool: Add default branch to sff8636_show_all_ioctl switch
          qsfp: Better handling of Page 03h netlink read failure
          module-eeprom: treat zero arguments like any other arguments for hex dump
          qsf: Better handling of Page A2h netlink read failure


author: Fengyan Mu <mufengyan@huawei.com> - 2:6.6-7
changelog:
  - Type:requirement
  - Id:NA
  - SUG:NA
  - DESC:ethtool: Add support the printer for the registers of unic driver
          through the command -d


author: yanglu <yanglu72@h-partners.com> - 2:6.6-8
changelog:
  - Type:bugfix
  - Id:NA
  - SUG:NA
  - DESC:add NULL check before jsonw_string_field() in print_string()
         netlink:add NULL check for get_string() in features.c


author: wangkai <13474090681@163.com> - 140.3.1-1
changelog:
  - Update to 140.3.1
  - Fix CVE-2025-10527 CVE-2025-10528 CVE-2025-10529 CVE-2025-10532 CVE-2025-10533
    CVE-2025-10536 CVE-2025-10537 CVE-2025-9182 CVE-2025-9183 CVE-2025-9184
    CVE-2025-8036 CVE-2025-8037 CVE-2025-8038 CVE-2025-8039 CVE-2025-8040


author: Funda Wang <fundawang@yeah.net> - 140.4.0-1
changelog:
  - update to 140.4.0
  - fix CVE-2025-11708, CVE-2025-11709, CVE-2025-11710, CVE-2025-11711,
    CVE-2025-11712, CVE-2025-11713, CVE-2025-11714, CVE-2025-11715


author: Funda Wang <fundawang@yeah.net> - 140.5.0-1
changelog:
  - update to 140.5.0
    * fix CVE-2025-13012, CVE-2025-13013, CVE-2025-13014, CVE-2025-13015,
      CVE-2025-13016, CVE-2025-13017, CVE-2025-13018, CVE-2025-13019,
      CVE-2025-13020


author: Funda Wang <fundawang@yeah.net> - 140.7.0-1
changelog:
  - update to 140.7.0
    * fix CVE-2026-0877, CVE-2026-0878, CVE-2026-0879, CVE-2026-0880,
      CVE-2026-0882, CVE-2025-14327, CVE-2026-0883, CVE-2026-0884,
      CVE-2026-0885, CVE-2026-0886, CVE-2026-0887, CVE-2026-0890,
      CVE-2026-0891


author: wangkai <13474090681@163.com> - 2:2.11.7-1
changelog:
  - Update to 2.11.7 for fix CVE-2024-32039,CVE-2024-32040,
    CVE-2024-32041,CVE-2024-32458,CVE-2024-32459,CVE-2024-32460,
    CVE-2024-32658,CVE-2024-32659 and CVE-2024-32660


author: Qingqing Li <liqingqing3@huawei.com> - 2.38-86
changelog:
  - memalign: reinstate alignment overflow check (CVE-2026-0861)
  - resolv: Fix NSS DNS backend for getnetbyaddr (CVE-2026-0915)


author: yaoxin <yao_xin001@hoperun.com> - 1.14.5-1
changelog:
  - Update to 1.14.5:
    * Added signed Windows msi binary and signed Apple dmg binary files.
    * Moved examples to the HDF5Examples folder in the source tree.
    * Added support for using zlib-ng package as the zlib library
    * Disable CMake UNITY_BUILD for hdf5
    * Removed "function/code stack" debugging configuration option
    * Added configure options for enabling/disabling non-standard programming language features
    * Added the CMake variable HDF5_ENABLE_ROS3_VFD to the HDF5 CMake config
      file hdf5-config.cmake. This allows it to easily detect if the library
      has been built with or without read-only S3 functionality.
    * Fixed many CVE:
      CVE-2024-29157,CVE-2024-29158,CVE-2024-29159,CVE-2024-29160,CVE-2024-29161,CVE-2024-29162
      CVE-2024-29163,CVE-2024-29164,CVE-2024-29165,CVE-2024-29166,CVE-2024-32605,CVE-2024-32606
      CVE-2024-32607,CVE-2024-32608,CVE-2024-32609,CVE-2024-32610,CVE-2024-32611,CVE-2024-32612
      CVE-2024-32613,CVE-2024-32614,CVE-2024-32615,CVE-2024-32616,CVE-2024-32617,CVE-2024-32618
      CVE-2024-32619,CVE-2024-32620,CVE-2024-32621,CVE-2024-32622,CVE-2024-32623,CVE-2024-32624
      CVE-2024-33873,CVE-2024-33874,CVE-2024-33875,CVE-2024-33876,CVE-2024-33877,CVE-2018-13871
      CVE-2018-13875,CVE-2018-14034


author: Funda Wang <fundawang@yeah.net> - 1.14.5-2
changelog:
  - add patches from azure linux for fixing CVE-2025-2153, CVE-2025-2310,
    CVE-2025-2914, CVE-2025-2926, CVE-2025-6816, CVE-2025-2925,
    CVE-2025-2924, CVE-2025-44905, CVE-2025-6269, CVE-2025-6750,
    CVE-2025-6857, CVE-2025-7067, CVE-2025-7068, CVE-2025-6858,
    CVE-2025-2923, CVE-2025-2913, CVE-2025-6516, CVE-2025-6818,
    CVE-2025-6817, CVE-2025-6856, CVE-2025-7069


author: zhangyaqi <zhagnyaqi@kylinos.cn> - 2.4.58-3
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:allocate a heap buffer if the configured size is greater than the stack-allocated buffer.


author: chengyechun <chengyechun1@huawei.com> - 2.4.58-6
changelog:
  - Type:CVE
  - ID:CVE-2024-38473,CVE-2024-38474,CVE-2024-38475,CVE-2024-38476,CVE-2024-38477,CVE-2024-39884,CVE-2024-39573
  - SUG:NA
  - DSEC:fix some CVEs


author: xingwei <xingwei14@h-partners.com> - 2.4.58-9
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:mod_log_config: Fix LogFormat directive merging
         Fix X509 leak and Increase MAX_CONCURRENCY hard limit
         mod_proxy_balancer: Fix the handling of the stickysession
         mod_cache_socache: Fix possible crash on error path
         mod_ssl: Check SSL_CTX_new() return value
         core: Report invalid Options argument when parsing AllowOverride directives


author: yanglu <yanglu72@h-partners.com> - 2.4.58-10
changelog:
  - Type:CVE
  - CVE:CVE-2025-49812,CVE-2025-23048,CVE-2024-47252,CVE-2024-43204,CVE-2024-42516
  - SUG:NA
  - DESC:fix CVE-2025-49812 CVE-2025-23048 CVE-2024-47252 CVE-2024-43204 CVE-2024-42516
         mod_lua: Fix memory handling in output filters.
         Fix a regression that caused stickysession keys
         avoid ap_set_content_type when processing a _Request_Header
         set_cookie_name: ensure correct format


author: tangce <tangce1@h-partners.com> - 2.4.58-11
changelog:
  - Type:CVE
  - CVE:CVE-2025-58098,CVE-2025-65082,CVE-2025-66200
  - SUG:NA
  - DESC:fix CVE-2025-58098,CVE-2025-65082,CVE-2025-66200


author: jingxiaolu<lujingxiao@huawei.com> - 2.1.5-18
changelog:
  - Type: bugfix
  - ID: NA
  - SUG: NA
  - DESC: sync patches from upstream for refactoring sandbox and bugfixing


author: liweigang <liweiganga@uniontech.com> - 1.8.9-5
changelog:
  - Type: bugfix
  - ID: NA
  - SUG: NA
  - DESC: libxtables: Fix memleak of matches' udata
          xshared: Fix parsing of empty string arg in '-c' option


author: yanglu <yanglu72@h-partners.com> - 1.8.9-8
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:extensions:recent:Fix format string for unsigned values
         nft:cmd:Init struct nft_cmd::head early


author: xinghe <xinghe2@h-partners.com> - 2:1.6.40-2
changelog:
  - Type:cves
  - CVE:CVE-2025-64505 CVE-2025-64506 CVE-2025-65018 CVE-2025-64720
  - SUG:NA
  - DESC:fix CVE-2025-64505 CVE-2025-64506 CVE-2025-65018 CVE-2025-64720


author: xinghe <xinghe2@h-partners.com> - 2.74.3-4
changelog:
  - Type:cves
  - ID:CVE-2024-52530 CVE-2024-52531 CVE-2024-52532
  - SUG:NA
  - DESC:fix CVE-2024-52530 CVE-2024-52531 CVE-2024-52532


author: zhangpan <zhangpan103@h-partners.com> - 2.74.3-5
changelog:
  - Type:cves
  - ID:CVE-2025-32050 CVE-2025-32052 CVE-2025-32053 CVE-2025-2784
  - SUG:NA
  - DESC:fix CVE-2025-32050 CVE-2025-32052 CVE-2025-32053 CVE-2025-2784


author: zhangpan <zhangpan103@h-partners.com> - 2.74.3-7
changelog:
  - Type:cves
  - ID:CVE-2025-32906 CVE-2025-32909 CVE-2025-32910 CVE-2025-32911 CVE-2025-32912 CVE-2025-32913
  - SUG:NA
  - DESC:fix CVE-2025-32906 CVE-2025-32909 CVE-2025-32910 CVE-2025-32911 CVE-2025-32912 CVE-2025-32913


author: zhangpan <zhangpan103@h-partners.com> - 2.74.3-10
changelog:
  - Type:cves
  - ID:CVE-2025-4476 CVE-2025-4948 CVE-2025-4969
  - SUG:NA
  - DESC:fix CVE-2025-4476 CVE-2025-4948 CVE-2025-4969


author: nickyang <nickyang228@163.com> - 2.74.3-12
changelog:
  - Type:cves
  - ID:CVE-2026-1539 CVE-2026-1467 CVE-2026-1761 CVE-2026-0716
  - SUG:NA
  - DESC:fix CVE-2026-1539 CVE-2026-1467 CVE-2026-1761 CVE-2026-0716


author: ZixinLi <lizixin10@h-partners.com> - 9.10.0-23
changelog:
  - Fix CVE-2025-12748 CVE-2025-13193
  - conf: Add virDomainDefIDsParseString
  - bhyve: Check ACLs before parsing the whole domain XML
  - libxl: Check ACLs before parsing the whole domain XML
  - lxc: Check ACLs before parsing the whole domain XML
  - vz: Check ACLs before parsing the whole domain XML
  - ch: Check ACLs before parsing the whole domain XML
  - qemu: Check ACLs before parsing the whole domain XML
  - qemu: snapshot: Set umask for 'qemu-img' when creating external inactive snapshots


author: PengruiZhang <zhangpengrui@huawei.com> - 9.10.0-26
changelog:
  - vdpa: Add the count of vdpa devices when calculating Max locked memory
  - virDomainDeviceIsUSB: Handle all USB devices and simplify the code
  - add TengyunS5000C cpu info to cpu map
  - qemu:Implement the RAS feature for aarch64


author: liyunfei <liyunfei33@huawei.com> - 19.1.7-11
changelog:
  - update to llvm-for-oE-19.1.7-2506.0.2
  - release note: https://gitee.com/openeuler/llvm-project/releases/tag/llvm-for-oE-19.1.7-2506.0.2


author: liyunfei <liyunfei33@huawei.com> - 19.1.7-17
changelog:
  - update to llvm-for-oE-19.1.7-2512.0.1
  - release note: https://gitee.com/openeuler/llvm-project/releases/tag/llvm-for-oE-19.1.7-2512.0.1


author: liyunfei <liyunfei33@huawei.com> - 19.1.7-19
changelog:
  - update to llvm-for-oE-19.1.7-2512.0.2
  - release note: https://gitee.com/openeuler/llvm-project/releases/tag/llvm-for-oE-19.1.7-2512.0.2


author: Funda Wang <fundawang@yeah.net> - 20240813-1
changelog:
  - update to 20240813 for fix CVE-2024-24853, CVE-2024-25939,
    CVE-2024-24980, CVE-2023-42667, CVE-2023-49141


author: Funda Wang <fundawang@yeah.net> - 20250211-1
changelog:
  - update to 2025021 for fix CVE-2024-28047, CVE-2024-31157, CVE-2024-39279,
    CVE-2024-28127, CVE-2024-29214, CVE-2024-24582, CVE-2023-34440, CVE-2024-37020,
    CVE-2024-39355, CVE-2023-43758, CVE-2024-36293, CVE-2024-31068


author: Funda Wang <fundawang@yeah.net> - 20250512-1
changelog:
  - update to 20250512 to fix CVE-2024-28956, CVE-2025-24495, CVE-2025-20012,
    CVE-2024-45332, CVE-2025-20623, CVE-2024-43420, CVE-2025-20054, CVE-2025-20103


author: Funda Wang <fundawang@yeah.net> - 20250812-1
changelog:
  - update to 20250812 to fix CVE-2025-20053, CVE-2025-20109, CVE-2025-21090,
    CVE-2025-22839, CVE-2025-22840, CVE-2025-22889, CVE-2025-24305, CVE-2025-26403,
    CVE-2025-32086


author: wangkai <13474090681@163.com> - 8.0.38-1
changelog:
  - Update to 8.0.38 for fix CVEs(CVE-2024-21125,CVE-2024-21142,CVE-2024-21179,
    CVE-2024-21171,CVE-2024-21130,CVE-2024-21162,CVE-2024-21177,CVE-2024-20996,
    CVE-2024-21134,CVE-2024-21165,CVE-2024-21173,CVE-2024-21129,CVE-2024-21127,
    CVE-2024-21163)


author: wangkai <13474090681@163.com> - 8.0.40-1
changelog:
  - Update to 8.0.40 for fix CVEs(CVE-2024-21218,CVE-2024-21196,CVE-2024-21207,
    CVE-2024-21198,CVE-2024-21203,CVE-2024-21213,CVE-2024-21239,CVE-2024-21199,
    CVE-2024-21197,CVE-2024-21247,CVE-2024-21193,CVE-2024-21212,CVE-2024-21241,
    CVE-2024-21230,CVE-2024-21236,CVE-2024-21194,CVE-2024-21238,CVE-2024-21237,
    CVE-2024-21201,CVE-2024-21231,CVE-2024-21219,CVE-2024-21185)


author: yaoxin <1024769339@qq.com> - 8.0.41-1
changelog:
  - Update to 8.0.41 for fix CVEs(CVE-2025-21490,CVE-2025-21491,CVE-2025-21495,
    CVE-2025-21497,CVE-2025-21500,CVE-2025-21501,CVE-2025-21503,CVE-2025-21505,
    CVE-2025-21518,CVE-2025-21519,CVE-2025-21520,CVE-2025-21522,CVE-2025-21523,
    CVE-2025-21529,CVE-2025-21531,CVE-2025-21540,CVE-2025-21543,CVE-2025-21546,
    CVE-2025-21555,CVE-2025-21559)


author: yaoxin <1024769339@qq.com> - 8.0.42-1
changelog:
  - Update to 8.0.42 for fix CVEs(CVE-2025-21574,CVE-2025-21575,CVE-2025-21577,
    CVE-2025-21580,CVE-2025-21581,CVE-2025-21584,CVE-2025-21585,CVE-2025-30681,
    CVE-2025-30682,CVE-2025-30683,CVE-2025-30684,CVE-2025-30685,CVE-2025-30687,
    CVE-2025-30688,CVE-2025-30689,CVE-2025-30693,CVE-2025-30695,CVE-2025-30696,
    CVE-2025-30699,CVE-2025-30703,CVE-2025-30704,CVE-2025-30705,CVE-2025-30710,
    CVE-2025-30715,CVE-2025-30721,CVE-2025-30722


author: yaoxin <1024769339@qq.com> - 8.0.43-1
changelog:
  - Update to 8.4.6 for fix CVEs (CVE-2025-50068,CVE-2025-50077,CVE-2025-50078,
    CVE-2025-50079,CVE-2025-50080,CVE-2025-50081,CVE-2025-50082,CVE-2025-50083,
    CVE-2025-50084,CVE-2025-50085,CVE-2025-50086,CVE-2025-50087,CVE-2025-50091,
    CVE-2025-50092,CVE-2025-50093,CVE-2025-50094,CVE-2025-50096,CVE-2025-50097,
    CVE-2025-50098,CVE-2025-50099,CVE-2025-50100,CVE-2025-50101,CVE-2025-50102,
    CVE-2025-50104,CVE-2025-53023)


author: wangkai <13474090681@163.com> - 8.0.44-1
changelog:
  - Update to 8.0.44 for fix CVEs (CVE-2025-53069,CVE-2025-53062,CVE-2025-53054,
    CVE-2025-53053,CVE-2025-53045,CVE-2025-53044,CVE-2025-53042,CVE-2025-53040)


author: yaoxin <1024769339@qq.com> - 8.0.45-1
changelog:
  - Update to 8.0.45 for fix CVEs (CVE-2026-21936,CVE-2026-21937,
    CVE-2026-21941,CVE-2026-21948,CVE-2026-21964,CVE-2026-21968)


author: gaihuiying <eaglegai@163.com> - 1:5.9.3-2
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Customized the anti-attacki/reset-last_engineTime function for IdeaUI
         change the permissions of passtest


author: xingwei <xingwei14@h-partners.com> - 1:5.9.3-3
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Migration patch from upstream, add compatibility to parse
  Linux 6.7 Ip header while keep support for previous versions.


author: yaoxin <yao_xin001@hoperun.com> - 1:20.12.1-1
changelog:
  - Update to 20.12.1:
    * CVE-2024-27983 - Assertion failed in node::http2::Http2Session::~Http2Session()
      leads to HTTP/2 server crash- (High)
    * CVE-2024-27982 - HTTP Request Smuggling via Content Length Obfuscation - (Medium)
    * llhttp version 9.2.1
    * undici version 5.28.4


author: jchzhou <zhoujiacheng@iscas.ac.cn> - 1:20.12.1-2
changelog:
  - fix building w/ clang: only apply '-fno-ipa-icf' for gcc && disable LTO for clang + ld.bfd
  - improve the handling of trilling whitespaces in C/CXXFLAGS


author: Ge Wang <wang__ge@126.com> - 1:20.12.1-3
changelog:
  - CVE-2023-45853 - Reject overflows of zip header fields in minizip
  - CVE-2024-5274 - Using FunctionParsingScope for parsing class static
  - CVE-2024-5535 - Fix SSL_select_next_proto
  - CVE-2024-7971 - Spill all loop inputs before entering loop


author: wangkai <13474090681@163.com> - 1:20.18.2-1
changelog:
  - Update to 20.18.2
  - Fix CVE-2025-23083 CVE-2025-23085 CVE-2025-23084 CVE-2024-36137
    CVE-2024-22018 CVE-2024-22020


author: wangkai <13474090681@163.com> - 1:20.18.2-5
changelog:
  - Fix CVE-2025-55130, CVE-2025-55131, CVE-2025-55132,
    CVE-2025-59465, CVE-2025-59466, CVE-2026-21637


author: xu_ping <707078654@qq.com> - 3.24.0-1
changelog:
  - Upgrade version to 3.24.0
    * Add support for FIPS-session mode
    * Updates to harden against RSA timing attacks
    * Add option to show the master key verification patterns of secure keys
    * Add support for exporting a key or certificate as URI-PEM file
    * Performance improvements for attribute retrieval
    * Add support for SHA-2 mechanisms
    * Experimental support for IBM Dilithium via OpenSSL OQS provider
    * Support live guest relocation for protected key (PKEY) operations
    * Add support for CKA_ALWAYS_AUTHENTICATE
    * Add support for CKD_*_SP800 KDFs for ECDH
    * Add support for SHA based key derivation mechanisms
    * Add support for PKCS#11 v3.0 SHA3 mechanisms
    * Add support for building Opencryptoki on the IBM AIX platform
    * Add support for the CCA token on non-IBM Z platforms (x86_64, ppc64)
    * Add support for protecting tokens with a token specific user group
    * Add support for combined CKA_EXTRACTABLE and CKA_IBM_PROTKEY_EXTRACTABLE
    * Add support for Koblitz curve secp256k1. Requires CCA v7.2 or later


author: zhang_wenyu <zhang_wenyu@hoperun.com> - 3.25.0-1
changelog:
  - Upgrade version to 3.25.0
    * Add support for PKCS#11 v3.0 SHAKE key derivation
    * Add support for PKCS#11 v3.0 SHA3 and SHA3-HMAC mechanisms
    * Add support for PKCS#11 v3.0 SHA3 mechanisms and MGFs for RSA-OAEP
    * Add support for PKCS#11 v3.0 SHA3 variants of RSA-PKCS and ECDSA mechanisms
    * Add support for CCA AES CIPHER secure key types
    * Add support for the CKM_ECDH1_DERIVE mechanism
    * Add support for the CKM_AES_KEY_WRAP[_*] mechanisms
    * Add support for the CKM_RSA_AES_KEY_WRAP mechanism
    * Add support for the CKM_ECDH_AES_KEY_WRAP mechanism
    * Add a tool for import and exporting PKCS#11 keys to a KMIP server
    * Add support for opaque secure key blob import via C_CreateObject
    * Add support for key wrapping with AES-GCM
    * Add support for newer CCA versions on s390x and non-s390x platforms
    * Add support for CKM_AES_GCM (single-part operations only)


author: fly_fzc <2385803914@qq.com> - 1:3.0.12-32
changelog:
  - fix CVE-2025-15467,CVE-2025-69418,
        CVE-2025-69419,CVE-2025-69420,
        CVE-2025-69421,CVE-2026-22795,
        CVE-2026-22796


author: yaoxin <yao_xin001@hoperun.com> - 6.4.1-1
changelog:
  - Update to 6.4.1
    * Parsing of the ``Transfer-Encoding`` header is now stricter.
    * Handling of whitespace in headers now matches the RFC more closely.
    * ``tornado.curl_httpclient`` now prohibits carriage return and linefeed headers in HTTP headers
    (matching the behavior of ``simple_httpclient``).


author: chengyechun <chengyechun1@huawei.com> - 1.26.18-2
changelog:
  - Type:CVE
  - CVE:CVE-2024-37891
  - SUG:NA
  - DESC:fix CVE-2024-37891 Strip Proxy-Authorizatioin header on redirects


author: zhangpengrui <zhangpengrui@huawei.com> 11:8.2.0-59
changelog:
  - vfio: Fix CSV3 mapping device mmio issue
  - util/cacheflush: Make first DSB unconditional on aarch64
  - block: Zero block driver state before reopening
  - target/arm: Correct STRD atomicity
  - qemu-img: Fix amend option parse error handling
  - qemu-img rebase: don't exceed IO_BUF_SIZE in one operation
  - aio-posix: keep polling enabled with fdmon-io_uring.c


author: zhangpengrui <zhangpengrui@huawei.com> 11:8.2.0-60
changelog:
  - qga: Fix truncated output handling in guest-exec status reporting
  - qga/installer: Remove QGA VSS if QGA installation failed
  - qga: Fix channel initialization check in run_agent_once
  - hw/rtc/goldfish: keep time offset when resetting
  - target/arm: Make DisasContext.{fp, sve}_access_checked tristate
  - net: parameterize the removing client from nc list
  - hid: fix incorrect return value for hid
  - util/qemu-timer.c: Don't warp timer from timerlist_rearm()
  - wdt_i6300esb: fix incorrect mask for interrupt type
  - target/arm: Correct LDRD atomicity and fault behaviour


author: zhangpengrui <zhangpengrui@huawei.com> 11:8.2.0-61
changelog:
  - tracetool: fix usage of try_import()
  - gtk: Skip drawing if console surface is NULL
  - vfio/iommufd: Fix SIGSEV in iommufd_cdev_attach()
  - qmp: update vhost-user protocol feature maps
  - hw/intc/arm_gicv3_its: Zero initialize local DTEntry etc structs
  - hw/aspeed/{xdma, rtc, sdhci}: Fix endianness to DEVICE_LITTLE_ENDIAN
  - replay: Improve assert in replay_char_read_all_load()
  - hw/scsi: Use error_setg_file_open() for a better error message
  - hw/virtio: Use error_setg_file_open() for a better error message
  - ui/vnc: Fix qemu abort when query vnc info


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-62
changelog:
  - iotests: Run iotests with sanitizers
  - tests/qemu-iotest: Add more image formats to the thorough testing
  - hw/intc: fix the issue of vNMI not supporting live migration
  - vfio/pci: VirtCCA adapt Ascend310P bar2 quirk.
  - vdpa:Set the vhostdev character of the VDPA device to the idstr assigned during migration
  - vdpa: Enable the ability of all VDPA devices to obtain backend config
  - hw/misc/psp.c: support live migrate for vpsp device
  - qga: ignore channel_init() fail if 'retry_path' is set
  - docs: fix typo in xive doc


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-63
changelog:
  - chardev/char-pty: Do not ignore chr_write() failures
  - hw/display/exynos4210_fimd: Remove duplicated definition
  - kvm: Fix kvm_vm_ioctl() and kvm_device_ioctl() return value
  - hw/vfio/hct: fix ci check_code issues
  - hw/vfio/hct: support abort migration when hct exception
  - hw/vfio/hct: fix virtual machine paused due to obtain VQ failed.
  - hw/vfio/hct: support live migration function for virtual machines.
  - hw/vfio/hct: support vfio-pci multiple processes.
  - hw/vfio/hct: support start with ccp.ko driver
  - hw/vfio/hct: remove the operation of reading the value of mdev index in qemu.
  - hw/vfio/hct: fix ccp index error caused by uninitialized buf
  - hw/vfio/hct: compatible with hct.ko modules in versions 0.5 and earlier.
  - hw/vfio/hct: sharing CCP resources between host and virtual machines.
  - aio-posix: fix spurious return from ->wait() due to signals
  - tests/unit: skip test-nested-aio-poll with io_uring
  - tests/qemu-iotests/184: Fix skip message for qemu-img without throttle
  - target/arm/cpu64: remove duplicate include
  - cxl/cdat: Fix header sum value in CDAT checksum
  - hw/virtio: Fix packed virtqueue flush used_idx


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-64
changelog:
  - arm/cpu: fix werrors if CONFIG_USER_ONLY was set
  - crypto/hash-gcrypt: Correct undeclared parameter
  - config/targets: update aarch64_be-linux-user gdb XML list
  - ub: add more check for arry to prevent mem overrun
  - backends: fix node id out of range when set proportion
  - ub: check kvm_usi_via_irqfd when set kvm interrupt
  - ub: fix some mem leak in handle_enum_query_request
  - ub: remove unused param in enum_query_get_max_num_ports
  - ub: fix possible mem overrun in fill_rq
  - ub: do size check for alloc idev ers addr
  - ub: dma memory read wirte with memory flag
  - ub: ummu mcmdq null cmd fix mem leak and enhace safe
  - ub: limits ummu kvtbl max entries to 1024
  - ub: fix some mem leak
  - ub: correct ub cfg setting and values
  - ub: support different versions of the UMMU chips
  - ub: fix compiling error if target is not aarch64


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-65
changelog:
  - net: pad packets to minimum length in qemu_receive_packet() (CVE-2025-12464)
  - io: release active GSource in TLS channel finalizer
  - io: move websock resource release to close method
  - io: fix use after free in websocket handshake code(CVE-2025-11234)
  - ub: correct cfg write access


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-66
changelog:
  - hw/i386/kvm: fix PIRQ bounds check in xen_physdev_map_pirq()(CVE-2026-0665)
  - hw/intc/loongarch_ipi_kvm: Fix the bug where the VM would crash when performing save or resume operations.
  - cxl/cdat: Handle cdat table build errors
  - hw/virtio: Fix the de-initialization of vhost-user devices
  - ub: fix memory leak in double pointer


author: openEuler <contact@openeuler.org> - 0.10.2-2
changelog:
  - Add internationalization support (currently supports English and Simplified Chinese)
  - Fix issue where settings page may reopen multiple times


author: openEuler <contact@openeuler.org> - 0.10.2-4
changelog:
  - Fix timeout when executing complex MCP tasks
  - Feature: Add login through browser (requires proper desktop environment)


author: openEuler <contact@openeuler.org> - 0.10.2-6
changelog:
  - installer: Add support for package name and alternative package name formats
  - cli: Fix TUI keyboard interaction issue in some environments


author: openEuler <contact@openeuler.org> - 2.0.0-3
changelog:
  - feat: Add Witty Assistant welcome screen & LOGO
  - refactor: Improve Markdown rendering performance in TUI


author: openEuler <contact@openeuler.org> - 2.0.1-1
changelog:
  - feat: Set defautl chat model during installation
  - feat: Add shell completion installation command
  - fix: Markdown rendering issue in TUI
  - chore: Remove deprecated scripts in installer


author: openEuler <contact@openeuler.org> - 2.0.2-1
changelog:
  - feat: Add option to launch OpenCode through Witty Assistant
  - installer: Install OpenCode-AI during deployment


author: Funda Wang <fundawang@yeah.net> - 1.20.11-37
changelog:
  - fix CVE-2025-26594, CVE-2025-26595, CVE-2025-26596,
    CVE-2025-26597, CVE-2025-26598, CVE-2025-26599
    CVE-2025-26600, CVE-2025-26601


author: Wang Kui <wangkui35@h-partners.com> - 1.20.11-41
changelog:
  - Fix CVE-2025-49176 CVE-2025-49179 CVE-2025-49180 CVE-2022-49737
    CVE-2025-62229 CVE-2025-62230 CVE-2025-62231


author: lingsheng <ultra_planet@qq.com> - 1.20.11-42
changelog:
  - fix CVE-2022-49737 CVE-2025-49175 CVE-2025-49176 CVE-2025-49178 CVE-2025-49179 CVE-2025-49180 CVE-2025-62229 CVE-2025-62230 CVE-2025-62231


