# changelog

author: Li Nan <linan122@huawei.com> - 6.6.0-137.0.0.131
changelog:
  - !20552 ub: udma: fix some code issues.
  - !20313 Fix CVE-2025-40220
  - !20321  nvme: fix admin request_queue lifetime
  - !20512 PM / devfreq: hisi: Fix potential UAF in OPP handling
  - !20544 Fix CVE-2025-71147
  - !20548 v4  net: LTS-6.6 backport
  - !20503 Fix CVE-2025-39713
  - !20133 Fix CVE-2025-39721
  - !20438 Fix CVE-2025-38659
  - !20264 Fix CVE-2025-40277
  - !20340 Fix CVE-2025-40271
  - !20319 Fix CVE-2025-40237
  - !20392  vfs: Don't leak disconnected dentries on umount
  - !20554  iommu/s390: Implement blocking domain
  - !20489 [OLK-6.6][linux-6.6.y sync] Backport 6.6.101-6.6.102 LTS Patches
  - !20513 ACPI: PCC: Fix race condition by removing static qualifier
  - !20468  drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer
  - !20483  rcu: Protect ->defer_qs_iw_pending from data race
  - !20510 drivers/ub/sentry: fix primary eid index value
  - !20553 ub: cdma: support separated page table feature
  - ub: udma: fix some code issues.
  - !20480 iommu/ummu-core: fix error invalidate tid
  - !20561 iommu/ummu: Add ummu sva independent page table parameter
  - ub: udma: bugfix related to 2m_hugepage.
  - ub: udma: support for separate page tables
  - ub: udma: delete debugfs code.
  - ub: udma: bugfix related to ctrlq function.
  - ub: udma: verify get cqe/ae aux info out addr and len.
  - ub: cdma: support separated page table feature
  - iommu/ummu: Add ummu sva independent page table parameter
  - iommu: Adjust PLB refresh timing in 'grant' and 'ungrant'
  - !20505 Fix CVE-2026-23035
  - iommu/s390: Implement blocking domain
  - drivers/ub/sentry: fix primary eid index value
  - !20535  libceph: make decode_pool() more resilient against corrupted osdmaps
  - !20536  mm/page_alloc: change all pageblocks migrate type on coalescing
  - !20537  mm/secretmem: fix use-after-free race in fault handler
  - !20538  wifi: avoid kernel-infoleak from struct iw_point
  - !20539  net: usb: rtl8150: fix memory leak on usb_submit_urb() failure
  - !20440  PCI/AER: Fix NULL pointer access by aer_info
  - !20262 Fix CVE-2025-68176
  - netfilter: nf_reject: don't leak dst refcount for loopback packets
  - net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error
  - page_pool: always add GFP_NOWARN for ATOMIC allocations
  - virtio-net: fix received length check in big packets
  - net: bridge: fix use-after-free due to MST port state bypass
  - vsock: Ignore signal/timeout on connect() if already established
  - tls: make sure to abort the stream if headers are bogus
  - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI
  - xfrm: Duplicate SPI Handling
  - tls: handle data disappearing from under the TLS ULP
  - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing
  - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls
  - Bluetooth: hci_core: Fix use-after-free in vhci_flush()
  - KEYS: trusted: Fix a memory leak in tpm2_load_cmd
  - !20237 Fix CVE-2025-68724
  - !20459 Fix CVE-2025-71131
  - !20525 Fix CVE-2025-68816
  - !20529  CVE-2025-68172
  - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure
  - !20370 Revert "Revert "RDMA/hns: Fix mismatch exception rollback""
  - wifi: avoid kernel-infoleak from struct iw_point
  - mm/secretmem: fix use-after-free race in fault handler
  - mm/page_alloc: change all pageblocks migrate type on coalescing
  - libceph: make decode_pool() more resilient against corrupted osdmaps
  - pps: Fix kabi breakage of struct pps_device for last_fetched_ev
  - sched: Fix kabi breakage of struct task_struct for saved_state
  - crypto: aspeed - fix double free caused by devm
  - !20515  Bluetooth: bcsp: receive data only if registered
  - !20507 Fix CVE-2025-40358
  - !20450 ub: ubase&unic: Fix some bug in concurrent process
  - !20452 iommu/ummu: Fix some bugs and optimize the code implementation
  - !20451 iommu/ummu: Add the function of creating devices with SVA-separated
  - !20500 mm: fix the inaccurate memory statistics issue for users
  - net/mlx5: fw_tracer, Validate format string parameters
  - Bluetooth: bcsp: receive data only if registered
  - ACPI: PCC: Fix race condition by removing static qualifier
  - ACPI: CPPC: Fix missing PCC check for guaranteed_perf
  - iommu/ummu: Add the function of creating devices with SVA-separated
  - iommu/ummu-core: fix error invalidate tid
  - riscv: stacktrace: Disable KASAN checks for non-current tasks
  - !20497  arch_topology: Fix incorrect error check in topology_parse_cpu_capacity()
  - !20496  drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies
  - !20495  iommu/amd: Avoid stack buffer overflow from kernel cmdline
  - !20494  HID: core: Harden s32ton() against conversion to 0 bits
  - !20493  iommu: Fix two issues in iommu_copy_struct_from_user()
  - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv
  - PM / devfreq: hisi: Fix potential UAF in OPP handling
  - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()
  - !20487  interference: Fix uninitialized ifs_clock compiling issue
  - MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow
  - MIPS: mm: Prevent a TLB shutdown on initial uniquification
  - mm: fix the inaccurate memory statistics issue for users
  - mm: add config option for atomic mode in mm counter
  - Revert "mm: fix the inaccurate memory statistics issue for users"
  - !20444  net/mlx5e: Fix crash on profile change rollback failure
  - !20442  net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv
  - arch_topology: Fix incorrect error check in topology_parse_cpu_capacity()
  - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies
  - iommu/amd: Avoid stack buffer overflow from kernel cmdline
  - HID: core: Harden s32ton() against conversion to 0 bits
  - iommu: Fix two issues in iommu_copy_struct_from_user()
  - SUNRPC: call xs_sock_process_cmsg for all cmsg
  - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read
  - !20374 [OLK 6.6]Use Hygon IBRS and IBPB rather than software-based mitigation to mitigate Retbleed and SRSO.
  - !20227  Rename leapioraid to leapraid and release v2.0
  - mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery
  - MIPS: mm: tlb-r4k: Uniquify TLB entries on init
  - x86/fpu: Delay instruction pointer fixup until after warning
  - ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx()
  - ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe()
  - x86/sev: Evict cache lines during SNP memory validation
  - net: usbnet: Fix the wrong netif_carrier_on() call
  - net: usbnet: Avoid potential RCU stall on LINK_CHANGE event
  - Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano
  - sched,freezer: Remove unnecessary warning in __thaw_task
  - freezer,sched: Clean saved_state when restoring it during thaw
  - freezer,sched: Do not restore saved_state of a thawed task
  - freezer,sched: Use saved_state to reduce some spurious wakeups
  - sched/core: Remove ifdeffery for saved_state
  - i2c: stm32f7: unmap DMA mapped buffer
  - i2c: stm32f7: simplify status messages in case of errors
  - i2c: stm32f7: perform most of irq job in threaded handler
  - i2c: stm32f7: use dev_err_probe upon calls of devm_request_irq
  - i2c: stm32f7: Use devm_clk_get_enabled()
  - USB: serial: option: add Foxconn T99W709
  - smb: server: Fix extension string in ksmbd_extract_shortname()
  - ksmbd: fix corrupted mtime and ctime in smb2_open
  - ksmbd: fix Preauh_HashValue race condition
  - ksmbd: fix null pointer dereference error in generate_encryptionkey
  - vsock: Do not allow binding to VMADDR_PORT_ANY
  - selftests/perf_events: Add a mmap() correctness test
  - smb: client: return an error if rdma_connect does not return within 5 seconds
  - smb: client: let recv_done() cleanup before notifying the callers.
  - smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already
  - smb: client: make use of common smbdirect_socket
  - smb: smbdirect: add smbdirect_socket.h
  - smb: client: Correct typos in multiple comments across various files
  - smb: client: Use min() macro
  - smb: server: let recv_done() avoid touching data_transfer after cleanup/move
  - smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already
  - ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out()
  - irqchip: Build IMX_MU_MSI only on ARM
  - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing
  - sunrpc: fix client side handling of tls alerts
  - net/sched: taprio: enforce minimum value for picos_per_byte
  - net: drop UFO packets in udp_rcv_segment()
  - ipv6: reject malicious packets in ipv6_gso_segment()
  - net/mlx5: Correctly set gso_segs when LRO is used
  - netlink: specs: ethtool: fix module EEPROM input/output arguments
  - net: ipa: add IPA v5.1 and v5.5 to ipa_version_string()
  - phy: mscc: Fix parsing of unicast frames
  - netpoll: prevent hanging NAPI when netcons gets enabled
  - md/md-cluster: handle REMOVE message earlier
  - NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY
  - NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate()
  - sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up()
  - pNFS/flexfiles: don't attempt pnfs on fatal DS errors
  - PCI: pnv_php: Fix surprise plug detection and recovery
  - powerpc/eeh: Export eeh_unfreeze_pe()
  - PCI: pnv_php: Work around switches with broken presence detection
  - kconfig: qconf: fix ConfigList::updateListAllforAll()
  - scsi: sd: Make sd shutdown issue START STOP UNIT appropriately
  - scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume
  - scsi: Revert "scsi: iscsi: Fix HW conn removal use after free"
  - scsi: mpt3sas: Fix a fw_event memory leak
  - vfio/pci: Separate SR-IOV VF dev_set
  - vfio/pds: Fix missing detach_ioas op
  - vfio: Prevent open_count decrement to negative
  - vfio: Fix unbalanced vfio_df_close call in no-iommu mode
  - f2fs: fix to calculate dirty data during has_not_enough_free_secs()
  - f2fs: fix to update upper_p in __get_secs_required() correctly
  - f2fs: vm_unmap_ram() may be called from an invalid context
  - f2fs: fix to avoid out-of-boundary access in devs.path
  - f2fs: doc: fix wrong quota mount option description
  - f2fs: fix KMSAN uninit-value in extent_info usage
  - rtc: rv3028: fix incorrect maximum clock rate handling
  - rtc: pcf8563: fix incorrect maximum clock rate handling
  - rtc: pcf85063: fix incorrect maximum clock rate handling
  - rtc: nct3018y: fix incorrect maximum clock rate handling
  - rtc: hym8563: fix incorrect maximum clock rate handling
  - rtc: ds1307: fix incorrect maximum clock rate handling
  - ucount: fix atomic_long_inc_below() argument type
  - module: Restore the moduleparam prefix length check
  - apparmor: fix loop detection used in conflicting attachment resolution
  - apparmor: ensure WB_HISTORY_SIZE value is a power of 2
  - bpf: Check netfilter ctx accesses are aligned
  - bpf: Check flow_dissector ctx accesses are aligned
  - vhost-scsi: Fix log flooding with target does not exist errors
  - mtd: rawnand: atmel: set pmecc data setup time
  - mtd: rawnand: rockchip: Add missing check after DMA map
  - mtd: rawnand: atmel: Fix dma_mapping_error() address
  - jfs: fix metapage reference count leak in dbAllocCtl
  - crypto: qat - fix seq_file position update in adf_ring_next()
  - crypto: qat - fix DMA direction for compression on GEN2 devices
  - perf tools: Remove libtraceevent in .gitignore
  - sh: Do not use hyphen in exported variable name
  - ASoC: fsl_xcvr: get channel status data when PHY is not exists
  - dmaengine: nbpfaxi: Add missing check after DMA map
  - dmaengine: mv_xor: Fix missing check after DMA map and missing unmap
  - fs/orangefs: Allow 2 more characters in do_c_string()
  - PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute
  - soundwire: stream: restore params when prepare ports fail
  - crypto: img-hash - Fix dma_unmap_sg() nents value
  - crypto: keembay - Fix dma_unmap_sg() nents value
  - hwrng: mtk - handle devm_pm_runtime_enable errors
  - watchdog: ziirave_wdt: check record length in ziirave_firm_verify()
  - scsi: isci: Fix dma_unmap_sg() nents value
  - scsi: mvsas: Fix dma_unmap_sg() nents value
  - scsi: elx: efct: Fix dma_unmap_sg() nents value
  - scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value
  - clk: sunxi-ng: v3s: Fix de clock definition
  - perf tests bp_account: Fix leaked file descriptor
  - kernel: trace: preemptirq_delay_test: use offstack cpu mask
  - crypto: inside-secure - Fix `dma_unmap_sg()` nents value
  - perf sched: Fix memory leaks in 'perf sched latency'
  - perf sched: Fix memory leaks for evsel->priv in timehist
  - perf sched: Free thread->priv using priv_destructor
  - perf dso: Add missed dso__put to dso__load_kcore
  - perf tools: Fix use-after-free in help_unknown_cmd()
  - Fix dma_unmap_sg() nents value
  - clk: clk-axi-clkgen: fix fpfd_max frequency for zynq
  - fanotify: sanitize handle_type values when reporting fid
  - pinctrl: sunxi: Fix memory leak on krealloc failure
  - PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails
  - crypto: arm/aes-neonbs - work around gcc-15 warning
  - power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set
  - power: supply: cpcap-charger: Fix null check for power_supply_get_by_name
  - clk: xilinx: vcu: unregister pll_post only if registered correctly
  - media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check
  - mtd: fix possible integer overflow in erase_xfer()
  - crypto: marvell/cesa - Fix engine load inaccuracy
  - crypto: qat - use unmanaged allocation for dc_data
  - crypto: sun8i-ce - fix nents passed to dma_unmap_sg()
  - PCI: rockchip-host: Fix "Unexpected Completion" log message
  - bpf/preload: Don't select USERMODE_DRIVER
  - ipv6: annotate data-races around rt->fib6_nsiblings
  - ipv6: fix possible infinite loop in fib6_info_uses_dev()
  - vrf: Drop existing dst reference in vrf_ip6_input_dst
  - selftests: rtnetlink.sh: remove esp4_offload after test
  - net/mlx5e: Clear Read-Only port buffer size in PBMC before update
  - netfilter: xt_nfacct: don't assume acct name is null-terminated
  - can: kvaser_usb: Assign netdev.dev_port based on device channel index
  - can: kvaser_pciefd: Store device channel index
  - can: peak_usb: fix USB FD devices potential malfunction
  - tools/rv: Do not skip idle in trace
  - Bluetooth: hci_event: Mask data status from LE ext adv reports
  - kcsan: test: Initialize dummy variable
  - wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon()
  - wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE
  - wifi: ath12k: fix endianness handling while accessing wmi service bit
  - wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key()
  - wifi: mac80211: Don't call fq_flow_idx() for management frames
  - wifi: mac80211: Do not schedule stopped TXQs
  - wifi: plfxlc: Fix error handling in usb driver probe
  - wifi: mac80211: reject TDLS operations when station is not associated
  - iommu/amd: Fix geometry.aperture_end for V2 tables
  - mwl8k: Add missing check after DMA map
  - wifi: rtl8xxxu: Fix RX skb size for aggregation disabled
  - tcp: call tcp_measure_rcv_mss() for ooo packets
  - xen/gntdev: remove struct gntdev_copy_batch from stack
  - net_sched: act_ctinfo: use atomic64_t for three counters
  - net/sched: Restrict conditions for adding duplicating netems to qdisc tree
  - um: rtc: Avoid shadowing err in uml_rtc_start()
  - arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX
  - netfilter: nf_tables: adjust lockdep assertions handling
  - netfilter: nf_tables: Drop dead code from fill_*_info routines
  - fbcon: Fix outdated registered_fb reference in comment
  - drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value
  - m68k: Don't unregister boot console needlessly
  - drm/msm/dpu: Fill in min_prefill_lines for SC8180X
  - kselftest/arm64: Fix check for setting new VLs in sve-ptrace
  - net: dst: annotate data-races around dst->input
  - tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range
  - wifi: ath11k: clear initialized flag for deinit-ed srng lists
  - iwlwifi: Add missing check for alloc_ordered_workqueue
  - wifi: iwlwifi: Fix memory leak in iwl_mvm_init()
  - wifi: rtl818x: Kill URBs before clearing tx status queue
  - wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band
  - caif: reduce stack size, again
  - bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure
  - drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel
  - net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain
  - selftests/bpf: fix signedness bug in redir_partial()
  - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls
  - bpf, sockmap: Fix psock incorrectly pointing to sk
  - drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed
  - staging: nvec: Fix incorrect null termination of battery manufacturer
  - interconnect: qcom: sc8180x: specify num_nodes
  - interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg
  - soc: qcom: pmic_glink: fix OF node leak
  - samples: mei: Fix building on musl libc
  - cpufreq: Initialize cpufreq-based frequency-invariance later
  - cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode
  - arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed
  - arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed
  - ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface
  - soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS
  - arm: dts: ti: omap: Fixup pinheader typo
  - usb: early: xhci-dbc: Fix early_ioremap leak
  - powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw()
  - pps: fix poll support
  - staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc()
  - spi: stm32: Check for cfg availability in stm32_spi_probe
  - usb: misc: apple-mfi-fastcharge: Make power supply names unique
  - usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe()
  - ARM: dts: vfxxx: Correctly use two tuples for timer address
  - arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely
  - arm64: dts: qcom: sc7180: Expand IMEM region
  - arm64: dts: qcom: sdm845: Expand IMEM region
  - soc: qcom: QMI encoding/decoding for big endian
  - selftests: Fix errno checking in syscall_user_dispatch test
  - ASoC: mediatek: use reserved memory or enable buffer pre-allocation
  - gfs2: No more self recovery
  - Revert "fs/ntfs3: Replace inode_trylock with inode_lock"
  - hfs: make splice write available again
  - hfsplus: make splice write available again
  - ublk: use vmalloc for ublk_device's __queues
  - fs_context: fix parameter name in infofc() macro
  - audit,module: restore audit logging in load failure case
  - ASoC: amd: yc: add DMI quirk for ASUS M6501RM
  - ASoC: Intel: fix SND_SOC_SOF dependencies
  - ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx
  - ethernet: intel: fix building with large NR_CPUS
  - ASoC: amd: yc: Add DMI quirk for HP Laptop 17 cp-2033dx
  - interference: Fix uninitialized ifs_clock compiling issue
  - iommu/ummu: optimize log printing
  - !20455 Fix compilation failure caused by PR#20174
  - !20302  CVE-2026-22980
  - !20142  CVE-2025-68803
  - !20261  ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency
  - !20435  fix CVE-2026-22998
  - !20433  scsi: target: Reset t_task_cdb pointer in error case
  - !20432  scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path"
  - !20431  block: Use RCU in blk_mq_[un
  - !20307  tpm: Cap the number of PCR banks
  - !20062  xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read
  - !20157 v2  md: backport from mainline
  - rcu: Protect ->defer_qs_iw_pending from data race
  - platform/x86/intel/pmt: fix compilation failure caused by PR#20174
  - iommu/ummu: optimize kv cache memory management
  - iommu/ummu: optimize permission table management
  - iommu/ummu: remove check for eid_type while del eid
  - iommu/ummu: optimize the code implementation
  - drivers/perf: fix ummu-pmu data reading exception
  - iommu/ummu: IOMMU_DOMAIN_BLOCKED type don not sync tct
  - drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer
  - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt
  - net: unic: Notify mami of the bond ip change.
  - ub: ubase: Support for UE link by ctrlq message
  - ub: ubase: send a deactivate req in removing
  - ub: ubase: Querying TPG/TP contexts in the chip is no longer supported after enabling safe mode.
  - ub: ubase: Use an independent thread for the ctrlq workqueue.
  - !20368 ubcore: fix logging and permission for route query.
  - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id
  - !20344  ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr
  - net: unic: Fix the ummu 0xa event that occurs when modifying queues and resetting concurrent scenarios
  - ub: ubase: Add KABI compatibility
  - ub: ubase: fixing the issue of cdma ctp_req_vl parameter configuration
  - ub: ubase: add PMU IDEV interrupt supported abilities.
  - ub: ubase: Delete the tid mask for eq, jfs, jfr, and jfc context
  - ub: ubase: Set the completion event interrupt to auto
  - net: unic: fix poll tx read old skb cause a UAF bug
  - !20249 Fix CVE-2025-38489
  - !20250 Fix CVE-2025-38480
  - !20378 Fix CVE-2025-39838
  - !20430  Fix CVE-2025-39942
  - !20351 Fix CVE-2025-71149
  - !20375 Fix CVE-2025-71150
  - !20323 Fix CVE-2025-38730
  - !20320 Fix CVE-2025-68814
  - !20314 Fix CVE-2025-71072
  - !20315 Fix CVE-2025-68794
  - !20403  bpf: Check skb->transport_header is set in bpf_skb_check_mtu
  - !20402  bpf: Do not let BPF test infra emit invalid GSO types to stack
  - !20401  tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check()
  - !20400  netfilter: nft_ct: add seqadj extension for natted connections
  - !20399  net: xfrm: Fix CVE-2025-40215
  - !20398  net/sched: sch_qfq: Fix null-deref in agg_dequeue
  - !20397  bpf: Reject narrower access to pointer ctx fields
  - !20396  Bluetooth: eir: Fix possible crashes on eir_create_adv_data
  - !20394  IB/mlx5: Fix potential deadlock in MR deregistration
  - !20367 ub: cdma: cdma uaf bugfix
  - net/mlx5e: Fix crash on profile change rollback failure
  - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv
  - PCI/AER: Fix NULL pointer access by aer_info
  - gfs2: No more self recovery
  - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE
  - crypto: qat - flush misc workqueue during device shutdown
  - !20174 Backport PMT spec 3.0 support
  - !20366 [Hygon][6.6][Bugfix]: Resolve FPU state corruption between atomic and non-atomic contexts
  - !19814 [OLK-6.6] Batch flushing user memory encrytion status change
  - !20393 [OLK-6.6][linux-6.6.y sync] Backport 6.6.100-6.6.101 LTS Patches
  - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec
  - nvmet-tcp: remove boilerplate code
  - scsi: target: Reset t_task_cdb pointer in error case
  - scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path"
  - block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock
  - ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size
  - ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer
  - smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection
  - smb: server: remove separate empty_recvmsg_queue
  - !20384 ub:ubus: Fix ubus link message and pool device error
  - !20389  gfs2: Prevent recursive memory reclaim
  - !20388  *** fix CVE-2025-38062 ***
  - !20387  KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced
  - !20386  pinctrl: check the return value of pinmux_ops::get_function_name()
  - !20385  iommu/amd/pgtbl: Fix possible race while increase page table level
  - ub:ubus: Not cfg access during surprise down
  - ub:hisi-ubus: Delete validate_pa err print
  - PCI: cadence: Check for the existence of cdns_pcie::ops before using it
  - can: netlink: can_changelink(): allow disabling of automatic restart
  - Revert "selftests/bpf: Add a cgroup prog bpf_get_ns_current_pid_tgid() test"
  - drm/sched: Remove optimization that causes hang when killing dependent jobs
  - ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS
  - bpf: Check skb->transport_header is set in bpf_skb_check_mtu
  - bpf: Do not let BPF test infra emit invalid GSO types to stack
  - tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check()
  - netfilter: nft_ct: add seqadj extension for natted connections
  - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added
  - xfrm: delete x->tunnel as we delete x
  - x86/hw-vuln:Support hardware-based mitigation for Retbleed and SRSO via Hygon IBRS to avoid performance degradation caused by software-based mitigation.
  - net/sched: sch_qfq: Fix null-deref in agg_dequeue
  - bpf: Reject narrower access to pointer ctx fields
  - Bluetooth: eir: Fix possible crashes on eir_create_adv_data
  - IB/mlx5: Fix potential deadlock in MR deregistration
  - ub:ubus: Fix ubus link message and pool device error
  - ub:hisi-ubus: cq poller maximum handle 64 cqe per time
  - ub:hisi-ubus:Fix vdm message print error
  - ub:ubus:Fix ubus interrupt release issue
  - wifi: mt76: mt7921: prevent decap offload config before STA initialization
  - mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec()
  - iio: hid-sensor-prox: Restore lost scale assignments
  - iio: hid-sensor-prox: Fix incorrect OFFSET calculation
  - crypto: powerpc/poly1305 - add depends on BROKEN for now
  - erofs: address D-cache aliasing
  - drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x
  - ALSA: hda: Add missing NVIDIA HDA codec IDs
  - ALSA: hda/tegra: Add Tegra264 support
  - comedi: comedi_test: Fix possible deletion of uninitialized timers
  - usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach
  - usb: typec: tcpm: allow switching to mode accessory to mux properly
  - usb: typec: tcpm: allow to use sink in accessory mode
  - drm/amdkfd: Don't call mmput from MMU notifier callback
  - mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n
  - selftests: mptcp: connect: also cover checksum
  - selftests: mptcp: connect: also cover alt modes
  - resource: fix false warning in __request_region()
  - gve: Fix stuck TX queue for DQ queue format
  - e1000e: ignore uninitialized checksum word on tgp
  - e1000e: disregard NVM checksum on tgp when valid checksum bit is not set
  - dpaa2-switch: Fix device reference count leak in MAC endpoint handling
  - dpaa2-eth: Fix device reference count leak in MAC endpoint handling
  - ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx
  - sprintf.h requires stdarg.h
  - bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint()
  - i2c: virtio: Avoid hang by using interruptible completion wait
  - i2c: tegra: Fix reset error handling with ACPI
  - platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots
  - can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode
  - can: dev: can_restart(): move debug message and stats after successful restart
  - can: dev: can_restart(): reverse logic to remove need for goto
  - i40e: When removing VF MAC filters, only check PF-set MAC
  - i40e: report VF tx_dropped with tx_errors instead of tx_discards
  - i40e: Add rx_missed_errors for buffer exhaustion
  - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch
  - net/mlx5: Fix memory leak in cmd_exec()
  - staging: vchiq_arm: Make vchiq_shutdown never fail
  - x86/hyperv: Fix usage of cpu_online_mask to get valid cpu
  - regmap: fix potential memory leak of regmap_bus
  - iio: adc: ad7949: use spi_is_bpw_supported()
  - interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node
  - RDMA/core: Rate limit GID cache warning messages
  - virtio_ring: Fix error reporting in virtqueue_resize
  - !20348 [OLK-6.6][linux-6.6.y sync] Backport 6.6.99-6.6.100 LTS Patches
  - !20346  tracing: Fix crash on synthetic stacktrace field usage
  - vfs: Don't leak disconnected dentries on umount
  - !20334 Fix CVE-2025-68780
  - gfs2: Prevent recursive memory reclaim
  - amd/amdkfd: enhance kfd process check in switch partition
  - drm/amdkfd: allow compute partition mode switch with cgroup exclusions
  - KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced
  - pinctrl: check the return value of pinmux_ops::get_function_name()
  - iommu/amd/pgtbl: Fix possible race while increase page table level
  - !19966  nvme-fc: use lock accessing port_state and rport state
  - ASoC: fsl_sai: replace regmap_write with regmap_update_bits
  - comedi: Fix use of uninitialized data in insn_rw_emulate_bits()
  - cifs: prevent NULL pointer dereference in UTF16 conversion
  - ksmbd: Fix refcount leak when invalid session is found on session lookup
  - ubcore: fix logging and permission for route query.
  - !20232 driver/coda: VirtCCA supports MSI device DA
  - Revert "Revert "RDMA/hns: Fix mismatch exception rollback""
  - !20197 ub: udma&ubase: fix a bug that caused long reboot time
  - x86: Resolve FPU state corruption between atomic and non-atomic contexts
  - ub: cdma: cdma uaf bugfix
  - ub: cdma: jfs call trace bugfix
  - !20353  x86/fpu: Clear XSTATE_BV[i
  - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again
  - KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls
  - nvmem: layouts: u-boot-env: remove crc32 endianness conversion
  - i2c: omap: fix deprecated of_property_read_bool() use
  - ASoC: fsl_sai: Force a software reset when starting in consumer mode
  - regulator: pwm-regulator: Manage boot-on with disabled PWM channels
  - regulator: pwm-regulator: Calculate the output voltage for disabled PWMs
  - i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe()
  - i2c: omap: Fix an error handling path in omap_i2c_probe()
  - i2c: omap: Add support for setting mux
  - usb: dwc3: qcom: Don't leave BCR asserted
  - usb: hub: Don't try to recover devices lost during warm reset.
  - usb: hub: Fix flushing of delayed work used for post resume purposes
  - usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm
  - usb: hub: fix detection of high tier USB3 devices behind suspended hubs
  - arm64: Filter out SME hwcaps when FEAT_SME isn't implemented
  - ipv6: make addrconf_wq single threaded
  - !20354 cpufreq/sched: Explicitly synchronize limits_changed flag handling
  - sched/deadline: only set free_cpus for online runqueues
  - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1
  - cpufreq/sched: Explicitly synchronize limits_changed flag handling
  - io_uring/poll: correctly handle io_poll_add() return value on update
  - shmem: fix recovery on rename failures
  - io_uring: fix filename leak in __io_openat_prep()
  - Revert "cgroup_freezer: cgroup_freezing: Check if not frozen"
  - rxrpc: Fix transmission of an abort in response to an abort
  - rxrpc: Fix recv-recv race of completed call
  - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree
  - net: bridge: Do not offload IGMP/MLD messages
  - hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf
  - netfilter: nf_conntrack: fix crash due to removal of uninitialised entry
  - ipv6: mcast: Delay put pmc->idev in mld_del_delrec()
  - net/mlx5: Correctly set gso_size when LRO is used
  - Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID
  - Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout
  - Bluetooth: SMP: If an unallowed command is received consider it a failure
  - Bluetooth: hci_sync: fix connectable extended advertising when using static random address
  - hwmon: (corsair-cpro) Validate the size of the received input buffer
  - selftests: net: increase inter-packet timeout in udpgro.sh
  - wifi: cfg80211: remove scan request n_channels counted_by
  - nvme: fix misaccounting of nvme-mpath inflight I/O
  - net: phy: Don't register LEDs for genphy
  - nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list()
  - rpl: Fix use-after-free in rpl_do_srh_inline().
  - block: fix kobject leak in blk_unregister_queue
  - net: emaclite: Fix missing pointer increment in aligned_read()
  - soundwire: amd: fix for clearing command status register
  - soundwire: amd: fix for handling slave alerts after link is down
  - comedi: Fix use of uninitialized data in insn_rw_emulate_bits()
  - comedi: Fix some signed shift left operations
  - comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large
  - comedi: das6402: Fix bit shift out of bounds
  - comedi: das16m1: Fix bit shift out of bounds
  - comedi: aio_iiro_16: Fix bit shift out of bounds
  - comedi: pcl812: Fix bit shift out of bounds
  - iio: adc: stm32-adc: Fix race in installing chained IRQ handler
  - iio: adc: max1363: Reorder mode_list[] entries
  - iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[]
  - iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush
  - soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled
  - soc: aspeed: lpc-snoop: Cleanup resources in stack-order
  - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again
  - pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov
  - net: libwx: properly reset Rx ring descriptor
  - net: libwx: remove duplicate page_pool_put_full_page()
  - mmc: sdhci_am654: Workaround for Errata i2312
  - mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models
  - mmc: bcm2835: Fix dma_unmap_sg() nents value
  - memstick: core: Zero initialize id_reg in h_memstick_read_dev_id()
  - isofs: Verify inode mode when loading from disk
  - dmaengine: nbpfaxi: Fix memory corruption in probe()
  - af_packet: fix soft lockup issue caused by tpacket_snd()
  - af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd()
  - arm64: dts: rockchip: use cs-gpios for spi1 on ringneck
  - arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on
  - arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency
  - net/mlx5: Update the list of the PCI supported devices
  - phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept()
  - io_uring/poll: fix POLLERR handling
  - ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS
  - drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume
  - tracing/osnoise: Fix crash in timerlat_dump_stack()
  - spi: Add check for 8-bit transfer with 8 IO mode support
  - pch_uart: Fix dma_sync_sg_for_device() nents value
  - thunderbolt: Fix bit masking in tb_dp_port_set_hops()
  - i2c: stm32: fix the device used for the DMA map
  - tracing: Fix crash on synthetic stacktrace field usage
  - usb: musb: fix gadget state on disconnect
  - USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI
  - USB: serial: option: add Foxconn T99W640
  - USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition
  - phy: tegra: xusb: Disable periodic tracking on Tegra234
  - phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode
  - phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode
  - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr
  - fs/proc: fix uaf in proc_readdir_de()
  - io_uring/net: commit partial buffers on retry
  - nvme: fix admin request_queue lifetime
  - fs/notify: call exportfs_encode_fid with s_umount
  - iomap: adjust read range correctly for non-block-aligned positions
  - fuse: fix livelock in synchronous file put from fuseblk workers
  - tpm: Cap the number of PCR banks
  - nfsd: provide locking for v4_end_grace
  - Revert "nfsd: provide locking for v4_end_grace"
  - config: enable config for PMT discovery driver
  - platform/x86/intel/pmt/discovery: use valid device pointer in dev_err_probe
  - platform/x86/intel/pmt: Fix kobject memory leak on init failure
  - platform/x86/intel/pmt: fix a crashlog NULL pointer access
  - platform/x86/intel/pmt: fix build dependency for kunit test
  - platform/x86/intel/pmt/discovery: fix format string warning
  - platform/x86/intel/pmt/discovery: Fix size_t specifiers for 32-bit
  - platform/x86/intel/pmt: KUNIT test for PMT Enhanced Discovery API
  - platform/x86/intel/pmt/telemetry: Add API to retrieve telemetry regions by feature
  - platform/x86/intel/pmt/discovery: Get telemetry attributes
  - platform/x86/intel/tpmi: Get OOBMSM CPU mapping from TPMI
  - platform/x86/intel/vsec: Set OOBMSM to CPU mapping
  - platform/x86/intel/tpmi: Relocate platform info to intel_vsec.h
  - docs: Add ABI documentation for intel_pmt feature directories
  - platform/x86/intel/pmt: Add PMT Discovery driver
  - sysfs: Fix crash on empty group attributes array
  - sysfs: Introduce a mechanism to hide static attribute_groups
  - platform/x86/intel/vsec: Add new Discovery feature
  - platform/x86/intel/vsec: Skip driverless features
  - platform/x86/intel/vsec: Skip absent features during initialization
  - platform/x86/intel/vsec: Add device links to enforce dependencies
  - platform/x86/intel/vsec: Create wrapper to walk PCI config space
  - platform/x86/intel/vsec: Add private data for per-device data
  - MAINTAINERS: Add link to documentation of Intel PMT ABI
  - platform/x86/intel/pmt: allow user offset for PMT callbacks
  - driver/coda: VirtCCA supports MSI device DA
  - ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency
  - Rename leapioraid to leapraid and release v2.0
  - ub: udma: fix a bug that caused long reboot time.
  - ub: ubase: Accelerate when ctrl node is shutting down
  - platform/x86/intel/pmt: Use PMT callbacks
  - platform/x86/intel/vsec: Add PMT read callbacks
  - platform/x86/intel/vsec.h: Move to include/linux
  - md: prevent incorrect update of resync/recovery offset
  - md/raid1: Fix data corruption for degraded array with slow disk
  - md/raid1: set max_sectors during early return from choose_slow_rdev()
  - md-cluster: fix no recovery job when adding/re-adding a disk
  - md-cluster: fix hanging issue while a new disk adding
  - md/raid5: recheck if reshape has finished with device_lock held
  - md-cluster: Constify struct md_cluster_operations
  - md: Remove unneeded semicolon
  - md/raid5: fix spares errors about rcu usage
  - dm-raid: Fix WARN_ON_ONCE check for sync_thread in raid_resume
  - md: pass in max_sectors for pers->sync_request()
  - md: factor out helpers for different sync_action in md_do_sync()
  - md: replace last_sync_action with new enum type
  - md: use new helpers in md_do_sync()
  - md: don't fail action_store() if sync_thread is not registered
  - md: remove parameter check_seq for stop_sync_thread()
  - md: replace sysfs api sync_action with new helpers
  - md: factor out helper to start reshape from action_store()
  - md: add new helpers for sync_action
  - md: add a new enum type sync_action
  - md: rearrange recovery_flags
  - md/raid0: don't free conf on raid0_run failure
  - md: make md_flush_request() more readable
  - md: change the return value type of md_write_start to void
  - md: Revert "md: Fix overflow in is_mddev_idle"
  - md: don't account sync_io if iostats of the disk is disabled
  - md: Fix overflow in is_mddev_idle
  - md: add check for sleepers in md_wakeup_thread()
  - md: add a mddev_is_dm helper
  - md: add a mddev_add_trace_msg helper
  - md: add a mddev_trace_remap helper
  - dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape
  - dm-raid: add a new helper prepare_suspend() in md_personality
  - dm-raid: really frozen sync_thread during suspend
  - md: add a new helper reshape_interrupted()
  - md: export helper md_is_rdwr()
  - md: export helpers to stop sync_thread
  - md: don't clear MD_RECOVERY_FROZEN for new dm-raid until resume
  - md/raid1: factor out helpers to choose the best rdev from read_balance()
  - md/raid1: factor out the code to manage sequential IO
  - md/raid1: factor out choose_bb_rdev() from read_balance()
  - md/raid1: factor out choose_slow_rdev() from read_balance()
  - md/raid1: factor out read_first_rdev() from read_balance()
  - md/raid1-10: factor out a new helper raid1_should_read_first()
  - md/raid1-10: add a helper raid1_check_read_range()
  - md/raid1: fix choose next idle in read_balance()
  - md/raid1: record nonrot rdevs while adding/removing rdevs to conf
  - md/raid1: factor out helpers to add rdev to conf
  - md: add a new helper rdev_has_badblock()
  - md: check mddev->pers before calling md_set_readonly()
  - md: clean up openers check in do_md_stop() and md_set_readonly()
  - md: sync blockdev before stopping raid or setting readonly
  - md: factor out a helper to sync mddev
  - md: return directly before setting did_set_md_closing
  - md: changed the switch of RAID_VERSION to if
  - md: merge the check of capabilities into md_ioctl_valid()
  - md: Don't suspend the array for interrupted reshape
  - md: Don't register sync_thread for reshape directly
  - md: Make sure md_do_sync() will set MD_RECOVERY_DONE
  - md: Don't ignore read-only array in md_check_recovery()
  - md: Don't ignore suspended array in md_check_recovery()
  - md: get rdev->mddev with READ_ONCE()
  - md: remove redundant md_wakeup_thread()
  - md: remove redundant check of 'mddev->sync_thread'
  - md: fix a suspicious RCU usage warning
  - raid: Remove now superfluous sentinel element from ctl_table array
  - NFSD: NFSv4 file creation neglects setting ACL
  - nfsd: set security label during create operations
  - xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read
  - nvme-fc: use lock accessing port_state and rport state
  - x86/mm: Batch flushing user memory encrytion status change


author: Li Nan <linan122@huawei.com> - 6.6.0-138.0.0.132
changelog:
  - !20588 [OLK-6.6] Revert "x86/csv: Enhance CMA memory usage reporting for CSV3"
  - Revert "x86/csv: Enhance CMA memory usage reporting for CSV3"
  - !20576  media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg()
  - !20575  RDMA/cm: Fix leaking the multicast GID table reference
  - !20580  RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly
  - !20551  Fix CVE-2025-68785
  - !20478  f2fs: fix to avoid potential deadlock
  - !20501 [OLK-6.6] backport important bugfix for bnxt driver from upstream linux-6.6.y
  - !20520 Fix CVE-2026-23038
  - !20424  net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup
  - !20425  mlx5: Fix default values in create CQ
  - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly
  - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg()
  - RDMA/cm: Fix leaking the multicast GID table reference
  - net: openvswitch: fix middle attribute validation in push_nsh() action
  - net: openvswitch: remove never-working support for setting nsh fields
  - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()
  - bnxt_en: Fix potential data corruption with HW GRO/LRO
  - f2fs: fix to avoid potential deadlock
  - mlx5: Fix default values in create CQ
  - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup


author: Li Nan <linan122@huawei.com> - 6.6.0-139.0.0.133
changelog:
  - !20727 v2  bpf: sockmap fixes
  - !20741  scsi: qla2xxx: Sanitize payload size to prevent member overflow
  - !20744  fix CVE-2025-38449
  - !20763  net: usb: asix: validate PHY address before use
  - !20762  smc91x: fix broken irq-context in PREEMPT_RT
  - !20293 [Hygon][6.6][EDAC] The width of hash value is 2 bits for Hygon family 18h model 6h processors
  - !20290 [Hygon][6.6][Bugfix] Bug fix for EDAC to use unicast instead of broadcast on hygon family 18h model 4h
  - !20289 [Hygon][6.6][Bugfix] Bug fix for EDAC to correct the address translation on hygon family 18h model 4h
  - !20245 KVM: arm64: Refactor exit handlers
  - !20246 KVM: arm64: Mark some header functions as inline
  - !19005 [Hygon] [OLK-6.6] [Bugfix] Fix memory bandwidth counter width for Hygon QoS
  - !20292 [Hygon][6.6][TSC Adjust] Backport x86 TSC adjust patch
  - !20273 [Hygon][6.6][Bugfix] Get correct CPU LLC ID in guest for Hygon processors
  - !20722 [OLK-6.6][linux-6.6.y sync] Backport 6.6.104-6.6.106 LTS Patches
  - !20667  fix CVE-2024-50102
  - !20736  netfilter: nf_tables: remove redundant chain validation on register store
  - !20758 ub: ubase: Fixed the alarm issue caused by the initialization of the structure variable definition.
  - !20721 obmm: reduce log noise for successful export/import/preimport
  - net: usb: asix: validate PHY address before use
  - smc91x: fix broken irq-context in PREEMPT_RT
  - !20731  devlink: rate: Unset parent pointer in devl_rate_nodes_destroy
  - !20732  libceph: return the handler error from mon_handle_auth_done()
  - !20743  mm: slub: avoid wake up kswapd in set_track_prepare
  - ub: ubase: Fixed the alarm issue caused by the initialization of the structure variable definition.
  - !20750 ub: cdma: adapted to UMMU interface changes
  - !20713 urma: DFX of log in kernel
  - urma: optimize log levels for kernel space
  - ub: cdma: adapted to UMMU interface changes
  - wifi: ath11k: avoid bit operation on key flags
  - drm/mediatek: fix potential OF node use-after-free
  - cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes
  - wifi: cfg80211: sme: store capped length in __cfg80211_connect_result()
  - !20708 ub:hisi-ubus: Add create bus instance ummu bypass
  - drm: fix kabi for struct drm_framebuffer
  - drm/framebuffer: Acquire internal references on GEM handles
  - drm/gem: Acquire references on GEM handles for framebuffers
  - mm: slub: avoid wake up kswapd in set_track_prepare
  - scsi: qla2xxx: Sanitize payload size to prevent member overflow
  - netfilter: nf_tables: remove redundant chain validation on register store
  - libceph: return the handler error from mon_handle_auth_done()
  - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy
  - Documentation/hw-vuln: Add VMSCAPE documentation
  - dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status()
  - riscv: use lw when reading int cpu in asm_per_cpu
  - mm: slub: avoid wake up kswapd in set_track_prepare
  - tools: gpio: remove the include directory on make clean
  - tools: gpio: rm .*.cmd on make clean
  - drm/amd/amdgpu: Fix missing error return on kzalloc failure
  - drm/amdgpu: Replace DRM_* with dev_* in amdgpu_psp.c
  - perf bpf-event: Fix use-after-free in synthesis
  - drm/bridge: ti-sn65dsi86: fix REFCLK setting
  - spi: spi-fsl-lpspi: Clear status register after disabling the module
  - spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort
  - spi: spi-fsl-lpspi: Set correct chip-select polarity bit
  - spi: spi-fsl-lpspi: Fix transmissions when using CONT
  - hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM
  - pcmcia: omap: Add missing check for platform_get_resource
  - Revert "drm/amdgpu: Avoid extra evict-restore process."
  - ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY
  - ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model
  - drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv
  - drm/mediatek: Fix using wrong drm private data to bind mediatek-drm
  - drm/mediatek: Add crtc path enum for all_drm_priv array
  - vmxnet3: update MTU after device quiesce
  - net: dsa: microchip: linearize skb for tail-tagging switches
  - net: dsa: microchip: update tag_ksz masks for KSZ9477 family
  - dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status()
  - ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup
  - ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA
  - iio: pressure: mprls0025pa: use aligned_s64 for timestamp
  - iio: chemical: pms7003: use aligned_s64 for timestamp
  - iio: imu: inv_mpu6050: align buffer for timestamp
  - thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold
  - nouveau: fix disabling the nonstall irq due to storm code
  - cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode
  - net: pcs: rzn1-miic: Correct MODCTRL register offset
  - platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list
  - drm/amdgpu: drop hw access in non-DC audio fini
  - wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data()
  - wifi: mwifiex: Initialize the chan_stats array to zero
  - tcp_bpf: Fix copied value in tcp_bpf_sendmsg
  - skmsg: Return copied bytes in sk_msg_memcopy_from_iter
  - tcp_bpf: Add sk_rmem_alloc related logic for tcp_bpf ingress redirection
  - Revert "bpf, sockmap: Add sk_rmem_alloc check for sockmap"
  - ALSA: usb-audio: Add mute TLV for playback volumes on some devices
  - phy: mscc: Stop taking ts_lock for tx_queue and use its own lock
  - selftest: net: Fix weird setsockopt() in bind_bhash.c.
  - net: atm: fix memory leak in atm_register_sysfs when device_register fail
  - ax25: properly unshare skbs in ax25_kiss_rcv()
  - mctp: return -ENOPROTOOPT for unknown getsockopt options
  - net/smc: Remove validation of reserved bits in CLC Decline message
  - ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init()
  - net: thunder_bgx: decrement cleanup index before use
  - net: thunder_bgx: add a missing of_node_put
  - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result()
  - wifi: libertas: cap SSID len in lbs_associate()
  - wifi: cw1200: cap SSID length in cw1200_do_join()
  - net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets
  - wifi: ath11k: fix group data packet drops during rekey
  - wifi: ath11k: avoid forward declaration of ath11k_mac_start_vdev_delay()
  - wifi: ath11k: rename ath11k_start_vdev_delay()
  - wifi: ath11k: Introduce and use ath11k_sta_to_arsta()
  - net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync()
  - macsec: read MACSEC_SA_ATTR_PN with nla_get_uint
  - netlink: add variable-length / auto integers
  - net: macb: Fix tx_ptr_lock locking
  - icmp: fix icmp_ndo_send address translation for reply direction
  - mISDN: Fix memory leak in dsp_hwec_enable()
  - xirc2ps_cs: fix register access when enabling FullDuplex
  - netfilter: conntrack: helper: Replace -EEXIST by -EBUSY
  - wifi: cfg80211: fix use-after-free in cmp_bss()
  - arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC
  - arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM
  - tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible"
  - arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro
  - Bluetooth: hci_sync: Avoid adding default advertising on startup
  - cpupower: Fix a bug where the -t option of the set subcommand was not working.
  - drm/amd/display: Don't warn when missing DCE encoder caps
  - cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN
  - LoongArch: Save LBT before FPU in setup_sigcontext()
  - btrfs: avoid load/store tearing races when checking if an inode was logged
  - btrfs: fix race between setting last_dir_index_offset and inode logging
  - btrfs: fix race between logging inode and checking if it was logged before
  - bpf: Fix oob access in cgroup local storage
  - !20556 urma: fix update topo logic
  - !20639 [OLK-6.6][linux-6.6.y sync] Backport 6.6.103-6.6.104 LTS Patches
  - !20641 [OLK-6.6][linux-6.6.y sync] LoongArch: Add more instruction opcodes and emit_* helpers
  - !20560  *** fix CVE-2025-38062 ***
  - !20662  pNFS: Fix a deadlock when returning a delegation during open()
  - ub:hisi-ubus: Add create bus instance ummu bypass
  - Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set"
  - Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set"
  - HID: mcp2221: Handle reads greater than 60 bytes
  - HID: mcp2221: Don't set bus speed on every transfer
  - net/mlx5: SF, Fix add port error handling
  - drm/nouveau/disp: Always accept linear modifier
  - smb3 client: fix return code mapping of remap_file_range
  - net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions
  - dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted
  - HID: wacom: Add a new Art Pen 2
  - HID: logitech: Add ids for G PRO 2 LIGHTSPEED
  - HID: quirks: add support for Legion Go dual dinput modes
  - net: stmmac: Set CIC bit only for TX queues with COE
  - net: stmmac: xgmac: Correct supported speed modes
  - net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts
  - net/mlx5e: Set local Xoff after FW update
  - net/mlx5e: Update and set Xon/Xoff upon port speed set
  - net/mlx5e: Update and set Xon/Xoff upon MTU set
  - net/mlx5: Nack sync reset when SFs are present
  - net/mlx5: Convert SF port_indices xarray to function_ids xarray
  - net/mlx5: Use devlink port pointer to get the pointer of container SF struct
  - net/mlx5: Call mlx5_sf_id_erase() once in mlx5_sf_dealloc()
  - phy: mscc: Fix when PTP clock is register and unregister
  - net: dlink: fix multicast stats being counted incorrectly
  - dt-bindings: display/msm: qcom,mdp5: drop lut clock
  - drm/nouveau: remove unused memory target test
  - drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr
  - Bluetooth: hci_sync: fix set_local_name race condition
  - Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced
  - Bluetooth: hci_event: Mark connection as closed during suspend disconnect
  - Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success
  - HID: input: report battery status changes immediately
  - HID: input: rename hidinput_set_battery_charge_status()
  - powerpc/kvm: Fix ifdef to remove build warning
  - drm/msm: Defer fd_install in SUBMIT ioctl
  - vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put()
  - ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list
  - erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC
  - ASoC: codecs: tx-macro: correct tx_macro_component_drv name
  - smb: client: fix race with concurrent opens in unlink(2)
  - scsi: core: sysfs: Correct sysfs attributes access rights
  - of: dynamic: Fix use after free in of_changeset_add_prop_helper()
  - of: Add a helper to free property struct
  - mips: lantiq: xway: sysctrl: rename the etop node
  - mips: dts: lantiq: danube: add missing burst length property
  - pinctrl: STMFX: add missing HAS_IOMEM dependency
  - of: dynamic: Fix memleak when of_pci_add_properties() failed
  - !20684 urma: adjust urma log format
  - !20355  udp: Deal with race between UDP socket address change and rehash
  - !20627  Fixes CVE-2025-38627
  - !20702  CVE-2025-39948
  - !20701  netfilter: ctnetlink: remove refcounting in expectation dumpers
  - !20700  CVE-2025-38678
  - !20703  CVE-2025-38491
  - !20690  tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork.
  - obmm: reduce log noise for successful export/import/preimport
  - mptcp: avoid deadlock on fallback while reinjecting
  - mptcp: plug races between subflow fail and subflow creation
  - mptcp: make fallback action and fallback decision atomic
  - ice: fix Rx page leak on multi-buffer frames
  - ice: fix incorrect counter for buffer allocation failures
  - ice: stop storing XDP verdict within ice_rx_buf
  - ice: gather page_count()'s of each frag right before XDP prog call
  - ice: Introduce ice_xdp_buff
  - netfilter: ctnetlink: remove refcounting in expectation dumpers
  - netfilter: nf_tables: reject duplicate device on updates
  - netfilter: nf_tables: Introduce functions freeing nft_hook objects
  - netfilter: nf_tables: Fix percpu address space issues in nf_tables_api.c
  - err.h: add ERR_PTR_PCPU(), PTR_ERR_PCPU() and IS_ERR_PCPU() macros
  - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork.
  - !20498 Fix CVE-2025-71118
  - !20608  pmdomain: arm: scmi: Fix genpd leak on provider registration failure
  - !20679  x86/CPU/AMD: Add RDSEED fix for Zen5
  - !20650  fix cve-2025-40300
  - !20661  Input: alps - fix use-after-free bugs caused by dev3_register_work
  - !20664  backport some net bugfix from 6.6 lts
  - urma: adjust urma log format
  - !20678 ub: udma: close debug switch load parameters.
  - ub: udma: close debug switch load parameters.
  - x86/CPU/AMD: Add RDSEED fix for Zen5
  - !20630  net: LTS-6.6 bugfix backport
  - !20632  net/sched: sch_qfq: do not free existing class in qfq_change_class()
  - !20631  macvlan: fix possible UAF in macvlan_forward_source()
  - !20628  Fix CVE-2025-39910
  - !20659 v2  Fix CVE-2025-22090
  - !20506  XSched: Update XSched manual
  - !20647  media: imon: make send_packet() more robust
  - !20646  ksm: use range-walk function to jump over holes in scan_get_next_rmap_item
  - !20645  fbcon: Set fb_display[i
  - !20648  parse_longname(): strrchr() expects NUL-terminated string
  - !20621 urma: modify log level
  - !20602 urma: fix the jfe uaf issue that occurred during the killall process.
  - !20567 urma:change log level and pass status 9
  - !20640  iio: common: st_sensors: Fix use of uninitialize device structs
  - !20634  usb: gadget: udc: fix use-after-free in usb_gadget_state_work
  - !20633  net: dsa: properly keep track of conduit reference
  - !20635  fix CVE-2025-68231
  - !20651  mm/slub: avoid accessing metadata when pointer is invalid in object_err()
  - !20649  drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb
  - !20652  mm/vmalloc: fix data race in show_numa_info()
  - x86: uaccess: don't use runtime-const rewriting in modules
  - x86: fix off-by-one in access_ok()
  - x86: fix user address masking non-canonical speculation issue
  - x86/uaccess: Zero the 8-byte get_range case on failure on 32-bit
  - x86/uaccess: Improve the 8-byte getuser() case
  - x86: fix whitespace in runtime-const assembler output
  - dcache: keep dentry_hashtable or d_hash_shift even when not used
  - runtime constants: add x86 architecture support
  - runtime constants: deal with old decrepit linkers
  - x86/uaccess: Add missing __force to casts in __access_ok() and valid_user_address()
  - !20345 arm64: entry: xcall/xint: make asm conditionals compatible with clang IAS
  - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
  - libceph: replace BUG_ON with bounds check for map->max_osd
  - libceph: prevent potential out-of-bounds writes in handle_auth_session_key()
  - libceph: fix potential use-after-free in have_mon_and_osd_map()
  - sctp: Hold sock lock while iterating over address list
  - sctp: Prevent TOCTOU out-of-bounds write
  - sctp: Hold RCU read lock while iterating over address list
  - tipc: Fix use-after-free in tipc_mon_reinit_self().
  - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto
  - sctp: avoid NULL dereference when chunk data buffer is missing
  - bpf: Explicitly check accesses to bpf_sock_addr
  - ipvs: Defer ip_vs_ftp unregister during netns cleanup
  - nexthop: Forbid FDB status change while nexthop is in a group
  - netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm
  - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().
  - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer
  - sctp: initialize more fields in sctp_v6_from_sk()
  - pNFS: Fix a deadlock when returning a delegation during open()
  - Input: alps - fix use-after-free bugs caused by dev3_register_work
  - x86/cpu: Get CPU LLC ID from CPUID 0x8000001d in guest for Hygon processors
  - kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork()
  - mm: (un)track_pfn_copy() fix + doc improvements
  - x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range()
  - !20642  mtdchar: fix integer overflow in read/write ioctls
  - mm/vmalloc: fix data race in show_numa_info()
  - mm/slub: avoid accessing metadata when pointer is invalid in object_err()
  - config: enable CONFIG_MITIGATION_VMESCAPE by default on x86
  - x86/vmscape: Enable the mitigation
  - x86/vmscape: Enumerate VMSCAPE bug
  - x86/vmscape: Add conditional IBPB mitigation
  - drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb
  - parse_longname(): strrchr() expects NUL-terminated string
  - media: imon: make send_packet() more robust
  - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item
  - fbcon: Set fb_display[i]->mode to NULL when the mode is released
  - !20569  CVE-2024-35808
  - mtdchar: fix integer overflow in read/write ioctls
  - !20619 Fix CVE-2026-22991
  - !20612 net: hns3: extend HCLGE_FD_AD_COUNTER_NUM to 8 bits
  - LoongArch: Add more instruction opcodes and emit_* helpers
  - iio: common: st_sensors: Fix use of uninitialize device structs
  - !20581  null_blk: fix kmemleak by releasing references to fault configfs items
  - mm/mempool: fix poisoning order>0 pages with HIGHMEM
  - mm/page_poison: replace kmap_atomic() with kmap_local_page()
  - mm/mempool: replace kmap_atomic() with kmap_local_page()
  - usb: gadget: udc: fix use-after-free in usb_gadget_state_work
  - net: dsa: properly keep track of conduit reference
  - net/sched: sch_qfq: do not free existing class in qfq_change_class()
  - macvlan: fix possible UAF in macvlan_forward_source()
  - netfilter: nft_objref: validate objref and objrefmap expressions
  - arp: do not assume dev_hard_header() does not change skb->head
  - ip6_gre: make ip6gre_header() robust
  - netfilter: nf_tables: avoid chain re-validation if possible
  - netfilter: nf_tables: drop unused 3rd argument from validate callback ops
  - Revert "netfilter: nft_objref: validate objref and objrefmap expressions"
  - bpf: Fix reference count leak in bpf_prog_test_run_xdp()
  - net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset
  - ethtool: Avoid overflowing userspace buffer on stats query
  - ipvs: fix ipv4 null-ptr-deref in route error path
  - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()
  - !20596  mm/page_alloc: prevent pcp corruption with SMP=n
  - !20598  team: fix check for port enabled in team_queue_override_port_prio_changed()
  - !18823  hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio
  - mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc()
  - kasan: avoid sleepable page allocation from atomic context
  - f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic
  - f2fs: compress: change the first parameter of page_array_{alloc,free} to sbi
  - !20583 [OLK-6.6][linux-6.6.y sync] Backport 6.6.102-6.6.103 LTS Patches
  - !20460  fbdev: Fix vmalloc out-of-bounds write in fast_imageblit
  - urma:fix log level and pass status 9
  - urma: modify log level
  - !20592  CVE-2025-71141 fixup
  - !20594  CVE-2025-39744 fixup
  - !20607  powerpc/64s/slb: Fix SLB multihit issue during SLB preload
  - !20606  mm/huge_memory: fix NULL pointer deference when splitting folio
  - !20604 Fix CVE-2026-22984
  - !20603 Fix CVE-2026-23021
  - !20600 Fix CVE-2026-22990
  - urma: fix the jfe uaf issue that occurred during the killall process.
  - !20380 pswiotlb: Adapt to the IOMMU DMA API upgraded by IOMMUFD
  - libceph: make free_choose_arg_map() resilient to partial allocation
  - drm/dp: Change AUX DPCD probe address from LANE0_1_STATUS to TRAINING_PATTERN_SET
  - net: hns3: extend HCLGE_FD_AD_COUNTER_NUM to 8 bits
  - net: hns3: extend HCLGE_FD_AD_QID to 11 bits
  - net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue
  - net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M
  - Revert "net: hns3: add support for FD counter"
  - !20587  dmaengine: stm32: dmamux: fix device leak on route allocation
  - pmdomain: arm: scmi: Fix genpd leak on provider registration failure
  - powerpc/64s/slb: Fix SLB multihit issue during SLB preload
  - mm/huge_memory: fix NULL pointer deference when splitting folio
  - !20562  LoongArch: BPF: Sign extend kfunc call arguments
  - !20470  ipv4: Fix reference count leak when using error routes with nexthop objects
  - !20471  net: sock: fix hardened usercopy panic in sock_recv_errqueue
  - !20472  net: fix memory leak in skb_segment_list for GRO packets
  - !20473  ipv4: ip_gre: make ipgre_header() robust
  - !20469  SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf
  - !20476  ipv6: Fix use-after-free in inet6_addr_del().
  - !20477  svcrdma: bound check rq_pages index in inline path
  - !20578  ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()
  - !20579  fix CVE-2025-68768
  - !20542  Fix NFS deadlock
  - USB: storage: Remove subclass and protocol overrides from Novatek quirk
  - cpuidle: governors: menu: Select polling state in some more cases
  - cpuidle: governors: menu: Rearrange main loop in menu_select()
  - cpuidle: menu: Update documentation after previous changes
  - Revert "drm/tegra: dsi: Clear enable register if powered by bootloader"
  - parisc: Remove spurious if statement from raw_copy_from_user()
  - ata: libata-scsi: Fix system suspend for a security locked drive
  - Revert "drm/amdgpu: fix incorrect vm flags to map bo"
  - mfd: axp20x: Set explicit ID for regulator cell if no IRQ line is present
  - drm/amd/display: use udelay rather than fsleep
  - sched/fair: Revert max_newidle_lb_cost bump
  - net: ipv4: fix regression in local-broadcast routes
  - tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers
  - PM: runtime: Do not clear needs_force_resume with enabled runtime PM
  - usb: typec: ucsi: psy: Set max current to zero when disconnected
  - io_uring/rw: cast rw->flags assignment to rwf_t
  - Documentation: ACPI: i2c-muxes: fix I2C device references
  - s390/hypfs: Enable limited access during lockdown
  - s390/hypfs: Avoid unnecessary ioctl registration in debugfs
  - ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation
  - net/mlx5e: Preserve shared buffer capacity during headroom updates
  - net/mlx5: Base ECVF devlink port attrs from 0
  - Octeontx2-af: Skip overlap check for SPI field
  - bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU
  - bonding: Add independent control state machine
  - bonding: update LACP activity flag after setting lacp_active
  - net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate
  - ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc
  - gve: prevent ethtool ops after shutdown
  - phy: mscc: Fix timestamping for vsc8584
  - net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path
  - ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add
  - net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM
  - ALSA: usb-audio: Fix size validation in convert_chmap_v3()
  - mlxsw: spectrum: Forward packets with an IPv4 link-local source IP
  - Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync()
  - Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established
  - scsi: qla4xxx: Prevent a potential error pointer dereference
  - RDMA/bnxt_re: Fix to initialize the PBL array
  - RDMA/bnxt_re: Fix to remove workload check in SRQ limit path
  - RDMA/bnxt_re: Fix to do SRQ armena by default
  - RDMA/erdma: Fix ignored return value of init_kernel_qp
  - iosys-map: Fix undefined behavior in iosys_map_clear()
  - cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key
  - spi: spi-fsl-lpspi: Clamp too high speed_hz
  - usb: typec: maxim_contaminant: disable low power mode when reading comparator values
  - usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean
  - iio: imu: inv_icm42600: change invalid data error to -EBUSY
  - iio: imu: inv_icm42600: Convert to uXX and sXX integer types
  - iio: imu: inv_icm42600: use = { } instead of memset()
  - iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64
  - iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read()
  - iio: light: as73211: Ensure buffer holes are zeroed
  - tls: fix handling of zero-length records on the rx_list
  - powerpc/boot: Fix build with gcc 15
  - mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER
  - compiler: remove __ADDRESSABLE_ASM{_STR,}() again
  - drm/amd/display: Don't overclock DCE 6 by 15%
  - usb: dwc3: pci: add support for the Intel Wildcat Lake
  - usb: dwc3: Ignore late xferNotReady event to prevent halt timeout
  - USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles
  - usb: storage: realtek_cr: Use correct byte order for bcs->Residue
  - USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera
  - usb: renesas-xhci: Fix External ROM access timeouts
  - usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test
  - comedi: Make insn_rw_emulate_bits() do insn->n samples
  - usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive
  - cdx: Fix off-by-one error in cdx_rpmsg_probe()
  - most: core: Drop device reference after usage in get_channel()
  - iio: proximity: isl29501: fix buffered read on big-endian systems
  - iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe()
  - fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable()
  - drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS
  - cpuidle: governors: menu: Avoid selecting states with too much latency
  - cpuidle: menu: Remove iowait influence
  - mmc: sdhci-pci-gli: Add a new function to simplify the code
  - mmc: sdhci-pci-gli: Use PCI AER definitions, not hard-coded values
  - mptcp: disable add_addr retransmission when timeout is 0
  - mptcp: remove duplicate sk_reset_timer call
  - use uniform permission checks for all mount propagation changes
  - arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support
  - scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems
  - scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers
  - scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE
  - PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features
  - PCI: imx6: Delay link start until configfs 'start' written
  - PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining
  - PCI: rockchip: Use standard PCIe definitions
  - drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs
  - drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs
  - drm/amd/display: Fix DP audio DTO1 clock source on DCE 6.
  - drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3
  - ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6
  - mm/debug_vm_pgtable: clear page table entries at destroy_args()
  - squashfs: fix memory leak in squashfs_fill_super
  - mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency
  - memstick: Fix deadlock by moving removing flag earlier
  - KVM: arm64: Fix kernel BUG() due to bad backport of FPSIMD/SVE/SME fix
  - sched/fair: Fix frequency selection for non-invariant case
  - kbuild: userprogs: use correct linker when mixing clang and GNU ld
  - ata: libata-scsi: Return aborted command when missing sense and result TF
  - PM: runtime: Take active children into account in pm_runtime_get_if_in_use()
  - PM: runtime: Simplify pm_runtime_get_if_active() usage
  - ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig
  - usb: dwc3: imx8mp: fix device leak at unbind
  - wifi: mac80211: check basic rates validity in sta_link_apply_parameters
  - KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer
  - s390/mm: Remove possible false-positive warning in pte_free_defer()
  - btrfs: send: make fs_path_len() inline and constify its argument
  - btrfs: send: use fallocate for hole punching with send stream v2
  - btrfs: send: avoid path allocation for the current inode when issuing commands
  - btrfs: send: keep the current inode's path cached
  - btrfs: send: add and use helper to rename current inode when processing refs
  - btrfs: send: only use boolean variables at process_recorded_refs()
  - btrfs: send: factor out common logic when sending xattrs
  - btrfs: populate otime when logging an inode item
  - btrfs: constify more pointer parameters
  - btrfs: fix ssd_spread overallocation
  - btrfs: open code timespec64 in struct btrfs_inode
  - xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags
  - btrfs: abort transaction on unexpected eb generation at btrfs_copy_root()
  - btrfs: always abort transaction on failure to add block group to free space tree
  - btrfs: move transaction aborts to the error site in add_block_group_free_space()
  - btrfs: qgroup: fix race between quota disable and quota rescan ioctl
  - usb: typec: fusb302: cache PD RX state
  - block: Make REQ_OP_ZONE_FINISH a write operation
  - block: reject invalid operation in submit_bio_noacct
  - leds: flash: leds-qcom-flash: Fix registry access after re-bind
  - leds: flash: leds-qcom-flash: Limit LED current based on thermal condition
  - selftests/memfd: add test for mapping write-sealed memfd read-only
  - mm: update memfd seal write check to include F_SEAL_WRITE
  - mptcp: pm: kernel: flush: do not reset ADD_ADDR limit
  - mptcp: drop skb if MPTCP skb extension allocation fails
  - ipv6: sr: Fix MAC comparison to be constant-time
  - drm/amd/display: Don't overwrite dce60_clk_mgr
  - drm/amd/display: Add primary plane to commits for correct VRR handling
  - drm/amdkfd: Destroy KFD debugfs after destroy KFD wq
  - drm/amdgpu: update mmhub 3.0.1 client id mappings
  - drm/amdgpu: Avoid extra evict-restore process.
  - drm/amd: Restore cached power limit during resume
  - media: venus: venc: Clamp param smaller than 1fps and bigger than 240
  - media: venus: vdec: Clamp param smaller than 1fps and bigger than 240.
  - media: venus: protect against spurious interrupts during probe
  - media: venus: hfi: explicitly release IRQ during teardown
  - media: qcom: camss: cleanup media device allocated resource on error path
  - media: ov2659: Fix memory leaks in ov2659_probe()
  - media: usbtv: Lock resolution while streaming
  - media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free()
  - media: verisilicon: Fix AV1 decoder clock frequency
  - media: vivid: fix wrong pixel_array control size
  - media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init()
  - media: hi556: correct the test pattern configuration
  - media: gspca: Add bounds checking to firmware parser
  - parisc: Update comments in make_insert_tlb
  - parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault()
  - parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c
  - parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers
  - parisc: Define and use set_pte_at()
  - parisc: Check region is readable by user in raw_copy_from_user()
  - soc/tegra: pmc: Ensure power-domains are in a known state
  - f2fs: fix to avoid out-of-boundary access in dnode page
  - phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence
  - vhost/vsock: Avoid allocating arbitrarily-sized SKBs
  - PCI: endpoint: Fix configfs group removal on driver teardown
  - PCI: endpoint: Fix configfs group list head handling
  - mtd: rawnand: renesas: Add missing check after DMA map
  - mtd: rawnand: fsmc: Add missing check after DMA map
  - mtd: spinand: propagate spinand_wait() errors from spinand_write_page()
  - mtd: spi-nor: Fix spi_nor_try_unlock_all()
  - hwmon: (gsc-hwmon) fix fan pwm setpoint show functions
  - pwm: mediatek: Fix duty and period setting
  - pwm: mediatek: Handle hardware enable and clock enable separately
  - pwm: imx-tpm: Reset counter if CMOD is 0
  - wifi: ath11k: fix dest ring-buffer corruption when ring is full
  - wifi: ath11k: fix source ring-buffer corruption
  - wifi: ath11k: fix dest ring-buffer corruption
  - wifi: ath12k: fix dest ring-buffer corruption when ring is full
  - wifi: ath12k: fix source ring-buffer corruption
  - wifi: ath12k: fix dest ring-buffer corruption
  - wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table()
  - iio: adc: ad_sigma_delta: change to buffer predisable
  - zynq_fpga: use sgtable-based scatterlist wrappers
  - scsi: ufs: ufs-pci: Fix default runtime and system PM levels
  - scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers
  - ata: libata-scsi: Fix ata_to_sense_error() status handling
  - scsi: mpi3mr: Fix race between config read submit and interrupt completion
  - dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints
  - dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints
  - arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses
  - arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1
  - arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default
  - btrfs: zoned: fix write time activation failure for metadata block group
  - ext4: fix hole length calculation overflow in non-extent inodes
  - ext4: don't try to clear the orphan_present feature block device is r/o
  - ext4: fix reserved gdt blocks handling in fsmap
  - ext4: fix fsmap end of range reporting with bigalloc
  - ext4: check fast symlink for ea_inode correctly
  - tracing: fprobe-event: Sanitize wildcard for fprobe event name
  - crypto: qat - lower priority for skcipher and aead algorithms
  - lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap
  - vt: defkeymap: Map keycodes above 127 to K_HOLE
  - vt: keyboard: Don't process Unicode characters in K_OFF mode
  - bus: mhi: host: Fix endianness of BHI vector table
  - usb: dwc3: meson-g12a: fix device leaks at unbind
  - usb: musb: omap2430: fix device leak at unbind
  - usb: gadget: udc: renesas_usb3: fix device leak at unbind
  - usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init()
  - m68k: Fix lost column on framebuffer debug console
  - platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister()
  - cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table()
  - rcu: Fix racy re-initialization of irq_work causing hangs
  - HID: apple: avoid setting up battery timer for devices without battery
  - HID: magicmouse: avoid setting up battery timer when not needed
  - RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages
  - tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros
  - media: uvcvideo: Do not mark valid metadata as invalid
  - media: venus: Fix OOB read due to missing payload bound check
  - parisc: Makefile: fix a typo in palo.conf
  - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit
  - btrfs: do not allow relocation of partially dropped subvolumes
  - btrfs: zoned: do not select metadata BG as finish target
  - btrfs: clear dirty status from extent buffer on error at insert_new_root()
  - btrfs: zoned: do not remove unwritten non-data block group
  - btrfs: abort transaction during log replay if walk_log_tree() failed
  - btrfs: zoned: use filesystem size not disk size for reclaim decision
  - cdc-acm: fix race between initial clearing halt and open
  - thunderbolt: Fix copy+paste error in match_service_id()
  - usb: typec: ucsi: Update power_supply on power role change
  - misc: rtsx: usb: Ensure mmc child device is active when card is present
  - iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range
  - cifs: reset iface weights when we cannot find a candidate
  - drm/amdgpu: fix incorrect vm flags to map bo
  - scsi: lpfc: Remove redundant assignment to avoid memory leak
  - rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe
  - pNFS: Handle RPC size limit for layoutcommits
  - pNFS: Fix disk addr range check in block/scsi layout
  - pNFS: Fix stripe mapping in block/scsi layout
  - ASoC: Intel: avs: Fix uninitialized pointer error in probe()
  - net: phy: smsc: add proper reset flags for LAN8710A
  - ipmi: Fix strcpy source and destination the same
  - kconfig: lxdialog: fix 'space' to (de)select options
  - kconfig: gconf: fix potential memory leak in renderer_edited()
  - kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed()
  - ipmi: Use dev_warn_ratelimited() for incorrect message warnings
  - vfio/mlx5: fix possible overflow in tracking max message size
  - scsi: aacraid: Stop using PCI_IRQ_AFFINITY
  - scsi: target: core: Generate correct identifiers for PR OUT transport IDs
  - scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans
  - kconfig: nconf: Ensure null termination where strncpy is used
  - vfio/type1: conditional rescheduling while pinning
  - kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c
  - f2fs: check the generic conditions first
  - exfat: add cluster chain loop check for dir
  - i2c: Force DLL0945 touchpad i2c freq to 100khz
  - apparmor: use the condition in AA_BUG_FMT even with debug disabled
  - dm-table: fix checking for rq stackable devices
  - dm-mpath: don't print the "loaded" message if registering fails
  - i3c: master: Initialize ret in i3c_i2c_notifier_call()
  - i3c: don't fail if GETHDRCAP is unsupported
  - apparmor: shift ouid when mediating hard links in userns
  - rtc: ds1307: handle oscillator stop flag (OSF) for ds1341
  - i3c: add missing include to internal header
  - module: Prevent silent truncation of module name in delete_module(2)
  - md: dm-zoned-target: Initialize return variable r to avoid uninitialized use
  - soundwire: Move handle_nested_irq outside of sdw_dev_lock
  - soundwire: amd: serialize amd manager resume sequence during pm_prepare
  - crypto: octeontx2 - add timeout for load_fvc completion poll
  - media: uvcvideo: Fix bandwidth issue for Alcor camera
  - media: usb: hdpvr: disable zero-length read messages
  - media: tc358743: Increase FIFO trigger level to 374
  - media: tc358743: Return an appropriate colorspace from tc358743_set_fmt
  - media: tc358743: Check I2C succeeded during probe
  - pinctrl: stm32: Manage irq affinity settings
  - scsi: mpi3mr: Correctly handle ATA device errors
  - scsi: mpt3sas: Correctly handle ATA device errors
  - power: supply: qcom_battmgr: Add lithium-polymer entry
  - RDMA/core: reduce stack using in nldev_stat_get_doit()
  - dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs
  - leds: leds-lp50xx: Handle reg to get correct multi_index
  - media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control
  - MIPS: lantiq: falcon: sysctrl: fix request memory check logic
  - crypto: jitter - fix intermediary handling
  - watchdog: iTCO_wdt: Report error if timeout configuration fails
  - MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free}
  - clk: qcom: ipq5018: keep XO clock always on
  - hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state
  - watchdog: dw_wdt: Fix default timeout
  - fs/orangefs: use snprintf() instead of sprintf()
  - phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal
  - mfd: axp20x: Set explicit ID for AXP313 regulator
  - clk: tegra: periph: Fix error handling and resolve unsigned compare warning
  - fbdev: fix potential buffer overflow in do_register_framebuffer()
  - cifs: Fix calling CIFSFindFirst() for root path without msearch
  - watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition
  - drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported
  - drm/amd/display: Only finalize atomic_obj if it was initialized
  - vhost: fail early when __vhost_add_used() fails
  - vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page
  - net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325
  - rcu: Fix rcu_read_unlock() deadloop due to IRQ work
  - drm/amd/display: Avoid trying AUX transactions on disconnected ports
  - selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size
  - bpf: Make reg_not_null() true for CONST_PTR_TO_MAP
  - uapi: in6: restore visibility of most IPv6 socket options
  - drm/ttm: Should to return the evict error
  - drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range
  - net: ncsi: Fix buffer overflow in fetching version id
  - ionic: clean dbpage in de-init
  - wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc()
  - ptp: Use ratelimite for freerun error message
  - bpftool: Fix JSON writer resource leak in version command
  - net: dsa: b53: prevent SWITCH_CTRL access on BCM5325
  - net: dsa: b53: prevent DIS_LEARNING access on BCM5325
  - net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325
  - net: dsa: b53: fix b53_imp_vlan_setup for BCM5325
  - gve: Return error for unknown admin queue command
  - net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs
  - net: vlan: Make is_vlan_dev() a stub when VLAN is not configured
  - drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual
  - dpaa_eth: don't use fixed_phy_change_carrier
  - wifi: iwlegacy: Check rate_idx range after addition
  - netmem: fix skb_frag_address_safe with unreadable skbs
  - powerpc: floppy: Add missing checks after DMA map
  - wifi: ath12k: Decrement TID on RX peer frag setup error handling
  - wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0
  - wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`.
  - wifi: mac80211: update radar_required in channel context after channel switch
  - drm/amd/display: Fix 'failed to blank crtc!'
  - wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect
  - wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd()
  - wifi: ath12k: Add memset and update default rate value in wmi tx completion
  - drm/amd/display: Separate set_gsl from set_gsl_source_select
  - net: fec: allow disable coalescing
  - net: atlantic: add set_power to fw_ops for atl2 to fix wol
  - net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths()
  - net: thunderbolt: Enable end-to-end flow control also in transmit
  - kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace
  - wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch
  - wifi: rtw89: Disable deep power saving for USB/SDIO
  - wifi: rtw89: Fix rtw89_mac_power_switch() for USB
  - drm/msm: use trylock for debugfs
  - wifi: mac80211: fix rx link assignment for non-MLO stations
  - ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in __ipv6_dev_mc_inc().
  - (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer
  - wifi: mac80211: don't complete management TX on SAE commit
  - sched/fair: Bump sd->max_newidle_lb_cost when newidle balance fails
  - s390/stp: Remove udelay from stp_sync_clock()
  - wifi: iwlwifi: mvm: fix scan request validation
  - um: Re-evaluate thread flags repeatedly
  - wifi: iwlwifi: mvm: set gtk id also in older FWs
  - perf/cxlpmu: Remove unintended newline from IRQ name format string
  - net: phy: micrel: Add ksz9131_resume()
  - net: thunderx: Fix format-truncation warning in bgx_acpi_match_id()
  - net: ipv4: fix incorrect MTU in broadcast routes
  - wifi: cfg80211: Fix interface type validation
  - net: mctp: Prevent duplicate binds
  - arm64: Mark kernel as tainted on SAE and SError panic
  - net/mlx5e: Properly access RCU protected qdisc_sleeping variable
  - net: ag71xx: Add missing check after DMA map
  - et131x: Add missing check after DMA map
  - wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB
  - be2net: Use correct byte order and format string for TCP seq and ack_seq
  - s390/time: Use monotonic clock in get_cycles()
  - wifi: cfg80211: reject HTC bit for management frames
  - ktest.pl: Prevent recursion of default variable options
  - wifi: ath12k: Correct tid cleanup when tid setup fails
  - net: usb: cdc-ncm: check for filtering capability
  - xen/netfront: Fix TX response spurious interrupts
  - Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie()
  - powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64
  - ASoC: qcom: use drvdata instead of component to keep id
  - ASoC: codecs: rt5640: Retry DEVICE_ID verification
  - iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement
  - ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros
  - ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop
  - platform/chrome: cros_ec_typec: Defer probe on missing EC parent
  - platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches
  - soc: qcom: mdt_loader: Actually use the e_phoff
  - imx8m-blk-ctrl: set ISI panic write hurry level
  - pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop()
  - usb: core: usb_submit_urb: downgrade type check
  - usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present
  - ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4
  - ASoC: hdac_hdmi: Rate limit logging on connection and disconnection
  - ALSA: hda: Disable jack polling at shutdown
  - ALSA: hda: Handle the jack polling always via a work
  - mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode()
  - mei: bus: Check for still connected devices in mei_cl_bus_dev_release()
  - char: misc: Fix improper and inaccurate error code returned by misc_init()
  - reset: brcmstb: Enable reset drivers for ARCH_BCM2835
  - pps: clients: gpio: fix interrupt handling order in remove path
  - ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path
  - mmc: sdhci-msm: Ensure SD card power isn't ON when card removed
  - ACPI: processor: fix acpi_object initialization
  - PM: sleep: console: Fix the black screen issue
  - thermal: sysfs: Return ENODATA instead of EAGAIN for reads
  - PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit()
  - firmware: tegra: Fix IVC dependency problems
  - ACPI: PRM: Reduce unnecessary printing to avoid user confusion
  - selftests: tracing: Use mutex_unlock for testing glob filter
  - tools/build: Fix s390(x) cross-compilation with clang
  - gpio: tps65912: check the return value of regmap_update_bits()
  - iio: adc: ad_sigma_delta: don't overallocate scan buffer
  - tools/nolibc: define time_t in terms of __kernel_old_time_t
  - thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required
  - ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed
  - EDAC/synopsys: Clear the ECC counters on init
  - gpio: wcd934x: check the return value of regmap_update_bits()
  - remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU
  - soc: qcom: rpmh-rsc: Add RSC version 4 support
  - usb: xhci: Avoid showing errors during surprise removal
  - usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command
  - usb: xhci: Avoid showing warnings for dying controller
  - usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default
  - selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t
  - cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag
  - platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list
  - usb: xhci: print xhci->xhc_state when queue_command failed
  - tracefs: Add d_delete to remove negative dentries
  - securityfs: don't pin dentries twice, once is enough...
  - fix locking in efi_secret_unlink()
  - ext2: Handle fiemap on empty files to prevent EINVAL
  - fs/ntfs3: correctly create symlink for relative path
  - fs/ntfs3: Add sanity check for file name
  - better lockdep annotations for simple_recursive_removal()
  - hfs: fix not erasing deleted b-tree node issue
  - drbd: add missing kref_get in handle_write_conflicts
  - udf: Verify partition map count
  - gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops
  - nvme-pci: try function level reset on init failure
  - smb/server: avoid deadlock when linking with ReplaceIfExists
  - arm64: Handle KCOV __init vs inline mismatches
  - ptp: prevent possible ABBA deadlock in ptp_clock_freerun()
  - intel_idle: Allow loading ACPI tables for any family
  - net: ti: icss-iep: Fix incorrect type for return value in extts_enable()
  - netfilter: ctnetlink: fix refcount leak on table dump
  - udp: also consider secpath when evaluating ipsec use for checksumming
  - KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs
  - KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter
  - KVM: VMX: Extract checking of guest's DEBUGCTL into helper
  - KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported
  - KVM: VMX: Handle forced exit due to preemption timer in fastpath
  - KVM: VMX: Re-enter guest in fastpath for "spurious" preemption timer exits
  - KVM: x86: Plumb "force_immediate_exit" into kvm_entry() tracepoint
  - libceph: prevent potential out-of-bounds reads in handle_auth_done()
  - net: usb: pegasus: fix memory leak in update_eth_regs_async()
  - libceph: replace overzealous BUG_ON in osdmap_apply_incremental()
  - !20540 urma: added support for ipoverurma
  - team: fix check for port enabled in team_queue_override_port_prio_changed()
  - mm/page_alloc: prevent pcp corruption with SMP=n
  - !20528 Fix CVE-2025-71083
  - KVM: nVMX: Defer SVI update to vmcs01 on EOI when L2 is active w/o VID
  - KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update()
  - KVM: SVM: Set RFLAGS.IF=1 in C code, to get VMRUN out of the STI shadow
  - smb: client: don't wait for info->send_pending == 0 on error
  - smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection()
  - ACPI: processor: perflib: Move problematic pr->performance check
  - ACPI: processor: perflib: Fix initial _PPC limit application
  - Documentation: ACPI: Fix parent device references
  - fs: Prevent file descriptor table allocations exceeding INT_MAX
  - sunvdc: Balance device refcount in vdc_port_mpgroup_check
  - PCI: Extend isolated function probing to LoongArch
  - NFSD: detect mismatch of file handle and delegation stateid in OPEN op
  - net: dpaa: fix device leak when querying time stamp info
  - net: ti: icss-iep: fix device and OF node leaks at probe
  - net: mtk_eth_soc: fix device leak at probe
  - net: enetc: fix device and OF node leak at probe
  - net: gianfar: fix device leak when querying time stamp info
  - net: phy: micrel: fix KSZ8081/KSZ8091 cable test
  - gpio: mlxbf3: use platform_get_irq_optional()
  - gpio: mlxbf2: use platform_get_irq_optional()
  - gpio: virtio: Fix config space reading.
  - ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks
  - ALSA: hda/realtek: Fix headset mic on HONOR BRB-X
  - ALSA: usb-audio: Validate UAC3 cluster segment descriptors
  - rcu: Fix racy re-initialization of irq_work causing hangs
  - rcu: Fix rcu_read_unlock() deadloop due to IRQ work
  - drm/tilcdc: Fix removal actions in case of failed probe
  - drm/tilcdc: request and mapp iomem with devres
  - urma: fix update topo logic
  - dmaengine: stm32: dmamux: fix device leak on route allocation
  - pswiotlb: Adapt to the IOMMU DMA API upgraded by IOMMUFD
  - null_blk: fix kmemleak by releasing references to fault configfs items
  - inet: frags: flush pending skbs in fqdir_pre_exit()
  - inet: frags: add inet_frag_queue_flush()
  - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()
  - md/dm-raid: don't clear MD_RECOVERY_FROZEN after setting frozen
  - md/dm-raid: don't call md_reap_sync_thread() directly
  - ACPICA: Avoid walking the Namespace if start_node is NULL
  - arm64: entry: xcall/xint: make asm conditionals compatible with clang IAS
  - LoongArch: BPF: Sign extend kfunc call arguments
  - genirq/msi:: Fix kabi break of struct msi_desc
  - genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie
  - NFS: Fix a deadlock involving nfs_release_folio()
  - Revert "[Huawei] Revert "NFS: fix up nfs_release_folio() to try to release the page""
  - urma: added support for ipoverurma
  - drm/ttm: Avoid NULL pointer deref for evicted BOs
  - XSched: Update XSched manual
  - svcrdma: bound check rq_pages index in inline path
  - ipv6: Fix use-after-free in inet6_addr_del().
  - ipv4: ip_gre: make ipgre_header() robust
  - net: fix memory leak in skb_segment_list for GRO packets
  - net: sock: fix hardened usercopy panic in sock_recv_errqueue
  - ipv4: Fix reference count leak when using error routes with nexthop objects
  - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf
  - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit
  - udp: Deal with race between UDP socket address change and rehash
  - EDAC/amd64: The width of hash value is 2 bits for Hygon family 18h model 6h processors
  - x86/tsc: Use topology_max_packages() to get package number
  - EDAC/amd64: Use unicast instead of broadcast to access the cs_config register
  - EDAC/amd64: Correct the address translation for hygon family 18h model 4h
  - KVM: arm64: Mark some header functions as inline
  - KVM: arm64: Refactor exit handlers
  - x86/resctrl: Fix memory bandwidth counter width for Hygon CPUs
  - hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio


author: Li Nan <linan122@huawei.com> - 6.6.0-140.0.0.134
changelog:
  - !20820 ub/obmm: add sysfs interface for mempool statistics & bugfixes
  - ub/obmm: fix wrong pxm_numa parameter validation
  - ub/obmm: Remove unused parameters from obmm_addr_check.c
  - ub/obmm: Enhance mem_allocator_granu validation
  - ub/obmm: simplify allocator naming scheme
  - ub/obmm: fix allow_slow logic and optimize conti_alloc_memory
  - ub/obmm: add sysfs interface with fine-grained memory statistics
  - !20804  net: hv_netvsc: reject RSS hash key programming without RX indirection table
  - !20813  migrate: correct lock ordering for hugetlb file folios
  - !20812  libceph: make calc_target() set t->paused, not just clear it
  - !20719 drivers/ub/sentry: some bugfix
  - !20798 urma: log should not retrieve eid_idx from uctx
  - !20808 urma: support triple bonding device
  - urma: log should not retrieve eid_idx from uctx
  - migrate: correct lock ordering for hugetlb file folios
  - libceph: make calc_target() set t->paused, not just clear it
  - !20745 vfio platform VFIO support for hisi05a1 devices
  - urma: support triple bonding device
  - net: hv_netvsc: reject RSS hash key programming without RX indirection table
  - !20789  gic: Add hip09 support for HISILICON_ERRATUM_165010801
  - !20726  tracing: Add recursion protection in kernel stack trace recording
  - !20668  irqchip/gic-v3-its: Avoid truncating memory addresses
  - !20795 ub: udma: support query and set qos info.
  - !20791 Migration/urma:optimize performance in live migration.
  - ub: udma: Support for UE link establishment message.
  - Migration/urma: optimize performance in live migration.
  - !20787 ub: cdma: modify the method of assigning values to the structure
  - !20759 ubcore: hotfix route query for port eid on the same node.
  - ub: udma: support query and set qos info.
  - Revert "ub: ubase: Support for RC saved by queue granularity"
  - ubcore: hotfix route query for port eid on the same node.
  - !20676 urma: set/get sl
  - !20765 urma: bugfix of UAF and double free in ubcm
  - !20778 ub: ubase&unic: Fixes some bugfix in resetting and dfx ability
  - gic: Add hip09 support for HISILICON_ERRATUM_165010801
  - vfio/platform: Add CONFIG_VFIO_HISI05A1 to openeuler_defconfig and turn it on by default
  - vfio/platform: VFIO support for hisi05a1 devices
  - ub: cdma: modify the method of assigning values to the structure
  - urma: set/get sl
  - ub: ubase: support to query ub dl pkt stats and real-time peak bandwidth
  - ub: ubase: Support for RC saved by queue granularity
  - ub: ubase: Traverse mailbox AE events using interrupts and polling.
  - ub: ubase: Modify ubase ctrlq trace to distinguish between MUE and UE messages
  - net: unic: The function of dumping himac registers is added.
  - ub: ubase: Fix MAC is_pfc sync, optimize list ops and code style
  - ub: ubase: Retain the initial tm qset configuration and restore it
  - net: unic: Fixed an issue in the bond IP address notification and pause configuration when an exception occurs.
  - ub: ubase: Add a retransmission function to improve reliability.
  - net: unic: Increase the readability and reliability of loopback code
  - net: unic: Synchronize the code modify for ip management and deactivation
  - net: unic: Increase the readability and reliability of VLAN feature.
  - net: unic: Added unic DFX log information.
  - ub: ubase: Add and correct comments for some functions and data structures
  - net: unic: Notify MAMI when the bond port status changes
  - ub: ubase: Support for HIMAC reset during ELR reset and Optimize ELR reset
  - !20768 iommu/ummu-core: Fix separate page table compatibility
  - !20665 [OLK-6.6] Enhance CMA memory usage reporting for CSV3
  - !20764 net: hns3: fix double free issue for tx spare buffer
  - urma: bugfix of UAF and double free in ubcm
  - iommu/ummu-core: Fix separate page table compatibility
  - net: hns3: fix double free issue for tx spare buffer
  - drivers/ub/sentry: fix memory leak in sentry_msg_helper
  - drivers/ub/sentry: initialize some variables
  - drivers/ub/sentry: fix potential buffer overflow in convert_str_to_smh_msg()
  - drivers/ub/sentry: fix potential null pointer reference in sentry_uvb_comm
  - drivers/ub/sentry: add input parameter verification for exported symbols
  - tracing: Add recursion protection in kernel stack trace recording
  - x86/csv: Enhance CMA memory usage reporting for CSV3
  - irqchip/gic-v3-its: Avoid truncating memory addresses


author: Li Nan <linan122@huawei.com> - 6.6.0-141.0.0.135
changelog:
  - !20704 kernel support hisi-cca-da
  - !20180 [virtCCA Live Migration 2]virtcca secure cvm supports live migration
  - !20905 v2  KVM: arm64: Fix softirq masking in FPSIMD register saving sequence
  - !20965 iommu/ummu: Optimized TID invalidation and tdev initialization
  - !20964 iommu/ummu: Support TID and EID Granularity for MPAM
  - !20970 ub: ubase&unic: Supporting the black box capability of the ubase&unic driver
  - hisi-cca-da: Start dev by rsi call
  - hisi-cca-da: Set ripas of the bar region as RIPAS_DEV
  - hisi-cca-da: Support swiotlb and realm memory use
  - hisi-cca-da: Add smmu info when dev attach
  - hisi-cca-da: Transfer realm msix access to rmm
  - hisi-cca-da: Support pcipc sriov capability
  - hisi-cca-da: Delay realm memory release to kvm_destroy_realm
  - hisi-cca-da: Create realm s2 host pgtable and map msi mmio to rmm
  - hisi-cca-da: Add cca realm s2 pgtable framework
  - hisi-cca-da: Use bitmap to determine whether the command can be forwarded
  - hisi-cca-da: Restrict Realm SMMU to stage-2 domain only
  - hisi-cca-da: Add cmd forward mechanism in realm smmu
  - hisi-cca-da: Add realm smmu event and gerror irq initialization
  - hisi-cca-da: Add realm smmu stream table initialization
  - hisi-cca-da: Add realm smmu cmdq and evtq initialization
  - hisi-cca-da: Add realm smmu initialization
  - hisi-cca-da: Add relam iommu support to iommufd
  - hisi-cca-da: Add realm iommu support for vfio-iommu-type1
  - hisi-cca-da: Support dev map and unmap
  - hisi-cca-da: Support dev validate and dev start
  - hisi-cca-da: VFIO support ccada
  - hisi-cca-da: Support dev delegate and dev attach
  - hisi-cca-da: Support root dev delegate and dev init
  - hisi-cca-da: Add hisilicon extension smc and ccada cmd
  - hisi-cca-da: Add hisi ccada feature config
  - !20751 ARM CCA supports hugepage
  - !20944 ub: ubmempfd: supports for D2H mapping and demapping
  - !20888  HiSock Enhancement
  - ub: ubase&unic: Supporting the black box capability of the ubase&unic driver.
  - net: unic: Resolve the residual MAC address problem
  - net: unic: Optimized the code for the cmd structure and FEC function.
  - ub: ubase: add log for post mailbox timeout
  - ub: ubus: Remove black box header file to include dir
  - rme: Remove the secret bit of the vring desc addr
  - rme: improve hisi-cca data mmap and destroy method
  - !20943 uvb: fix wd_obtain logic err
  - !20942 urma: fix bond device id not release
  - !20892  dcache: Limit the minimal number of bucket to two
  - rme: isolate page when do delegation to avoid migration
  - rme: hisi-cca supports different levels for mapping ram
  - rme: rename ccal to hisi-cca
  - rme: support set ripas for ccal realm vm
  - rme: support destroy ram data for ccal realm vm
  - rme: support populate region for ccal realm vm
  - rme: support map ram for ccal realm vm
  - rme: support config ccal realm vm
  - rme: support ccal RMI calls
  - rme: realm vm supports wfx handler
  - !20952 urma: introduce ipourma module
  - iommu/ummu-core: Simplifies tdev initialization resources
  - iommu/ummu: Optimized log printing
  - iommu/ummu: Use passed gfp_mask in map_pages callback
  - uvb: fix wd_obtain logic err
  - !20949 ub: udma: support user ctl function.
  - urma: fix bond device id not release
  - !20901 drivers/ub/sentry: some bugfix
  - ub: ubmempfd: supports for D2H mapping and demapping
  - ub: ubmempfd: supports providing services to the QEMU process through file nodes
  - [virtCCA Live Migration 2]virtcca secure cvm supports live migration
  - urma: query priority and enable bit, support ring size configuration
  - urma: implement debugfs, improve boundary checks and error handling logic
  - urma: implement data plane interaction and statistics
  - urma: implement ipourma network device operations
  - urma: ipourma resource management
  - urma: ipourma resource management and err code
  - urma: introduce ipourma main module
  - iommu/ummu: Optimized the TID invalidation configuration
  - iommu/ummu: Optimized SVA permission table memory allocation approach
  - iommu/ummu: Adapt UMMU SVA interface adjustment
  - iommu/ummu: Support TID and EID Granularity for MPAM
  - !20848 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y
  - !20847 urma: sl resource query error
  - !20908 [OLK-6.6][linux-6.6.y sync] Backport 6.6.108-6.6.110 LTS Patches
  - !20084 Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption
  - !20929  PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug
  - drivers/ub/sentry: fix check input parameters
  - ub: udma: support user ctl function.
  - ub: udma: support uboe function.
  - ub: udma: bugfix related to query aux info.
  - !20935 ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs
  - drivers/ub/sentry: do not use magic numbers
  - !20876 urma: Kernel-mode specific implementations file for Jetty extension interface
  - urma: sl resource query error
  - !20873 sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4
  - !20875 sunrpc: fix race in cache cleanup causing stale nextcheck time
  - ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs
  - ub: ubmem_vmmu: supports parsing and configuring the hardware node information
  - ub: ubmem_vmmu: HiSilicon ubmem_vmmu Architecture Implementation
  - !20806 Fix CVE-2025-71225
  - !20896  scsi: qla2xxx: Free sp in error path to fix system crash
  - !20894  scsi: qla2xxx: Delay module unload while fabric scan in progress
  - !20893  scsi: qla2xxx: Validate sp before freeing associated memory
  - !20802 Fix CVE-2026-23110
  - urma: Kernel-mode specific implementations file for Jetty extension interface
  - drivers/ub/sentry: fix memory leak in process_urma_data()
  - drivers/ub/sentry: initialize some variables
  - PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug
  - !20770 ub: ubdevshm: supports the memory user to obtain and release shared memory
  - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00
  - mm: consider non-anon swap cache folios in folio_expected_ref_count()
  - mm: simplify folio_expected_ref_count()
  - ASoC: qcom: audioreach: fix potential null pointer dereference
  - gcc-plugins: Remove TODO_verify_il for GCC >= 16
  - crypto: sha256 - fix crash at kexec
  - drm/i915/backlight: Return immediately when scale() finds invalid parameters
  - minmax.h: remove some #defines that are only expanded once
  - minmax.h: simplify the variants of clamp()
  - minmax.h: move all the clamp() definitions after the min/max() ones
  - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp()
  - minmax.h: reduce the #define expansion of min(), max() and clamp()
  - minmax.h: update some comments
  - minmax.h: add whitespace around operators and after commas
  - minmax: fix up min3() and max3() too
  - minmax: improve macro expansion and type checking
  - minmax: don't use max() in situations that want a C constant expression
  - minmax: simplify min()/max()/clamp() implementation
  - minmax: make generic MIN() and MAX() macros available everywhere
  - drm/ast: Use msleep instead of mdelay for edid read
  - gpiolib: Extend software-node support to support secondary software-nodes
  - ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB
  - s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b
  - kmsan: fix out-of-bounds access to shadow memory
  - afs: Fix potential null pointer dereference in afs_put_server
  - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address
  - i40e: improve VF MAC filters accounting
  - i40e: add mask to apply valid bits for itr_idx
  - HID: asus: add support for missing PX series fn keys
  - drm/gma500: Fix null dereference in hdmi teardown
  - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow()
  - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port
  - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup()
  - net: dsa: lantiq_gswip: do also enable or disable cpu port
  - selftests: fib_nexthops: Fix creation of non-FDB nexthops
  - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS
  - bnxt_en: correct offset handling for IPv6 destination address
  - vhost: Take a reference on the task in struct vhost_task.
  - Bluetooth: hci_sync: Fix hci_resume_advertising_sync
  - ethernet: rvu-af: Remove slash from the driver name
  - can: peak_usb: fix shift-out-of-bounds issue
  - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow
  - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow
  - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow
  - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow
  - bpf: Reject bpf_timer for PREEMPT_RT
  - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI
  - wifi: virt_wifi: Fix page fault on connect
  - cpufreq: Initialize cpufreq-based invariance before subsys
  - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients
  - arm64: dts: imx8mp: Correct thermal sensor index
  - mm: folio_may_be_lru_cached() unless folio_test_large()
  - mm/gup: local lru_add_drain() to avoid lru_add_drain_all()
  - mm/gup: check ref_count instead of lru before migration
  - mm: add folio_expected_ref_count() for reference count calculation
  - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked"
  - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions
  - ALSA: usb-audio: Add mute TLV for playback volumes on more devices
  - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk
  - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device
  - i2c: designware: Add quirk for Intel Xe
  - mmc: sdhci-cadence: add Mobileye eyeQ support
  - usb: core: Add 0x prefix to quirks debug output
  - ALSA: usb-audio: Fix build with CONFIG_INPUT=n
  - ALSA: usb-audio: Convert comma to semicolon
  - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5
  - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks
  - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks
  - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks
  - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks
  - ALSA: usb-audio: Fix block comments in mixer_quirks
  - firewire: core: fix overlooked update of subsystem ABI version
  - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE
  - !20843 [OLK-6.6][linux-6.6.y sync] Backport 6.6.107-6.6.108 LTS Patches
  - !20869 ub:hisi-ubus: fix bug of security smatch
  - !20861  CVE-2026-23163
  - ub: ubdevshm: supports the memory user to obtain and release shared memory
  - ub: ubdevshm: supports granting and revoking shared memory permissions
  - ub: ubdevshm: supports the registration and deregistration of shared memory segments
  - ub: ubdevshm: supports the registration and deregistration
  - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence
  - !20886  Fix CVE-2026-23205
  - !20803 Fix CVE-2026-23112
  - !20868  sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure
  - !20811  smb/server: fix refcount leak in smb2_open()
  - !20810  smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe()
  - !20809  smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection()
  - sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4
  - sunrpc: fix race in cache cleanup causing stale nextcheck time
  - scsi: qla2xxx: Free sp in error path to fix system crash
  - scsi: qla2xxx: Delay module unload while fabric scan in progress
  - scsi: qla2xxx: Validate sp before freeing associated memory
  - dcache: Limit the minimal number of bucket to two
  - !20872 Fix CVE-2026-23220
  - !20846 Fix CVE-2026-23193
  - !20815 Fix CVE-2026-23216
  - !20859 Fix CVE-2026-23179
  - !20871  CVE-2026-23096
  - !20858 ub: ubase: resolve the cmdq crq overflow problem
  - bpf: Deprecate hisock unused kfuncs and orig ingress logic
  - bpf: Add local connect support for hisock
  - bpf: Add ipv4-mapped ipv6 addr support for hisock
  - bpf: Add target comm parse to hisock_cmd
  - bpf: Add multi port parse to hisock_cmd
  - bpf: Only deploy hisock in server
  - bpf: Apply BPF_HISOCK_INGRESS to hisock ingress
  - bpf: Add bpf_handle_ingress/egress_ptype kfunc
  - bpf: Add bpf_get_skb_ethhdr kfunc
  - bpf: Add bpf_set_ingress/egress_dev kfunc
  - bpf: Add bpf_set_ingress_dst kfunc
  - bpf: Add BPF_HISOCK_INGRESS attach type
  - cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted
  - smb: client: fix potential UAF and double free in smb2_open_file()
  - smb/client: fix memory leak in smb2_open_file()
  - !20852  ASoC: amd: fix memory leak in acp3x pdm dma ops
  - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths
  - uacce: fix cdev handling in the cleanup path
  - Revert "uacce: fix for cdev memory leak"
  - ub:hisi-ubus: fix bug of security smatch
  - ub:ubus: injected route event
  - ub:ubus: Black Box Development
  - !20865 urma: urma support uboe
  - sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure
  - urma: urma support uboe
  - !20857 ub_fwctl driver adds support for querying some functions
  - ub:ub_fwctl:Add illegal verification for scc
  - ub:ub_fwctl:Support querying the historical status of port links
  - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove
  - drm/amdkfd: Don't use sw fault filter if retry cam enabled
  - ub:ub_fwctl:Support querying firmware version numbers
  - ub: ub_fwctl: Support querying real-time bandwidth statistics
  - ub:ub_fwctl:Support querying statistical indicators at the ub port and uboe port levels
  - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready()
  - !20854 [URMA] add ping server for urma_ping
  - urma: add ping server
  - ub: ubase: resolve the cmdq crq overflow problem
  - ub: ubase: Optimized the QoS code naming to improve code readability.
  - ub: ubase&unic: optimizing code and configuration settings.
  - net: unic: not support query and configure ip by control plane in UBoE
  - net: unic: fix the automatically enable uc guid promisc mode.
  - !20844 urma:kernel header of userctl
  - urma: Kernel-mode header file for Jetty extension interface
  - ASoC: amd: fix memory leak in acp3x pdm dma ops
  - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready()
  - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()
  - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again)
  - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11
  - !20835 Fix CVE-2026-23084
  - minmax: add a few more MIN_T/MAX_T users
  - minmax: simplify and clarify min_t()/max_t() implementation
  - minmax: avoid overly complicated constant expressions in VM code
  - rtc: pcf2127: fix SPI command byte for PCF2131 backport
  - xhci: dbc: Fix full DbC transfer ring after several reconnects
  - xhci: dbc: decouple endpoint allocation from initialization
  - phy: ti: omap-usb2: fix device leak at unbind
  - phy: Use device_get_match_data()
  - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path
  - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message
  - ASoC: wm8974: Correct PLL rate rounding
  - ASoC: wm8940: Correct typo in control name
  - ASoC: wm8940: Correct PLL rate rounding
  - io_uring: include dying ring in task_work "should cancel" state
  - io_uring: backport io_should_terminate_tw()
  - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx
  - selftests: mptcp: avoid spurious errors on TCP disconnect
  - selftests: mptcp: connect: catch IO errors on listen side
  - rds: ib: Increment i_fastreg_wrs before bailing out
  - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active
  - mmc: mvsdio: Fix dma_unmap_sg() nents value
  - ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S
  - ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface
  - btrfs: tree-checker: fix the incorrect inode ref size check
  - iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page()
  - LoongArch: Check the return value when creating kobj
  - LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled
  - LoongArch: Update help info of ARCH_STRICT_ALIGN
  - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/*
  - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp()
  - net: liquidio: fix overflow in octeon_init_instr_queue()
  - bonding: don't set oif to bond dev when getting NS target destination
  - net/mlx5e: Consider aggregated port speed during rate configuration
  - i40e: remove redundant memory barrier when cleaning Tx descs
  - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure
  - selftests: mptcp: sockopt: fix error messages
  - mptcp: tfo: record 'deny join id0' info
  - mptcp: set remote_deny_join_id0 on SYN recv
  - dpaa2-switch: fix buffer pool seeding for control traffic
  - btrfs: fix invalid extref key setup when replaying dentry
  - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch
  - wifi: mac80211: fix incorrect type for ret
  - wifi: mac80211: increase scan_ies_len for S1G
  - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported
  - !20769 [OLK-6.6][linux-6.6.y sync] Backport 6.6.106-6.6.107 LTS Patches
  - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list
  - !20776 ub:ubfi: Release the chosen node
  - !20817  CVE-2026-23094
  - !20819  dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()
  - ub:ubus: Add port num check
  - !20379 [OLK-6.6][sync from OLK-5.10]io_uring: Support forcing sq thread to be idle and woken up by hrtimer
  - !20830  sched/soft_domain: Increasing NR_MAX_CLUSTER to 32
  - sched/soft_domain: Increasing NR_MAX_CLUSTER to 32
  - btrfs: fix incorrect readahead expansion length
  - x86: disable image size check for test builds
  - drm/i915/power: fix size for for_each_set_bit() in abox iteration
  - drm/amdgpu: fix a memory leak in fence cleanup when unloading
  - net: mdiobus: release reset_gpio in mdiobus_unregister_device()
  - phy: ti-pipe3: fix device leak at unbind
  - phy: tegra: xusb: fix device and OF node leak at probe
  - dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate
  - usb: gadget: midi2: Fix MIDI2 IN EP max packet size
  - usb: gadget: midi2: Fix missing UMP group attributes initialization
  - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels
  - RISC-V: Remove unnecessary include from compat.h
  - hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active()
  - hrtimer: Remove unused function
  - regulator: sy7636a: fix lifecycle of power good gpio
  - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map
  - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr
  - hsr: use rtnl lock when iterating over ports
  - net: hsr: Add VLAN CTAG filter support
  - net: hsr: Add support for MC filtering at the slave device
  - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB
  - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails
  - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed
  - igb: fix link test skipping when interface is admin down
  - docs: networking: can: change bcm_msg_head frames member to support flexible array
  - tunnels: reset the GSO metadata before reusing the skb
  - net: bridge: Bounce invalid boolopts
  - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable()
  - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions
  - USB: serial: option: add Telit Cinterion FN990A w/audio compositions
  - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks
  - serial: sc16is7xx: fix bug in flow control levels init
  - tty: hvc_console: Call hvc_kick in hvc_write unconditionally
  - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups"
  - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table
  - Input: iqs7222 - avoid enabling unused interrupts
  - mm/khugepaged: fix the address passed to notifier on testing young
  - btrfs: fix corruption reading compressed range when block size is smaller than page size
  - btrfs: use readahead_expand() on compressed extents
  - mm/damon/sysfs: fix use-after-free in state_show()
  - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing
  - mtd: nand: raw: atmel: Fix comment in timings preparation
  - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages
  - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time
  - mm/damon/core: set quota->charged_from to jiffies at first charge window
  - fuse: prevent overflow in copy_file_range return value
  - fuse: check if copy_file_range() returns larger than requested size
  - mtd: rawnand: stm32_fmc2: fix ECC overwrite
  - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer
  - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups
  - i2c: i801: Hide Intel Birch Stream SoC TCO WDT
  - ocfs2: fix recursive semaphore deadlock in fiemap call
  - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN
  - compiler-clang.h: define __SANITIZE_*__ macros only when undefined
  - EDAC/altera: Delete an inappropriate dma_free_coherent() call
  - rcu-tasks: Maintain real-time response in rcu_tasks_postscan()
  - rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks
  - rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks
  - s390/cpum_cf: Deny all sampling events by counter PMU
  - NFSv4/flexfiles: Fix layout merge mirror check.
  - NFSv4.2: Serialise O_DIRECT i/o and copy range
  - NFSv4.2: Serialise O_DIRECT i/o and clone range
  - NFSv4.2: Serialise O_DIRECT i/o and fallocate()
  - NFS: Serialise O_DIRECT i/o and truncate()
  - fs/nfs/io: make nfs_start_io_*() killable
  - ftrace/samples: Fix function size computation
  - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server
  - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set
  - media: i2c: imx214: Fix link frequency validation
  - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs()
  - nfsd: Fix a regression in nfsd_setattr()
  - kasan: fix GCC mem-intrinsic prefix with sw tags
  - kunit: kasan_test: disable fortify string checker on kasan_strings() test
  - io_uring: fix kabi broken in struct io_ring_ctx
  - io_uring: Support forcing sq thread to be idle and woken up by hrtimer
  - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()
  - uacce: fix isolate sysfs check condition
  - Revert "uacce: fix isolate sysfs check condition"
  - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()
  - smb/server: fix refcount leak in smb2_open()
  - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe()
  - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection()
  - md: suspend array while updating raid_disks via sysfs
  - scsi: core: Wake up the error handler when final completions race against each other
  - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec
  - ub:ubfi: Release the chosen node
  - ub:ubus: Delete unused functions
  - Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption


author: Li Nan <linan122@huawei.com> - 6.6.0-142.0.0.136
changelog:
  - !21194 hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise.
  - !21192 urma: bugfix of ubagg&ubcore&uburma
  - !21183  platform/x86: classmate-laptop: Add missing NULL pointer checks
  - urma: bugfix of ubagg&ubcore&uburma
  - hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise.
  - platform/x86: classmate-laptop: Add missing NULL pointer checks
  - !21167 urma: fix kernel codecheck issues.
  - !21174 urma: change return value for provider err
  - !21127 urma: copy linked ports when importing bond jetty/seg
  - !20247 ubcore: query primary eid in ipourma loopback mode.
  - !21077 Fix hisi cca bugs
  - ubcore: route query refine and ipo loopback adapt.
  - hisi-cca-da: Transfer PCIe ECAM access requests to RMM for realm device.
  - hisi-cca-da: Write NS STE for PF drivers.
  - hisi-cca-da: Provide IO interfaces
  - hisi-cca-da: Destroy mmu stage2 pagetable after closing vfio devices
  - !21045  scsi: hisi_sas: Fix NULL pointer exception when do user_scan()
  - hisi-cca-da: Automatically unbind PF/VF drivers and prevent probe.
  - !21165  tools/interference: add ifstool utility for kernel interference statistics
  - !21166 urma: fix jfce uaf in batch cleanup
  - !21043 urma: fix tjetty ref in ping server
  - urma: change return value for provider err
  - !21128  sched/rt: Skip currently executing CPU in rto_next_cpu()
  - !21129  procfs: fix missing RCU protection when reading real_parent in do_task_stat()
  - urma: fix jfce uaf in batch cleanup
  - !21074 ipmi: Add HiSilicon IPMI Page Soft Offline driver
  - !21076 [OLK-6.6][linux-6.6.y sync] Backport 6.6.112-6.6.113 LTS Patches
  - urma: fix kernel codecheck issues.
  - tools/interference: add ifstool utility for kernel interference statistics
  - !20291 [Hygon][6.6][Bugfix] Bug fix for EDAC decode address fail issue on Hygon Dhyana processor
  - !21092  kexec: derive purgatory entry from symbol
  - !21154  sched: Add SOFT_DOMAIN feature interface for cgroup2
  - !21153  fix CVE-2025-39981
  - Revert "hisi-cca-da: Delay realm memory release to kvm_destroy_realm"
  - urma: fix tjetty ref in ping server
  - rme: Enforce isolation to solve compile error without config CONFIG_HISI_CCA
  - hisi-cca-da: Improve hisi cca dev validate and delegate
  - hisi-cca-da: Fix smmu enable rme problem
  - hisi-cca-da: Fix msi region shared problem
  - sched: Add SOFT_DOMAIN feature interface for cgroup2
  - Bluetooth: MGMT: Fix memory leak in set_ssp_complete
  - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete
  - overflow: Introduce __DEFINE_FLEX for having no initializer
  - overflow: Fix direct struct member initialization in _DEFINE_FLEX()
  - overflow: Change DEFINE_FLEX to take __counted_by member
  - overflow: add DEFINE_FLEX() for on-stack allocs
  - Bluetooth: MGMT: Fix possible UAFs
  - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete()
  - !21103  Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()"
  - !21104 v2  vsock/virtio: cap TX credit to local buffer size
  - !21070  Fixes CVE-2026-23100
  - !21135 RDMA/hns: Support configure and query the CNP DSCP through sysfs
  - !21088  ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref
  - RDMA/hns: Support configure and query the CNP DSCP through sysfs
  - RDMA/hns: Support query FW cap bit
  - RDMA/hns: Support query HW ID.
  - !20934  smb/server: fix refcount leak in parse_durable_handle_context()
  - !21004  regmap: Fix race condition in hwspinlock irqsave routine
  - !19568 [OLK-6.6]fix txgbe clang compile warning
  - urma: copy linked ports when importing bond jetty/seg
  - procfs: fix missing RCU protection when reading real_parent in do_task_stat()
  - sched/rt: Skip currently executing CPU in rto_next_cpu()
  - !21073  scsi: qla2xxx: Fix bsg_done() causing double free
  - !21114  CVE-2024-57979
  - !21113  iommu: disable SVA when CONFIG_X86 is set
  - !20957  dmaengine: xilinx: xdma: Fix regmap max_register
  - !21087 net: unic: Multiple stability fixes for tx timeout, DFX capability and concurrent activation/reset
  - pps: Fix a use-after-free - fix kabi
  - pps: Fix a use-after-free
  - !21078  of: unittest: Fix memory leak in unittest_data_add()
  - !21079  *** fix CVE-2026-23208 ***
  - !21082  ALSA: aloop: Fix racy access at PCM trigger
  - !21083  bus: fsl-mc: fix use-after-free in driver_override_show()
  - iommu: disable SVA when CONFIG_X86 is set
  - vsock/virtio: cap TX credit to local buffer size
  - Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()"
  - !20983 Fix CVE-2026-23139
  - !20878 Fix CVE-2026-23230
  - kexec: derive purgatory entry from symbol
  - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC
  - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug
  - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV"
  - rtc: interface: Alarm race handling should not discard preceding error
  - perf test stat tests: Fix for virtualized machines
  - perf test stat: Update test expectations and events
  - perf test stat: Avoid hybrid assumption when virtualized
  - writeback: Avoid excessively long inode switching times
  - writeback: Avoid softlockup when switching many inodes
  - cramfs: Verify inode mode when loading from disk
  - fs: Add 'initramfs_options' to set initramfs mount options
  - minixfs: Verify inode mode when loading from disk
  - irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume
  - irqchip/sifive-plic: Make use of __assign_bit()
  - selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled
  - s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG
  - s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL
  - s390/bpf: Describe the frame using a struct instead of constants
  - s390/bpf: Centralize frame offset calculations
  - s390/bpf: Change seen_reg to a mask
  - ACPI: property: Do not pass NULL handles to acpi_attach_data()
  - ACPI: property: Add code comments explaining what is going on
  - ACPI: property: Disregard references in data-only subnode lists
  - ACPI: battery: Add synchronization between interface updates
  - ACPI: battery: Check for error code from devm_mutex_init() call
  - ACPI: battery: initialize mutexes through devm_ APIs
  - ACPI: battery: allocate driver data through devm_ APIs
  - arm64: mte: Do not flag the zero page as PG_mte_tagged
  - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref
  - !20790  dm: use bio_clone_blkg_association
  - ipmi: Add HiSilicon IPMI Page Soft Offline driver
  - net: unic: Resolve network unavailability caused by concurrent activation and reset
  - net: unic: Provide the DFX capability for querying MNG table
  - net: unic: Delete the elr reset process after the tx timeout
  - bus: fsl-mc: fix use-after-free in driver_override_show()
  - ALSA: aloop: Fix racy access at PCM trigger
  - ALSA: usb-audio: Use the right limit for PCM OOB check
  - ALSA: usb-audio: Prevent excessive number of frames
  - of: unittest: Fix memory leak in unittest_data_add()
  - !21034  CVE-2026-23140
  - !21016  net: fix segmentation of forwarding fraglist GRO
  - !21017  mptcp: fix race in mptcp_pm_nl_flush_addrs_doit()
  - !21018  CVE-2026-23209
  - !21019  ipv6: annotate data-race in ndisc_router_discovery()
  - !20881  ipvlan: Make the addrs_lock be per port
  - rme: Imporve range delegate
  - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range()
  - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release
  - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan()
  - misc: fastrpc: Save actual DMA size in fastrpc_map structure
  - misc: fastrpc: Add missing dev_err newlines
  - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag
  - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type
  - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value
  - media: mc: Clear minor number before put device
  - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older
  - ACPICA: Allow to skip Global Lock initialization
  - ext4: validate ea_ino and size in check_xattrs
  - ext4: correctly handle queries for metadata mappings
  - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch()
  - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry
  - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul()
  - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success
  - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0
  - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations
  - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500
  - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again
  - selftests: mptcp: join: validate C-flag + def limit
  - spi: cadence-quadspi: Flush posted register writes before DAC access
  - spi: cadence-quadspi: Flush posted register writes before INDAC access
  - PCI: tegra194: Handle errors in BPMP response
  - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq()
  - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock
  - PCI: rcar-host: Drop PMSR spinlock
  - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit
  - PCI/AER: Support errors introduced by PCIe r6.0
  - PCI/AER: Fix missing uevent on recovery when a reset is requested
  - PCI/ERR: Fix uevent on failure to recover
  - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV
  - PCI/sysfs: Ensure devices are powered for config reads
  - PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock
  - rseq/selftests: Use weak symbol reference, not definition, to link with glibc
  - rtc: interface: Fix long-standing race when setting alarm
  - rtc: interface: Ensure alarm irq is enabled when UIE is enabled
  - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe
  - mmc: core: SPI mode remove cmd7
  - mtd: rawnand: fsmc: Default to autodetect buswidth
  - xtensa: simdisk: add input size check in proc_write_simdisk
  - sparc: fix error handling in scan_one_device()
  - sparc64: fix hugetlb for sun4u
  - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl()
  - sched/deadline: Fix race in push_dl_task()
  - pwm: berlin: Fix wrong register in suspend/resume
  - powerpc/pseries/msi: Fix potential underflow and leak issue
  - powerpc/powernv/pci: Fix underflow and leak issue
  - power: supply: max77976_charger: fix constant current reporting
  - pinctrl: samsung: Drop unused S3C24xx driver data
  - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk
  - parisc: don't reference obsolete termio struct for TC* constants
  - openat2: don't trigger automounts with RESOLVE_NO_XDEV
  - of: unittest: Fix device reference count leak in of_unittest_pci_node_verify
  - lib/genalloc: fix device leak in of_gen_pool_get()
  - KEYS: trusted_tpm1: Compare HMAC values in constant time
  - iommu/vt-d: PRS isn't usable if PDS isn't supported
  - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume
  - init: handle bootloader identifier in kernel parameters
  - iio: xilinx-ams: Unmask interrupts after updating alarms
  - iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK
  - iio: frequency: adf4350: Fix prescaler usage.
  - iio: dac: ad5421: use int type to store negative error codes
  - iio: dac: ad5360: use int type to store negative error codes
  - fs/ntfs3: Fix a resource leak bug in wnd_extend()
  - fbdev: Fix logic error in "offb" name match
  - crypto: rockchip - Fix dma_unmap_sg() nents value
  - crypto: atmel - Fix dma_unmap_sg() direction
  - crypto: aspeed - Fix dma_unmap_sg() direction
  - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64)
  - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup()
  - bus: mhi: ep: Fix chained transfer handling in read path
  - btrfs: avoid potential out-of-bounds in btrfs_encode_fh()
  - blk-crypto: fix missing blktrace bio split events
  - drm/nouveau: fix bad ret code in nouveau_bo_move_prep
  - drm/rcar-du: dsi: Fix 1/2/3 lane support
  - media: lirc: Fix error handling in lirc_register()
  - media: venus: firmware: Use correct reset sequence for IRIS2
  - media: pci: ivtv: Add missing check after DMA map
  - media: mc: Fix MUST_CONNECT handling for pads with no links
  - media: i2c: mt9v111: fix incorrect type for ret
  - media: cx18: Add missing check after DMA map
  - firmware: meson_sm: fix device leak at probe
  - xen/events: Update virq_to_irq on migration
  - xen/events: Return -EEXIST for bound VIRQs
  - xen/manage: Fix suspend error path
  - xen/events: Cleanup find_virq() return codes
  - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required
  - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init
  - arm64: dts: ti: k3-am62a-main: Fix main padcfg length
  - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees
  - arm64: dts: qcom: msm8939: Add missing MDSS reset
  - arm64: dts: qcom: msm8916: Add missing MDSS reset
  - ACPI: debug: fix signedness issues in read/write helpers
  - ACPI: property: Fix buffer properties extraction for subnodes
  - gpio: wcd934x: mark the GPIO controller as sleeping
  - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single
  - smb: client: fix missing timestamp updates after utime(2)
  - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu()
  - drm/amd/display: Properly disable scaling on DCE6
  - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6
  - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs
  - drm/amdgpu: Add additional DCE6 SCL registers
  - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes
  - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call
  - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat()
  - perf python: split Clang options when invoking Popen
  - tools build: Align warning options with perf
  - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe
  - drm/vmwgfx: Fix copy-paste typo in validation
  - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
  - LoongArch: Init acpi_gbl_use_global_lock to false
  - LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init()
  - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size
  - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
  - clk: tegra: do not overallocate memory for bpmp clocks
  - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver
  - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate()
  - clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags()
  - clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m
  - perf evsel: Ensure the fallback message is always written to
  - perf tools: Add fallback for exclude_guest
  - perf test: Add a test for default perf stat command
  - perf test: Don't leak workload gopipe in PERF_RECORD_*
  - perf session: Fix handling when buffer exceeds 2 GiB
  - perf arm_spe: Correct memory level for remote access
  - perf arm_spe: Correct setting remote access
  - rtc: optee: fix memory leak on driver removal
  - rtc: x1205: Fix Xicor X1205 vendor prefix
  - perf util: Fix compression checks returning -1 as bool
  - clk: at91: peripheral: fix return value
  - libperf event: Ensure tracing data is multiple of 8 sized
  - perf evsel: Avoid container_of on a NULL leader
  - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled
  - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE
  - clocksource/drivers/clps711x: Fix resource leaks in error paths
  - fscontext: do not consume log entries when returning -EMSGSIZE
  - fs: always return zero on success from replace_fd()
  - !21067 [OLK-6.6][linux-6.6.y sync] Backport 6.6.111-6.6.112 LTS Patches
  - scsi: qla2xxx: Fix bsg_done() causing double free
  - !21065 Fix CVE-2026-23069
  - !21062 v4  Support multi-level cgroup
  - !20987 Fix CVE-2026-23212
  - !20982 Fix CVE-2026-23119
  - !20979 Fix CVE-2026-23111
  - !20974 Fix CVE-2026-23099
  - !20973 Fix CVE-2026-23105
  - !20972 Fix CVE-2026-23074
  - !20884  ksmbd: add chann_lock to protect ksmbd_chann_list xarray
  - !20947 Fix CVE-2026-23101
  - ext4: clear i_state_flags when alloc inode
  - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup
  - Revert "wifi: ath10k: avoid unnecessary wait for service ready message"
  - fs/ntfs3: fix mount failure for sparse runs in run_unpack()
  - !20825  efivarfs: fix error propagation in efivar_entry_get()
  - !20824  io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop
  - !20950 ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem
  - mm/rmap: fix two comments related to huge_pmd_unshare()
  - mm/hugetlb: fix two comments related to huge_pmd_unshare()
  - mm/hugetlb: fix hugetlb_pmd_shared()
  - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count
  - !20728 drivers: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers
  - vsock/virtio: fix potential underflow in virtio_transport_get_credit()
  - !21001 Fix CVE-2026-23229
  - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call
  - arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode
  - !20999 Fix CVE-2026-23173
  - usb: typec: tipd: Clear interrupts first
  - bus: fsl-mc: Check return value of platform_get_resource()
  - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable()
  - Input: atmel_mxt_ts - allow reset GPIO to sleep
  - misc: fastrpc: Skip reference for DMA handles
  - misc: fastrpc: fix possible map leak in fastrpc_put_args
  - misc: fastrpc: Fix fastrpc_map_lookup operation
  - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe()
  - ext4: fix checks for orphan inodes
  - ksmbd: fix error code overwriting in smb2_get_info_filesystem()
  - LoongArch: Automatically disable kaslr if boot from kexec_file
  - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data()
  - mfd: rz-mtu3: Fix MTU5 NFCR register offset
  - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down
  - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()
  - vhost: vringh: Modify the return value check
  - net/mlx5: fw reset, add reset timeout work
  - net/mlx5: pagealloc: Fix reclaim race during command interface teardown
  - net/mlx5: Stop polling for command response if interface goes down
  - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable
  - nfp: fix RSS hash key size when RSS is not supported
  - mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands
  - drivers/base/node: fix double free in register_one_node()
  - hwrng: ks-sa - fix division by zero in ks_sa_rng_init
  - KEYS: X.509: Fix Basic Constraints CA flag parsing
  - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements
  - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO
  - vhost: vringh: Fix copy_to_iter return value check
  - RDMA/siw: Always report immediate post SQ errors
  - usb: vhci-hcd: Prevent suspending virtually attached devices
  - NFSv4.1: fix backchannel max_resp_sz verification check
  - coresight: trbe: Return NULL pointer for allocation failures
  - coresight: etm4x: Support atclk
  - coresight-etm4x: Conditionally access register TRCEXTINSELR
  - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice
  - PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert()
  - vfio/pds: replace bitmap_free with vfree
  - sparc: fix accurate exception reporting in copy_{from,to}_user for M7
  - sparc: fix accurate exception reporting in copy_to_user for Niagara 4
  - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara
  - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III
  - wifi: mac80211: fix Rx packet handling when pubsta information is not available
  - wifi: ath10k: avoid unnecessary wait for service ready message
  - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram
  - IB/sa: Fix sa_local_svc_timeout_ms read race
  - RDMA/core: Resolve MAC of next-hop device without ARP support
  - f2fs: fix zero-sized extent for precache extents
  - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp()
  - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES()
  - scsi: qla2xxx: edif: Fix incorrect sign of error code
  - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message
  - f2fs: fix to truncate first page in error path of f2fs_truncate()
  - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks()
  - wifi: mt76: fix potential memory leak in mt76_wmac_probe()
  - RDMA/cm: Rate limit destroy CM ID timeout error message
  - drivers/base/node: handle error properly in register_one_node()
  - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog
  - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable
  - iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
  - iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed()
  - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist
  - fs: ntfs3: Fix integer overflow in run_unpack()
  - drm/msm/dpu: fix incorrect type for ret
  - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
  - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping
  - misc: genwqe: Fix incorrect cmd field being reported in error
  - usb: gadget: configfs: Correctly set use_os_string at bind
  - usb: phy: twl6030: Fix incorrect type for ret
  - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl()
  - tcp: fix __tcp_close() to only send RST when required
  - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation
  - wifi: mwifiex: send world regulatory domain to driver
  - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3)
  - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2)
  - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3)
  - drm/amd/pm: Adjust si_upload_smc_data register programming (v3)
  - drm/amd/pm: Fix si_upload_smc_data (v3)
  - drm/amd/pm: Disable ULV even if unsupported (v3)
  - drm/amdgpu: Power up UVD 3 for FW validation (v2)
  - coresight: Only register perf symlink for sinks with alloc_buffer
  - inet: ping: check sock_net() in ping_get_port() and ping_lookup()
  - media: st-delta: avoid excessive stack usage
  - ALSA: lx_core: use int type to store negative error codes
  - media: rj54n1cb0c: Fix memleak in rj54n1_probe()
  - scsi: myrs: Fix dma_alloc_coherent() error check
  - hwrng: nomadik - add ARM_AMBA dependency
  - crypto: keembay - Add missing check after sg_nents_for_len()
  - drm/amd/display: Remove redundant semicolons
  - serial: max310x: Add error checking in probe()
  - usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls
  - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup
  - phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568
  - media: zoran: Remove zoran_fh structure
  - drm/bridge: it6505: select REGMAP_I2C
  - f2fs: fix condition in __allow_reserved_blocks()
  - drm/radeon/r600_cs: clean up of dead code in r600_cs
  - drm/panel: novatek-nt35560: Fix invalid return value
  - bpf: Enforce expected_attach_type for tailcall compatibility
  - i2c: designware: Add disabling clocks when probe fails
  - i2c: designware: Fix clock issue when PM is disabled
  - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD
  - thermal/drivers/qcom/lmh: Add missing IRQ includes
  - thermal/drivers/qcom: Make LMH select QCOM_SCM
  - hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems
  - once: fix race by moving DO_ONCE to separate section
  - smp: Fix up and expand the smp_call_function_many() kerneldoc
  - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported
  - i3c: master: svc: Recycle unused IBI slot
  - i3c: master: svc: Use manual response for IBI events
  - ACPICA: Fix largest possible resource descriptor index
  - pwm: tiehrpwm: Fix corner case in clock divisor calculation
  - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible
  - arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value
  - arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names
  - cpuidle: qcom-spm: fix device and OF node leaks at probe
  - firmware: firmware: meson-sm: fix compile-test default
  - arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0
  - null_blk: Fix the description of the cache_size module argument
  - pinctrl: renesas: Use int type to store negative error codes
  - power: supply: cw2015: Fix a alignment coding style issue
  - PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe()
  - ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property
  - ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS
  - ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax
  - block: use int to store blk_stack_limits() return value
  - selftests/nolibc: fix EXPECT_NZ macro
  - regulator: scmi: Use int type to store negative error codes
  - arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map
  - ARM: at91: pm: fix MCKx restore routine
  - pinctrl: meson-gxl: add missing i2c_d pinmux
  - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
  - leds: flash: leds-qcom-flash: Update torch current clamp setting
  - ARM: dts: renesas: porter: Fix CAN pin group
  - libbpf: Fix reuse of DEVMAP
  - bpf: Remove migrate_disable in kprobe_multi_link_prog_run
  - bpf/selftests: Fix test_tcpnotify_user
  - regmap: Remove superfluous check for !config in __regmap_init()
  - arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0
  - x86/vdso: Fix output operand size of RDPID
  - smb: server: fix IRD/ORD negotiation with the client
  - coresight: trbe: Prevent overflow in PERF_IDX2OFF()
  - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote
  - selftests: arm64: Check fread return value in exec_target
  - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast
  - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD
  - filelock: add FL_RECLAIM to show_fl_flags() macro
  - !21022  KVM: Don't clobber irqfd routing type when deassigning irqfd
  - !20998  ceph: fix oops due to invalid pointer for kfree() in parse_longname()
  - !21023  l2tp: avoid one data-race in l2tp_tunnel_del_work()
  - xsched: fix potential NULL dereference in xsched_quota_timeout_update
  - xsched: remove the standalone xcu_cfs_cg_deinit() helper
  - xsched: restructure xcu_cgrp_subsys teardown to align with cpu_cgrp_subsys lifecycle
  - xsched: simplify root group check by direct comparison with root_xcg
  - xsched: replace magic number with SCHED_CLASS_MAX_LENGTH for scheduler class string length
  - xsched/core: immediate cleanup of remaining operators on task exit
  - xsched: add init_fair_xsched_group() for XCU-specific fair group initialization
  - xsched: modify xcu_cg_initialize_components helper
  - xsched: refactor xsched_entity initialization
  - xsched: change rq_init() parameter from struct xsched_cu to struct xsched_rq
  - xsched: harden and clarify xcu_move_task() logic
  - xsched: move throttling-related fields from xsched_group_xcu_priv to xsched_rq_cfs
  - xsched/quota: add throttled flag to cfs_rq for robust hierarchical enqueue under throttling
  - xsched/quota: support multi-level cgroup
  - xsched: remove redundant xcu parameter from dequeue_ctx
  - xsched: update group shares using xcu_grp_shares_add/sub helpers
  - xsched: delete unused code
  - xsched/cfs: propagate group activation/deactivation up the hierarchy
  - xsched/cfs: move xruntime updates to pick/put paths
  - xsched: add has_running hook to xsched classes for wake-up eligibility check
  - !21012 [OLK-6.6][linux-6.6.y sync] Backport 6.6.110-6.6.111 LTS Patches
  - scsi: hisi_sas: Fix NULL pointer exception when do user_scan()
  - !21013  CVE-2026-23177
  - !21007  bonding: fix use-after-free due to enslave fail after slave array update
  - !21006  net: Fix CVE-2026-23204
  - bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path
  - bpf, test_run: Subtract size of xdp_frame from allowed metadata size
  - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN
  - bpf: Make variables in bpf_prog_test_run_xdp less confusing
  - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K
  - !21015  libceph: reset sparse-read state in osd_fault()
  - !21024 ub: udma: bugfix related to print messages.
  - !20980 Fix CVE-2026-23126
  - !20922 Fix CVE-2026-23133
  - ub: udma: bugfix related to print messages.
  - l2tp: avoid one data-race in l2tp_tunnel_del_work()
  - KVM: Don't clobber irqfd routing type when deassigning irqfd
  - ipv6: annotate data-race in ndisc_router_discovery()
  - macvlan: observe an RCU grace period in macvlan_common_newlink() error path
  - macvlan: fix error recovery in macvlan_common_newlink()
  - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit()
  - net: fix segmentation of forwarding fraglist GRO
  - can: rcar_canfd: Fix CAN-FD mode as default
  - libceph: reset sparse-read state in osd_fault()
  - !21008 uvb: fix cis call return value and obtain
  - mm, shmem: prevent infinite loop on truncate race
  - mm/shmem, swap: fix race of truncate and swap entry split
  - net/9p: fix double req put in p9_fd_cancelled
  - riscv: mm: Do not restrict mmap address based on hint
  - riscv: mm: Use hint address in mmap if available
  - driver core/PM: Set power.no_callbacks along with power.no_pm
  - serial: stm32: allow selecting console when the driver is module
  - hid: fix I2C read buffer overflow in raw_event() for mcp2221
  - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free
  - ALSA: usb-audio: Kill timer properly at removal
  - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list
  - can: rcar_canfd: Fix controller mode setting
  - can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled
  - btrfs: ref-verify: handle damaged extent root tree
  - ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue
  - perf subcmd: avoid crash in exclude_cmds when excludes is empty
  - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list
  - dm-integrity: limit MAX_TAG_SIZE to 255
  - ASoC: amd: acp: Adjust pdm gain value
  - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188
  - USB: serial: option: add SIMCom 8230C compositions
  - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe
  - !20931 Fix CVE-2026-23060
  - uvb: fix cis call return value and obtain
  - bonding: fix use-after-free due to enslave fail after slave array update
  - net/sched: cls_u32: use skb_header_pointer_careful()
  - net: add skb_header_pointer_careful() helper
  - regmap: Fix race condition in hwspinlock irqsave routine
  - crypto: virtio - Add spinlock protection with virtqueue notification
  - net/mlx5e: TC, delete flows only for existing peers
  - !20967 net: hns3: modify code of judging if SMMU DMA is enabled
  - ceph: fix oops due to invalid pointer for kfree() in parse_longname()
  - !20969 Fix CVE-2026-23125
  - !20948 v4  arm64: Add memory poison recovery support for various paths
  - !20975  CVE-2026-23102
  - !20977 v4  support apei_page_offline_policy
  - bonding: annotate data-races around slave->last_rx
  - netfilter: nf_conncount: update last_gc only when GC has been performed
  - bonding: provide a net pointer to __skb_flow_dissect()
  - netdevsim: fix a race issue related to the operation on bpf_bound_progs list
  - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()
  - apei/ghes: Add sysctl interface to control soft-offline page isolation
  - Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages"
  - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec
  - arm64/fpsimd: signal: Fix restoration of SVE context
  - arm64/fpsimd: signal: Consistently read FPSIMD context
  - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state
  - bonding: limit BOND_MODE_8023AD to Ethernet devices
  - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag
  - net/sched: Enforce that teql can only be used as root qdisc
  - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT
  - drivers/net: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers
  - net: hns3: modify code of judging if SMMU DMA is enabled
  - dmaengine: xilinx: xdma: Fix regmap max_register
  - ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem
  - ub:ubus: Avoid getting empty uent from ubc
  - ub:hisi-ubus: Use GFP_ATOMIC when alloc memory
  - arm64: send sig fault for user task when apei_claim_sea fails
  - arm64: add ras log during do_sea
  - arm64: move getting valid siaddr to the top of do_sea
  - arm64: mm: shmem: support poison recovery from shmem_file_read_iter()
  - arm64: fs: support poison recovery from __kernel_read()
  - iov_iter: add mc support for copy_page_to_iter
  - arm64: mm: support recovery from copy_{from/to}_user_page()
  - iov_iter: get rid of 'copy_mc' flag
  - leds: led-class: Only Add LED to leds_list when it is fully ready
  - wifi: ath10k: fix dma_free_coherent() pointer
  - smb/server: fix refcount leak in parse_durable_handle_context()
  - ksmbd: add chann_lock to protect ksmbd_chann_list xarray
  - ipvlan: Make the addrs_lock be per port
  - smb: client: split cached_fid bitfields to avoid shared-byte RMW races
  - efivarfs: fix error propagation in efivar_entry_get()
  - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop
  - dm: use bio_clone_blkg_association
  - RAS/AMD/ATL: fix error nodes per socket on for Hygon Dhyana processor
  - net: txgbe: fix clang compile warning


author: Li Nan <linan122@huawei.com> - 6.6.0-143.0.0.137
changelog:
  - !21258 ub:hisi-ubus: Review of Readability Modifications
  - !21293 urma: update urma_admin agg expose flag
  - urma: update urma_admin agg expose
  - !21227 [OLK-6.6][linux-6.6.y sync] Backport 6.6.114-6.6.115 LTS Patches
  - !21270  l2tp: fix double dst_release() on sk_dst_cache race
  - !21272  mptcp: fix soft lockup in mptcp_recvmsg()
  - !20994 urma: support comm endpoint
  - !21245 urma: support non-root execute 'urma_ping' and 'urma_admin show topo'
  - !21271 urma: fix useless copy_logic_device and use expose instead.
  - urma: support non-root execute in containers
  - urma: fix useless copy_logic_device and use expose instead.
  - ub:hisi-ubus: Review of Readability Modifications
  - mptcp: fix soft lockup in mptcp_recvmsg()
  - mptcp: fix MSG_PEEK stream corruption
  - l2tp: fix double dst_release() on sk_dst_cache race
  - urma: update urma_admin agg expose
  - !21252  arm64: Set __nocfi on swsusp_arch_resume()
  - !21226 hisi-cca-da: Fix potential data overflow.
  - !19706 [OLK-6.6]:update patches for sw64 architecture
  - !21253  xattr: switch to CLASS(fd)
  - !21255 ub: cdma: cdma bug fix
  - !21241 net/ipv4:scmtcp: fix soft lockup caused by spin_lock in soft irq
  - ub: cdma: cdma bug fix
  - xattr: switch to CLASS(fd)
  - arm64: Set __nocfi on swsusp_arch_resume()
  - hisi-cca-da: Fix error where multiple devices share the same SMMU domain.
  - net/ipv4:scmtcp: fix soft lockup caused by spin_lock in soft irq
  - net/ipv4:scmtcp: fix panic caused by file_htable_del_flist
  - !21237 urma: change warn log into info for topo query
  - hisi-cca-da: Fix potential data overflow.
  - !21210 urma: fix tjetty tp type in ping server
  - !21224  arm64/mpam: Fix warning of schedule state in resctrl_arch_mon_ctx_alloc()
  - !21240 urma: update urma_admin agg expose
  - !21042 net/ipv4: introduce IPPROTO_SCMTCP for SCM_RIGHTS
  - urma: update urma_admin agg expose
  - net/ipv4: introduce IPPROTO_SCMTCP for SCM_RIGHTS
  - !21238 urma: delete ubcm_genl implementation
  - urma: delete ubcm_genl implementation
  - urma: change warn log into info for topo query
  - tcpm: allow looking for role_sw device in the main node
  - usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE
  - most: usb: fix double free on late probe failure
  - arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation
  - net: enetc: fix build warning when PAGE_SIZE is greater than 128K
  - gpio: ljca: Initialize num before accessing item in ljca_gpio_config
  - s390/cio: Update purge function to unregister the unused subchannels
  - x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID
  - xfs: always warn about deprecated mount options
  - devcoredump: Fix circular locking dependency with devcd->mutex.
  - serial: 8250_mtk: Enable baud clock and manage in runtime PM
  - serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018
  - serial: 8250_dw: handle reset control deassert error
  - dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp
  - tcpm: switch check for role_sw device with fw_node
  - most: usb: hdm_probe: Fix calling put_device() before device initialization
  - most: usb: Fix use-after-free in hdm_disconnect
  - mei: me: add wildcat lake P DID
  - comedi: fix divide-by-zero in comedi_buf_munge()
  - binder: remove "invalid inc weak" check
  - x86/microcode: Fix Entrysign revision check for Zen1/Naples
  - xhci: dbc: enable back DbC in resume if it was enabled before suspend
  - usb: raw-gadget: do not limit transfer length
  - usb/core/quirks: Add Huawei ME906S to wakeup quirk
  - USB: serial: option: add Telit FN920C04 ECM compositions
  - USB: serial: option: add Quectel RG255C
  - USB: serial: option: add UNISOC UIS7720
  - sched: Remove never used code in mm_cid_get()
  - io_uring: correct __must_hold annotation in io_install_fixed_file
  - gpio: ljca: Fix duplicated IRQ mapping
  - gpio: update Intel LJCA USB GPIO driver
  - hwmon: (sht3x) Fix error handling
  - RISC-V: Don't print details of CPUs disabled in DT
  - RISC-V: Define pgprot_dmacoherent() for non-coherent devices
  - firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode
  - spi: spi-nxp-fspi: add extra delay after dll locked
  - selftests: mptcp: join: mark implicit tests as skipped if not supported
  - selftests: mptcp: join: mark 'flush re-add' as skipped if not supported
  - net: ravb: Ensure memory write completes before ringing TX doorbell
  - net: ravb: Enforce descriptor type ordering
  - net: usb: rtl8150: Fix frame padding
  - net: stmmac: dwmac-rk: Fix disabling set_clock_selection
  - ocfs2: clear extent cache after moving/defragmenting extents
  - MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering
  - cifs: Fix TCP_Server_Info::credits to be signed
  - gpio: 104-idio-16: Define maximum valid register address offset
  - gpio: pci-idio-16: Define maximum valid register address offset
  - dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC
  - net: bonding: fix possible peer notify event loss or dup issue
  - arm64, mm: avoid always making PTE dirty in pte_mkwrite()
  - !21236  Fix TLBI broadcast optimization loss and incorrect dvmbm handling
  - KVM: arm64: Fix CCA guest panic when dvmbm is enabled
  - !21228 ub:ubus: add reset function
  - !21220  selftests/bpf: Add cross-build support for urandom_read et al
  - !21214  optimize lightweight load balancing
  - ub:ubus: add reset function
  - !21218 ub_fwctl modifies the interception and concurrency verification of commands in different scenarios
  - !21221 iommu/ummu: Modify the ummu/tid permission
  - selftests: net: fix server bind failure in sctp_vrf.sh
  - selftests/net: convert sctp_vrf.sh to run it in unique namespace
  - can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb()
  - dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path
  - net: enetc: correct the value of ENETC_RXB_TRUESIZE
  - net: enetc: fix the deadlock of enetc_mdio_lock
  - net: Tree wide: Replace xdp_do_flush_map() with xdp_do_flush().
  - rtnetlink: Allow deleting FDB entries in user namespace
  - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size()
  - Unbreak 'make tools/*' for user-space targets
  - smb: server: let smb_direct_flush_send_list() invalidate a remote key first
  - powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure
  - m68k: bitops: Fix find_*_bit() signatures
  - lkdtm: fortify: Fix potential NULL dereference on kmalloc failure
  - hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super()
  - hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits()
  - dlm: check for defined force value in dlm_lockspace_release
  - hfs: validate record offset in hfsplus_bmap_alloc
  - hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent()
  - hfs: make proper initalization of struct hfs_find_data
  - hfs: clear offset and space out of valid records in b-tree node
  - nios2: ensure that memblock.current_limit is set when setting pfn limits
  - exec: Fix incorrect type for ret
  - !21222 ub: ubase: Added the interface for obtaining hardware version information
  - !21175 iommu/ummu: Optimize ummu register compatibility ubmem processing
  - !21216  Fix RT priority Setting
  - arm64/mpam: Fix warning of schedule state in resctrl_arch_mon_ctx_alloc()
  - iommu/ummu: Modify the ummu/tid permission
  - ub: ubase&unic: Optimize the code for log information
  - ub: ubase: Solve The out-of-bounds problem of accessing a variable of the u16 type through unsigned long
  - ub: ubase: Fix the issue where the himac reset cannot be triggered during an elr reset
  - ub:ub_fwctl:Add a mutex lock
  - ub:ub_fwctl:Add interception and validation for unsupported environment commands
  - ub: ubase: Added the interface for obtaining hardware version information.
  - selftests/bpf: Add cross-build support for urandom_read et al
  - !21217  Revert "drivers: core: synchronize really_probe() and dev_uevent()"
  - !21205  arm64/mpam: Fix wrong closid config access when CDP is enabled
  - !21169 [OLK-6.6][linux-6.6.y sync] Backport 6.6.113-6.6.114 LTS Patches
  - Revert "drivers: core: synchronize really_probe() and dev_uevent()"
  - !21213 ub:ubus: alter nl ssu credit ras recover
  - iommu/ummu: Optimize the duplicate code
  - xsched: initialize tgid before configuring RT priority
  - xsched: fix typo in xcu cgroup subsys released callback name
  - xsched: refactor xse_this_grp_xcu to xse_this_cfs_rq for clarity and correctness
  - sched: expand sysctl_sched_features to unsigned long
  - sched: Fix kabi breakage of struct sched_domain for newidle_stats
  - sched/fair: Proportional newidle balance
  - ub:ubus: alter nl ssu credit ras recover
  - ub:ubus add some missing code to openeuler
  - change bus instance create EID_BYPASS
  - urma: fix tjetty tp type in ping server
  - iommu/ummu: Optimize the definition of 'hisi_ummu_tdev_info'
  - iommu/ummu: Delete the unused interface of the UMMU
  - arm64/mpam: Fix wrong closid config access when CDP is enabled
  - Revert "fs/resctrl: Fix configuration to wrong control group when CDP is enabled"
  - iommu/ummu: Remove the constraint that l_tid must be valid
  - iommu/ummu: Remove redundant read register operations
  - iommu/ummu: Optimize the UMMU instance matching logic
  - iommu/ummu: Improve the reliability of ummu initialization
  - iommu/ummu: Modify parameter for separated page table
  - drm/amd: Fix suspend failure with secure display TA
  - PCI: tegra194: Reset BARs when running in PCIe endpoint mode
  - PCI: j721e: Fix programming sequence of "strap" settings
  - PCI: j721e: Enable ACSPCIE Refclk if "ti,syscon-acspcie-proxy-ctrl" exists
  - ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL
  - PCI/sysfs: Ensure devices are powered for config reads (part 2)
  - nfsd: decouple the xprtsec policy check from check_nfsd_access()
  - phy: cadence: cdns-dphy: Update calibration wait time for startup state machine
  - xfs: use deferred intent items for reaping crosslinked blocks
  - iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended
  - iio: imu: inv_icm42600: reorganize DMA aligned buffers in structure
  - phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling
  - phy: cdns-dphy: Store hs_clk_rate and return it
  - iio: imu: inv_icm42600: Simplify pm_runtime setup
  - PM: runtime: Add new devm functions
  - xfs: fix log CRC mismatches between i386 and other architectures
  - xfs: rename the old_crc variable in xlog_recover_process
  - NFSD: Fix last write offset handling in layoutcommit
  - NFSD: Minor cleanup in layoutcommit processing
  - NFSD: Rework encoding and decoding of nfsd4_deviceid
  - nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs()
  - block: fix race between set_blocksize and read paths
  - arm64: errata: Apply workarounds for Neoverse-V3AE
  - arm64: cputype: Add Neoverse-V3AE definitions
  - selftests: arg_parsing: Ensure data is flushed to disk before reading.
  - HID: multitouch: fix name of Stylus input devices
  - HID: hid-input: only ignore 0 battery events for digitizers
  - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card
  - selftests/bpf: make arg_parsing.c more robust to crashes
  - ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings
  - drm/rockchip: vop2: use correct destination rectangle height check
  - drm/amd/powerplay: Fix CIK shutdown temperature
  - drm/i915/guc: Skip communication warning on reset in progress
  - ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit
  - ASoC: nau8821: Generalize helper to clear IRQ status
  - ASoC: nau8821: Cancel jdet_work before handling jack ejection
  - ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec
  - drm/bridge: lt9211: Drop check for last nibble of version register
  - riscv: kprobes: Fix probe address validation
  - nvme-multipath: Skip nr_active increments in RETRY disposition
  - net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset
  - net: usb: lan78xx: Add error handling to lan78xx_init_mac_address
  - tls: don't rely on tx_work during send()
  - tls: always set record_type in tls_process_cmsg
  - tls: wait for async encrypt in case of error during latter iterations of sendmsg
  - net: tls: wait for async completion on last message
  - tls: trim encrypted message to match the plaintext on short splice
  - tg3: prevent use of uninitialized remote_adv and local_adv variables
  - tcp: fix tcp_tso_should_defer() vs large RTT
  - amd-xgbe: Avoid spurious link down messages during interface toggle
  - r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H
  - doc: fix seg6_flowlabel path
  - net: dlink: handle dma_map_single() failure properly
  - can: m_can: m_can_plat_remove(): add missing pm_runtime_disable()
  - dax: skip read lock assertion for read-only filesystems
  - HID: multitouch: fix sticky fingers
  - usb: gadget: f_rndis: Refactor bind path to use __free()
  - usb: gadget: f_ncm: Refactor bind path to use __free()
  - usb: gadget: f_acm: Refactor bind path to use __free()
  - usb: gadget: f_ecm: Refactor bind path to use __free()
  - usb: gadget: Introduce free_usb_request helper
  - usb: gadget: Store endpoint pointer in usb_request
  - media: nxp: imx8-isi: m2m: Fix streaming cleanup on release
  - media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain()
  - drm/exynos: exynos7_drm_decon: remove ctx->suspended
  - drm/exynos: exynos7_drm_decon: properly clear channels during bind
  - drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions
  - drm/msm/a6xx: Fix PDC sleep sequence
  - drm/msm/adreno: De-spaghettify the use of memory barriers
  - eventpoll: Replace rwlock with spinlock
  - epoll: Remove ep_scan_ready_list() in comments
  - Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1
  - cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay
  - drm/amd: Check whether secure display TA loaded successfully
  - drm/amdgpu: use atomic functions with memory barriers for vm fault info
  - cifs: parse_dfs_referrals: prevent oob on malformed input
  - can: gs_usb: increase max interface to U8_MAX
  - can: gs_usb: gs_make_candev(): populate net_device->dev_port
  - btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running
  - ext4: wait for ongoing I/O to complete before freeing blocks
  - jbd2: ensure that all ongoing I/O complete before freeing blocks
  - f2fs: fix wrong block mapping for multi-devices
  - r8152: add error handling in rtl8152_driver_init
  - sw64: ebpf: port arch_prepare_bpf_trampoline()
  - sw64: fix random mmap base range
  - sw64: paravirt: add pv steal_time support in guest side
  - sw64: kvm: add pv steal time support
  - sw64: pci: remove redundant debug control


author: Li Nan <linan122@huawei.com> - 6.6.0-144.0.0.139
changelog:
  - !21367 ub: udma: bugfix related to jfr id.
  - !21356 ub: ubase: Improving the reliability of CtrlQ and fasten reboot
  - !21357 urma: fix add obj type compile error
  - ub: udma: bugfix related to jfr id.
  - urma: fix add obj type compile error
  - ub: ubase: optimized reboot time required
  - !21350 urma: add obj type in ubcore delete uobj error
  - !21343 urma: support ubp methods
  - !21351  arm64: fix compile error if CONFIG_ARCH_HAS_COPY_MC not enabled
  - urma: support ubp methods;
  - !21320 urma: decrease session creation max timeout
  - !21323 urma: tp reuse in RC transmode
  - !21319 urma: remove legacy bonding dev create/delete
  - !21342 iommu/ummu: Optimize resource management and eliminate redundant interfaces
  - ub: ubase: Improving the reliability of CtrlQ.
  - arm64: fix compile error if CONFIG_ARCH_HAS_COPY_MC not enabled
  - urma: add obj type in ubcore delete uobj error
  - urma: Kernel-mode file for tp reuse in RC transmode
  - iommu/ummu-core: Delete the redundant fields of struct ummu_mpam.
  - ub:ubfi: Delete device load debug logs
  - iommu/ummu-core: Fix kref imbalance in VMA split scenario
  - iommu/ummu-core: Prevent FREE_TID while mmap is active
  - iommu/ummu: Add deprecation markers for ummu SVA APIs
  - !21324 mfs: fix mfsd_prefetch.cpp compile error
  - !21303 net/ipv4:scmtcp: fix scmtcp_sk_recvmsg() return incorrect fds due to RLIMIT_NOFILE
  - !20936 gmem: fix several issues
  - !21267 drivers/ub/sentry: set the priority to prevent machine being hung up when the load is heavy
  - !21333 v4  hugetlb: drain pcp for movable zone before alloc
  - drivers/ub/sentry: set the priority
  - hugetlb: drain pcp for movable zone before alloc
  - !21325  mm/hugetlb: fix memory offline failure due to hwpoisoned file hugetlb
  - gmem: only create vma->vm_obj when peer_va_alloc_fixed return true
  - gmem: check vma->vm_obj in vm_object_split to avoid NULL ptr deference
  - gmem: hold mmap_read lock while executing gmem_unmap_region
  - gmem: Fix a potential double free in exit_mm() by reordering the intialization of mm->gm_as in dup_mm()
  - gmem: fix hmemcpy src/dest conflict deadlock under concurrency
  - gmem: fix NULL ptr deference in vm_object_merge
  - mm/hugetlb: fix memory offline failure due to hwpoisoned file hugetlb
  - mfs: fix mfsd_prefetch.cpp compile error
  - !21310 CCA: Add the RSI interface for obtaining the device certificate.
  - urma: remove legacy bonding dev create/delete
  - urma: Decrease session creation max timeout
  - !21316 ub: udma: Move the request for RC context from UDMA to UBASE
  - net/ipv4:scmtcp: fix scmtcp_sk_recvmsg() return incorrect fds due to RLIMIT_NOFILE
  - ub: ubase: Move the request for RC context from UDMA to UBASE
  - !19936 [Intel-SIG]: sched/topology: Fix sched domain build error for GNR, CWF in SNC-3 mode
  - !21302 [OLK-6.6]:update patches for sw64 architecture
  - ub: udma: bugfix related to deactivate tp.
  - ub: udma: bugfix related to jetty group.
  - !21311  mm/shrinker: Implementation of register_shrinker() and unregister_shrinker()
  - !21312 urma: support remove ubagg & uburma ko
  - !21223 kvm: add skip vmovp feature support
  - CCA: Add the RSI interface for obtaining the device certificate.
  - urma: support remove ubagg & uburma ko
  - KVM: arm64: vgic-v4: Elide VMOVP on vCPU scheduling within same affinity group
  - !21276 ub/ubdevshm: Fix some issues
  - !21292 [OLK-6.6][linux-6.6.y sync] Backport 6.6.115-6.6.116 LTS Patches
  - !21309 ub:ub_fwctl:Modify the query to address issues that do not meet expectations
  - ub/ubmem-mmu: Fix some issues
  - ub/ubmempfd: Add module author
  - ub/ubdevshm: Fix some issues
  - mm/shrinker: Implementation of register_shrinker() and unregister_shrinker()
  - gpio: regmap: Fix memleak in error path in gpio_regmap_register()
  - perf: sched: Fix perf crash with new is_user_task() helper
  - ub:ub_fwctl:Modify the statistical port link up/down to only count 10 times
  - ub:ub_fwctl:When modifying the link information of a query port, verify non-existent ports
  - !21307 ub: ubase&unic: Stability and Functionality Fixes Collection
  - net: unic: correct DMA direction for TX path
  - net: unic: Fix the bug that could cause nconsistent resource state or double-free
  - net: unic: optimize MAC address deletion to avoid sleeping in spinlock
  - ub: ubase: Resolve integer wraparound
  - ub: ubase: Resolve cache coherence and set smp_rmb
  - ub: ubase&unic: adjust the encoding format of the ubase&unic driver.
  - ub: ubase: Support udma get ue msg info.
  - net: unic: The FPGA and EVB compilation macros are deleted from the unic driver.
  - ub: ubase: The debugfs function supports querying the Ethernet port rate.
  - sw64: adapt arch_tlbbatch_add_pending according to upstream
  - sw64: fix the compilation error when CONFIG_DEBUG_VIRTUAL is enabled
  - sw64: add support for batched TLB flushing during unmap
  - sw64: fix the parameter passing logic of memblock_mark_nomap
  - sw64: add HUGE_VMAP support for c4
  - sw64: define get_cycles macro
  - sw64: cpuidle: refine C6 state stability
  - sw64: add barriers and tlb flush for set_atc
  - sw64: adapt kernel page table for kdump
  - sw64: adapt kernel page table for memory hotplug
  - sw64: set PTBR_SYS before accessing vmalloc area
  - sw64: set execute permission for virtual machine's hmcode text section
  - sw64: adjust the marking and definitions of some kernel mapping functions
  - sw64: adapt kernel page table for S4
  - sw64: fix an inappropriate lock in __set_memory
  - sw64: enable kernel page table
  - sw64: use ioremap to map IO address in functions like __get_cpu_nums()
  - sw64: move non-boot core's kernel page table enabling logic to hmcode
  - sw64: use ioremap to map IO address
  - sw64: map legacy I/O to K segment
  - sw64: setup early_ioremap
  - sw64: reset ATC for kvm
  - sw64: setup mapping for efi_mm
  - sw64: set protection for kernel page table
  - sw64: modify codes with fixmap
  - sw64: map the early and the final page table
  - sw64: add fixmap support
  - sw64: fix mmap_base exceeding Java assertion address
  - sw64: add memb before/after atomic
  - sw64: add EDAC support with dynamic node and MC detection
  - sw64: fix: getcpu passed a null pointer error
  - sw64: iommu: refactor iommu v2 initialization
  - sw64: cache: fix shared_cpu_map when PPTT is invalid
  - sw64: add alternative runtime patching
  - sw64: pci: fix IO_BASE if numa_off
  - sw64: use ioremap to map spaces for cpufreq and S3
  - sw64: pci: add sunway pci controller for Command Completed errata
  - sw64: add definitions for kernel-required CPU capabilities
  - sw64: kvm: add qemu-gdb watchpoint support
  - sw64: kvm: fix srcu lock leak in pv steal time
  - gpio: idio-16: Define fixed direction of the GPIO lines
  - gpio: regmap: add the .fixed_direction_output configuration parameter
  - gpio: regmap: Allow to allocate regmap-irq device
  - bits: introduce fixed-type GENMASK_U*()
  - bits: add comments and newlines to #if, #else and #endif directives
  - xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event
  - xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive.
  - xhci: dbc: Improve performance by removing delay in transfer event polling.
  - xhci: dbc: Allow users to modify DbC poll interval via sysfs
  - xhci: dbc: poll at different rate depending on data transfer activity
  - serial: sc16is7xx: reorder code to remove prototype declarations
  - serial: sc16is7xx: remove unused to_sc16is7xx_port macro
  - selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported
  - selftests: mptcp: disable add_addr retrans in endpoint_tests
  - arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c
  - btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot()
  - btrfs: use level argument in log tree walk callback replay_one_buffer()
  - btrfs: always drop log root tree reference in btrfs_replay_log()
  - btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io()
  - btrfs: zoned: refine extent allocator hint selection
  - btrfs: zoned: return error from btrfs_zone_finish_endio()
  - EDAC/mc_sysfs: Increase legacy channel support to 16
  - x86/bugs: Fix reporting of LFENCE retpoline
  - x86/bugs: Report correct retbleed mitigation status
  - perf: Skip user unwind if the task is a kernel thread
  - perf: Have get_perf_callchain() return NULL if crosstask and user are set
  - perf: Use current->flags & PF_KTHREAD|PF_USER_WORKER instead of current->mm == NULL
  - audit: record fanotify event regardless of presence of rules
  - sched/topology,x86: Fix build warning
  - sched/topology: Fix sched domain build error for GNR, CWF in SNC-3 mode
  - sched: Create architecture specific sched domain distances


author: Li Nan <linan122@huawei.com> - 6.6.0-145.0.0.140
changelog:
  - !21462 urma: Kernel-mode file for bugfix of kerf of tjetty
  - urma: Kernel-mode file for bugfix of kerf of tjetty
  - !21456  time/jiffies: Mark jiffies_64_to_clock_t() notrace
  - !21393 Fix CVE-2026-23268
  - !21446  i40e: Fix preempt count leak in napi poll tracepoint
  - !21441  ext4: fix generic/363 failure in iomap buffered I/O mode
  - !21200 ub/obmm: delay conti_clear_thread when conti_clear_memseg failed & minor bugfixes
  - !21450 Fix CVE-2026-23317
  - !21429 urma: add workqueue for well_know_jetty
  - !21439 urma: userctl fuction about fix mode.
  - !21458 urma: adjust log level to info for get_dev_name
  - !21425 urma: fix the double free issue of import_cb
  - !21408 urma: ipourma default sl configuration
  - urma: usrctrl function about fix mode.
  - urma: adjust log level to info for get_dev_name
  - !21436  bpf: Release module BTF IDR before module unload
  - !21440 v2  CVE-2026-23319
  - !21438  bpf: Fix stack-out-of-bounds write in devmap
  - time/jiffies: Mark jiffies_64_to_clock_t() notrace
  - !21426  RDMA/umad: Reject negative data_len in ib_umad_write
  - drm/vmwgfx: Return the correct value in vmw_translate_ptr functions
  - !21421 v3  CVE-2026-23352
  - !21380  perf: HiSilicon: Support uncore ITS PMU
  - !21379  drivers/perf: hisi: Add new function for HiSilicon MN PMU driver
  - !21391  quota: fix livelock between quotactl and freeze_super
  - !21390  ext4: fix dirtyclusters double decrement on fs shutdown
  - !21389  fat: avoid parent link count underflow in rmdir
  - !21388  ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O
  - !21387  ext4: fix memory leak in ext4_ext_shift_extents()
  - !21386  blktrace: fix __this_cpu_read/write in preemptible context
  - !21434 Fix CVE-2026-23388
  - i40e: Fix preempt count leak in napi poll tracepoint
  - ub/obmm: delay conti_clear_thread when conti_clear_memseg failed
  - urma: add workqueue for well_know_jetty
  - ext4: zero post EOF partial block before iomap appending write
  - ext4: move pagecache_isize_extended() out of active handle
  - ext4: remove ctime/mtime update from ext4_alloc_file_blocks()
  - ext4: unify SYNC mode checks in fallocate paths
  - ext4: ensure zeroed partial blocks are persisted in SYNC mode
  - ext4: move zero partial block range functions out of active handle
  - ext4: pass allocate range as loff_t to ext4_alloc_file_blocks()
  - ext4: remove handle parameters from zero partial block functions
  - ext4: move ordered data handling out of ext4_block_do_zero_range()
  - ext4: rename ext4_block_zero_page_range() to ext4_block_zero_range()
  - ext4: factor out journalled block zeroing range
  - ext4: rename and extend ext4_block_truncate_page()
  - iomap: make zero range flush conditional on unwritten mappings
  - iomap: fix handling of dirty folios over unwritten extents
  - ub/obmm: minor bugfixes
  - bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim
  - bpf: export bpf_link_inc_not_zero.
  - !21406 crypto: hisilicon/qm - support querying the hardware fault status through VFs
  - crypto: hisilicon/qm - support querying the hardware fault status through VFs
  - urma: ipourma default sl configuration
  - bpf: Fix stack-out-of-bounds write in devmap
  - bpf: Release module BTF IDR before module unload
  - Squashfs: check metadata block offset is within range
  - !21346 Revert "net: hns3: add sync command to sync io-pgtable"
  - !21372  nvme: fix memory allocation in nvme_pr_read_keys()
  - apparmor: fix unprivileged local user can do privileged policy management
  - !21423  nvme: fix admin queue leak on controller reset
  - !21422  scsi: target: Fix recursive locking in __configfs_open_file()
  - RDMA/umad: Reject negative data_len in ib_umad_write
  - !21402  CVE-2026-23296
  - !21403  fix queue start/stop imbalance under race
  - urma: fix the double free issue of bind_cb
  - nvme: fix admin queue leak on controller reset
  - scsi: target: Fix recursive locking in __configfs_open_file()
  - x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size
  - x86/efi: defer freeing of boot services memory
  - !21405 Fix CVE-2025-71239
  - !21398 drivers/ub/sentry: skip memory_failure if pfn is 0x0
  - !21410 urma: disallow user-mode calls for some ubagg userctl ops
  - !21371 urma: remote all logic device when set dev ns
  - urma: disallow user-mode calls for some ubagg userctl ops
  - !21109 filemap: restrict pagecache to non-cpuless NUMA nodes
  - drivers/ub/sentry: skip memory_failure if pfn is 0x0
  - !21314 [OLK-6.6][linux-6.6.y sync] Backport 6.6.116-6.6.117 LTS Patches
  - audit: add fchmodat2() to change attributes class
  - urma: remote all logic device when set dev ns
  - !21348 uvb: support communication in VM
  - !21378 net/ipv4:scmtcp: fix no dmi_uuid in VM
  - dm: fix queue start/stop imbalance under remove/resume races
  - dm: fix queue start/stop imbalance under suspend/load/resume races
  - scsi: core: Fix error handling for scsi_alloc_sdev()
  - scsi: core: Fix refcount leak for tagset_refcnt
  - uvb: support communication in VM
  - !21313  bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing
  - !21334  prevent SEA storms on critical RAS
  - !21375 urma: Kernel-mode file for tp reuse in RC transmode
  - urma: Kernel-mode file for tp reuse in RC transmode and bugfix of uburma and add tp_state
  - quota: fix livelock between quotactl and freeze_super
  - ext4: fix dirtyclusters double decrement on fs shutdown
  - fat: avoid parent link count underflow in rmdir
  - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O
  - ext4: fix memory leak in ext4_ext_shift_extents()
  - blktrace: fix __this_cpu_read/write in preemptible context
  - !21354  media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
  - perf: HiSilicon: Support uncore ITS PMU
  - drivers/perf: hisi: Add new function for HiSilicon MN PMU driver
  - net/ipv4:scmtcp: fix no dmi_uuid in VM
  - !21355  perf: Fix __perf_event_overflow() vs perf_remove_from_context() race
  - !21249  arm64/xcall: add research papers reference in file headers
  - !21322  nfs: return EISDIR on nfs3_proc_create if d_alias is a dir
  - !21369 drivers/ub/sentry: add some log for event report
  - mm/filemap: restrict pagecache to non-cpuless NUMA nodes
  - mm/mempolicy: add mpol_update_interleave_stats() helper
  - !21328 genirq: Get rid of global lock in irq_do_set_affinity()
  - !21282 spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization
  - nvme: fix memory allocation in nvme_pr_read_keys()
  - !21339 iommu: Revert to using .domain_alloc_user without kvm parameter
  - spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization
  - Revert "Fixed the wrong debugfs node name in hisi_spi debugfs initialization"
  - drivers/ub/sentry: add some log for event report
  - perf: Fix __perf_event_overflow() vs perf_remove_from_context() race
  - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
  - iommu: Revert to using .domain_alloc_user without kvm parameter
  - Revert "net: hns3: add sync command to sync io-pgtable"
  - regulator: fixed: Rely on the core freeing the enable GPIO
  - net/mlx5e: Fix validation logic in rate limiting
  - drm/amdgpu: fix cyan_skillfish2 gpu info fw handling
  - ntfs3: init run lock for extend inode
  - scsi: ufs: host: mediatek: Require CONFIG_PM
  - wifi: rtw88: limit indirect IO under powered off for RTL8822CS
  - pinctrl: keembay: fix double free in keembay_build_functions()
  - block: fix comment for op_is_zone_mgmt() to include RESET_ALL
  - mptcp: schedule rtx timer only after pushing data
  - ACPI: HMAT: Remove register of memory node for generic target
  - mm/memory-tier: fix abstract distance calculation overflow
  - mm/truncate: unmap large folio on split failure
  - mm: memcg: change flush_next_time to flush_last_time
  - mm: memcg: add per-memcg zswap writeback stat
  - scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL
  - scsi: ufs: core: Add a quirk to suppress link_startup_again
  - scsi: ufs: core: Add a quirk for handling broken LSDBS field in controller capabilities register
  - scsi: ufs: core: Add UFSHCD_QUIRK_KEYS_IN_PRDT
  - scsi: ufs: core: Add fill_crypto_prdt variant op
  - scsi: ufs: core: Add UFSHCD_QUIRK_BROKEN_CRYPTO_ENABLE
  - scsi: ufs: core: fold ufshcd_clear_keyslot() into its caller
  - scsi: ufs: core: Add UFSHCD_QUIRK_CUSTOM_CRYPTO_PROFILE
  - f2fs: fix to avoid overflow while left shift operation
  - mm, percpu: do not consider sleepable allocations atomic
  - iommufd: Don't overflow during division for dirty tracking
  - btrfs: ensure no dirty metadata is written back for an fs with errors
  - Revert "perf dso: Add missed dso__put to dso__load_kcore"
  - selftests: mptcp: connect: trunc: read all recv data
  - selftests: mptcp: join: rm: set backup flag
  - selftests: mptcp: connect: fix fallback note due to OoO
  - pmdomain: samsung: plug potential memleak during probe
  - btrfs: do not update last_log_commit when logging inode due to a new name
  - btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe()
  - EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection
  - EDAC/altera: Handle OCRAM ECC enable after warm reset
  - LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY
  - selftests/user_events: fix type cast for write_index packed member in perf_test
  - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev
  - spi: Try to get ACPI GPIO IRQ earlier
  - smb: client: fix cifs_pick_channel when channel needs reconnect
  - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer
  - mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4
  - mm/mm_init: fix hash table order logging in alloc_large_system_hash()
  - wifi: mac80211: reject address change while connecting
  - selftests/tracing: Run sample events to clear page cache events
  - LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY
  - LoongArch: Use correct accessor to read FWPC/MWPC
  - dma-mapping: benchmark: Restore padding to ensure uABI remained consistent
  - strparser: Fix signed/unsigned mismatch bug
  - ksmbd: close accepted socket when per-IP limit rejects connection
  - gcov: add support for GCC 15
  - KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated
  - HID: uclogic: Fix potential memory leak in error path
  - ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY
  - HID: hid-ntrig: Prevent memory leak in ntrig_report_version()
  - ARM: dts: imx51-zii-rdu1: Fix audmux node names
  - arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1
  - mtd: onenand: Pass correct pointer to IRQ handler
  - Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()'
  - lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN
  - irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops
  - acpi/hmat: Fix lockdep warning for hmem_register_resource()
  - base/node / ACPI: Enumerate node access class for 'struct access_coordinate'
  - acpi: numa: Add setting of generic port system locality attributes
  - acpi: Break out nesting for hmat_parse_locality()
  - acpi: numa: Add genport target allocation to the HMAT parsing
  - acpi: numa: Create enum for memory_target access coordinates indexing
  - base/node / acpi: Change 'node_hmem_attrs' to 'access_coordinates'
  - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd
  - NFSv4: Fix an incorrect parameter when calling nfs4_call_sync()
  - NFS: sysfs: fix leak when nfs_client kobject add fails
  - pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS
  - NFS: enable nconnect for RDMA
  - pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect()
  - ASoC: tas2781: fix getting the wrong device number
  - ASoC: codecs: va-macro: fix resource leak in probe error path
  - ASoC: cs4271: Fix regulator leak on probe failure
  - regulator: fixed: fix GPIO descriptor leak on register failure
  - acpi,srat: Fix incorrect device handle check for Generic Initiator
  - cifs: Fix uncached read into ITER_KVEC iterator
  - cifs: stop writeback extension when change of size is detected
  - Bluetooth: L2CAP: export l2cap_chan_hold for modules
  - ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs
  - ACPI: CPPC: Check _CPC validity for only the online CPUs
  - hsr: Fix supervision frame sending on HSRv0
  - virtio-net: fix incorrect flags recording in big mode
  - net_sched: limit try_bulk_dequeue_skb() batches
  - net/mlx5e: Fix potentially misleading debug message
  - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps
  - net/mlx5e: Fix maxrate wraparound in threshold between units
  - net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak
  - net: sched: act_connmark: initialize struct tc_ife to fix kernel leak
  - net_sched: act_connmark: use RCU in tcf_connmark_dump()
  - wifi: mac80211: skip rate verification for not captured PSDUs
  - net: mdio: fix resource leak in mdiobus_register_device()
  - net/handshake: Fix memory leak in tls_handshake_accept()
  - net/smc: fix mismatch between CLC header and proposal
  - Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions
  - Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion
  - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path
  - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF
  - net: fec: correct rx_bytes statistic for the case SHIFT16 is set
  - selftests: net: local_termination: Wait for interfaces to come up
  - wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp()
  - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down
  - smb/server: fix possible refcount leak in smb2_sess_setup()
  - smb/server: fix possible memory leak in smb2_read()
  - NFS: check if suid/sgid was cleared after a write as needed
  - HID: quirks: avoid Cooler Master MM712 dongle wakeup bug
  - NFS4: Fix state renewals missing after boot
  - drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices
  - drm/amd/pm: Disable MCLK switching on SI at high pixel clocks
  - riscv: acpi: avoid errors caused by probing DT devices when ACPI is used
  - RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors
  - compiler_types: Move unused static inline functions warning to W=2
  - iommufd: Make vfio_compat's unmap succeed if the range is already empty
  - smb: client: fix refcount leak in smb2_set_path_attr
  - drm/i915: Fix conversion between clock ticks and nanoseconds
  - drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD
  - selftests: netdevsim: set test timeout to 10 minutes
  - riscv: stacktrace: fix backtracing through exceptions
  - drm/amd/display: Fix black screen with HDMI outputs
  - drm/amdgpu: Fix function header names in amdgpu_connectors.c
  - extcon: adc-jack: Cleanup wakeup source only if it was enabled
  - scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers
  - x86/microcode/AMD: Add more known models to entry sign checking
  - drm/amd/display: Enable mst when it's detected but yet to be initialized
  - net: bridge: fix MST static key usage
  - lan966x: Fix sleeping in atomic context
  - net: dsa: microchip: Fix reserved multicast address table programming
  - net/mlx5e: SHAMPO, Fix skb size check for 64K pages
  - net/mlx5e: Fix return value in case of module EEPROM read error
  - net/mlx5e: Use extack in get module eeprom by page callback
  - wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup
  - net: dsa: b53: stop reading ARL entries if search is done
  - net: dsa: b53: fix enabling ip multicast
  - net: dsa: b53: fix resetting speed and pause on forced link
  - net: vlan: sync VLAN features with lower device
  - selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh
  - netdevsim: add Makefile for selftests
  - selftests/net: use destination options instead of hop-by-hop
  - selftests/net: fix GRO coalesce test and add ext header coalesce tests
  - selftests/net: fix out-of-order delivery of FIN in gro:tcp test
  - net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx
  - Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2()
  - riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro
  - riscv: stacktrace: Disable KASAN checks for non-current tasks
  - riscv: Improve exception and system call latency
  - net: libwx: fix device bus LAN ID
  - ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again
  - ceph: refactor wake_up_bit() pattern of calling
  - ceph: add checking of wait_for_completion_killable() return value
  - ASoC: meson: aiu-encoder-i2s: fix bit clock polarity
  - kbuild: uapi: Strip comments before size type check
  - rtc: pcf2127: fix watchdog interrupt mask on pcf2131
  - tools: lib: thermal: use pkg-config to locate libnl3
  - tools: lib: thermal: don't preserve owner in install
  - tools bitmap: Add missing asm-generic/bitsperlong.h include
  - scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS
  - 9p: sysfs_init: don't hardcode error to ENOMEM
  - cpufreq: tegra186: Initialize all cores to max frequencies
  - 9p: fix /sys/fs/9p/caches overwriting itself
  - NTB: epf: Allow arbitrary BAR mapping
  - clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled
  - clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register
  - clk: at91: clk-master: Add check for divide by 3
  - ARM: at91: pm: save and restore ACR during PLL disable/enable
  - rtc: pcf2127: clear minute/second interrupt
  - clk: sunxi-ng: sun6i-rtc: Add A523 specifics
  - um: Fix help message for ssl-non-raw
  - fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink
  - btrfs: mark dirty extent range for out of bound prealloc extents
  - RDMA/irdma: Set irdma_cq cq_num field during CQ create
  - RDMA/irdma: Remove unused struct irdma_cq fields
  - RDMA/irdma: Fix SD index calculation
  - ACPICA: Update dsmethod.c to get rid of unused variable warning
  - char: misc: restrict the dynamic range to exclude reserved minors
  - smb: client: transport: avoid reconnects triggered by pending task work
  - ksmbd: use sock_create_kern interface to create kernel socket
  - orangefs: fix xattr related buffer overflow...
  - page_pool: Clamp pool size to max 16K pages
  - 6pack: drop redundant locking and refcounting
  - exfat: limit log print for IO error
  - ALSA: usb-audio: add mono main switch to Presonus S1824c
  - Bluetooth: SCO: Fix UAF on sco_conn_free
  - Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames
  - net: macb: avoid dealing with endianness in macb_set_hwaddr()
  - arm64: openeuler_defconfig: enable ras critical related configs by default
  - rseq: avoid memory access during rseq_get_rseq_cs if task facing critical RAS
  - futex: avoid memory access during exit_robust_list if task facing critical RAS
  - mm: avoid memory access during __access_remote_vm if task facing critical RAS
  - coredump: skip coredump during critical error if task facing critical RAS
  - exit: terminate process on critical RAS events to prevent further damage
  - ACPI: APEI: Add MMF_RAS_CRITICAL to mark critical RAS scenarios in mm struct
  - ACPI: APEI: Add vendor specific error info handling for ARM Processor
  - mm: memory_failure: fix UAF in memory_failure_cb
  - genirq: Get rid of global lock in irq_do_set_affinity()
  - nfs: return EISDIR on nfs3_proc_create if d_alias is a dir
  - ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007
  - ASoC: stm32: sai: manage context in set_sysclk callback
  - amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw
  - ext4: increase IO priority of fastcommit
  - accel/habanalabs/gaudi2: read preboot status after recovering from dirty state
  - accel/habanalabs: return ENOMEM if less than requested pages were pinned
  - scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate
  - accel/habanalabs/gaudi2: fix BMON disable configuration
  - scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill()
  - net: bridge: Install FDB for bridge MAC on VLAN 0
  - NFSv4.1: fix mount hang after CREATE_SESSION failure
  - NFSv4: handle ERR_GRACE on delegation recalls
  - drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream
  - wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256
  - remoteproc: qcom: q6v5: Avoid handling handover twice
  - PCI/PM: Skip resuming to D0 if device is disconnected
  - vfio: return -ENOTTY for unsupported device feature
  - sparc64: fix prototypes of reads[bwl]()
  - sparc/module: Add R_SPARC_UA64 relocation handling
  - r8169: set EEE speed down ratio to 1
  - net: intel: fm10k: Fix parameter idx set but not used
  - wifi: ath10k: Fix connection after GTK rekeying
  - iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot()
  - net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X
  - net: phy: clear link parameters on admin link down
  - ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup()
  - jfs: fix uninitialized waitqueue in transaction manager
  - jfs: Verify inode mode when loading from disk
  - ipv6: np->rxpmtu race annotation
  - f2fs: fix infinite loop in __insert_extent_tree()
  - usb: xhci: plat: Facilitate using autosuspend for xhci plat devices
  - usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs
  - allow finish_no_open(file, ERR_PTR(-E...))
  - scsi: lpfc: Define size of debugfs entry for xri rebalancing
  - scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup
  - scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET
  - scsi: ufs: core: Disable timestamp functionality if not supported
  - selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency
  - drm/amdgpu: reject gang submissions under SRIOV
  - HID: i2c-hid: Resolve touchpad issues on Dell systems during S4
  - ethernet: Extend device_get_mac_address() to use NVMEM
  - drm/amd/display: Disable VRR on DCE 6
  - drm/amd/display: Fix DVI-D/HDMI adapters
  - drm/amd: Avoid evicting resources at S5
  - drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl
  - ALSA: serial-generic: remove shared static buffer
  - wifi: mt76: mt7996: Temporarily disable EPCS
  - wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device
  - net/cls_cgroup: Fix task_get_classid() during qdisc run
  - crypto: caam - double the entropy delay interval for retry
  - PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify()
  - crypto: sun8i-ce - remove channel timeout field
  - watchdog: s3c2410_wdt: Fix max_timeout being calculated larger
  - HID: asus: add Z13 folio to generic group for multitouch to work
  - selftests: Replace sleep with slowwait
  - eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP
  - selftests: Disable dad for ipv6 in fcnal-test.sh
  - x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT
  - netfilter: nf_reject: don't reply to icmp error messages
  - selftests: traceroute: Use require_command()
  - media: redrat3: use int type to store negative error codes
  - selftests: net: replace sleeps in fcnal-test with waits
  - net: sh_eth: Disable WoL if system can not suspend
  - phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0
  - phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet
  - phy: cadence: cdns-dphy: Enable lower resolutions in dphy
  - wifi: mac80211: Fix HE capabilities element check
  - ntfs3: pretend $Extend records as regular files
  - scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes
  - net: phy: marvell: Fix 88e1510 downshift counter errata
  - scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure
  - scsi: ufs: host: mediatek: Enhance recovery on resume failure
  - media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer
  - media: ov08x40: Fix the horizontal flip control
  - char: Use list_del_init() in misc_deregister() to reinitialize list pointer
  - drm/msm: make sure to not queue up recovery more than once
  - usb: gadget: f_hid: Fix zero length packet transfer
  - drm/amdgpu: add support for cyan skillfish gpu_info
  - drm/amdgpu: don't enable SMU on cyan skillfish
  - drm/amd: add more cyan skillfish PCI ids
  - iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs
  - iommu/amd: Skip enabling command/event buffers for kdump
  - smsc911x: add second read of EEPROM mac when possible corruption seen
  - net: call cond_resched() less often in __release_sock()
  - ALSA: usb-audio: apply quirk for MOONDROP Quark2
  - media: verisilicon: Explicitly disable selection api ioctls for decoders
  - media: adv7180: Only validate format in querystd
  - media: adv7180: Do not write format to device in set_fmt
  - media: adv7180: Add missing lock in suspend callback
  - net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms
  - ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled
  - drm/amdgpu: Allow kfd CRIU with no buffer objects
  - drm/msm/dsi/phy_7nm: Fix missing initial VCO rate
  - drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL
  - dmaengine: dw-edma: Set status for callback_result
  - dmaengine: mv_xor: match alloc_wc and free_wc
  - dmaengine: sh: setup_xref error handling
  - ptp: Limit time setting of PTP clocks
  - scsi: pm8001: Use int instead of u32 to store error codes
  - crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof()
  - mips: lantiq: danube: rename stp node on EASY50712 reference board
  - mips: lantiq: xway: sysctrl: rename stp clock
  - mips: lantiq: danube: add missing device_type in pci node
  - mips: lantiq: danube: add model to EASY50712 dts
  - mips: lantiq: danube: add missing properties to cpu node
  - drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2)
  - media: fix uninitialized symbol warnings
  - drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption
  - drm/amdkfd: fix vram allocation failure for a special case
  - fuse: zero initialize inode private data
  - net: phy: fixed_phy: let fixed_phy_unregister free the phy_device
  - remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper
  - extcon: adc-jack: Fix wakeup source leaks on device unbind
  - scsi: pm80xx: Fix race condition caused by static variables
  - scsi: mpi3mr: Fix controller init failure on fault during queue creation
  - rds: Fix endianness annotation for RDS_MPATH_HASH
  - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units
  - PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call
  - net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV.
  - net: stmmac: Correctly handle Rx checksum offload errors
  - net: When removing nexthops, don't call synchronize_net if it is not necessary
  - char: misc: Does not request module for miscdevice with dynamic minor
  - char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor
  - usb: gadget: f_ncm: Fix MAC assignment NCM ethernet
  - iio: adc: imx93_adc: load calibrated values even calibration failed
  - iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register
  - drm/amdkfd: Handle lack of READ permissions in SVM mapping
  - drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts
  - scsi: ufs: host: mediatek: Fix invalid access in vccqx handling
  - scsi: ufs: host: mediatek: Change reset sequence for improved stability
  - scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change
  - scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration
  - bridge: Redirect to backup port when port is administratively down
  - s390/pci: Use pci_uevent_ers() in PCI recovery
  - powerpc/eeh: Use result of error_detected() in uevent
  - ice: Don't use %pK through printk or tracepoints
  - net: stmmac: Check stmmac_hw_setup() in stmmac_resume()
  - x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall
  - media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR
  - drm/tidss: Set crtc modesetting parameters with adjusted mode
  - drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST
  - drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value
  - drm/tidss: Use the crtc_* timings when programming the HW
  - media: amphion: Delete v4l2_fh synchronously in .release()
  - media: pci: ivtv: Don't create fake v4l2_fh
  - drm/amdkfd: return -ENOTTY for unsupported IOCTLs
  - wifi: rtw88: sdio: use indirect IO for device registers before power-on
  - selftests/net: Ensure assert() triggers in psock_tpacket.c
  - selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8
  - PCI: Disable MSI on RDC PCI to PCIe bridges
  - drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf()
  - drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff
  - drm/amd/pm: Use cached metrics data on arcturus
  - drm/amd/pm: Use cached metrics data on aldebaran
  - drm/amd/display: update dpp/disp clock from smu clock table
  - drm/amd/display: add more cyan skillfish devices
  - drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration
  - drm/amd/display: ensure committing streams is seamless
  - mfd: da9063: Split chip variant reading in two bus transactions
  - mfd: madera: Work around false-positive -Wininitialized warning
  - mfd: stmpe-i2c: Add missing MODULE_LICENSE
  - mfd: stmpe: Remove IRQ domain upon removal
  - tools/power x86_energy_perf_policy: Prefer driver HWP limits
  - tools/power x86_energy_perf_policy: Enhance HWP enable
  - tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage
  - tools/cpupower: Fix incorrect size in cpuidle_state_disable()
  - hwmon: (dell-smm) Add support for Dell OptiPlex 7040
  - hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex
  - uprobe: Do not emulate/sstep original instruction when ip is changed
  - nvme: Use non zero KATO for persistent discovery connections
  - bpf: Clear pfmemalloc flag when freeing all fragments
  - riscv: bpf: Fix uninitialized symbol 'retval_off'
  - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel
  - spi: rpc-if: Add resume support for RZ/G3E
  - cpuidle: Fail cpuidle device registration if there is one already
  - bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21
  - power: supply: qcom_battmgr: handle charging state change notifications
  - pmdomain: apple: Add "apple,t8103-pmgr-pwrstate"
  - tools/cpupower: fix error return value in cpupower_write_sysfs()
  - video: backlight: lp855x_bl: Set correct EPROM start for LP8556
  - tee: allow a driver to allocate a tee_device without a pool
  - ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method()
  - mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card
  - ARM: tegra: transformer-20: fix audio-codec interrupt
  - ARM: tegra: transformer-20: add missing magnetometer interrupt
  - soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups
  - arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106
  - irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller
  - hwmon: sy7636a: add alias
  - power: supply: sbs-charger: Support multiple devices
  - pinctrl: keembay: release allocated memory in detach path
  - hwmon: (sbtsi_temp) AMD CPU extended temperature range support
  - power: supply: qcom_battmgr: add OOI chemistry
  - ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[]
  - ACPI: PRM: Skip handlers with NULL handler_address or NULL VA
  - irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment
  - selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh
  - arc: Fix __fls() const-foldability via __builtin_clzl()
  - cpufreq/longhaul: handle NULL policy in longhaul_exit
  - selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2
  - irqchip/sifive-plic: Respect mask state when setting affinity
  - memstick: Add timeout to prevent indefinite waiting
  - mmc: host: renesas_sdhi: Fix the actual clock
  - pinctrl: single: fix bias pull up/down handling in pin_config_set
  - bpf: Don't use %pK through printk
  - spi: loopback-test: Don't use %pK through printk
  - soc: qcom: smem: Fix endian-unaware access of num_entries
  - soc: aspeed: socinfo: Add AST27xx silicon IDs
  - usb: gadget: f_fs: Fix epfile null pointer access after ep enable.
  - drm/sched: Fix race in drm_sched_entity_select_rq()
  - s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP
  - sched/fair: Use all little CPUs for CPU-bound workloads
  - sched/pelt: Avoid underestimation of task utilization
  - net: phy: dp83867: Disable EEE support as not implemented
  - s390/pci: Restore IRQ unconditionally for the zPCI device
  - regmap: slimbus: fix bus_context pointer in regmap init calls
  - block: make REQ_OP_ZONE_OPEN a write operation
  - block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL
  - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland
  - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji
  - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table()
  - sfc: fix potential memory leak in efx_mae_process_mport()
  - drm/etnaviv: fix flush sequence logic
  - Bluetooth: hci_core: Fix tracking of periodic advertisement
  - Bluetooth: ISO: Fix another instance of dst_type handling
  - Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset
  - libbpf: Fix powerpc's stack register definition in bpf_tracing.h
  - ASoC: fsl_sai: fix bit order for DSD format
  - ASoC: Intel: avs: Unprepare a stream when XRUN occurs
  - scsi: ufs: core: Initialize value of an attribute returned by uic cmd
  - ALSA: usb-audio: fix control pipe direction
  - drm/msm/a6xx: Fix GMU firmware parser
  - wifi: ath12k: free skb during idr cleanup callback
  - wifi: ath10k: Fix memory leak on unsupported WMI command
  - ASoC: qdsp6: q6asm: do not sleep while atomic
  - mptcp: restore window probe
  - mptcp: drop bogus optimization in __mptcp_check_push()
  - fbdev: valkyriefb: Fix reference count leak in valkyriefb_init
  - fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS
  - Bluetooth: rfcomm: fix modem control handling
  - ACPI: button: Call input_free_device() on failing input device registration
  - fbdev: atyfb: Check if pll_ops->init_pll failed
  - net: usb: asix_devices: Check return value of usbnet_get_endpoints
  - bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing
  - arm64/xcall: add research papers reference in file headers


author: Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.0.1.141
changelog:
  - !21670 urma: change well-known jetty to UM
  - !21669 urma: adjust netlink log level of ipourma
  - urma: change well-known jetty to UM
  - urma: adjust netlink log level of ipourma
  - !21644 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-145.0.0 to 6.6.0-146.0.0
  - f2fs: fix to detect potential corrupted nid in free_nid_list
  - ntfs3: Fix uninit buffer allocated by __getname()
  - nvme-pci: Fix race bug in nvme_poll_irqdisable()
  - tls: Purge async_hold in tls_decrypt_async_wait()
  - clsact: Fix use-after-free in init/destroy rollback asymmetry
  - nf_tables: nft_dynset: fix possible stateful expression memleak in error path
  - xdp: produce a warning when calculated tailroom is negative
  - xdp: use modulo operation to calculate XDP frag tailroom
  - apparmor: fix race between freeing data and fs accessing it
  - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks"
  - riscv: Replace function-like macro by static inline function
  - sched/fair: scale wake_wide() threshold by SMT width
  - sched/core: fix SCHED_FEAT overflow on 32-bit architectures
  - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid()
  - urma: fix race condition in async event causing kfree of invalid pointer
  - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid
  - apparmor: replace recursive profile removal with iterative approach
  - apparmor: fix: limit the number of levels of policy namespaces
  - nfnetlink_osf: validate individual option lengths in fingerprints
  - tls: Fix race condition in tls_sw_cancel_work_tx()
  - urma: Kernel-mode file for bugfix of vtpn of empty pointer
  - xen/privcmd: add boot control for restricted usage in domU
  - xen/privcmd: unregister xenstore notifier on module exit
  - xen/privcmd: restrict usage in unprivileged domU
  - af_unix: Give up GC if MSG_PEEK intervened.
  - urma: Kernel-mode file for bugfix to move hashtable from alloc to active
  - apparmor: fix differential encoding verification
  - ub:hisi-ubus: Synchronize the missing code
  - apparmor: Fix double free of ns_name in aa_replace_profiles()
  - mptcp: pm: in-kernel: always mark signal+subflow endp as used
  - bridge: cfm: Fix race condition in peer_mep deletion
  - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()
  - apparmor: fix race on rawdata dereference
  - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase
  - net/sched: act_gate: snapshot parameters with RCU on replace
  - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded
  - netfilter: nf_tables: always walk all pending catchall elements
  - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels
  - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs
  - netfilter: nf_tables: unconditionally bump set->nelems before insertion
  - netfilter: nf_tables: release flowtable after rcu grace period on error
  - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks
  - netfilter: xt_CT: drop pending enqueued packets on template removal
  - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit
  - apparmor: fix memory leak in verify_header
  - wifi: libertas: fix use-after-free in lbs_free_adapter()
  - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback
  - urma: Kernel-mode file for bugfix deactivate to apply pid in udma
  - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback
  - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop
  - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled
  - can: bcm: fix locking for bcm_op runtime updates
  - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock
  - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled
  - net: prevent NULL deref in ip[6]tunnel_xmit()
  - net: add xmit recursion limit to tunnel xmit functions
  - net: gro: fix outer network offset
  - net: annotate data-races around sk->sk_{data_ready,write_space}
  - net: add proper RCU protection to /proc/net/ptype
  - urma: fix potential deadlock risk in urma_ping
  - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ
  - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting
  - net: usb: kalmia: validate USB endpoints
  - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE
  - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair()
  - urma: use user-specified dev_name when creating agg dev
  - mm: thp: deny THP for files on anonymous inodes
  - mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
  - smb: client: Don't log plaintext credentials in cifs_set_cifscreds
  - netfilter: nf_tables: fix use-after-free in nf_tables_addchain()
  - xhci: dbgtty: fix device unregister: fixup
  - tty: introduce and use tty_port_tty_vhangup() helper
  - net: dsa: microchip: Fix error path in PTP IRQ setup
  - can: ucan: Fix infinite loop from zero-length messages
  - net: dsa: microchip: Free previously initialized ports on init failures
  - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}()
  - selftests: mptcp: join: properly kill background tasks
  - staging: rtl8712: Remove driver using deprecated API wext
  - net: macb: fix unregister_netdev call order in macb_remove()
  - iio: adc: rtq6056: Correct the sign bit index
  - nfsd: Replace clamp_t in nfsd4_get_drc_mem()
  - net: dsa: microchip: ptp: Fix checks on irq_find_mapping()
  - net: dsa: microchip: common: Fix checks on irq_find_mapping()
  - drm/amd/display: Check NULL before accessing
  - drm: sti: fix device leaks at component probe
  - USB: serial: option: add support for Rolling RW101R-GL
  - USB: serial: ftdi_sio: add support for u-blox EVK-M101
  - xhci: dbgtty: fix device unregister
  - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host
  - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths
  - usb: dwc3: pci: Sort out the Intel device IDs
  - usb: dwc3: pci: add support for the Intel Nova Lake -S
  - usb: renesas_usbhs: Fix synchronous external abort on unbind
  - usb: gadget: f_eem: Fix memory leak in eem_unwrap
  - usb: cdns3: Fix double resource release in cdns3_pci_probe
  - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking
  - mptcp: clear scheduled subflows on retransmit
  - firmware: stratix10-svc: fix bug in saving controller data
  - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves
  - thunderbolt: Add support for Intel Wildcat Lake
  - drivers/usb/dwc3: fix PCI parent check
  - dm-verity: fix unreliable memory allocation
  - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling
  - can: sja1000: fix max irq loop handling
  - atm/fore200e: Fix possible data race in fore200e_open()
  - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line
  - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230
  - iio: adc: ad7280a: fix ad7280_store_balance_timer()
  - iio: accel: fix ADXL355 startup race condition
  - iio: accel: bmc150: Fix irq assumption regression
  - iio:common:ssp_sensors: Fix an error handling path ssp_probe()
  - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields
  - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()"
  - spi: bcm63xx: fix premature CS deassertion on RX-only transactions
  - spi: nxp-fspi: Propagate fwnode in ACPI case as well
  - spi: nxp-fspi: Support per spi-mem operation frequency switches
  - spi: spi-mem: Add a new controller capability
  - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency
  - spi: spi-mem: Allow specifying the byte order in Octal DTR mode
  - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors
  - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA
  - mailbox: pcc: don't zero error register
  - mailbox: mailbox-test: Fix debugfs_create_dir error checking
  - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors
  - iio: st_lsm6dsx: Fixed calibrated timestamp calculation
  - net: fec: do not register PPS event for PEROUT
  - net: fec: do not allow enabling PPS and PEROUT simultaneously
  - net: fec: do not update PEROUT if it is enabled
  - net: fec: cancel perout_timer when PEROUT is disabled
  - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic
  - net: dsa: sja1105: simplify static configuration reload
  - net: sxgbe: fix potential NULL dereference in sxgbe_rx()
  - net: lan966x: Fix the initialization of taprio
  - net: aquantia: Add missing descriptor cache invalidation on ATL2
  - platform/x86: intel: punit_ipc: fix memory corruption
  - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY
  - Bluetooth: SMP: Fix not generating mackey and ltk when repairing
  - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data
  - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header
  - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs
  - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers


author: Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.0.2.142
changelog:
  - !21696 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove
  - !21695 urma: Create jetty with kernel thread
  - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove
  - urma: Create jetty with kernel thread


author: Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.0.3.143
changelog:
  - !21778 urma: implement share TP for RM mode
  - urma: implement share TP for RM mode
  - !21768 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-146.0.0 to 6.6.0-147.0.0
  - ub:hisi-ubus: Adjust the order of the message struct
  - ub:ubus: Fix find error ubc_num of local ras
  - ub:ubus: Fix null message workqueue issue
  - mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose().
  - net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work
  - urma: fix Clos networking and add a new interface get_path_set.
  - sched/debug: Fix avg_vruntime() usage
  - sched/fair: Fix zero_vruntime tracking fix
  - sched/fair: Fix vruntime drift by preventing double lag scaling during reweight
  - sched/eevdf: Update se->vprot in reweight_entity()
  - sched/fair: Only set slice protection at pick time
  - sched: Fix struct sched_entity kabi broken
  - sched/fair: Fix NO_RUN_TO_PARITY case
  - sched/fair: Use protect_slice() instead of direct comparison
  - sched: Cancel the slice protection of the idle entity
  - sched/eevdf: Fix wakeup-preempt by checking cfs_rq->nr_running
  - sched/eevdf: Disable shorter slices to wakeup-preempt
  - sched/eevdf: Allow shorter slices to wakeup-preempt
  - sched: Unify more update_curr*()
  - sched: Remove vruntime from trace_sched_stat_runtime()
  - sched: fix kabi broken in struct sched_statistics
  - sched: Unify runtime accounting across classes
  - sched/fair: Adhere to place_entity() constraints
  - sched/fair: Fix EEVDF entity placement bug causing scheduling lag
  - sched/fair: Fix zero_vruntime tracking
  - sched: Fix kabi breakage of struct cfs_rq for sum_w_vruntime
  - sched/fair: Rename cfs_rq::avg_vruntime to ::sum_w_vruntime, and helper functions
  - sched: Fix kabi breakage of struct cfs_rq for sum_weight
  - sched/fair: Rename cfs_rq::avg_load to cfs_rq::sum_weight
  - sched: Re-evaluate scheduling when migrating queued tasks out of throttled cgroups
  - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer
  - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer
  - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one
  - spi: tegra210-quad: Move curr_xfer read inside spinlock
  - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer
  - tools: Fix bitfield dependency failure
  - iomap: allocate s_dio_done_wq for async reads as well
  - i3c: Move device name assignment after i3c_bus_init
  - staging: rtl8723bs: properly validate the data in rtw_get_ie_ex()
  - drm/vmwgfx: Fix invalid kref_put callback in vmw_bo_dirty_release
  - selftests: bonding: Add more missing config options
  - selftests: bonding: add missing build configs
  - mtd: rawnand: renesas: Handle devm_pm_runtime_enable() errors
  - net: stmmac: fix rx limit check in stmmac_rx_zc()
  - netfilter: flowtable: check for maximum number of encapsulations in bridge vlan
  - Reinstate "resource: avoid unnecessary lookups in find_next_iomem_res()"
  - resource: introduce is_type_match() helper and use it
  - resource: replace open coded resource_intersection()
  - resource: Reuse for_each_resource() macro
  - ARM: dts: samsung: exynos4412-midas: turn off SDIO WLAN chip during system suspend
  - ARM: dts: samsung: exynos4210-trats: turn off SDIO WLAN chip during system suspend
  - ARM: dts: samsung: exynos4210-i9100: turn off SDIO WLAN chip during system suspend
  - ARM: dts: samsung: universal_c210: turn off SDIO WLAN chip during system suspend
  - ASoC: Intel: catpt: Fix error path in hw_params()
  - vdpa/pds: use %pe for ERR_PTR() in event handler registration
  - virtio: fix virtqueue_set_affinity() docs
  - virtio: fix whitespace in virtio_config_ops
  - virtio: fix typo in virtio_device_ready() comment
  - virtio_vdpa: fix misleading return in void function
  - ext4: improve integrity checking in __mb_check_buddy by enhancing order-0 validation
  - ext4: remove unused return value of __mb_check_buddy
  - ublk: prevent invalid access with DEBUG
  - ublk: complete command synchronously on error
  - ublk: make sure io cmd handled in submitter task context
  - ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4
  - hwmon: sy7636a: Fix regulator_enable resource leak on error path
  - drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1()
  - ASoC: fsl_xcvr: clear the channel status control memory
  - RDMA/irdma: Do not directly rely on IB_PD_UNSAFE_GLOBAL_RKEY
  - RDMA/irdma: Add support to re-register a memory region
  - RDMA/irdma: Fix data race in irdma_free_pble
  - RDMA/irdma: Fix data race in irdma_sc_ccq_arm
  - iommu/arm-smmu-qcom: Enable use of all SMR groups when running bare-metal
  - backlight: lp855x: Fix lp855x.h kernel-doc warnings
  - backlight: led-bl: Add devlink to supplier LEDs
  - wifi: ieee80211: correct FILS status codes
  - iomap: always run error completions in user context
  - iomap: factor out a iomap_dio_done helper
  - drm/nouveau: restrict the flush page to a 32-bit address
  - PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition
  - btrfs: fix leaf leak in an error path in btrfs_del_items()
  - staging: fbtft: core: fix potential memory leak in fbtft_probe_common()
  - firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc
  - mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add()
  - RDMA/bnxt_re: Fix the inline size for GenP7 devices
  - RISC-V: KVM: Fix guest page fault within HLV* instructions
  - crypto: ccree - Correctly handle return of sg_nents_for_len
  - crypto: starfive - Correctly handle return of sg_nents_for_len
  - selftests/bpf: Improve reliability of test_perf_branches_no_hw()
  - selftests/bpf: skip test_perf_branches_hw() on unsupported platforms
  - usb: dwc2: fix hang during suspend if set as peripheral
  - usb: dwc2: fix hang during shutdown if set as peripheral
  - usb: dwc2: disable platform lowlevel hw resources during shutdown
  - usb: chaoskey: fix locking for O_NONBLOCK
  - cpuset: Treat cpusets in attaching as populated
  - net: phy: adin1100: Fix software power-down ready condition
  - mfd: mt6358-irq: Fix missing irq_domain_remove() in error path
  - mfd: mt6397-irq: Fix missing irq_domain_remove() in error path
  - wifi: mac80211: fix CMAC functions not handling errors
  - wifi: mac80211: remove RX_DROP_UNUSABLE
  - pwm: bcm2835: Make sure the channel is enabled after pwm_request()
  - perf arm_spe: Fix memset subclass in operation
  - perf arm-spe: Extend branch operations
  - drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue
  - fs/ntfs3: Prevent memory leaks in add sub record
  - fs/ntfs3: out1 also needs to put mi
  - powerpc/64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE format
  - powerpc/64s/hash: Restrict stress_hpt_struct memblock region to within RMA limit
  - wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring()
  - drm/msm/a2xx: stop over-complaining about the legacy firmware
  - NFSD/blocklayout: Fix minlength check in proc_layoutget
  - tracefs: fix a leak in eventfs_create_events_dir()
  - watchdog: starfive: Fix resource leak in probe error path
  - watchdog: wdat_wdt: Fix ACPI table leak in probe function
  - selftests/bpf: Fix failure paths in send_signal test
  - bpf: Handle return value of ftrace_set_filter_ip in register_fentry
  - ps3disk: use memcpy_{from,to}_bvec index
  - arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 5A
  - arm64: dts: rockchip: Move the EEPROM to correct I2C bus on Radxa ROCK 5A
  - PCI: keystone: Exit ks_pcie_probe() for invalid mode
  - leds: netxbig: Fix GPIO descriptor leak in error paths
  - scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls
  - ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint()
  - ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent()
  - lib/vsprintf: Check pointer before dereferencing in time_and_date()
  - clk: renesas: r9a06g032: Fix memory leak in error path
  - coresight: etm4x: Add context synchronization before enabling trace
  - coresight: etm4x: Extract the trace unit controlling
  - coresight: etm4x: Correct polling IDLE bit
  - wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper()
  - powerpc/32: Fix unpaired stwcx. on interrupt exit
  - cpufreq/amd-pstate: Call cppc_set_auto_sel() only for online CPUs
  - scsi: ufs: core: fix incorrect buffer duplication in ufshcd_read_string_desc()
  - ARM: dts: stm32: stm32mp157c-phycore: Fix STMPE811 touchscreen node properties
  - RDMA/rtrs: server: Fix error handling in get_or_create_srv
  - dt-bindings: PCI: amlogic: Fix the register name of the DBI region
  - staging: most: remove broken i2c driver
  - staging: most: i2c: Drop explicit initialization of struct i2c_device_id::driver_data to 0
  - scsi: stex: Fix reboot_notifier leak in probe error path
  - regulator: core: disable supply if enabling main regulator fails
  - perf/x86/intel: Correct large PEBS flag check
  - ext4: correct the checking of quota files before moving extents
  - mfd: da9055: Fix missing regmap_del_irq_chip() in error path
  - efi/libstub: Fix page table access in 5-level to 4-level paging transition
  - x86/boot: Fix page table access in 5-level to 4-level paging transition
  - ARM: dts: omap3: n900: Correct obsolete TWL4030 power compatible
  - ARM: dts: omap3: beagle-xm: Correct obsolete TWL4030 power compatible
  - ARM: dts: am335x-netcom-plus-2xx: add missing GPIO labels
  - spi: tegra210-quad: Fix timeout handling
  - fs/9p: Don't open remote file with APPEND mode when writeback cache is used
  - scsi: target: Do not write NUL characters into ASCII configfs output
  - power: supply: apm_power: only unset own apm_get_power_status
  - power: supply: wm831x: Check wm831x_set_bits() return value
  - power: supply: rt9467: Prevent using uninitialized local variable in rt9467_set_value_from_ranges()
  - power: supply: rt9467: Return error on failure in rt9467_set_value_from_ranges()
  - power: supply: cw2015: Check devm_delayed_work_autocancel() return code
  - perf record: skip synthesize event when open evsel failed
  - perf lock contention: Load kernel map before lookup
  - perf maps: Add maps__load_first()
  - interconnect: debugfs: Fix incorrect error handling for NULL path
  - arm64: dts: qcom: msm8996: add interconnect paths to USB2 controller
  - interconnect: qcom: msm8996: add missing link to SLAVE_USB_HS
  - i3c: master: svc: Prevent incomplete IBI transaction
  - i3c: fix refcount inconsistency in i3c_master_register
  - i3c: master: Inherit DMA masks and parameters from parent device
  - pinctrl: stm32: fix hwspinlock resource leak in probe function
  - soc: qcom: smem: fix hwspinlock resource leak in probe error paths
  - tools/nolibc/stdio: let perror work when NOLIBC_IGNORE_ERRNO is set
  - mtd: rawnand: lpc32xx_slc: fix GPIO descriptor leak on probe error and remove
  - mtd: nand: relax ECC parameter validation check
  - Revert "mtd: rawnand: marvell: fix layouts"
  - ARM: dts: renesas: r9a06g032-rzn1d400-db: Drop invalid #cells properties
  - ARM: dts: renesas: gose: Remove superfluous port property
  - sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock().
  - phy: mscc: Fix PTP for VSC8574 and VSC8572
  - arm64: dts: qcom: sdm845-oneplus: Correct gpio used for slider
  - firmware: imx: scu-irq: fix OF node leak in
  - arm64: dts: ti: k3-am62p: Fix memory ranges for GPU
  - s390/ap: Don't leak debug feature files if AP instructions are not available
  - s390/smp: Fix fallback CPU detection
  - wifi: ath11k: fix peer HE MCS assignment
  - clk: qcom: camcc-sm6350: Fix PLL config of PLL2
  - clk: qcom: camcc-sm6350: Specify Titan GDSC power domain as a parent to other
  - uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe
  - PCI: rcar-gen2: Drop ARM dependency from PCI_RCAR_GEN2
  - arm64: dts: imx8mp-venice-gw702x: remove off-board sdhc1
  - arm64: dts: imx8mp-venice-gw702x: remove off-board uart
  - arm64: dts: imx8mm-venice-gw72xx: remove unused sdhc1 pinctrl
  - arm64: dts: freescale: imx8mp-venice-gw7905-2x: remove duplicate usdhc1 props
  - iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member
  - inet: Avoid ehash lookup race in inet_ehash_insert()
  - rculist: Add hlist_nulls_replace_rcu() and hlist_nulls_replace_init_rcu()
  - ntfs3: fix uninit memory after failed mi_read in mi_format_new
  - crypto: authenc - Correctly pass EINPROGRESS back up to the caller
  - irqchip/qcom-irq-combiner: Fix section mismatch
  - irqchip/imx-mu-msi: Fix section mismatch
  - irqchip/irq-brcmstb-l2: Fix section mismatch
  - irqchip/irq-bcm7120-l2: Fix section mismatch
  - irqchip/irq-bcm7038-l1: Fix section mismatch
  - objtool: Fix weak symbol detection
  - objtool: Fix standalone --hacks=jump_label
  - HID: logitech-hidpp: Do not assume FAP in hidpp_send_message_sync()
  - clk: renesas: cpg-mssr: Read back reset registers to assure values latched
  - clk: renesas: Pass sub struct of cpg_mssr_priv to cpg_clk_register
  - clk: renesas: Use str_on_off() helper
  - clk: renesas: rzg2l: Use %x format specifier to print CLK_ON_R()
  - clk: renesas: rzg2l: Remove critical area
  - clk: renesas: rzg2l: Simplify the logic in rzg2l_mod_clock_endisable()
  - clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle callback
  - USB: Fix descriptor count when handling invalid MBIM extended descriptor
  - drm/vgem-fence: Fix potential deadlock on release
  - drm/panel: visionox-rm69299: Don't clear all mode flags
  - gpu: host1x: Fix race in syncpt alloc/free
  - smack: fix bug: unprivileged task can create labels
  - staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing
  - staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing
  - staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser
  - comedi: check device's attached status in compat ioctls
  - comedi: multiq3: sanitize config options in multiq3_attach()
  - comedi: c6xdigio: Fix invalid PNP driver unregistration
  - wifi: rtw88: Add USB ID 2001:3329 for D-Link AC13U rev. A1
  - samples: work around glibc redefining some of our defines wrong
  - HID: elecom: Add support for ELECOM M-XT3URBK (018F)
  - platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally
  - platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list
  - platform/x86: huawei-wmi: add keys for HONOR models
  - HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list
  - platform/x86: acer-wmi: Ignore backlight event
  - pinctrl: qcom: msm: Fix deadlock in pinmux configuration
  - HID: hid-input: Extend Elan ignore battery quirk to USB
  - bfs: Reconstruct file type when loading from disk
  - ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series
  - smb: fix invalid username check in smb3_fs_context_parse_param()
  - Bluetooth: btrtl: Avoid loading the config file on security chips
  - drm/vmwgfx: Use kref in vmw_bo_dirty
  - spi: imx: keep dma request disabled before dma transfer setup
  - spi: xilinx: increase number of retries before declaring stall
  - ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct()
  - USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC
  - USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC
  - serial: add support of CPCI cards
  - USB: serial: ftdi_sio: match on interface number for jtag
  - USB: serial: option: move Telit 0x10c7 composition in the right place
  - USB: serial: option: add Telit Cinterion FE910C04 new compositions
  - USB: serial: option: add Foxconn T99W760
  - comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel()
  - locking/spinlock/debug: Fix data-race in do_raw_write_lock
  - ksmbd: ipc: fix use-after-free in ipc_msg_send_request
  - Documentation: process: Also mention Sasha Levin as stable tree maintainer
  - leds: spi-byte: Use devm_led_classdev_register_ext()
  - fs: aio: set VMA_DONTCOPY_BIT in mmap to fix NULL-pointer-dereference error
  - Solve kernel ABI issue introduced by x86_max_cores updates
  - x86/acpi/boot: Correct acpi_is_processor_usable() check again
  - x86/xen: mark boot CPU of PV guest in MSR_IA32_APICBASE
  - x86/topology: Handle the !APIC case gracefully
  - x86/acpi: Don't limit CPUs to 1 for Xen PV guests due to disabled ACPI
  - x86/cpu/topology: Remove limit of CPUs due to disabled IO/APIC
  - x86/topology: Handle bogus ACPI tables correctly
  - x86/xen/smp_pv: Register the boot CPU APIC properly
  - x86/topology: Don't update cpu_possible_map in topo_set_cpuids()
  - x86/topology: Don't evaluate logical IDs during early boot
  - x86/topology: Ignore non-present APIC IDs in a present package
  - x86/cpu/topology: Get rid of cpuinfo::x86_max_cores
  - x86/cpu/topology: Provide __num_[cores|threads]_per_package
  - x86/cpu/topology: Rename topology_max_die_per_package()
  - x86/cpu/topology: Rename smp_num_siblings
  - x86/cpu/topology: Retrieve cores per package from topology bitmaps
  - x86/cpu/topology: Use topology logical mapping mechanism
  - x86/cpu/topology: Provide logical pkg/die mapping
  - x86/cpu/topology: Simplify cpu_mark_primary_thread()
  - x86/cpu/topology: Mop up primary thread mask handling
  - x86/cpu/topology: Use topology bitmaps for sizing
  - x86/cpu/topology: Let XEN/PV use topology from CPUID/MADT
  - x86/xen/smp_pv: Count number of vCPUs early
  - x86/cpu/topology: Assign hotpluggable CPUIDs during init
  - x86/cpu/topology: Reject unknown APIC IDs on ACPI hotplug
  - x86/topology: Add a mechanism to track topology via APIC IDs
  - x86/cpu: Detect real BSP on crash kernels
  - x86/cpu/topology: Rework possible CPU management
  - x86/cpu/topology: Sanitize the APIC admission logic
  - x86/smpboot: Make error message actually useful
  - x86/cpu/topology: Use a data structure for topology info
  - x86/cpu/topology: Simplify APIC registration
  - x86/cpu/topology: Confine topology information
  - x86/xen/smp_pv: Register fake APICs
  - x86/acpi: Dont invoke topology_register_apic() for XEN PV
  - x86/mpparse: Use new APIC registration function
  - x86/of: Use new APIC registration functions
  - x86/jailhouse: Use new APIC registration function
  - x86/acpi: Use new APIC registration functions
  - x86/cpu/topology: Provide separate APIC registration functions
  - x86/cpu/topology: Move registration out of APIC code
  - x86/of: Set the parse_smp_cfg for all the DeviceTree platforms by default
  - x86/hyperv/vtl: Correct x86_init.mpparse.parse_smp_cfg assignment
  - x86/of: Move the x86_flattree_get_config() call out of x86_dtb_init()
  - x86/apic: Use a proper define for invalid ACPI CPU ID
  - x86/apic: Remove yet another dubious callback
  - x86/apic: Remove the pointless writeback of boot_cpu_physical_apicid
  - x86/mpparse: Remove the physid_t bitmap wrapper
  - x86/mm/numa: Move early mptable evaluation into common code
  - x86/mpparse: Switch to new init callbacks
  - x86/hyperv/vtl: Prepare for separate mpparse callbacks
  - x86/xen/smp_pv: Prepare for separate mpparse callbacks
  - x86/jailhouse: Prepare for separate mpparse callbacks
  - x86/platform/intel-mid: Prepare for separate mpparse callbacks
  - x86/platform/ce4100: Prepare for separate mpparse callbacks
  - x86/dtb: Rename x86_dtb_init()
  - x86/mpparse: Prepare for callback separation
  - x86/mpparse: Provide separate early/late callbacks
  - x86/mpparse: Rename default_find_smp_config()
  - x86/apic: Remove check_apicid_used() and ioapic_phys_id_map()
  - x86/ioapic: Simplify setup_ioapic_ids_from_mpc_nocheck()
  - x86/ioapic: Make io_apic_get_unique_id() simpler
  - x86/apic: Get rid of get_physical_broadcast()
  - x86/ioapic: Replace some more set bit nonsense
  - x86/platform/ce4100: Dont override x86_init.mpparse.setup_ioapic_ids
  - x86/xen: return a sane initial apic id when running as PV guest
  - x86/cpu/topology: Make the APIC mismatch warnings complete
  - Solve kernel ABI issues introduced by x86_coreid_bits updates
  - x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON
  - x86/apic/uv: Remove the private leaf 0xb parser
  - x86/xen/smp_pv: Remove cpudata fiddling
  - x86/apic: Remove unused phys_pkg_id() callback
  - x86/cpu: Remove x86_coreid_bits
  - x86/cpu: Remove topology.c
  - x86/cpu: Make topology_amd_node_id() use the actual node info
  - x86/mm/numa: Use core domain size on AMD
  - x86/cpu: Use common topology code for HYGON
  - x86/cpu: Use common topology code for AMD
  - x86/smpboot: Teach it about topo.amd_node_id
  - x86/topology/amd: Evaluate SMT in CPUID leaf 0x8000001e only on family 0x17 and greater
  - x86/topology/amd: Ensure that LLC ID is initialized
  - x86/cpu/amd: Move TOPOEXT enablement into the topology parser
  - x86/cpu/amd: Make the NODEID_MSR union actually work
  - x86/cpu/amd: Make the CPUID 0x80000008 parser correct
  - x86/cpu: Provide an AMD/HYGON specific topology parser
  - x86/cpu/amd: Provide a separate accessor for Node ID
  - x86/topology/intel: Unlock CPUID before evaluating anything
  - x86/cpu: Use common topology code for Intel
  - x86/cpu: Provide a sane leaf 0xb/0x1f parser
  - x86/cpu: Move __max_die_per_package to common.c
  - x86/cpu: Use common topology code for Centaur and Zhaoxin
  - x86/cpu: Add legacy topology parser
  - x86/cpu: Provide cpu_init/parse_topology()
  - x86/cpuid: Include <linux/build_bug.h> in <asm/cpuid.h>
  - x86/cpu: Provide cpuid_read() et al.
  - Revert "RAS/AMD/ATL: fix error nodes per socket on for Hygon Dhyana processor"
  - Solve kernel ABI issues introduced by cpuinfo_x86 updates
  - x86/cpu: Provide debug interface
  - x86/cpu/topology: Cure the abuse of cpuinfo for persisting logical ids
  - x86/apic, x86/hyperv: Use u32 in hv_snp_boot_ap() too
  - x86/apic: Use u32 for wakeup_secondary_cpu[_64]()
  - x86/apic: Use u32 for [gs]et_apic_id()
  - x86/apic: Use u32 for phys_pkg_id()
  - x86/apic: Use u32 for cpu_present_to_apicid()
  - x86/apic: Use u32 for check_apicid_used()
  - x86/apic: Use u32 for APIC IDs in global data
  - x86/apic: Use BAD_APICID consistently
  - x86/cpu: Move cpu_l[l2]c_id into topology info
  - x86/cpu: Move logical package and die IDs into topology info
  - x86/cpu: Move cu_id into topology info
  - x86/cpu: Move cpu_core_id into topology info
  - hwmon: (fam15h_power) Use topology_core_id()
  - scsi: lpfc: Use topology_core_id()
  - x86/cpu: Move cpu_die_id into topology info
  - x86/cpu: Move phys_proc_id into topology info
  - x86/cpu: Encapsulate topology information in cpuinfo_x86
  - urma: fix bonding udata exchange for imported seg/jetty objects.
  - Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user
  - urma: fix log error in connect
  - urma: fix kmod log format error
  - x86/uprobes: Fix XOL allocation failure for 32-bit tasks
  - pstore/ram: fix buffer overflow in persistent_ram_save_old()
  - urma: fix ubcore connect error
  - urma: fix error for setting conn timeout
  - ub: udma: change return value format.
  - drivers/ub/sentry: add some log for sent_cnt and remote_recv_cnt
  - drivers/ub/sentry: Refactor the message data format sent via UVB/URMA
  - net/mlx5e: Fix race condition during IPSec ESN update
  - ub/ubdevshm: Fix register segment failed issue in multi-thread scenario
  - nvdimm/bus: Fix potential use after free in asynchronous initialization
  - urma: fix bind jetty compat error
  - net/mlx5e: Prevent concurrent access to IPSec ASO context
  - urma: change urma kmod errno
  - urma:delete redundant sub_trans_mode_cap in urma
  - RDMA/hns: Fix config the CNP DSCP
  - RDMA/hns: Fix the panic caused by a large number of print
  - media: dvb-net: fix OOB access in ULE extension header tables
  - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure
  - urma: bonding support health check
  - xSched: update xSched manual for xcu cmdline enable option
  - xSched: enable CONFIG_CGROUP_XCU and CONFIG_XCU_SCHED_CFS in arm64/x86 defconfig
  - cgroup: sync CGROUP_SUBSYS_COUNT limit with upstream to 16
  - xSched/cgroup: make xcu.stat invisible at root cgroup
  - xSched/cgroup: reuse SUBSYS for xcu and freezer to preserve KABI
  - apparmor: validate DFA start states are in bounds in unpack_pdb
  - tcp: secure_seq: add back ports to TS offset
  - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold
  - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access
  - ice: Fix memory leak in ice_set_ringparam()
  - bpf: Fix regsafe() for pointers to packet
  - drivers/ub/sentry: add lock for update global variables and change some global variables to local variables


author: Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.0.4.144
changelog:
  - !21886 urma: fix peer reconnection notification after ubagg failover
  - urma: fix peer reconnection notification after ubagg failover
  - urma: add configurable retransmission count limit
  - urma: fix tjetty creation anomaly in the first connection creation
  - !21879 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-147.0.0 to 6.6.0-148.0.0
  - urma: fix kernel irq profiling
  - xSched: remove redundant lookup in alloc_ctx_from_vstream to enforce allocation semantics
  - xSched/cgroup: prevent to init xse when xcu cgroup is disabled
  - urma: fix the panic issue caused by ipourma abnormal exit
  - net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check
  - net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume
  - net: macb: Introduce gem_init_rx_ring()
  - net: macb: queue tie-off or disable during WOL suspend
  - net: macb: Shuffle the tx ring before enabling tx
  - net: macb: Fix tx/rx malfunction after phy link down and up
  - hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler optimization induced race
  - net: openvswitch: Avoid releasing netdev before teardown completes
  - ext4: fix error message when rejecting the default hash
  - ext4: filesystems without casefold feature cannot be mounted with siphash
  - Revert "iommu/amd: Skip enabling command/event buffers for kdump"
  - firmware: arm_scmi: Fix unused notifier-block in unregister
  - tty: fix tty_port_tty_*hangup() kernel-doc
  - pwm: stm32: Always program polarity
  - virtio_console: fix order of fields cols and rows
  - mm/damon/tests/core-kunit: handle alloc failures in damon_test_update_monitoring_result()
  - mm/damon/tests/core-kunit: handle alloc failure on damon_test_set_attrs()
  - mm/damon/tests/core-kunit: handle alloc failures in damon_test_ops_registration()
  - mm/damon/tests/core-kunit: handle alloc failures in damon_test_set_regions()
  - mm/damon/tests/core-kunit: handle alloc failures on damos_test_filter_out()
  - mm/damon/tests/core-kunit: handle memory alloc failure from damon_test_aggregate()
  - mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_regions_of()
  - mm/damon/tests/core-kunit: handle memory failure from damon_test_target()
  - mm/damon/tests/core-kunit: handle alloc failures on damon_test_merge_two()
  - mm/damon/tests/core-kunit: handle alloc failures on dasmon_test_merge_regions_of()
  - mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_at()
  - mm/damon/tests/core-kunit: handle allocation failures in damon_test_regions()
  - mm/damon/tests/core-kunit: handle alloc failres in damon_test_new_filter()
  - mm/damon/tests/vaddr-kunit: handle alloc failures on damon_test_split_evenly_succ()
  - net: Allow to use SMP threads for backlog NAPI.
  - net: Remove conditional threaded-NAPI wakeup based on task state.
  - sched/fair: Small cleanup to sched_balance_newidle()
  - mm/damon/tests/vaddr-kunit: handle alloc failures on damon_do_test_apply_three_regions()
  - mm/damon/tests/vaddr-kunit: handle alloc failures in damon_test_split_evenly_fail()
  - media: mediatek: vcodec: Use spinlock for context list protection lock
  - media: amphion: Remove vpu_vb_is_codecconfig
  - media: amphion: Make some vpu_v4l2 functions static
  - media: amphion: Add a frame flush mode for decoder
  - KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit
  - powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages
  - mm/balloon_compaction: convert balloon_page_delete() to balloon_page_finalize()
  - mm/balloon_compaction: we cannot have isolated pages in the balloon list
  - media: verisilicon: Fix CPU stalls on G2 bus error
  - media: verisilicon: g2: Use common helpers to compute chroma and mv offsets
  - media: verisilicon: Store chroma and motion vectors offset
  - f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes()
  - f2fs: use global inline_xattr_slab instead of per-sb slab cache
  - f2fs: fix to propagate error from f2fs_enable_checkpoint()
  - f2fs: fix to avoid updating compression context during writeback
  - f2fs: drop inode from the donation list when the last file is closed
  - f2fs: keep POSIX_FADV_NOREUSE ranges
  - f2fs: remove unused GC_FAILURE_PIN
  - ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all()
  - powerpc/64s/radix/kfence: map __kfence_pool at page granularity
  - drm/mediatek: Fix probe resource leaks
  - drm/mediatek: Fix probe memory leak
  - drm/amdgpu: Forward VMID reservation errors
  - net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration
  - pmdomain: imx: Fix reference count leak in imx_gpc_probe()
  - pmdomain: Use device_get_match_data()
  - wifi: mac80211: Discard Beacon frames to non-broadcast address
  - lockd: fix vfs_test_lock() calls
  - mptcp: fallback earlier on simult connection
  - PCI: brcmstb: Fix disabling L0s capability
  - ARM: dts: microchip: sama7g5: fix uart fifo size to 32
  - gpiolib: acpi: Add quirk for Dell Precision 7780
  - NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap
  - scsi: ufs: core: Add ufshcd_update_evt_hist() for UFS suspend error
  - usb: ohci-nxp: fix device leak on probe failure
  - usb: ohci-nxp: Use helper function devm_clk_get_enabled()
  - mm/ksm: fix exec/fork inheritance support for prctl
  - wifi: mt76: Fix DTS power-limits on little endian systems
  - btrfs: don't rewrite ret from inode_permission
  - gfs2: fix freeze error handling
  - jbd2: fix the inconsistency between checksum and data in memory for journal sb
  - ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi()
  - ALSA: wavefront: Clear substream pointers on close
  - ALSA: wavefront: Use guard() for spin locks
  - ALSA: wavefront: Fix integer overflow in sample size validation
  - ALSA: wavefront: Use standard print API
  - drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb
  - drm/msm/dpu: Add missing NULL pointer check for pingpong interface
  - drm/mgag200: Fix big-endian support
  - drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse()
  - drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg()
  - drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers
  - drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma
  - net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to macb_open()
  - net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write
  - net: usb: sr9700: fix incorrect command used to write single register
  - nfsd: Drop the client reference in client_states_open()
  - LoongArch: BPF: Zero-extend bpf_tail_call() index
  - fjes: Add missing iounmap in fjes_hw_init()
  - samples/ftrace: Adjust LoongArch register restore order in direct calls
  - tools/mm/page_owner_sort: fix timestamp comparison for stable sorting
  - idr: fix idr_alloc() returning an ID out of range
  - kasan: refactor pcpu kasan vmalloc unpoison
  - compiler_types.h: add "auto" as a macro for "__auto_type"
  - LoongArch: Use unsigned long for _end and _text
  - LoongArch: Use __pmd()/__pte() for swap entry conversions
  - LoongArch: Fix build errors for CONFIG_RANDSTRUCT
  - LoongArch: Add new PCI ID for pci_fixup_vgadev()
  - media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init()
  - media: i2c: adv7842: Remove redundant cancel_delayed_work in probe
  - media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe
  - media: amphion: Cancel message work before releasing the VPU core
  - media: vpif_display: fix section mismatch
  - media: vpif_capture: fix section mismatch
  - media: videobuf2: Fix device reference leak in vb2_dc_alloc error path
  - media: verisilicon: Protect G2 HEVC decoder against invalid DPB index
  - media: TDA1997x: Remove redundant cancel_delayed_work in probe
  - media: samsung: exynos4-is: fix potential ABBA deadlock on init
  - media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled
  - media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread()
  - media: cec: Fix debugfs leak on bus_register() failure
  - fbdev: tcx.c fix mem_map to correct smem_start offset
  - fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing
  - fbdev: gbefb: fix to use physical address instead of dma address
  - dm-bufio: align write boundary on physical block size
  - dm-ebs: Mark full buffer dirty even on partial write
  - firmware: stratix10-svc: Add mutex in stratix10 memory management
  - media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status()
  - powerpc/pseries/cmm: call balloon_devinfo_init() also without CONFIG_BALLOON_COMPACTION
  - parisc: entry: set W bit for !compat tasks in syscall_restore_rfi()
  - parisc: entry.S: fix space adjustment on interruption for 64-bit userspace
  - media: rc: st_rc: Fix reset control resource leak
  - mfd: max77620: Fix potential IRQ chip conflict when probing two devices
  - mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup
  - clk: samsung: exynos-clkout: Assign .num before accessing .hws
  - leds: leds-lp50xx: Enable chip before any communication
  - leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs
  - leds: leds-lp50xx: Allow LED 0 to be added to module bank
  - powerpc, mm: Fix mprotect on book3s 32-bit
  - PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths
  - HID: logitech-dj: Remove duplicate error logging
  - iommu: disable SVA when CONFIG_X86 is set
  - iommu/tegra: fix device leak on probe_device()
  - iommu/sun50i: fix device leak on of_xlate()
  - iommu/qcom: fix device leak on of_xlate()
  - iommu/omap: fix device leaks on probe_device()
  - iommu/mediatek: fix device leak on of_xlate()
  - iommu/mediatek-v1: fix device leaks on probe()
  - iommu/mediatek-v1: fix device leak on probe_device()
  - iommu/ipmmu-vmsa: fix device leak on of_xlate()
  - iommu/exynos: fix device leak on of_xlate()
  - iommu/apple-dart: fix device leak on of_xlate()
  - iommu/amd: Fix pci_segment memleak in alloc_pci_segment()
  - ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment.
  - ASoC: qcom: q6adm: the the copp device only during last instance
  - ASoC: qcom: q6asm-dai: perform correct state check before closing
  - ASoC: qcom: q6apm-dai: set flags to reflect correct operation of appl_ptr
  - ASoC: stm32: sai: fix OF node leak on probe
  - ASoC: stm32: sai: fix clk prepare imbalance on probe failure
  - ASoC: stm32: sai: fix device leak on probe
  - ntfs: Do not overwrite uptodate pages
  - selftests/ftrace: traceonoff_triggers: strip off names
  - RDMA/bnxt_re: fix dma_free_coherent() pointer
  - RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation
  - ksmbd: Fix memory leak in get_file_all_info()
  - RDMA/bnxt_re: Fix to use correct page size for PDE table
  - RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send
  - RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db()
  - RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr()
  - RDMA/efa: Remove possible negative shift
  - RDMA/irdma: avoid invalid read in irdma_net_event
  - net: rose: fix invalid array index in rose_kill_by_device()
  - net: stmmac: fix the crash issue for zero copy XDP_TX action
  - octeontx2-pf: fix "UBSAN: shift-out-of-bounds error"
  - platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing
  - net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct
  - net: dsa: b53: skip multicast entries for fdb_dump()
  - firewire: nosy: Fix dma_free_coherent() size
  - genalloc.h: fix htmldocs warning
  - selftests: net: fix "buffer overflow detected" for tap.c
  - amd-xgbe: reset retries and mode on RX adapt failures
  - platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic
  - platform/x86: msi-laptop: add missing sysfs_remove_group()
  - net: openvswitch: Avoid needlessly taking the RTNL on vport destroy
  - net: mdio: aspeed: add dummy read to avoid read-after-write issue
  - Bluetooth: btusb: revert use of devm_kzalloc in btusb
  - i40e: fix scheduling in set_rx_mode
  - wifi: mac80211: do not use old MBSSID elements
  - iommu/mediatek: fix use-after-free on probe deferral
  - ARM: dts: microchip: sama5d2: fix spi flexcom fifo size to 32
  - hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU
  - hwmon: (w83791d) Convert macros to functions to avoid TOCTOU
  - hwmon: (max16065) Use local variable to avoid TOCTOU
  - i2c: amd-mp2: fix reference leak in MP2 PCI device
  - platform/x86: intel: chtwc_int33fe: don't dereference swnode args
  - rpmsg: glink: fix rpmsg device leak
  - ub: udma: fix a bug related to get tp list.
  - perf/core: Fix race between perf_event_exit_task and perf_pending_task
  - userfaultfd: fix kabi breakage due to struct userfaultfd_ctx
  - mm/mremap: fix WARN with uffd that has remap events disabled
  - mm: clear uffd-wp PTE/PMD state on mremap()
  - userfaultfd: move userfaultfd_ctx struct to header file
  - urma: add timeout mechanism for TP state waiting loop
  - ub: udma: bugfix related to stars jfc db.
  - net: usb: kaweth: validate USB endpoints
  - arm64: mm: fix pass user prot to ioremap_prot in generic_access_phys
  - RDMA/hns: Support setting GSI QP SL
  - RDMA/hns: Fix warning in poll cq direct mode
  - RDMA/hns: Fix missing CQE when UD QP use different SL
  - ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz
  - xsk: introduce helper to determine rxq->frag_size
  - drm/logicvc: Fix device node reference leak in logicvc_drm_config_parse()
  - urma: fix log implementation in urma kmod
  - urma: fix deactivate tp failure under RM share TP mode
  - net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check
  - smb: client: fix krb5 mount with username option
  - io_uring/poll: fix multishot recv missing EOF on wakeup race
  - io_uring/poll: improve readability of poll reference decrementing
  - LoongArch: efi: avoid double calling set_virtual_map()
  - LoongArch: Fix the improper handling of the set_virtual_map's return value
  - LoongArch: Disable instrumentation for setup_ptwalker()
  - LoongArch: Remove some code if kasan_arch_is_ready() is false
  - LoongArch: entry: Migrate ret_from_fork() to C
  - LoongArch: Clarify 3 MSG interrupt features
  - LoongArch: Always select HAVE_VIRT_CPU_ACCOUNTING_GEN
  - drivers/amdgpu: amd rx550 should emit 10 fences after run a command
  - LoongArch: Fix AP booting issue in VM mode
  - LoongArch: Increase COMMAND_LINE_SIZE up to 4096
  - LoongArch: Relax memory ordering for atomic operations
  - pci/quirks: 2k3000: set discrete GPU as default boot device if present
  - drm/amdgpu: Make eleven EOP packet for GFX10_0/GFX11_0 have real content
  - urma: fix of adapt to bondp_import
  - ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()
  - ACPI: APEI: GHES: Don't send SIGBUS to kernel threads on ARM HW errors
  - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()
  - net/sched: teql: Fix double-free in teql_master_xmit
  - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case
  - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp()
  - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()
  - udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n
  - ipv6: add NULL checks for idev in SRv6 paths
  - net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()
  - sunrpc: fix cache_request leak in cache_release
  - urma: fix psn exchange anomaly when import jfr
  - mfs: fix race condition issue in try_hook_fd()
  - drivers/loongson-pwm: sync master patch to fix pwm driver
  - LoongArch:stmmac:fix mdc too high issues.
  - LoongArch: gpio: read/write mode to 8bit in BIT_CTRL_MODE
  - drivers/pwm: export symbol for pwm_add_table
  - LoongArch: config: Revert CONFIG_RTC_DRV_EFI back to 'm'
  - urma: fix psn exchange anomaly under share_tp mode
  - RNP: NET: Update driver to 1.0.0
  - RNPGBE: NET: Update driver to 1.0.0
  - net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown
  - intel_th: fix device leak on output open()
  - usb: gadget: lpc32xx_udc: fix clock imbalance in error path
  - Revert "hwmon: (ibmpex) fix use-after-free in high/low store"
  - efi/cper: Fix cper_bits_to_str buffer handling and return value
  - soc: amlogic: canvas: fix device leak on lookup
  - soc: qcom: ocmem: fix device leak on lookup
  - tracing: Fix fixed array of synthetic event
  - amba: tegra-ahb: Fix device leak on SMMU enable
  - crypto: caam - Add check for kcalloc() in test_len()
  - selftests: openvswitch: Fix escape chars in regexp.
  - drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state()
  - s390/ipl: Clear SBP flag when bootprog is set
  - btrfs: don't log conflicting inode if it's a dir moved in the current transaction
  - svcrdma: return 0 on success from svc_rdma_copy_inline_range
  - nfsd: Mark variable __maybe_unused to avoid W=1 build break
  - net/handshake: restore destructor on submit failure
  - r8169: fix RTL8117 Wake-on-Lan in DASH mode
  - xfs: fix a memory leak in xfs_buf_item_init()
  - KVM: nSVM: Clear exit_code_hi in VMCB when synthesizing nested VM-Exits
  - KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN)
  - KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN
  - KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation
  - KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN
  - KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE
  - KVM: x86: Explicitly set new periodic hrtimer expiration in apic_timer_fn()
  - KVM: x86: WARN if hrtimer callback for periodic APIC timer fires with period=0
  - parisc: Do not reprogram affinitiy on ASP chip
  - scs: fix a wrong parameter in __scs_magic
  - platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver
  - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI)
  - ocfs2: fix kernel BUG in ocfs2_find_victim_chain
  - media: vidtv: initialize local pointers upon transfer of memory ownership
  - tools/testing/nvdimm: Use per-DIMM device handle
  - f2fs: fix return value of f2fs_recover_fsync_data()
  - f2fs: fix age extent cache insertion skip on counter overflow
  - f2fs: invalidate dentry cache on failed whiteout creation
  - f2fs: fix to avoid updating zero-sized extent in extent cache
  - f2fs: ensure node page reads complete before f2fs_put_super() finishes
  - NFSD: use correct reservation type in nfsd4_scsi_fence_client
  - scsi: aic94xx: fix use-after-free in device removal path
  - cpufreq: nforce2: fix reference count leak in nforce2
  - cpuidle: governors: teo: Drop misguided target residency check
  - intel_th: Fix error handling in intel_th_output_open
  - char: applicom: fix NULL pointer dereference in ac_ioctl
  - usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc()
  - usb: dwc3: keep susphy enabled during exit to avoid controller faults
  - usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe
  - usb: phy: isp1301: fix non-OF device reference imbalance
  - usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal
  - USB: lpc32xx_udc: Fix error handling in probe
  - phy: broadcom: bcm63xx-usbh: fix section mismatches
  - media: pvrusb2: Fix incorrect variable used in trace message
  - usb: usb-storage: Maintain minimal modifications to the bcdDevice range.
  - media: v4l2-mem2mem: Fix outdated documentation
  - jbd2: use a weaker annotation in journal handling
  - jbd2: use a per-journal lock_class_key for jbd2_trans_commit_key
  - ext4: fix incorrect group number assertion in mb_check_buddy
  - ktest.pl: Fix uninitialized var in config-bisect.pl
  - kallsyms: Fix wrong "big" kernel symbol type read from procfs
  - floppy: fix for PAGE_SIZE != 4KB
  - block: rate-limit capacity change info log
  - s390/dasd: Fix gendisk parent after copy pair swap
  - lib/crypto: x86/blake2s: Fix 32-bit arg treated as 64-bit
  - mmc: sdhci-msm: Avoid early clock doubling during HS400 transition
  - vhost/vsock: improve RCU read sections around vhost_vsock_get()
  - block: rnbd-clt: Fix signedness bug in init_dev()
  - platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks
  - nvme-fc: don't hold rport lock when putting ctrl
  - i2c: designware: Disable SMBus interrupts to prevent storms from mis-configured firmware
  - libperf cpumap: Fix perf_cpu_map__max for an empty/NULL map
  - serial: sprd: Return -EPROBE_DEFER when uart clock is not ready
  - usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive.
  - usb: xhci: limit run_graceperiod for only usb 3.0 devices
  - iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc complains
  - usbip: Fix locking bug in RT-enabled kernels
  - exfat: fix remount failure in different process environments
  - reset: fix BIT macro reference
  - via_wdt: fix critical boot hang due to unnamed resource allocation
  - fuse: Invalidate the page cache after FOPEN_DIRECT_IO write
  - fuse: Always flush the page cache before FOPEN_DIRECT_IO write
  - scsi: qla2xxx: Use reinit_completion on mbx_intr_comp
  - scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive
  - scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled
  - powerpc/addnote: Fix overflow on 32-bit builds
  - clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 & pcie_x4
  - ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx
  - firmware: imx: scu-irq: Init workqueue before request mbox channel
  - ipmi: Fix __scan_channels() failing to rescan channels
  - ipmi: Fix the race between __scan_channels() and deliver_response()
  - ALSA: usb-mixer: us16x08: validate meter packet indices
  - ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path
  - ALSA: vxpocket: Fix resource leak in vxpocket_probe error path
  - net/hsr: fix NULL pointer dereference in prp_get_untagged_frame()
  - dt-bindings: mmc: sdhci-of-aspeed: Switch ref to sdhci-common.yaml
  - mmc: sdhci-esdhc-imx: add alternate ARCH_S32 dependency to Kconfig
  - spi: fsl-cpm: Check length parity before switching to 16 bit mode
  - can: gs_usb: gs_can_open(): fix error handling
  - Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table
  - Input: ti_am335x_tsc - fix off-by-one error in wire_order validation
  - HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen
  - ksmbd: fix buffer validation by including null terminator size in EA length
  - ksmbd: skip lock-range check on equal size to avoid size==0 underflow
  - block: rnbd-clt: Fix leaked ID in init_dev()
  - spi: cadence-quadspi: Fix clock disable on probe failure path
  - x86/xen: Fix sparse warning in enlighten_pv.c
  - x86/xen: Move Xen upcall handler
  - drm/panel: sony-td4353-jdi: Enable prepare_prev_first
  - MIPS: Fix a reference leak bug in ip22_check_gio()
  - hwmon: (tmp401) fix overflow caused by default conversion rate value
  - hwmon: (ibmpex) fix use-after-free in high/low store
  - net: enetc: do not transmit redirected XDP frames when the link is down
  - net/handshake: duplicate handshake cancellations leak socket
  - net/mlx5: Serialize firmware reset with devlink
  - net/mlx5: Skip HotPlug check on sync reset using hot reset
  - net/mlx5: fw_tracer, Handle escaped percent properly
  - net/mlx5: Drain firmware reset in shutdown callback
  - net/mlx5: fw reset, clear reset requested on drain_fw_reset
  - iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED
  - netfilter: nf_tables: pass context structure to nft_parse_register_load
  - nfc: pn533: Fix error code in pn533_acr122_poweron_rdr()
  - caif: fix integer underflow in cffrml_receive()
  - broadcom: b44: prevent uninitialized value usage
  - mlxsw: spectrum_router: Fix possible neighbour reference count leak
  - ipvlan: Ignore PACKET_LOOPBACK in handle_mode_l2()
  - netrom: Fix memory leak in nr_sendmsg()
  - net: fec: ERR007885 Workaround for XDP TX path
  - Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE
  - Bluetooth: btusb: Add new VID/PID 2b89/6275 for RTL8761BUV
  - ksmbd: vfs: fix race on m_flags in vfs_cache
  - gfs2: fix remote evict for read-only filesystems
  - btrfs: scrub: always update btrfs_scrub_progress::last_physical
  - wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet
  - hfsplus: fix volume corruption issue for generic/073
  - hfsplus: Verify inode mode when loading from disk
  - hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create
  - hfsplus: fix volume corruption issue for generic/070
  - ntfs: set dummy blocksize to read boot_block when mounting
  - kbuild: Use objtree for module signing key path
  - fs/ntfs3: Support timestamps prior to epoch
  - livepatch: Match old_sympos 0 and 1 in klp_find_func()
  - cpuidle: menu: Use residency threshold in polling state override decisions
  - cpufreq: s5pv210: fix refcount leak
  - cpufreq: dt-platdev: Add JH7110S SOC to the allowlist
  - ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only
  - x86/ptrace: Always inline trivial accessors
  - iomap: account for unaligned end offsets when truncating read range
  - btrfs: fix memory leak of fs_devices in degraded seed device path
  - btrfs: fix a potential path leak in print_data_reloc_error()
  - btrfs: do not skip logging new dentries when logging a new name
  - ALSA: dice: fix buffer overflow in detect_stream_formats()
  - usb: phy: Initialize struct usb_phy list_head
  - usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt
  - net: lan743x: Allocate rings outside ZONE_DMA
  - ocfs2: fix memory leak in ocfs2_merge_rec_left()
  - irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc()
  - efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs
  - efi/cper: Adjust infopfx size to accept an extra space
  - efi/cper: Add a new helper function to print bitmasks
  - dm log-writes: Add missing set_freezable() for freezable kthread
  - dm-raid: fix possible NULL dereference with undefined raid type
  - ARM: 9464/1: fix input-only operand modification in load_unaligned_zeropad()
  - ALSA: firewire-motu: add bounds check in put_user loop for DSP events
  - rtc: gamecube: Check the return value of ioremap()
  - ALSA: uapi: Fix typo in asound.h comment
  - dma/pool: eliminate alloc_pages warning in atomic_pool_expand
  - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events
  - nvme-auth: use kvfree() for memory allocated with kvcalloc()
  - ASoC: ak5558: Disable regulator when error happens
  - ASoC: ak4458: Disable regulator when error happens
  - ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure()
  - platform/x86: asus-wmi: use brightness_set_blocking() for kbd led
  - fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8()
  - NFS: Fix inheritance of the block sizes when automounting
  - Expand the type of nfs_fattr->valid
  - Revert "nfs: clear SB_RDONLY before getting superblock"
  - Revert "nfs: ignore SB_RDONLY when remounting nfs"
  - NFS: Initialise verifiers for visible dentries in nfs_atomic_open()
  - NFS: Initialise verifiers for visible dentries in readdir and lookup
  - fs/nls: Fix utf16 to utf8 conversion
  - NFS: Avoid changing nlink when file removes and attribute updates race
  - 9p: fix cache/debug options printing in v9fs_show_options
  - fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe()
  - pinctrl: single: Fix incorrect type for error return variable
  - pinctrl: single: Fix PIN_CONFIG_BIAS_DISABLE handling
  - perf tools: Fix split kallsyms DSO counting
  - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop
  - clk: keystone: fix compile testing
  - md/raid5: fix IO hang when array is broken with IO inflight
  - remoteproc: qcom_q6v5_wcss: fix parsing of qcom,halt-regs
  - mtd: lpddr_cmds: fix signed shifts in lpddr_cmds
  - selftests: bonding: add delay before each xvlan_over_bond connectivity check
  - selftests: bonding: add ipvlan over bond testing
  - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
  - NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd
  - hisi-cca-da: Fix compile warnings when CONFIG_HISI_CCA=n.
  - ub: cdma: cdma code format issue bugfix
  - i3c: master: Inherit DMA masks and parameters from parent device
  - urma: bugfix ubagg get physical dev info acquisition
  - !21874 urma: add software reliability for create and destroy connection
  - urma: add software reliability for create and destroy connection


author: Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.0.6.145
changelog:
  - !22093 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-148.0.0 to 6.6.0-149.0.0
  - gpio: rockchip: Stop calling pinctrl for set_direction
  - gpio: rockchip: mark the GPIO controller as sleeping
  - ext4: fix error message when rejecting the default hash
  - ext4: filesystems without casefold feature cannot be mounted with siphash
  - userfaultfd: fix kabi breakage due to struct userfaultfd_ctx
  - mm/mremap: fix WARN with uffd that has remap events disabled
  - mm: clear uffd-wp PTE/PMD state on mremap()
  - userfaultfd: move userfaultfd_ctx struct to header file
  - spi: fix statistics allocation
  - Revert "hwmon: (ibmpex) fix use-after-free in high/low store"
  - hwmon: (ibmpex) fix use-after-free in high/low store
  - icmp: fix NULL pointer dereference in icmp_tag_validation()
  - net/sched: act_ife: Fix metalist update behavior
  - net/sched: act_ife: avoid possible NULL deref
  - apparmor: fix missing bounds check on DEFAULT table in verify_dfa()
  - spi: fix use-after-free on controller registration failure
  - PM: runtime: Fix a race condition related to device removal
  - apparmor: fix side-effect bug in match_char() macro usage
  - urma: Kernel-mode file for bugfix to move hashtable from alloc to active
  - ipv6: avoid overflows in ip6_datagram_send_ctl()
  - netfilter: nfnetlink_log: account for netlink header size
  - netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp
  - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD
  - bpf: Fix incorrect pruning due to atomic fetch precision tracking
  - bpf: reject direct access to nullable PTR_TO_BUF pointers
  - bpf: Reject sleepable kprobe_multi programs at attach time
  - ub: udma: fix a bug related to free rcu mem
  - ub: ubase: Add a soft dependency declaration for the ubase driver
  - ub: ubase: Rectify the problem that the shutdown process ends and logs are printed
  - ub: ubase: Verify the length of ctrlq rq msg
  - ub: ubase: debugfs supports tpg context query
  - perf: Make sure to use pmu_ctx->pmu for groups
  - perf: Fix kabi breakage of perf_output_handle
  - perf: Avoid the read if the count is already updated
  - perf: Extract a few helpers
  - irqchip/mbigen: hardcode gicr_base for HIP12
  - irqchip/mbigen: add HIP12 support for vtimer irq bypass
  - irqchip/gic-v3-its: Read ITS_VERSION with vendor checking
  - KVM: arm64: fix mbigen vtimer interrupt loss in save/restore
  - irqchip/mbigen: add check for GICv4.1 before enabling vtimer
  - gpio: rockchip: Stop calling pinctrl for set_direction
  - gpio: pca953x: fix wrong error probe return value
  - scsi: sg: Fix occasional bogus elapsed time that exceeds timeout
  - ASoC: fsl_sai: Add missing registers to cache default
  - ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025
  - ALSA: usb-audio: Update for native DSD support quirks
  - can: j1939: make j1939_session_activate() fail if device is no longer registered
  - drm/amd/display: Fix DP no audio issue
  - powercap: fix sscanf() error return value handling
  - powercap: fix race condition in register_control_type()
  - NFS: trace: show TIMEDOUT instead of 0x6e
  - ALSA: ac97: fix a double free in snd_ac97_controller_register()
  - ALSA: ac97bus: Use guard() for mutex locks
  - HID: quirks: work around VID/PID conflict for appledisplay
  - net: wwan: iosm: Fix memory leak in ipc_mux_deinit()
  - net/mlx5e: Don't print error message due to invalid module
  - netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates
  - inet: ping: Fix icmp out counting
  - net: mscc: ocelot: Fix crash when adding interface under a lag
  - bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress
  - net: marvell: prestera: fix NULL dereference on devlink_alloc() failure
  - netfilter: nf_tables: fix memory leak in nf_tables_newrule()
  - gpio: pca953x: handle short interrupt pulses on PCAL devices
  - gpio: pca953x: Add support for level-triggered interrupts
  - gpio: pca953x: Utilise temporary variable for struct device
  - gpio: pca953x: Utilise dev_err_probe() where it makes sense
  - netfilter: nft_synproxy: avoid possible data-race on update operation
  - arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM
  - ARM: dts: imx6q-ba16: fix RTC interrupt level
  - arm64: dts: add off-on-delay-us for usdhc2 regulator
  - scsi: ufs: core: Fix EH failure after W-LUN resume error
  - scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset
  - smb/client: fix NT_STATUS_NO_DATA_DETECTED value
  - smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value
  - smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value
  - NFS: Fix up the automount fs_context to use the correct cred
  - NFSv4: ensure the open stateid seqid doesn't go backwards
  - dm-snapshot: fix 'scheduling while atomic' on real-time kernels
  - alpha: don't reference obsolete termio struct for TC* constants
  - ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels
  - csky: fix csky_cmpxchg_fixup not working
  - nfsd: convert to new timestamp accessors
  - pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping
  - gpio: rockchip: mark the GPIO controller as sleeping
  - drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[]
  - drm/pl111: Fix error handling in pl111_amba_probe
  - counter: interrupt-cnt: Drop IRQF_NO_THREAD flag
  - counter: 104-quad-8: Fix incorrect return value in IRQ handler
  - lib/crypto: aes: Fix missing MMU protection for AES S-box
  - mei: me: add nova lake point S DID
  - btrfs: always detect conflicting inodes when logging inode refs
  - net: 3com: 3c59x: fix possible null dereference in vortex_probe1()
  - atm: Fix dma_free_coherent() size
  - NFSD: Fix permission check for read access to executable-only files
  - LoongArch: Add cpuhotplug hooks to fix high cpu usage of vCPU threads
  - cpufreq: loongson3-acpi-cpufreq: Expand cpu id field for 3C6000
  - LoongArch: Adapt upstream backport for openEuler
  - urma: add rate limit for high-frequency error logs in ubmad and ubcm
  - ub:hisi-ubus: add soft dep of ummu for hisi_ubus
  - kprobes: avoid crash when rmmod/insmod after ftrace killed
  - bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN
  - sched/fair: Clear rel_deadline when initializing forked entities
  - ub/ubmempfd: Fix issues from AI
  - ub/ubdevshm: Optimize print format
  - ub/ubdevshm: Fix issues from AI.
  - ub/ubdevshm: Bugfix for multi-Ops with same va.
  - ub/ubdevshm: Optimize functions to improve readability.
  - media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex
  - sched/ebpf: Fix bpf_sched_set_task_prefer_nid()
  - LoongArch: KVM: Clear LLBCTL if secondary mmu mapping is changed
  - LoongArch: KVM: rename extioi to eiointc
  - LoongArch: KVM: Remove duplicated cache attribute setting
  - LoongArch: KVM: Set page with write attribute if dirty track disabled
  - LoongArch: KVM: Simplify kvm_deliver_intr()
  - LoongArch: KVM: Rework kvm_send_pv_ipi()
  - LoongArch: KVM: Restore guest PMU if it is enabled
  - LoongArch: KVM: Add delay until timer interrupt injected
  - LoongArch: KVM: Move kvm_iocsr tracepoint out of generic code
  - LoongArch: KVM: Add PTW feature detection on new hardware
  - LoongArch: KVM: Remove unused returns and semicolons
  - LoongArch: KVM: Add tracepoints for CPUCFG and CSR emulation exits
  - LoongArch: KVM: Add ecode parameter for exception handlers
  - LoongArch: KVM: Fully clear some CSRs when VM reboot
  - LoongArch: KVM: Fix multiple typos of KVM code
  - LoongArch: KVM: Add stub for kvm_arch_vcpu_preempted_in_kernel()
  - LoongArch: KVM: Remove unnecessary header include path
  - LoongArch: KVM: Set host with kernel mode when switch to VM mode
  - LoongArch: KVM: Fix typo issue about GCFG feature detection
  - LoongArch: KVM: Protect kvm_check_requests() with SRCU
  - LoongArch: KVM: Fix GPA size issue about VM
  - LoongArch: KVM: Adapt pch_pic alignment check
  - LoongArch: KVM: Use kvm_get_vcpu_by_id() instead of kvm_get_vcpu()
  - LoongArch: KVM: Adapt send_ipi_data() stack protector fix
  - LoongArch: KVM: Make function kvm_own_lbt() robust
  - erofs: add GFP_NOIO in the bio completion if needed
  - mm/rmap: fix incorrect pte restoration for lazyfree folios
  - mm: introduce FPB_RESPECT_WRITE for PTE batching infrastructure
  - mm: remove boolean output parameters from folio_pte_batch_ext()
  - mm: split folio_pte_batch() into folio_pte_batch() and folio_pte_batch_flags()
  - mm: smaller folio_pte_batch() improvements
  - mm: convert FPB_IGNORE_* into FPB_RESPECT_*
  - mm: fix folio_pte_batch() on XEN PV
  - !21961 urma: use user-specified ue_idx for bonding import exchange
  - udma：fix ub udma set dev name style
  - ub: udma: Delete the mailbox memory allocation and release in UDMA
  - ub: ubase: Release the MAILBOX memory when AE is received
  - urma: check driver and wq duration for conn_err
  - urma: rate-limit error logs across ubcore
  - urma: fix ubcore_get_device_by_eid without put.
  - urma: use user-specified ue_idx for bonding import exchange
  - urma: fix double put ubagg_dev.
  - urma: fix ubcore_get_device_by_eid uaf.
  - urma: Fix UAF risk in the ubagg_dev_exists function
  - urma: Add rate limiting to log within ubcore_get_tp_list and connection related error routines to mitigate soft lockup risks from excessive printk output, and resolve orthographic errors
  - urma: switch to acalloc for large memory allocation
  - urma: fix wk-jetty send implementation


author: Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.0.7.146
changelog:
  - !22148 CVE-2026-31431
  - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl
  - crypto: authencesn - Fix src offset when decrypting in-place
  - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption
  - crypto: authenc - use memcpy_sglist() instead of null skcipher
  - crypto: algif_aead - snapshot IV for async AEAD requests
  - crypto: algif_aead - Revert to operating out-of-place
  - crypto: algif_aead - use memcpy_sglist() instead of null skcipher
  - crypto: scatterwalk - Backport memcpy_sglist()
  - crypto: algif_aead - Fix minimum RX size check for decryption


author: Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.0.8.147
changelog:
  - !22175 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-149.0.0 to 6.6.0-151.0.0
  - dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc()
  - netfilter: conntrack: add missing netlink policy validations
  - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP
  - net/sched: sch_hfsc: fix divide-by-zero in rtsc_min()
  - bridge: mrp: reject zero test interval to avoid OOM panic
  - netfilter: ipset: drop logically empty buckets in mtype_del
  - xfrm: prevent policy_hthresh.work from racing with netns teardown
  - netfilter: nft_ct: fix use-after-free in timeout object destroy
  - KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION
  - x86/platform/uv: Handle deconfigured sockets
  - x86/CPU: Fix FPDSS on Zen1
  - can: raw: fix ro->uniq use-after-free in raw_rcv()
  - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption
  - net: skb: fix cross-cache free of KFENCE-allocated skb head
  - iavf: fix out-of-bounds writes in iavf_get_ethtool_stats()
  - PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup
  - bfq: Lock when clearing the q->elevator entry
  - ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio
  - ext4: publish jinode after initialization
  - ext4: validate p_idx bounds in ext4_ext_correct_indexes
  - ext4: prevent partial update of the extents path
  - ext4: refactor ext4_ext_rm_idx() to index 'path'
  - ext4: reject mount if bigalloc with s_first_data_block != 0
  - ext4: fix use-after-free in update_super_work when racing with umount
  - ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi()
  - platform/x86/amd/pmc: Add support for Van Gogh SoC
  - team: Move team device type change at the end of team_port_add
  - perf/x86: Fix potential bad container_of in intel_pmu_hw_config
  - x86/topo: Fix SNC topology mess
  - x86/topo: Replace x86_has_numa_in_package
  - x86/topo: Add topology_num_nodes_per_package()
  - x86/numa: Store extra copy of numa_nodes_parsed
  - x86/smpboot: avoid SMT domain attach/destroy if SMT is not enabled
  - x86/smpboot: moves x86_topology to static initialize and truncate
  - x86/smpboot: remove redundant CONFIG_SCHED_SMT
  - smpboot: introduce SDTL_INIT() helper to tidy sched topology setup
  - sched: Move sched domain name out of CONFIG_SCHED_DEBUG
  - x86/topology: Remove x86_smt_flags and use cpu_smt_flags directly
  - x86/mm: Don't print out SRAT table information
  - powerpc/smp: Dynamically build Powerpc topology
  - powerpc/smp: Avoid asym packing within thread_group of a core
  - powerpc/smp: Add __ro_after_init attribute
  - powerpc/smp: Disable MC domain for shared processor
  - powerpc/smp: Enable Asym packing for cores on shared processor
  - drm/i915/gt: Check set_default_submission() before deferencing
  - urma: change kzalloc into vzalloc for ubcore
  - ALSA: ctxfi: Limit PTP to a single page
  - Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()
  - Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete
  - Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb
  - Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del()
  - Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop
  - ext4: convert inline data to extents when truncate exceeds inline size
  - af_unix: read UNIX_DIAG_VFS data under unix_state_lock
  - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()
  - net: ipv6: flowlabel: defer exclusive option free until RCU teardown
  - bridge: br_nd_send: linearize skb before parsing ND options
  - net: bonding: fix NULL deref in bond_debug_rlb_hash_show
  - can: gw: fix OOB heap access in cgw_csum_crc8_rel()
  - netfilter: ctnetlink: use netlink policy range checks
  - netfilter: nf_conntrack_expect: skip expectations in other netns via proc
  - mmc: vub300: fix NULL-deref on disconnect
  - X.509: Fix out-of-bounds access when parsing extensions
  - net: fix fanout UAF in packet_release() via NETDEV_UP race
  - af_key: validate families in pfkey_send_migrate()
  - openvswitch: defer tunnel netdev_put to RCU release
  - Bluetooth: hci_sync: fix double unlock in hci_discovery_filter_clear()
  - crypto: af_alg - limit RX SG extraction by receive buffer budget
  - perf/x86/intel: Add missing branch counters constraint apply
  - ub/ubdevshm: Remove KABI for compatible with Ubuntu x86, add version verification interface.
  - urma: move variable initialization before use in error branch


author: Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.0.9.148
changelog:
  - !22247 sync pr 22246: Revert efi/cper ARM CPER type alignment
  - Revert "efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs"


author: Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.0.10.149
changelog:
  - !22435 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-151.0.0 to 6.6.0-152.0.0
  - HID: core: Mitigate potential OOB by removing bogus memset()
  - HID: core: Add printk_ratelimited variants to hid_warn() etc
  - HID: multitouch: Check to ensure report responses match the request
  - Bluetooth: MGMT: validate LTK enc_size on load
  - ceph: fix i_nlink underrun during async unlink
  - hwmon: (pmbus/core) Protect regulator operations with mutex
  - hwmon: (pmbus/core) Declare regulator notification function as void
  - dmaengine: idxd: Fix not releasing workqueue on .release()
  - driver/core: Fix kabi broken of platform_device/bus_type/device
  - driver core: platform: use generic driver_override infrastructure
  - hwmon: axi-fan: don't use driver_override as IRQ name
  - driver core: generalize driver_override in struct device
  - ceph: fix memory leaks in ceph_mdsc_build_path()
  - ceph: supply snapshot context in ceph_zero_partial_object()
  - Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync
  - Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt
  - Bluetooth: SMP: derive legacy responder STK authentication from MITM state
  - Bluetooth: MGMT: validate mesh send advertising payload length
  - Bluetooth: hci_event: move wake reason storage into validated event handlers
  - ACPI: processor: Fix previous acpi_processor_errata_piix4() fix
  - ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4()
  - KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2()
  - KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block()
  - KVM: x86: WARN if a vCPU gets a valid wakeup that KVM can't yet inject
  - HID: core: clamp report_size in s32ton() to avoid undefined shift
  - HID: alps: fix NULL pointer dereference in alps_raw_event()
  - Input: uinput - fix circular locking dependency with ff-core
  - HID: apple: avoid memory leak in apple_report_fixup()
  - HID: magicmouse: avoid memory leak in magicmouse_report_fixup()
  - mm/userfaultfd: fix hugetlb fault mutex hash calculation
  - rxrpc: proc: size address buffers for %pISpc output
  - dmaengine: idxd: Fix memory leak when a wq is reset
  - net/mlx5: lag: Check for LAG device before creating debugfs
  - crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed
  - crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed
  - blk-iocost: fix busy_level reset when no IOs complete
  - block: use min() instead of min_t()
  - blk-throttle: fix lower bps rate by throtl_trim_slice()
  - block: flush all throttled bios when deleting the cgroup
  - jbd2: increase IO priority of checkpoint
  - blk-throttle: don't take carryover for prioritized processing of metadata
  - blk-throttle: support prioritized processing of metadata
  - blk-throttle: fix lower control under super low iops limit
  - gfs2: fiemap page fault fix
  - x86/apic: Disable x2apic on resume if the kernel expects so
  - USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts
  - USB: usbcore: Introduce usb_bulk_msg_killable()
  - dmaengine: idxd: Fix possible invalid memory access after FLR
  - drm/ioc32: stop speculation on the drm_compat_ioctl path
  - Revert "cpufreq: Fix re-boost issue after hotplugging a CPU"
  - drivers/ub/sentry: change the ub_mem_ras_handler function to always return 0
  - virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
  - libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()
  - urma: fix potential parameter overflow in initialization
  - mm/numa_remote: avoid numa_remote lock when onlining pre-onlined memory
  - crypto: af-alg - fix NULL pointer dereference in scatterwalk
  - tracing: Fix soft lockup when lseeking trace file
  - urma: query resource options by id.
  - bonding: remove unused bond_is_first_slave and bond_is_last_slave macros
  - net: bonding: fix use-after-free in bond_xmit_broadcast()
  - bonding: do not set usable_slaves for broadcast mode
  - net: bonding: update the slave array for broadcast mode
  - crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed
  - net/sched: cls_flow: fix NULL pointer dereference on shared blocks
  - net: sched: act_csum: validate nested VLAN headers
  - netfilter: ip6t_eui64: reject invalid MAC header for all packets
  - wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler()
  - xfrm: esp: avoid in-place decrypt on shared skb frags
  - net/sched: sch_netem: fix out-of-bounds access in packet corruption
  - esp: fix skb leak with espintcp and async crypto
  - xfrm: Fix the usage of skb->sk
  - net/sched: cls_fw: fix NULL dereference of "old" filters before change()
  - net/sched: cls_fw: fix NULL pointer dereference on shared blocks
  - mm: memcontrol: don't throttle dying tasks on memory.high
  - futex: Clear stale exiting pointer in futex_lock_pi() retry path
  - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib
  - EDAC/mc: Fix error path ordering in edac_mc_alloc()
  - perf/x86/intel/uncore: Skip discovery table for offline dies


author: Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.1.13.151
changelog:
  - !22969 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-154.0.0 to 6.6.0-155.0.0
  - Revert "net: unic: adapt to the change for ETS tsa and bw configuration permission"
  - Revert "net: unic: Notify MAMI when the LACP status changes"
  - Revert "net: unic: The unsupported VL rate limit value is displayed as 0"
  - Revert "driver core: enforce device_lock for driver_match_device()"
  - gpio: omap: do not register driver in probe()
  - vsock/test: verify socket options after setting them
  - net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module
  - scsi: qla2xxx: Query FW again before proceeding with login
  - scsi: qla2xxx: Allow recovery for tape devices
  - wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon()
  - nilfs2: Fix potential block overflow that cause system hang
  - crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req
  - crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly
  - crypto: octeontx - Fix length check to avoid truncation in ucode_load_store
  - Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB
  - driver core: enforce device_lock for driver_match_device()
  - usb: typec: ucsi: skip connector validation before init
  - usb: typec: ucsi: validate connector number in ucsi_notify_common()
  - nouveau/dpcd: return EBUSY for aux xfer if the device is asleep
  - ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
  - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()
  - net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak
  - net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback
  - lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl()
  - crypto: pcrypt - Fix handling of MAY_BACKLOG requests
  - dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler
  - dpaa2-switch: do not clear any interrupts automatically
  - wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom
  - ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU.
  - spi: tegra114: Preserve SPI mode bits in def_command1_reg
  - spi: tegra: Fix a memory leak in tegra_slink_probe()
  - btrfs: fix racy bitfield write in btrfs_clear_space_info_full()
  - hwmon: (occ) Mark occ_init_attribute() as __printf
  - drm/mgag200: fix mgag200_bmc_stop_scanout()
  - net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi()
  - tipc: use kfree_sensitive() for session key material
  - net: don't touch dev->stats in BPF redirect paths
  - dpaa2-switch: add bounds check for if_id in IRQ handler
  - net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup
  - net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup
  - net: liquidio: Initialize netdev pointer before queue setup
  - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero
  - platform/x86: hp-bioscfg: Skip empty attribute names
  - platform/x86: intel_telemetry: Fix PSS event register mask
  - platform/x86: toshiba_haps: Fix memory leaks in add/remove routines
  - wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice
  - wifi: mac80211: correctly check if CSA is active
  - ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU
  - wifi: cfg80211: Fix bitrate calculation overflow for HE rates
  - ASoC: tlv320adcx140: Propagate error codes during probe
  - ASoC: amd: yc: Fix microphone on ASUS M6500RE
  - ASoC: davinci-evm: Fix reference leak in davinci_evm_probe
  - wifi: mac80211: collect station statistics earlier when disconnect
  - ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free
  - HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101)
  - HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report()
  - HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list
  - netfilter: replace -EEXIST with -EBUSY
  - ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk
  - HID: playstation: Center initial joystick axes to prevent spurious events
  - HID: intel-ish-hid: Reset enum_devices_done before enumeration
  - btrfs: fix reservation leak in some error paths when inserting inline extent
  - HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL
  - HID: intel-ish-hid: Update ishtp bus match to support device ID table
  - LoongArch: Enable exception fixup for specific ADE subcode
  - LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED
  - block,bfq: fix aux stat accumulation destination
  - net: usb: sr9700: support devices with virtual driver CD
  - wifi: wlcore: ensure skb headroom before skb_push
  - wifi: mac80211: ocb: skip rx_no_sta when interface is not joined
  - tracing: Fix ftrace event field alignments
  - KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures
  - binderfs: fix ida_alloc_max() upper bound
  - binder: fix BR_FROZEN_REPLY error log
  - ublk: fix deadlock when reading partition table
  - Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem"
  - ARM: 9468/1: fix memset64() on big-endian
  - rbd: check for EOD after exclusive lock is ensured to be held
  - pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains
  - pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup
  - pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset
  - pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup
  - pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state
  - platform/x86: intel_telemetry: Fix swapped arrays in PSS output
  - !22835 config: x86: Fix openeuler_defconfig to resolve CI failure
  - config: x86: Restore CONFIG_INIT_STACK_ALL_{PATTERN,ZERO} in openeuler_defconfig
  - config: x86: Fix CI "checkdefconfig" warning by updating defconfig
  - !22778 revert mpam from openEuler-24.03-LTS_SP1
  - Revert "x86: Decouple resctrl with resctrl-mpam"
  - Revert "x86/resctrl: Fix unused variable warning in cache_alloc_hsw_probe()"
  - Revert "x86/resctrl: Remove hard-coded memory bandwidth limit"
  - Revert "x86/resctrl: Read supported bandwidth sources from CPUID"
  - Revert "x86/resctrl: Implement new mba_MBps throttling heuristic"
  - Revert "x86/resctrl: Remove redundant variable in mbm_config_write_domain()"
  - Revert "x86/resctrl: Free rmid_ptrs from resctrl_exit()"
  - Revert "x86/resctrl: Create helper for RMID allocation and mondata dir creation"
  - Revert "x86/resctrl: Move RMID allocation out of mkdir_rdt_prepare()"
  - Revert "x86/resctrl: Track the closid with the rmid"
  - Revert "x86/resctrl: Access per-rmid structures by index"
  - Revert "x86/resctrl: Allow RMID allocation to be scoped by CLOSID"
  - Revert "x86/resctrl: Track the number of dirty RMID a CLOSID has"
  - Revert "x86/resctrl: Use __set_bit()/__clear_bit() instead of open coding"
  - Revert "x86/resctrl: Allocate the cleanest CLOSID by searching closid_num_dirty_rmid"
  - Revert "x86/resctrl: Move CLOSID/RMID matching and setting to use helpers"
  - Revert "x86/resctrl: Add cpumask_any_housekeeping() for limbo/overflow"
  - Revert "x86/resctrl: Queue mon_event_read() instead of sending an IPI"
  - Revert "x86/resctrl: Allow resctrl_arch_rmid_read() to sleep"
  - Revert "x86/resctrl: Allow arch to allocate memory needed in resctrl_arch_rmid_read()"
  - Revert "x86/resctrl: Make resctrl_mounted checks explicit"
  - Revert "x86/resctrl: Move alloc/mon static keys into helpers"
  - Revert "x86/resctrl: Make rdt_enable_key the arch's decision to switch"
  - Revert "x86/resctrl: Add helpers for system wide mon/alloc capable"
  - Revert "x86/resctrl: Add CPU online callback for resctrl work"
  - Revert "x86/resctrl: Allow overflow/limbo handlers to be scheduled on any-but CPU"
  - Revert "x86/resctrl: Add CPU offline callback for resctrl work"
  - Revert "x86/resctrl: Move domain helper migration into resctrl_offline_cpu()"
  - Revert "x86/resctrl: Separate arch and fs resctrl locks"
  - Revert "x86/resctrl: Remove lockdep annotation that triggers false positive"
  - Revert "Documentation/x86: Document that resctrl bandwidth control units are MiB"
  - Revert "Documentation/x86: Fix title underline length"
  - Revert "x86/resctrl: Fix uninitialized memory read when last CPU of domain goes offline"
  - Revert "x86/resctrl: Switch to new Intel CPU model defines"
  - Revert "x86/resctrl: Pass domain to target CPU"
  - Revert "x86/resctrl: Simplify call convention for MSR update functions"
  - Revert "x86/resctrl: Rename pseudo_lock_event.h to trace.h"
  - Revert "x86/resctrl: Add tracepoint for llc_occupancy tracking"
  - Revert "x86/resctrl: Don't try to free nonexistent RMIDs"
  - Revert "cpu: Move CPU hotplug function declarations into their own header"
  - Revert "cpu: Drop "extern" from function declarations in cpuhplock.h"
  - Revert "cacheinfo: Add function to get cacheinfo for a given CPU and cache level"
  - Revert "x86/resctrl: Replace open coded cacheinfo searches"
  - Revert "x86/resctrl: Prepare for new domain scope"
  - Revert "x86/resctrl: Prepare to split rdt_domain structure"
  - Revert "x86/resctrl: Prepare for different scope for control/monitor operations"
  - Revert "x86/resctrl: Split the rdt_domain and rdt_hw_domain structures"
  - Revert "x86/resctrl: Add node-scope to the options for feature scope"
  - Revert "x86/resctrl: Introduce snc_nodes_per_l3_cache"
  - Revert "x86/resctrl: Block use of mba_MBps mount option on Sub-NUMA Cluster (SNC) systems"
  - Revert "x86/resctrl: Prepare for new Sub-NUMA Cluster (SNC) monitor files"
  - Revert "x86/resctrl: Add a new field to struct rmid_read for summation of domains"
  - Revert "x86/resctrl: Initialize on-stack struct rmid_read instances"
  - Revert "x86/resctrl: Refactor mkdir_mondata_subdir() with a helper function"
  - Revert "x86/resctrl: Allocate a new field in union mon_data_bits"
  - Revert "x86/resctrl: Create Sub-NUMA Cluster (SNC) monitor files"
  - Revert "x86/resctrl: Handle removing directories in Sub-NUMA Cluster (SNC) mode"
  - Revert "x86/resctrl: Fill out rmid_read structure for smp_call*() to read a counter"
  - Revert "x86/resctrl: Make __mon_event_count() handle sum domains"
  - Revert "x86/resctrl: Enable shared RMID mode on Sub-NUMA Cluster (SNC) systems"
  - Revert "x86/resctrl: Detect Sub-NUMA Cluster (SNC) mode"
  - Revert "x86/resctrl: Update documentation with Sub-NUMA cluster changes"
  - Revert "x86/resctrl: Fix arch_mbm_* array overrun on SNC"
  - Revert "x86/resctrl: Avoid overflow in MB settings in bw_validate()"
  - Revert "x86/resctrl: Annotate get_mem_config() functions as __init"
  - Revert "x86/resctrl: Slightly clean-up mbm_config_show()"
  - Revert "x86/resctrl: Support Sub-NUMA cluster mode SNC6"
  - Revert "x86/resctrl: Use kthread_run_on_cpu()"
  - Revert "x86/resctrl: Introduce resctrl_file_fflags_init() to initialize fflags"
  - Revert "x86/resctrl: Prepare for per-CTRL_MON group mba_MBps control"
  - Revert "x86/resctrl: Modify update_mba_bw() to use per CTRL_MON group event"
  - Revert "x86/resctrl: Compute memory bandwidth for all supported events"
  - Revert "x86/resctrl: Make mba_sc use total bandwidth if local is not supported"
  - Revert "x86/resctrl: Add "mba_MBps_event" file to CTRL_MON directories"
  - Revert "x86/resctrl: Add write option to "mba_MBps_event" file"
  - Revert "x86/resctrl: Document the new "mba_MBps_event" file"
  - Revert "x86/resctrl: Fix allocation of cleanest CLOSID on platforms with no monitors"
  - Revert "x86/resctrl: Add a helper to avoid reaching into the arch code resource list"
  - Revert "x86/resctrl: Remove fflags from struct rdt_resource"
  - Revert "x86/resctrl: Use schema type to determine how to parse schema values"
  - Revert "x86/resctrl: Use schema type to determine the schema format string"
  - Revert "x86/resctrl: Remove data_width and the tabular format"
  - Revert "x86/resctrl: Add max_bw to struct resctrl_membw"
  - Revert "x86/resctrl: Generate default_ctrl instead of sharing it"
  - Revert "x86/resctrl: Add helper for setting CPU default properties"
  - Revert "x86/resctrl: Remove rdtgroup from update_cpu_closid_rmid()"
  - Revert "x86/resctrl: Expose resctrl fs's init function to the rest of the kernel"
  - Revert "x86/resctrl: Move rdt_find_domain() to be visible to arch and fs code"
  - Revert "x86/resctrl: Move resctrl types to a separate header"
  - Revert "x86/resctrl: Add an arch helper to reset one resource"
  - Revert "x86/resctrl: Move monitor exit work to a resctrl exit call"
  - Revert "x86/resctrl: Move monitor init work to a resctrl init call"
  - Revert "x86/resctrl: Rewrite and move the for_each_*_rdt_resource() walkers"
  - Revert "x86/resctrl: Move the is_mbm_*_enabled() helpers to asm/resctrl.h"
  - Revert "x86/resctrl: Add resctrl_arch_is_evt_configurable() to abstract BMEC"
  - Revert "x86/resctrl: Change mon_event_config_{read,write}() to be arch helpers"
  - Revert "x86/resctrl: Move mba_mbps_default_event init to filesystem code"
  - Revert "x86/resctrl: Move mbm_cfg_mask to struct rdt_resource"
  - Revert "x86/resctrl: Add resctrl_arch_ prefix to pseudo lock functions"
  - Revert "x86/resctrl: Allow an architecture to disable pseudo lock"
  - Revert "x86/resctrl: Make prefetch_disable_bits belong to the arch code"
  - Revert "x86/resctrl: Make resctrl_arch_pseudo_lock_fn() take a plr"
  - Revert "x86/resctrl: Move RFTYPE flags to be managed by resctrl"
  - Revert "x86/resctrl: Handle throttle_mode for SMBA resources"
  - Revert "x86/resctrl: Move get_config_index() to a header"
  - Revert "x86/resctrl: Move get_{mon,ctrl}_domain_from_cpu() to live with their callers"
  - Revert "cpumask: kernel-doc cleanups and additions"
  - Revert "cpumask: add cpumask_any_and_but()"
  - Revert "cpumask: add cpumask_weight_andnot()"
  - Revert "cpumask: Introduce cpumask_first_and_and()"
  - Revert "cpumask: Switch from inline to __always_inline"
  - Revert "cpumask: Relax cpumask_any_but()"
  - Revert "find: Add find_first_andnot_bit()"
  - Revert "cpumask: Add cpumask_{first,next}_andnot() API"
  - Revert "ptrace: Convert ptrace_attach() to use lock guards"
  - Revert "kernfs: sysfs: support custom llseek method for sysfs entries"
  - Revert "kernfs: Convert kernfs_walk_ns() from strlcpy() to strscpy()"
  - Revert "kernfs: Convert kernfs_name_locked() from strlcpy() to strscpy()"
  - Revert "kernfs: mount: Remove unnecessary ‘NULL’ values from knparent"
  - Revert "kernfs: Acquire kernfs_rwsem in kernfs_notify_workfn()."
  - Revert "kernfs: Acquire kernfs_rwsem in kernfs_get_parent_dentry()."
  - Revert "kernfs: Acquire kernfs_rwsem in kernfs_node_dentry()."
  - Revert "kernfs: Convert kernfs_path_from_node_locked() from strlcpy() to strscpy()"
  - Revert "kernfs: Use RCU to access kernfs_node::parent."
  - Revert "kernfs: Use RCU to access kernfs_node::name."
  - Revert "kernfs: annotate different lockdep class for of->mutex of writable files"
  - Revert "kernfs: Drop kernfs_rwsem while invoking lookup_positive_unlocked()."
  - Revert "kernfs: Move dput() outside of the RCU section."
  - Revert "x86/resctrl: Optimize cpumask_any_housekeeping()"
  - Revert "x86/resctrl: Remove the limit on the number of CLOSID"
  - Revert "x86/resctrl: Rename resctrl_sched_in() to begin with "resctrl_arch_""
  - Revert "x86/resctrl: Check all domains are offline in resctrl_exit()"
  - Revert "x86/resctrl: Resctrl_exit() teardown resctrl but leave the mount point"
  - Revert "x86/resctrl: Drop __init/__exit on assorted symbols"
  - Revert "x86/resctrl: Move is_mba_sc() out of core.c"
  - Revert "x86/resctrl: Add end-marker to the resctrl_event_id enum"
  - Revert "x86/resctrl: Expand the width of domid by replacing mon_data_bits"
  - Revert "x86/resctrl: Split trace.h"
  - Revert "x86/resctrl: Add 'resctrl' to the title of the resctrl documentation"
  - Revert "fs/resctrl: Add boiler plate for external resctrl code"
  - Revert "x86/resctrl: Move the filesystem bits to headers visible to fs/resctrl"
  - Revert "x86/resctrl: Move enum resctrl_event_id to resctrl.h"
  - Revert "x86/resctrl: Fix types in resctrl_arch_mon_ctx_{alloc,free}() stubs"
  - Revert "x86/resctrl: Move pseudo lock prototypes to include/linux/resctrl.h"
  - Revert "x86/resctrl: Squelch whitespace anomalies in resctrl core code"
  - Revert "x86/resctrl: Prefer alloc(sizeof(*foo)) idiom in rdt_init_fs_context()"
  - Revert "x86/resctrl: Relax some asm #includes"
  - Revert "x86/resctrl: Always initialise rid field in rdt_resources_all[]"
  - Revert "x86/resctrl: Fix rdtgroup_mkdir()'s unlocked use of kernfs_node::name"
  - Revert "x86,fs/resctrl: Move the resctrl filesystem code to live in /fs/resctrl"
  - Revert "MAINTAINERS: Add reviewers for fs/resctrl"
  - Revert "fs/resctrl: Restore the rdt_last_cmd_clear() calls after acquiring rdtgroup_mutex"
  - Revert "x86,fs/resctrl: Remove inappropriate references to cacheinfo in the resctrl subsystem"
  - Revert "resctrl: get rid of pointless debugfs_file_{get,put}()"
  - Revert "fs/resctrl: Eliminate false positive lockdep warning when reading SNC counters"
  - Revert "fs/resctrl: Optimize code in rdt_get_tree()"
  - Revert "x86/resctrl: Support Sub-NUMA Cluster (SNC) mode on Clearwater Forest"
  - Revert "x86,fs/resctrl: Consolidate monitor event descriptions"
  - Revert "x86,fs/resctrl: Replace architecture event enabled checks"
  - Revert "x86/resctrl: Remove the rdt_mon_features global variable"
  - Revert "x86,fs/resctrl: Prepare for more monitor events"
  - !22737 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-152.0.0 to 6.6.0-154.0.0
  - Bluetooth: hci_sync: annotate data-races around hdev->req_status
  - Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ
  - fbcon: check return value of con2fb_acquire_newinfo()
  - media: pvrusb2: fix URB leak in pvr2_send_request_ex
  - unshare: fix unshare_fs() handling
  - bridge: br_nd_send: validate ND option lengths
  - obmm: add VMA access for ptrace/GDB on PFNMAP regions
  - obmm: support VMA split with ownership-aligned attributes
  - obmm: refactor ownership tracking for PMD-granularity support
  - obmm: fix PTE protection bits for READWRITE mappings
  - mm: export split_vma for module use
  - USB: core: Limit the length of unkillable synchronous timeouts
  - udp: Fix wildcard bind conflict check when using hash2
  - tcp: Rearrange tests in inet_csk_bind_conflict().
  - usb: dwc3: gadget: Move vbus draw to workqueue context
  - usb: class: cdc-wdm: fix reordering issue in read code path
  - x86,fs/resctrl: Prepare for more monitor events
  - x86/resctrl: Remove the rdt_mon_features global variable
  - x86,fs/resctrl: Replace architecture event enabled checks
  - x86,fs/resctrl: Consolidate monitor event descriptions
  - x86/resctrl: Support Sub-NUMA Cluster (SNC) mode on Clearwater Forest
  - fs/resctrl: Optimize code in rdt_get_tree()
  - fs/resctrl: Eliminate false positive lockdep warning when reading SNC counters
  - resctrl: get rid of pointless debugfs_file_{get,put}()
  - x86,fs/resctrl: Remove inappropriate references to cacheinfo in the resctrl subsystem
  - fs/resctrl: Restore the rdt_last_cmd_clear() calls after acquiring rdtgroup_mutex
  - MAINTAINERS: Add reviewers for fs/resctrl
  - x86,fs/resctrl: Move the resctrl filesystem code to live in /fs/resctrl
  - x86/resctrl: Fix rdtgroup_mkdir()'s unlocked use of kernfs_node::name
  - x86/resctrl: Always initialise rid field in rdt_resources_all[]
  - x86/resctrl: Relax some asm #includes
  - x86/resctrl: Prefer alloc(sizeof(*foo)) idiom in rdt_init_fs_context()
  - x86/resctrl: Squelch whitespace anomalies in resctrl core code
  - x86/resctrl: Move pseudo lock prototypes to include/linux/resctrl.h
  - x86/resctrl: Fix types in resctrl_arch_mon_ctx_{alloc,free}() stubs
  - x86/resctrl: Move enum resctrl_event_id to resctrl.h
  - x86/resctrl: Move the filesystem bits to headers visible to fs/resctrl
  - fs/resctrl: Add boiler plate for external resctrl code
  - x86/resctrl: Add 'resctrl' to the title of the resctrl documentation
  - x86/resctrl: Split trace.h
  - x86/resctrl: Expand the width of domid by replacing mon_data_bits
  - x86/resctrl: Add end-marker to the resctrl_event_id enum
  - x86/resctrl: Move is_mba_sc() out of core.c
  - x86/resctrl: Drop __init/__exit on assorted symbols
  - x86/resctrl: Resctrl_exit() teardown resctrl but leave the mount point
  - x86/resctrl: Check all domains are offline in resctrl_exit()
  - x86/resctrl: Rename resctrl_sched_in() to begin with "resctrl_arch_"
  - x86/resctrl: Remove the limit on the number of CLOSID
  - x86/resctrl: Optimize cpumask_any_housekeeping()
  - kernfs: Move dput() outside of the RCU section.
  - kernfs: Drop kernfs_rwsem while invoking lookup_positive_unlocked().
  - kernfs: annotate different lockdep class for of->mutex of writable files
  - kernfs: Use RCU to access kernfs_node::name.
  - kernfs: Use RCU to access kernfs_node::parent.
  - kernfs: Convert kernfs_path_from_node_locked() from strlcpy() to strscpy()
  - kernfs: Acquire kernfs_rwsem in kernfs_node_dentry().
  - kernfs: Acquire kernfs_rwsem in kernfs_get_parent_dentry().
  - kernfs: Acquire kernfs_rwsem in kernfs_notify_workfn().
  - kernfs: mount: Remove unnecessary ‘NULL’ values from knparent
  - kernfs: Convert kernfs_name_locked() from strlcpy() to strscpy()
  - kernfs: Convert kernfs_walk_ns() from strlcpy() to strscpy()
  - kernfs: sysfs: support custom llseek method for sysfs entries
  - ptrace: Convert ptrace_attach() to use lock guards
  - cpumask: Add cpumask_{first,next}_andnot() API
  - find: Add find_first_andnot_bit()
  - cpumask: Relax cpumask_any_but()
  - cpumask: Switch from inline to __always_inline
  - cpumask: Introduce cpumask_first_and_and()
  - cpumask: add cpumask_weight_andnot()
  - cpumask: add cpumask_any_and_but()
  - cpumask: kernel-doc cleanups and additions
  - x86/resctrl: Move get_{mon,ctrl}_domain_from_cpu() to live with their callers
  - x86/resctrl: Move get_config_index() to a header
  - x86/resctrl: Handle throttle_mode for SMBA resources
  - x86/resctrl: Move RFTYPE flags to be managed by resctrl
  - x86/resctrl: Make resctrl_arch_pseudo_lock_fn() take a plr
  - x86/resctrl: Make prefetch_disable_bits belong to the arch code
  - x86/resctrl: Allow an architecture to disable pseudo lock
  - x86/resctrl: Add resctrl_arch_ prefix to pseudo lock functions
  - x86/resctrl: Move mbm_cfg_mask to struct rdt_resource
  - x86/resctrl: Move mba_mbps_default_event init to filesystem code
  - x86/resctrl: Change mon_event_config_{read,write}() to be arch helpers
  - x86/resctrl: Add resctrl_arch_is_evt_configurable() to abstract BMEC
  - x86/resctrl: Move the is_mbm_*_enabled() helpers to asm/resctrl.h
  - x86/resctrl: Rewrite and move the for_each_*_rdt_resource() walkers
  - x86/resctrl: Move monitor init work to a resctrl init call
  - x86/resctrl: Move monitor exit work to a resctrl exit call
  - x86/resctrl: Add an arch helper to reset one resource
  - x86/resctrl: Move resctrl types to a separate header
  - x86/resctrl: Move rdt_find_domain() to be visible to arch and fs code
  - x86/resctrl: Expose resctrl fs's init function to the rest of the kernel
  - x86/resctrl: Remove rdtgroup from update_cpu_closid_rmid()
  - x86/resctrl: Add helper for setting CPU default properties
  - x86/resctrl: Generate default_ctrl instead of sharing it
  - x86/resctrl: Add max_bw to struct resctrl_membw
  - x86/resctrl: Remove data_width and the tabular format
  - x86/resctrl: Use schema type to determine the schema format string
  - x86/resctrl: Use schema type to determine how to parse schema values
  - x86/resctrl: Remove fflags from struct rdt_resource
  - x86/resctrl: Add a helper to avoid reaching into the arch code resource list
  - x86/resctrl: Fix allocation of cleanest CLOSID on platforms with no monitors
  - x86/resctrl: Document the new "mba_MBps_event" file
  - x86/resctrl: Add write option to "mba_MBps_event" file
  - x86/resctrl: Add "mba_MBps_event" file to CTRL_MON directories
  - x86/resctrl: Make mba_sc use total bandwidth if local is not supported
  - x86/resctrl: Compute memory bandwidth for all supported events
  - x86/resctrl: Modify update_mba_bw() to use per CTRL_MON group event
  - x86/resctrl: Prepare for per-CTRL_MON group mba_MBps control
  - x86/resctrl: Introduce resctrl_file_fflags_init() to initialize fflags
  - x86/resctrl: Use kthread_run_on_cpu()
  - x86/resctrl: Support Sub-NUMA cluster mode SNC6
  - x86/resctrl: Slightly clean-up mbm_config_show()
  - x86/resctrl: Annotate get_mem_config() functions as __init
  - x86/resctrl: Avoid overflow in MB settings in bw_validate()
  - x86/resctrl: Fix arch_mbm_* array overrun on SNC
  - x86/resctrl: Update documentation with Sub-NUMA cluster changes
  - x86/resctrl: Detect Sub-NUMA Cluster (SNC) mode
  - x86/resctrl: Enable shared RMID mode on Sub-NUMA Cluster (SNC) systems
  - x86/resctrl: Make __mon_event_count() handle sum domains
  - x86/resctrl: Fill out rmid_read structure for smp_call*() to read a counter
  - x86/resctrl: Handle removing directories in Sub-NUMA Cluster (SNC) mode
  - x86/resctrl: Create Sub-NUMA Cluster (SNC) monitor files
  - x86/resctrl: Allocate a new field in union mon_data_bits
  - x86/resctrl: Refactor mkdir_mondata_subdir() with a helper function
  - x86/resctrl: Initialize on-stack struct rmid_read instances
  - x86/resctrl: Add a new field to struct rmid_read for summation of domains
  - x86/resctrl: Prepare for new Sub-NUMA Cluster (SNC) monitor files
  - x86/resctrl: Block use of mba_MBps mount option on Sub-NUMA Cluster (SNC) systems
  - x86/resctrl: Introduce snc_nodes_per_l3_cache
  - x86/resctrl: Add node-scope to the options for feature scope
  - x86/resctrl: Split the rdt_domain and rdt_hw_domain structures
  - x86/resctrl: Prepare for different scope for control/monitor operations
  - x86/resctrl: Prepare to split rdt_domain structure
  - x86/resctrl: Prepare for new domain scope
  - x86/resctrl: Replace open coded cacheinfo searches
  - cacheinfo: Add function to get cacheinfo for a given CPU and cache level
  - cpu: Drop "extern" from function declarations in cpuhplock.h
  - cpu: Move CPU hotplug function declarations into their own header
  - x86/resctrl: Don't try to free nonexistent RMIDs
  - x86/resctrl: Add tracepoint for llc_occupancy tracking
  - x86/resctrl: Rename pseudo_lock_event.h to trace.h
  - x86/resctrl: Simplify call convention for MSR update functions
  - x86/resctrl: Pass domain to target CPU
  - x86/resctrl: Switch to new Intel CPU model defines
  - x86/resctrl: Fix uninitialized memory read when last CPU of domain goes offline
  - Documentation/x86: Fix title underline length
  - Documentation/x86: Document that resctrl bandwidth control units are MiB
  - x86/resctrl: Remove lockdep annotation that triggers false positive
  - x86/resctrl: Separate arch and fs resctrl locks
  - x86/resctrl: Move domain helper migration into resctrl_offline_cpu()
  - x86/resctrl: Add CPU offline callback for resctrl work
  - x86/resctrl: Allow overflow/limbo handlers to be scheduled on any-but CPU
  - x86/resctrl: Add CPU online callback for resctrl work
  - x86/resctrl: Add helpers for system wide mon/alloc capable
  - x86/resctrl: Make rdt_enable_key the arch's decision to switch
  - x86/resctrl: Move alloc/mon static keys into helpers
  - x86/resctrl: Make resctrl_mounted checks explicit
  - x86/resctrl: Allow arch to allocate memory needed in resctrl_arch_rmid_read()
  - x86/resctrl: Allow resctrl_arch_rmid_read() to sleep
  - x86/resctrl: Queue mon_event_read() instead of sending an IPI
  - x86/resctrl: Add cpumask_any_housekeeping() for limbo/overflow
  - x86/resctrl: Move CLOSID/RMID matching and setting to use helpers
  - x86/resctrl: Allocate the cleanest CLOSID by searching closid_num_dirty_rmid
  - x86/resctrl: Use __set_bit()/__clear_bit() instead of open coding
  - x86/resctrl: Track the number of dirty RMID a CLOSID has
  - x86/resctrl: Allow RMID allocation to be scoped by CLOSID
  - x86/resctrl: Access per-rmid structures by index
  - x86/resctrl: Track the closid with the rmid
  - x86/resctrl: Move RMID allocation out of mkdir_rdt_prepare()
  - x86/resctrl: Create helper for RMID allocation and mondata dir creation
  - x86/resctrl: Free rmid_ptrs from resctrl_exit()
  - x86/resctrl: Remove redundant variable in mbm_config_write_domain()
  - x86/resctrl: Implement new mba_MBps throttling heuristic
  - x86/resctrl: Read supported bandwidth sources from CPUID
  - x86/resctrl: Remove hard-coded memory bandwidth limit
  - x86/resctrl: Fix unused variable warning in cache_alloc_hsw_probe()
  - x86: Decouple resctrl with resctrl-mpam
  - crypto: hisilicon - remove unused and non-public APIs for qm and sec
  - crypto: hisilicon/qm - drop redundant variable initialization
  - crypto: hisilicon/qm - remove else after return
  - crypto: hisilicon/qm - add const qualifier to info_name in struct qm_cmd_dump_item
  - crypto: hisilicon - fix the format string type error
  - crypto: hisilicon/sec2 - prevent req used-after-free for sec
  - crypto: hisilicon - add device load query functionality to debugfs
  - crypto: hisilicon/qm - increase wait time for mailbox
  - crypto: hisilicon/qm - obtain the mailbox configuration at one time
  - crypto: hisilicon/qm - remove unnecessary code in qm_mb_write()
  - Revert "crypto: hisilicon/qm - obtain the mailbox configuration at one time"
  - Revert "hisi_acc_vfio_pci: obtain the mailbox configuration at one time"
  - crypto: hisilicon/qm - move the barrier before writing to the mailbox register
  - crypto: hisilicon/zip - add lz4 algorithm for hisi_zip
  - virtCCA-Live-Migration: Add host agent support for CVM live migration
  - fix migvm_queue_dev_mmap buffer check
  - gpiolib: acpi: Fix potential out-of-boundary left shift
  - bpf/selftests: test_select_reuseport_kern: Remove unused header
  - Revert "net: Remove conditional threaded-NAPI wakeup based on task state."
  - Revert "net: Allow to use SMP threads for backlog NAPI."
  - ksmbd: fix recursive locking in RPC handle list access
  - pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins
  - mptcp: avoid dup SUB_CLOSED events after disconnect
  - writeback: fix 100% CPU usage when dirtytime_expire_interval is 0
  - drm/msm/a6xx: fix bogus hwcg register updates
  - pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver
  - ALSA: usb-audio: Fix missing unlock at error path of maxpacksize check
  - net/sched: act_ife: convert comma to semicolon
  - btrfs: prevent use-after-free on page private data in btrfs_subpage_clear_uptodate()
  - drm/radeon: delete radeon_fence_process in is_signaled, no deadlock
  - wifi: mac80211: move TDLS work to wiphy work
  - ksmbd: Fix race condition in RPC handle list access
  - drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV
  - ksmbd: smbd: fix dma_unmap_sg() nents
  - mei: trace: treat reg parameter as string
  - mm/kfence: randomize the freelist on initialization
  - drm/amdgpu/gfx11: fix wptr reset in KGQ init
  - drm/amdgpu/gfx10: fix wptr reset in KGQ init
  - drm/amdgpu/soc21: fix xclk for APUs
  - drm/imx/tve: fix probe device leak
  - scripts: generate_rust_analyzer: Add compiler_builtins -> core dep
  - flex_proportions: make fprop_new_period() hardirq safe
  - selftests: mptcp: join: fix local endp not being tracked
  - mptcp: only reset subflow errors when propagated
  - scsi: qla2xxx: edif: Fix dma_free_coherent() size
  - gpio: pca953x: mask interrupts in irq shutdown
  - ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO
  - scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo()
  - ASoC: fsl: imx-card: Do not force slot width to sample width
  - rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target
  - riscv: compat: fix COMPAT_UTS_MACHINE definition
  - pinctrl: meson: mark the GPIO controller as sleeping
  - dma/pool: distinguish between missing and exhausted atomic pools
  - gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler
  - ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion
  - scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg()
  - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload
  - net: bridge: fix static key check
  - nfc: nci: Fix race between rfkill and nci_unregister_device().
  - net/mlx5e: Account for netdev stats in ndo_get_stats64
  - net/mlx5e: Report rx_discards_phy via rx_dropped
  - ice: stop counting UDP csum mismatch as rx_errors
  - nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame().
  - rocker: fix memory leak in rocker_world_port_post_fini()
  - net: wwan: t7xx: fix potential skb->frags overflow in RX path
  - ipv6: use the right ifindex when replying to icmpv6 from localhost
  - net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins()
  - octeon_ep: Fix memory leak in octep_device_setup()
  - net: bcmasp: fix early exit leak with fixed phy
  - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup()
  - Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work
  - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated
  - net/oenetcls: free sk entry hash on ntuple cleanup
  - sched/fair: Fix overflow in vruntime_eligible()
  - sched/fair: Introduce and use the vruntime_cmp() and vruntime_op() wrappers for wrapped-signed aritmetics
  - sched/fair: Mark m*_vruntime() with __maybe_unused
  - sched/fair: Clear rel_deadline when initializing forked entities
  - Revert "sched/fair: Clear rel_deadline when initializing forked entities"
  - LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE
  - ceph: add a bunch of missing ceph_path_info initializers
  - blk-cgroup: skip dying blkg in blkcg_activate_policy()
  - urma: fix the panic when ipourma module is repeatedly loaded
  - net: ipa: fix event ring index not programmed for IPA v5.0+
  - net/oenetcls: remove duplicated linux/inet.h include
  - net/oenetcls: fix mode-0 init rollback for ntuple resources
  - net/oenetcls: fix RPS CPU index scaling bias
  - net/oenetcls: Add rps policy switch for phy NIC
  - net/oenetcls: Make OENETCLS default as module
  - net/oenetcls: Support ipv6 for ntuple mode
  - net/oenetcls: Supports rxq multiplexing
  - net/oenetcls: Add local flow NUMA-aware rps
  - net/oenetcls: Fix possible hash collision issue
  - net/oenetcls: Prioritize oenetcls hooks over rps
  - net/oenetcls: Add mode 2 for rps numa affinity
  - usb: cdns3: gadget: fix NULL pointer dereference in ep_queue
  - ptrace: Fix kabi breakage in struct task_struct
  - ptrace: slightly saner 'get_dumpable()' logic
  - urma: Enable RH2D streaming by IPoURMA
  - urma: fix spinlock usage in ubagg_get_seg_info function
  - smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path
  - apei: use blocking notifier for page offline policy chain
  - urma: fix reference count imbalance in ubagg and uburma modules
  - powerpc, perf: Check that current->mm is alive before getting user callchain
  - ub:ubus: Add KABI_RESERVE to struct ub_decoder and message_device
  - ub:ubus: Will not enable decoder if matt jurisdiction is UBFM
  - ub:ubus: change the condition of io decoder creating page table or not
  - net: unic: The unsupported VL rate limit value is displayed as 0
  - net: unic: Notify MAMI when the LACP status changes
  - net: unic: adapt to the change for ETS tsa and bw configuration permission
  - iommu/ummu-core: fix uaf in ummu_core_invalidate_cfg()
  - iommu: Optimize the iommu PLBI Framework
  - iommu/ummu: remove swap operation when ungrant
  - iommu/ummu-core: ummu_fill_pages interface provides GFP flags for memory allocation
  - perf/x86/intel/uncore: Fix die ID init and look up bugs
  - scsi: target: tcm_loop: Drain commands in target_reset handler


author: Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.1.14.152
changelog:
  - !23144 sync CVE LTS and bugfix from OLK-6.6 from 14ed6c3948b1 to b39d11626963
  - sched: idle: Make skipping governor callbacks more consistent
  - cpuidle: Skip governor when only one idle state is available
  - vxlan: validate ND option lengths in vxlan_na_create
  - net: use skb_header_pointer() for TCPv4 GSO frag_off check
  - ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put()
  - USB: serial: option: add Telit FN920C04 RNDIS compositions
  - f2fs: fix to avoid mapping wrong physical block for swapfile
  - f2fs: fix zoned block device information initialization
  - f2fs: fix to avoid UAF in f2fs_write_end_io()
  - f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes
  - f2fs: fix out-of-bounds access in sysfs attribute read/write
  - f2fs: fix to add gc count stat in f2fs_gc_range
  - fbdev: smscufx: properly copy ioctl memory to kernelspace
  - fbdev: rivafb: fix divide error in nv3_arb()
  - Revert "wireguard: device: enable threaded NAPI"
  - gpiolib: acpi: Fix gpio count with string references
  - ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put()
  - ASoC: cs42l43: Correct handling of 3-pole jack load detection
  - platform/x86: panasonic-laptop: Fix sysfs group leak in error path
  - platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro
  - ASoC: amd: yc: Add quirk for HP 200 G2a 16
  - ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9
  - drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used
  - romfs: check sb_set_blocksize() return value
  - ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel
  - ALSA: hda/realtek: Add quirk for Inspur S14-G1
  - gpio: sprd: Change sprd_gpio lock to raw_spin_lock
  - ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list
  - ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU
  - PCI: endpoint: Avoid creating sub-groups asynchronously
  - PCI: endpoint: Remove unused field in struct pci_epf_group
  - Revert "driver core: enforce device_lock for driver_match_device()"
  - driver core: enforce device_lock for driver_match_device()
  - !23084 sync CVE LTS and bugfix from OLK-6.6 from 8238b832b9ac to 14ed6c3948b1
  - net: skbuff: preserve shared-frag marker during coalescing
  - net: skbuff: propagate shared-frag marker through frag-transfer helpers
  - powerpc/smp: Add check for kcalloc() failure in parse_thread_groups()


author: Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.1.15.153
changelog:
  - !23824 sync CVE LTS and bugfix from OLK-6.6 from af2b85218113 to 62d67c0aee60
  - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork
  - iommu/ummu: Enable separated SVA page table by default
  - usbip: validate number_of_packets in usbip_pack_ret_submit()
  - usb: gadget: f_hid: don't call cdev_init while cdev in use
  - urma: fix dev cap struct length by reserved
  - urma: fix ipourma eid setup ordering
  - crypto: hisilicon/hpre: implement full backlog support for hpre driver
  - crypto: hisilicon/sec2 - restore iv for ctr mode
  - crypto: hisilicon/sec2 - fix resource leakage issues in non-backlog mode
  - crypto: hisilicon/sec2 - fix UAF in sec_alg_send_backlog
  - crypto: hisilicon/zip - add backlog support for zip
  - iommu/vt-d: Clear Present bit before tearing down context entry
  - netfilter: nf_tables: reject immediate NF_QUEUE verdict
  - xfrm: account XFRMA_IF_ID in aevent size calculation
  - mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL
  - cpufreq: conservative: Simplify frequency limit handling
  - cpufreq: Avoid redundant target() calls for unchanged limits
  - cpufreq: Fix typo in comment
  - arm64: smp: Do not mark secondary CPUs possible under nosmp
  - cpufreq: Documentation: fix freq_step description
  - cpufreq: Documentation: fix sampling_down_factor documentation range
  - rethook: Use tsk->on_cpu to check task execution state
  - rethook: Remove warning messages printed for finding return address of a frame.
  - smb: client: reject userspace cifs.spnego descriptions
  - urma: remove the redundant update of the tx_ring in error branch
  - virtcca huk-based key encryption
  - xfrm_user: fix info leak in build_mapping()
  - fbdev: defio: Remove unused variable 'fbdefio' to fix build warning
  - fbdev: defio: fix KABI breakage in struct fb_deferred_io and struct fb_info
  - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info
  - fbdev/deferred-io: Always call get_page() for framebuffer pages
  - fbdev/deferred-io: Clean up pageref on lastclose
  - iommu/vt-d: Clear Present bit before tearing down PASID entry
  - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ
  - urma: fix cm payload and async bind callback
  - ub: udma: modify the UDMA document.
  - tcp: restore kABI for syn_recv_sock() backport
  - tcp: fix potential race in tcp_v6_syn_recv_sock()
  - 8021q: delete cleared egress QoS mappings
  - 8021q: use RCU for egress QoS mappings
  - net: af_key: zero aligned sockaddr tail in PF_KEY exports
  - vhost: move vdpa group bound check to vhost_vdpa
  - x86-64: rename misleadingly named '__copy_user_nocache()' function
  - ipvs: skip ipv6 extension headers for csum checks
  - drm/amd/display: Fix dc_link NULL handling in HPD init
  - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl
  - smb: client: validate the whole DACL before rewriting it in cifsacl
  - eventpoll: fix ep_remove struct eventpoll / struct file UAF
  - eventpoll: move epi_fget() up
  - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}()
  - eventpoll: kill __ep_remove()
  - eventpoll: split __ep_remove()
  - eventpoll: use hlist_is_singular_node() in __ep_remove()
  - mm/page_alloc: clear page->private in free_pages_prepare()
  - net: Drop the lock in skb_may_tx_timestamp()
  - KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT
  - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers
  - mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects()
  - ipvs: do not keep dest_dst if dev is going down
  - RDMA/hns: Fix log flood after cmd_mbox failure
  - xfrm: esp: restore combined single-frag length gate
  - obmm: validate VMA identity via vm_ops before accessing vm_file
  - obmm: add PMD huge entry support for ptrace/GDB vma access
  - obmm: fix VMA access for ptrace/GDB on export regions
  - obmm: fix page table walk for ownership permission updates
  - obmm: reject MAP_PRIVATE
  - !23644 sync sentry modules bugfix patches
  - drivers/ub/sentry: enhance sentry module error handling and logging observability
  - drivers/ub/sentry: remove send/recv counter-based tjetty rebuild mechanism
  - drivers/ub/sentry: delete unimportant logs and optimize some log content
  - drivers/ub/sentry: fix sscanf buffer overflow in proc_client_info_write


author: Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.1.17.155
changelog:
  * Mon Jun 22 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.1.16.154
  - !24099 CVE-2026-46331
  - net/sched: fix pedit partial COW leading to page cache corruption


author: Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.1.19.156
changelog:
  - !24889 sync CVE LTS and bugfix from OLK-6.6
  - ub/ubdevshm: Support for acquiring va is a sub-range of registered va
  - urma: use xarray for ubagg/ubcore session lookup
  - urma: make ratelimit burst configurable for ubcore/uburma/ubagg
  - urma: use vzalloc for ubmad tjetty and ini_rtbuffer
  - urma: fix UAF of accessing jfs/jetty in log.
  - urma: ratelimit import jetty/jfr error logs
  - urma: drain jfe event lists in batches to avoid soft-lockup
  - urma: reduce ubagg topo log noise
  - urma: free jfe events outside lock
  - urma: free completion events outside jfe lock
  - urma: Fix the issue of inaccurate timing for some functions in DFX
  - urma: fix UAF of accessing token_id in log.
  - urma: fix tpid_reuse attached to vtpn causes use_after_free
  - urma: retry import jetty/jfr on EIO from tpid reuse failure
  - urma: limit ubagg connect exchange logs
  - mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise
  - urma: limit ubcore logs in reuse paths
  - ub: udma: Optimize udma jetty id access logic.
  - urma: fix workqueue use-after-free in ubagg_exit teardown sequence
  - sched/fair: Optimize wake_soft_domain() fast path
  - Revert "sched/fair: Record per-LLC utilization to guide cache-aware scheduling decisions"
  - Revert "kabi: Protect new sched_domain_shared fields with KABI_EXTEND"
  - Revert "sched: Inhibit soft domain scheduling when overutil"
  - Revert "sched/fair: Optimize wake_soft_domain() fast path"
  - Revert "sched/fair: Filter soft domain candidates in find_idlest_group/cpu"
  - sched/fair: Filter soft domain candidates in find_idlest_group/cpu
  - sched/fair: Optimize wake_soft_domain() fast path
  - sched: Inhibit soft domain scheduling when overutil
  - kabi: Protect new sched_domain_shared fields with KABI_EXTEND
  - sched/fair: Record per-LLC utilization to guide cache-aware scheduling decisions
  - urma: kref_get in find_add_tpid_reuse
  - iommu/ummu: Fix use-after-free in ummu_core_alloc_separate_tdev
  - urma: change log level to rl in ubagg_import_jetty and ubagg_import_seg
  - urma: create resources in ubmad_post_send before the ack message returns
  - ub: udma: Adjust the order of delete global variables.
  - urma: fix nullptr in ubcore_remove_jetty_from_jetty_grp
  - urma: fix several tp state and adapter disconnect cleanup bugs
  - urma: split tpid_reuse from vtpn to avoid use_after_free
  - urma: fix file lifetime race between open, close and device removal
  - urma: fix urma ping server cleanup paths
  - urma: fix call trace during JFR deletion
  - ub:ubus: Always invalidate tlb during decoder unmap
  - iommu/ummu: Fix nested TLB invalidation commands
  - iommu/ummu: Fix NULL pointer dereference in logic_ummu_tlb_inv_walk
  - ub: ubase: clear FE reset status register during probe
  - urma: free vtpn after free tpid reuse
  - urma: Support user mode to obtain statistical results of kernel interrupt times
  - urma: delete whether head is null in select tpid
  - urma: fix isref send no rsp to confirm state
  - urma: add huge lock in create tpid
  - urma: fix ref in ubmad and fix UAF in ubmad_rt_work_handler
  - urma: fix flush done event dispatch
  - urma: optimize sleep and logging in TPID reuse and rate-limited logs
  - ub: udma: Optimize the process of refcount_inc
  - mm/numa_remote: fix variable undeclared error when CONFIG_MEMORY_RELIABLE isn't enabled
  - ub:ubus: Optimize the initialization performance of USI INT_TYPE2
  - ub:ubus: Resolve the link change message is not reported before sending notify message
  - ub: udma: Intercept unsupported operations.
  - urma: fix ubcore device attr sl flag error
  - urma: fix tpid status and state reset
  - urma: fix reuse use cnt not balance cause dead lock
  - urma: fix deadlock when using loopback mode
  - urma: add order_type conversion for jfs/jfr/jetty/tjetty config
  - net: Fix kabi breakage of struct nf_queue_entry
  - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation
  - xfrm: Fix dev use-after-free in xfrm async resumption
  - xfrm: hold dev ref until after transport_finish NF_HOOK
  - xfrm: hold device only for the asynchronous decryption
  - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump
  - net: Fix kabi breakage of struct nf_conntrack_expect
  - netfilter: nf_conntrack_expect: restore helper propagation via expectation
  - netfilter: ctnetlink: ignore explicit helper on new expectations
  - netfilter: nf_conntrack_expect: store netns and zone in expectation
  - config: Enable ARM64_ERRATUM_4193714 ARM64_ERRATUM_4118414
  - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU
  - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU
  - arm64: errata: Mitigate TLBI errata on various Arm CPUs
  - arm64: cputype: Add C1-Premium definitions
  - arm64: cputype: Add C1-Ultra definitions
  - arm64: cputype: Add NVIDIA Olympus definitions
  - md raid: fix hang when stopping arrays with metadata through dm-raid
  - xfs: avoid dereferencing log items after push callbacks
  - xfs: save ailp before dropping the AIL lock in push callbacks
  - Revert "xfs: fix a UAF when inode item push"
  - ASoC: simple-card-utils: Don't use __free(device_node) at graph_util_parse_dai()
  - cifs: Fix busy dentry used after unmounting
  - wifi: cw1200: Revert "Fix locking in error paths"
  - drm/ssd130x: Fix atomic_check for disabled planes
  - cifs: open files should not hold ref on superblock
  - mm/kfence: disable KFENCE upon KASAN HW tags enablement
  - regulator: pca9450: Make IRQ optional
  - ASoC: simple-card-utils: fix graph_util_is_ports0() for DT overlays
  - ASoC: simple-card-utils: use __free(device_node) for device node
  - ASoC: soc-core: flush delayed work before removing DAIs and widgets
  - ASoC: soc-core: drop delayed_work_pending() check before flush
  - wifi: cw1200: Fix locking in error paths
  - drm/solomon: Fix page start when updating rectangle in page addressing mode
  - drm/ssd130x: Replace .page_height field in device info with a constant
  - drm/ssd130x: Store the HW buffer in the driver-private CRTC state
  - drm/ssd130x: Use bool for ssd130x_deviceinfo flags
  - ALSA: usb-audio: Cap the packet size pre-calculations
  - smb: client: require a full NFS mode SID before reading mode bits
  - netfilter: nft_inner: Fix IPv6 inner_thoff desync
  - tun: free page on short-frame rejection in tun_xdp_one()
  - net: gro: don't merge zcopy skbs
  - Bluetooth: l2cap: fix MPS check in l2cap_ecred_reconf_req
  - nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems
  - wifi: libertas: don't kill URBs in interrupt context
  - wifi: libertas: use USB anchors for tracking in-flight URBs
  - x86/kexec: add a sanity check on previous kernel's ima kexec buffer
  - Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ
  - Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ
  - Bluetooth: hci_qca: Cleanup on all setup failures
  - Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ
  - nfc: nxp-nci: remove interrupt trigger type
  - PCI: Enable ACS after configuring IOMMU for OF platforms
  - wifi: libertas: fix WARNING in usb_tx_block
  - Revert "net/smc: Introduce TCP ULP support"
  - tap: free page on error paths in tap_get_user_xdp()
  - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache
  - urma: fix ubcore device attr sl flag
  - urma: urma: use ctp+um to support large-scale D2D communications
  - urma: set tpid_status after deactive tp failed
  - urma: fix tpid reuse ref wrong
  - urma: fix jfr nullptr in ubcore_delete_jfr_batch
  - urma: fix ubagg topo bonding device name
  - urma: ubcore restrict CNA-level shared-CTP to RM+CTP only
  - urma: fix solves the UAF issue in the uburma_release_comp_event
  - ub: ub_fwctl: Modify the way ub_fwctl obtains device type and port type.
  - urma: fix mm_struct leakage in concurrent mmu_notifier release
  - urma: fix obj_arr memory leak
  - urma: fix tpid memory leak
  - urma: move ubagg failback req/result to user_ctl
  - urma: fix exist tpid reuse use cnt
  - urma: fix ubagg failback device lookup and teardown
  - ub: ub_fwctl: Modify the index for retrieving port historical status in ub_fwctl.
  - net: unic: Fix the DSCP-TC mapping is reset by the UNIC driver when the UNIC driver is reloaded
  - net: unic: Fix the issue of the first up network port reporting the netdev_change event
  - ub: udma: Resolve the issue of repeated va not being recognized.
  - sched/fair: Only update stats for allowed CPUs when looking for dst group
  - ub: cdma: replace ummu_alloc_tdev_separated with ummu_core_alloc_separate_tdev
  - urma: ubcore fix potential null pointer dereference on cnas
  - urma: add new query information of TP
  - urma: fix the incorrect reference count of tpid_list
  - urma: add order_type validation for UM+CTP in import functions
  - urma: Fix the issue of missing timing logic in the delete_jfc path
  - urma: fix missing lock when query tp_reuse info
  - urma: no error reported when failed to query host EID during shared-ctp
  - ub: udma: fix the bug in the eid update process.
  - urma: support failback notification in 1:N and N:1 scenarios
  - urma: ubcore fix missing topo CNA field in topology structs
  - urma: add multi-transport types,FLUSH_DMA opcode,device config extensions
  - urma: using nlattr to query tp information
  - urma: ubcore add CNA-level shared-CTP
  - urma: move topo query api from ubcore to ubagg
  - urma: fix post send failure when msn cfg is different
  - urma: add multi-transport types,FLUSH_DMA opcode,device config extensions
  - urma: Fix the issue of DFX functionality missing some header files during compilation
  - urma: ubagg add GET_RJETTY and GET_SEG_CTX ioctl handlers
  - urma: fix err log to info and change query to create
  - urma: Optimize the adaptability of the ubagg NL commands
  - urma: move v2p resource query api from ubcore to ubagg
  - urma: Optimize the adaptability of the NL commands
  - urma: remove uvs_get_route_list and standardize uvs tlv formats
  - urma: change the enum in ubcore_cmd.h for set_sl and genl_pid
  - iommu/ummu: Fix the problem of the shared identity page
  - iommu/ummu: Fix the adapt disable DVM issue
  - ub:ubus: modify ub virt notify
  - iommu/ummu: Mask the impact of the iommu.passthrough=1 configuration
  - iommu/ummu: Add dedicated Kconfig for GFP_HIGHUSER_MOVABLE support
  - iommu/ummu: Improve code quality and fix potential issues
  - ub: ub_fwctl: Modify TA layer to obtain WQE delay related registers.
  - iommu/ummu: Add the tect cache synchronization operation
  - ub: udma: Optimize the duplicate registration
  - ub: udma: fix issues of safe mode
  - !24825 Roll back the patch that was repeatedly integrated.
  - Revert "urma: Kernel-mode file for bugfix to move hashtable from alloc to active"
  - Revert "i3c: master: Inherit DMA masks and parameters from parent device"
  - !24817 sync from OLK-6.6  (6.6.0-145.0...6.6.0-159.0)
  - config: x86: Restore CONFIG_INIT_STACK_ALL_{PATTERN,ZERO} in openeuler_defconfig
  - x86: config: Enable resctrl related configs
  - x86: config: Enable Intel Application Energy Telemetry (AET)
  - config: x86: Fix CI "checkdefconfig" warning by updating defconfig
  - drivers/ub/sentry: add link down/up event detection and reporting
  - net: unic: Fix JFC context domain segment fields and
  - ub: unic: separate DSCP-TC and prio-TC mapping configuration
  - net: make CONFIG_UB_SOCKET_HANDSHAKE independent of CONFIG_UB_UMS
  - net: add sockopt TCP_UBS_HANDSHAKE
  - urma: refactor ubagg connect and message handling
  - ub: ub_fwctl: Modify the method of obtaining link status in the port_link command.
  - urma: ubcore enable shared-ctp
  - iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error
  - iommu/ummu: Fix null pointer problem during permission table expansion
  - urma: fix log error print wrong place
  - urma: add set_share_topo host EID programming path
  - ub: udma: fix the bug in the eid update process.
  - ub:ubus: Resolve the issue of msgq consuming CPU resources
  - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent
  - ub: ubase: optimize activate dev request handling in
  - ub: ubase: process change for querying SL through the
  - ub: udma: resolve the issue of false verification.
  - ub:ubus: Add new chip information into ubus_error_table
  - ub:ubus: ras adapter of the new chips
  - urma: Add host info lookup trie for CTP reuse
  - urma: add dfx for ns mode
  - tun: free page on build_skb failure in tun_xdp_one()
  - ub: ubase: set the delay processing time for ctrlq crq to
  - urma: add command to query TP information
  - ub: udma: resolve issues of create ccu_jetty.
  - ub: udma: set the jetty type by id
  - urma: fix target_reuse_tpid connect waiting times
  - drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get()
  - vfio:ubus: Corrected the English errors of vfio
  - ub:ubfi: Corrected the English errors of ubfi
  - ub:ubus: Corrected the English errors of ubus
  - ub:ubus: add module_version for udev modules
  - ub:ubus: Eliminate some compilation warnings on the code review platform
  - net: unic: resolve environment panic caused by alloc page
  - ub: cdma: refactor naming conventions and code cleanup
  - ASoC: nau8821: Cancel delayed work on component remove
  - ASoC: nau8821: Cancel pending work before suspend
  - octeon_ep: initialise control mbox tasks before using APIs
  - ub: ubase: increase reset task scheduling delay to avoid
  - urma: fix tpid reuse start up link error and ref cnt
  - iommu/ummu: Fix TLB invalidation flow in map/unmap
  - octeon_ep: ensure dbell BADDR updation
  - octeon_ep: set backpressure watermark for RX queues
  - octeon_ep: disable per ring interrupts
  - octeon_ep: support Octeon CN10K devices
  - octeon_ep: restructured interrupt handlers
  - octeon_ep: support to fetch firmware info
  - ASoC: nau8821: Fixup nau8821_enable_jack_detect()
  - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler
  - ASoC: nau8821: Consistently clear interrupts before unmasking
  - bpf, sockmap: Fix incorrect copied_seq calculation
  - urma: add eid sharing mode
  - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit
  - xfrm: Wait for RCU readers during policy netns exit
  - obmm: fix vma access check for PROT_WRITE-only mappings
  - ub: cdma: fix some code errors detected by AI in the kernel cdma
  - most: core: fix leak on early registration failure
  - most: core: fix resource leak in most_register_interface error paths
  - most: remove usage of the deprecated ida_simple_xx() API
  - fix "KVM: x86: Use scratch field in MMIO fragment to hold small write values" KABI CRC break issue
  - KVM: x86: Use scratch field in MMIO fragment to hold small write values
  - RDMA/hns: Return actual error code instead of fixed EINVAL
  - RDMA/hns: Fix RoCEv1 failure due to DSCP
  - bpf: Fix bpf_xdp_store_bytes proto for read-only arg
  - MAINTAINERS: remove Jerin Jacob from Marvell OcteonTX2
  - netfilter: x_tables: ensure names are nul-terminated
  - urma: validate ubcore message version for compatibility
  - netconsole: avoid OOB reads, msg is not nul-terminated
  - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs
  - scsi/hiraid: Support new RAID features and bug fixes
  - ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration
  - urma: change the enum in ubcore_cmd.h for netlink msg_type
  - ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently
  - bug fix for virtcca huk-based key encryption
  - urma: fix panic issue when ifconfig up/down ipourma device
  - drivers/iommu: Revise IOMMU memory reservation interface call timing
  - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side"
  - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt vcpu_is_preempted() support in guest side"
  - LoongArch: KVM: Revert "LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function"
  - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support
  - Revert "irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support"
  - bcache: fix uninitialized closure object
  - bcache: fix cached_dev.sb_bio use-after-free and crash
  - spi: spidev: fix lock inversion between spi_lock and buf_lock
  - mm: make SPLIT_PTE_PTLOCKS depend on SMP
  - powerpc/8xx: document and enforce that split PT locks are not used
  - mm: turn USE_SPLIT_PTE_PTLOCKS / USE_SPLIT_PTE_PTLOCKS into Kconfig options
  - ub: udma: optimizing the scheme for separating page
  - KVM: SVM: Add missing save/restore handling of LBR MSRs
  - urma:  fix unimport jetty function call and remove debug logs
  - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support
  - urma: enhance the reliability of the kernel-mode wk_jetty retransmission
  - x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8
  - urma: fix well-known jetty create/delete hook up with main ue eid event
  - ksmbd: close durable scavenger races against m_fp_list lookups
  - ksmbd: validate owner of durable handle on reconnect
  - ksmbd: add durable scavenger timer
  - ksmbd: avoid reclaiming expired durable opens by the client
  - usb: gadget: f_ecm: Fix net_device lifecycle with device_move
  - mm: fix CMA folio migration problems
  - mm: enhance CMA folio mempolicy support and fix MPOL_BIND bypass
  - urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time
  - ub: udma: add get tp list function.
  - EDAC/amd64:Update the SMN and nb interface used by Hygon processors in EDAC
  - hwmon/k10temp: Update the SMN interface used by Hygon processors in k10temp
  - x86/hygon_nb: Add Hygon Northbridge driver support via PCI enumeration
  - hwrng: core - use RCU and work_struct to fix race condition
  - hwrng: core - Allow runtime disabling of the HW RNG
  - RDMA/mlx5: Fix UMR hang in LAG error state unload
  - ub: ubase: adapt to the API of alloc memory of ummu
  - bpf: Remove smap argument from bpf_selem_free()
  - urma: implement kernel-space get tp list with hash table.
  - x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8
  - apparmor: Fix & Optimize table creation from possibly unaligned memory
  - AppArmor: Allow apparmor to handle unaligned dfa tables
  - drivers/ub/sentry: adapt to ubcore_get_tp_list semantic change
  - urma: fix uburma ioctl error handling for connection
  - xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb()
  - selftests/bpf: Add test for stale pkt range after scalar arithmetic
  - bpf: Drop pkt_end markers on arithmetic to prevent is_pkt_ptr_branch_taken
  - obmm: add feature-based enable control
  - dlm: validate length in dlm_search_rsb_tree
  - netfs: Fix potential uninitialised var in netfs_extract_user_iter()
  - net/rds: reset op_nents when zerocopy page pin fails
  - mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker
  - mptcp: pm: ADD_ADDR rtx: fix potential data-race
  - spi: sifive: fix controller deregistration
  - spi: sifive: Simplify clock handling with devm_clk_get_enabled()
  - media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0
  - spi: st-ssc4: fix controller deregistration
  - spi: st-ssc4: switch to use modern name
  - RDMA/mana: Fix error unwind in mana_ib_create_qp_rss()
  - f2fs: fix false alarm of lockdep on cp_global_sem lock
  - f2fs: fix incorrect file address mapping when inline inode is unwritten
  - mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0
  - mptcp: pm: prio: skip closed subflows
  - mptcp: fix rx timestamp corruption on fastopen
  - mptcp: drop __mptcp_fastopen_gen_msk_ackseq()
  - RDMA/mana: Validate rx_hash_key_len
  - btrfs: fix missing last_unlink_trans update when removing a directory
  - btrfs: use btrfs inodes in btrfs_rmdir() to avoid so much usage of BTRFS_I()
  - btrfs: use inode already stored in local variable at btrfs_rmdir()
  - smb: client: Use FullSessionKey for AES-256 encryption key derivation
  - drm/v3d: Reject empty multisync extension to prevent infinite loop
  - eventfs: Use list_add_tail_rcu() for SRCU-protected children list
  - pmdomain: core: Fix detach procedure for virtual devices in genpd
  - drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init
  - drm/gma500/oaktrail_lvds: fix hang on init failure
  - drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup
  - drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout()
  - drm/i915: skip __i915_request_skip() for already signaled requests
  - iommu/vt-d: Disable DMAR for Intel Q35 IGFX
  - libceph: handle rbtree insertion error in decode_choose_args()
  - libceph: Fix potential out-of-bounds access in crush_decode()
  - libceph: Fix potential null-ptr-deref in decode_choose_args()
  - libceph: Fix potential out-of-bounds access in osdmap_decode()
  - netfs: fix error handling in netfs_extract_user_iter()
  - powerpc/warp: Fix error handling in pika_dtm_thread
  - io-wq: check that the predecessor is hashed in io_wq_remove_pending()
  - ceph: fix a buffer leak in __ceph_setxattr()
  - ALSA: usb-audio: Bound MIDI endpoint descriptor scans
  - ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans
  - drm/i915/dp: Fix VSC dynamic range signaling for RGB formats
  - ASoC: SOF: Intel: hda: Fix NULL pointer dereference
  - ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond HDAudio
  - ASoC: SOF: Intel: hda-dai: remove dspless special case
  - KVM: x86: Fix Xen hypercall tracepoint argument assignment
  - KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic
  - KVM: Reject wrapped offset in kvm_reset_dirty_gfn()
  - audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV
  - net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled
  - netfilter: nft_ct: fix missing expect put in obj eval
  - audit: fix incorrect inheritable capability in CAPSET records
  - netfilter: nf_conntrack_sip: get helper before allocating expectation
  - workqueue: Fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path
  - i40e: Cleanup PTP pins on probe failure
  - crypto: af_alg - Cap AEAD AD length to 0x80000000
  - netconsole: avoid out-of-bounds access on empty string in trim_newline()
  - net/sched: sch_pie: annotate more data-races in pie_dump_stats()
  - ksmbd: validate response sizes in ipc_validate_msg()
  - net: bcmgenet: fix leaking free_bds
  - net: bcmgenet: Initialize u64 stats seq counter
  - crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx
  - ntfs: ->d_compare() must not block
  - net/sched: cls_flower: revert unintended changes
  - sfc: fix error code in efx_devlink_info_running_versions()
  - net: tls: fix strparser anchor skb leak on offload RX setup failure
  - ice: fix NULL pointer dereference in ice_reset_all_vfs()
  - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler
  - iavf: wait for PF confirmation before removing VLAN filters
  - iavf: stop removing VLAN filters from PF on interface down
  - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING
  - bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner
  - drm/amd/display: Read EDID from VBIOS embedded panel info
  - drm/amd/display: Allow DCE link encoder without AUX registers
  - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup
  - ALSA: hda/conexant: Fix missing error check for jack detection
  - ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87
  - ALSA: hda/conexant: fix some typos
  - netconsole: propagate device name truncation in dev_name_store()
  - net: netconsole: move newline trimming to function
  - net/sched: sch_cake: annotate data-races in cake_dump_stats() (V)
  - bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst()
  - ipv6: rename and move ip6_dst_lookup_tunnel()
  - ipv4: add new arguments to udp_tunnel_dst_lookup()
  - ipv4: remove "proto" argument from udp_tunnel_dst_lookup()
  - ipv4: rename and move ip_route_output_tunnel()
  - sctp: discard stale INIT after handshake completion
  - netfilter: skip recording stale or retransmitted INIT
  - ASoC: codecs: ab8500: Fix casting of private data
  - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring
  - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring
  - drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring
  - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring
  - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring
  - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring
  - drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings
  - drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings
  - drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings
  - net: phy: dp83869: fix setting CLK_O_SEL field.
  - net: mctp i2c: check length before marking flow active
  - ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams
  - neigh: let neigh_xmit take skb ownership
  - neighbour: add RCU protection to neigh_tables[]
  - net/sched: taprio: fix NULL pointer dereference in class dump
  - NFC: trf7970a: Ignore antenna noise when checking for RF field
  - net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit
  - net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()
  - vrf: Fix a potential NPD when removing a port from a VRF
  - net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats()
  - net/sched: sch_choke: annotate data-races in choke_dump_stats()
  - net/sched: netem: check for negative latency and jitter
  - net/sched: netem: fix slot delay calculation overflow
  - net/sched: netem: validate slot configuration
  - net/sched: netem: only reseed PRNG when seed is explicitly provided
  - net/sched: netem: fix queue limit check to include reordered packets
  - net/sched: netem: fix probability gaps in 4-state loss model
  - netdevsim: zero initialize struct iphdr in dummy sk_buff
  - cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro()
  - arm64/scs: Fix potential sign extension issue of advance_loc4
  - drm/sysfb: ofdrm: fix PCI device reference leaks
  - spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ
  - netfilter: nf_conntrack_sip: don't use simple_strtoul
  - netfilter: xt_policy: fix strict mode inbound policy matching
  - drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2)
  - drm/amdgpu/uvd3.1: Don't validate the firmware when already validated
  - drm/amdgpu: fix spelling typos
  - drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG
  - nvme-pci: fix missed admin queue sq doorbell write
  - netfilter: arp_tables: fix IEEE1394 ARP payload parsing
  - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers
  - btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent()
  - mailbox: mailbox-test: make data_ready a per-instance variable
  - mailbox: mailbox-test: initialize struct earlier
  - mailbox: mailbox-test: don't free the reused channel
  - mailbox: add sanity check for channel array
  - cgroup/rdma: fix integer overflow in rdmacg_try_charge()
  - mailbox: mailbox-test: free channels on probe error
  - fbdev: offb: fix PCI device reference leak on probe failure
  - rtc: abx80x: Disable alarm feature if no interrupt attached
  - fs/adfs: validate nzones in adfs_validate_bblk()
  - vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll()
  - tipc: fix double-free in tipc_buf_append()
  - nfp: fix swapped arguments in nfp_encode_basic_qdr() calls
  - net: dsa: realtek: rtl8365mb: fix mode mask calculation
  - net/sched: sch_sfb: annotate data-races in sfb_dump_stats()
  - net/sched: sch_red: annotate data-races in red_dump_stats()
  - net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats()
  - net/sched: sch_pie: annotate data-races in pie_dump_stats()
  - net_sched: sch_hhf: annotate data-races in hhf_dump_stats()
  - net/rds: zero per-item info buffer before handing it to visitors
  - ksmbd: scope conn->binding slowpath to bound sessions only
  - ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open
  - ksmbd: destroy async_ida in ksmbd_conn_free()
  - ksmbd: add support for supplementary groups
  - ksmbd: Use struct_size() to improve smb_direct_rdma_xmit()
  - ksmbd: destroy tree_conn_ida in ksmbd_session_destroy()
  - arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number
  - slip: bound decode() reads against the compressed packet length
  - slip: reject VJ receive packets on instances with no rstate array
  - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check
  - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching
  - ipvs: fix MTU check for GSO packets in tunnel mode
  - netfilter: xtables: restrict several matches to inet family
  - netfilter: conntrack: remove sprintf usage
  - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO
  - netfilter: nft_osf: restrict it to ipv4
  - openvswitch: cap upcall PID array size and pre-size vport replies
  - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks
  - ipv6: fix possible UAF in icmpv6_rcv()
  - e1000e: Unroll PTP in probe error handling
  - i40e: don't advertise IFF_SUPP_NOFCS
  - ice: fix double-free of tx_buf skb
  - ice: Remove jumbo_remove step from TX path
  - tcp: annotate data-races around tp->plb_rehash
  - tcp: annotate data-races around (tp->write_seq - tp->snd_nxt)
  - tcp: annotate data-races around tp->dsack_dups
  - tcp: annotate data-races around tp->bytes_retrans
  - tcp: annotate data-races around tp->bytes_sent
  - tcp: add data-race annotations around tp->data_segs_out and tp->total_retrans
  - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch
  - nexthop: fix IPv6 route referencing IPv4 nexthop
  - net/sched: sch_cake: fix NAT destination port not being updated in cake_update_flowkeys
  - macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF
  - arm64: dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT
  - arm64: dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT
  - arm64: dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT
  - PCMCIA: Fix garbled log messages for KERN_CONT
  - arm64: dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for PMIC_nINT
  - arm64: dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT
  - arm64: dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT
  - arm64: dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT
  - arm64: dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT
  - crypto: ccp - copy IV using skcipher ivsize
  - crypto: sa2ul - Fix AEAD fallback algorithm names
  - drm/i915/wm: Verify the correct plane DDB entry
  - drm/i915: Loop over all active pipes in intel_mbus_dbox_update
  - drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update()
  - drm/i915: Simplify watermark state checker calling convention
  - drm/i915: Constify watermark state checker
  - f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show()
  - f2fs: Use sysfs_emit_at() to simplify code
  - clk: visconti: pll: initialize clk_init_data to zero
  - lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug()
  - clk: qcom: dispcc-sc7180: Add missing MDSS resets
  - dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets
  - clk: xgene: Fix mapping leak in xgene_pllclk_init()
  - clk: qoriq: avoid format string warning
  - clk: imx8mq: Correct the CSI PHY sels
  - clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels()
  - clk: imx: imx6q: Fix device node reference leak in pll6_bypassed()
  - clk: qcom: dispcc-sm8250: Enable parents for pixel clocks
  - clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk
  - clk: qcom: gcc-sc8180x: Use retention for PCIe power domains
  - clk: qcom: gcc-sc8180x: Use retention for USB power domains
  - clk: qcom: gcc-sc8180x: Add missing GDSCs
  - dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs
  - scsi: target: core: Fix integer overflow in UNMAP bounds check
  - clk: qcom: dispcc-sc8280xp: remove CLK_SET_RATE_PARENT from byte_div_clk_src dividers
  - scsi: sg: Resolve soft lockup issue when opening /dev/sgX
  - scsi: sg: Fix sysctl sg-big-buff register during sg_init()
  - scsi: sg: Make sg_sysfs_class constant
  - clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source
  - RDMA/core: Prefer NLA_NUL_STRING
  - platform/x86: dell-wmi-sysman: bound enumeration string aggregation
  - platform/x86: dell_rbu: avoid uninit value usage in packet_size_write()
  - fs/ntfs3: terminate the cached volume label after UTF-8 conversion
  - nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist()
  - mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata()
  - platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup
  - tty: hvc_iucv: fix off-by-one in number of supported devices
  - leds: lgm-sso: Remove duplicate assignments for priv->mmap
  - platform/surface: surfacepro3_button: Drop wakeup source on remove
  - backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt()
  - dev_printk: add new dev_err_probe() helpers
  - i3c: mipi-i3c-hci: fix IBI payload length calculation for final status
  - perf util: Kill die() prototype, dead for a long time
  - ipmi: ssif_bmc: change log level to dbg in irq callback
  - ipmi: ssif_bmc: fix message desynchronization after truncated response
  - ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure
  - perf expr: Return -EINVAL for syntax error in expr__find_ids()
  - perf lock: Fix option value type in parse_max_stack
  - pinctrl: abx500: Fix type of 'argument' variable
  - perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace
  - perf branch: Avoid incrementing NULL
  - pinctrl: cy8c95x0: Avoid returning positive values to user space
  - pinctrl: cy8c95x0: Unify messages with help of dev_err_probe()
  - pinctrl: cy8c95x0: remove duplicate error message
  - pinctrl: pinctrl-pic32: Fix resource leak
  - bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT
  - bpf: allow UTF-8 literals in bpf_bprintf_prepare()
  - bpf: Fix precedence bug in convert_bpf_ld_abs alignment check
  - bpf, sockmap: Take state lock for af_unix iter
  - bpf, sockmap: Fix af_unix null-ptr-deref in proto update
  - bpf, sockmap: Fix af_unix iter deadlock
  - HID: usbhid: fix deadlock in hid_post_reset()
  - mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob
  - mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions
  - mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path
  - mtd: spi-nor: swp: check SR_TB flag when getting tb_mask
  - mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation
  - mtd: spi-nor: sfdp: introduce smpt_map_id fixup hook
  - mtd: spi-nor: sfdp: introduce smpt_read_dummy fixup hook
  - mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations
  - dt-bindings: interrupt-controller: arm,gic-v3: Fix EPPI range
  - mtd: physmap_of_gemini: Fix disabled pinctrl state check
  - HID: asus: do not abort probe when not necessary
  - HID: asus: make asus_resume adhere to linux kernel coding standards
  - ima: check return value of crypto_shash_final() in boot aggregate
  - soundwire: cadence: Clear message complete before signaling waiting thread
  - dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register()
  - soundwire: bus: demote UNATTACHED state warnings to dev_dbg()
  - dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function
  - ocfs2: validate group add input before caching
  - ocfs2: validate bg_bits during freefrag scan
  - ocfs2: fix listxattr handling when the buffer is full
  - ARM: dts: imx27-eukrea: replace interrupts with interrupts-extended
  - arm64/xor: fix conflicting attributes for xor_block_template
  - ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX
  - arm64: dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP
  - soc: qcom: aoss: compare against normalized cooling state
  - soc: qcom: llcc: fix v1 SB syndrome register offset
  - ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison
  - ocfs2/dlm: validate qr_numregions in dlm_match_regions()
  - unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure
  - soc/tegra: cbb: Set ERD on resume for err interrupt
  - arm64: dts: imx8qxp-mek: switch Type-C connector power-role to dual
  - arm64: dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered during boot
  - arm64: dts: qcom: sm7225-fairphone-fp4: Fix conflicting bias pinctrl
  - arm64: dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes
  - arm64: dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes
  - arm64: dts: qcom: sm8550: Fix xo clock supply of platform SD host controller
  - arm64: dts: qcom: sm8550: Fix GIC_ITS range length
  - arm64: dts: qcom: sm8450: Fix GIC_ITS range length
  - soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available
  - soc: qcom: ocmem: register reasons for probe deferrals
  - soc: qcom: ocmem: use scoped device node handling to simplify error paths
  - soc: qcom: ocmem: make the core clock optional
  - arm64: dts: qcom: msm8953-xiaomi-daisy: fix backlight
  - arm64: dts: qcom: msm8953-xiaomi-vince: correct wled ovp value
  - arm64: dts: mediatek: mt7986a: Fix gpio-ranges pin count
  - arm64: dts: mediatek: mt6795: Fix gpio-ranges pin count
  - arm64: dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO (M.2 W_DISABLE1)
  - arm64: dts: imx8-apalis: Fix LEDs name collision
  - memory: tegra30-emc: Fix dll_change check
  - memory: tegra124-emc: Fix dll_change check
  - ARM: dts: mediatek: mt7623: fix efuse fallback compatible
  - ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine
  - efi/capsule-loader: fix incorrect sizeof in phys array reallocation
  - gfs2: prevent NULL pointer dereference during unmount
  - gfs2: add some missing log locking
  - quota: Fix race of dquot_scan_active() with quota deactivation
  - ktest: Run POST_KTEST hooks on failure and cancellation
  - ktest: Honor empty per-test option overrides
  - ktest: Avoid undef warning when WARNINGS_FILE is unset
  - gfs2: Call unlock_new_inode before d_instantiate
  - crypto: jitterentropy - replace long-held spinlock with mutex
  - dm cache: fix missing return in invalidate_committed's error path
  - ALSA: sc6000: Keep the programmed board state in card-private data
  - ALSA: sc6000: Use standard print API
  - spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback
  - PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well
  - PCI: tegra194: Use DWC IP core version
  - PCI: tegra194: Allow system suspend when the Endpoint link is not up
  - PCI: tegra194: Disable direct speed change for Endpoint mode
  - PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select"
  - PCI: tegra194: Disable PERST# IRQ only in Endpoint mode
  - PCI: tegra194: Don't force the device into the D0 state before L2
  - PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in tegra_pcie_downstream_dev_to_D0()
  - PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down
  - PCI: tegra194: Increase LTSSM poll time on surprise link down
  - PCI: tegra194: Fix polling delay for L2 state
  - ASoC: SOF: compress: return the configured codec from get_params
  - ALSA: scarlett2: Add missing sentinel initializer field
  - selftest: memcg: skip memcg_sock test if address family not supported
  - Documentation: fix a hugetlbfs reservation statement
  - selftests/mm: skip migration tests if NUMA is unavailable
  - PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found
  - PCI: Enable AtomicOps only if Root Port supports them
  - ASoC: rsnd: Fix potential out-of-bounds access of component_dais[]
  - crypto: qat - use swab32 macro
  - ASoC: qcom: qdsp6: topology: check widget type before accessing data
  - ASoC: fsl_easrc: Change the type for iec958 channel status controls
  - ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits()
  - ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits()
  - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put()
  - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put()
  - ASoC: fsl_micfil: Fix event generation in micfil_quality_set()
  - ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state()
  - ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode()
  - ASoC: fsl_micfil: Fix event generation in hwvad_put_enable()
  - ASoC: fsl_micfil: Add access property for "VAD Detected"
  - pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe()
  - pmdomain: ti: omap_prm: Fix a reference leak on device node
  - drm/msm/a6xx: Use barriers while updating HFI Q headers
  - drm/msm/shrinker: Fix can_block() logic
  - drm/msm/a6xx: Fix HLSQ register dumping
  - ASoC: SOF: Intel: hda: Place check before dereference
  - ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}')
  - drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board
  - drm/amd/pm/ci: Fill DW8 fields from SMC
  - drm/amd/pm/ci: Clear EnabledForActivity field for memory levels
  - drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0
  - drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock
  - drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs
  - drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled
  - ALSA: core: Validate compress device numbers without dynamic minors
  - drm/panel: simple: Correct G190EAN01 prepare timing
  - drm/panel: sharp-ls043t1le01: make use of prepare_prev_first
  - drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0
  - drm/msm/dsi: add the missing parameter description
  - drm/msm/dpu: fix mismatch between power and frequency
  - spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo
  - drm/amdgpu/gfx10: look at the right prop for gfx queue priority
  - crypto: atmel-aes - guard unregister on error in atmel_aes_register_algs
  - crypto: atmel - Use unregister_{aeads,ahashes,skciphers}
  - crypto: atmel - Remove cfb and ofb
  - fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break
  - dm init: ensure device probing has finished in dm-mod.waitfor=
  - drm/amdgpu: Add default case in DVI mode validation
  - drm/sun4i: Fix resource leaks
  - spi: fsl-qspi: Use reinit_completion() for repeated operations
  - drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check
  - drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs
  - drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable()
  - dm log: fix out-of-bounds write due to region_count overflow
  - dm cache metadata: fix memory leak on metadata abort retry
  - platform/chrome: chromeos_tbmc: Drop wakeup source on remove
  - dm cache: fix dirty mapping checking in passthrough mode switching
  - dm cache: support shrinking the origin device
  - dm cache: fix concurrent write failure in passthrough mode
  - dm cache policy smq: fix missing locks in invalidating cache blocks
  - dm cache: fix write hang in passthrough mode
  - dm cache: fix write path cache coherency in passthrough mode
  - dm cache: fix null-deref with concurrent writes in passthrough mode
  - ASoC: sti: use managed regmap_field allocations
  - ASoC: sti: Return errors from regmap_field_alloc()
  - drm/sun4i: backend: fix error pointer dereference
  - drm/komeda: fix integer overflow in AFBC framebuffer size check
  - net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master
  - sctp: fix missing encap_port propagation for GSO fragments
  - net: phy: qcom: at803x: Use the correct bit to disable extended next page
  - net: phy: move at803x PHY driver to dedicated directory
  - net: phy: add Rust Asix PHY driver
  - net: phy: aquantia: move to separate directory
  - bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb
  - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic()
  - net/mlx5e: Fix features not applied during netdev registration
  - dt-bindings: net: dsa: nxp,sja1105: make spi-cpol optional for sja1110
  - net: ipa: Fix decoding EV_PER_EE for IPA v5.0+
  - net: ipa: Fix programming of QTIME_TIMESTAMP_CFG
  - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls
  - net/rds: Restrict use of RDS/IB to the initial network namespace
  - net/rds: Optimize rds_ib_laddr_check
  - net/sched: act_ct: Only release RCU read lock after ct_ft
  - net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf
  - 6pack: propagage new tty types
  - netfilter: nft_fwd_netdev: check ttl/hl before forwarding
  - netfilter: xt_socket: enable defrag after all other checks
  - net: bcmgenet: fix racing timeout handler
  - net: bcmgenet: switch to use 64bit statistics
  - net: bcmgenet: support reclaiming unsent Tx packets
  - net: bcmgenet: move DESC_INDEX flow to ring 0
  - net: bcmgenet: add bcmgenet_has_* helpers
  - net: bcmgenet: Remove custom ndo_poll_controller()
  - net: bcmgenet: fix off-by-one in bcmgenet_put_txcb
  - arm64: kexec: Remove duplicate allocation for trans_pgd
  - ACPI: AGDI: fix missing newline in error message
  - bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec()
  - wifi: brcmfmac: Fix error pointer dereference
  - macvlan: annotate data-races around port->bc_queue_len_used
  - selftests/powerpc: Suppress -Wmaybe-uninitialized with GCC 15
  - selftests/powerpc: Re-order *FLAGS to follow lib.mk
  - powerpc/crash: fix backup region offset update to elfcorehdr
  - r8152: fix incorrect register write to USB_UPHY_XTAL
  - wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap()
  - wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work()
  - wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event
  - arm64: cpufeature: Make PMUVer and PerfMon unsigned
  - wifi: mt76: mt7996: fix FCS error flag check in RX descriptor
  - wifi: mt76: mt7915: fix use_cts_prot support
  - wifi: mt76: mt7615: fix use_cts_prot support
  - wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr()
  - module: Fix freeing of charp module parameters when CONFIG_SYSFS=n
  - params: Replace __modinit with __init_or_module
  - s390/bpf: Zero-extend bpf prog return values and kfunc arguments
  - dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n
  - dpaa2: add independent dependencies for FSL_DPAA2_SWITCH
  - bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap
  - bpf: Add CHECKSUM_COMPLETE to bpf test progs
  - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet
  - wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt()
  - firmware: dmi: Correct an indexing error in dmi.h
  - locking: Fix rwlock support in <linux/spinlock_up.h>
  - hrtimer: Reduce trace noise in hrtimer_start()
  - hrtimer: Avoid pointless reprogramming in __hrtimer_start_range_ns()
  - hrtimers: Update the return type of enqueue_hrtimer()
  - irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter
  - s390/cio: use generic driver_override infrastructure
  - s390/cio: convert sprintf()/snprintf() to sysfs_emit()
  - s390/cio: make sch->lock spinlock pointer a member
  - debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str()
  - debugfs: check for NULL pointer in debugfs_create_str()
  - thermal/drivers/spear: Fix error condition for reading st,thermal-flags
  - devres: fix missing node debug info in devm_krealloc()
  - ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver
  - ACPI: x86: cmos_rtc: Clean up address space handler driver
  - blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current()
  - nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty()
  - loop: fix partition scan race between udev and loop_reread_partitions()
  - drbd: Balance RCU calls in drbd_adm_dump_devices()
  - fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START
  - blk-cgroup: wait for blkcg cleanup before initializing new disk
  - smb: client: use kzalloc to zero-initialize security descriptor buffer
  - mtd: spi-nor: sst: Fix SST write failure
  - drm/amdgpu/vcn4: Avoid overflow on msg bound check
  - drm/amdgpu/vcn3: Avoid overflow on msg bound check
  - vsock/virtio: fix length and offset in tap skb for split packets
  - vsock: fix buffer size clamping order
  - KVM: arm64: Wake-up from WFI when iqrchip is in userspace
  - usb: dwc3: Move GUID programming after PHY initialization
  - tracing/probes: Limit size of event probe to 3K
  - btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak
  - pwm: imx-tpm: Count the number of enabled channels in probe
  - mtd: spi-nor: sst: Fix write enable before AAI sequence
  - mtd: spi-nor: sst: Factor out common write operation to `sst_nor_write_data()`
  - ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger
  - mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values
  - usb: typec: tcpm: reset internal port states on soft reset AMS
  - mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values
  - mm/damon/core: implement damon_kdamond_pid()
  - mm/damon/core: disallow time-quota setting zero esz
  - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb()
  - fbcon: Avoid OOB font access if console rotation fails
  - spi: microchip-core-qspi: fix controller deregistration
  - spi: microchip-core-qspi: Use helper function devm_clk_get_enabled()
  - mm/hugetlb_cma: round up per_node before logging it
  - spi: uniphier: fix controller deregistration
  - spi: uniphier: Simplify clock handling with devm_clk_get_enabled()
  - spi: uniphier: switch to use modern name
  - spi: tegra20-sflash: fix controller deregistration
  - spi: tegra114: fix controller deregistration
  - spi: sun6i: fix controller deregistration
  - spi: sun6i: switch to use modern name
  - spi: zynq-qspi: fix controller deregistration
  - spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled()
  - spi: zynq-qspi: switch to use modern name
  - spi: ti-qspi: fix controller deregistration
  - spi: spi-ti-qspi: switch to use modern name
  - spi: spi-ti-qspi: Convert to platform remove callback returning void
  - spi: sun4i: fix controller deregistration
  - spi: sun4i: switch to use modern name
  - spi: syncuacer: fix controller deregistration
  - spi: synquacer: switch to use modern name
  - Bluetooth: hci_conn: fix potential UAF in create_big_sync
  - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete
  - xfrm: ah: account for ESN high bits in async callbacks
  - net: ipv6: stop checking crypto_ahash_alignmask
  - net: ipv4: stop checking crypto_ahash_alignmask
  - net: stmmac: Prevent NULL deref when RX memory exhausted
  - net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY()
  - net: stmmac: avoid shadowing global buf_sz
  - crypto: caam - guard HMAC key hex dumps in hash_digest_key
  - printk: add print_hex_dump_devel()
  - wifi: rtl8xxxu: fix potential use of uninitialized value
  - hfsplus: fix held lock freed on hfsplus_fill_super()
  - hfsplus: fix uninit-value by validating catalog record size
  - xfs: fix a resource leak in xfs_alloc_buftarg()
  - mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs
  - udf: fix partition descriptor append bookkeeping
  - firmware: google: framebuffer: Do not unregister platform device
  - spi: fix resource leaks on device setup failure
  - net: qrtr: ns: Limit the total number of nodes
  - net: qrtr: ns: Limit the maximum number of lookups
  - net: qrtr: ns: Limit the maximum server registration per node
  - net: bridge: use a stable FDB dst snapshot in RCU readers
  - net: mctp: fix don't require received header reserved bits to be zero
  - RDMA/mana_ib: Disable RX steering on RSS QP destroy
  - sched: Use u64 for bandwidth ratio calculations
  - block: relax pgmap check in bio_add_page for compatible zone device pages
  - PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete
  - wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling
  - wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor
  - wifi: mt76: connac: introduce helper for mt7925 chipset
  - lib: test_hmm: evict device pages on file close to avoid use-after-free
  - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()
  - batman-adv: bla: put backbone reference on failed claim hash insert
  - batman-adv: bla: only purge non-released claims
  - batman-adv: bla: prevent use-after-free when deleting claims
  - batman-adv: stop caching unowned originator pointers in BAT IV
  - batman-adv: reject new tp_meter sessions during teardown
  - batman-adv: fix integer overflow on buff_pos
  - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL
  - drm/amdgpu/pm: align Hawaii mclk workaround with radeon
  - drm/amdgpu/pm: add missing revision check for CI
  - drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission
  - drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ
  - drm/amdgpu: zero-initialize GART table on allocation
  - drm/radeon: add missing revision check for CI
  - drm/amdkfd: validate SVM ioctl nattr against buffer size
  - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()
  - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg
  - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg
  - drm/amdgpu/vce: Prevent partial address patches
  - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB
  - drm/amdgpu: Add bounds checking to ib_{get,set}_value
  - drm/amdkfd: Add upper bound check for num_of_nodes
  - drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure
  - spi: cadence: fix unclocked access on unbind
  - spi: cadence: fix controller deregistration
  - spi: mpc52xx: fix use-after-free on unbind
  - spi: orion: fix clock imbalance on registration failure
  - spi: orion: fix runtime pm leak on unbind
  - spi: imx: fix runtime pm leak on probe deferral
  - spi: img-spfi: fix controller deregistration
  - spi: rspi: fix controller deregistration
  - spi: sprd: fix controller deregistration
  - spi: coldfire-qspi: fix controller deregistration
  - spi: bcmbca-hsspi: fix controller deregistration
  - spi: fsl: fix controller deregistration
  - spi: sh-hspi: fix controller deregistration
  - spi: mtk-nor: fix controller deregistration
  - spi: omap2-mcspi: fix controller deregistration
  - spi: fsl-espi: fix controller deregistration
  - spi: s3c64xx: fix controller deregistration
  - spi: dln2: fix controller deregistration
  - media: omap3isp: drop the use count of v4l2 pipeline
  - media: i2c: ov08d10: fix image vertical start setting
  - media: staging: imx: request mbus_config in csi_start
  - media: i2c: imx412: Assert reset GPIO during probe
  - media: dib8000: avoid division by 0 in dib8000_set_dds()
  - media: pci: zoran: fix potential memory leak in zoran_probe()
  - platform/x86: hp-wmi: Ignore backlight and FnLock events
  - media: saa7164: add ioremap return checks and cleanups
  - spi: at91-usart: fix controller deregistration
  - spi: qup: fix controller deregistration
  - spi: lantiq-ssc: fix controller deregistration
  - regulator: bd9571mwv: fix OF node reference imbalance
  - regulator: act8945a: fix OF node reference imbalance
  - media: videobuf2: Set vma_flags in vb2_dma_sg_mmap
  - regulator: rk808: fix OF node reference imbalance
  - media: rc: streamzap: Error handling in probe
  - media: rc: xbox_remote: heed DMA restrictions
  - regulator: max77650: fix OF node reference imbalance
  - regulator: mt6357: fix OF node reference imbalance
  - staging: media: atomisp: Disallow all private IOCTLs
  - spi: atmel: fix controller deregistration
  - spi: bcm63xx: fix controller deregistration
  - media: i2c: ov8856: free control handler on error in ov8856_init_controls()
  - media: uvcvideo: Enable VB2_DMABUF for metadata stream
  - HID: playstation: Clamp num_touch_reports
  - exit: Sleep at TASK_IDLE when waiting for application core dump
  - LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup
  - LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang()
  - KVM: arm64: Fix initialisation order in __pkvm_init_finalise()
  - KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value
  - f2fs: fix node_cnt race between extent node destroy and writeback
  - f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks()
  - f2fs: fix fiemap boundary handling when read extent cache is incomplete
  - f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode()
  - mptcp: fix scheduling with atomic in timestamp sockopt
  - mptcp: sockopt: set timestamp flags on subflow socket, not msk
  - mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure
  - mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure
  - mptcp: fastclose msk when linger time is 0
  - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path
  - RDMA/rxe: Reject unknown opcodes before ICRC processing
  - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads
  - RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp()
  - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()
  - power: supply: max17042: avoid overflow when determining health
  - PCI/AER: Stop ruling out unbound devices as error source
  - PCI/AER: Clear only error bits in PCIe Device Status
  - KVM: x86: check for nEPT/nNPT in slow flush hypercalls
  - smb: client: validate dacloffset before building DACL pointers
  - smb/client: fix out-of-bounds read in symlink_data()
  - smb/client: fix out-of-bounds read in smb2_compound_op()
  - s390/debug: Reject zero-length input in debug_input_flush_fn()
  - RDMA/hns: Fix unlocked call to hns_roce_qp_remove()
  - nvme-apple: drop invalid put of admin queue reference count
  - md/raid10: fix divide-by-zero in setup_geo() with zero far_copies
  - libceph: Fix slab-out-of-bounds access in auth message processing
  - lib/scatterlist: fix temp buffer in extract_user_to_sg()
  - lib/scatterlist: fix length calculations in extract_kvec_to_sg
  - isofs: validate block number from NFS file handle in isofs_export_iget
  - isofs: validate Rock Ridge CE continuation extent against volume size
  - dm-verity-fec: correctly reject too-small hash devices
  - dm-verity-fec: correctly reject too-small FEC devices
  - dm: fix a buffer overflow in ioctl processing
  - dm: don't report warning when doing deferred remove
  - dm-thin: fix metadata refcount underflow
  - ASoC: qcom: q6apm: remove child devices when apm is removed
  - ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens
  - ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop
  - ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error
  - ASoC: fsl_easrc: fix comment typo
  - ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table
  - cpuidle: powerpc: avoid double clear when breaking snooze
  - clk: microchip: mpfs-ccc: fix out of bounds access during output registration
  - clk: imx: imx8-acm: fix flags for acm clocks
  - spi: topcliff-pch: fix use-after-free on unbind
  - thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp
  - thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata
  - udf: reject descriptors with oversized CRC length
  - ibmveth: Disable GSO for packets with small MSS
  - hv_sock: fix ARM64 support
  - gpio: of: clear OF_POPULATED on hog nodes in remove path
  - extcon: ptn5150: handle pending IRQ events during system resume
  - cifs: change_conf needs to be called for session setup
  - cifs: abort open_cached_dir if we don't request leases
  - block: add pgmap check to biovec_phys_mergeable
  - af_unix: Reject SIOCATMARK on non-stream sockets
  - hwmon: (corsair-psu) Close HID device on probe errors
  - clk: rk808: fix OF node reference imbalance
  - hwmon: (ltc2992) Fix u32 overflow in power read path
  - hwmon: (ltc2992) Clamp threshold writes to hardware range
  - parisc: Fix IRQ leak in LASI driver
  - net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler
  - net/rds: handle zerocopy send cleanup before the message is queued
  - ip6_gre: Use cached t->net in ip6erspan_changelink().
  - net: libwx: fix VF illegal register access
  - sound: ua101: fix division by zero at probe
  - net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo
  - fanotify: fix false positive on permission events
  - staging: vme_user: fix root device leak on init failure
  - spi: s3c64xx: fix NULL-deref on driver unbind
  - spi: zynqmp-gqspi: fix controller deregistration
  - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb()
  - Bluetooth: virtio_bt: validate rx pkt_type header length
  - Bluetooth: virtio_bt: clamp rx length before skb_put
  - selinux: prune /sys/fs/selinux/disable
  - selinux: shrink critical section in sel_write_load()
  - selinux: don't reserve xattr slot when we won't fill it
  - ipv6: xfrm6: release dst on error in xfrm6_rcv_encap()
  - xfrm: provide message size for XFRM_MSG_MAPPING
  - powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o
  - ALSA: firewire-tascam: Do not drop unread control events
  - USB: serial: option: add Telit Cinterion LE910Cx compositions
  - USB: omap_udc: DMA: Don't enable burst 4 mode
  - ALSA: usb-audio: Fix UAC3 cluster descriptor size check
  - ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3()
  - ALSA: usb-audio: midi2: Restart output URBs on resume
  - wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task
  - wifi: b43: enforce bounds check on firmware key index in b43_rx()
  - wifi: mac80211: remove station if connection prep fails
  - wifi: ath5k: do not access array OOB
  - wifi: mac80211: drop stray 'static' from fast-RX rx_result
  - wifi: b43legacy: enforce bounds check on firmware key index in RX path
  - wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work
  - wifi: mt76: mt7921: fix a potential clc buffer length underflow
  - exit: prevent preemption of oopsing TASK_DEAD task
  - selftests/bpf: validate fake register spill/fill precision backtracking logic
  - selftests/bpf: validate precision logic in partial_stack_load_preserves_zeros
  - selftests/bpf: validate zero preservation for sub-slot loads
  - selftests/bpf: validate STACK_ZERO is preserved on subreg spill
  - net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked
  - KVM: SVM: check validity of VMCB controls when returning from SMM
  - flow_dissector: do not dissect PPPoE PFC frames
  - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN
  - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets
  - rxrpc: Fix potential UAF after skb_unshare() failure
  - spi: meson-spicc: Fix double-put in remove path
  - drm/amd/display: Do not skip unrelated mode changes in DSC validation
  - spi: rockchip: fix controller deregistration
  - ASoC: SOF: Don't allow pointer operations on unconfigured streams
  - iommufd: Fix a race with concurrent allocation and unmap
  - ACPI: video: force native backlight on HP OMEN 16 (8A44)
  - ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug
  - ACPI: scan: Use acpi_dev_put() in object add error paths
  - fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free
  - ipmi:si: Return state to normal if message allocation fails
  - ipmi: Check event message buffer response for bad data
  - ipmi: Add limits to event and receive message requests
  - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()
  - netfilter: reject zero shift in nft_bitwise
  - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels
  - drm/amdgpu: fix zero-size GDS range init on RDNA4
  - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
  - seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode
  - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails
  - rtmutex: Use waiter::task instead of current in remove_waiter()
  - ntfs3: fix integer overflow in run_unpack() volume boundary check
  - ntfs3: add buffer boundary checks to run_unpack()
  - ktest: Fix the month in the name of the failure directory
  - IB/core: Fix zero dmac race in neighbor resolution
  - dm mirror: fix integer overflow in create_dirty_log()
  - crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path
  - crypto: atmel-tdes - fix DMA sync direction
  - crypto: ccree - fix a memory leak in cc_mac_digest()
  - crypto: hisilicon - Fix dma_unmap_single() direction
  - crypto: atmel-ecc - Release client on allocation failure
  - crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup
  - crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit
  - can: ucan: fix devres lifetime
  - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers
  - taskstats: set version in TGID exit notifications
  - tcp: call sk_data_ready() after listener migration
  - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails
  - md/raid5: validate payload size before accessing journal metadata
  - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all()
  - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access
  - mtd: docg3: fix use-after-free in docg3_release()
  - mtd: docg3: Convert to platform remove callback returning void
  - KVM: nSVM: Add missing consistency check for nCR3 validity
  - KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS
  - KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT
  - KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT
  - KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID)
  - KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN
  - KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT
  - KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode
  - KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts
  - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2
  - KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state
  - KVM: x86: Defer non-architectural deliver of exception payload to userspace read
  - userfaultfd: allow registration of ranges below mmap_min_addr
  - mm/damon/core: use time_in_range_open() for damos quota window start
  - rtc: ntxec: fix OF node reference imbalance
  - tpm: tpm_tis: stop transmit if retries are exhausted
  - tpm: tpm_tis: add error logging for data transfer
  - crypto: talitos - rename first/last to first_desc/last_desc
  - crypto: talitos - fix SEC1 32k ahash request limitation
  - arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins
  - mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration
  - mmc: block: use single block write in retry
  - power: supply: axp288_charger: Do not cancel work before initializing it
  - LoongArch: Show CPU vulnerabilites correctly
  - tpm: avoid -Wunused-but-set-variable
  - extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE'
  - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply()
  - ipv4: icmp: validate reply type before using icmp_pointers
  - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv
  - drm/arcpgu: fix device node leak
  - net: ks8851: Avoid excess softirq scheduling
  - net: ks8851: Reinstate disabling of BHs around IRQ handler
  - net/smc: avoid early lgr access in smc_clc_wait_msg
  - net: rds: fix MR cleanup on copy error
  - net: qrtr: ns: Free the node during ctrl_cmd_bye()
  - tools/accounting: handle truncated taskstats netlink messages
  - rxrpc: Fix re-decryption of RESPONSE packets
  - rxrpc: Fix rxkad crypto unalignment handling
  - rxrpc: Fix memory leaks in rxkad_verify_response()
  - iio: adc: ad7768-1: fix one-shot mode data acquisition
  - io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE
  - io_uring/poll: fix signed comparison in io_poll_get_ownership()
  - iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned()
  - io_uring/timeout: check unused sqe fields
  - rbd: fix null-ptr-deref when device_add_disk() fails
  - selftests/mqueue: Fix incorrectly named file
  - remoteproc: xlnx: Only access buffer information if IPI is buffered
  - parisc: _llseek syscall is only available for 32-bit userspace
  - nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set
  - nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4
  - mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused
  - md/raid10: fix deadlock with check operation and nowait requests
  - ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes
  - ALSA: ctxfi: Add fallback to default RSR for S/PDIF
  - ALSA: aoa: i2sbus: fix OF node lifetime handling
  - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget()
  - media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe()
  - lib/ts_kmp: fix integer overflow in pattern length calculation
  - PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown
  - media: mtk-jpeg: fix use-after-free in release path due to uncancelled work
  - net: strparser: fix skb_head leak in strp_abort_strp()
  - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names()
  - media: amphion: Fix race between m2m job_abort and device_run
  - of: unittest: fix use-after-free in testdrv_probe()
  - spi: imx: fix use-after-free on unbind
  - um: drivers: call kernel_strrchr() explicitly in cow_user.c
  - wifi: rtw88: check for PCI upstream bridge existence
  - zram: do not forget to endio for partial discard requests
  - LoongArch: Add spectre boundry for syscall dispatch table
  - ocfs2: split transactions in dio completion to avoid credit exhaustion
  - regset: use kvzalloc() for regset_get_alloc()
  - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion
  - drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array
  - padata: Remove comment for reorder_work
  - firmware: google: framebuffer: Do not mark framebuffer as busy
  - ibmasm: fix heap over-read in ibmasm_send_i2o_message()
  - ibmasm: fix OOB reads in command_file_write due to missing size checks
  - misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt()
  - leds: qcom-lpg: Check for array overflow when selecting the high resolution
  - ALSA: usb-audio: Evaluate packsize caps at the right place
  - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change
  - usb: chipidea: otg: not wait vbus drop if use role_switch
  - usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable()
  - ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch
  - ALSA: usb-audio: Avoid false E-MU sample-rate notifications
  - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES
  - Buffer overflow in drivers/xen/sys-hypervisor.c
  - md/raid1: fix data lost for writemostly rdev
  - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing
  - crypto: testmgr - Hide ENOENT errors better
  - crypto: testmgr - Hide ENOENT errors
  - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()
  - f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io()
  - fuse: quiet down complaints in fuse_conn_limit_write
  - fuse: Check for large folio with SPLICE_F_MOVE
  - fuse: reject oversized dirents in page cache
  - f2fs: fix to avoid memory leak in f2fs_rename()
  - fs/ntfs3: validate rec->used in journal-replay file record check
  - rxrpc: only handle RESPONSE during service challenge
  - rxrpc: Fix anonymous key handling
  - scripts/dtc: Remove unused dts_version in dtc-lexer.l
  - Revert "wifi: cfg80211: stop NAN and P2P in cfg80211_leave"
  - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline
  - ocfs2: validate inline data i_size during inode read
  - ocfs2: add inline inode consistency check to ocfs2_validate_inode_block()
  - rxrpc: Fix key quota calculation for multitoken keys
  - scripts: generate_rust_analyzer.py: define scripts
  - net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registers
  - PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown
  - Revert "perf unwind-libdw: Fix invalid reference counts"
  - media: hackrf: fix to not free memory after the device is registered in hackrf_probe()
  - media: vidtv: fix pass-by-value structs causing MSAN warnings
  - nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map
  - media: as102: fix to not free memory after the device is registered in as102_usb_probe()
  - ALSA: 6fire: fix use-after-free on disconnect
  - media: em28xx: fix use-after-free in em28xx_v4l2_open()
  - media: mediatek: vcodec: fix use-after-free in encoder release path
  - media: vidtv: fix nfeeds state corruption on start_streaming failure
  - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()
  - mm/kasan: fix double free for kasan pXds
  - ASoC: qcom: q6apm: move component registration to unmanaged version
  - checkpatch: add support for Assisted-by tag
  - nfc: nci: complete pending data exchange on device close
  - net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr()
  - KVM: nVMX: Fold requested virtual interrupt check into has_nested_events()
  - btrfs: merge btrfs_orig_bbio_end_io() into btrfs_bio_end_io()
  - ocfs2: handle invalid dinode in ocfs2_group_extend
  - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY
  - ocfs2: fix possible deadlock between unlink and dio_end_io_write
  - media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections
  - Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates race
  - USB: serial: option: add Telit Cinterion FN990A MBIM composition
  - staging: sm750fb: fix division by zero in ps_to_hz()
  - wifi: rtw88: fix device leak on probe failure
  - scripts: generate_rust_analyzer.py: avoid FD leak
  - fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
  - ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc
  - ksmbd: require 3 sub-authorities before reading sub_auth[2]
  - ksmbd: validate EaNameLength in smb2_get_ea()
  - usb: gadget: renesas_usb3: validate endpoint index in standard request handlers
  - usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete()
  - usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb()
  - fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
  - ALSA: fireworks: bound device-supplied status before string array lookup
  - drm/vc4: platform_get_irq_byname() returns an int
  - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler
  - net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()
  - staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify()
  - i2c: s3c24xx: check the size of the SMBUS message before using it
  - nfc: llcp: add missing return after LLCP_CLOSED checks
  - drm/i915/psr: Do not use pipe_src as borders for SU area
  - objtool: Remove max symbol name length limitation
  - ALSA: usb-audio: Improve Focusrite sample rate filtering
  - gpio: tegra: fix irq_release_resources calling enable instead of disable
  - l2tp: Drop large packets with UDP encap
  - net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+
  - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator
  - ipvs: fix NULL deref in ip_vs_add_service error path
  - selftests: net: bridge_vlan_mcast: wait for h1 before querier check
  - xsk: validate MTU against usable frame size on bind
  - xsk: fix XDP_UMEM_SG_FLAG issues
  - xsk: respect tailroom for ZC setups
  - xsk: tighten UMEM headroom validation to account for tailroom and min frame
  - e1000: check return value of e1000_read_eeprom
  - dt-bindings: net: Fix Tegra234 MGBE PTP clock
  - net: stmmac: Fix PTP ref clock for Tegra234
  - nfc: s3fwrn5: allocate rx skb before consuming bytes
  - net: lapbether: handle NETDEV_PRE_TYPE_CHANGE
  - eventpoll: defer struct eventpoll free to RCU grace period
  - drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock
  - drm/vc4: Fix a memory leak in hang state error path
  - drm/vc4: Fix memory leak of BO array in hang state
  - drm/vc4: Release runtime PM reference after binding V3D
  - PCI: hv: Set default NUMA node to 0 for devices without affinity info
  - arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency
  - soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching
  - ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J
  - wifi: brcmfmac: validate bsscfg indices in IF events
  - ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585
  - HID: roccat: fix use-after-free in roccat_report_event
  - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10
  - HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3
  - platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug
  - pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer)
  - ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx
  - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath
  - ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex
  - ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list
  - wifi: wl1251: validate packet IDs before indexing tx_frames
  - ALSA: hda/realtek: add quirk for Framework F111:000F
  - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry
  - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx
  - can: mcp251x: add error handling for power enable in open and resume
  - ASoC: SOF: topology: reject invalid vendor array size in token parser
  - ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF
  - ALSA: asihpi: avoid write overflow check warning
  - media: rkvdec: reduce stack usage in rkvdec_init_v4l2_vp9_count_tbl()
  - ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC
  - ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk
  - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA
  - RDMA/irdma: Fix double free related to rereg_user_mr
  - Revert "PCI: Enable ACS after configuring IOMMU for OF platforms"
  - rxrpc: Fix missing error checks for rxkad encryption/decryption failure
  - rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING)
  - rxrpc: fix reference count leak in rxrpc_server_keyring()
  - rxrpc: reject undecryptable rxkad response tickets
  - rxrpc: Only put the call ref if one was acquired
  - rxrpc: Fix key reference count leak from call->key
  - rxrpc: Fix call removal to use RCU safe deletion
  - net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool()
  - net: stmmac: fix integer underflow in chain mode
  - net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure
  - pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled
  - net/mlx5: Update the list of the PCI supported devices
  - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat
  - batman-adv: hold claim backbone gateways by reference
  - net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit()
  - batman-adv: reject oversized global TT response buffers
  - nfc: pn533: allocate rx skb before consuming bytes
  - arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges
  - arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity
  - arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V
  - Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower"
  - wifi: brcmsmac: Fix dma_free_coherent() size
  - Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug"
  - usb: gadget: f_hid: move list and spinlock inits from bind to alloc
  - virtio_net: clamp rss_max_key_size to NETDEV_RSS_KEY_LEN
  - MIPS: mm: Rewrite TLB uniquification for the hidden bit feature
  - MIPS: mm: Suppress TLB uniquification on EHINV hardware
  - MIPS: Always record SEGBITS in cpu_data.vmbits
  - Input: uinput - take event lock when submitting FF request "event"
  - mptcp: fix slab-use-after-free in __inet_lookup_established
  - net: rfkill: prevent unlimited numbers of rfkill events from being created
  - wifi: rt2x00usb: fix devres lifetime
  - net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta
  - MPTCP: fix lock class name family in pm_nl_create_listen_socket
  - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests
  - dmaengine: fsl-edma: change to guard(mutex) within fsl_edma3_xlate()
  - x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling()
  - net: mana: fix use-after-free in add_adev() error path
  - net: macb: Move devm_{free,request}_irq() out of spin lock area
  - iio: imu: inv_icm42600: fix odr switch when turning buffer off
  - wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free
  - usb: gadget: f_uac1_legacy: validate control request size
  - usb: gadget: f_rndis: Protect RNDIS options with mutex
  - usb: gadget: f_subset: Fix unbalanced refcnt in geth_free
  - usb: gadget: uvc: fix NULL pointer dereference during unbind race
  - usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop
  - btrfs: do not free data reservation in fallback from inline due to -ENOSPC
  - btrfs: fix the qgroup data free range for inline data extents
  - usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer
  - USB: dummy-hcd: Fix interrupt synchronization error
  - USB: dummy-hcd: Fix locking/synchronization error
  - thunderbolt: Fix property read in nhi_wake_supported()
  - misc: fastrpc: possible double-free of cctx->remote_heap
  - thermal: core: Fix thermal zone device registration error path
  - gpio: mxc: map Both Edge pad wakeup to Rising Edge
  - net: ftgmac100: fix ring allocation unwind on open failure
  - counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member
  - counter: rz-mtu3-cnt: prevent counter from being toggled multiple times
  - nvmem: imx: assign nvmem_cell_info::raw_len
  - dt-bindings: connector: add pd-disable dependency
  - comedi: me4000: Fix potential overrun of firmware buffer
  - comedi: me_daq: Fix potential overrun of firmware buffer
  - comedi: ni_atmio16d: Fix invalid clean-up after failed attach
  - comedi: Reinit dev->spinlock between attachments to low-level drivers
  - comedi: dt2815: add hardware detection to prevent crash
  - cdc-acm: new quirk for EPSON HMD
  - usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop()
  - usb: ehci-brcm: fix sleep during atomic
  - usb: usbtmc: Flush anchored URBs in usbtmc_release
  - usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive
  - iio: gyro: mpu3050: Fix out-of-sequence free_irq()
  - iio: gyro: mpu3050: Move iio_device_register() to correct location
  - iio: gyro: mpu3050: Fix irq resource leak
  - iio: gyro: mpu3050: Fix incorrect free_irq() variable
  - iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only
  - iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin()
  - iio: light: vcnl4035: fix scan buffer on big-endian
  - iio: dac: ad5770r: fix error return in ad5770r_read_raw()
  - iio: accel: fix ADXL355 temperature signature value
  - Input: xpad - add support for Razer Wolverine V3 Pro
  - Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode
  - Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table
  - Input: synaptics-rmi4 - fix a locking bug in an error path
  - iio: adc: ti-adc161s626: use DMA-safe memory for spi_read()
  - drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP
  - drm/ast: dp501: Fix initialization of SCU2C
  - iio: adc: ti-adc161s626: fix buffer read on big-endian
  - mips: mm: Allocate tlb_vpn array atomically
  - hwmon: (occ) Fix division by zero in occ_show_power_1()
  - MIPS: Fix the GCC version check for `__multi3' workaround
  - ALSA: ctxfi: Fix missing SPDIFI1 index handling
  - ALSA: caiaq: fix stack out-of-bounds read in init_card
  - USB: serial: option: add MeiG Smart SRM825WN
  - wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation
  - riscv: kgdb: fix several debug register assignment bugs
  - mips: ralink: update CPU clock index
  - hwmon: (occ) Fix missing newline in occ_show_extended()
  - hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify()
  - dt-bindings: gpio: fix microchip #interrupt-cells
  - hwmon: (pxe1610) Check return value of page-select write in probe
  - accel/qaic: Handle DBC deactivation if the owner went away
  - iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one
  - net: hsr: fix VLAN add unwind on slave errors
  - net/x25: Fix overflow when accumulating packets
  - net/x25: Fix potential double free of skb
  - net/mlx5: Avoid "No data available" when FW version queries fail
  - net: macb: properly unregister fixed rate clocks
  - net: macb: fix clk handling on PCI glue driver removal
  - bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready().
  - rds: ib: reject FRMR registration before IB connection is established
  - Bluetooth: SCO: fix race conditions in sco_sock_connect()
  - Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate
  - net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec
  - NFC: pn533: bound the UART receive buffer
  - net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak
  - ipv6: prevent possible UaF in addrconf_permanent_addr()
  - ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure
  - tg3: Fix race for querying speed/duplex
  - net/ipv6: ioam6: prevent schema length wraparound in trace fill
  - net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak
  - net: fec: fix the PTP periodic output sysfs interface
  - crypto: caam - fix overflow on long hmac keys
  - crypto: caam - fix DMA corruption on long hmac keys
  - wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session
  - wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation
  - wifi: ath11k: skip status ring entry processing
  - dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning
  - spi: geni-qcom: Check DMA interrupts early in ISR
  - btrfs: reject root items with drop_progress and zero drop_level
  - i2c: tegra: Don't mark devices with pins as IRQ safe
  - objtool: Fix Clang jump table detection
  - tg3: replace placeholder MAC address with device property
  - btrfs: don't take device_list_mutex when querying zone info
  - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq
  - arm64/scs: Fix handling of advance_loc4
  - Revert "rust: pin-init: add references to previously initialized fields"
  - Revert "rust: pin-init: internal: init: document load-bearing fact of field accessors"
  - dmaengine: idxd: Fix freeing the allocated ida too late
  - btrfs: fix lost error when running device stats on multiple devices fs
  - btrfs: fix super block offset in error message in btrfs_validate_super()
  - dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA
  - dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction
  - dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA
  - dmaengine: xilinx: xilinx_dma: Fix dma_device directions
  - dmaengine: xilinx: xdma: Fix regmap init error handling
  - dmaengine: dw-edma: Fix multiple times setting of the CYCLE_STATE and CYCLE_BIT bits for HDMA.
  - phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types()
  - erofs: fix "BUG: Bad page state in z_erofs_do_read_page"
  - mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0]
  - mtd: spi-nor: core: avoid odd length/address writes in 8D-8D-8D mode
  - mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D mode
  - rust: pin-init: internal: init: document load-bearing fact of field accessors
  - rust: pin-init: add references to previously initialized fields
  - tracing: Fix potential deadlock in cpu hotplug with osnoise
  - tracing: Switch trace_osnoise.c code over to use guard() and __free()
  - ksmbd: fix memory leaks and NULL deref in smb2_lock()
  - ksmbd: fix use-after-free and NULL deref in smb_grant_oplock()
  - powerpc64/bpf: do not increment tailcall count when prog is NULL
  - arm64: dts: imx8mn-tqma8mqnl: fix LDO5 power off
  - ext4: always drain queued discard work in ext4_mb_release()
  - ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths
  - ext4: fix the might_sleep() warnings in kvfree()
  - ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()
  - ext4: make recently_deleted() properly work with lazy itable initialization
  - ext4: fix fsync(2) for nojournal mode
  - ext4: fix stale xarray tags after writeback
  - ext4: fix journal credit check when setting fscrypt context
  - xfs: fix ri_total validation in xlog_recover_attri_commit_pass2
  - xfs: stop reclaim before pushing AIL during unmount
  - LoongArch: Workaround LS2K/LS7A GPU DMA hang bug
  - dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock
  - dmaengine: sh: rz-dmac: Protect the driver specific lists
  - irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment
  - jbd2: gracefully abort on checkpointing state corruptions
  - net: macb: Use dev_consume_skb_any() to free TX SKBs
  - scsi: ses: Handle positive SCSI error from ses_recv_diag()
  - scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done()
  - alarmtimer: Fix argument order in alarm_timer_forward()
  - s390/entry: Scrub r12 register on kernel entry
  - hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible()
  - hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute temperature
  - hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs attributes
  - KVM: arm64: Discard PC update state on vcpu reset
  - platform/x86: ISST: Correct locked bit width
  - can: isotp: fix tx.buf use-after-free in isotp_sendmsg()
  - ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload
  - ALSA: firewire-lib: fix uninitialized local variable
  - ksmbd: do not expire session on binding failure
  - ksmbd: fix potencial OOB in get_file_all_info() for compound requests
  - ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len()
  - s390/barrier: Make array_index_mask_nospec() __always_inline
  - s390/syscalls: Add spectre boundary for syscall dispatch table
  - spi: spi-fsl-lpspi: fix teardown order issue (UAF)
  - ASoC: adau1372: Fix clock leak on PLL lock failure
  - ASoC: adau1372: Fix unchecked clk_prepare_enable() return value
  - sysctl: fix uninitialized variable in proc_do_large_bitmap
  - hwmon: (adm1177) fix sysfs ABI violation and current unit conversion
  - ASoC: Intel: catpt: Fix the device initialization
  - spi: sn-f-ospi: Fix resource leak in f_ospi_probe()
  - PM: hibernate: Drain trailing zero pages on userspace restore
  - PM: hibernate: Don't ignore return from set_memory_ro()
  - drm/i915/gmbus: fix spurious timeout on 512-byte burst reads
  - scsi: scsi_transport_sas: Fix the maximum channel scanning issue
  - RDMA/irdma: Return EINVAL for invalid arp index error
  - RDMA/irdma: Fix deadlock during netdev reset with active connections
  - RDMA/irdma: Remove reset check from irdma_modify_qp_to_err()
  - RDMA/irdma: Clean up unnecessary dereference of event->cm_node
  - RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce()
  - RDMA/irdma: Update ibqp state to error if QP is already in error state
  - RDMA/irdma: Initialize free_qp completion before using it
  - RDMA/rw: Fall back to direct SGE on MR pool exhaustion
  - regmap: Synchronize cache for the page selector
  - Bluetooth: btusb: clamp SCO altsetting table indices
  - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock
  - Bluetooth: hci_sync: Remove remaining dependencies of hci_request
  - Bluetooth: Remove 3 repeated macro definitions
  - Bluetooth: L2CAP: Fix send LE flow credits in ACL link
  - dma-mapping: add missing `inline` for `dma_free_attrs`
  - net: enetc: fix the output issue of 'ethtool --show-ring'
  - ice: use ice_update_eth_stats() for representor stats
  - platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen
  - rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size
  - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer
  - nfc: nci: fix circular locking dependency in nci_close_device
  - ionic: fix persistent MAC address override on PF
  - pinctrl: mediatek: common: Fix probe failure for devices without EINT
  - Bluetooth: hci_ll: Fix firmware leak on error path
  - can: statistics: add missing atomic access in hot path
  - dma: swiotlb: add KMSAN annotations to swiotlb_bounce()
  - xfrm: call xdo_dev_state_delete during state update
  - spi: intel-pci: Add support for Nova Lake mobile SPI flash
  - usb: core: new quirk to handle devices with zero configurations
  - objtool: Handle Clang RSP musical chairs
  - ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390
  - ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk
  - btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create
  - dma-buf: Include ioctl.h in UAPI header
  - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits()
  - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg()
  - HID: asus: add xg mobile 2023 external hardware support
  - HID: mcp2221: cancel last I2C command on read error
  - net: usb: r8152: add TRENDnet TUC-ET2G
  - HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2
  - platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10
  - platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1
  - nvme-fabrics: use kfree_sensitive() for DHCHAP secrets
  - nvme-pci: cap queue creation to used queues
  - platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list
  - HID: asus: avoid memory leak in asus_report_fixup()
  - sh: platform_early: remove pdev->driver_override check
  - hwmon: (axi-fan-control) Use device firmware agnostic API
  - cxl/hdm: Avoid incorrect DVSEC fallback when HDM decoders are enabled
  - tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure
  - lib/bootconfig: check xbc_init_node() return in override path
  - ksmbd: fix use-after-free in durable v2 replay of active file handles
  - ksmbd: fix use-after-free of share_conf in compound request
  - drm/amd/display: Fix DisplayID not-found handling in parse_edid_displayid_vrr()
  - mtd: rawnand: brcmnand: skip DMA during panic write
  - mtd: rawnand: serialize lock/unlock against other NAND operations
  - i2c: cp2615: fix serial string NULL-deref at probe
  - i2c: cp2615: replace deprecated strncpy with strscpy
  - i2c: pxa: defer reset on Armada 3700 when recovery is used
  - i2c: fsi: Fix a potential leak in fsi_i2c_probe()
  - USB: serial: f81232: fix incomplete serial port generation
  - drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
  - hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit()
  - hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return value
  - net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths
  - net: mvpp2: guard flow control update with global_tx_fc in buffer switching
  - netfilter: bpf: defer hook memory release until rcu readers are done
  - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle
  - net: macb: fix uninitialized rx_fs_lock
  - wifi: mac80211: fix NULL deref in mesh_matches_local()
  - iavf: fix VLAN filter lost on add/delete race
  - igc: fix missing update of skb->tail in igc_xmit_frame()
  - net: usb: aqc111: Do not perform PM inside suspend callback
  - sched: idle: Consolidate the handling of two special cases
  - net: bcmgenet: increase WoL poll timeout
  - netfilter: xt_time: use unsigned int for monthday bit shift
  - netfilter: nft_ct: drop pending enqueued packets on removal
  - net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect
  - firmware: arm_scpi: Fix device_node reference leak in probe path
  - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down
  - soc: fsl: qbman: fix race condition in qman_destroy_fq
  - cache: ax45mp: Fix device node reference leak in ax45mp_cache_init()
  - btrfs: tree-checker: fix misleading root drop_level error message
  - btrfs: log new dentries when logging parent dir of a conflicting inode
  - drm/amd/display: Wrap dcn32_override_min_req_memclk() in DC_FP_{START, END}
  - drm/amdgpu: apply state adjust rules to some additional HAINAN vairants
  - drm/radeon: apply state adjust rules to some additional HAINAN vairants
  - drm/amdgpu/mmhub3.0: add bounds checking for cid
  - drm/amdgpu/mmhub3.0.2: add bounds checking for cid
  - drm/amdgpu/mmhub3.0.1: add bounds checking for cid
  - drm/amdgpu/mmhub2.3: add bounds checking for cid
  - drm/amdgpu/mmhub2.0: add bounds checking for cid
  - drm/amdgpu/gmc9.0: add bounds checking for cid
  - serial: uartlite: fix PM runtime usage count underflow on probe
  - serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY
  - serial: 8250_pci: add support for the AX99100
  - iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry
  - mtd: Avoid boot crash in RedBoot partition table parser
  - mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init()
  - mtd: rawnand: pl353: make sure optimal timings are applied
  - pmdomain: bcm: bcm2835-power: Increase ASB control timeout
  - mmc: sdhci: fix timing selection for 1-bit bus width
  - mmc: sdhci-pci-gli: fix GL9750 DMA write corruption
  - batman-adv: avoid OGM aggregation when skb tailroom is insufficient
  - iio: light: bh1780: fix PM runtime leak on error path
  - btrfs: fix transaction abort on file creation due to name hash collision
  - btrfs: fix transaction abort on set received ioctl due to item overflow
  - btrfs: fix transaction abort when snapshotting received subvolumes
  - kprobes: Remove unneeded warnings from __arm_kprobe_ftrace()
  - kprobes: Remove unneeded goto
  - ksmbd: unset conn->binding on failed binding request
  - Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp()
  - parisc: Flush correct cache in cacheflush() syscall
  - net: macb: fix use-after-free access to PTP clock
  - NFC: nxp-nci: allow GPIOs to sleep
  - LoongArch: Give more information if kmem access failed
  - s390/zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute
  - s390/stackleak: Fix __stackleak_poison() inline assembly constraint
  - s390/xor: Fix xor_xc_2() inline assembly constraints
  - mptcp: pm: in-kernel: always set ID as avail when rm endp
  - rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access
  - drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free
  - drm/exynos: vidi: fix to avoid directly dereferencing user pointer
  - drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl()
  - drm/amdgpu: Add basic validation for RAS header
  - l2tp: do not use sock_hold() in pppol2tp_session_get_sock()
  - drm/amd/display: Add pixel_clock to amd_pp_display_configuration
  - btrfs: do not strictly require dirty metadata threshold for metadata writepages
  - rxrpc: Fix data-race warning and potential load/store tearing
  - x86/sev: Check for MWAITX and MONITORX opcodes in the #VC handler
  - x86/sev: Harden #VC instruction emulation somewhat
  - dm-verity: disable recursive forward error correction
  - rxrpc: Fix recvmsg() unconditional requeue
  - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list()
  - btrfs: fix NULL dereference on root when tracing inode eviction
  - arm64: mm: Don't remap pgtables for allocate vs populate
  - arm64: mm: Don't remap pgtables per-cont(pte|pmd) block
  - net/tcp-md5: Fix MAC comparison to be constant-time
  - ksmbd: Compare MACs in constant time
  - smb: client: Compare MACs in constant time
  - xfs: ensure dquot item is deleted from AIL only after log shutdown
  - xfs: fix integer overflow in bmap intent sort comparator
  - crypto: atmel-sha204a - Fix OOM ->tfm_count leak
  - drm/bridge: ti-sn65dsi83: halve horizontal syncs for dual LVDS output
  - drm/msm: Fix dma_free_attrs() buffer size
  - ksmbd: Don't log keys in SMB3 signing and encryption key generation
  - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids
  - usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling
  - can: gs_usb: gs_can_open(): always configure bitrates before starting device
  - kbuild: Leave objtool binary around with 'make clean'
  - mptcp: pm: avoid sending RM_ADDR over same subflow
  - drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink
  - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL
  - x86/sev: Allow IBPB-on-Entry feature for SNP guests
  - platform/x86: hp-bioscfg: Support allocations of larger data
  - ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths
  - gve: defer interrupt enabling until NAPI registration
  - drm/bridge: ti-sn65dsi86: Add support for DisplayPort mode with HPD
  - i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor
  - i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort
  - i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors
  - iio: imu: inv_icm42600: fix odr switch to the same value
  - iio: gyro: mpu3050-i2c: fix pm_runtime error handling
  - iio: gyro: mpu3050-core: fix pm_runtime error handling
  - iio: buffer: Fix wait_queue not being removed
  - iio: chemical: bme680: Fix measurement wait duration calculation
  - iio: potentiometer: mcp4131: fix double application of wiper shift
  - iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas()
  - iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas()
  - iio: frequency: adf4377: Fix duplicated soft reset mask
  - iio: dac: ds4424: reject -128 RAW value
  - btrfs: abort transaction on failure to update root in the received subvol ioctl
  - smb: client: fix iface port assignment in parse_server_interfaces
  - smb: client: fix in-place encryption corruption in SMB2_write()
  - lib/bootconfig: check bounds before writing in __xbc_open_brace()
  - lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after()
  - lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error
  - s390/dasd: Copy detected format information to secondary device
  - s390/dasd: Move quiesce state with pprc swap
  - xfs: fix undersized l_iclog_roundoff values
  - cifs: make default value of retrans as zero
  - tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G
  - drm/i915: Fix potential overflow of shmem scatterlist length
  - drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding
  - drm/amd: Set num IP blocks to 0 if discovery fails
  - drm/amdgpu: Fix use-after-free race in VM acquire
  - net: ethernet: arc: emac: quiesce interrupts before requesting IRQ
  - net: ncsi: fix skb leak in error paths
  - ksmbd: fix use-after-free by using call_rcu() for oplock_info
  - smb: server: fix use-after-free in smb2_open()
  - ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close()
  - pmdomain: bcm: bcm2835-power: Fix broken reset status read
  - parisc: Check kernel mapping earlier at bootup
  - parisc: Fix initial page table creation for boot
  - hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read
  - parisc: Increase initial mapping to 64 MB with KALLSYMS
  - batman-adv: Avoid double-rtnl_lock ELP metric worker
  - tracing: Fix syscall events activation by ensuring refcount hits zero
  - ice: fix retry for AQ command 0x06EE
  - net: mana: Ring doorbell at 4 CQ wraparounds
  - staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie
  - ixgbevf: fix link setup issue
  - ice: reintroduce retry mechanism for indirect AQ
  - irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports
  - device property: Allow secondary lookup in fwnode_get_next_child_node()
  - drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used
  - drm/bridge: samsung-dsim: Fix memory leak in error path
  - Revert "tcpm: allow looking for role_sw device in the main node"
  - scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend
  - i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach
  - libceph: admit message frames only in CEPH_CON_S_OPEN state
  - libceph: Use u32 for non-negative values in ceph_monmap_decode()
  - libceph: reject preamble if control segment is empty
  - tipc: fix divide-by-zero in tipc_sk_filter_connect()
  - ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start
  - mmc: core: Avoid bitfield RMW for claim/retune flags
  - mm/kfence: disable KFENCE upon KASAN HW tags enablement
  - mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index()
  - mm/tracing: rss_stat: ensure curr is false from kthread context
  - usb: image: mdc800: kill download URB on timeout
  - usb: mdc800: handle signal and read racing
  - usb: renesas_usbhs: fix use-after-free in ISR during device removal
  - usb: roles: get usb role switch from parent only for usb-b-connector
  - usb: cdc-acm: Restore CAP_BRK functionnality to CH343
  - usb: core: don't power off roothub PHYs if phy_set_mode() fails
  - usb: misc: uss720: properly clean up reference in uss720_probe()
  - usb: dwc3: pci: add support for the Intel Nova Lake -H
  - usb: yurex: fix race in probe
  - usb: xhci: Fix memory leak in xhci_disable_slot()
  - USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed
  - usb/core/quirks: Add Huawei ME906S-device to wakeup quirk
  - USB: add QUIRK_NO_BOS for video capture several devices
  - KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC
  - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA
  - net: usb: lan78xx: skip LTM configuration for LAN7850
  - net: usb: lan78xx: fix TX byte statistics for small packets
  - net: usb: lan78xx: fix silent drop of packets with checksum errors
  - ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces
  - ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain()
  - cgroup: fix race between task migration and iteration
  - Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on"
  - usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks()
  - octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt status
  - octeontx2-af: devlink health: use retained error fmsg API
  - octeontx2-af: devlink: fix NIX RAS reporter recovery condition
  - net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled
  - ASoC: detect empty DMI strings
  - ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition
  - ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address()
  - i40e: fix src IP mask checks and memcpy argument names in cloud filter
  - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set
  - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()
  - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path
  - netfilter: x_tables: guard option walkers against 1-byte tail reads
  - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()
  - amd-xgbe: prevent CRC errors during RX adaptation with AN disabled
  - amd-xgbe: fix link status handling in xgbe_rx_adaptation
  - mctp: route: hold key->lock in mctp_flow_prepare_output()
  - can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value
  - mctp: i2c: fix skb memory leak in receive path
  - serial: caif: hold tty->link reference in ldisc_open and ser_release
  - net: sfp: improve Huawei MA5671a fixup
  - net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick
  - net: sfp: improve Nokia GPON sfp fixup
  - net: sfp: re-implement ignoring the hardware TX_FAULT signal
  - net/mlx5: IFC updates for disabled host PF
  - bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states
  - drm/msm/dsi: fix pclk rate calculation for bonded dsi
  - drm/msm/dsi: Document DSC related pclk_rate and hdisplay calculations
  - net: dsa: realtek: rtl8365mb: remove ifOutDiscards from rx_packets
  - xprtrdma: Decrement re_receiving on the early exit paths
  - smb/server: Fix another refcount leak in smb2_open()
  - powerpc: 83xx: km83xx: Fix keymile vendor prefix
  - remoteproc: mediatek: Unprepare SCP clock during system suspend
  - remoteproc: sysmon: Correct subsys_name_len type in QMI request
  - powerpc/uaccess: Fix inline assembly for clang build on PPC32
  - ALSA: usb-audio: Check max frame size for implicit feedback mode, too
  - ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0
  - scsi: ufs: core: Fix shift out of bounds when MAXQ=32
  - scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace()
  - ASoC: cs42l43: Report insert for exotic peripherals
  - ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table
  - scsi: ses: Fix devices attaching to different hosts
  - ACPI: OSI: Add DMI quirk for Acer Aspire One D255
  - wifi: mac80211: set default WMM parameters on all links
  - scsi: mpi3mr: Add NULL checks when resetting request and reply queues
  - ACPI: PM: Save NVS memory on Lenovo G70-35
  - net: tcp: accept old ack during closing
  - tracing: Add NULL pointer check to trigger_data_free()
  - selftest/arm64: Fix sve2p1_sigill() to hwcap test
  - i40e: use xdp.frame_sz as XDP RxQ info frag_size
  - i40e: fix registering XDP RxQ info
  - net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in mtk_xdp_setup()
  - net: stmmac: Fix error handling in VLAN add and delete paths
  - nfc: rawsock: cancel tx_work before socket teardown
  - nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback
  - nfc: nci: free skb on nci_transceive early error paths
  - net: nfc: nci: Fix zero-length proprietary notifications
  - drm/sched: Fix kernel-doc warning for drm_sched_job_done()
  - amd-xgbe: fix sleep while atomic on suspend/resume
  - smb/client: fix buffer size for smb311_posix_qinfo in SMB311_posix_query_info()
  - smb/client: fix buffer size for smb311_posix_qinfo in smb2_compound_op()
  - xen/acpi-processor: fix _CST detection using undersized evaluation buffer
  - net/rds: Fix circular locking dependency in rds_tcp_tune
  - indirect_call_wrapper: do not reevaluate function pointer
  - wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211()
  - wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211()
  - wifi: wlcore: Fix a locking bug
  - octeon_ep: avoid compiler and IQ/OQ reordering
  - octeon_ep: Relocate counter updates before NAPI
  - net: dsa: realtek: rtl8365mb: fix rtl8365mb_phy_ocp_write return value
  - kunit: tool: copy caller args in run_kernel to prevent mutation
  - rust: kunit: fix warning when !CONFIG_PRINTK
  - can: mcp251x: fix deadlock in error path of mcp251x_open
  - amd-xgbe: fix MAC_TCR_SS register width for 2.5G and 10M speeds
  - atm: lec: fix null-ptr-deref in lec_arp_clear_vccs
  - net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling in ALE table
  - e1000e: clear DPG_EN after reset to avoid autonomous power-gating
  - hwmon: (it87) Check the it87_lock() return value
  - platform/x86: thinkpad_acpi: Fix errors reading battery thresholds
  - pinctrl: equilibrium: fix warning trace on load
  - pinctrl: equilibrium: rename irq_chip function callbacks
  - hwmon: (aht10) Fix initialization commands for AHT20
  - hwmon: (aht10) Add support for dht20
  - ARM: clean up the memset64() C wrapper
  - selftests: mptcp: join: check removing signal+subflow endp
  - selftests: mptcp: more stable simult_flows tests
  - smb: client: fix broken multichannel with krb5+signing
  - smb: client: fix cifs_pick_channel when channels are equally loaded
  - drbd: fix null-pointer dereference on local read error
  - drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock()
  - net/sched: ets: fix divide by zero in the offload path
  - RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah()
  - IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq()
  - wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()
  - wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration
  - wifi: cfg80211: cancel rfkill_block work in wiphy_unregister()
  - wifi: radiotap: reject radiotap with unknown bits
  - ALSA: usb-audio: Use correct version for UAC3 header validation
  - platform/x86: dell-wmi: Add audio/mic mute key codes
  - platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data
  - HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them
  - can: usb: f81604: handle bulk write errors properly
  - can: usb: f81604: handle short interrupt urb messages properly
  - can: usb: f81604: correctly anchor the urb in the read bulk callback
  - can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message
  - nfc: pn533: properly drop the usb interface reference on disconnect
  - eventpoll: Fix integer overflow in ep_loop_check_proc()
  - drm/amdgpu: keep vga memory on MacBooks with switchable graphics
  - drm/amd: Drop special case for yellow carp without discovery
  - net: arcnet: com20020-pci: fix support for 2.5Mbit cards
  - ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314
  - ALSA: hda/conexant: Add quirk for HP ZBook Studio G4
  - usb: cdns3: remove redundant if branch
  - clk: tegra: tegra124-emc: fix device leak on set_rate()
  - arm64: dts: rockchip: Fix rk356x PCIe range mappings
  - mfd: omap-usb-host: Fix OF populate on driver rebind
  - mfd: omap-usb-host: Convert to platform remove callback returning void
  - mfd: qcom-pm8xxx: Fix OF populate on driver rebind
  - mfd: qcom-pm8xxx: Convert to platform remove callback returning void
  - ext4: delete redundant calculations in ext4_mb_get_buddy_page_lock()
  - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()
  - mailbox: Allow controller specific mapping using fwnode
  - mailbox: Use guard/scoped_guard for con_mutex
  - mailbox: Use dev_err when there is error
  - mailbox: remove unused header files
  - mailbox: sort headers alphabetically
  - mailbox: don't protect of_parse_phandle_with_args with con_mutex
  - mailbox: Use of_property_match_string() instead of open-coding
  - ext4: get rid of ppath in ext4_ext_create_new_leaf()
  - ext4: get rid of ppath in ext4_find_extent()
  - bus: omap-ocp2scp: fix OF populate on driver rebind
  - bus: omap-ocp2scp: Convert to platform remove callback returning void
  - drm/tegra: dsi: fix device leak on probe
  - media: tegra-video: Fix memory leak in __tegra_channel_try_format()
  - media: tegra-video: Use accessors for pad config 'try_*' fields
  - KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR
  - KVM: x86: Rename KVM_MSR_RET_INVALID to KVM_MSR_RET_UNSUPPORTED
  - PCI: Use resource_set_range() that correctly sets ->end
  - resource: Add resource set range and size helpers
  - PCI: Use resource names in PCI log messages
  - PCI: Update BAR # and window messages
  - memory: mtk-smi: fix device leak on larb probe
  - memory: mtk-smi: fix device leaks on common probe
  - memory: mtk-smi: Convert to platform remove callback returning void
  - PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value
  - btrfs: fix compat mask in error messages in btrfs_check_features()
  - btrfs: fix warning in scrub_verify_one_metadata()
  - btrfs: fix objectid value in error message in check_extent_data_ref()
  - btrfs: fix incorrect key offset in error message in check_dev_extent_item()
  - btrfs: add support for inserting raid stripe extents
  - btrfs: read raid stripe tree from disk
  - btrfs: add raid stripe tree definitions
  - btrfs: move btrfs_extref_hash into inode-item.h
  - btrfs: remove btrfs_crc32c wrapper
  - btrfs: move btrfs_crc32c_final into free-space-cache.c
  - ALSA: hda: cs35l56: Fix signedness error in cs35l56_hda_posture_put()
  - ALSA: pci: hda: use snd_kcontrol_chip()
  - ALSA: usb-audio: Use inclusive terms
  - ALSA: usb-audio: Cap the packet size pre-calculations
  - scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume
  - rseq: Clarify rseq registration rseq_size bound check comment
  - ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices
  - scsi: pm8001: Fix use-after-free in pm8001_queue_command()
  - scsi: lpfc: Properly set WC for DPP mapping
  - irqchip/sifive-plic: Fix frozen interrupt due to affinity setting
  - Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer"
  - arm64: Fix sampling the "stable" virtual counter in preemptible section
  - drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros
  - NTB: ntb_transport: Fix too small buffer for debugfs_name
  - net: nfc: nci: Fix parameter validation for packet data
  - arm64: Force the use of CNTVCT_EL0 in __delay()
  - x86/kexec: Copy ACPI root pointer address from config table
  - net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash()
  - net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle
  - ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR
  - fbcon: Remove struct fbcon_display.inverse
  - fbdev: ffb: fix corrupted video output on Sun FFB1
  - fbdev: of: display_timing: fix refcount leak in of_get_display_timings()
  - fbdev: vt8500lcdfb: fix missing dma_free_coherent()
  - atm: fore200e: fix use-after-free in tasklets during device removal
  - net: intel: fix PCI device ID conflict between i40e and ipw2200
  - io_uring/filetable: clamp alloc_hint to the configured alloc range
  - tracing: Fix to set write permission to per-cpu buffer_size_kb
  - octeontx2-af: CGX: fix bitmap leaks
  - net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean()
  - net: ethernet: marvell: skge: remove incorrect conflicting PCI ID
  - LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT
  - LoongArch: Prefer top-down allocation after arch_mem_init()
  - MIPS: rb532: Fix MMIO UART resource registration
  - staging: rtl8723bs: fix null dereference in find_network
  - parisc: kernel: replace kfree() with put_device() in create_tree_node()
  - PCI: Fix pci_slot_trylock() error handling
  - net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path
  - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()
  - tipc: fix RCU dereference race in tipc_aead_users_dec()
  - mtd: rawnand: pl353: Fix software ECC support
  - usb: dwc2: fix resume failure if dr_mode is host
  - scsi: ufs: core: Flush exception handling work when RPM level is zero
  - perf/arm-cmn: Reject unsupported hardware configurations
  - remoteproc: imx_rproc: Fix invalid loaded resource table detection
  - btrfs: continue trimming remaining devices on failure
  - arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y
  - ocfs2: fix reflink preserve cleanup issue
  - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net()
  - mm/highmem: fix __kmap_to_page() build error
  - iio: gyro: itg3200: Fix unchecked return value in read_raw
  - dm mpath: make pg_init_delay_msecs settable
  - bus: fsl-mc: fix an error handling in fsl_mc_device_add()
  - usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN
  - nvmem: Drop OF node reference on nvmem_add_one_cell() failure
  - nfsd: fix return error code for nfsd_map_name_to_[ug]id
  - PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions
  - xfs: fix remote xattr valuelblk check
  - xfs: fix freemap adjustments when adding xattrs to leaf blocks
  - xfs: delete attr leaf freemap entries when empty
  - mfd: core: Add locking around 'mfd_of_node_list'
  - iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode
  - media: verisilicon: AV1: Fix tile info buffer size
  - xfs: mark data structures corrupt on EIO and ENODATA
  - selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs
  - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations
  - drm: of: drm_of_panel_bridge_remove(): fix device_node leak
  - media: venus: vdec: restrict EOS addr quirk to IRIS2 only
  - media: venus: vdec: fix error state assignment for zero bytesused
  - arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro
  - dm-unstripe: fix mapping bug when there are multiple targets in a table
  - dm-integrity: fix recalculation in bitmap mode
  - s390/pci: Handle futile config accesses of disabled devices directly
  - clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc()
  - media: i2c: ov01a10: Fix digital gain range
  - clk: clk-apple-nco: Add "apple,t8103-nco" compatible
  - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation
  - soc: ti: pruss: Fix double free in pruss_clk_mux_setup()
  - soc: ti: k3-socinfo: Fix regmap leak on probe failure
  - dm-integrity: fix a typo in the code for write/discard race
  - media: i2c: ov5647: use our own mutex for the ctrl lock
  - media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode
  - media: i2c: ov5647: Sensor should report RAW color space
  - media: i2c: ov5647: Correct minimum VBLANK value
  - media: i2c: ov5647: Correct pixel array offset
  - media: i2c: ov5647: Initialize subdev before controls
  - media: ccs: Avoid possible division by zero
  - media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update()
  - media: i2c: ov01a10: Fix test-pattern disabling
  - media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls
  - media: i2c: ov01a10: Fix analogue gain range
  - media: i2c: ov01a10: Fix reported pixel-rate value
  - media: i2c: ov01a10: Fix the horizontal flip control
  - media: i2c/tw9906: Fix potential memory leak in tw9906_probe()
  - media: i2c/tw9903: Fix potential memory leak in tw9903_probe()
  - media: cx25821: Add missing unmap in snd_cx25821_hw_params()
  - media: cx23885: Add missing unmap in snd_cx23885_hw_params()
  - media: cx88: Add missing unmap in snd_cx88_hw_params()
  - media: radio-keene: fix memory leak in error path
  - media: verisilicon: AV1: Set IDR flag for intra_only frame type
  - arm64: dts: apple: t8112-j473: Keep the HDMI port powered on
  - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length()
  - HID: prodikeys: Check presence of pm->input_ep82
  - HID: magicmouse: Do not crash on missing msc->input
  - HID: hid-pl: handle probe errors
  - arm64: Disable branch profiling for all arm64 code
  - KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding
  - ARM: omap2: Fix reference count leaks in omap_control_init()
  - media: verisilicon: AV1: Fix tx mode bit setting
  - media: verisilicon: AV1: Fix enable cdef computation
  - media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove()
  - media: mtk-mdp: Fix error handling in probe function
  - media: mediatek: encoder: Fix uninitialized scalar variable issue
  - dm-verity: correctly handle dm_bufio_client_create() failure
  - fpga: dfl: use subsys_initcall to allow built-in drivers to be added
  - ASoC: SOF: ipc4-control: Keep the payload size up to date
  - ASoC: SOF: ipc4-control: Use the correct size for scontrol->ipc_control_data
  - ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls
  - ASoC: SOF: ipc4-control: If there is no data do not send bytes update
  - clk: renesas: rzg2l: Select correct div round macro
  - clk: renesas: rzg2l: Fix intin variable size
  - rpmsg: core: fix race in driver_override_show() and use core helper
  - netfilter: nf_conntrack_h323: fix OOB read in decode_choice()
  - dpaa2-switch: validate num_ifs to prevent out-of-bounds write
  - net/mlx5: Fix missing devlink lock in SRIOV enable error path
  - net/mlx5: DR, Fix circular locking dependency in dump
  - RDMA/umem: Fix double dma_buf_unpin in failure path
  - RDMA/efa: Fix typo in efa_alloc_mr()
  - net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets
  - RDMA/core: Fix stale RoCE GIDs during netdev events at registration
  - tipc: fix duplicate publication key in tipc_service_insert_publ()
  - Remove WARN_ALL_UNSEEDED_RANDOM kernel config option
  - wifi: cfg80211: wext: fix IGTK key ID off-by-one
  - net: ethernet: xscale: Check for PTP support properly
  - net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set()
  - net: usb: lan78xx: scan all MDIO addresses on LAN7801
  - xfrm: always flush state and policy upon NETDEV_UNREGISTER event
  - ipmi: ipmb: initialise event handler read bytes
  - xfrm: skip templates check for packet offload tunnel mode
  - xfrm6: fix uninitialized saddr in xfrm6_get_saddr()
  - ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut
  - ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access
  - rtc: zynqmp: correct frequency value
  - drm/amd/display: Remove conditional for shaper 3DLUT power-on
  - btrfs: replace BUG() with error handling in __btrfs_balance()
  - ALSA: usb-audio: Add sanity check for OOB writes at silencing
  - drm/radeon: Add HAINAN clock adjustment
  - drm/amdgpu: Add HAINAN clock adjustment
  - ALSA: usb-audio: Update the number of packets properly at receiving
  - drm/amdgpu: Adjust usleep_range in fence wait
  - drm/amd/display: Avoid updating surface with the same surface under MPO
  - ARM: 9467/1: mm: Don't use %pK through printk
  - include: uapi: netfilter_bridge.h: Cover for musl libc
  - thermal: int340x: Fix sysfs group leak on DLVR registration failure
  - ceph: supply snapshot context in ceph_uninline_data()
  - fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra()
  - fs/ntfs3: drop preallocated clusters for sparse and compressed files
  - fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST
  - fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata
  - fs: ntfs3: check return value of indx_find to avoid infinite loop
  - MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE
  - iio: magnetometer: Remove IRQF_ONESHOT
  - iio: Use IRQF_NO_THREAD
  - Revert "mfd: da9052-spi: Change read-mask to write-mask"
  - phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature
  - phy: mvebu-cp110-utmi: fix dr_mode property read from dts
  - watchdog: imx7ulp_wdt: handle the nowayout option
  - binder: don't use %pK through printk
  - fix it87_wdt early reboot by reporting running timer
  - serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done
  - staging: rtl8723bs: fix memory leak on failure path
  - misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66
  - misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read()
  - dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings
  - dmaengine: sun6i: Choose appropriate burst length under maxburst
  - fpga: of-fpga-region: Fail if any bridge is missing
  - usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs
  - serial: 8250_dw: handle clock enable errors in runtime_resume
  - staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure
  - soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15)
  - m68k: nommu: fix memmove() with differently aligned src and dest for 68000
  - clk: microchip: core: correct return value on *_get_parent()
  - mailbox: sprd: clear delivery flag before handling TX done
  - remoteproc: mediatek: Break lock dependency to `prepare_lock`
  - mailbox: sprd: mask interrupts that are not handled
  - mailbox: imx: Skip the suspend flag for i.MX7ULP
  - mailbox: pcc: Remove spurious IRQF_ONESHOT usage
  - remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized
  - tracing: Fix false sharing in hwlat get_sample()
  - vhost: fix caching attributes of MMIO regions by setting them explicitly
  - scsi: buslogic: Reduce stack usage
  - ata: libata: avoid long timeouts on hot-unplugged SATA DAS
  - RDMA/rtrs-clt: For conn rejection use actual err number
  - myri10ge: avoid uninitialized variable use
  - PCI: Mark Nvidia GB10 to avoid bus reset
  - PCI: Add ACS quirk for Qualcomm Hamoa & Glymur
  - PCI: Enable ACS after configuring IOMMU for OF platforms
  - PCI: Fix pci_slot_lock () device locking
  - net/rds: Clear reconnect pending bit
  - vmw_vsock: bypass false-positive Wnonnull warning with gcc-16
  - net: usb: sr9700: remove code to drive nonexistent multicast filter
  - wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg()
  - wifi: rtw89: pci: restore LDO setting after device resume
  - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky
  - Bluetooth: btusb: Add device ID for Realtek RTL8761BU
  - Bluetooth: btusb: Add new VID/PID for RTL8852CE
  - Bluetooth: hci_conn: use mod_delayed_work for active mode timeout
  - Bluetooth: hci_conn: Set link_policy on incoming ACL connections
  - ipv4: fib: Annotate access to struct fib_alias.fa_state.
  - wifi: iwlegacy: add missing mutex protection in il3945_store_measurement()
  - wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power()
  - gro: change the BUG_ON() in gro_pull_from_frag0()
  - net/rds: No shortcut out of RDS_CONN_ERROR
  - wifi: iwlwifi: mvm: check the validity of noa_len
  - net: usb: r8152: fix transmit queue timeout
  - openrisc: define arch-specific version of nop()
  - netfilter: xt_tcpmss: check remaining length before reading optlen
  - netfilter: nf_conntrack: Add allow_clash to generic protocol handler
  - ext4: mark group extend fast-commit ineligible
  - ext4: mark group add fast-commit ineligible
  - ipv6: exthdrs: annotate data-race over multiple sysctl
  - ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}()
  - wifi: ath12k: fix preferred hardware mode calculation
  - wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1
  - PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port
  - wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode
  - iommu/amd: move wait_on_sem() out of spinlock
  - iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency
  - dm: remove fake timeout to avoid leak request
  - dm: replace -EEXIST with -EBUSY
  - wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H
  - wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode()
  - wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero
  - jfs: nlink overflow in jfs_rename
  - jfs: Add missing set_freezable() for freezable kthread
  - ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio
  - modpost: Amend ppc64 save/restfpr symnames for -Os build
  - ASoC: es8328: Add error unwind in resume
  - hwmon: (f71882fg) Add F81968 support
  - hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE
  - ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe()
  - spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end
  - ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio
  - gpio: aspeed-sgpio: Change the macro to support deferred probe
  - ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro
  - HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK
  - HID: multitouch: add eGalaxTouch EXC3188 support
  - media: rkisp1: Fix filter mode register configuration
  - drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release
  - drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts
  - drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback
  - virt: vbox: uapi: Mark inner unions in packed structs as packed
  - hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed
  - drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map()
  - media: v4l2-async: Fix error handling on steps after finding a match
  - media: cx25821: Fix a resource leak in cx25821_dev_setup()
  - media: solo6x10: Check for out of bounds chip_id
  - media: adv7180: fix frame interval in progressive mode
  - media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START
  - spi: spi-mem: Limit octal DTR constraints to octal DTR situations
  - ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug
  - ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask
  - HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards
  - drm/amdgpu: avoid a warning in timedout job handler
  - drm/amdgpu: add support for HDP IP version 6.1.1
  - media: mediatek: vcodec: Don't try to decode 422/444 VP9
  - media: omap3isp: set initial format
  - media: omap3isp: isppreview: always clamp in preview_try_format()
  - media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes
  - drm/v3d: Set DMA segment size to avoid debug warnings
  - spi: stm32: fix Overrun issue at < 8bpw
  - media: dvb-core: dmxdevfilter must always flush bufs
  - spi-geni-qcom: use xfer->bits_per_word for can_dma()
  - spi-geni-qcom: initialize mode related registers to 0
  - drm/display/dp_mst: Add protection against 0 vcpi
  - parisc: Prevent interrupts during reboot
  - arm64: tegra: smaug: Add usb-role-switch support
  - char: tpm: cr50: Remove IRQF_ONESHOT
  - mailbox: bcm-ferxrm-mailbox: Use default primary handler
  - PCI/MSI: Unmap MSI-X region on error
  - clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF
  - clocksource/drivers/sh_tmu: Always leave device running after probe
  - bpf: verifier improvement in 32bit shift sign extension pattern
  - sparc: don't reference obsolete termio struct for TC* constants
  - sparc: Synchronize user stack on fork and clone
  - blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs()
  - xenbus: Use .freeze/.thaw to handle xenbus devices
  - perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD
  - s390/perf: Disable register readout on sampling events
  - cpufreq: dt-platdev: Block the driver from probing on more QC platforms
  - md-cluster: fix NULL pointer dereference in process_metadata_update
  - ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP
  - EFI/CPER: don't go past the ARM processor CPER record buffer
  - x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set
  - rnbd-srv: Zero the rsp buffer before using it
  - perf/arm-cmn: Support CMN-600AE
  - s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS
  - tools/power cpupower: Reset errno before strtoull()
  - smb: client: add proper locking around ses->iface_last_update
  - btrfs: handle user interrupt properly in btrfs_trim_fs()
  - minix: Add required sanity checking to minix_check_superblock()
  - i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr()
  - hfsplus: pretend special inodes as regular files
  - audit: add missing syscalls to read class
  - fs/buffer: add alert in try_to_free_buffers() for folios without buffers
  - hfsplus: fix volume corruption issue for generic/498
  - libperf build: Always place libperf includes first
  - libperf: Don't remove -g when EXTRA_CFLAGS are used
  - libsubcmd: Fix null intersection case in exclude_cmds()
  - perf callchain: Fix srcline printing with inlines
  - perf unwind-libdw: Fix invalid reference counts
  - ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names
  - ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names
  - ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false
  - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path
  - SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths
  - ata: libata-scsi: refactor ata_scsi_translate()
  - ata: pata_ftide010: Fix some DMA timings
  - ext4: use optimized mballoc scanning regardless of inode format
  - ext4: don't cache extent during splitting extent
  - MIPS: Work around LLVM bug when gp is used as global register variable
  - drm/amd/display: Use same max plane scaling limits for all 64 bpp formats
  - ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk
  - x86/hyperv: Fix error pointer dereference
  - btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found
  - efi: Fix reservation of unaccepted memory table
  - s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n
  - spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe()
  - spi: wpcm-fiu: Simplify with dev_err_probe()
  - spi: wpcm-fiu: Fix uninitialized res
  - spi: wpcm-fiu: Use devm_platform_ioremap_resource_byname()
  - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2
  - drm/amdkfd: fix debug watchpoints for logical devices
  - ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init
  - drm/i915/acpi: free _DSM package when no connectors
  - drm/amdgpu: Fix memory leak in amdgpu_ras_init()
  - apparmor: fix invalid deref of rawdata when export_binary is unset
  - apparmor: provide separate audit messages for file and policy checks
  - apparmor: use passed in gfp flags in aa_alloc_null()
  - apparmor: fix rlimit for posix cpu timers
  - apparmor: return -ENOMEM in unpack_perms_table upon alloc failure
  - apparmor: fix NULL sock in aa_sock_file_perm
  - net/mlx5: Fix multiport device check over light SFs
  - bonding: alb: fix UAF in rlb_arp_recv during bond up/down
  - octeontx2-af: Fix default entries mcam entry action
  - cache: add __cacheline_group_{begin, end}_aligned() (+ couple more)
  - cache: enforce cache groups
  - ping: annotate data-races in ping_lookup()
  - bpftool: Fix truncated netlink dumps
  - ipv6: fix a race in ip6_sock_set_v6only()
  - net: remove WARN_ON_ONCE when accessing forward path array
  - netfilter: nf_conntrack_h323: don't pass uninitialised l3num value
  - selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled
  - selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled
  - net: bridge: mcast: always update mdb_n_entries for vlan contexts
  - net/rds: rds_sendmsg should not discard payload_len
  - net: usb: catc: enable basic endpoint checking
  - net: sparx5/lan969x: fix PTP clock max_adj value
  - net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj()
  - net: mscc: ocelot: split xmit into FDMA and register injection paths
  - net: mscc: ocelot: extract ocelot_xmit_timestamp() helper
  - net: sparx5/lan969x: fix DWRR cost max to match hardware register width
  - selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2
  - ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO
  - selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT
  - selftests/memfd: delete unused declarations
  - kbuild: Add objtool to top-level clean target
  - powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check
  - ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs
  - fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot
  - fs/ntfs3: prevent infinite loops caused by the next valid being the same
  - io_uring/cancel: de-unionize file and user_data in struct io_cancel_data
  - dmaengine: fsl-edma: don't explicitly disable clocks in .remove()
  - dmaengine: fsl-edma-main: Convert to platform remove callback returning void
  - backlight: qcom-wled: Change PM8950 WLED configurations
  - backlight: qcom-wled: Support ovp values for PMI8994
  - leds: qcom-lpg: Check the return value of regmap_bulk_write()
  - pinctrl: single: fix refcount leak in pcs_add_gpio_func()
  - pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition
  - iio: sca3000: Fix a resource leak in sca3000_probe()
  - ovl: Fix uninit-value in ovl_fill_real
  - pinctrl: equilibrium: Fix device node reference leak in pinbank_init()
  - usb: bdc: fix sleep during atomic
  - drivers: iio: mpu3050: use dev_err_probe for regulator request
  - mfd: simple-mfd-i2c: Add Delta TN48M CPLD support
  - mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order
  - mfd: simple-mfd-i2c: Add SpacemiT P1 support
  - mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA
  - mfd: simple-mfd-i2c: Add MAX77705 support
  - mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure
  - Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms"
  - coresight: etm3x: Fix cpulocked warning on cpuhp
  - watchdog: starfive-wdt: Fix PM reference leak in probe error path
  - iio: pressure: mprls0025pa: fix scan_type struct
  - mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms
  - serial: SH_SCI: improve "DMA support" prompt
  - serial: imx: change SERIAL_IMX_CONSOLE to bool
  - staging: greybus: lights: avoid NULL deref
  - dma: dma-axi-dmac: fix SW cyclic transfers
  - dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX
  - clk: mediatek: Fix error handling in runtime PM setup
  - clk: qcom: gfx3d: add parent to parent request map
  - clk: qcom: dispcc-sdm845: Enable parents for pixel clocks
  - clk: Move clk_{save,restore}_context() to COMMON_CLK section
  - clk: qcom: gcc-ipq5018: flag sleep clock as critical
  - clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc
  - clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc
  - clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops
  - clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops
  - clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops
  - clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs
  - clk: qcom: rcg2: compute 2d using duty fraction directly
  - clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs
  - fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe()
  - fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings()
  - tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros
  - tracing: Properly process error handling in event_hist_trigger_parse()
  - fs/nfs: Fix readdir slow-start regression
  - nvdimm: virtio_pmem: serialize flush requests
  - scsi: csiostor: Fix dereference of null pointer rn
  - scsi: smartpqi: Fix memory leak in pqi_report_phys_luns()
  - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN
  - RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc
  - power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer
  - mtd: spinand: Fix kernel doc
  - mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions()
  - cxl: Fix premature commit_end increment on decoder commit failure
  - RDMA/core: add rdma_rw_max_sge() helper for SQ sizing
  - svcrdma: Reduce the number of rdma_rw contexts per-QP
  - svcrdma: Increase the per-transport rw_ctx count
  - svcrdma: Clean up comment in svc_rdma_accept()
  - svcrdma: Remove queue-shortening warnings
  - RDMA/core: Fix a couple of obvious typos in comments
  - RDMA/rxe: Fix race condition in QP timer handlers
  - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send
  - mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse()
  - crypto: ccp - Add an S4 restore flow
  - mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper
  - tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus()
  - RDMA/rxe: Fix double free in rxe_srq_from_init
  - RDMA/rtrs-srv: fix SG mapping
  - power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed()
  - power: supply: bq27xxx: fix wrong errno when bus ops are unsupported
  - power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write
  - power: supply: sbs-battery: Fix use-after-free in power_supply_changed()
  - power: supply: rt9455: Fix use-after-free in power_supply_changed()
  - power: supply: goldfish: Fix use-after-free in power_supply_changed()
  - power: supply: cpcap-battery: Fix use-after-free in power_supply_changed()
  - power: supply: bq25980: Fix use-after-free in power_supply_changed()
  - power: supply: bq256xx: Fix use-after-free in power_supply_changed()
  - power: supply: act8945a: Fix use-after-free in power_supply_changed()
  - power: supply: ab8500: Fix use-after-free in power_supply_changed()
  - IB/cache: update gid cache on client reregister event
  - RDMA/rtrs: server: remove dead code
  - octeontx2-pf: Unregister devlink on probe failure
  - ionic: Rate limit unknown xcvr type messages
  - serial: caif: fix use-after-free in caif_serial ldisc_close()
  - net: Add skb_dstref_steal and skb_dstref_restore
  - net: sunhme: Fix sbus regression
  - net: atm: fix crash due to unvalidated vcc pointer in sigd_send()
  - smb: client: correct value for smbd_max_fragmented_recv_size
  - PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404]
  - netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets
  - netfilter: nft_counter: fix reset of counters on 32bit archs
  - netfilter: nft_set_hash: fix get operation on big endian
  - nfc: hci: shdlc: Stop timers and work before freeing context
  - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP
  - bonding: only set speed/duplex to unknown, if getting speed failed
  - octeontx2-af: Fix PF driver crash with kexec kernel booting
  - mptcp: fix receive space timestamp initialization
  - of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy()
  - ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit()
  - ipc: don't audit capability check in ipc_permissions()
  - PCI/ACPI: Restrict program_hpx_type2() to AER bits
  - PCI: Add defines for bridge window indexing
  - PCI: Add PCIE_MSG_CODE_ASSERT_INTx message macros
  - PCI: Log bridge info when first enumerating bridge
  - PCI: Log bridge windows conditionally
  - PCI: Supply bridge device, not secondary bus, to read window details
  - PCI: Move pci_read_bridge_windows() below individual window accessors
  - PCI: Initialize RCB from pci_configure_device()
  - wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump()
  - tcp: tcp_tx_timestamp() must look at the rtx queue
  - nfsd: never defer requests during idmap lookup
  - iommu/vt-d: Flush cache for PASID table before using it
  - PCI: Mark 3ware-9650SA Root Port Extended Tags as broken
  - kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup()
  - module: add helper function for reading module_buildid()
  - netfilter: nft_compat: add more restrictions on netlink attributes
  - netfilter: nf_conncount: increase the connection clean up limit to 64
  - netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH
  - netfilter: nf_tables: reset table validation state on abort
  - wifi: cfg80211: stop NAN and P2P in cfg80211_leave
  - mctp i2c: initialise event handler read bytes
  - net: mctp-i2c: fix duplicate reception of old data
  - PCI/portdrv: Fix potential resource leak
  - PCI: Do not attempt to set ExtTag for VFs
  - Documentation: tracing: Add PCI tracepoint documentation
  - Documentation: trace: Refactor toctree
  - docs: fix WARNING document not included in any toctree
  - Documentation: tracing: Add ring-buffer mapping
  - PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails
  - PCI/PM: Avoid redundant delays on D3hot->D3cold
  - Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors
  - PCI: mediatek: Fix IRQ domain leak when MSI allocation fails
  - spi: tools: Add include folder to .gitignore
  - platform/chrome: cros_ec_lightbar: Fix response size initialization
  - media: uvcvideo: Fix allocation for small frame sizes
  - platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev
  - drm/msm/a2xx: fix pixel shader start on A225
  - media: ccs: Accommodate C-PHY into the calculation
  - drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x
  - HID: playstation: Add missing check for input_ff_create_memless
  - regulator: core: move supply check earlier in set_machine_constraints()
  - drm/msm/disp/dpu: add merge3d support for sc7280
  - drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init
  - smack: /smack/doi: accept previously used values
  - smack: /smack/doi must be > 0
  - workqueue: Process rescuer work items one-by-one using a cursor
  - workqueue: Only assign rescuer work when really needed
  - workqueue: Factor out assign_rescuer_work()
  - arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions
  - arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1
  - arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0
  - arm64: dts: amlogic: g12: assign the MMC A signal clock
  - arm64: dts: amlogic: g12: assign the MMC B and C signal clocks
  - arm64: dts: amlogic: gx: assign the MMC signal clocks
  - arm64: dts: amlogic: axg: assign the MMC signal clocks
  - arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node
  - ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells
  - powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling
  - soc: mediatek: svs: Fix memory leak in svs_enable_debug_write()
  - soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe
  - powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user()
  - ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property
  - arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on
  - arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on
  - arm64: dts: qcom: sdm630: fix gpu_speed_bin size
  - clk: qcom: Return correct error code in qcom_cc_probe_by_index()
  - arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings
  - EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size()
  - EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size()
  - soc: qcom: smem: handle ENOMEM error during probe
  - mfd: wm8350-core: Use IRQF_ONESHOT
  - EDAC/altera: Remove IRQF_ONESHOT
  - scsi: efct: Use IRQF_ONESHOT and default primary handler
  - hrtimer: Fix trace oddity
  - crypto: octeontx - fix dma_free_coherent() size
  - crypto: cavium - fix dma_free_coherent() size
  - ARM: VDSO: Patch out __vdso_clock_getres() if unavailable
  - libbpf: Fix OOB read in btf_dump_get_bitfield_value
  - selftests/bpf: veristat: fix printing order in output_stats()
  - crypto: qat - fix warning on adf_pfvf_pf_proto.c
  - s390/cio: Fix device lifecycle handling in css_alloc_subchannel()
  - PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races
  - perf: arm_spe: Properly set hw.state on failures
  - PM: wakeup: Handle empty list in wakeup_sources_walk_start()
  - Partial revert "x86/xen: fix balloon target initialization for PVH dom0"
  - x86/xen: make some functions static
  - ublk: Validate SQE128 flag before accessing the cmd
  - iomap: fix submission side handling of completion side errors
  - md/raid10: fix any_working flag handling in raid10_sync_request
  - cpuidle: governors: menu: Always check timers with tick stopped
  - cpuidle: menu: Cleanup after loadavg removal
  - io_uring/sync: validate passed in offset
  - xen/virtio: Don't use grant-dma-ops when running as Dom0
  - btrfs: fix block_group_tree dirty_list corruption
  - btrfs: qgroup: return correct error when deleting qgroup relation item
  - tpm: st33zp24: Fix missing cleanup on get_burstcount() error
  - tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure
  - i3c: dw: Initialize spinlock to avoid upsetting lockdep
  - gfs2: Retries missing in gfs2_{rename,exchange}
  - i3c: master: Update hot-join flag only on success
  - fs: add <linux/init_task.h> for 'init_fs'
  - audit: move the compat_xxx_class[] extern declarations to audit_arch.h
  - rcu: Fix rcu_read_unlock() deadloop due to softirq
  - rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler()
  - rcu: Refactor expedited handling check in rcu_read_unlock_special()
  - rcu/exp: Move expedited kthread worker creation functions above rcutree_prepare_cpu()
  - rcu: s/boost_kthread_mutex/kthread_mutex
  - hfsplus: return error when node already exists in hfs_bnode_create
  - auxdisplay: arm-charlcd: fix release_mem_region() size
  - RDMA/siw: Fix potential NULL pointer dereference in header processing
  - bpf: Avoid soft lockup in bpf_uprobe_unregister
  - usb: cdns3: fix role switching during resume
  - urma: add v2p function in kernel for dfx such as urma_admin
  - ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch()
  - urma: increase topo max node limit to 1024
  - ub: ub_fwctl: the function of querying the historical status of ports has been unrestricted.
  - riscv: kvm: fix vector context allocation leak
  - ub:hisi-ubus: modify return value of hi_feature_get() in abnormal branch
  - urma: fix jetty_grp count boundary check and pass opt_mask to check_jetty_check_dev_cap
  - APEI/GHES: ARM processor Error: don't go past allocated memory
  - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()
  - refcount: provide ops for cases when object's memory can be reused
  - mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node
  - iommu/ummu: Fix reading command value in check_pa_continuity_nop_exec
  - drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc()
  - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check
  - ub: udma: change default value of set dev name
  - soc: hisilicon: kunpeng_hccs: Remove unused input parameter
  - soc: hisilicon: kunpeng_hccs: Fix discard 'const' qualifier
  - ntfs3: fix circular locking dependency in run_unpack_ex
  - openvswitch: vport: fix self-deadlock on release of tunnel ports
  - crypto: authencesn - reject short ahash digests during instance creation
  - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery
  - net/mlx5: Fix deadlock between devlink lock and esw->wq
  - iommu/ummu: Fix potential soft lockup in ummu_core_alloc_separate_tdev
  - iommu/ummu: Fix incorrect xarray index in map_pages error path
  - sched/eevdf: Force propagating min_slice of cfs_rq when {en,de}queue tasks
  - sched/eevdf: Fix se->slice being set to U64_MAX and resulting crash
  - sched: Fix kabi breakage in struct sched_entity
  - sched/eevdf: Propagate min_slice up the cgroup hierarchy
  - sched/fair: Re-organize dequeue_task_fair()
  - sched/eevdf: Use sched_attr::sched_runtime to set request/slice suggestion
  - sched/cputime: Fix time overflow in cputime_adjust()
  - urma: fix main_ue_eid flush ioctl argument
  - net: usb: pegasus: enable basic endpoint checking
  - mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock
  - libceph: prevent potential out-of-bounds reads in process_message_header()
  - iommu/amd: serialize sequence allocation under concurrent TLB invalidations
  - urma: refactor connect_bonding from ubcore to ubagg
  - mm/vmalloc: take vmap_purge_lock in shrinker
  - rnpgbe: update rnpgbe driver to version 1.0.10
  - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1
  - openeuler_defconfig: disable CONFIG_USERSWAP by default
  - mm/userswap: remove boot param
  - usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl
  - usb: usblp: fix heap leak in IEEE 1284 device ID via short response
  - mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show()
  - wifi: rsi: fix kthread lifetime race between self-exit and external-stop
  - net: hibmcge: move dma_rmb() after dma_sync_single_for_cpu() in RX path
  - net: hibmcge: disable Relaxed Ordering to fix RX packet corruption
  - usb: ulpi: fix memory leak on ulpi_register() error paths
  - usb: ulpi: fix double free in ulpi_register_interface() error path
  - vsock/virtio: fix accept queue count leak on transport mismatch
  - soc cache: Fix unsafe shift left
  - net: caif: clear client service pointer on teardown
  - net: ioam6: fix OOB and missing lock
  - ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data()
  - urma: change wk1 to wk2 to send data and add responsibility
  - x86/kexec: add a sanity check on previous kernel's ima kexec buffer
  - ima: verify the previous kernel's IMA buffer lies in addressable RAM
  - usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo
  - usb: gadget: f_ncm: Fix net_device lifecycle with device_move
  - cleanup: Provide retain_and_null_ptr()
  - usb: gadget: ncm: Fix indentations in documentation of NCM section
  - usb: gadget: ncm: Fix endianness of wMaxSegmentSize variable in ecm_desc
  - usb: gadget: ncm: Add support to update wMaxSegmentSize via configfs
  - ceph: only d_add() negative dentries when they are unhashed
  - xen-netback: reject zero-queue configuration from guest
  - net: qrtr: ns: Fix use-after-free in driver remove()
  - md/raid5: fix soft lockup in retry_aligned_read()
  - urma: fix main_ue_eid query table configuration path
  - urma: topology supports parallel planes
  - gfs2: Fix use-after-free in iomap inline data write path
  - gfs2: Add metapath_dibh helper
  - RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq()
  - ipmi:ssif: NULL thread on error
  - ipmi:ssif: Clean up kthread on errors
  - eventfs: Hold eventfs_mutex and SRCU when remount walks events
  - APEI/GHES: ensure that won't go past CPER allocated record
  - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()
  - ﻿ub: ubase: Correct the statistics on ELR reset failures
  - ﻿ub: ubase&unic: Improve driver code readability
  - ﻿ub: ubase: Discard ctrlq request with non-zero ret value
  - ﻿ub: ubase: Add abort handling for non-timeout ELR failures
  - ﻿net: unic: Log rectification for the wildfire project
  - ﻿ub: ubase/unic/cdma: Clear adev_status when probe succeeds
  - ﻿net: unic: Filter out IPv6 link-local address in bond IP notification
  - kvm: arm64: Fix NULL pointer dereference in kvm_destroy_cvm() with timer early inject
  - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0
  - Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt
  - sched/ext: Avoid null ptr traversal when ->put_prev_task() is called with NULL next
  - sched_ext: fix flag check for deferred callbacks
  - sched_ext: defer queue_balance_callback() until after ops.dispatch
  - thermal: core: Fix thermal zone governor cleanup issues
  - sched_ext: Keep bypass on between enable failure and scx_disable_workfn()
  - urma: fix device change namespace calltrace
  - net: unic: Fix the issue of system suspend when the fe
  - ub: ubase: Resolved the issue of printing logs in spin
  - erofs: fix inline data read failure for ztailpacking pclusters
  - ub:ubus: optimize error print for ubus and hisi_ubus
  - urma: fix the scenario-specific message processing interface
  - ub:ubfi: add numa node get from firmware mode
  - bpf: Fix variable length stack write over spilled pointers
  - bpf: Do not allow deleting local storage in NMI
  - bpf: Convert bpf_selem_unlink to failable
  - bpf: Convert bpf_selem_link_map to failable
  - bpf: Convert bpf_selem_unlink_map to failable
  - bpf: Select bpf_local_storage_map_bucket based on bpf_local_storage
  - ub: udma: optimize log format.
  - mfs: update mfs doc for adding sysfs part
  - vfio:ubus: add vfio ub cfg0 and cfg1 basic attr perm
  - mount: hold namespace_sem across copy in create_new_namespace()
  - mount: add OPEN_TREE_NAMESPACE
  - gfs2: Fix slab-use-after-free in qd_put
  - tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG
  - update rnpgbevf driver to version 1.0.1.
  - ub:ubus: Optimize error log and add mutex lock for ub memory ras
  - ub:ubus: add mutex lock for port local ras
  - gfs2: fix memory leaks in gfs2_fill_super error path
  - cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path
  - Bluetooth: SMP: force responder MITM requirements before building the pairing response
  - ipv4: icmp: fix null-ptr-deref in icmp_build_probe()
  - erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap()
  - erofs: fix the out-of-bounds nameoff handling for trailing dirents
  - mm: fix some minor per-VMA lock issues in userfaultfd
  - userfaultfd: use per-vma locks in userfaultfd operations
  - mm: add vma_assert_locked() for !CONFIG_PER_VMA_LOCK
  - userfaultfd: protect mmap_changing with rw_sem in userfaulfd_ctx
  - userfaultfd: fix operator precedence bug in UFFDIO_COPY mode check
  - ub: cdma: inline cdma_id_find_ctp into cdma_delete_ctp
  - sched: idle: Make skipping governor callbacks more consistent
  - cpuidle: Skip governor when only one idle state is available
  - mfs: handle close event in user-space side
  - mfs: post close event to user-space side
  - mfs: add file operation event filtering
  - sched: Fix bpf_sched_set_task_prefer_nid() build error
  - bnxt_en: Update VNIC resource calculation for VFs
  - bnxt_en: Do not call sleeping hwmon_notify_event() from NAPI
  - bnxt_en: Support QOS and TPID settings for the SRIOV VLAN
  - Revert "bnxt_en: Support QOS and TPID settings for the SRIOV VLAN"
  - bnxt_en: Support QOS and TPID settings for the SRIOV VLAN
  - bnxt_en: Event handler for Thermal event
  - bnxt_en: Use non-standard attribute to expose shutdown temperature
  - bnxt_en: Expose threshold temperatures through hwmon
  - bnxt_en: Modify the driver to use hwmon_device_register_with_info
  - bnxt_en: Move hwmon functions into a dedicated file
  - bnxt_en: Enhance hwmon temperature reporting
  - eth: bnxt: fix backward compatibility with older devices
  - bnxt_en: Fix 2 stray ethtool -S counters
  - urma: move capability of querying physical devices from ubcore to ubagg
  - mfs: add sysfs interface to configure event
  - netfilter: ctnetlink: ensure safe access to master conntrack
  - net: consume xmit errors of GSO frames
  - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()
  - drivers/ub/sentry: use fixed short interval for ACK wait loop polling
  - ub: ubase: Ctrlq code optimization
  - net: unic: Added logging related to the Jetty context
  - ub: ubase: Adjust the macro definition for querying chip
  - ub:ubus: add error return when send config message
  - sched/idle: Fall back to idle after failed soft quota repick
  - sched/idle: Update SCX idle mask only when picking idle
  - urma: Introduce EID patricia trie for primary EID lookup
  - ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put()
  - KVM: arm64: reuse vgic_write_guest_lock to suppress spurious WARN_ON when no vCPU is running
  - KVM: arm64: add CVM VM check when initializing union to avoid corrupting KABI isolation
  - drm: Account property blob allocations to memcg
  - net/oenetcls: make rps policy module params read-only
  - net/oenetcls: fix async delete race with pending rule add
  - net/oenetcls: move listen-time tuple resolution to worker context
  - ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put()
  - ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU
  - iommu/ummu: Adapt disable DVM
  - tracing: Avoid NULL return from hist_field_name() on truncation
  - tracing: Fix fully-qualified variable reference printing in histograms
  - tracing: Rebuild full_name on each hist_field_name() call
  - PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry
  - ub/ubmem-vmmu: optimize prints
  - ub/ubmempfd: update note and optimize format
  - ub/ubdevshm: Fix spelling errors and optimize prints
  - arm64/ACPI: fix build error when CONFIG_ACPI_APEI_GHES is disabled
  - RDMA/hns: Fix hung task when drain qp failed.
  - RDMA/hns: Support drain SQ and RQ
  - RDMA/hns: Fix WQ_MEM_RECLAIM warning
  - ub:ubfi: fix the resource maintenance issue in the ubfi ummu node parsing
  - scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT
  - libceph: define and enforce CEPH_MAX_KEY_LEN
  - drivers/ub/sentry: Add timestamp logging and optimize ACK wait loop
  - update rnpgbevf driver to version 1.0.1.
  - sched: Remove redundant rcu_read_lock() in build_soft_domain()
  - lib/crypto: chacha: Zeroize permuted_state before it leaves scope
  - PCI/IOV: Fix use-after-free in pci_iov_remove_virtfn()
  - urma: fix RNR ERR under CTP mode in IPoURMA
  - net: yt6801: fix link info for yt6801
  - sched/idle: Fix soft quota fair repick state handling
  - urma: zero-initialize cg_obj to prevent uninitialized memory access
  - ub:ubus: bugfix for QEMU'addr 8byte check
  - tracing/probe: reject non-closed empty immediate strings
  - tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func()
  - tracing: branch: Fix inverted check on stat tracer registration
  - x86/microcode: Add Zhaoxin cpu microcode update driver
  - ub:ubus: bugfix for UE probe without MUE'lock
  - ub:ubus: Fixing the bug of concurrent hotplug and device reset
  - ub: cdma: move cleanup helper to event and remove unused include
  - RDMA/hns: Notify ULP of remaining soft-WCs during reset
  - RDMA/hns: Fix udca not unregistered when reset entry allocation failed
  - pstore/ram: fix resource leak when ioremap() fails
  - net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode
  - Revert "driver core: enforce device_lock for driver_match_device()"
  - iommu/arm-smmu-v3: Fix pgsize_bit for sva domains
  - tools/dma: Add dma_map_sg support
  - dma-mapping: benchmark: add support for dma_map_sg
  - dma-mapping: benchmark: modify the framework to adapt to more map modes
  - mm/cma_folio: make CMA folio allocation per-task opt-in via procfs
  - mm: introduce CMA-based folio allocation
  - ub: cdma: fix multiple code quality and potential bug issues
  - driver core: enforce device_lock for driver_match_device()
  - urma: fix resource leaks in uburma and ubcore error paths
  - net/hinic5: Add Huawei Intelligent Network Card Driver: hinic5
  - crypto：Fix panic caused by OFB and CFB self-test failure when starting in FIPS mode.
  - bpftool: Fix regression of "bpftool cgroup tree" EINVAL on older kernels
  - config: Enable NETKIT
  - set BPF_NETKIT_PRIMARY=54, BPF_NETKIT_PEER=55
  - add __GENKSYMS__ in uapi bpf.h and if_link.h
  - ACPI: processor: idle: Reset cpuidle on C-state list changes
  - cpuidle: Extract and export no-lock variants of cpuidle_unregister_device()
  - cpuidle: Simplify cpuidle_register_device() with guard()
  - ACPI: processor: idle: Fix NULL pointer dereference in hotplug path
  - ACPI: processor: idle: Reset power_setup_done flag on initialization failure
  - ACPI: processor: idle: Remove redundant static variable and rename cstate check function
  - ACPI: processor: idle: Move max_cstate update out of the loop
  - ACPI: processor: idle: Remove redundant cstate check in acpi_processor_power_init
  - ACPI: arm64: cpuidle: Tolerate platforms with no deep PSCI idle states
  - ACPI: processor: idle: Rework the handling of acpi_processor_ffh_lpi_probe()
  - ACPI: processor: idle: Convert acpi_processor_setup_cpuidle_dev() to void
  - ACPI: processor: idle: Convert acpi_processor_setup_cpuidle_states() to void
  - ACPI: processor: idle: Add debug log for states with invalid entry methods
  - ACPI: processor: idle: Replace strlcat() with better alternative
  - ACPI: processor: idle: Add missing bounds check in flatten_lpi_states()
  - ACPI: processor: Do not expose global variable acpi_idle_driver
  - ACPI: processor: Update cpuidle driver check in __acpi_processor_start()
  - ACPI: processor: idle: Redefine two functions as void
  - ACPI: processor: idle: Rearrange declarations in header file
  - ACPI: processor: Remove unused empty stubs of some functions
  - ACPI: processor: idle: Optimize ACPI idle driver registration
  - ACPI: processor: idle: Drop redundant C-state count checks
  - ACPI: processor: idle: Relocate state flags initialization
  - ACPI: processor: idle: Eliminate static variable flat_state_cnt
  - sched/fair: fix !CONFIG_SMP build errors
  - net/oenetcls: validate module params and reject zero table sizes
  - LoongArch: KVM: Move unconditional delay into timer clear scenery
  - LoongArch: KVM: Fix HW timer interrupt lost when inject interrupt by software
  - LoongArch: KVM: Move AVEC interrupt injection into switch loop
  - LoongArch: KVM: Use kvm_set_pte() in kvm_flush_pte()
  - LoongArch: KVM: Fix missing EMULATE_FAIL in kvm_emu_mmio_read()
  - LoongArch: KVM: Cap KVM_CAP_NR_VCPUS by KVM_CAP_MAX_VCPUS
  - LoongArch: KVM: Fix "unreliable stack" for kvm_exc_entry
  - LoongArch: KVM: Compile switch.S directly into the kernel
  - LoongArch: KVM: Add DMSINTC inject msi to vCPU
  - LoongArch: KVM: Add DMSINTC device support
  - LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function
  - LoongArch: KVM: Move host CSR_GSTAT save and restore in context switch
  - LoongArch: KVM: Move host CSR_EENTRY save and restore in context switch
  - LoongArch: KVM: Check kvm_request_pending() in kvm_late_check_requests()
  - LoongArch: KVM: Use CSR_CRMD_PLV in kvm_arch_vcpu_in_kernel()
  - LoongArch: KVM: Handle the case that EIOINTC's coremap is empty
  - LoongArch: KVM: Make kvm_get_vcpu_by_cpuid() more robust
  - LoongArch: KVM: Fix typo issue in kvm_vm_init_features()
  - LoongArch: KVM: Add paravirt vcpu_is_preempted() support in guest side
  - LoongArch: KVM: Add paravirt preempt feature in hypervisor side
  - LoongArch: KVM: Set default return value in KVM IO bus ops
  - LoongArch: KVM: Add FPU/LBT delay load support
  - LoongArch: KVM: Move LBT capability check in exception handler
  - LoongArch: KVM: Move LASX capability check in exception handler
  - LoongArch: KVM: Move LSX capability check in exception handler
  - LoongArch: KVM: Handle LOONGARCH_CSR_IPR during vCPU context switch
  - LoongArch: KVM: Check VM msgint feature during interrupt handling
  - LoongArch: KVM: Add msgint registers in kvm_init_gcsr_flag()
  - LoongArch: KVM: Move feature detection in kvm_vm_init_features()
  - LoongArch: KVM: Add more CPUCFG mask bits
  - LoongArch: Complete CPUCFG registers definition
  - crypto: virtio - Replace package id with numa node id
  - ACPICA: iASL: Add definitions for the IOVT table
  - LoongArch: KVM: Fix kvm_device leak in kvm_pch_pic_destroy()
  - LoongArch: KVM: Fix kvm_device leak in kvm_eiointc_destroy()
  - LoongArch: KVM: Fix kvm_device leak in kvm_ipi_destroy()
  - LoongArch: Add and use some macros for AVEC
  - LoongArch: KVM: Fix the compatibility issue between eioint and the upstream qemu
  - LoongArch: KVM: Add AVEC basic support
  - LoongArch: KVM: Get VM PMU capability from HW GCFG register
  - LoongArch: KVM: Register perf callbacks for guest
  - LoongArch: KVM: Implement arch-specific functions for guest perf
  - LoongArch: KVM: Remove PGD saving during VM context switch
  - LoongArch: KVM: Rework pch_pic_update_batch_irqs()
  - LoongArch: KVM: Add different length support in loongarch_pch_pic_write()
  - LoongArch: KVM: Add different length support in loongarch_pch_pic_read()
  - LoongArch: KVM: Add IRR and ISR register read emulation
  - LoongArch: KVM: Set version information at initial stage
  - LoongArch: KVM: Avoid copy_*_user() with lock hold in kvm_pch_pic_regs_access()
  - LoongArch: KVM: Add address alignment check in pch_pic register access
  - LoongArch: KVM: Add stat information with kernel irqchip
  - LoongArch: KVM: sync pch_pic to upstream
  - LoongArch: KVM: Access mailbox directly in mail_send()
  - LoongArch: KVM: Add implementation with IOCSR_IPI_SET
  - CVE-2025-39704: LoongArch: KVM: Fix stack protector issue in send_ipi_data()
  - LoongArch: KVM: sync kvm_ipi to upstream
  - LoongArch: KVM: Ensure that kvm eiointc is compatible with older versions
  - LoongArch: KVM: Use 64-bit register definition for EIOINTC
  - LoongArch: KVM: Fix max supported vCPUs set with EIOINTC
  - LoongArch: KVM: Avoid copy_*_user() with lock hold in kvm_eiointc_sw_status_access()
  - LoongArch: KVM: Avoid copy_*_user() with lock hold in kvm_eiointc_ctrl_access()
  - LoongArch: KVM: Replace eiointc_enable_irq() with eiointc_update_irq()
  - LoongArch: KVM: Use generic function loongarch_eiointc_write()
  - LoongArch: KVM: Use generic function loongarch_eiointc_read()
  - LoongArch: KVM: Use standard bitops API with eiointc
  - LoongArch: KVM: Remove never called default case statement
  - LoongArch: KVM: Remove unused parameter len
  - LoongArch: KVM: Remove unnecessary local variable
  - LoongArch: KVM: Disable updating of "num_cpu" and "feature"
  - CVE-2025-38366: LoongArch: KVM: Check validity of "num_cpu" from user space
  - LoongArch: KVM: Check interrupt route from physical CPU
  - LoongArch: KVM: Fix interrupt route update with EIOINTC
  - LoongArch: KVM: Add address alignment check for IOCSR emulation
  - drivers/iommu: Fixed the problem that some network cards in dpdk could not work properly with iommu
  - sched/fair: Do not send IPI if WFI timeout is 0
  - ub: udma: alloc jfc_id avoid the ccu/starts type.
  - ub: udma: optimize the remove process.
  - CVE-2025-38367: LoongArch: KVM: Avoid overflow with array index
  - LoongArch: KVM: sync eiointc to upstream
  - LoongArch: KVM: Delete the kvm mmu interfaces that are no longer in use
  - LoongArch: KVM: Fix VM migration failure with PTW enabled
  - LoongArch: KVM: Do not flush tlb if HW PTW supported
  - LoongArch: KVM: Skip PMU checking on vCPU context switch
  - LoongArch: KVM: Add sign extension with kernel IOCSR read emulation
  - LoongArch: KVM: Add sign extension with kernel MMIO read emulation
  - irqchip/loongson-eiointc: Add multiple interrupt pin routing support
  - irqchip/loongson-eiointc: Add virt extension support
  - irqchip/loongson-eiointc: Route interrupt parsed from bios table
  - LoongArch: KVM: Protect kvm_io_bus_{read,write}() with SRCU
  - LoongArch: config: enable paravirt feature
  - x86/sev: Fix potential sign extension in amd_enc_status_change_finish()
  - ipmi: hisi_pso: fix atomic sleep and use-after-free via async workqueue
  - bpf: Fix tcx/netkit detach permissions when prog fd isn't given
  - bpf: align CAP_NET_ADMIN checks with bpf_capable() approach
  - rtnetlink: add needed_{head,tail}room attributes
  - bpftool: Fix cgroup command to only show cgroup bpf programs
  - netkit: Allow for configuring needed_{head,tail}room
  - selftests/bpf: Extend netkit tests to validate skb meta data
  - tools: Sync if_link.h uapi tooling header
  - netkit: Simplify netkit mode over to use NLA_POLICY_MAX
  - netkit: Add option for scrubbing skb meta data
  - netkit: Disable netpoll support
  - bpftool: Query only cgroup-related attach types
  - selftests/bpf: Add netkit test for pkt_type
  - selftests/bpf: Add netkit tests for mac address
  - netkit: Fix pkt_type override upon netkit pass verdict
  - netkit: Fix setting mac address in l2 mode
  - bpf, docs: Fix bpf_redirect_peer header doc
  - bpf: Add missing BPF_LINK_TYPE invocations
  - netkit: Reject IFLA_NETKIT_PEER_INFO in netkit_change_link
  - selftests/bpf: Add netkit to tc_redirect selftest
  - bpf, netkit: Add indirect call wrapper for fetching peer dev
  - netkit: Add tstats per-CPU traffic counters
  - netkit: Remove explicit active/peer ptr initialization
  - selftests/bpf: Add selftests for netkit
  - bpftool: Extend net dump with netkit progs
  - bpftool: Implement link show support for netkit
  - libbpf: Add link-based API for netkit
  - tools: Sync if_link uapi header
  - netkit, bpf: Add bpf programmable net device
  - arm64: kernel: fix Clang integrated assembler errors in entry.S
  - xSched: fix NULL pointer dereference in cfs_rq during class switch
  - xSched/dmem: memory allocation size must larger than 0
  - xSched: prevent HBM allocation for non-AI tasks
  - xSched: fix incorrect error returns in vstream allocation
  - xSched/cgroup: remove legacy cftypes due to cgroup v1 incompatibility
  - PCI: Fix PCIe unplug Enumeration Long Blocking Issue
  - urma: add rate limit for modify error logs
  - mfs: fix inode resource leak when cache object fd is zero
  - bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path
  - bpf: Use copy_map_value_locked() in alloc_htab_elem() for BPF_F_LOCK
  - bpf: Fix OOB in pcpu_init_value
  - bpf: Fix stale offload->prog pointer after constant blinding
  - bpf: fix end-of-list detection in cgroup_storage_get_next_key()
  - bpf: Fix RCU stall in bpf_fd_array_map_clear()
  - bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks
  - bpf: Fix use-after-free in offloaded map/prog info fill
  - bpf, arm64: Fix off-by-one in check_imm signed range check
  - bpf: Fix NULL deref in map_kptr_match_type for scalar regs
  - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists
  - net: unic: Add statistics on abnormal cqe
  - ub:ubase:anti-attack feature adaptation
  - ub: ubase: Add execution statistics for the software
  - ub: ubase: Add retry when ctrlq e2e msg send fail during
  - update rnpgbevf driver to version 1.0.1.
  - rme: add debugfs nodes for rme firmware log control
  - rme: reorder hisi_ext_cmd enum values by numeric order
  - nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free
  - arm64: topology: Fix false warning in counters_read_on_cpu() for same-CPU reads
  - cpufreq: CPPC: Update FIE arch_freq_scale in ticks for non-PCC regs
  - cpufreq: CPPC: Factor out cppc_fie_kworker_init()
  - ACPI: CPPC: Factor out and export per-cpu cppc_perf_ctrs_in_pcc_cpu()
  - cpufreq: CPPC: Don't warn if FIE init fails to read counters
  - Revert "cpufreq: CPPC: Don't warn on failing to read perf counters on offline cpus"
  - PM / devfreq: use _visible attribute to replace create/remove_sysfs_files()
  - cpufreq: Replace magic number
  - cpufreq: Update sscanf() to kstrtouint()
  - update to sysfs_emit() for safer buffer handling
  - btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file()
  - btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file()
  - x86/resctrl: Fix memory bandwidth counter width for Hygon
  - x86/resctrl: Add missing resctrl initialization for Hygon
  - x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper
  - x86/cpu/hygon: Clean up out-of-tree resctrl code
  - md/bitmap: fix GPF in write_page caused by resize race
  - libbpf: Fix -Wdiscarded-qualifiers under C23
  - drivers/ub/sentry: Reduce the sleep time of sentry_urma_kthread thread
  - ub: cdma: specify log and add hardware version
  - ub: cdma: reconstruct the event reporting module
  - gve: Fix stats report corruption on queue count change
  - iommu/pages: Make iommu_put_pages_list() work with high order allocations
  - iommu/amd: Fix alias device DTE setting
  - iommu/amd: Fix error path in amd_iommu_probe_device()
  - iommu/amd: Remove unused PPR_* macros
  - iommu/amd: Fix header file
  - iommu/amd: Preserve default DTE fields when updating Host Page Table Root
  - iommu/amd: Modify set_dte_entry() to use 256-bit DTE helpers
  - iommu/amd: Introduce struct ivhd_dte_flags to store persistent DTE flags
  - mm: delete the unused put_pages_list()
  - iommu/amd/pgtbl_v2: Take protection domain lock before invalidating TLB
  - iommu/amd: Fix argument order in amd_iommu_dev_flush_pasid_all()
  - iommu/amd: Handle error path in amd_iommu_probe_device()
  - iommu/amd: Remove unused DTE_GCR3_INDEX_* macros
  - iommu/amd: Invalidate cache before removing device from domain list
  - iommu/amd: Introduce per device DTE update function
  - configs/hardening: Fix disabling UBSAN configurations
  - iommu/amd: use page allocation function provided by iommu-pages.h
  - iommu/dma: use iommu_put_pages_list() to releae freelist
  - iommu/amd: Fix possible irq lock inversion dependency issue
  - iommu/amd: Fix sleeping in atomic context
  - iommu/amd: Introduce per-device domain ID to fix potential TLB aliasing issue
  - iommu/amd: Refactor GCR3 table helper functions
  - iommu/amd: Refactor protection_domain helper functions
  - iommu/amd: Refactor attaching / detaching device functions
  - iommu/amd: Refactor helper function for setting / clearing GCR3
  - iommu/amd: Rearrange GCR3 table setup code
  - iommu/amd: Add support for device based TLB invalidation
  - iommu/amd: Introduce per-device GCR3 table
  - iommu/amd: Introduce struct protection_domain.pd_mode
  - iommu/amd: Introduce get_amd_iommu_from_dev()
  - iommu/amd/pgtbl_v2: Invalidate updated page ranges only
  - iommu/amd: Make domain_flush_pages as global function
  - iommu/amd: Consolidate amd_iommu_domain_flush_complete() call
  - iommu/amd: Refactor device iotlb invalidation code
  - iommu/amd: Refactor IOMMU tlb invalidation code
  - iommu/amd: Add support to invalidate multiple guest pages
  - iommu/amd: Remove redundant passing of PDE bit
  - iommu/amd: Remove redundant domain flush from attach_device()
  - hardening: x86: drop reference to removed config AMD_IOMMU_V2
  - iommu/amd: Miscellaneous clean up when free domain
  - iommu/amd: Consolidate logic to allocate protection domain
  - hardening: Provide Kconfig fragments for basic options
  - iommu/amd: Enable support for up to 2K interrupts per function
  - iommu/amd: Rename DTE_INTTABLEN* and MAX_IRQS_PER_TABLE macro
  - iommu/amd: Lock DTE before updating the entry with WRITE_ONCE()
  - iommu/amd: Introduce helper function get_dte256()
  - iommu/amd: Introduce helper function to update 256-bit DTE
  - iommu/amd: Update PASID, GATS, GLX, SNPAVICSUP feature related macros
  - iommu/amd: Introduce iommu_dev_data.max_pasids
  - iommu/amd: Rename amd_iommu_v2_supported() as amd_iommu_pasid_supported()
  - iommu/amd: Pass struct iommu_dev_data to set_dte_entry()
  - iommu/amd: Remove unused EXPORT_SYMBOLS
  - iommu/amd: Remove amd_iommu_device_info()
  - iommu/amd: Introduce iommu_dev_data.flags to track device capabilities
  - iommu/amd: Introduce iommu_dev_data.ppr
  - iommu/amd: Rename ats related variables
  - iommu/amd: Modify logic for checking GT and PPR features
  - iommu/amd: Replace slab cache allocator with page allocator
  - iommu/vt-d: add wrapper functions for page allocations
  - iommu/amd: Introduce generic function to set multibit feature value
  - iommu/amd: Move PPR-related functions into ppr.c
  - iommu/amd: Remove PPR support
  - iommu/amd: Remove iommu_v2 module
  - iommu/amd: Consolidate feature detection and reporting logic
  - iommu/amd: Introduce helper functions for managing GCR3 table
  - iommu/amd: Consolidate timeout pre-define to amd_iommu_type.h
  - mm/userswap: Fix NULL pointer dereference with unaligned small mremap length
  - ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU.
  - e1000/e1000e: Fix leak in DMA error cleanup
  - arch/x86/mm: reserve memblock for CSV3 guest
  - KVM: arm64: Fix timer_early_inject conflict with CVM
  - ub/obmm: set OBMM_BASIC_GRANU to 2M rather than PMD_SIZE
  - obmm: relax contig_mem_pool restriction for 64KB pages
  - iommu/ummu: Support pplb.
  - ext4: move ext4_percpu_param_init() before ext4_mb_init()
  - io_uring/kbuf: check if target buffer list is still legacy on recycle
  - espintcp: Fix race condition in espintcp_close()
  - io_uring: validate user-controlled cq.head in io_cqe_cache_refill()
  - net: ipv6: fix dst refleaks in rpl, seg6 and ioam6 lwtunnels
  - seg6: separate dst_cache for input and output paths in seg6 lwtunnel
  - net: ipv6: fix dst ref loop on input in rpl lwt
  - net: ipv6: rpl_iptunnel: mitigate 2-realloc issue
  - net: ipv6: fix dst ref loop on input in seg6 lwt
  - net: ipv6: seg6_iptunnel: mitigate 2-realloc issue
  - serial: 8250: Fix TX deadlock when using DMA
  - sched_ext: Sync openeuler_defconfig for sched_ext
  - alloc_fdtable(): change calling conventions.
  - fs: consistently deref the files table with rcu_dereference_raw()
  - iommu/ummu: Introduce struct ummu_device_event
  - iommu/ummu: Use non mirror mem.
  - iommu/ummu: Optimized ubmem register compatibility
  - arm64: entry: Fix missing sync_sei in irq_ventry
  - net/oenetcls: Limit rxqs against combined_channels
  - ptrace: Fix kabi breakage in struct task_struct
  - ptrace: slightly saner 'get_dumpable()' logic
  - iommu/ummu: Support free_bit.
  - iommu/ummu: Optimized stage2 bypass support
  - config: Enable SMT_QOS
  - arm64: Add arch code for SMT QoS
  - sched/fair: Add SMT QoS sched core code
  - sched/fair: Move dynamic affinity helper functions to sched.h
  - sched: Add qos_sched_enabled() helper for future expansion
  - sched: Split out QOS_LEVEL from QOS_SCHED for reuse
  - sched_ext: Update comments replacing breather with aborting mechanism
  - sched_ext: Pass held rq to SCX_CALL_OP() for core_sched_before
  - sched_ext: Pass held rq to SCX_CALL_OP() for dump_cpu/dump_task
  - sched_ext: Guard scx_dsq_move() against NULL kit->dsq after failed iter_new
  - sched_ext: Use WRITE_ONCE() for the write side of scx_enable helper pointer
  - tools/sched_ext: update scx_show_state.py for scx_aborting change
  - scx_central: Defer timer start to central dispatch to fix init error
  - sched_ext: Fix ops.cgroup_move() invocation kf_mask and rq tracking
  - sched_ext: Track @p's rq lock across set_cpus_allowed_scx -> ops.set_cpumask
  - sched_ext: Fix stale direct dispatch state in ddsp_dsq_id
  - sched_ext: Fix SCX_KICK_WAIT deadlock by deferring wait to balance callback
  - selftests/sched_ext: Add missing error check for exit__load()
  - sched_ext: Fix enqueue_task_scx() truncation of upper enqueue flags
  - sched_ext: Fix starvation of scx_enable() under fair-class saturation
  - sched_ext: Disable preemption between scx_claim_exit() and kicking helper work
  - watchdog/softlockup: fix sample ring index wrap in need_counting_irqs()
  - sched_ext: Fix missing post-enqueue handling in move_local_task_to_local_dsq()
  - sched_ext: Factor out local_dsq_post_enq() from dispatch_enqueue()
  - sched_ext: Fix bypass depth leak on scx_enable() failure
  - sched_ext: Fix incorrect sched_class settings for per-cpu migration tasks
  - sched_ext: Exit dispatch and move operations immediately when aborting
  - sched_ext: Simplify breather mechanism with scx_aborting flag
  - sched_ext: Use per-CPU DSQs instead of per-node global DSQs in bypass mode
  - sched_ext: Refactor do_enqueue_task() local and global DSQ paths
  - sched_ext: Fix SCX_KICK_WAIT to work reliably
  - tools/sched_ext: Provide a compatible helper for scx_bpf_events()
  - tools/sched_ext: Sync with scx repo
  - sched_ext: Add scx_bpf_events() and scx_read_event() for BPF schedulers
  - sched_ext: Use SCX_TASK_READY test instead of tryget_task_struct() during class switch
  - sched_ext: Fix unsafe locking in the scx_dump_state()
  - sched_ext: Don't kick CPUs running higher classes
  - sched_ext: Always use SMP versions in kernel/sched/ext.c
  - sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU
  - sched_ext: Drop kfuncs marked for removal in 6.15
  - sched_ext: Validate prev_cpu in scx_bpf_select_cpu_dfl()
  - sched/ext: Prevent update_locked_rq() calls with NULL rq
  - sched_ext: Fix rq lock state in hotplug ops
  - sched_ext: Remove duplicate BTF_ID_FLAGS definitions
  - rhashtable: Fix rhashtable_try_insert test
  - sched_ext: Make scx_kf_allowed_if_unlocked() available outside ext.c
  - sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group()
  - sched_ext: Make scx_group_set_weight() always update tg->scx.weight
  - sched/ext: Fix invalid task state transitions on class switch
  - sched/fair: Fix sched_can_stop_tick() for fair tasks
  - sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator
  - sched_ext: Fix missing rq lock in scx_bpf_cpuperf_set()
  - sched_ext: Make scx_locked_rq() inline
  - sched_ext: Track currently locked rq
  - sched_ext: Move built-in idle CPU selection policy to a separate file
  - sched_ext: Implement SCX_OPS_ALLOW_QUEUED_WAKEUP
  - selftests/sched_ext: Fix exit selftest hang on UP
  - sched_ext: Use kvzalloc for large exit_dump allocation
  - sched_ext: create_dsq: Return -EEXIST on duplicate request
  - rhashtable: Fix potential deadlock by moving schedule_work outside lock
  - tools include UAPI: Sync linux/sched.h copy with the kernel sources
  - sched/doc: Update documentation after renames and synchronize Chinese version
  - sched/fair: Remove stale FREQUENCY_UTIL comment
  - <linux/cleanup.h>: Allow the passing of both iomem and non-iomem pointers to no_free_ptr()
  - file: add take_fd() cleanup helper
  - sched/ext: Remove sched_fork() hack
  - sched_ext: Fix pick_task_scx() picking non-queued tasks when it's called without balance()
  - sched_ext: Use SCX_CALL_OP_TASK in task_tick_scx
  - sched_ext: Fix the incorrect bpf_list kfunc API in common.bpf.h.
  - sched_ext: selftests: Fix grammar in tests description
  - sched_ext: Fix incorrect assumption about migration disabled tasks in task_can_run_on_remote_rq()
  - sched_ext: Fix migration disabled handling in targeted dispatches
  - sched_ext: Implement auto local dispatching of migration disabled tasks
  - sched_ext: Fix incorrect time delta calculation in time_delta()
  - sched_ext: Fix lock imbalance in dispatch_to_local_dsq()
  - sched_ext: selftests/dsp_local_on: Fix selftest on UP systems
  - tools/sched_ext: Add helper to check task migration state
  - sched_ext: Fix incorrect autogroup migration detection
  - sched_ext: selftests/dsp_local_on: Fix sporadic failures
  - selftests/sched_ext: Fix enum resolution
  - sched_ext: Include task weight in the error state dump
  - sched_ext: Fixes typos in comments
  - sched_ext: fix kernel-doc warnings
  - sched_ext: Use time helpers in BPF schedulers
  - sched_ext: Replace bpf_ktime_get_ns() to scx_bpf_now()
  - sched_ext: Add time helpers for BPF schedulers
  - sched_ext: Add scx_bpf_now() for BPF scheduler
  - sched_ext: Implement scx_bpf_now()
  - sched_ext: Relocate scx_enabled() related code
  - sched_ext: Add option -l in selftest runner to list all available tests
  - sched_ext: Include remaining task time slice in error state dump
  - sched_ext: update scx_bpf_dsq_insert() doc for SCX_DSQ_LOCAL_ON
  - sched_ext: idle: small CPU iteration refactoring
  - sched_ext: idle: introduce check_builtin_idle_enabled() helper
  - sched_ext: idle: clarify comments
  - sched_ext: idle: use assign_cpu() to update the idle cpumask
  - cpumask: introduce assign_cpu() macro
  - sched_ext: Use str_enabled_disabled() helper in update_selcpu_topology()
  - sched_ext: Use sizeof_field for key_len in dsq_hash_params
  - tools/sched_ext: Receive updates from SCX repo
  - sched_ext: Use the NUMA scheduling domain for NUMA optimizations
  - sched_ext: keep running prev when prev->scx.slice != 0
  - sched_ext: idle: Refresh idle masks during idle-to-idle transitions
  - sched_ext: switch class when preempted by higher priority scheduler
  - sched_ext: Replace rq_lock() to raw_spin_rq_lock() in scx_ops_bypass()
  - sched_ext: Fix dsq_local_on selftest
  - sched_ext: initialize kit->cursor.flags
  - sched_ext: Fix invalid irq restore in scx_ops_bypass()
  - MAINTAINERS: add me as reviewer for sched_ext
  - MAINTAINERS: add self as reviewer for sched_ext
  - scx: Fix maximal BPF selftest prog
  - sched_ext: fix application of sizeof to pointer
  - selftests/sched_ext: fix build after renames in sched_ext API
  - sched_ext: Add __weak to fix the build errors
  - sched_ext: Replace scx_next_task_picked() with switch_class() in comment
  - sched_ext: Rename scx_bpf_dispatch[_vtime]_from_dsq*() -> scx_bpf_dsq_move[_vtime]*()
  - sched_ext: Rename scx_bpf_consume() to scx_bpf_dsq_move_to_local()
  - sched_ext: Rename scx_bpf_dispatch[_vtime]() to scx_bpf_dsq_insert[_vtime]()
  - sched_ext: scx_bpf_dispatch_from_dsq_set_*() are allowed from unlocked context
  - sched_ext: add a missing rcu_read_lock/unlock pair at scx_select_cpu_dfl()
  - sched_ext: Clarify sched_ext_ops table for userland scheduler
  - sched_ext: Enable the ops breather and eject BPF scheduler on softlockup
  - watchdog/softlockup: Report the most frequent interrupts
  - watchdog/softlockup: Low-overhead detection of interrupt storm
  - genirq: Provide a snapshot mechanism for interrupt statistics
  - genirq: Fix kabi for kstat_irqs in struct irq_desc
  - genirq: Convert kstat_irqs to a struct
  - genirq: Deduplicate interrupt descriptor initialization
  - sched_ext: Avoid live-locking bypass mode switching
  - sched_ext: Fix incorrect use of bitwise AND
  - sched_ext: Do not enable LLC/NUMA optimizations when domains overlap
  - sched_ext: Introduce NUMA awareness to the default idle selection policy
  - sched_ext: Replace set_arg_maybe_null() with __nullable CFI stub tags
  - sched_ext: Rename CFI stubs to names that are recognized by BPF
  - sched_ext: Introduce LLC awareness to the default idle selection policy
  - sched_ext: Clarify ops.select_cpu() for single-CPU tasks
  - sched_ext: improve WAKE_SYNC behavior for default idle CPU selection
  - sched_ext: Use btf_ids to resolve task_struct
  - sched/ext: Use tg_cgroup() to elieminate duplicate code
  - sched/ext: Fix unmatch trailing comment of CONFIG_EXT_GROUP_SCHED
  - sched_ext: Factor out move_task_between_dsqs() from scx_dispatch_from_dsq()
  - sched_ext: ops.cpu_acquire() should be called with SCX_KF_REST
  - sched_ext: Handle cases where pick_task_scx() is called without preceding balance_scx()
  - sched_ext: Update scx_show_state.py to match scx_ops_bypass_depth's new type
  - sched_ext: Add a missing newline at the end of an error message
  - sched_ext: Fix enq_last_no_enq_fails selftest
  - sched_ext: Make cast_mask() inline
  - scx: Fix raciness in scx_ops_bypass()
  - scx: Fix exit selftest to use custom DSQ
  - sched_ext: Fix function pointer type mismatches in BPF selftests
  - selftests/sched_ext: add order-only dependency of runner.o on BPFOBJ
  - sched: Pass correct scheduling policy to __setscheduler_class
  - sched: Add __setscheduler_class() for sched_ext
  - sched_ext: Remove unnecessary cpu_relax()
  - sched_ext: Don't hold scx_tasks_lock for too long
  - sched_ext: Move scx_tasks_lock handling into scx_task_iter helpers
  - sched_ext: bypass mode shouldn't depend on ops.select_cpu()
  - sched_ext: Move scx_buildin_idle_enabled check to scx_bpf_select_cpu_dfl()
  - sched_ext: Start schedulers with consistent p->scx.slice values
  - Revert "sched_ext: Use shorter slice while bypassing"
  - sched_ext: use correct function name in pick_task_scx() warning message
  - selftests: sched_ext: Add sched_ext as proper selftest target
  - sched_ext: Documentation: Update instructions for running example schedulers
  - sched_ext, scx_qmap: Add and use SCX_ENQ_CPU_SELECTED
  - sched/core: Add ENQUEUE_RQ_SELECTED to indicate whether ->select_task_rq() was called
  - sched/core: Make select_task_rq() take the pointer to wake_flags instead of value
  - sched_ext: scx_cgroup_exit() may be called without successful scx_cgroup_init()
  - sched_ext: Improve error reporting during loading
  - sched_ext: Add __weak markers to BPF helper function decalarations
  - sched_ext: Remove redundant p->nr_cpus_allowed checker
  - sched_ext: Decouple locks in scx_ops_enable()
  - sched_ext: Decouple locks in scx_ops_disable_workfn()
  - sched_ext: Add scx_cgroup_enabled to gate cgroup operations and fix scx_tg_online()
  - sched_ext: Enable scx_ops_init_task() separately
  - sched_ext: Fix SCX_TASK_INIT -> SCX_TASK_READY transitions in scx_ops_enable()
  - sched_ext: Initialize in bypass mode
  - sched_ext: Remove SCX_OPS_PREPPING
  - sched_ext: Relocate check_hotplug_seq() call in scx_ops_enable()
  - sched_ext: Use shorter slice while bypassing
  - sched_ext: Split the global DSQ per NUMA node
  - sched_ext: Relocate find_user_dsq()
  - sched_ext: Allow only user DSQs for scx_bpf_consume(), scx_bpf_dsq_nr_queued() and bpf_iter_scx_dsq_new()
  - scx_flatcg: Use a user DSQ for fallback instead of SCX_DSQ_GLOBAL
  - tools/sched_ext: Receive misc updates from SCX repo
  - sched_ext: Add __COMPAT helpers for features added during v6.12 devel cycle
  - sched_ext: Build fix for !CONFIG_SMP
  - sched_ext: Provide a sysfs enable_seq counter
  - sched_ext: Fix build when !CONFIG_STACKTRACE
  - sched_ext: Don't trigger ops.quiescent/runnable() on migrations
  - sched_ext: Synchronize bypass state changes with rq lock
  - scx_qmap: Implement highpri boosting
  - sched_ext: Implement scx_bpf_dispatch[_vtime]_from_dsq()
  - sched_ext: Compact struct bpf_iter_scx_dsq_kern
  - sched_ext: Replace consume_local_task() with move_local_task_to_local_dsq()
  - sched_ext: Move consume_local_task() upward
  - sched_ext: Move sanity check and dsq_mod_nr() into task_unlink_from_dsq()
  - sched_ext: Reorder args for consume_local/remote_task()
  - sched_ext: Restructure dispatch_to_local_dsq()
  - sched_ext: Fix processs_ddsp_deferred_locals() by unifying DTL_INVALID handling
  - sched_ext: Make find_dsq_for_dispatch() handle SCX_DSQ_LOCAL_ON
  - sched_ext: Refactor consume_remote_task()
  - sched_ext: Rename scx_kfunc_set_sleepable to unlocked and relocate
  - sched_ext: Add missing static to scx_dump_data
  - sched_ext: Add missing static to scx_has_op[]
  - sched_ext: Temporarily work around pick_task_scx() being called without balance_scx()
  - sched: Add dummy version of sched_group_set_idle()
  - sched: Fix kabi for int idle in struct task_group
  - sched: Put task_group::idle under CONFIG_GROUP_SCHED_WEIGHT
  - sched_ext: Add a cgroup scheduler which uses flattened hierarchy
  - sched_ext: Fix kabi for scx_flags and scx_weight in struct task_group
  - sched_ext: Add cgroup support
  - sched: Introduce CONFIG_GROUP_SCHED_WEIGHT
  - sched: Make cpu_shares_read_u64() use tg_weight()
  - sched: Expose css_tg()
  - sched_ext: TASK_DEAD tasks must be switched into SCX on ops_enable
  - sched_ext: TASK_DEAD tasks must be switched out of SCX on ops_disable
  - sched_ext: Remove sched_class->switch_class()
  - sched_ext: Remove switch_class_scx()
  - sched_ext: Relocate functions in kernel/sched/ext.c
  - sched_ext: Unify regular and core-sched pick task paths
  - sched_ext: Replace SCX_TASK_BAL_KEEP with SCX_RQ_BAL_KEEP
  - sched_ext: Don't call put_prev_task_scx() before picking the next task
  - sched: Fix kabi for put_prev_task in struct sched_class
  - sched: Add put_prev_task(.next)
  - sched: Combine the last put_prev_task() and the first set_next_task()
  - sched: Fix kabi pick_task in struct sched_class
  - sched: Rework pick_next_task()
  - sched: Split up put_prev_task_balance()
  - sched: Fixup set_next_task() implementations
  - sched/fair: Unify pick_{,next_}_task_fair()
  - sched/fair: Cleanup pick_task_fair()'s curr
  - sched/fair: Cleanup pick_task_fair() vs throttle
  - sched/fair: Remove unused 'curr' argument from pick_next_entity()
  - sched: Use set_next_task(.first) where required
  - sched_ext: Use sched_clock_cpu() instead of rq_clock_task() in touch_core_sched()
  - sched_ext: Use task_can_run_on_remote_rq() test in dispatch_to_local_dsq()
  - sched_ext: Add missing cfi stub for ops.tick
  - scx_central: Fix smatch checker warning
  - sched_ext: Don't use double locking to migrate tasks across CPUs
  - sched_ext: define missing cfi stubs for sched_ext
  - sched_ext: Improve logging around enable/disable
  - sched_ext: Make scx_rq_online() also test cpu_active() in addition to SCX_RQ_ONLINE
  - sched_ext: Fix unsafe list iteration in process_ddsp_deferred_locals()
  - sched_ext: Enable CONFIG_SCHED_CLASS_EXT on ARM64
  - sched_ext: Make task_can_run_on_remote_rq() use common task_allowed_on_cpu()
  - sched_ext: Improve comment on idle_sched_class exception in scx_task_iter_next_locked()
  - sched_ext: Fix kabi for balance in struct sched_class
  - sched_ext: Simplify UP support by enabling sched_class->balance() in UP
  - sched_ext: Use update_curr_common() in update_curr_scx()
  - sched_ext: Add scx_enabled() test to @start_class promotion in put_prev_task_balance()
  - sched_ext: Simplify scx_can_stop_tick() invocation in sched_can_stop_tick()
  - sched_ext: Allow p->scx.disallow only while loading
  - sched_ext: Build fix on !CONFIG_STACKTRACE[_SUPPORT]
  - scx/selftests: Verify we can call create_dsq from prog_run
  - scx: Allow calling sleepable kfuncs from BPF_PROG_TYPE_SYSCALL
  - sched_ext: Fixes incorrect type in bpf_scx_init()
  - sched_ext/scx_qmap: Pick idle CPU for direct dispatch on !wakeup enqueues
  - sched_ext: Allow SCX_DSQ_LOCAL_ON for direct dispatches
  - sched_ext: s/SCX_RQ_BALANCING/SCX_RQ_IN_BALANCE/ and add SCX_RQ_IN_WAKEUP
  - sched_ext: Unpin and repin rq lock from balance_scx()
  - sched: Move struct balance_callback definition upward
  - sched_ext: Make scx_bpf_reenqueue_local() skip tasks that are being migrated
  - sched_ext: Reimplement scx_bpf_reenqueue_local()
  - sched_ext/scx_qmap: Add an example usage of DSQ iterator
  - sched_ext: Implement DSQ iterator
  - sched_ext: Take out ->priq and ->flags from scx_dsq_node
  - sched, sched_ext: Move some declarations from kernel/sched/ext.h to sched.h
  - sched, sched_ext: Open code for_balance_class_range()
  - sched_ext: Minor cleanups in kernel/sched/ext.h
  - sched_ext: Disallow loading BPF scheduler if isolcpus= domain isolation is in effect
  - sched_ext: Account for idle policy when setting p->scx.weight in scx_ops_enable_task()
  - sched, sched_ext: Simplify dl_prio() case handling in sched_fork()
  - sched/ext: Add BPF function to fetch rq
  - sched_ext: Documentation: Remove mentions of scx_bpf_switch_all
  - sched_ext: Swap argument positions in kcalloc() call to avoid compiler warning
  - sched_ext: add CONFIG_DEBUG_INFO_BTF dependency
  - sched_ext: fix typo in set_weight() description
  - sched_ext: Fix spelling mistake: "intead" -> "instead"
  - sched_ext: Drop tools_clean target from the top-level Makefile
  - sched_ext: Make scx_bpf_cpuperf_set() @cpu arg signed
  - sched_ext: Add cpuperf support
  - cpufreq_schedutil: Refactor sugov_cpu_is_busy()
  - sched_ext: Fix kabi for switch_class in struct sched_class
  - sched, sched_ext: Replace scx_next_task_picked() with sched_class->switch_class()
  - sched_ext: Add selftests
  - sched_ext: Documentation: scheduler: Document extensible scheduler class
  - sched_ext: Add vtime-ordered priority queue to dispatch_q's
  - sched_ext: Implement core-sched support
  - sched_ext: Bypass BPF scheduler while PM events are in progress
  - sched_ext: Implement sched_ext_ops.cpu_online/offline()
  - sched_ext: Implement sched_ext_ops.cpu_acquire/release()
  - sched_ext: Implement SCX_KICK_WAIT
  - sched_ext: Track tasks that are subjects of the in-flight SCX operation
  - sched_ext: Implement tickless support
  - sched_ext: Add task state tracking operations
  - sched_ext: Make watchdog handle ops.dispatch() looping stall
  - sched_ext: Add a central scheduler which makes all scheduling decisions on one CPU
  - sched_ext: Implement scx_bpf_kick_cpu() and task preemption support
  - tools/sched_ext: Add scx_show_state.py
  - sched_ext: Print debug dump after an error exit
  - sched_ext: Print sched_ext info when dumping stack
  - sched_ext: Allow BPF schedulers to disallow specific tasks from joining SCHED_EXT
  - sched_ext: Implement runnable task stall watchdog
  - sched_ext: Add sysrq-S which disables the BPF scheduler
  - sched_ext: Add scx_simple and scx_example_qmap example schedulers
  - sched_ext: Allow dequeue_task_scx to fail
  - sched_ext: Fix kabi for scx in struct task_struct
  - sched_ext: Implement BPF extensible scheduler class
  - sched: Fix kabi for dequeue_task in struct sched_class
  - sched: Allow sched_class::dequeue_task() to fail
  - sched/deadline: Move bandwidth accounting into {en,de}queue_dl_entity
  - sched/fair: Fix kabi for check_preempt_curr and wakeup_preempt in struct sched_class
  - sched/fair: Rename check_preempt_curr() to wakeup_preempt()
  - sched/fair: Rename check_preempt_wakeup() to check_preempt_wakeup_fair()
  - sched_ext: Add boilerplate for extensible scheduler class
  - sched: Add normal_policy()
  - sched: Factor out update_other_load_avgs() from __update_blocked_others()
  - sched: Factor out cgroup weight conversion functions
  - sched: Fix kabi for switching_to in struct sched_class
  - sched: Add sched_class->switching_to() and expose check_class_changing/changed()
  - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting
  - sched/syscalls: Fix kabi for EXPORT_SYMBOL moved from core.c to syscalls.c
  - sched/syscalls: Split out kernel/sched/syscalls.c from kernel/sched/core.c
  - sched/cpufreq: Rework schedutil governor performance estimation
  - Reapply "sched: Fix kabi breakage of struct task_struct for saved_state"
  - sched/core: Remove ifdeffery for saved_state
  - sched: Misc cleanups
  - Revert "sched/core: Remove ifdeffery for saved_state"
  - Revert "sched: Fix kabi breakage of struct task_struct for saved_state"
  - sched: Simplify sched_move_task()
  - sched: Simplify sched_rr_get_interval()
  - sched: Simplify yield_to()
  - sched: Simplify sched_{set,get}affinity()
  - sched: Simplify syscalls
  - Revert "sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting"
  - sched: Simplify set_user_nice()
  - cleanup: Make no_free_ptr() __must_check
  - sched: Fix kabi for reweight_task in struct sched_class
  - sched: Add sched_class->reweight_task()
  - sched: Allow sched_cgroup_fork() to fail and introduce sched_cancel_fork()
  - sched: Restructure sched_class order sanity checks in sched_init()
  - Revert "sched: Split out QOS_LEVEL from QOS_SCHED for reuse"
  - Revert "sched: Add qos_sched_enabled() helper for future expansion"
  - Revert "sched/fair: Move dynamic affinity helper functions to sched.h"
  - Revert "sched/fair: Add SMT QoS sched core code"
  - Revert "arm64: Add arch code for SMT QoS"
  - Revert "config: Enable SMT_QOS"
  - ub: cdma: add software TLB invalidation for KSVA memory
  - usb: xhci: Prevent interrupt storm on host controller error (HCE)
  - ub: udma: code optimization
  - config: Enable SMT_QOS
  - arm64: Add arch code for SMT QoS
  - sched/fair: Add SMT QoS sched core code
  - sched/fair: Move dynamic affinity helper functions to sched.h
  - sched: Add qos_sched_enabled() helper for future expansion
  - sched: Split out QOS_LEVEL from QOS_SCHED for reuse
  - ub: udma: resolve legacy issues of shared page tables.
  - ub: udma: support dtu function.
  - ub: udma: support jetty_opt.
  - ub: udma: support ucp & udp.
  - ub: udma: support sharing JFC.
  - ub: udma: supports write with atomic.
  - ub: udma: Supports Safe Mode.
  - Fix kabi breakage in kernfs_node, kernfs_ops and bin_attribute
  - perf/x86/intel/uncore: Add per-scheduler IMC CAS count events
  - x86,fs/resctrl: Update documentation for telemetry events
  - x86/resctrl: Enable RDT_RESOURCE_PERF_PKG
  - fs/resctrl: Move RMID initialization to first mount
  - x86,fs/resctrl: Compute number of RMIDs as minimum across resources
  - fs/resctrl: Move allocation/free of closid_num_dirty_rmid[]
  - x86/resctrl: Handle number of RMIDs supported by RDT_RESOURCE_PERF_PKG
  - x86/resctrl: Add energy/perf choices to rdt boot option
  - x86,fs/resctrl: Handle domain creation/deletion for RDT_RESOURCE_PERF_PKG
  - fs/resctrl: Refactor rmdir_mondata_subdir_allrdtgrp()
  - fs/resctrl: Refactor mkdir_mondata_subdir()
  - x86/resctrl: Read telemetry events
  - x86/resctrl: Find and enable usable telemetry events
  - x86,fs/resctrl: Add architectural event pointer
  - x86,fs/resctrl: Fill in details of events for performance and energy GUIDs
  - x86/resctrl: Discover hardware telemetry events
  - fs/resctrl: Emphasize that L3 monitoring resource is required for summing domains
  - x86,fs/resctrl: Add and initialize a resource for package scope monitoring
  - x86,fs/resctrl: Add an architectural hook called for first mount
  - x86,fs/resctrl: Support binary fixed point event counters
  - x86,fs/resctrl: Handle events that can be read from any CPU
  - fs/resctrl: Make event details accessible to functions when reading events
  - x86,fs/resctrl: Rename some L3 specific functions
  - x86,fs/resctrl: Rename struct rdt_mon_domain and rdt_hw_mon_domain
  - x86,fs/resctrl: Use struct rdt_domain_hdr when reading counters
  - fs/resctrl: Split L3 dependent parts out of __mon_event_count()
  - x86,fs/resctrl: Refactor domain create/remove using struct rdt_domain_hdr
  - x86/resctrl: Clean up domain_remove_cpu_ctrl()
  - x86/resctrl: Refactor domain_remove_cpu_mon() ready for new domain types
  - x86/resctrl: Move L3 initialization into new helper function
  - x86,fs/resctrl: Improve domain type checking
  - fs/resctrl: Consider sparse masks when initializing new group's allocation
  - x86,fs/resctrl: Fix NULL pointer dereference with events force-disabled in mbm_event mode
  - x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID
  - fs/resctrl: Fix counter auto-assignment on mkdir with mbm_event enabled
  - MAINTAINERS: resctrl: Add myself as reviewer
  - x86/resctrl: Configure mbm_event mode if supported
  - fs/resctrl: Introduce the interface to switch between monitor modes
  - fs/resctrl: Disable BMEC event configuration when mbm_event mode is enabled
  - fs/resctrl: Introduce the interface to modify assignments in a group
  - fs/resctrl: Introduce mbm_L3_assignments to list assignments in a group
  - fs/resctrl: Auto assign counters on mkdir and clean up on group removal
  - fs/resctrl: Introduce mbm_assign_on_mkdir to enable assignments on mkdir
  - fs/resctrl: Provide interface to update the event configurations
  - fs/resctrl: Add event configuration directory under info/L3_MON/
  - fs/resctrl: Support counter read/reset with mbm_event assignment mode
  - x86/resctrl: Implement resctrl_arch_reset_cntr() and resctrl_arch_cntr_read()
  - x86/resctrl: Refactor resctrl_arch_rmid_read()
  - fs/resctrl: Introduce counter ID read, reset calls in mbm_event mode
  - fs/resctrl: Pass struct rdtgroup instead of individual members
  - fs/resctrl: Add the functionality to unassign MBM events
  - fs/resctrl: Add the functionality to assign MBM events
  - x86,fs/resctrl: Implement resctrl_arch_config_cntr() to assign a counter with ABMC
  - fs/resctrl: Introduce event configuration field in struct mon_evt
  - x86/resctrl: Add data structures and definitions for ABMC assignment
  - fs/resctrl: Introduce interface to display number of free MBM counters
  - fs/resctrl: Introduce mbm_cntr_cfg to track assignable counters per domain
  - fs/resctrl: Add resctrl file to display number of assignable counters
  - fs/resctrl: Introduce the interface to display monitoring modes
  - x86/resctrl: Add support to enable/disable AMD ABMC feature
  - x86,fs/resctrl: Detect Assignable Bandwidth Monitoring feature details
  - x86,fs/resctrl: Consolidate monitoring related data from rdt_resource
  - x86/resctrl: Add ABMC feature in the command line options
  - x86/cpufeatures: Add support for Assignable Bandwidth Monitoring Counters (ABMC)
  - x86,fs/resctrl: Prepare for more monitor events
  - x86/resctrl: Remove the rdt_mon_features global variable
  - x86,fs/resctrl: Replace architecture event enabled checks
  - x86,fs/resctrl: Consolidate monitor event descriptions
  - x86/resctrl: Support Sub-NUMA Cluster (SNC) mode on Clearwater Forest
  - fs/resctrl: Optimize code in rdt_get_tree()
  - fs/resctrl: Eliminate false positive lockdep warning when reading SNC counters
  - resctrl: get rid of pointless debugfs_file_{get,put}()
  - x86,fs/resctrl: Remove inappropriate references to cacheinfo in the resctrl subsystem
  - fs/resctrl: Restore the rdt_last_cmd_clear() calls after acquiring rdtgroup_mutex
  - MAINTAINERS: Add reviewers for fs/resctrl
  - x86,fs/resctrl: Move the resctrl filesystem code to live in /fs/resctrl
  - x86/resctrl: Fix rdtgroup_mkdir()'s unlocked use of kernfs_node::name
  - x86/resctrl: Always initialise rid field in rdt_resources_all[]
  - x86/resctrl: Relax some asm #includes
  - x86/resctrl: Prefer alloc(sizeof(*foo)) idiom in rdt_init_fs_context()
  - x86/resctrl: Squelch whitespace anomalies in resctrl core code
  - x86/resctrl: Move pseudo lock prototypes to include/linux/resctrl.h
  - x86/resctrl: Fix types in resctrl_arch_mon_ctx_{alloc,free}() stubs
  - x86/resctrl: Move enum resctrl_event_id to resctrl.h
  - x86/resctrl: Move the filesystem bits to headers visible to fs/resctrl
  - fs/resctrl: Add boiler plate for external resctrl code
  - x86/resctrl: Add 'resctrl' to the title of the resctrl documentation
  - x86/resctrl: Split trace.h
  - x86/resctrl: Expand the width of domid by replacing mon_data_bits
  - x86/resctrl: Add end-marker to the resctrl_event_id enum
  - x86/resctrl: Move is_mba_sc() out of core.c
  - x86/resctrl: Drop __init/__exit on assorted symbols
  - x86/resctrl: Resctrl_exit() teardown resctrl but leave the mount point
  - x86/resctrl: Check all domains are offline in resctrl_exit()
  - x86/resctrl: Rename resctrl_sched_in() to begin with "resctrl_arch_"
  - x86/resctrl: Remove the limit on the number of CLOSID
  - x86/resctrl: Optimize cpumask_any_housekeeping()
  - kernfs: Move dput() outside of the RCU section.
  - kernfs: Drop kernfs_rwsem while invoking lookup_positive_unlocked().
  - kernfs: annotate different lockdep class for of->mutex of writable files
  - kernfs: Use RCU to access kernfs_node::name.
  - kernfs: Use RCU to access kernfs_node::parent.
  - kernfs: Convert kernfs_path_from_node_locked() from strlcpy() to strscpy()
  - kernfs: Acquire kernfs_rwsem in kernfs_node_dentry().
  - kernfs: Acquire kernfs_rwsem in kernfs_get_parent_dentry().
  - kernfs: Acquire kernfs_rwsem in kernfs_notify_workfn().
  - kernfs: mount: Remove unnecessary ‘NULL’ values from knparent
  - kernfs: Convert kernfs_name_locked() from strlcpy() to strscpy()
  - kernfs: Convert kernfs_walk_ns() from strlcpy() to strscpy()
  - kernfs: sysfs: support custom llseek method for sysfs entries
  - ptrace: Convert ptrace_attach() to use lock guards
  - cpumask: Add cpumask_{first,next}_andnot() API
  - find: Add find_first_andnot_bit()
  - cpumask: Relax cpumask_any_but()
  - cpumask: Switch from inline to __always_inline
  - cpumask: Introduce cpumask_first_and_and()
  - cpumask: add cpumask_weight_andnot()
  - cpumask: add cpumask_any_and_but()
  - cpumask: kernel-doc cleanups and additions
  - x86/resctrl: Move get_{mon,ctrl}_domain_from_cpu() to live with their callers
  - x86/resctrl: Move get_config_index() to a header
  - x86/resctrl: Handle throttle_mode for SMBA resources
  - x86/resctrl: Move RFTYPE flags to be managed by resctrl
  - x86/resctrl: Make resctrl_arch_pseudo_lock_fn() take a plr
  - x86/resctrl: Make prefetch_disable_bits belong to the arch code
  - x86/resctrl: Allow an architecture to disable pseudo lock
  - x86/resctrl: Add resctrl_arch_ prefix to pseudo lock functions
  - x86/resctrl: Move mbm_cfg_mask to struct rdt_resource
  - x86/resctrl: Move mba_mbps_default_event init to filesystem code
  - x86/resctrl: Change mon_event_config_{read,write}() to be arch helpers
  - x86/resctrl: Add resctrl_arch_is_evt_configurable() to abstract BMEC
  - x86/resctrl: Move the is_mbm_*_enabled() helpers to asm/resctrl.h
  - x86/resctrl: Rewrite and move the for_each_*_rdt_resource() walkers
  - x86/resctrl: Move monitor init work to a resctrl init call
  - x86/resctrl: Move monitor exit work to a resctrl exit call
  - x86/resctrl: Add an arch helper to reset one resource
  - x86/resctrl: Move resctrl types to a separate header
  - x86/resctrl: Move rdt_find_domain() to be visible to arch and fs code
  - x86/resctrl: Expose resctrl fs's init function to the rest of the kernel
  - x86/resctrl: Remove rdtgroup from update_cpu_closid_rmid()
  - x86/resctrl: Add helper for setting CPU default properties
  - x86/resctrl: Generate default_ctrl instead of sharing it
  - x86/resctrl: Add max_bw to struct resctrl_membw
  - x86/resctrl: Remove data_width and the tabular format
  - x86/resctrl: Use schema type to determine the schema format string
  - x86/resctrl: Use schema type to determine how to parse schema values
  - x86/resctrl: Remove fflags from struct rdt_resource
  - x86/resctrl: Add a helper to avoid reaching into the arch code resource list
  - x86/resctrl: Fix allocation of cleanest CLOSID on platforms with no monitors
  - x86/resctrl: Document the new "mba_MBps_event" file
  - x86/resctrl: Add write option to "mba_MBps_event" file
  - x86/resctrl: Add "mba_MBps_event" file to CTRL_MON directories
  - x86/resctrl: Make mba_sc use total bandwidth if local is not supported
  - x86/resctrl: Compute memory bandwidth for all supported events
  - x86/resctrl: Modify update_mba_bw() to use per CTRL_MON group event
  - x86/resctrl: Prepare for per-CTRL_MON group mba_MBps control
  - x86/resctrl: Introduce resctrl_file_fflags_init() to initialize fflags
  - x86/resctrl: Use kthread_run_on_cpu()
  - x86/resctrl: Support Sub-NUMA cluster mode SNC6
  - x86/resctrl: Slightly clean-up mbm_config_show()
  - x86/resctrl: Annotate get_mem_config() functions as __init
  - x86/resctrl: Avoid overflow in MB settings in bw_validate()
  - x86/resctrl: Fix arch_mbm_* array overrun on SNC
  - x86/resctrl: Update documentation with Sub-NUMA cluster changes
  - x86/resctrl: Detect Sub-NUMA Cluster (SNC) mode
  - x86/resctrl: Enable shared RMID mode on Sub-NUMA Cluster (SNC) systems
  - x86/resctrl: Make __mon_event_count() handle sum domains
  - x86/resctrl: Fill out rmid_read structure for smp_call*() to read a counter
  - x86/resctrl: Handle removing directories in Sub-NUMA Cluster (SNC) mode
  - x86/resctrl: Create Sub-NUMA Cluster (SNC) monitor files
  - x86/resctrl: Allocate a new field in union mon_data_bits
  - x86/resctrl: Refactor mkdir_mondata_subdir() with a helper function
  - x86/resctrl: Initialize on-stack struct rmid_read instances
  - x86/resctrl: Add a new field to struct rmid_read for summation of domains
  - x86/resctrl: Prepare for new Sub-NUMA Cluster (SNC) monitor files
  - x86/resctrl: Block use of mba_MBps mount option on Sub-NUMA Cluster (SNC) systems
  - x86/resctrl: Introduce snc_nodes_per_l3_cache
  - x86/resctrl: Add node-scope to the options for feature scope
  - x86/resctrl: Split the rdt_domain and rdt_hw_domain structures
  - x86/resctrl: Prepare for different scope for control/monitor operations
  - x86/resctrl: Prepare to split rdt_domain structure
  - x86/resctrl: Prepare for new domain scope
  - x86/resctrl: Replace open coded cacheinfo searches
  - cacheinfo: Add function to get cacheinfo for a given CPU and cache level
  - cpu: Drop "extern" from function declarations in cpuhplock.h
  - cpu: Move CPU hotplug function declarations into their own header
  - x86/resctrl: Don't try to free nonexistent RMIDs
  - x86/resctrl: Add tracepoint for llc_occupancy tracking
  - x86/resctrl: Rename pseudo_lock_event.h to trace.h
  - x86/resctrl: Simplify call convention for MSR update functions
  - x86/resctrl: Pass domain to target CPU
  - x86/resctrl: Switch to new Intel CPU model defines
  - x86/resctrl: Fix uninitialized memory read when last CPU of domain goes offline
  - Documentation/x86: Fix title underline length
  - Documentation/x86: Document that resctrl bandwidth control units are MiB
  - x86/resctrl: Remove lockdep annotation that triggers false positive
  - x86/resctrl: Separate arch and fs resctrl locks
  - x86/resctrl: Move domain helper migration into resctrl_offline_cpu()
  - x86/resctrl: Add CPU offline callback for resctrl work
  - x86/resctrl: Allow overflow/limbo handlers to be scheduled on any-but CPU
  - x86/resctrl: Add CPU online callback for resctrl work
  - x86/resctrl: Add helpers for system wide mon/alloc capable
  - x86/resctrl: Make rdt_enable_key the arch's decision to switch
  - x86/resctrl: Move alloc/mon static keys into helpers
  - x86/resctrl: Make resctrl_mounted checks explicit
  - x86/resctrl: Allow arch to allocate memory needed in resctrl_arch_rmid_read()
  - x86/resctrl: Allow resctrl_arch_rmid_read() to sleep
  - x86/resctrl: Queue mon_event_read() instead of sending an IPI
  - x86/resctrl: Add cpumask_any_housekeeping() for limbo/overflow
  - x86/resctrl: Move CLOSID/RMID matching and setting to use helpers
  - x86/resctrl: Allocate the cleanest CLOSID by searching closid_num_dirty_rmid
  - x86/resctrl: Use __set_bit()/__clear_bit() instead of open coding
  - x86/resctrl: Track the number of dirty RMID a CLOSID has
  - x86/resctrl: Allow RMID allocation to be scoped by CLOSID
  - x86/resctrl: Access per-rmid structures by index
  - x86/resctrl: Track the closid with the rmid
  - x86/resctrl: Move RMID allocation out of mkdir_rdt_prepare()
  - x86/resctrl: Create helper for RMID allocation and mondata dir creation
  - x86/resctrl: Free rmid_ptrs from resctrl_exit()
  - x86/resctrl: Remove redundant variable in mbm_config_write_domain()
  - x86/resctrl: Implement new mba_MBps throttling heuristic
  - x86/resctrl: Read supported bandwidth sources from CPUID
  - x86/resctrl: Remove hard-coded memory bandwidth limit
  - x86/resctrl: Fix unused variable warning in cache_alloc_hsw_probe()
  - x86: Decouple resctrl with resctrl-mpam
  - ub: ub_fwctl: add querying the peak bandwidth.
  - ub: ubase&unic&cdma&udma: Supporting the restart optimization of the management and control process
  - dm: clear cloned request bio pointer when last clone bio completes
  - ub:ubus: Bugfix control software restart features
  - bpf-rvi: Fix possible AA deadlock pidns_list_lock
  - ub: ubase: Provide interface for obtaining ub feature
  - pinctrl/zhaoxin: Refactor KH50000 pinctrl to support multi‑socket
  - ub: ubase&unic: ubase & unic use non mirror mem
  - ub: ubase: Supports real-time traffic control functions such as enabling, querying, and disabling only
  - ub: ubase: The ubase supports the configuration of QoS priority mapping using the hccn_tool
  - cifs: some missing initializations on replay
  - arm64: uaccess: add CONFIG control for copy_from_user_opt
  - arm64: uaccess: add optimized copy_from_user for Hisilicon platforms
  - arm64: cputype: Add CPU type for HISI_CPU_PART_HIP11
  - LoongArch: KVM: fix vm start fail
  - ub: ubase: reinitialize cmdq in uninit flow to resolve UE deregistration failure after ELR reset failure
  - ub: ubase: Resolve the issue of insufficient ctrlq sequences
  - ub: ubase: Modify the log rate limiting interface, add frequency-limited logs, and add maintenance logs
  - ub: ubase: Locking is performed on the seq_tbl processing in the proxy response
  - net: unic: Fixed the problem of being unable to replenish rqe to the chip in time
  - ub: ubase: Solve the mailbox processing times out in abnormal scenarios
  - net: unic: Fixed the issue of memory overwriting in unic traffic flow
  - ub: ubase&unic: encoding alarm rectification
  - ub: ubase: Fix the issue where the mailbox buffer is not released after a cmdq submission failure
  - net: unic: Supports querying of the Ethernet port's NL-layer register
  - ub: ubase: Fix the problem of frequent log printing
  - ub: ubase: Adjustment of conditions for creating ubase proxy auxiliary devices
  - ub: ubase: Delete residual DTU window of the UDMA during reset
  - ub: ubase: Add DTU capability bit printing
  - net: unic: The unsupported VL rate limit value is displayed as 0
  - net: unic: Notify MAMI when the LACP status changes
  - net: unic: adapt to the change for ETS tsa and bw configuration permission
  - Revert "net: Remove conditional threaded-NAPI wakeup based on task state."
  - Revert "net: Allow to use SMP threads for backlog NAPI."
  -  Linkdata: fix build failure due to missing IPsec configs in defconfig
  - ub:ubus: Add control software restart features
  - ub: ub_fwctl: supports the configuration and query of packet statistics on the UBOE interface based on the NL-layer VL.
  - ub: ub_fwctl: query port link status add construct first link data
  - vsock driver add translate cid and gpa interface
  - Revert "!21796 [OLK-6.6] x86/mce/zhaoxin: Enable mcelog to decode PCIE, ZDI/ZPI, and DRAM errors"
  - arm64: openeuler_defconfig: enable CONFIG_ARM64_SYNC_SEI by default
  - ACPI/APEI/arm64: add vendor SEI handling for firmware-first RAS
  - arm64: Add runtime switch to control ESB for SEI synchronization
  - arm64/entry: Add support to synchronize SEI at the exception boundary
  - nbd: remove queue freeze in nbd_add_socket
  - nbd: remove redundant num_connections boundary checks
  - nbd: replace socks pointer array with xarray
  - nbd: simplify find_fallback() by removing redundant logic
  - Documentation: ext4: Convert includes into toctrees
  - Documentation: ext4: atomic_writes: Demote last three sections
  - block: Don't allow an atomic write be truncated in blkdev_write_iter()
  - nvme: stop using AWUPF
  - ext4: Simplify last in leaf check in ext4_map_query_blocks
  - ext4: Unwritten to written conversion requires EXT4_EX_NOCACHE
  - block: Fix blk_validate_atomic_write_limits() build for arm32
  - block: fix kabi broken in enum req_flag_bits
  - iomap: Lift blocksize restriction on atomic writes
  - ext4: Add atomic block write documentation
  - ext4: Enable support for ext4 multi-fsblock atomic write using bigalloc
  - ext4: Add multi-fsblock atomic write support with bigalloc
  - ext4: Add support for EXT4_GET_BLOCKS_QUERY_LEAF_BLOCKS
  - ext4: Make ext4_meta_trans_blocks() non-static for later use
  - ext4: Check if inode uses extents in ext4_inode_can_atomic_write()
  - ext4: Document an edge case for overwrites
  - ext4: Do not fallback to buffered-io for DIO atomic write
  - ext4: Support setting FMODE_CAN_ATOMIC_WRITE
  - ext4: Check for atomic writes support in write iter
  - ext4: Add statx support for atomic writes
  - fs: fix kabi broken in struct kstat
  - fs: Add initial atomic write support info to statx
  - fs: iomap: Atomic write support
  - fs: Export generic_atomic_write_valid()
  - nvme: Atomic write support
  - block: Add bdev atomic write limits helpers
  - fs/block: Check for IOCB_DIRECT in generic_atomic_write_valid()
  - block/fs: Pass an iocb to generic_atomic_write_valid()
  - block: Add fops atomic write support
  - block: Call blkdev_dio_unaligned() from blkdev_direct_IO()
  - block: fix kabi broken in struct queue_limits
  - block: Add core atomic write support
  - fs: Initial atomic write support
  - block: Generalize chunk_sectors support as boundary support
  - block: Pass blk_queue_get_max_sectors() a request pointer
  - iommu/ummu-core: support TID sharing within same mm
  - smb: client: prevent races in ->query_interfaces()
  - ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()
  - bpf, x86: Fix missing BTF_SET8_KFUNCS flag for arch kfuncs
  - riscv: Sanitize syscall table indexing under speculation
  - ub:ubus: support getting supported features data
  - efi/cper: Print correctable AER information
  - driver/core: Fix kabi broken of platform_device/bus_type/device
  - driver core: generalize driver_override in struct device
  - pinctrl: zhaoxin: kx7000: Fix logic error in GPIO type mapping
  - iommu/vt-d: fix NULL pointer issue in acpi_rmrr_andd_probe
  - btrfs: reject new transactions if the fs is fully read-only
  - drm/amdgpu: ensure no_hw_access is visible before MMIO
  - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset
  - cifs: Fix locking usage for tcon fields
  - dmaengine: idxd: Fix leaking event log memory
  - ixgbevf: add missing negotiate_features op to Hyper-V ops table
  - HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure
  - module: Fix kernel panic when a symbol st_shndx is out of bounds
  - EFI/CPER: don't dump the entire memory region
  - net: hns3: add dcbnl_setbuffer and dcbnl_getbuffer support for pf
  - Ethernet: Linkdata: Supports Linkdata ethernet Controllers
  - ub: ubase: Added proxy functions to ubase
  - ub: ubase: support DTU feature
  - ub: ubase: add USC and UCP
  - ub: ubase: Add Ubase S Device ID
  - Revert "efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs"
  - atm: lec: fix use-after-free in sock_def_readable()
  - kvm: arm64: Add HIP13 cpu type definition for detecting virtualization features
  - usb: cdns3: gadget: fix state inconsistency on gadget init failure
  - pstore: ram_core: fix incorrect success return when vmap() fails
  - netfilter: nf_conntrack_expect: use expect->helper
  - netfilter: nf_conntrack_expect: honor expectation helper field
  - netfilter: nf_conntrack_helper: pass helper to expect cleanup
  - rnp: update rnp driver to version 1.1.14.
  - Revert "KVM: arm64: Add a module param to enable/disable pv_preempted dynamically"
  - mm/numa_remote: remove depends on ARM64_4K_PAGES
  - mm/pfn_range_alloc: add support for CONFIG_ARM64_64K_PAGES
  - openvswitch: validate MPLS set/set_masked payload length
  - xfrm_user: fix info leak in build_report()
  - KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock
  - xen/privcmd: fix double free via VMA splitting
  - dmaengine: idxd: Fix crash when the event log is disabled
  - dmaengine: idxd: Delete unnecessary NULL check
  - spi: spi-dw-dma: fix print error log when wait finish transaction
  - wifi: mac80211: Fix static_branch_dec() underflow for aql_disable.
  - rnpvf: update rnpvf driver to version 1.1.10.
  - bnxt_en: Update firmware interface to 1.10.2.171
  - KVM: x86: Add support for CPUID leaf 0x8C860000
  - x86/delay: add support for Zhaoxin PAUSEOPT instruction
  - cpufreq: conservative: Reset requested_freq on limits change
  - netfilter: xt_multiport: validate range encoding in checkentry
  - qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size
  - btrfs: fix double free in create_space_info_sub_group() error path
  - btrfs: fix double free in create_space_info() error path
  - interconnect: debugfs: fix devm_kstrdup and kfree mismatch
  - Revert "ALSA: usb: Increase volume range that triggers a warning"
  - x86/kfence: fix booting on 32bit non-PAE systems
  - can: gs_usb: gs_usb_receive_bulk_callback(): fix error message
  - drm/amd: Fix hang on amdgpu unload by using pci_dev_is_disconnected()
  - btrfs: fix leak of kobject name for sub-group space_info
  - net: phy: fix phy_uses_state_machine()
  - fs/ntfs3: Initialize allocated memory before use
  - nvme: fix PCIe subsystem reset controller state transition
  - nvme-pci: do not directly handle subsys reset fallout
  - nvme-fc: rename free_ctrl callback to match name pattern
  - ASoC: codecs: wsa883x: fix unnecessary initialisation
  - ASoC: codecs: wsa881x: fix unnecessary initialisation
  - ASoC: codecs: wsa881x: Drop unused version readout
  - phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe()
  - phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path
  - mm: kmsan: fix poisoning of high-order non-compound pages
  - dmaengine: stm32: dmamux: fix OF node leak on route allocation failure
  - iio: adc: exynos_adc: fix OF populate on driver rebind
  - ALSA: scarlett2: Fix buffer overflow in config retrieval
  - arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s
  - iio: core: add separate lockdep class for info_exist_lock
  - iio: core: add missing mutex_destroy in iio_dev_release()
  - mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure
  - mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure
  - can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak
  - selftests/bpf: Check for timeout in perf_link test
  - can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak
  - can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak
  - can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak
  - can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak
  - perf/x86/intel: Do not enable BTS for guests
  - pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu
  - platform/x86: hp-bioscfg: Fix automatic module loading
  - netrom: fix double-free in nr_route_frame()
  - slimbus: core: fix device reference leak on report present
  - slimbus: core: fix runtime PM imbalance on report present
  - octeontx2: Fix otx2_dma_map_page() error return code
  - arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA
  - wifi: rsi: Fix memory corruption due to not set vif driver data size
  - wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize()
  - wifi: ath12k: fix dma_free_coherent() pointer
  - mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode
  - mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function
  - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()
  - ALSA: ctxfi: Fix potential OOB access in audio mixer handling
  - iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl
  - iio: chemical: scd4x: fix reported channel endianness
  - iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver
  - iio: adc: ad9467: fix ad9434 vref mask
  - iio: accel: iis328dq: fix gain values
  - of: platform: Use default match table for /firmware
  - of: fix reference count leak in of_alias_scan()
  - x86: make page fault handling disable interrupts properly
  - vsock/test: fix seqpacket message bounds test
  - net: openvswitch: fix data race in ovs_vport_get_upcall_stats
  - octeontx2-af: Fix error handling
  - net: dsa: fix off-by-one in maximum bridge ID determination
  - selftests: net: amt: wait longer for connection before sending packets
  - drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2)
  - drm/amd/pm: Don't clear SI SMC table when setting power limit
  - usbnet: limit max_mtu based on device's hard_mtu
  - mISDN: annotate data-race around dev->work
  - be2net: fix data race in be_get_new_eqd
  - net: hns3: fix data race in hns3_fetch_stats
  - ALSA: usb: Increase volume range that triggers a warning
  - riscv: clocksource: Fix stimecmp update hazard on RV32
  - kconfig: fix static linking of nconf
  - spi: spi-sprd-adi: Fix double free in probe error path
  - spi: sprd-adi: switch to use spi_alloc_host()
  - spi: sprd: adi: Use devm_register_restart_handler()
  - interconnect: debugfs: initialize src_node and dst_node to empty strings
  - iio: adc: ad7280a: handle spi_setup() errors in probe()
  - iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection
  - platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro
  - platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names
  - comedi: Fix getting range information for subdevices 16 to 255
  - x86/kfence: avoid writing L1TF-vulnerable PTEs
  - arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro
  - arm64: dts: rockchip: remove dangerous max-link-speed from helios64
  - scsi: xen: scsiback: Fix potential memory leak in scsiback_remove()
  - scsi: storvsc: Process unsupported MODE_SENSE_10
  - Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA
  - Input: i8042 - add quirks for MECHREVO Wujie 15X Pro
  - Revert "nfc/nci: Add the inconsistency check between the input data length and count"
  - w1: fix redundant counter decrement in w1_attach_slave_device()
  - w1: therm: Fix off-by-one buffer overflow in alarms_store
  - comedi: dmm32at: serialize use of paged registers
  - serial: 8250_pci: Fix broken RS485 for F81504/508/512
  - octeontx2: cn10k: fix RX flowid TCAM mask handling
  - veth: fix data race in veth_get_ethtool_stats
  - fou: Don't allow 0 for FOU_ATTR_IPPROTO.
  - tools: ynl: Specify --no-line-number in ynl-regen.sh.
  - gue: Fix skb memleak with inner IP protocol 0.
  - amd-xgbe: avoid misleading per-packet error log
  - can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error
  - selftests: net: fib-onlink-tests: Convert to use namespaces by default
  - selftests/net: convert fib-onlink-tests.sh to run it in unique namespace
  - net: usb: dm9601: remove broken SR9700 support
  - igc: fix race condition in TX timestamp read for register 0
  - ice: Avoid detrimental cleanup for bond during interface stop
  - ice: initialize ring_stats->syncp
  - ata: libata: Print features also for ATAPI devices
  - ata: libata: Call ata_dev_config_lpm() for ATAPI devices
  - ata: libata-core: Introduce ata_dev_config_lpm()
  - ata: libata: Add cpr_log to ata_dev_print_features() early return
  - pmdomain: qcom: rpmhpd: Add MXC to SC8280XP
  - dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO
  - dt-bindings: power: qcom-rpmpd: split RPMh domains definitions
  - dt-bindings: power: qcom,rpmpd: add Turbo L5 corner
  - dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains
  - dt-bindings: power: rpmpd: Update part number to X1E80100
  - dt-bindings: power: qcom,rpmpd: document the SM8650 RPMh Power Domains
  - dt-bindings: power: rpmpd: Add MSM8917, MSM8937 and QM215
  - dt-bindings: power: qcom,rpmpd: Add SM7150
  - btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE
  - Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump()
  - hyperv-tlfs: Change prefix of generic HV_REGISTER_* MSRs to HV_MSR_*
  - arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links
  - io_uring: move local task_work in exit cancel loop
  - btrfs: fix deadlock in wait_current_trans() due to ignored transaction type
  - dmaengine: ti: k3-udma: fix device leak on udma lookup
  - dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation
  - dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation
  - dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all()
  - dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config()
  - dmaengine: lpc18xx-dmamux: fix device leak on route allocation
  - dmaengine: idxd: fix device leaks on compat bind and unbind
  - dmaengine: dw: dmamux: fix OF node leak on route allocation failure
  - dmaengine: bcm-sba-raid: fix device leak on probe
  - dmaengine: at_hdmac: fix device leak on of_dma_xlate()
  - dmaengine: apple-admac: Add "apple,t8103-admac" compatible
  - drm/vmwgfx: Fix an error return check in vmw_compat_shader_add()
  - drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel
  - drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare
  - drm/amdkfd: fix a memory leak in device_queue_manager_init()
  - drm/amd: Clean up kfd node on surprise disconnect
  - drm/amd/display: Bump the HDMI clock to 340MHz
  - LoongArch: Fix PMU counter allocation for mixed-type event groups
  - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure
  - bpf: Fix the use of prog->axu->sleepable
  - mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free
  - EDAC/i3200: Fix a resource leak in i3200_probe1()
  - EDAC/x38: Fix a resource leak in x38_probe1()
  - hrtimer: Fix softirq base check in update_needs_ipi()
  - nvme-pci: disable secondary temp for Wodposit WPBSNM8
  - USB: serial: ftdi_sio: add support for PICAXE AXE027 cable
  - USB: serial: option: add Telit LE910 MBIM composition
  - USB: OHCI/UHCI: Add soft dependencies on ehci_platform
  - usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor
  - usb: dwc3: Check for USB4 IP_NAME
  - phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7
  - phy: rockchip: inno-usb2: fix disconnection in gadget mode
  - phy: freescale: imx8m-pcie: assert phy reset during power on
  - phy: rockchip: inno-usb2: fix communication disruption in gadget mode
  - x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers
  - net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts
  - can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit.
  - can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak
  - ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer
  - HID: usbhid: paper over wrong bNumDescriptor field
  - i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA
  - dmaengine: omap-dma: fix dma_pool resource leak in error paths
  - phy: stm32-usphyc: Fix off by one in probe()
  - phy: qcom-qusb2: Fix NULL pointer dereference on early suspend
  - phy: drop probe registration printks
  - phy: phy-snps-eusb2: refactor constructs names
  - phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it
  - dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing
  - dmaengine: tegra-adma: Fix use-after-free
  - mm, kfence: describe @slab parameter in __kfence_obj_info()
  - textsearch: describe @list member in ts_ops search
  - ASoC: tlv320adcx140: fix word length
  - ASoC: tlv320adcx140: fix null pointer
  - selftests: drv-net: fix RPS mask handling for high CPU numbers
  - btrfs: fix memory leaks in create_space_info() error paths
  - btrfs: introduce btrfs_space_info sub-group
  - btrfs: factor out check_removing_space_info() from btrfs_free_block_groups()
  - btrfs: factor out init_space_info() from create_space_info()
  - btrfs: store fs_info in space_info
  - net/mlx5e: Restore destroying state bit after profile cleanup
  - vsock/test: add a final full barrier after run all tests
  - net: update netdev_lock_{type,name}
  - net: bridge: annotate data-races around fdb->{updated,used}
  - net: bridge: Set BR_FDB_ADDED_BY_USER early in fdb_add_entry
  - btrfs: send: check for inline extents in range_is_hole_in_parent()
  - can: etas_es58x: allow partial RX URB allocation to succeed
  - ASoC: codecs: wsa884x: fix codec initialisation
  - firmware: imx: scu-irq: Set mu_resource_id before get handle
  - xfrm: clear trailing padding in build_polexpire()
  - numa: add critical_err sysfs interface for remote node recovery
  - mm: mark node as critical_err on remote RAS error
  - nvmet: move async event work off nvmet-wq
  - smb: client: fix OOB reads parsing symlink error response
  - smb: client: fix off-by-8 bounds check in check_wsl_eas()
  - Loongarch: Fixed warning about legacy_boot.h when build kernel
  - gpio: rockchip: Stop calling pinctrl for set_direction
  - bpf: Load vmlinux btf for any struct_ops map
  - gpio: rockchip: mark the GPIO controller as sleeping
  - KVM: arm64: fix build without VIRT_VTIMER_PV_STATUS
  - KVM: arm64: Add a module param to enable/disable pv_preempted dynamically
  - net: hns3: set the freed pointer to NULL
  - net: hns3: add support to query/set pfc_prevention_tout for ethtool
  - net: hns3: debugfs support for dumping fd rules
  - net: hns3: support tc flow for vf
  - net: hns3: support FLOW_DISSECTOR_KEY_IP and FLOW_DISSECTOR_KEY_ENC_KEYID for tc flow
  - net: hns3: support two more actions for tc flow
  - net: hns3: Improved the unused_tuple parameter setting.
  - net: hns3: adjust add_cls_flower() for support more action
  - net: hns3: Clear the static alarm about 'no previous prototype'
  - net: hns3: Clear the static alarm about discarding the 'const' qualifier
  - kvm: arm64: set default early time for HIP12
  - openeuler_defconfig: Enable CONFIG_VIRT_TIMER_EARLY_INJECT by default
  - KVM: arm64: Add KVM_CAP_ARM_TIMER_EARLY_INJECT capability
  - clocksource/drivers/arm_arch_timer: Use PV timer early inject interface
  - arm64: paravirt: Implement timer early inject PV guest support
  - kvm: arm64: Implement timer early inject PV hypcall handling
  - kvm: arm64: Add VIRT_TIMER_EARLY_INJECT configuration and SMCCC definitions
  - openeuler_defconfig: Enable CONFIG_VIRT_VTIMER_PV_STATUS by default
  - KVM: arm64: Add KVM_CAP_ARM_HISI_PVTIMER_STATUS capability
  - KVM: arm64: Implement vtimer active status MMIO handling
  - KVM: arm64: vgic: Add is_uaccess parameter for active state handling
  - irqchip/gic-v3: Report vtimer active status to hypervisor
  - arm64: paravirt: Add pvtimer status support for guest
  - KVM: arm64: Provide VCPU attributes for pvtimer status
  - KVM: arm64: Add vCPU pvtimer_status structure and initialization
  - nvme-pci: ensure we're polling a polled queue
  - ext4: avoid infinite loops caused by residual data
  - ksmbd: fix OOB write in QUERY_INFO for compound requests
  - scsi: hisi_sas: Fix the risk of overflow in bitwise logical operations
  - EDAC/amd64: Adjust the maximum number of memory controllers per node to 1 for Hygon family 18h model 18h
  - drivers/ub/sentry: fix input length validation in proc_oom_rate_limit_write
  - scsi: hisi_sas: Correct printing format issues
  - EDAC/amd64: Add support for Hygon family 18h model 18h
  - EDAC/amd64: Convert Hygon family 18h model checks to switch-case
  - mfs: handle file system umount event
  - mfs: notify user-space programs when it is being unmounted
  - ptt: Adapt the PTT tune event name in the document match to the actual names in the code.
  - x86/fpu: fix wrong thread_flag check in switch_kernel_fpu_prepare
  - x86/copy_user_avx2: add sfence before vzeroupper in fixup path
  - Euler: configs: enable AMD NODE and HSMP drivers in x86 defconfig
  - x86/mce/amd: Filter bogus hardware errors on Zen3 clients
  - x86/mce/amd: Check SMCA feature bit before accessing SMCA MSRs
  - x86/mce: Handle AMD threshold interrupt storms
  - x86/mce: Do not clear bank's poll bit in mce_poll_banks on AMD SMCA systems
  - x86/mce: Add support for physical address valid bit
  - x86/mce: Save and use APEI corrected threshold limit
  - x86/mce/amd: Define threshold restart function for banks
  - x86/mce/amd: Remove redundant reset_block()
  - x86/mce/amd: Support SMCA Corrected Error Interrupt
  - x86/mce/amd: Enable interrupt vectors once per-CPU on SMCA systems
  - x86/mce: Unify AMD DFR handler with MCA Polling
  - x86/mce: Unify AMD THR handler with MCA Polling
  - x86/mce: Add a clear_bank() helper
  - x86/msr: Rename 'mce_wrmsrl()' to 'mce_wrmsrq()'
  - x86/msr: Rename 'mce_rdmsrl()' to 'mce_rdmsrq()'
  - x86/MCE/AMD: Add support for new MCA_SYND{1,2} registers
  - tracing: Add __print_dynamic_array() helper
  - x86/mce: Move machine_check_poll() status checks to helper functions
  - x86/mce: Separate global and per-CPU quirks
  - x86/mce: Convert family/model mixed checks to VFM-based checks
  - x86/cpu/intel: Replace PAT erratum model/family magic numbers with symbolic IFM references
  - x86/mce: Cleanup bank processing on init
  - x86/mce: Do 'UNKNOWN' vendor check early
  - x86/mce: Break up __mcheck_cpu_apply_quirks()
  - x86/mce: Make four functions return bool
  - x86/mce: Make several functions return bool
  - x86/mce: Add wrapper for struct mce to export vendor specific info
  - x86/mce: Use mce_prep_record() helpers for apei_smca_report_x86_error()
  - x86/mce: Define mce_prep_record() helpers for common and per-CPU fields
  - x86/mce: Rename mce_setup() to mce_prep_record()
  - x86/mce: Remove unused variable and return value in machine_check_poll()
  - x86/mce: Switch to new Intel CPU model defines
  - x86/mce: Dynamically size space for machine check records
  - x86/mce: Remove redundant check from mce_device_create()
  - x86/mce: Cleanup mce_usable_address()
  - x86/mce: Define amd_mce_usable_address()
  - x86/MCE/AMD: Split amd_mce_is_memory_error()
  - x86/cpu: Clear SVM feature if disabled by BIOS
  - x86/mce: Define BSP-only SMCA init
  - x86/mce: Define BSP-only init
  - x86/mce: Set CR4.MCE last during init
  - x86/mce: Remove __mcheck_cpu_init_early()
  - x86/mce/amd: Put list_head in threshold_bank
  - x86/mce/amd: Remove shared threshold bank plumbing
  - x86/mce/amd: Remove smca_banks_map
  - x86/mce/amd: Remove return value for mce_threshold_{create,remove}_device()
  - x86/mce/amd: Rename threshold restart function
  - x86/mce: Ensure user polling settings are honored when restarting timer
  - x86/mce: Add per-bank CMCI storm mitigation
  - x86/mce: Remove old CMCI storm mitigation code
  - tools headers x86 cpufeatures: Sync with the kernel sources to pick ZEN6 and Indirect Target Selection (ITS) bits
  - hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models
  - EDAC/amd64: Add support for AMD family 1Ah-based newer models
  - x86/CPU/AMD: Add X86_FEATURE_ZEN6
  - x86/cpufeatures: Free up unused feature bits
  - pwm: dwc: Add support for Hygon pwm controller
  - hwtracing: hisi_ptt: Add an error handling when pcim_iomap_table fails to obtain the device's I/O map table.
  - hwtracing: hisi_ptt: Add an error handler when the PTT device returns an incorrect size.
  - hwtracing: hisi_ptt: Corrcet some spelling mistakes in hisi_ptt driver
  - ext4: fix error message when rejecting the default hash
  - ext4: filesystems without casefold feature cannot be mounted with siphash
  - net: Allow to use SMP threads for backlog NAPI.
  - net: Remove conditional threaded-NAPI wakeup based on task state.
  - mm/numa_remote: set default distance between remote nodes to 255
  - jfs: add dmapctl integrity check to prevent invalid operations
  - rnpm: update rnpm driver to version 1.0.0.
  - xSched/dmem: introduce xsched_dmem_cleanup()
  - xSched/dmem: introduce xsched_dmem_free()
  - xSched/dmem: introduce xsched_dmem_alloc()
  - xSched/dmem: add support for XPU devices to register/unregister dmem regions
  - bpf, docs: Fix broken link to renamed bpf_iter_task_vmas.c
  - selftests/bpf: Add file_read_pattern to gitignore
  - selftests/bpf: Add distilled BTF test about marking BTF_IS_EMBEDDED
  - libbpf: Fix incorrect traversal end type ID when marking BTF_IS_EMBEDDED
  - libbpf: Fix return zero when elf_begin failed
  - selftests/bpf: Fix btf leak on new btf alloc failure in btf_distill test
  - bpf: Reject struct_ops registration that uses module ptr and the module btf_id is missing
  - selftests/bpf: Use -4095 as the bad address for bits iterator
  - selftests/bpf: Add three test cases for bits_iter
  - bpf: Use __u64 to save the bits in bits iterator
  - bpf: Check the validity of nr_words in bpf_iter_bits_new()
  - bpf: Add bpf_mem_alloc_check_size() helper
  - bpf: Free dynamically allocated bits in bpf_iter_bits_destroy()
  - selftests/bpf: Check if distilled base inherits source endianness
  - libbpf: Ensure new BTF objects inherit input endianness
  - bpf: Fix a crash when btf_parse_base() returns an error pointer
  - selftests/bpf: test passing iterator to a kfunc
  - bpf: allow passing struct bpf_iter_<type> as kfunc arguments
  - bpf: extract iterator argument type and name validation logic
  - libbpf: Fix license for btf_relocate.c
  - riscv, bpf: Fix out-of-bounds issue when preparing trampoline image
  - libbpf: Fix error handling in btf__distill_base()
  - bpf: fix build when CONFIG_DEBUG_INFO_BTF[_MODULES] is undefined
  - selftests/bpf: Add kfunc_call test for simple dtor in bpf_testmod
  - kbuild,bpf: Add module-specific pahole flags for distilled base BTF
  - libbpf,bpf: Share BTF relocate-related code with kernel
  - libbpf: Split field iter code into its own file kernel
  - bpf: Fix kabi breakage in struct module
  - module, bpf: Store BTF base pointer in struct module
  - libbpf: BTF relocation followup fixing naming, loop logic
  - resolve_btfids: Handle presence of .BTF.base section
  - libbpf: Make btf_parse_elf process .BTF.base transparently
  - selftests/bpf: Extend distilled BTF tests to cover BTF relocation
  - libbpf: Split BTF relocation
  - selftests/bpf: Test distilled base, split BTF generation
  - libbpf: Add btf__distill_base() creating split BTF with distilled base BTF
  - libbpf: Remove callback-based type/string BTF field visitor helpers
  - bpftool: Use BTF field iterator in btfgen
  - libbpf: Make use of BTF field iterator in BTF handling code
  - libbpf: Make use of BTF field iterator in BPF linker code
  - libbpf: Add BTF field iterator
  - selftests/bpf: modify test_loader that didn't support running bpf_prog_type_syscall programs
  - selftests/bpf: Add selftest for bits iter
  - bpf: Add bits iterator
  - kbuild, bpf: Use test-ge check for v1.25-only pahole
  - kbuild,bpf: Switch to using --btf_features for pahole v1.26 and later
  - bitops: make BYTES_TO_BITS() treewide-available
  - bpf: Check return from set_memory_rox()
  - bpf: Remove arch_unprotect_bpf_trampoline()
  - bpf: Remove unnecessary err < 0 check in bpf_struct_ops_map_update_elem
  - bpf: Fix kabi for bpf_prog_aux and bpf_prog
  - bpf: move sleepable flag from bpf_prog_aux to bpf_prog
  - selftests/bpf: Test struct_ops maps with a large number of struct_ops program.
  - bpf: struct_ops supports more than one page for trampolines.
  - bpf, net: validate struct_ops when updating value.
  - selftests/bpf: Test if shadow types work correctly.
  - bpftool: Add an example for struct_ops map and shadow type.
  - bpftool: Generated shadow variables for struct_ops maps.
  - libbpf: Convert st_ops->data to shadow type.
  - libbpf: Set btf_value_type_id of struct bpf_map for struct_ops.
  - bpf: introduce in_sleepable() helper
  - selftests/bpf: Test PTR_MAYBE_NULL arguments of struct_ops operators.
  - bpf: Create argument information for nullable arguments.
  - bpf: Move __kfunc_param_match_suffix() to btf.c.
  - bpf: Fix kabi for bpf_ctx_arg_aux
  - bpf: add btf pointer to struct bpf_ctx_arg_aux.
  - bpf, btf: Check btf for register_bpf_struct_ops
  - selftests/bpf: Add tests for RCU lock transfer between subprogs
  - bpf: Transfer RCU lock state between subprog calls
  - selftests/bpf: Add test for static subprog call in lock cs
  - bpf: Allow calling static subprogs while holding a bpf_spin_lock
  - selftests/bpf: Suppress warning message of an unused variable.
  - bpf: Remove an unnecessary check.
  - libbpf: Add btf__new_split() API that was declared but not implemented
  - bpf: treewide: Annotate BPF kfuncs in BTF
  - bpf: btf: Add BTF_KFUNCS_START/END macro pair
  - bpf: btf: Support flags for BTF_SET8 sets
  - bpf: Fix error checks against bpf_get_btf_vmlinux().
  - libbpf: Ensure undefined bpf_attr field stays 0
  - selftests/bpf: test case for register_bpf_struct_ops().
  - bpf: export btf_ctx_access to modules.
  - libbpf: Find correct module BTFs for struct_ops maps and progs.
  - bpf, net: switch to dynamic registration
  - bpf: validate value_type
  - bpf_verifier: Fix kabi for bpf_verifier_env
  - bpf: hold module refcnt in bpf_struct_ops map creation and prog verification.
  - bpf: Fix kabi for bpf_attr
  - bpf: pass attached BTF to the bpf_struct_ops subsystem
  - bpf: lookup struct_ops types from a given module BTF.
  - bpf: pass btf object id in bpf_map_info.
  - bpf: make struct_ops_map support btfs other than btf_vmlinux.
  - bpf: add struct_ops_tab to btf.
  - bpf, net: introduce bpf_struct_ops_desc.
  - bpf: get type information with BTF_ID_LIST
  - bpf: refactory struct_ops type initialization to a function.
  - riscv, bpf: Fix unpredictable kernel crash about RV64 struct_ops
  - bpf: Introduce "volatile compare" macros
  - s390/bpf: Fix indirect trampoline generation
  - bpf: Fix dtor CFI
  - cfi: Add CFI_NOSEAL()
  - x86/cfi,bpf: Fix bpf_struct_ops CFI
  - x86/cfi,bpf: Fix bpf_callback_t CFI
  - x86/cfi,bpf: Fix BPF JIT call
  - cfi: Flip headers
  - x86, bpf: Use bpf_prog_pack for bpf trampoline
  - bpf: Fix kabi-breakage for bpf_tramp_image
  - bpf: Use arch_bpf_trampoline_size
  - bpf: Add arch_bpf_trampoline_size()
  - bpf, x86: Adjust arch_prepare_bpf_trampoline return value
  - bpf: Add helpers for trampoline image management
  - bpf: Adjust argument names of arch_prepare_bpf_trampoline()
  - bpf: Let bpf_prog_pack_free handle any pointer
  - selftests/bpf: Add lazy global subprog validation tests
  - bpf: Fix kabi-breakage for bpf_func_info_aux
  - bpf: Validate global subprogs lazily
  - bpf: Emit global subprog name in verifier logs
  - selftests/bpf: get trusted cgrp from bpf_iter__cgroup directly
  - bpf: Let verifier consider {task,cgroup} is trusted in bpf_iter_reg
  - selftests/bpf: Add test for using css_task iter in sleepable progs
  - selftests/bpf: Add tests for css_task iter combining with cgroup iter
  - bpf: Relax allowlist for css_task iter
  - bpf: Add __bpf_hook_{start,end} macros
  - bpf: Add __bpf_kfunc_{start,end}_defs macros
  - bpf: fix compilation error without CGROUPS
  - kbuild: avoid too many execution of scripts/pahole-flags.sh
  - selftests/bpf: Add tests for open-coded task and css iter
  - selftests/bpf: rename bpf_iter_task.c to bpf_iter_tasks.c
  - bpf: Let bpf_iter_task_new accept null task ptr
  - bpf: teach the verifier to enforce css_iter and task_iter in RCU CS
  - bpf: Introduce css open-coded iterator kfuncs
  - bpf: Introduce task open coded iterator kfuncs
  - bpf: Introduce css_task open-coded iterator kfuncs
  - cgroup: Prepare for using css_task_iter_*() in BPF
  - selftests/bpf: Add tests for open-coded task_vma iter
  - bpf: Introduce task_vma open-coded iterator kfuncs
  - selftests/bpf: Rename bpf_iter_task_vma.c to bpf_iter_task_vmas.c
  - bpf: Don't explicitly emit BTF for struct btf_iter_num
  - selftests/bpf: Test pinning bpf timer to a core
  - bpf: Add ability to pin bpf timer to calling CPU
  - bpf: Charge modmem for struct_ops trampoline
  - mfs: remove anon_file item from struct mfs_cache_object
  - sw64: fix compile error with missing header file
  - sw64: update openeuler_defconfig and remove junzhang_defconfig
  - cpufreq: Add CPU frequency policy change notification support
  - apei/ghes: Add Zhaoxin platform support for ghes_edac
  - Revert "hwmon: (ibmpex) fix use-after-free in high/low store"
  - hwmon: (ibmpex) fix use-after-free in high/low store
  - x86/cpu: detect extended topology for Zhaoxin CPUs
  - arm64/cpufeature: Fix unused enable_pseudo_nmi variable warning
  - ALSA: HDA: Add Centaur HDMI Controller and Codec support
  - x86/mce/zhaoxin: Enable mcelog to decode PCIE, ZDI/ZPI, and DRAM errors
  - efi/cper: Add Zhaoxin mem error decode for KH-50000
  - efi/cper: Add Zhaoxin cache error decode
  - efi/cper: Add Zhaoxin micro-architectural error decode
  - efi/cper: Add Zhaoxin non standard cper error decode
  - efi/cper: Add Zhaoxin ZDI ZPI error decode for KH-50000
  - efi: cper: Update Zhaoxin/Centaur ZDI/ZPI error decode
  - hwmon: zhaoxin-cputemp: Update for KX-8000
  - zhaoxin: Update hardware random number generator driver
  - ALSA: hda: Add support for Zhaoxin SB HDAC controller
  - efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs
  - x86/microcode/intel: Enable staging when available
  - x86/microcode/intel: Support mailbox transfer
  - x86/microcode/intel: Implement staging handler
  - x86/microcode/intel: Define staging state struct
  - x86/microcode/intel: Establish staging control logic
  - x86/microcode: Introduce staging step to reduce late-loading time
  - x86/cpu/topology: Make primary thread mask available with SMP=n
  - platform/x86/amd: Fix memory leak in wbrf_record()
  - platform/x86/amd/hsmp: Make amd_hsmp and hsmp_acpi as mutually exclusive drivers
  - platform/x86/amd/hsmp: mark hsmp_msg_desc_table[] as maybe_unused
  - platform/x86/amd/hsmp: Ensure sock->metric_tbl_addr is non-NULL
  - x86/amd_node: Fix AMD root device caching
  - x86/amd_node: Add support for debugfs access to SMN registers
  - x86/amd_node: Add SMN offsets to exclusive region access
  - x86/amd_node, platform/x86/amd/hsmp: Have HSMP use SMN through AMD_NODE
  - platform/x86/amd/hsmp: Make hsmp_pdev static instead of global
  - platform/x86/amd/hsmp: Use dev_groups in the driver structure
  - platform/x86/amd/hsmp: Use name space while exporting module symbols
  - platform/x86/amd/hsmp: Create separate ACPI, plat and common drivers
  - platform/x86/amd/hsmp: Change generic plat_dev name to hsmp_pdev
  - platform/x86/amd/hsmp: Move ACPI code to acpi.c
  - platform/x86/amd/hsmp: Move platform device specific code to plat.c
  - platform/x86/amd/hsmp: Move structure and macros to header file
  - platform/x86/amd/hsmp: Convert amd_hsmp_rdwr() to a function pointer
  - platform/x86/amd/hsmp: Create wrapper function init_acpi()
  - platform/x86/amd/hsmp: Create hsmp/ directory
  - platform/x86/amd/hsmp: Check HSMP support on AMD family of processors
  - platform/x86/amd/hsmp: switch to use device_add_groups()
  - platform/x86/amd/hsmp: Change devm_kzalloc() to devm_kcalloc()
  - platform/x86/amd/hsmp: Remove extra parenthesis and add a space
  - platform/x86/amd/hsmp: Check num_sockets against MAX_AMD_SOCKETS
  - platform/x86/amd/hsmp: Non-ACPI support for AMD F1A_M00~0Fh
  - platform/x86/amd/hsmp: Add support for ACPI based probing
  - platform/x86/amd/hsmp: Restructure sysfs group creation
  - platform/x86/amd/hsmp: Move dev from platdev to hsmp_socket
  - platform/x86/amd/hsmp: Define a struct to hold mailbox regs
  - platform/x86/amd/hsmp: Create static func to handle platdev
  - platform/x86/amd/hsmp: Cache pci_dev in struct hsmp_socket
  - platform/x86/amd/hsmp: Move hsmp_test to probe
  - platform/x86/amd: Add support for AMD ACPI based Wifi band RFI mitigation feature
  - platform/x86/amd/hsmp: Fix iomem handling
  - platform/x86/amd/hsmp: improve the error log
  - platform/x86/amd/hsmp: add support for metrics tbl
  - platform/x86/amd/hsmp: create plat specific struct
  - x86/amd_node: Use defines for SMN register offsets
  - x86/amd_node: Remove dependency on AMD_NB
  - x86/amd_node: Update __amd_smn_rw() error paths
  - x86/amd_nb: Move SMN access code to a new amd_node driver
  - x86/amd_nb, hwmon: (k10temp): Simplify amd_pci_dev_to_node_id()
  - x86/amd_nb: Enhance SMN access error checking
  - EDAC/amd64: Check return value of amd_smn_read()
  - EDAC/amd64: Remove unused register accesses
  - x86/amd_nb: Simplify function 3 search
  - x86/amd_nb: Use topology info to get AMD node count
  - x86/amd_nb: Simplify root device search
  - x86/amd_nb: Simplify function 4 search
  - x86/amd_nb: Add new PCI ID for AMD family 1Ah model 20h
  - x86/amd_nb: Add new PCI IDs for AMD family 1Ah model 60h-70h
  - x86/amd_nb: Add AMD Family MI300 PCI IDs
  - x86: Start moving AMD node functionality out of AMD_NB
  - crypto: ccp - Add support for PCI device 0x17D8
  - KVM: arm64: Add SMCCC interface for pvtimer status
  - KVM: arm64: Export vtimer_is_irqbypass for external use
  - crypto: ccp: fix build issue like redefined RI_XXX_PRESENT
  - crypto: ccp: SM2 ccp encryption support Hygon model 10h
  - crypto: ccp: check if ccp supports sm4-xts/sm4-gcm
  - x86/fpu: Rename fpu_reset_fpregs() to fpu_reset_fpstate_regs()
  - x86/fpu: Remove export of mxcsr_feature_mask
  - x86/pkeys: Simplify PKRU update in signal frame
  - x86/fpu: Refactor xfeature bitmask update code for sigframe XSAVE
  - x86/fpu: Log XSAVE disablement consistently
  - selftests/x86/apx: Add APX test
  - x86/fpu/apx: Enable APX state support
  - x86/fpu/apx: Disallow conflicting MPX presence
  - x86/fpu/apx: Define APX state component
  - tools headers x86 cpufeatures: Sync with the kernel sources
  - x86/cpufeatures: Add X86_FEATURE_APX
  - x86/fpu/xstate: Adjust xstate copying logic for user ABI
  - x86/fpu/xstate: Adjust XSAVE buffer size calculation
  - x86/fpu/xstate: Introduce xfeature order table and accessor macro
  - x86/fpu/xstate: Remove xstate offset check
  - x86/fpu/xstate: Simplify print_xstate_features()
  - selftests/x86/avx: Add AVX tests
  - selftests/x86/xstate: Clarify supported xstates
  - selftests/x86/xstate: Consolidate test invocations into a single entry
  - selftests/x86/xstate: Introduce signal ABI test
  - selftests/x86/xstate: Refactor ptrace ABI test
  - selftests/x86/xstate: Refactor context switching test
  - selftests/x86/xstate: Enumerate and name xstate components
  - selftests/x86/xstate: Refactor XSAVE helpers for general use
  - selftests/x86: Consolidate redundant signal helper functions
  - x86/pkeys: Ensure updated PKRU value is XRSTOR'd
  - x86/pkeys: Change caller of update_pkru_in_sigframe()
  - x86/pkeys: Update PKRU to enable all pkeys before XSAVE
  - x86/pkeys: Add helper functions to update PKRU on the sigframe
  - selftests/x86: fix Makefile dependencies to work with clang
  - selftests/x86: remove (or use) unused variables and functions
  - sched/fair: guard WA_SMT with CONFIG_SCHED_SMT in wake_wide()
  - LoongArch: KVM: Add hypercall service support for usermode VMM
  - dmem: enable CONFIG_CGROUP_DMEM in arm64/x86 defconfig
  - cgroup/dmem: reuse SUBSYS for dmem and devices to preserve KABI
  - cgroup/dmem: avoid pool UAF
  - cgroup/dmem: avoid rcu warning when unregister region
  - cgroup/dmem: fix NULL pointer dereference when setting max
  - cgroup/dmem: Don't open-code css_for_each_descendant_pre
  - cgroup/rdma: Drop bogus PAGE_COUNTER select
  - doc/cgroup: Fix title underline length
  - cgroup/dmem: Fix parameters documentation
  - kernel/cgroup: Remove the unused variable climit
  - cgroup/dmem: Select PAGE_COUNTER
  - kernel/cgroup: Add "dmem" memory accounting cgroup
  - mm: page_counters: put page_counter_calculate_protection() under CONFIG_MEMCG
  - mm/page_counter: move calculating protection values to page_counter
  - serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN
  - KVM: arm64: vgic: Remove redundant vtimer irq bypass workaround
  - tools headers x86 cpufeatures: Sync with the kernel sources
  - Documentation: KVM: KVM_GET_SUPPORTED_CPUID now exposes TSC_DEADLINE
  - KVM: x86: Advertise support for AMD's PREFETCHI
  - KVM: x86: Use only local variables (no bitmask) to init kvm_cpu_caps
  - KVM: x86: Explicitly track feature flags that are enabled at runtime
  - KVM: x86: Explicitly track feature flags that require vendor enabling
  - KVM: x86: Rename "SF" macro to "SCATTERED_F"
  - KVM: x86: Pull CPUID capabilities from boot_cpu_data only as needed
  - KVM: x86: Add a macro for features that are synthesized into boot_cpu_data
  - KVM: x86: Advertise HYPERVISOR in KVM_GET_SUPPORTED_CPUID
  - KVM: x86: Advertise TSC_DEADLINE_TIMER in KVM_GET_SUPPORTED_CPUID
  - KVM: x86: Add a macro to init CPUID features that KVM emulates in software
  - KVM: x86: Add a macro to init CPUID features that ignore host kernel support
  - KVM: x86: Harden CPU capabilities processing against out-of-scope features
  - KVM: x86: #undef SPEC_CTRL_SSBD in cpuid.c to avoid macro collisions
  - KVM: x86: Handle kernel- and KVM-defined CPUID words in a single helper
  - KVM: x86: Add a macro to precisely handle aliased 0x1.EDX CPUID features
  - KVM: x86: Add a macro to init CPUID features that are 64-bit only
  - KVM: x86: Unpack F() CPUID feature flag macros to one flag per line of code
  - KVM: x86: Account for max supported CPUID leaf when getting raw host CPUID
  - KVM: x86: Limit use of F() and SF() to kvm_cpu_cap_{mask,init_kvm_defined}()
  - KVM: x86: Use feature_bit() to clear CONSTANT_TSC when emulating CPUID
  - KVM: x86: Advertise AMD_IBPB_RET to userspace
  - KVM: SVM: Invert handling of SEV and SEV_ES feature flags
  - x86: KVM: Add feature flag for CPUID.80000021H:EAX[bit 1]
  - KVM: x86: Add SBPB support
  - KVM: x86: Add IBPB_BRTYPE support
  - perf/x86/uncore: Add DF PMU support for Hygon family 18h model 18h
  - hwmon/k10temp: Add support for Hygon family 18h model 18h
  - mmc: sdhci-pci: Add support for Hygon SD controller
  - x86/amd_nb: Add Hygon family 18h model 18h PCI IDs
  - sw64: fix compile error with missing arch-specific header file
  - sw64: enable CONFIG_DRM_FBDEV_EMULATION=y as default
  - smb/server: update some misguided comment of smb2_0_server_cmds proc
  - smb/server: fix return value of smb2_oplock_break()
  - smb/server: fix return value of smb2_ioctl()
  - smb/server: fix return value of smb2_query_dir()
  - smb/server: fix return value of smb2_notify()
  - smb/server: fix return value of smb2_read()
  - drivers/ub/sentry: add oom rate limit
  - ip6_tunnel: adapt to skb_vlan_inet_prepare() return value change
  - net: tunnel: make skb_vlan_inet_prepare() return drop reasons
  - nvme-fc: release admin tagset if init fails
  - mmc: sdhci-acpi: Add device HID for Hygon eMMC controller
  - spi: dw: Add device HID for Hygon SPI controller
  - ACPI/IORT: Add PMCG platform information for 162001900
  - arm-smmu-v3: add HIP09A, HIP09B, HIP10C, HIP10CA for 162100602 errata
  - regmap: maple: free entry on mas_store_gfp() failure
  - net: usb: pegasus: validate USB endpoints
  - tools headers: Update the x86 headers with the kernel sources
  - iommu/hygon: Add support for Hygon family 18h model 18h IOAPIC
  - net/ipv4:scmtcp: fix unable to release scmtcp sock when sendmsg itself
  - xfrm: Fix inner mode lookup in tunnel mode GSO segmentation
  - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo
  - pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe()
  - mptcp: fix a race in mptcp_pm_del_add_timer()
  - HID: amd_sfh: Stop sensor before starting
  - pmdomain: imx: Fix reference count leak in imx_gpc_remove
  - pmdomain: imx-gpc: Convert to platform remove callback returning void
  - wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac()
  - uio_hv_generic: Set event for all channels on the device
  - tracing/tools: Fix incorrcet short option in usage text for --threads
  - ALSA: usb-audio: fix uac2 clock source at terminal parser
  - s390/mm: Fix __ptep_rdp() inline assembly
  - kconfig/nconf: Initialize the default locale at startup
  - kconfig/mconf: Initialize the default locale at startup
  - net: tls: Cancel RX async resync request on rcd_delta overflow
  - selftests: net: use BASH for bareudp testing
  - x86/microcode/AMD: Limit Entrysign signature checking to known generations
  - scsi: core: Fix a regression triggered by scsi_host_busy()
  - cifs: fix typo in enable_gcm_256 module parameter
  - bcma: don't register devices disabled in OF
  - LoongArch: Use UAPI types in ptrace UAPI header
  - pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc()
  - pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc
  - platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos
  - s390/ctcm: Fix double-kfree
  - net: mlxsw: linecards: fix missing error check in mlxsw_linecard_devlink_info_get()
  - net: dsa: hellcreek: fix missing error handling in LED registration
  - drm/tegra: Add call to put_pid()
  - mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats()
  - pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe()
  - xfrm: Prevent locally generated packets from direct output in tunnel mode
  - xfrm: Determine inner GSO type from packet inner protocol
  - drm/amd/display: Move sleep into each retry for retrieve_link_cap()
  - drm/amd/display: Increase DPCD read retries
  - drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled
  - drm/tegra: dc: Fix reference leak in tegra_dc_couple()
  - mptcp: do not fallback when OoO is present
  - mptcp: avoid unneeded subflow-level drops
  - mptcp: fix premature close in case of fallback
  - mptcp: fix ack generation for fallback msk
  - mptcp: fix race condition in mptcp_schedule_work()
  - LoongArch: Don't panic if no valid cache info for PCI
  - dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups
  - MIPS: Malta: Fix !EVA SOC-it PCI MMIO
  - Input: pegasus-notetaker - fix potential out-of-bounds access
  - Input: imx_sc_key - fix memory corruption on unload
  - Input: goodix - add support for ACPI ID GDIX1003
  - Input: cros_ec_keyb - fix an invalid memory access
  - net: dsa: microchip: lan937x: Fix RGMII delay tuning
  - smb: client: introduce close_cached_dir_locked()
  - mptcp: Disallow MPTCP subflows from sockmap
  - exfat: check return value of sb_min_blocksize in exfat_read_boot_sector
  - shmem: fix tmpfs reconfiguration (remount) when noswap is set
  - mtd: rawnand: cadence: fix DMA device NULL pointer dereference
  - ALSA: hda: Add support for Hygon family 18h model 18h HD-Audio
  - crypto: ccp: Support SM4-GCM for hygon ccp
  - crypto: ccp: Support SM4-XTS for hygon ccp
  - tools headers: Update the KVM headers with the kernel sources
  - KVM: SVM: Add Idle HLT intercept support
  - x86/cpufeatures: Add CPUID feature bit for Idle HLT intercept
  - perf vendor events amd: Update Zen 5 data cache fill events
  - perf vendor events amd: Add Zen 5 data fabric metrics
  - perf vendor events amd: Add Zen 5 data fabric events
  - KVM: x86/mmu: x86: Don't overflow lpage_info when checking attributes
  - perf/amd/ibs: Prevent leaking sensitive data to userspace
  - perf/x86: Check data address for IBS software filter
  - perf/x86: Relax privilege filter restriction on AMD IBS
  - perf/core: Export perf_exclude_event()
  - KVM: x86: Disallow hugepages when memory attributes are mixed
  - KVM: Drop superfluous __KVM_VCPU_MULTIPLE_ADDRESS_SPACE macro
  - fs: Rename anon_inode_getfile_secure() and anon_inode_getfd_secure()
  - x86/bugs: Add RSB mitigation document
  - x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier()
  - x86/bugs: Rename entry_ibpb() to write_ibpb()
  - perf amd ibs: Sync arch/x86/include/asm/amd-ibs.h header with the kernel
  - perf/amd/ibs: Update DTLB/PageSize decode logic
  - perf/amd/ibs: Add support for OP Load Latency Filtering
  - perf/amd/ibs: Ceil sample_period to min_period
  - perf/amd/ibs: Add ->check_period() callback
  - perf/amd/ibs: Add PMU specific minimum period
  - perf/amd/ibs: Don't allow freq mode event creation through ->config interface
  - perf/amd/ibs: Remove pointless sample period check
  - perf/amd/ibs: Remove IBS_{FETCH|OP}_CONFIG_MASK macros
  - amd-pstate: Switch to amd-pstate by default on some Server platforms
  - cpufreq: amd-pstate: enable shared memory type CPPC by default
  - cpufreq: amd-pstate: switch boot_cpu_has() to cpu_feature_enabled()
  - cpufreq: amd-pstate: Add quirk for the pstate CPPC capabilities missing
  - cpufreq: amd-pstate: Unify computation of {max,min,nominal,lowest_nonlinear}_freq
  - userfaultfd: fix kabi breakage due to struct userfaultfd_ctx
  - mm/mremap: fix WARN with uffd that has remap events disabled
  - mm: clear uffd-wp PTE/PMD state on mremap()
  - userfaultfd: move userfaultfd_ctx struct to header file
  - smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work)
  - tools headers: Sync x86 headers with kernel sources
  - perf/x86: Add PERF_CAP_PEBS_TIMING_INFO flag
  - perf/x86/intel: Use early_initcall() to hook bts_init()
  - perf/x86/intel: Fix NULL event dereference crash in handle_pmi_common()
  - perf/x86/intel: Fix and clean up intel_pmu_drain_arch_pebs() type use
  - perf/x86/intel: Optimize PEBS extended config
  - perf/x86/intel: Check PEBS dyn_constraints
  - perf/x86/intel: Add a check for dynamic constraints
  - perf/x86/intel: Add counter group support for arch-PEBS
  - perf/x86/intel: Setup PEBS data configuration and enable legacy groups
  - perf/x86/intel: Update dyn_constraint base on PEBS event precise level
  - perf/x86/intel: Allocate arch-PEBS buffer and initialize PEBS_BASE MSR
  - perf/x86/intel: Process arch-PEBS records or record fragments
  - perf/x86/intel/ds: Factor out PEBS group processing code to functions
  - perf/x86/intel/ds: Factor out PEBS record processing code to functions
  - perf/x86/intel: Initialize architectural PEBS
  - perf/x86/intel: Replace x86_pmu.drain_pebs calling with static call
  - perf/x86: Fix NULL event access and potential PEBS record loss
  - perf/x86: Remove redundant is_x86_event() prototype
  - perf/core: Check sample_type in perf_sample_save_brstack
  - perf/core: Check sample_type in perf_sample_save_callchain
  - perf/x86/intel/ds: Remove redundant assignments to sample.period
  - perf/x86/intel: Introduce pairs of PEBS static calls
  - perf/x86/intel: Rename x86_pmu.pebs to x86_pmu.ds_pebs
  - perf/x86/intel: Decouple BTS initialization from PEBS initialization
  - MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits
  - scsi: leapraid: add RAID disk hide/show events and fix misc issues


