linux-hwe-7.0 (7.0.0-38.38~24.04.4trisquel43) ecne; urgency=medium

  * Removed non-free bits

 -- Trisquel GNU/Linux developers <trisquel-devel@listas.trisquel.info>  Fri, 09 Oct 2026 18:20:55 +0000

linux-hwe-7.0 (7.0.0-38.38~24.04.4) noble; urgency=medium

  * noble/linux-hwe-7.0: 7.0.0-38.38~24.04.4 -proposed tracker (LP: #2165487)

  * [noble:linux-hwe-7.0] Convert to use linux-main-modules (lmm)
    (LP: #2165131)
    - [Packaging] Allow dynamically turning lmm on
    - [Packaging] Switch to use LMM
    - [Packaging] Fix dependency for v4l2loopback (amd64 only)

  [ Ubuntu: 7.0.0-38.38 ]

  * resolute/linux: 7.0.0-38.38 -proposed tracker (LP: #2166443)
  * linux: dtbs_install fails on Resolute builders due to uutils install(1)
    EEXIST race under parallel make (LP: #2166356)
    - SAUCE: [Packaging] Serialise dtbs_install to work around uutils
      install(1) race
  * #510/p sleepable raw tracepoint reject from test_verifier in ubuntu_bpf
    failed with resolute (7.0.0-33.33) generic amd64 (LP: #2165872)
    - SAUCE: Revert "bpf: Verifier support for sleepable tracepoint programs"
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189)
    - platform/x86/intel-uncore-freq: Fix current_freq_khz after CPU hotplug
    - selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs
    - drm/virtio: fix deadlock in display_info_cb by removing hotplug from
      dequeue worker
    - seqlock: Allow UBSAN_ALIGNMENT to fail optimizing
    - KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN
    - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin
    - xprtrdma: Clear receive-side ownership pointers on release
    - Input: ims-pcu - fix logic error in packet reset
    - fuse: fix writeback array overflow when max_pages is one
    - arm64: tegra: Remove fallback compatible for GPCDMA
    - arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234
    - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm()
    - mtd: mtdswap: remove debugfs stats file on teardown
    - mtd: nand: mtk-ecc: stop on ECC idle timeouts
    - btrfs: fallback to transaction csum tree on a commit root csum miss
    - RDMA/cma: Fix hardware address comparison length in netevent callback
    - RDMA/irdma: Remove redundant legacy_mode checks
    - RDMA/erdma: initialize ret for empty receive WR lists
    - RDMA/mana_ib: initialize err for empty send WR lists
    - RDMA/hns: Fix potential integer overflow in mhop hem cleanup
    - selftests/alsa: Fix memory leak in find_controls error path
    - RDMA/irdma: Prevent overflows in memory contiguity checks
    - wifi: cfg80211: derive S1G beacon TSF from S1G fields
    - wifi: nl80211: validate nested MBSSID IE blobs
    - wifi: nl80211: constrain MBSSID TX link ID range
    - wifi: cfg80211: validate PMSR measurement type data
    - wifi: cfg80211: reject unsupported PMSR FTM location requests
    - wifi: mac80211: avoid non-S1G AID fallback for S1G assoc
    - ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on
      start/stop
    - ASoC: amd: ps: disable MSI on resume in ACP PCI driver
    - ASoC: amd: ps: fix wrong ACP version string in pci_request_regions()
    - ASoC: amd: ps: replace bitwise OR with logical OR in IRQ return check
    - ASoC: cs42l43: Correct report for forced microphone jack
    - ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after
      lookup
    - firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context
    - cpufreq: Make cpufreq_update_pressure() fall back to cpuinfo.max_freq
    - udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf()
    - ata: sata_dwc_460ex: use platform_get_irq()
    - ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending
      interrupts
    - accel/ivpu: Fix wrong register read in LNL failure diagnostics
    - ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC
    - drm/i915/gt: use correct selftest config symbol
    - powerpc/85xx: Add fsl,ifc to common device ids
    - powerpc/time: Prepare to stop elapsing in dynticks-idle
    - powerpc/vtime: Initialize starttime at boot for native accounting
    - drm/panthor: Check debugfs GEM lock initialization
    - riscv: hwprobe: Avoid uninitialized read in hwprobe_get_cpus()
    - can: j1939: fix lockless local-destination check
    - drm/xe/wopcm: fix WOPCM size for LNL+
    - drm/i915/wm: clear the plane ddb_y entries on plane disable
    - drm/i915/selftests: Fix GT PM sort comparators
    - USB: storage: add NO_ATA_1X quirk for Longmai USB Key
    - usb: chipidea: fix usage_count leak when autosuspend_delay is negative
    - USB: gadget: snps-udc: fix device name leak on probe failure
    - USB: gadget: fsl-udc: fix device name leak on probe failure
    - USB: gadget: fsl-udc: fix dev_printk() device
    - USB: serial: ftdi_sio: add support for E+H FXA291
    - USB: serial: keyspan_pda: fix data loss on receive throttling
    - USB: serial: option: add TDTECH MT5710-CN
    - SAUCE: Revert "usb: typec: ucsi: Detect and skip duplicate altmodes from
      buggy firmware"
    - usb: typec: ucsi: Detect and skip duplicate altmodes from buggy firmware
    - wifi: mwifiex: fix freeze for 60 seconds caused by request_firmware
    - RISC-V: KVM: Serialize virtual interrupt pending state updates
    - Revert "drm/amd/display: Add missing kdoc for ALLM parameters"
    - usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits
    - selftests/bpf: Adjust verifier_map_ptr for the map's excl field
    - selftests/bpf: Keep verifier_map_ptr exercising ops pointer access
    - wifi: ath11k: Flush the posted write after writing to
      PCIE_SOC_GLOBAL_RESET
    - wifi: ath12k: Flush the posted write after writing to
      PCIE_SOC_GLOBAL_RESET
    - btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8
    - btrfs: fix u32 to s64 type conversion in dirty_metadata_bytes accounting
    - ASoC: sun4i-codec: Set quirks.playback_only for H616 codec
    - ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI
    - ASoC: cs35l56: Don't use devres to unregister component
    - ASoC: cs35l56: Fix potential probe() deadlock
    - ASoC: cs35l56: Use complete_all() to signal init_completion
    - wifi: iwlwifi: mvm: validate SAR GEO response payload size
    - wifi: iwlwifi: fix pointer arithmetic in iwl_add_mcc_to_tas_block_list
    - wifi: iwlwifi: validate payload length in iwl_pnvm_complete_fn
    - wifi: iwlwifi: mvm: fix read in wake packet notification handler
    - usb: atm: ueagle-atm: reject descriptors that confuse probe and
      disconnect
    - drivers/virt: pkvm: Fix end calculation in mmio_guard_ioremap_hook()
    - hwmon: (asus-ec-sensors) fix looping over banks while reading from EC
    - hwmon: (asus-ec-sensors) fix EC read intervals
    - hwmon: (asus-ec-sensors) add missed handle for ENOMEM
    - selftests/net: ovpn: fix getaddrinfo memory leak in ovpn_parse_remote()
    - ovpn: use monotonic clock for peer keepalive timeouts
    - regulator: mt6358: use regmap helper to read fixed LDO calibration
    - net: phy: marvell: fix return code
    - netlink: specs: rt-link: convert bridge port flag attributes to u8
    - gtp: parse extension headers before reading inner protocol
    - vhost-net: fix TX stall when vhost owns virtio-net header
    - wifi: mac80211: recalculate TIM when a station enters power save
    - pds_core: reject component parameter in legacy firmware update
    - arm64: Correct value returned by ESR_ELx_FSC_ADDRSZ_nL()
    - amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN
    - soreuseport: Clear sk_reuseport_cb before failure in sk_clone().
    - net: Call net_enable_timestamp() before failure in sk_clone().
    - pds_core: yield the CPU while waiting for the adminq to drain
    - pds_core: order completion reads after the ownership check
    - pds_core: check for workqueue allocation failure
    - tls: device: push pending open record on splice EOF
    - selftests: af_unix: add USER_NS config
    - selftests: openvswitch: add config file
    - selftests: ovpn: add IPV6 and VETH configs
    - selftests: ovpn: increase timeout
    - selftests: drv-net: increase timeout
    - ppp: don't store tx skb in the fastpath
    - ppp: annotate concurrent dev->stats accesses
    - ovl: fix trusted xattr escape prefix matching
    - drm/panel: s6e3ha8: fix unmet dependency on DRM_DISPLAY_HELPER
    - amt: make the head writable before rewriting the L2 header
    - net: bridge: vlan: fix vlan range dumps starting with pvid
    - net: dpaa: fix mode setting
    - drm/xe/i2c: Allow per domain unique id
    - iomap: correct the range of a partial dirty clear
    - drm/tests: shmem: Set DMA mask to 64-bit in drm_gem_shmem
    - net: stmmac: xgmac: fix l4 filter port overwrite on register update
    - net: stmmac: fix l3l4 filter rejecting unsupported offload requests
    - net: stmmac: reset residual action in L3L4 filters on delete
    - net: stmmac: enable the MAC on link up for all supported speeds
    - octeontx2-vf: set TC flower flag on MCAM entry allocation
    - ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup
    - ppp: annotate data races in ppp_generic
    - hinic: remove unused ethtool RSS user configuration buffers
    - raw: annotate lockless match fields in raw_v4_match()
    - net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule
    - net/mlx5e: Report zero bandwidth for non-ETS traffic classes
    - net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation
    - octeontx2-pf: tc: fix egress ratelimiting
    - net: ipv6: fix dif and sdif mismatch in raw6_icmp_error
    - ice: allow creating VFs when !CONFIG_ICE_SWITCHDEV
    - ice: fix LAG recipe to profile association
    - ipv6: Change allocation flags to match rcu_read_lock section
      requirements
    - ptp: netc: explicitly clear TMR_OFF during initialization
    - mctp: check register_netdevice_notifier() error in mctp_device_init()
    - net: airoha: fix ETS channel derivation in airoha_tc_setup_qdisc_ets()
    - drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay
    - drm: renesas: rzg2l_mipi_dsi: Move rzg2l_mipi_dsi_set_display_timing()
    - drm/tidss: Fix missing drm_bridge_add() call
    - drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video()
    - drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't
      at 0 (v2)
    - drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older
    - drm/sysfb: Do not page-align visible size of the framebuffer
    - drm/sysfb: Avoid truncating maximum stride
    - drm/amdgpu/gfx9: Fix Ring and IB test fail after mode2
    - drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT
    - drm/sysfb: Return errno code from drm_sysfb_get_visible_size()
    - drm/displayid: fix Tiled Display Topology ID size
    - drm/nouveau/acr: fix missing nvkm_done() in error path of
      nvkm_acr_oneinit()
    - drm/radeon: fix r100_copy_blit for large BOs
    - drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds
    - drm/amdkfd: Use kvcalloc to allocate arrays
    - drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips
    - drm/i915/hdcp: require monotonically increasing seq_num_v
    - drm/amd/amdgpu: disable ASPM on VI if pcie dpm is disabled
    - drm/amd/pm: fix smu14 power limit range calculation
    - drm/gfx10: Program DB_RING_CONTROL
    - drm/virtio: Don't detach GEM from a non-created context
    - drm/panthor: return error on truncated firmware
    - drm/amdgpu: Fix VFCT bus number matching with soft filter
    - drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X)
    - drm/amd/display: consolidate DCN vblank/flip handling onto
      vupdate_no_lock
    - drm/amd/display: Force PWM backlight on Lenovo Legion 5 15ARH05
    - drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge
    - drm/amd/display: Fix flip-done timeouts on mode1 reset
    - drm/amd/display: Fix missing DCE check in
      dm_gpureset_toggle_interrupts()
    - drm/v3d: Reach the GMP through the hub registers on V3D 7.x
    - media: aspeed: fix missing of_reserved_mem_device_release() on probe
      failure
    - media: cec: seco: unregister adapter on IR probe failure
    - media: cedrus: clean up media device on probe failure
    - media: cedrus: Fix missing cleanup in error path
    - media: imx219: Fix maximum frame length in lines
    - media: iris: Fix use IRQF_NO_AUTOEN when requesting the IRQ
    - media: marvell-cam: fix missing pci_disable_device() on remove
    - media: nuvoton: npcm-video: fix error handling in npcm_video_init()
    - media: nxp: imx8-isi: Clean up already-initialized pipes on probe
      failure
    - media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init
      error path
    - media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding
    - media: qcom: camss: Fix RDI streaming for CSID 680
    - media: qcom: camss: Fix RDI streaming for CSID GEN2
    - media: qcom: camss: Fix RDI streaming for CSID GEN3
    - media: rzg2l-cru: Skip ICnMC configuration when ICnSVC is used
    - media: synopsys: hdmirx: Fix HPD lane hold time
    - media: tegra-video: vi: fix invalid u32 return value in format lookup
    - media: v4l2-ctrls-request: add NULL check in
      v4l2_ctrl_request_complete()
    - media: v4l2-subdev: Fail {enable,disable}_streams and s_streaming nicely
    - media: vb2: use ssize_t for vb2_read/vb2_write
    - media: verisilicon: Export only needed pixels formats
    - media: vidtv: fix reference leak on failed device registration
    - media: vimc: fix reference leak on failed device registration
    - media: vpif_capture: fix OF node reference imbalance
    - ALSA: hda/realtek: Fix speakers on Lunnen Ground 14
    - ALSA: hda: codecs: hdmi: disable keep-alive before audio format change
    - wifi: brcmfmac: set F2 blocksize to 256 for BCM43752
    - wifi: ath11k: fix refcount leak in ath11k_ahb_fw_resources_init()
    - staging: rtl8723bs: fix inverted HT40 secondary channel offset
    - platform/loongarch: laptop: Explicitly reset bl_powered state when
      suspend
    - rust_binder: only print failure if error has source
    - rust: time: fix as_micros_ceil() to round correctly for negative Delta
    - rust: allow `clippy::unwrap_or_default` globally
    - objtool/rust: add one more `noreturn` Rust function for Rust 1.99.0
    - LoongArch: Fix address space mismatch in kexec command line lookup
    - LoongArch: Fix oops during single-step debugging
    - LoongArch: Move jump_label_init() before parse_early_param()
    - LoongArch: Retrieve CPU package ID from PPTT when available
    - x86/boot/compressed: Disable jump tables
    - uio_hv_generic: Bind to FCopy device by default
    - serial: sc16is7xx: implement gpio get_direction() callback
    - selftests: ntsync: correct CONFIG_NTSYNC name
    - tracing: Fix context switch counter truncation
    - tracing/eprobe: Fix exact system name matching in
      eprobe_dyn_event_match()
    - tracing/probes: Avoid temporary buffer truncation in
      trace_probe_match_command_args()
    - tracing/probes: Fix potential underflow in LEN_OR_ZERO macro
    - tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err()
    - mptcp: decrement subflows counter on failed passive join
    - mptcp: only set DATA_FIN when a mapping is present
    - mm/kmemleak: fix checksum computation for per-cpu objects
    - mm/huge_memory: set PG_has_hwpoisoned only after new folio head is
      established
    - ceph: fix refcount leak in ceph_readdir()
    - ceph: fix writeback_count leak in write_folio_nounlock()
    - ASoC: fsl: imx-card: Skip sysclk reset for active DAIs in shutdown
    - ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP
    - io_uring/rw: fix missing ERESTARTSYS conversion in read paths
    - iommu/vt-d: Disallow SVA if page walk is not coherent
    - net: stmmac: intel: skip SerDes reconfig when rate is unchanged
    - net: pcs: xpcs: fix SGMII state reading
    - proc: Fix broken error paths for namespace links
    - s390/ptff: Export ptff_function_mask[]
    - smb: client: handle STATUS_STOPPED_ON_SYMLINK responses without a
      symlink target
    - ice: use READ_ONCE() to access cached PHC time
    - ovpn: hold peer before scheduling keepalive work
    - vsock/virtio: collapse receive queue under memory pressure
    - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct
    - drm/amd/pm: fix amdgpu_pm_info power display units
    - drm/amd/pm: make pp_features read-only when scpm is enabled
    - drm/amdgpu/jpeg: fix jpeg_v4_0_3_is_idle detection
    - drm/amdgpu/jpeg: fix jpeg_v5_0_1_is_idle detection
    - drm/amdgpu/soc24: reset dGPU if suspend got aborted
    - drm/amdgpu: fix resource leak on ACP reset timeout
    - drm/amd/pm: fix smu13 power limit range calculation
    - drm/amdgpu: fix check in amdgpu_hmm_invalidate_gfx
    - drm/xe/uapi: Reject coh_none PAT index for CPU_ADDR_MIRROR
    - net: qrtr: ns: Raise node count limit to 512
    - drm/amd/display: Fix DTB DTO updates breaking live pixel rate sources
    - audit: widen ino fields to u64
    - audit: use 'unsigned int' instead of 'unsigned'
    - xfs: don't replace the wrong part of the cow fork
    - netfilter: nf_tables: remove register tracking infrastructure
    - drm: drop lib from header search path.
    - SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists
    - SUNRPC: Return an error from xdr_buf_to_bvec() on overflow
    - SAUCE: Revert "mm/sparse-vmemmap: fix vmemmap accounting underflow"
    - mm/sparse-vmemmap: fix vmemmap accounting underflow
    - mmc: vub300: rename probe error labels
    - net: mana: Optimize irq affinity for low vcpu configs
    - bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c
    - bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline()
    - pmdomain: imx93-blk-ctrl: convert to devm_* only
    - rust: allow `suspicious_runtime_symbol_definitions` lint for Rust >=
      1.98
    - rust: device: avoid trailing ; in printing macros
    - sched_ext: Skip ops.set_weight() for disabled tasks
    - sched_ext: Annotate ksyncs with __rcu in alloc/free_kick_syncs()
    - reset: spacemit: k3: fix USB2 ahb reset
    - wifi: cfg80211: reject empty PMSR peer lists
    - ASoC: amd: acp: Fix linker error with SDCA quirks
    - [Config] Adjust config SND_SOC_ACPI_AMD_SDCA_QUIRKS
    - sched_ext: Enable tick for finite slices on nohz_full
    - Bluetooth: mgmt: Translate HCI reason in Device Disconnected event
    - riscv: Gate FUNCTION_ALIGNMENT_4B on DYNAMIC_FTRACE
    - spi: cadence-quadspi: Fix indirect write timeout when DMA read mode is
      enabled
    - drm/xe: Assign queue name in time for drm_sched_init
    - drm/xe: add WQ_PERCPU to alloc_workqueue users
    - selftests: netconsole: only restore MAC when it changed on resume
    - wifi: ath10k: fix skb leak on incomplete msdu during rx pop
    - wifi: ath12k: Fix low MLO RX throughput on WCN7850
    - iommu/amd: Fix nested domain leak
    - arm_mpam: Fix software reset values of MPAMCFG_PRI
    - arm_mpam: Fix MPAMCFG_MBW_PBM register setting
    - hwmon: Drop unused i2c driver_data
    - hwmon: Use named initializers for arrays of i2c_device_data
    - hwmon: (pmbus/max34440): add support adpm12250
    - hwmon: (pmbus/max34440) block unsupported VIN and IIN limit registers
    - drm/i915/backlight: Remove DP_EDP_BACKLIGHT_AUX_ENABLE_CAP check for
      DPCD backlight
    - selftests/net: Fix tun IPv6 test addresses to avoid 6to4 range
    - geneve: fix hint header definition wrt endianness
    - geneve: ensure the skb is writable before fixing its headers
    - accel: ethosu: Handle U85 internal chaining buffer
    - selftests: drv-net: convert so_txtime to drv-net
    - cifs: prevent readdir from changing file size due to stale directory
      metadata
    - wifi: mt76: fix airoha_npu dependency tracking
    - [Config] Fix config dependencies for MT76_NPU
    - drm/panel: ilitek-ili9882t: fix unmet dependency for
      DRM_PANEL_ILITEK_ILI9882T
    - iomap: fix incorrect did_zero setting in iomap_zero_iter()
    - mpls: Set rt->rt_nhn just before returning from mpls_nh_build_multi().
    - LoongArch: BPF: Zero-extend signed ALU32 div/mod results
    - bnge/bng_re: fix ring ID widths
    - pidfs: make pidfs_ino_lock static
    - LoongArch: BPF: Fix memory leak in bpf_jit_free()
    - drm/exynos: fbdev: Remove offset into screen_buffer
    - drm/tegra: fbdev: Remove offset into framebuffer memory
    - drm/i915/cdclk: Fix up CDCLK_FREQ_DECIMAL without a full PLL re-enable
    - drm/amd/pm: re-enable MC access after PrepareMp1ForUnload on SMU V15
      APUs
    - bitmap: add test_zero_nbits()
    - drm/xe: Add compact-PT and addr mask handling for page reclaim
    - drm/amd/display: Restore periodic detection for DCN35
    - drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions
    - drm/amdkfd: Use exclusive bounds for SVM split alignment checks
    - drm/i915/mtl+: Enable PPS before PLL
    - drm/xe/oa: Fix offset alignment for MERT WHITELIST_OA_MERT_MMIO_TRG
    - drm/xe/nvm: fix writable override for CRI
    - drm/amdgpu: Check for multiplication overflow in checkpoint stack size
    - drm/amdkfd: Guard m->cp_hqd_eop_control setting by
      q->eop_ring_buffer_size
    - drm/amdkfd: free MQD managers on DQM init failures
    - drm/amd/display: set MSA MISC1 bit 6 when using VSC SDP for DCE 11.x
    - drm/amdgpu: add the doorbell index input for suspending userq
    - drm/amdgpu: remove deadlocks from amdgpu_userq_pre_reset
    - drm/amd: Create a device link between APU display and XHCI devices
    - drm/pagemap: Clear driver-provided PFNs from migration PFN array
    - mm: add gpu active/reclaim per-node stat counters (v2)
    - drm/ttm: use gpu mm stats to track gpu memory allocations. (v4)
    - drm/ttm: Fix GPU MM stats during pool shrinking
    - drm/ttm/pool: back up at native page order
    - drm/gpusvm: Zero HMM PFNs before scanning ranges
    - media: mali-c55: Add missing of_reserved_mem_device_release()
    - media: mali-c55: Disable pm_runtime on probe error
    - media: mali-c55: Power-off the peripheral in remove()
    - media: qcom: camss: Fix RDI streaming for CSID 340
    - media: rzv2h-ivc: Wait for frame end in stop_streaming
    - media: ti: vpe: Fix fwnode_handle leak in vip_probe_complete()
    - media: ti: vpe: Fix the error code of devm_request_irq()
    - media: uapi: rkisp: Correct name version enum
    - wifi: mt76: restrict NPU/PPE active checks to MMIO devices
    - LoongArch: Fix build errors due to wrong instructions for 32BIT
    - LoongArch: Increase TASK_STRUCT_OFFSET up to 2040 for 32BIT
    - firmware: stratix10-svc: fix teardown order in remove to prevent race
    - firmware: stratix10-svc: handle NO_RESPONSE in async poll
    - tracing: perf: Fix stale head for perf syscall tracing
    - arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates
    - Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer
      updates"
    - selftests: mptcp: userspace_pm: fix undefined variable port
    - m68k: avoid -Wunused-but-set-parameter in clear_user_page()
    - mm/memory-failure: trace: change memory_failure_event to ras subsystem
    - mm/slub: fix lost local objects when bulk remote free batch fills
    - mm/slab: fix a memory leak due to bootstrapping sheaves twice
    - drm/amdgpu: rework userq fence driver alloc/destroy
    - drm/amdgpu: rework userq fence signal processing
    - drm/amdgpu/gfx11: fix EOP interrupt routing for KQ and userq
    - drm/amdgpu/gfx12: fix EOP interrupt routing for KQ and userq
    - drm/amdgpu/mes11: set doorbell offset for suspending userq
    - selftests: drv-net: add missing kconfig for psp.py
    - mm/sparse-vmemmap: pass @pgmap argument to memory deactivation paths
    - mm/sparse-vmemmap: fix DAX vmemmap accounting with optimization
    - selftests: drv-net: cope with slow env in so_txtime.py test
    - selftests: drv-net: so_txtime: relax variance bounds
    - cifs: fix time_last_write stamp placement in setattr/truncate paths
    - cifs: consolidate time_last_write stamp into _cifsFileInfo_put()
    - Upstream stable to v6.18.41, v6.18.42, v6.18.43, v7.1.6, v7.1.7
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68480
    - x86/bugs: Make Safe-RET robust against interrupt injection
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68105
    - drm/amdgpu: Fix kernel panic during driver load failure
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68109
    - drm/amdgpu/sdma7.1: replace BUG_ON() with WARN_ON()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68114
    - drm/amdgpu/gfx12.1: replace BUG_ON() with WARN_ON()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68431
    - ksmbd: validate minimum PDU size for transform requests
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68138
    - net/sched: serialize qdisc_rtab_list against concurrent get/put
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68082
    - libceph: fix two unsafe bare decodes in decode_lockers()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68159
    - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68163
    - mm/page_vma_mapped: fix device-private PMD handling
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68166
    - userfaultfd: prevent registration of special VMAs
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68170
    - mptcp: fix stale skb->sk reference on subflow close
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68177
    - tracing: Delay module ref count for "enable_event" trigger
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68191
    - wifi: ath12k: fix NULL pointer dereference in rhash table destroy
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-64586
    - wifi: brcmfmac: drain bus_reset work on device removal
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68208
    - media: ti: vpe: Fix the error code of devm_kzalloc() in
      vip_probe_slice()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68224
    - media: mali-c55: Fix possible ERR_PTR in enable_streams
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68237
    - drm/amdgpu/userq: fix indefinite fence wait during GPU reset
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68240
    - drm/gpusvm: publish dpagemap early to avoid device mapping leak on error
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68242
    - drm/i915/gt: Fix NULL deref on sched_engine alloc failure
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68254
    - drm/i915/vrr: require valid min/max vfreq for VRR
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68436
    - drm/amd/display: use kvzalloc to allocate struct dc
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68447
    - drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68264
    - drm/xe/pt: Reset current_op in xe_pt_update_ops_init()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68265
    - drm/xe/vm: Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOC
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68267
    - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68273
    - drm/amdgpu: Fix context pstate override handling
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68274
    - drm/xe/guc: Fix buffer overflow in steered register list allocation
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68283
    - tracing: Fix use-after-free freeing trigger private data
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68286
    - drop_monitor: perform u64_stats updates under IRQ-disabled section
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68287
    - drop_monitor: fix size calculations for 64-bit attributes
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68288
    - net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68289
    - tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68291
    - idpf: fix max_vport related crash on allocation error during init
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68303
    - drm/vc4: hvs/v3d: Fix null dereference in unbind
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68312
    - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain
      paths
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68316
    - accel: ethosu: Fix element size accounting for cmd stream validation
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68322
    - rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68440
    - net: txgbe: fix heap overflow when reading module EEPROM
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68323
    - tipc: serialize udp bearer replicast list updates
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68441
    - net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68337
    - bpf: Reject redirect helpers without a bpf_net_context
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68345
    - arm_mpam: guard MBWU state before adding it to garbage
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68347
    - iommu/amd: Fix IRQ unsafe locking in gdom allocation
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68375
    - bnxt_en: Handle partially initialized auxiliary devices
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68382
    - drm/xe/guc: Hold device ref until queue teardown completes
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68383
    - drm/xe/guc: Keep scheduler timeline name alive
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68390
    - Bluetooth: hci_sync: hold hdev->lock for hci_conn_params lookups
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68399
    - bpf: Fix UAF in sock clone early bailouts
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68404
    - wifi: cfg80211: use wiphy work for socket owner autodisconnect
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-64581
    - xfrm: fix sk_dst_cache double-free in xfrm_user_policy()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68093
    - KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision
      after hotplug
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68367
    - usb: gadget: f_tcm: synchronize delayed set_alt with teardown
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68164
    - mm/damon/core: disallow overlapping input ranges for damon_set_regions()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68165
    - mm/damon/core: validate ranges in damon_set_regions()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68095
    - fuse-uring: fix race between registration and connection abortion
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68096
    - audit: fix recursive locking deadlock in audit_dupe_exe()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68147
    - fscrypt: Avoid dynamic allocation in fscrypt_get_devices()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68097
    - ksmbd: validate ACE size against SID sub-authorities
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68098
    - ksmbd: bound DACL dedup walk to copied ACEs
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68099
    - ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68100
    - ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68173
    - ublk: wait on ublk_dev_ready() instead of ub->completion
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68104
    - drm/amdgpu: invoke pm_genpd_remove() before freeing genpd
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68106
    - drm/amdgpu: fix division by zero with invalid uvd dimensions
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68429
    - drm/dp_mst: Handle torn-down topology gracefully in
      drm_dp_mst_topology_queue_probe()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68107
    - drm/amdgpu/vcn4: avoid rereading IB param length
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68108
    - drm/amdgpu/vce: fix integer overflow in image size
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68110
    - drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68111
    - drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68112
    - drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68430
    - drm/amdgpu/gfx8: drop unecessary BUG_ON()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68113
    - drm/amdgpu/gfx12: replace BUG_ON() with WARN_ON()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68246
    - drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68115
    - drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68116
    - vxlan: mdb: Fix source list corruption on a failed replace
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68117
    - tipc: clear sock->sk on the failed-insert path in tipc_sk_create()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68118
    - tcp: challenge ACK for non-exact RST in SYN-RECEIVED
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68119
    - tcp: initialize standalone TCP-AO response padding
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68120
    - rtase: Workaround for TX hang caused by hardware packet parsing
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68121
    - pppoe: reload header pointer after dev_hard_header()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68122
    - ovpn: fix peer refcount leak in TCP error paths
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68123
    - openvswitch: fix GSO userspace truncation underflow
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68124
    - mctp: serial: handle zero-length frames to prevent rx buffer overflow
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68125
    - mac802154: llsec: reject frames shorter than the authentication tag
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68126
    - mac802154: hold an interface reference across the scan worker
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68127
    - ila: reload IPv6 header after pskb_may_pull in checksum adjust
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68128
    - ice: reject out-of-range ptype in ice_parser_profile_init
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68129
    - gve: fix Rx queue stall on alloc failure
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68130
    - ksmbd: defer destroy_previous_session() until after NTLM authentication
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68131
    - rbd: Reset positive result codes to zero in object map update path
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68132
    - super: fix emergency thaw deadlock on frozen block devices
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68133
    - ice: fix PTP Call Trace during PTP release
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68134
    - ptp: ptp_s390: Add missing facility check
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68135
    - net: hip04: fix RX buffer leak on build_skb failure
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68136
    - net: gro: fix double aggregation of flush-marked skbs
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68137
    - net/x25: fix use-after-free in x25_kill_by_neigh()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68139
    - net/mlx5e: Use sender devcom for MPV master-up
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68140
    - net/iucv: fix use-after-free of a severed iucv_path
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68141
    - net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68142
    - geneve: require CAP_NET_ADMIN in the device netns for changelink
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68143
    - net: slip: serialize receive against buffer reallocation
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68432
    - vxlan: require CAP_NET_ADMIN in the device netns for changelink
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68144
    - phonet: pep: fix use-after-free in pep_get_sb()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68145
    - iomap: fix out-of-bounds bitmap_set() with zero-length range
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68146
    - ftrace: Add global mutex to serialize trace_parser access
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68148
    - fscrypt: Add missing superblock check in find_or_insert_direct_key()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68149
    - fs: preserve ACL_DONT_CACHE state in forget_cached_acl()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68150
    - fs/super: fix emergency thaw double-unlock of s_umount
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68151
    - binfmt_elf_fdpic: only honour the first PT_INTERP
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68152
    - amt: fix use-after-free in AMT delayed works
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68153
    - libceph: remove debugfs files before client teardown
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68154
    - libceph: reject zero bucket types in crush_decode
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68155
    - libceph: Reject monmaps advertising zero monitors
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68156
    - libceph: refresh auth->authorizer_buf{,_len} after authorizer update
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68157
    - libceph: guard missing CRUSH type name lookup
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68158
    - libceph: Fix multiplication overflow in decode_new_up_state_weight()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68433
    - libceph: bound get_version reply decode to front len
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68160
    - ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68161
    - sctp: close UDP tunnel sockets during netns teardown
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68162
    - sctp: avoid auth_enable sysctl UAF during netns teardown
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-64564
    - sctp: don't free the ASCONF's own transport in DEL-IP processing
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68168
    - afs: Fix afs_edit_dir_remove() to get, not find, block 0
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68169
    - mptcp: pm: userspace: fix use-after-free in get_local_id
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68172
    - arm64: make huge_ptep_get handled unaligned addresses
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68174
    - tracing: Fix union collision of module and refcnt for dynamic events
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68175
    - tracing: Fix resource leak on mmiotrace trace_pipe close
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68176
    - tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68178
    - misc: nsm: pin the module while the device is open
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68179
    - misc: nsm: only unlock nsm_dev on post-lock error paths
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68180
    - intel_th: fix MSC output device reference leak
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68181
    - mei: bus: access mei_device under device_lock on cleanup
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68434
    - serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR
      platforms
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68182
    - comedi: comedi_parport: deal with premature interrupt
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68183
    - firmware: stratix10-svc: fix memory leaks and list corruption bugs
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-64563
    - rhashtable: clear stale iter->p on table restart
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68184
    - cdrom: fix stack out-of-bounds read in CDROMVOLCTRL
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68186
    - binfmt_misc: set have_execfd only once the interpreter is opened
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68187
    - exec: fix unsigned loop counter wrap in transfer_args_to_stack()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68188
    - Bluetooth: RFCOMM: Fix session UAF in set_termios
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68189
    - Bluetooth: hci_sync: Protect UUID list traversal
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68190
    - staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68192
    - wifi: brcmfmac: make release_scratchbuffers idempotent
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68193
    - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68194
    - wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68195
    - wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68196
    - wifi: wilc1000: validate assoc response length before subtracting header
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68197
    - wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-
      oper
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68198
    - wifi: ath6kl: fix use-after-free in aggr_reset_state()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68199
    - wifi: ath6kl: fix OOB access from firmware ADDBA window size
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68200
    - ALSA: timer: don't re-enter an instance callback that is still running
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68201
    - ALSA: timer: drain a slave's callback before its master detaches it
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68202
    - ALSA: seq: close a re-opened queue timer in the destructor
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68203
    - media: vivid: fix cleanup bugs in vivid_init()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68204
    - media: vivid: check for vb2_is_busy() when toggling caps
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68205
    - media: v4l2-fwnode: Fix subdev owner overwritten in
      v4l2_async_register_subdev_sensor()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68206
    - media: v4l2-ctrls: validate HEVC active reference counts
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68207
    - media: ti: vpe: unwind v4l2 device registration on probe error
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68209
    - media: sun4i-csi: Return queued buffers on start_streaming() failure
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68210
    - media: stm32: dcmi: unregister notifier on probe failure
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68211
    - media: stm32-dcmipp: Return queued buffers on start_streaming() failure
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68212
    - media: saa7134: Fix a possible memory leak in saa7134_video_init1
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68213
    - media: rtl2832_sdr: Return queued buffers on start_streaming() failure
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68214
    - media: rtl2832: fix use-after-free in rtl2832_remove()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68215
    - media: radio-si476x: Unregister v4l2_device on probe failure
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68216
    - media: pwc: Return queued buffers on start_streaming() failure
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68217
    - media: pwc: Drain fill_buf on start_streaming() failure
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68218
    - media: pci: dm1105: Free allocated workqueue
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68219
    - media: nxp: imx8-isi: Fix potential out-of-bounds issues
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68220
    - media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and
      pipe
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68221
    - media: nuvoton: npcm-video: fix memory leaks in probe and remove
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68222
    - media: msi2500: Return queued buffers on start_streaming() failure
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68223
    - media: meson: vdec: Fix memory leak in error path of vdec_open
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68225
    - media: i2c: alvium: fix critical pointer access in alvium_ctrl_init
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68226
    - media: cx23885: add ioremap return check and cleanup
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68227
    - media: cx231xx: fix devres lifetime
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68228
    - media: chips-media: wave5: Move src_buf Removal to finish_encode
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68229
    - media: cedrus: skip invalid H.264 reference list entries
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68230
    - media: amlogic-c3: Add validations for ae and awb config
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68231
    - media: airspy: Return queued buffers on start_streaming() failure
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68232
    - drm/gpusvm: Fix MM reference leak in drm_gpusvm_range_evict
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68445
    - drm/vc4: Prevent shader BO mappings from becoming writable
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68446
    - drm/vmwgfx: Validate vmw_surface_metadata::array_size
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68233
    - drm/vc4: Shut down BO cache timer before teardown
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68234
    - drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68235
    - drm/amd/display: dce100: skip non-DP stream encoders for DP MST
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68236
    - drm/amd/display: set new_stream to NULL after release
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68238
    - drm/amdgpu: Release VFCT ACPI table reference
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68239
    - drm/ttm: Account for NULL and handle pages in ttm_pool_backup
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68241
    - drm/i915/mst: limit DP MST ESI service loop
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68243
    - drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68244
    - drm/i915/gem: Do not leak siblings[] on proto context error
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68245
    - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68247
    - drm/i915/bios: range check LFP Data Block panel_type2
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68248
    - drm/i915: Return NULL on error in active_instance
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68249
    - drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68250
    - drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68251
    - drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68252
    - drm/amdgpu/sdma7.0: replace BUG_ON() with WARN_ON()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68253
    - drm/i915/hdcp: check streams[] bounds before overflow
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68255
    - drm/virtio: bound EDID block reads to the response buffer
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68256
    - drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path
      leaks prev_sink reference
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68257
    - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68258
    - drm/amdkfd: Check bounds on CRIU restore queue type and mqd size
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68259
    - drm/amdkfd: Check bounds in allocate_event_notification_slot
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68260
    - drm/imagination: acquire vm_ctx->lock before mapping memory to GPU VM
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68261
    - drm/imagination: fix error checking of pvr_vm_context_lookup()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68262
    - drm/imagination: Fix user array stride in pvr_set_uobj_array()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68263
    - drm/imagination: Fix double call to drm_sched_entity_fini()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68266
    - drm/xe: Hold a dma-buf reference for imported BOs
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68268
    - drm/xe: Return error on non-migratable faults requiring devmem
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68269
    - drm/i915/gem: Add missing nospec on parallel submit slot
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68270
    - drm/sysfb: Avoid possible truncation with calculating visible size
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68271
    - drm/nouveau: fix reversed error cleanup order in ucopy functions
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68272
    - drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68275
    - drm/amdgpu: check amdgpu_vm_bo_find() result in GET_MAPPING_INFO
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68276
    - drm/amdgpu/gfx: fix cleaner shader IB buffer overflow
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68277
    - drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68437
    - drm/imagination: Fit paired fragment job in the correct CCCB
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68278
    - drm/dp/mst: fix buffer overflows in sideband chunk accumulation
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68279
    - drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68280
    - drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68281
    - drm/imagination: Count paired job fence as dependency in prepare_job()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68282
    - drm/rockchip: analogix_dp: Add missing error check for
      platform_get_resource()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68284
    - bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68290
    - rds: tcp: unregister sysctl before tearing down listen socket
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68292
    - ice: prevent tstamp ring allocation for non-PF VSI types
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68293
    - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68294
    - net: qrtr: restrict socket creation to the initial network namespace
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68296
    - net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-64575
    - bpf: tcp: fix double sock release on batch realloc
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68297
    - tipc: fix u16 MTU truncation in media and bearer MTU validation
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68298
    - drm/xe/vm: Fix SVM leak on resv obj alloc failure in xe_vm_create()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68299
    - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68300
    - sctp: auth: verify auth requirement when auth_chunk is NULL
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68301
    - net: hsr: fix memory leak on slave unregistration by removing synced
      VLANs
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68302
    - amt: re-read skb header pointers after every pull
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68448
    - ovl: check access to copy_file_range source with src mounter creds
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68304
    - wifi: brcmfmac: fix 802.1X-SHA256 call trace warning
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68306
    - wifi: mt76: mt7996: fix possible NULL-pointer deref in
      mt7996_mcu_sta_bfer_eht()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68307
    - wifi: mt76: mt7925: fix crash in reset link replay
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68308
    - wifi: mt76: mt7996: check pointer returned by
      mt76_connac_get_he_phy_cap()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68439
    - wifi: mt76: mt7925: fix possible NULL-pointer deref in
      mt7925_mcu_bss_he_tlv()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68309
    - wifi: mt76: connac: fix possible NULL-pointer deref in
      mt76_connac_mcu_uni_bss_he_tlv()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68310
    - wifi: mt76: mt7915: guard HE capability lookups
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68311
    - wifi: mt76: mt7925: guard link STA in decap offload
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68313
    - tipc: fix infinite loop in __tipc_nl_compat_dumpit
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-64576
    - nexthop: initialize extack in nh_res_bucket_migrate()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-64577
    - gtp: check skb_pull_data() return in gtp1u_send_echo_resp()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68314
    - net: mctp i3c: clean up notifier and buses if driver register fails
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68315
    - sctp: validate stream count in sctp_process_strreset_inreq()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68317
    - pds_core: fix auxiliary device add/del races
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68318
    - pds_core: fix use-after-free on workqueue during remove
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68319
    - pds_core: fix deadlock between reset thread and remove
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68320
    - sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68321
    - net: txgbe: fix FDIR filter leak on remove
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68324
    - iommu/intel: Fix out-of-bounds memset in dmar_latency_disable()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68325
    - iommu/amd: Bound the early ACPI HID map
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68326
    - wifi: mwifiex: bound uAP association event IEs to the event buffer
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68327
    - wan: wanxl: Only reset hardware after BAR mapping
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68328
    - nfp: Check resource mutex allocation
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-64574
    - wifi: mac80211: tear down new links on vif update error path
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68329
    - iommu/amd: Wait for completion instead of returning early in
      iommu_completion_wait()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68330
    - net: airoha: Fix DMA direction for NPU mailbox buffer
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68331
    - dpaa2-eth: put MAC endpoint device on disconnect
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68332
    - net: airoha: Fix potential use-after-free in airoha_ppe_deinit()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68333
    - dpaa2-switch: put MAC endpoint device on disconnect
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68334
    - rxrpc: fix io_thread race in rxrpc_wake_up_io_thread()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68335
    - rds: drop incoming messages that cross network namespace boundaries
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68336
    - bonding: fix devconf_all NULL dereference when IPv6 is disabled
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68338
    - net/packet: avoid fanout hook re-registration after unregister
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68339
    - Bluetooth: btusb: validate Realtek vendor event length
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68340
    - hwmon: occ: validate poll response sensor blocks
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68341
    - ovpn: fix use after free in unlock_ovpn()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68342
    - ovpn: avoid putting unrelated P2P peer on socket release
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68343
    - smb: client: validate DFS referral PathConsumed
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68346
    - ALSA: hda: cs35l41: validate and free ACPI mute object
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68348
    - ASoC: tas2781: bound firmware description string parsing
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68450
    - btrfs: free mapping node on duplicate reloc root insert
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68442
    - btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68349
    - wifi: carl9170: fix buffer overflow in rx_stream failover path
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68350
    - wifi: carl9170: fix OOB read from off-by-two in TX status handler
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68351
    - wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68352
    - wifi: ath6kl: fix OOB read from firmware IE lengths in connect event
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68353
    - wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68354
    - firewire: net: Fix fragmented datagram reassembly
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68355
    - wifi: ath11k: fix potential buffer underflow in
      ath11k_hal_rx_msdu_list_get()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68356
    - watchdog: airoha: Prevent division by zero when clock frequency is zero
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68357
    - watchdog: pretimeout: Fix UAF in watchdog_unregister_governor()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68358
    - hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68359
    - hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68443
    - hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68360
    - hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68361
    - hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68362
    - wifi: ath11k: fix NULL pointer dereference in
      ath11k_hal_srng_access_begin
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68363
    - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware
      request
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68365
    - USB: serial: io_edgeport: cap received transmit credits
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68366
    - usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-64583
    - usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before
      teardown
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68368
    - usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68369
    - usb: gadget: printer: fix infinite loop in printer_read()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-64584
    - usb: gadget: f_midi: cancel pending IN work before freeing the midi
      object
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68370
    - usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68371
    - usb: musb: omap2430: Do not put borrowed of_node in probe
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68373
    - wifi: at76c50x-usb: avoid length underflow in at76_guess_freq()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68374
    - usb: core: sysfs: add lock to bos_descriptors_read()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-64569
    - mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68376
    - sctp: fix auth_hmacs array size in struct sctp_cookie
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68377
    - net/sched: act_tunnel_key: Defer dst_release to RCU callback
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68378
    - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68379
    - tcp: fix TIME_WAIT socket reference leak on PSP policy failure
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68380
    - accel/amdxdna: Fix use-after-free of mm_struct in job scheduler
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-64578
    - ksmbd: validate compound request size before reading StructureSize2
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68381
    - ksmbd: pin conn during async oplock break notification
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68384
    - drm/xe/vf: Fix VF CCS attach/detach race with in-flight BO moves
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68385
    - s390/checksum: Fix csum_partial() without vector facility
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68386
    - bpf, sockmap: Reject unhashed UDP sockets on sockmap update
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68387
    - can: raw: add locking for raw flags bitfield
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68388
    - smb/client: handle overlapping allocated ranges in fallocate
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68389
    - Bluetooth: hci_qca: Clear memdump state on invalid dump size
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68391
    - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68392
    - Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68393
    - Bluetooth: hci_sync: extend conn_hash lookup critical sections
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68394
    - Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-64573
    - Bluetooth: qca: fix NVM tag length underflow in TLV parser
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68449
    - ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-
      scanning
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68395
    - ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is
      registered
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68396
    - scsi: core: wake eh reliably when using scsi_schedule_eh
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68397
    - net/iucv: take a reference on the socket found in afiucv_hs_rcv()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-64572
    - ipv4: fib: free fib_alias with kfree_rcu() on insert error path
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68398
    - ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68400
    - firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset
      calculation
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68401
    - firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68402
    - wifi: cfg80211: bound element ID read when checking non-inheritance
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68403
    - wifi: brcmfmac: initialize SDIO data work before cleanup
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68405
    - wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68406
    - wifi: cfg80211: validate PMSR FTM preamble range
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68407
    - wifi: nl80211: free RNR data on MBSSID mismatch
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68408
    - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-64571
    - wifi: p54: validate RX frame length in p54_rx_eeprom_readback()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68409
    - wifi: mac80211: defer link RX stats percpu free to RCU
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68410
    - wifi: libertas: fix memory leak in helper_firmware_cb()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-64570
    - wifi: mac80211: fix fils_discovery double free on alloc failure
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-64568
    - wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68411
    - wifi: mac80211_hwsim: clamp virtio RX length before skb_put
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68412
    - wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68413
    - wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68414
    - wifi: cfg80211: cancel sched scan results work on unregister
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-64579
    - xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-64580
    - xfrm6: clear dst.dev on error to avoid double netdev_put in
      xfrm6_fill_dst()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-64566
    - xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68415
    - xfrm: clear mode callbacks after failed mode setup
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68416
    - mtd: fix double free and WARN_ON in add_mtd_device() error paths
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68417
    - RDMA/siw: publish QP after initialization
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68418
    - RDMA/irdma: Prevent user-triggered null deref on QP create
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68419
    - RDMA/irdma: Prevent rereg_mr for non-mem regions
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68420
    - xfrm: reject optional IPTFS templates in outbound policies
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68421
    - sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68444
    - firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68422
    - btrfs: fix root leak if its reloc root is unexpected in
      merge_reloc_roots()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-64567
    - btrfs: reject free space cache with more entries than pages
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68425
    - IB/mad: Drop unmatched RMPP responses before reassembly
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68426
    - xfrm: fix stale skb->prev after async crypto steals a GSO segment
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-64565
    - Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68427
    - gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-68428
    - KVM: x86/mmu: Fix use-after-free on vendor module reload
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-64562
    - KVM: nVMX: Hide shadow VMCS right after VMCLEAR
  * Resolute update: upstream stable patchset 2026-08-26 (LP: #2165189) //
    CVE-2026-64561
    - KVM: x86: Check for invalid/obsolete root *after* making MMU pages
      available
  * resolute: llvm-21-dev build-depends breaks cross-builds (LP: #2165407)
    - [Packaging] Fix cross-builds
  * Resolute Stable Update v6.18.40, v7.1.5 bugs (LP: #2165040)
    - accel/amdxdna: Allow forcing IOVA-based DMA via module parameter
    - SAUCE: bpf: Add missing NULL argument to zap_page_range_single
    - accel/amdxdna: Return ERR_PTR on dma_alloc_noncoherent failure
    - accel/amdxdna: Fix memory leak in amdxdna_iommu_alloc()
  * [SRU][HPE] Take Intel platform into account for old microcode checks
    (LP: #2161748)
    - x86/microcode: Refactor platform ID enumeration into a helper
    - x86/cpu: Add platform ID to CPU info structure
    - x86/cpu: Add platform ID to CPU matching structure
    - x86/microcode: Add platform mask to Intel microcode "old" list
    - x86/microcode: Do not access MSR_IA32_PLATFORM_ID when running as a
      guest
  * ice: E810 interface fails to initialize (ice_init_hw failed: -5) during
    NVM read (LP: #2163508)
    - ice: acquire NVM lock around each flash read
  * WWAN modem unresponsive after freeze on Dell systems with DW5826e
    (LP: #2163214)
    - platform/x86: dell-dw5826e: Add reset driver for DW5826e
    - platform/x86: dell-dw5826e: fix ACPI _DSM function index and bitmask
      usage
    - [Config] Add CONFIG_DELL_DW5826E_RESET=m
  * amdgpu panel self-refresh on dual-gpu laptops causes complete built-in
    panel freeze and severe system instability (LP: #2162904)
    - SAUCE: drm/amdgpu: Do not enter PSR if multiple displays are active
  * linux 7.0: dw9719 VCM never binds, disabling all IPU3 cameras (regression,
    fixed upstream) (LP: #2162045)
    - media: dw9719: Add back the I²C device id table
  * Fix TAS2783 SoundWire amp resume timeout  >5s (LP: #2164967)
    - soundwire: Add a helper function to wait for device initialisation
    - ASoC: tas2783: Use new SoundWire enumeration helper
    - soundwire: Move wait for initialisation helper to header
    - ASoC: codecs: tas2783-sdw: Propagate regcache_sync() errors
    - ASoC: tas2783-sdw: drop stale regcache on uninitialized re-attach
  * Linux, Ubuntu, 24.04, System hangs for about 10 seconds when unplug
    external monitor cable on non TBT dock  (LP: #2160082)
    - SAUCE: drm/i915/tc: Revert forced DP-alt connected workaround
  * Speakers not detected on HP systems with TI TAS2783 SoundWire amps
    (LP: #2164504)
    - ASoC: sdw_utils: Add missed component_name strings for TI amps
  * [TWL][Desktop] intel_dmc_wait_fw_load()  merge to Ubuntu next release
    (LP: #2156316)
    - SAUCE: drm/i915/dmc: fix assert_dmc_loaded WARN during async firmware
      load
  * Reboot machine with ext4 configured to data=journal could dump spurious
    call trace (LP: #2164716)
    - ext4: clear stale xarray tags on folios skipped during writeback
  * [UBUNTU 22.04] s390/topology: Use zero-based numbering (LP: #2164516)
    - s390/topology: Use zero-based numbering for containing entities
  * Ethernet adapter unusable after suspend/resume on Advantech systems with
    Intel I226-V (LP: #2163375)
    - igc: fix netdev not re-attached after resume if interface is down
  * ice: fix stale -EBUSY on resume of Intel E810 (LP: #2162803)
    - ice: wait for reset completion in ice_resume()
  * idxd: crash-kernel NULL-pointer Oops in `destroy_workqueue()` breaks kdump
    on Intel DSA/IAA systems (LP: #2163062)
    - SAUCE: dmaengine: idxd: Do not call destroy_workqueue with null idxd->wq
    - SAUCE: dmaengine: idxd: fix duplicate memory frees on initialization
      error path.
  * [HP][ZBook Power 16 G11] Laptop freezed after upgrading the BIOS
    (LP: #2132119)
    - PCI/ASPM: Avoid L0s for Realtek RTS525A
  * Fix noise of audio output on more Dell QCx1255 models after reboot
    (LP: #2163293)
    - ALSA: hda/realtek - Add quirk for Dell Pro QC1255
  * Fix no audio input/output device on Dell WCL Slate platform with
    CirrusLogic audio solution (LP: #2160200)
    - ASoC: SDCA: fix the register to ctl value conversion for Q7.8 format
    - ASoC: SOF: ipc4-control: Use local copy of IPC message for sending
  * Fix no audio output and mute hotkey not working on HP ZBook 8 G2a
    (LP: #2158858)
    - ALSA: hda/realtek: Add inverted LED quirk for HP ZBook 8 G2a
  * Dock ethernet stops working after Thunderbolt dock unplug on Dell systems
    (LP: #2162704)
    - usb: core: port: Deattach Type-C connector on component unbind
  * USB-C alt mode dropped with false firmware bug warning on Dell systems
    (LP: #2162695)
    - Revert "usb: typec: ucsi: Detect and skip duplicate altmodes from buggy
      firmware"
    - Revert "usb: typec: ucsi: Add duplicate detection to nvidia registration
      path"
    - Revert "usb: typec: ucsi: yoga_c630: Remove redundant duplicate altmode
      handling"
    - usb: typec: ucsi: Detect and skip duplicate altmodes from buggy firmware
    - usb: typec: ucsi: Add duplicate detection to nvidia registration path
    - usb: typec: ucsi: yoga_c630: Remove redundant duplicate altmode handling
  * Resolute update: upstream stable patchset 2026-08-20 (LP: #2164666)
    - crypto: algif_skcipher - force synchronous processing
    - crypto: sun4i-ss - Remove insecure and unused rng_alg
    - [Config] Remove unused CRYPTO_DEV_SUN4I_SS_PRNG
    - media: uvcvideo: Fix deadlock if uvc_status_stop is called from
      async_ctrl.work
    - bpf: Clear delta when clearing reg id for non-{add,sub} ops
    - selftests/bpf: Add tests for delta tracking when src_reg == dst_reg
    - selftests/bpf: Add tests for stale delta leaking through id reassignment
    - ALSA: hda/realtek: Add quirk for TongFang X6xx45xU
    - ALSA: hda: conexant: Remove mic bias threshold override
    - ALSA: hda: Fix cached processing coefficient verbs
    - ALSA: hda/realtek: Fix speakers on Legion Pro 7 16ARX8H with codec SSID
      17aa:38a7
    - media: uvcvideo: Use hw timestaming if the clock buffer is full
    - media: uvcvideo: Avoid partial metadata buffers
    - media: uvcvideo: Fix buffer sequence in frame gaps
    - media: uvcvideo: Fix dev_sof filtering in hw timestamp
    - media: uvcvideo: Do not add clock samples with small sof delta
    - media: uvcvideo: Relax the constrains for interpolating the hw clock
    - media: uvcvideo: Fix sequence number when no EOF
    - dt-bindings: media: sun4i-a10-video-engine: Add interconnect properties
    - dt-bindings: power: imx93: Add MIPI PHY power domain
    - serial: msm: Disable DMA for kernel console UART
    - serial: max310x: implement gpio_chip::get_direction()
    - serial: 8250_omap: clear rx_running on zero-length DMA completes
    - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc
    - rxrpc: Fix socket notification race
    - rxrpc: Fix leak of released call in recvmsg(MSG_PEEK)
    - rxrpc: Fix potential infinite loop in rxrpc_recvmsg()
    - rxrpc: Fix rxrpc_rotate_tx_rotate() to check there's something to rotate
    - rxrpc: Fix oob challenge leak in cleanup after notification failure
    - rxrpc: Fix ACKALL packet handling
    - rxrpc: Fix the reception of a reply packet before data transmission
    - rxrpc: Fix leak of connection from OOB challenge
    - afs: fix NULL pointer dereference in afs_get_tree()
    - afs: handle CB.InitCallBackState3 requests without a server record
    - afs: Fix uncancelled rxrpc OOB message handler
    - fbcon: fix NULL pointer dereference for a console without vc_data
    - fbcon: Use correct type for vc_resize() return value
    - openrisc: mm: Fix section mismatch between map_page and __set_fixmap
    - clocksource/drivers/sun5i: Handle error returns from
      devm_reset_control_get_optional_exclusive()
    - accel/amdxdna: Fix leak when pinning ubuf pages
    - drm/rockchip: dw_dp: Switch to drmm_kzalloc()
    - drm/rockchip: dw_dp: Fix null-ptr-deref in dw_dp_remove()
    - drm/rockchip: Test for imported buffers with drm_gem_is_imported()
    - drm/tidss: Drop extra drm_mode_config_reset() call
    - drm/gpusvm: Reject VMAs with VM_IO or VM_PFNMAP when creating SVM ranges
    - drm/gpuvm: Do not prepare NULL objects
    - drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch()
    - drm/radeon: fix integer overflow in radeon_align_pitch()
    - drm/radeon: fix memory leak in radeon_ring_restore() on lock failure
    - libbpf: Report error when a negative kprobe offset is specified
    - selftests/bpf: Fix off-by-one in bpf_cpumask_populate related selftest
    - dt-bindings: timer: Remove sifive,fine-ctr-bits property
    - drm/amd/pm: remove trailing semicolon from AMDGPU_PM_POLICY_ATTR macro
    - selftests/bpf: Use local type for flow_offload_tuple_rhash in
      xdp_flowtable
    - selftests/bpf: Use local type for bpf_fou_encap in test_tunnel_kern
    - Documentation: proc: fix section numbering in table of contents
    - arm64: dts: rockchip: fix Ethernet PHY not found on PX30 Cobra
    - arm64: dts: rockchip: Fix gmac0 reset pin for NanoPi R5S
    - arm64: dts: qcom: ipq5424: Fix USB simple_bus_reg warnings
    - arm64: dts: qcom: sc8180x: Fix phy simple_bus_reg warning
    - arm64: dts: qcom: sdm845-mezzanine: Fix camss ports unit_address_vs_reg
      warning
    - wifi: cfg80211: fix grammar in MLO group key error message
    - arm64: tegra: Fix Tegra234 MGBE PTP clock
    - dt-bindings: pinctrl: nvidia,tegra234: Add missing required block
    - drm/amdkfd: Validate CRIU-restored IDs before idr_alloc
    - driver core: use READ_ONCE() for dev->driver in dev_has_sync_state()
    - wifi: rtw89: fix wrong pci_get_drvdata type in AER handlers
    - wifi: rtw88: fix wrong pci_get_drvdata type in AER handlers
    - wifi: rtw89: Correct data type for scan index to avoid infinite loop
    - wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA
      buffer
    - wifi: rtw89: add bounds check on firmware mac_id in link lookup
    - kconfig: fix potential NULL pointer dereference in conf_askvalue
    - soc: xilinx: Shutdown and free rx mailbox channel
    - pinctrl: mediatek: eint: Drop base from mtk_eint_chip_write_mask()
    - wifi: ath9k: fix OOB access from firmware tx status queue ID
    - ARM: dts: am335x-sl50: Fix audio bitclock and frame master endpoint
    - Documentation/rv: Replace stale website link
    - watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH
    - watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5
    - watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register
      failure
    - media: cedrus: Fix failure to clean up hardware on probe failure
    - media: v4l2-common: Add YUV24 format info
    - memory: tegra: Wire up system sleep PM ops
    - crypto: qat - fix heartbeat error injection
    - lib/vsprintf: Fix to check field_width and precision
    - dts: spacemit: set console baud rate on bpif3
    - pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path
    - dt-bindings: vendor-prefixes: Add Displaytech Ltd.
    - drm/gpuvm: take refcount on DRM device
    - drm/panel: Clean up S6E3HA2 config dependencies and fill help text
    - ARM: dts: rockchip: Add #{address,size}-cells to Chromium-based
      /firmware
    - arm64: dts: rockchip: Add #{address,size}-cells to Chromium-based
      /firmware
    - arm64: dts: rockchip: fix rk809 interrupt pin on rk3566-roc-pc
    - arm64: dts: imx8x-colibri: Correct SODIMM PAD settings
    - Revert "arm64: dts: imx8mm-kontron: Add support for reading SD_VSEL
      signal"
    - Revert "arm64: dts: imx8mp-kontron: Add support for reading SD_VSEL
      signal"
    - drm: renesas: rz-du: mipi_dsi: Fix return path on error
    - alarmtimer: Remove stale return description from alarm_handle_timer()
    - OPP: Fix race between OPP addition and lookup
    - crypto: ccp - Reverse the cleanup order in psp_dev_destroy()
    - crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one
    - crypto: atmel-sha204a - fix blocking and non-blocking rng logic
    - crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve
    - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents
    - ARM: multi_v7_defconfig: Correct QCOM_RPMH and QCOM_RPMHPD
    - nilfs2: fix backing_dev_info reference leak
    - media: qcom: camss: vfe: fix PIX subdev naming on VFE lite
    - media: iris: scale MMCX power domain on SM8250
    - media: venus: scale MMCX power domain on SM8250
    - iommu/amd: Fix a stale comment about which legacy mode is user visible
    - soc: mediatek: mtk-mmsys: Restore MT8167 routing masks lost during merge
    - bpf: fix crash in bpf_[set|remove]_dentry_xattr for negative dentries
    - uaccess: fix ignored_trailing logic in copy_struct_to_user()
    - arm64: dts: mediatek: mt8192-asurada: Move PCIe DMA bounce buffer to
      host
    - rust: alloc: fix `Vec::extend_with` SAFETY comment
    - clk: scmi: Fix clock rate rounding
    - arm64: dts: qcom: kodiak: Fix ICE reg size
    - arm64: dts: qcom: sm8450: Fix ICE reg size
    - drm/hisilicon/hibmc: add updating link cap in DP detect()
    - drm/hisilicon/hibmc: fix no showing when no connectors connected
    - drm/hisilicon/hibmc: move display contrl config to hibmc_probe()
    - drm/hisilicon/hibmc: use clock to look up the PLL value
    - evm: terminate and bound the evm_xattrs read buffer
    - thermal: hwmon: Fix critical temperature attribute removal
    - clk: scpi: Unregister child clock providers on remove
    - net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats()
    - scsi: hisi_sas: Add slave_destroy interface for v3 hw
    - crypto: ccp - Treat zero-length cert chain as query for blob lengths
    - spi: hisi-kunpeng: Use dev_err_probe() for host registration failure
    - net/sched: sch_htb: do not change sch->flags in htb_dump()
    - net/sched: sch_htb: annotate data-races (I)
    - IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier
    - RDMA/hns: Fix arithmetic overflow in calc_hem_config()
    - RDMA/mlx5: Fix UMR XLT cleanup on ODP populate failure
    - RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference
    - RDMA/hns: Initialize seqfile before creating file
    - drm/syncobj: Fix memory leak in drm_syncobj_find_fence()
    - selftests/bpf: Reject unsupported -k option in vmtest.sh
    - selftests/bpf: Fix test for refinement of single-value tnum
    - iommu/arm-smmu-qcom: Fix fastrpc compatible string in ACTLR client match
      table
    - selftests/mm: Fix resv_sz when parsing arm64 signal frame
    - firmware: arm_ffa: Honor partition info descriptor size
    - arm64: dts: imx8dxl-evk: Remove unnecessary PCIe EP properties
    - arm64: dts: imx8qxp-mek: Remove unnecessary PCIe EP vpcie-supply
    - arm64: dts: imx95-19x19-evk: Fix PCIe EP vpcie-supply
    - media: atomisp: Fix memory leak in atomisp_fixed_pattern_table()
    - media: atomisp: gc2235: fix UAF and memory leak
    - staging: media: atomisp: fix loop shadowing in ia_css_stream_destroy()
    - riscv: dts: spacemit: set console baud rate on Milk-V Jupiter
    - firmware: smccc: Fix Arm SMCCC SOC_ID name call
    - firmware: arm_scmi: Read sensor config as 32-bit value
    - sysfs: clamp show() return value in sysfs_kf_read()
    - bitops: use common function parameter names
    - regulator: dt-bindings: mt6359: Drop regulator-name pattern restrictions
    - tools/nolibc: getopt: Fix potential out of bounds access
    - nilfs2: Fix return in nilfs_mkdir
    - net/sched: sch_drr: annotate data-races around cl->deficit
    - media: rockchip: rga: fix too small buffer size
    - firmware: arm_scmi: Fix OOB in scmi_power_name_get()
    - arm64: dts: qcom: lemans: Add power-domain and iface clk for ice node
    - arm64: dts: qcom: monaco: Add power-domain and iface clk for ice node
    - arm64: dts: qcom: sc7180: Add power-domain and iface clk for ice node
    - arm64: dts: qcom: kodiak: Add power-domain and iface clk for ice node
    - arm64: dts: qcom: sm8450: Add power-domain and iface clk for ice node
    - arm64: dts: qcom: sm8550: Add power-domain and iface clk for ice node
    - arm64: dts: qcom: sm8650: Add power-domain and iface clk for ice node
    - arm64: dts: qcom: sm8750: Add power-domain and iface clk for ice node
    - tracing: Bound synthetic-field strings with seq_buf
    - arm64: dts: qcom: lemans: Add eDP ref clock for eDP PHYs
    - writeback: drop now-unnecessary rcu_barrier() in
      cgroup_writeback_umount()
    - kernfs: fix suspicious RCU usage in kernfs_put()
    - device property: fix fwnode reference leak in
      fwnode_graph_get_endpoint_by_id()
    - driver core: Use mod_delayed_work to prevent lost deferred probe work
    - Revert "treewide: Fix probing of devices in DT overlays"
    - of: dynamic: Fix overlayed devices not probing because of fw_devlink
    - crypto: eip93 - fix reset ring register definition
    - cpufreq: Documentation: fix sampling_down_factor range
    - cpufreq: conservative: Simplify frequency limit handling
    - pwm: imx27: Fix variable truncation in .apply()
    - RDMA/mana_ib: Use ib_get_eth_speed for reporting port speed
    - bus: sunxi-rsb: Always check register address validity
    - pinctrl: spacemit: fix NULL check in spacemit_pin_set_config
    - RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs
    - RDMA/rxe: Fix a use-after-free problem in rxe_mmap
    - IB/mlx4: Fix refcount leak in add_port() error path
    - RDMA/hns: Fix warning in poll cq direct mode
    - RDMA/hns: Fix log flood after cmd_mbox failure
    - RDMA/counter: Fix incorrect port index in rdma_counter_init() error
      cleanup
    - pinctrl: meson: amlogic-a4: fix gpio output glitch
    - PM: sleep: Use complete() in device_pm_sleep_init()
    - MIPS: Fix big-endian stack argument fetching in o32 wrapper
    - MIPS: DEC: Remove do_IRQ() call indirection
    - mips: ralink: mt7621: add missing __iomem
    - mips: n64: add __iomem for writel call
    - driver core: Fix missing jiffies conversion in
      deferred_probe_extend_timeout()
    - driver core: Guard deferred probe timeout extension with
      delayed_work_pending()
    - mtd: spi-nor: debugfs: Fix the flags list
    - mtd: spi-nor: Drop duplicate Kconfig dependency
    - ALSA: xen-front: Reset event channel state on stream clear
    - ALSA: xen-front: Connect event channel after stream prepare
    - ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data
    - ALSA: seq: midi: Serialize output teardown with event_input
    - selftests: Fix Makefile target for nsfs
    - pinctrl: nuvoton: ma35d1: fix MFP register offset and pin table
    - pinctrl: cs42l43: Fix leaked pm reference on error path
    - pinctrl: cs42l43: Fix polarity on debounce
    - init/initramfs_test: wait_for_initramfs() before running
    - nvmet-tcp: fix page fragment cache leak in error path
    - nvmet-tcp: check return value of nvmet_tcp_set_queue_sock
    - nvme-pci: fix out-of-bounds access in nvme_setup_descriptor_pools
    - workqueue: drop spurious '*' from print_worker_info() fn declaration
    - ipv6: guard against possible NULL deref in __in6_dev_stats_get()
    - net/sched: cls_bpf: prevent unbounded recursion in offload rollback
    - iommu/amd: Fix premature break in init_iommu_one()
    - rtla/actions: Restore continue flag in actions_perform()
    - drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X
      client is registered
    - drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove
    - gpu: host1x: Allow entries in BO caches to be freed
    - drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output()
    - gpu: host1x: Fix iommu_map_sgtable() return value check
    - drm/tegra: Fix iommu_map_sgtable() return value check
    - drm/nouveau/bios: specify correct display fuse register for Ampere and
      Ada
    - libbpf: Harden parse_vma_segs() path parsing
    - bpftool: Fix typo in struct_ops map FD generation for light skeleton
    - libbpf: Fix UAF in strset__add_str()
    - ARM: tegra: Add #{address,size}-cells to Chromium-based /firmware
    - arm64: tegra: Add #{address,size}-cells to Chromium-based /firmware
    - dax/kmem: account for partial discontiguous resource upon removal
    - rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc()
    - ocfs2: don't BUG_ON an invalid journal dinode
    - ocfs2: kill osb->system_file_mutex lock
    - crypto: hisilicon/qm - disable error report before flr
    - crypto: inside-secure/eip93 - Add check for devm_request_threaded_irq
    - crypto: tegra - Fix dma_free_coherent size error
    - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm
    - sched/deadline: Reject debugfs dl_server writes for offline CPUs
    - drm/msm/dp: fix HPD state status bit shift value
    - drm/msm/dp: Fix the ISR_* enum values
    - EDAC/igen6: Fix call trace due to missing release()
    - EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in
      skx_get_dimm_info
    - arm64: dts: st: Fix SAI addresses on stm32mp251
    - RDMA/umem: Add ib_umem_is_contiguous() stub for
      !CONFIG_INFINIBAND_USER_MEM
    - RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe
    - RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path
    - Revert "media: venus: hfi_platform: Correct supported codecs for sc7280"
    - media: qcom: venus: drop extra padding in NV12 raw size calculation
    - media: qcom: venus: relax encoder frame/blur dimension steps on v4
    - media: qcom: venus: relax encoder frame/blur step size on v6
    - amba: use generic driver_override infrastructure
    - cdx: use generic driver_override infrastructure
    - Drivers: hv: vmbus: use generic driver_override infrastructure
    - rpmsg: use generic driver_override infrastructure
    - raid1: fix nr_pending leak in REQ_ATOMIC bad-block error path
    - bpf: fix BPF_PROG_QUERY OOB write and cgroup backward compat
    - selftests/bpf: add verification for BPF_PROG_QUERY attr size boundaries
    - libbpf: Skip hash computation when loader generation failed
    - libbpf: Skip endianness swap when loader generation failed
    - ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data
      writeback
    - spi: atmel: fix DMA channel and bounce buffer leaks
    - ASoC: rsnd: Fix RSND_SOC_MASK width to single nibble
    - NFSD: Fix delegation reference leak in nfsd4_revoke_states
    - ARM: imx3: Fix CCM node reference leak
    - HID: wiimote: Fix table layout and whitespace errors
    - wifi: ath12k: fix incorrect HT/VHT/HE/EHT MCS reporting in monitor mode
    - wifi: ath12k: fix NULL deref in change_sta_links for unready link
    - ata: libata: Fix ata_exec_internal()
    - ARM: imx31: Fix IIM mapping leak in revision check
    - x86/cpu: Keep the PROCESSOR_SELECT menu together
    - nvdimm/btt: Handle preemption in BTT lane acquisition
    - scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-
      channel scans"
    - bpf: Reject exclusive maps as inner maps in map-in-map
    - libbpf: Reject non-exclusive metadata maps in the signed loader
    - libbpf: Skip initial_value override on signed loaders
    - libbpf: Skip max_entries override on signed loaders
    - scsi: pm8001: Fix error code in non_fatal_log_show()
    - scsi: ufs: Fix wrong value printed in unexpected UPIU response case
    - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs
    - mm/fake-numa: fix under-allocation detection in uniform split
    - ext2: fix ignored return value of generic_write_sync()
    - sched: restore timer_slack_ns when resetting RT policy on fork
    - driver core: Use system_percpu_wq instead of system_wq
    - bpf: Reject exclusive maps for bpf_map_elem iterators
    - tick/sched: Fix TOCTOU in nohz idle time fetch
    - lib/test_meminit: use && for bools
    - riscv: dts: sophgo: sg2044: use hex for CPU unit address
    - riscv: dts: sophgo: sg2042: use hex for CPU unit address
    - configfs_lookup(): don't leave ->s_dentry dangling on failure
    - lockdep/selftests: Restore migrate_disable() state on PREEMPT_RT
    - lockdep/selftests: Restore sched_rt_mutex state on PREEMPT_RT
    - ext4: fix fast commit wait/wake bit mapping on 64-bit
    - drm/amdgpu: set sub_block_index for mca ras sub-blocks
    - bpftool: Use libbpf error code for flow dissector query
    - vhost: fix vhost_get_avail_idx for a non empty ring
    - iommu/vt-d: Fix RB-tree corruption in probe error path
    - perf/x86/amd/core: Always use the NMI latency mitigation
    - perf/x86/intel/uncore: Fix discovery unit lookup for multi-die systems
    - perf/x86/amd/uncore: Use Node ID to identify DF and UMC domains
    - xfrm: fix NAT-related field inheritance in SA migration
    - cxl/fwctl: Fix __fortify_panic
    - drm/amdkfd: always resume_all after suspend_all
    - of: reserved_mem: avoid post-init UAF when alloc_reserved_mem_array()
      fails
    - ocfs2: rebase copied fsdlm LVB pointers in locking_state
    - lib: kunit_iov_iter: repeatedly call alloc_pages_bulk()
    - ocfs2: fix buffer head management in ocfs2_read_blocks()
    - ocfs2: reject FITRIM ranges shorter than a cluster
    - ocfs2/dlm: require a ref for locking_state debugfs open
    - ocfs2: fix race between ocfs2_control_install_private() and
      ocfs2_control_release()
    - netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures
    - netfilter: nfnetlink_cthelper: use {READ,WRITE}_ONCE for accessing
      helper flags
    - netfilter: synproxy: drop packets if timestamp adjustment fails
    - netfilter: synproxy: adjust duplicate timestamp options
    - netfilter: synproxy: fix unaligned memory access in timestamp adjustment
    - netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock
    - ALSA: usb-audio: qcom: Initialize offload control return value
    - x86/cpu: Remove obsolete aperfmperf_get_khz() declaration
    - netfilter: conntrack: revert ct extension genid infrastructure
    - netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper
      is pptp
    - RDMA/hfi1: Open-code rvt_set_ibdev_name()
    - IB/cm: Fix av cm device leak on an error path in cm_init_av_by_path()
    - ALSA: hda: fix Kconfig dependency of HD Audio PCI
    - RDMA/irdma: Fix OOB read during CQ MR registration
    - RDMA/irdma: Initialize iwmr->access during MR registration
    - arm64: dts: imx8mp-kontron: Reduce EERAM SPI clock frequency
    - arm64: dts: imx95: Correct PCIe outbound address space configuration
    - arm64: dts: lx2162a-clearfog: use rev2 SoC dtsi
    - arm64: dts: tqma8mpql-mba8mpxl: configure sai clock in audio codec as
      well
    - arm64: dts: imx8mp-kontron: Fix GPIO for display power switch
    - bpf: Clear rb node linkage when freeing bpf_rb_root
    - bpf: Check tail zero of bpf_map_info
    - bpf: Check tail zero of bpf_prog_info
    - bpf: Update transport_header when encapsulating UDP tunnel in lwt
    - wifi: wcn36xx: fix heap overflow from oversized firmware HAL response
    - wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO
      indication
    - wifi: wcn36xx: fix OOB read from short trigger BA firmware response
    - ALSA: seq: Fix partial userptr event expansion
    - riscv: cpu_ops: Change return value type of cpu_is_stopped() to bool
    - riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe
    - ALSA: seq: Clear variable event pointer on read
    - bpf: Fix NMI/tracepoint re-entry deadlock on lru locks
    - kunit:tool: Don't write to stdout when it should be disabled
    - powerpc/8xx: implement get_direction() in cpm1
    - bpf: Fix NULL pointer dereference in bpf_task_from_vpid()
    - ACPI: IPMI: Fix message kref handling on dead device
    - cpufreq: Documentation: fix conservative governor freq_step description
    - thermal: testing: reject missing command arguments
    - btrfs: don't force DIO writes to be serialized
    - IB/mlx5: Don't take the rereg_mr fallback without a new translation
    - IB/mlx5: Properly support implicit ODP rereg_mr
    - IB/mlx5: Remove unused mkc bits in mlx5r_umr_update_mr_page_shift()
    - IB/mlx5: Pull the pdn out of the depths of the umr machinery
    - IB/mlx5: Don't mangle the mr->pd inside the rereg callback
    - spi: ep93xx: fix double-free of zeropage on DMA setup failure
    - ASoC: amd: acp-sdw-legacy: Bound DAI link iteration
    - ASoC: amd: acp-sdw-sof: Bound DAI link iteration
    - firmware_loader: Fix recursive lock in device_cache_fw_images()
    - configfs: fix lockless traversals of ->s_children
    - watchdog: unregister PM notifier on watchdog unregister
    - pinctrl: qcom: Fix resolving register base address from device node
    - scsi: target: Fix hexadecimal CHAP_I handling
    - scsi: target: Remove tcm_loop target reset handling
    - pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins
      34-39
    - pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins
      34-39
    - vmalloc: fix NULL pointer dereference in is_vm_area_hugepages()
    - hwspinlock: qcom: avoid uninitialized struct members
    - sched/fair: Fix cpu_util runnable_avg arithmetic
    - ARM: configs: Drop duplicated CONFIG_EXT4_FS
    - wifi: mt76: mt7925: clean up DMA on probe failure
    - wifi: mt76: use kfree_rcu for offchannel link in mt76_put_vif_phy_link
    - wifi: mt76: mt7996: add missing max_remain_on_channel_duration
    - wifi: mt76: mt7925: fix stale pointer comparisons in change_vif_links
    - wifi: mt76: mt7925: keep TX BA state in the primary WCID
    - wifi: mt76: mt792x: skip MLD header rewrite for 802.3 encap TX
    - wifi: mt76: mt7925: validate skb length in testmode query
    - wifi: mt76: mt7996: Fix possible token leak in mt7996_tx_prepare_skb()
    - wifi: mt76: mt7996: Fix possible NULL pointer dereference in
      mt7996_mac_write_txwi_80211()
    - wifi: mt76: mt7996: fix reading zeroed info->control.flags after
      mt76_tx_status_skb_add()
    - wifi: mt76: mt7996: limit work in set_bitrate_mask
    - wifi: mt76: fix argument to ieee80211_is_first_frag()
    - wifi: mt76: mt7915: fix potential tx_retries underflow
    - wifi: mt76: mt7921: fix potential tx_retries underflow
    - wifi: mt76: mt7925: fix potential tx_retries underflow
    - wifi: mt76: mt7996: fix potential tx_retries underflow
    - btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs()
    - ALSA: aloop: Drop superfluous break
    - gpio: mt7621: fix interrupt banks mapping on gpio chips
    - wifi: ath12k: enable IEEE80211_VHT_EXT_NSS_BW_CAPABLE when NSS ratio is
      reported
    - fbdev: sm501fb: Fix buffer errors in OF binding code
    - vfs: add FS_USERNS_DELEGATABLE flag and set it for NFS
    - hwmon: (it87) Clamp negative values to zero in set_fan()
    - btrfs: zoned: don't account data relocation space-info in statfs free
      space
    - Revert "btrfs: fix the file offset calculation inside
      btrfs_decompress_buf2page()"
    - btrfs: zoned: always set max_active_zones for zoned devices
    - btrfs: annotate lockless read of defrag_bytes in should_nocow()
    - btrfs: fix deadlock cloning inline extent when using flushoncommit
    - igc: skip RX timestamp header for frame preemption verification
    - ASoC: sma1307: Fix uevent string leaks in fault worker
    - IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified
    - NFSD: Handle layout stid in nfsd4_drop_revoked_stid()
    - spi: meson-spifc: fix runtime PM leak on remove
    - ASoC: codecs: aw88261: fix incorrect masks for boost regs
    - vduse: hold vduse_lock across IDR lookup in open path
    - vhost/vdpa: validate virtqueue index in mmap and fault paths
    - virtio: rtc: tear down old virtqueues before restore
    - virtio_console: read size from config space during device init
    - vduse: Requeue failed read to send_list head
    - tools/virtio: check mmap return value in vringh_test
    - vdpa/octeon_ep: Fix PF->VF mailbox data address calculation
    - vdpa/octeon_ep: fix IRQ-to-ring mapping in interrupt handler
    - ASoC: cs35l56: Fix missing calls to wm_adsp2_remove()
    - ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails
    - ext4: fix ERR_PTR(0) in ext4_mkdir()
    - tools: missed broadcast_neigh if_link uapi header
    - netlink: specs: rt-link: missed broadcast-neigh
    - bonding: 3ad: add lacp_strict configuration knob
    - bonding: 3ad: fix carrier when no usable slaves
    - bonding: 3ad: fix mux port state on oper down
    - ext4: fix kernel BUG in ext4_write_inline_data_end
    - selftests/bpf: Fix bpf_iter/task_vma test
    - cxl/test: Fix integer overflow in mock LSA bounds checks
    - cxl/test: Zero out LSA backing memory to avoid leaking to user
    - of: cpu: add check in __of_find_n_match_cpu_property()
    - vfio/qat: fix f_pos race in qat_vf_resume_write()
    - bpf: Tighten cgroup storage cookie checks for prog arrays
    - pinctrl: sunxi: a523: Remove unneeded IRQ remuxing flag
    - pinctrl: airoha: an7581: add missed gpio32 pin group
    - pinctrl: airoha: an7581: fix misprint in gpio19 pinconf
    - arm64: dts: allwinner: a523: Add missing GPIO interrupt
    - ASoC: cs35l56: Fix possible uninitialized value in
      cs35l56_spi_system_reset()
    - s390/process: Fix kernel thread function pointer type
    - Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for
      non-serdev device
    - Bluetooth: eir: Fix stack OOB write when prepending the Flags AD
    - Bluetooth: hci_event: fix simultaneous discovery stuck in FINDING
    - Bluetooth: hci_core: Fix UAF in hci_unregister_dev()
    - Bluetooth: btmtk: fix URB leak in alloc_mtk_intr_urb error path
    - Bluetooth: hci: validate codec capability element length
    - Bluetooth: vhci: validate devcoredump state before side effects
    - fs: efs: remove unneeded debug prints
    - RDMA/mlx5: Remove DCT restrack tracking
    - RDMA/mlx5: Remove raw RSS QP restrack tracking
    - RDMA/mlx5: Fix undefined shift of user RQ WQE size
    - RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one
    - ASoC: SOF: Intel: hda-sdw-bpt: select SND_SOF_SOF_HDA_SDW_BPT properly
    - ASoC: codecs: hdac_hdmi: Validate written enum value
    - ASoC: fsl: fsl_audmix: Validate written enum values
    - ASoC: tegra: tegra210_ahub: Validate written enum value
    - net: dsa: qca8k: fix led devicename when using external mdio bus
    - net/sched: cls_flow: Dont expose folded kernel pointers
    - net: fib_rules: Don't dump dying fib_rule in fib_rules_dump().
    - bridge: cfm: reject invalid CCM interval at configuration time
    - net: pfcp: allocate per-cpu tstats for PFCP netdevs
    - net/sched: sch_hfsc: Don't make class passive twice
    - tipc: require net admin for TIPCv2 netlink mutators
    - tipc: prevent snt_unacked underflow on CONN_ACK
    - tipc: reject inverted service ranges from peer bindings
    - cxl/test: Unregister cxl_acpi in cxl_test_init() error path
    - cxl/test: Add check after kzalloc() memory in alloc_mock_res()
    - crypto: marvell/octeontx - fix DMA cleanup using wrong loop index
    - crypto: cavium/cpt - fix DMA cleanup using wrong loop index
    - crypto: rng - Free default RNG on module exit
    - ALSA: usb-audio: qcom: Guard sideband endpoint removal
    - ALSA: seq: Fix kernel heap address leak in bounce_error_event()
    - spi: xilinx: use FIFO occupancy register to determine buffer size
    - iommu: Avoid copying the user array twice in the full-array copy helper
    - ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO
    - power: supply: core: fix supplied_from allocations
    - handshake: Require admin permission for DONE command
    - virtio_net: do not allow tunnel csum offload for non GSO packets
    - net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during
      peek before restoring qlen
    - net/sched: sch_dualpi2: Do not call qdisc_tree_reduce_backlog during
      peek before restoring qlen
    - net: mana: initialize gdma queue id to INVALID_QUEUE_ID
    - net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check
    - net: watchdog: fix refcount tracking races
    - net: ethernet: mtk_wed: fix loading WO firmware for MT7986
    - net/sched: sch_dualpi2: Add missing module alias
    - bpf: Run generic devmap egress prog on private skb
    - net/mlx5: Check max_macs devlink param value against max capability
    - bpf: Fix setting retval to -EPERM for cgroup hooks not returning errno
    - octeontx2-af: npc: Fix size of entry2cntr_map
    - net: ethernet: mtk_wed: debugfs: correct index in wed_amsdu_show()
    - net: wwan: t7xx: check skb_clone in control TX
    - dpll: fix stale iteration in dpll_pin_on_pin_unregister()
    - dpll: send delete notification before unregister in on-pin rollback
    - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister()
    - dpll: guard sync-pair removal on full pin unregister
    - dpll: balance create/delete notifications in __dpll_pin_(un)register
    - landlock: Fix unmarked concurrent access to socket family
    - net: bcmgenet: Use weighted round-robin TX DMA arbitration
    - net: airoha: Fix register index for Tx-fwd counter configuration
    - net: airoha: Fix debugfs new-tuple display for IPv4 ROUTE entries
    - kcm: use WRITE_ONCE() when changing lower socket callbacks
    - ALSA: seq: oss: Serialize readq reset state with q->lock
    - ALSA: seq: avoid stale FIFO cells during resize
    - netfilter: nf_conncount: callers must hold rcu read lock
    - ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait()
    - cifs: remove all cifs files before kill super
    - smb/client: always return a value for FS_IOC_GETFLAGS
    - selftests/bpf: Fix typo in verify_umulti_link_info
    - selftests/bpf: Initialize operation name before use
    - bpf: Fix bpf_get/setsockopt to tos for ipv4-mapped ipv6 socket
    - udf: fix nls leak on udf_fill_super() failure
    - bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()
    - net: remove addr_len argument of recvmsg() handlers
    - sockmap: Fix use-after-free in udp_bpf_recvmsg()
    - bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check
    - MIPS: mm: Fix out-of-bounds write in maar_res_walk()
    - powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del
    - powerpc/powernv: fix preempt count leak in
      pnv_kexec_wait_secondaries_down
    - powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus
    - KEYS: Use acquire when reading state in keyring search
    - tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)
    - net: airoha: Fix always-true condition in PPE1 queue reservation loop
    - net: ethernet: oa_tc6: Remove FCS size in RX frame
    - ionic: Fix check in ionic_get_link_ext_stats
    - RDMA/bnxt_re: Free SRQ toggle page after firmware teardown
    - RDMA/bnxt_re: Avoid displaying the kernel pointer
    - RDMA/bnxt_re: Fail DBR related page allocation UAPIs if the feature is
      disabled
    - ksmbd: fix use-after-free in same_client_has_lease()
    - mfd: rsmu: Fix page register setup
    - mfd: cs42l43: Sanity check firmware size
    - ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write
    - 9p: avoid returning ERR_PTR(0) from mkdir operations
    - eventpoll: rename ep_remove_safe() back to ep_remove()
    - eventpoll: expand top-of-file overview / locking doc
    - eventpoll: rename attach_epitem() to ep_attach_file()
    - eventpoll: split ep_insert() into alloc + register stages
    - eventpoll: extract ep_deliver_event() from ep_send_events()
    - eventpoll: wrap EP_UNACTIVE_PTR in typed sentinel helpers
    - eventpoll: rename epi->next and txlist for clarity
    - eventpoll: Fix epoll_wait() report false negative
    - gpiolib: acpi: Only trigger ActiveBoth interrupts on boot
    - i3c: master: svc: Fix missed IBI after false SLVSTART on NPCM845
    - staging: nvec: fix use-after-free in nvec_rx_completed()
    - perf debuginfo: Fix libdw API contract violations
    - coresight: cti: Fix DT filter signals silently ignored
    - soundwire: don't program SDW_SCP_BUSCLOCK_SCALE on a unattached
      Peripheral
    - soundwire: fix bug in sdw_add_element_group_count found by syzkaller
    - coresight: ete: Always save state on power down
    - coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore
    - PCI/ASPM: Don't reconfigure ASPM entering low-power state
    - PCI: Introduce named defines for PCI ROM
    - PCI: Check ROM header and data structure addr before accessing
    - x86/platform/olpc: xo15: Drop wakeup source on driver removal
    - platform/x86: xo15-ebook: Fix wakeup source and GPE handling
    - perf sched: Add missing mmap2 handler in timehist
    - PCI: loongson: Do not ignore downstream devices on external bridges
    - rust: alloc: fix assert in `Vec::reserve` doc test
    - bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker()
    - coresight: fix missing error code when trace ID is invalid
    - clk: qcom: cmnpll: Account for reference clock divider
    - phy: phy-can-transceiver: Check driver match and driver data against
      NULL
    - perf pmu: Skip test on Arm64 when #slots is zero
    - clk: at91: sam9x7: Fix gmac_gclk clock definition
    - soundwire: intel_ace2x: release bpt_stream when close it
    - coresight: Fix source not disabled on idr_alloc_u32 failure
    - mailbox: mpfs: fix check for syscon presence in mpfs_mbox_inbox_isr()
    - mailbox: mtk-adsp: fix UAF during device teardown
    - PCI: dwc: Fix signedness bug in fault injection test code
    - perf build-id: Fix off-by-one bug when printing kernel/module build-id
    - staging: most: video: avoid double free on video register failure
    - usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control()
    - usb: host: max3421: Reject hub port requests for non-existent ports
    - perf test amd ibs: Fix incorrect kernel version check
    - gpib: Fix inappropriate ioctl error return
    - char: tlclk: fix use-after-free in tlclk_cleanup()
    - gpib: fix double decrement of descriptor_busy in command_ioctl()
    - clk: renesas: rzg2l: Rename iterator in for_each_mod_clock() to avoid
      shadowing
    - powerpc tools perf: Initialize error code in auxtrace_record_init
      function
    - PCI: qcom: Disable ASPM L0s for SA8775P
    - perf header: Sanity check HEADER_EVENT_DESC attr.size before swap
    - iio: light: si1133: reset counter to prevent race condition
    - iio: light: si1133: prevent race condition on timeout
    - iio: magnetometer: ak8975: fix potential kernel stack memory leak
    - iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling
    - iio: accel: mma8452: handle I2C read error(s) in mma8452_read()
    - iio: tcs3472: power down chip on probe failure
    - clk: at91: keep securam node alive while mapping it
    - HID: logitech-hidpp: remove excess kernel-doc member in
      hidpp_scroll_counter
    - fs/ntfs3: add bounds check to run_get_highest_vcn()
    - fs/ntfs3: fix mount failure on 64K page-size kernels
    - drm/amd/display: Add missing kdoc for ALLM parameters
    - thunderbolt: debugfs: Fix margining error counter buffer leak
    - dmaengine: imx-sdma: Refine spba bus searching in probe
    - dt-bindings: dma: nvidia,tegra186-gpc-dma: Make reset optional
    - perf: Fix off-by-one stack buffer overflow in kallsyms__parse()
    - perf annotate: Fix crashes on empty annotate windows
    - perf tools: Guard test_bit from out-of-bounds sample CPU
    - perf sched: Fix thread reference leak in latency_switch_event
    - perf tools: Add bounds check to cpu__get_node()
    - perf sched: Cap max_cpu at MAX_CPUS in timehist sample processing
    - perf sched: Fix register_pid() overflow, strcpy, and BUG_ON
    - perf mmap: Guard cpu__get_node() return in aio_bind()
    - perf stat: Bounds-check CPU index in topology aggregation callbacks
    - perf c2c: Bounds-check CPU and node IDs before bitmap and array access
    - perf c2c: Bounds-check CPU IDs in setup_nodes() topology loop
    - perf sched: Clean up idle_threads entry on init failure
    - perf sched: Use thread__put() in free_idle_threads()
    - perf sched: Replace BUG_ON and add NULL checks in replay event helpers
    - perf mmap: Fix NULL deref in aio cleanup on alloc failure
    - perf stat: Introduce perf_env__get_cpu_topology() to guard NULL env->cpu
    - perf c2c: Fix use-after-free in he__get_c2c_hists() error path
    - perf timechart: Fix cpu2y() OOB read on untrusted CPU index
    - perf tools: Fix int16_t truncation of max_cpu_num in set_max_cpu_num()
    - dt-bindings: clock: qcom: Add X1P42100 camera clock controller
    - clk: qcom: camcc-x1e80100: Add support for camera QDSS debug clocks
    - mshv: add bounds check on vp_index in mshv_intercept_isr()
    - dmaengine: qcom: gpi: set DMA_PRIVATE capability
    - dmaengine: Fix possible use after free
    - dmaengine: dma-axi-dmac: Properly free struct axi_dmac_desc
    - dmaengine: dma-axi-dmac: use DMA pool to manange DMA descriptor
    - clk: qcom: a53: Corrected frequency multiplier for 1152MHz
    - sunrpc: Fix error handling in rpc_sysfs_xprt_switch_add_xprt_store()
    - pNFS/filelayout: fix cheking if a layout is striped
    - NFSv4/pnfs: defer return_range callbacks until after inode unlock
    - nfs: keep PG_UPTODATE clear after read errors in page groups
    - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect
      errors
    - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in
      pg_get_mirror_count_write
    - PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro
    - pwm: rzg2l-gpt: Add missing newlines to dev_err_probe() messages
    - PCI: meson: Propagate devm_add_action_or_reset() failure
    - PCI: meson: Add missing remove callback
    - fs/ntfs3: resize log->one_page_buf when adopting on-disk page size
    - platform/x86/intel/vsec: Decouple add/link helpers from PCI
    - platform/x86/intel/vsec: Switch exported helpers from pci_dev to device
    - platform/x86/intel/vsec: Return real error codes from registration path
    - platform/x86/intel/vsec: Restore BAR fallback for header walk
    - perf tools: Fix get_max_num() size_t underflow on empty sysfs file
    - perf tools: Use scnprintf() in cpu_map__snprint() to prevent overflow
    - perf tools: Use perf_env__get_cpu_topology() in machine__resolve()
    - PCI: rcar-host: Remove unused LIST_HEAD(res)
    - perf sched: Bounds-check prio before test_bit() in timehist
    - perf sched: Fix idle-hist callchain display using wrong rb_first variant
    - perf bpf: Use scnprintf() in snprintf_hex() and
      synthesize_bpf_prog_name()
    - perf hists: Fix snprintf() in hists__scnprintf_title() UID filter path
    - xprtrdma: Fix ep kref imbalance on ADDR_CHANGE
    - xprtrdma: Initialize re_id before removal registration
    - xprtrdma: Check frwr_wp_create() during connect
    - xprtrdma: Document and assert reply-handler invariants
    - xprtrdma: Resize reply buffers before reposting receives
    - xprtrdma: Sanitize the reply credit grant after parsing
    - xprtrdma: Repost Receive buffers for malformed replies
    - xprtrdma: Return sendctx slot after Send preparation failure
    - perf s390: Fix TEXTREL in Python extension by compiling as PIC
    - perf cs-etm: Queue context packets for frontend
    - perf pmu: Fix pmu_id() heap underwrite on empty identifier file
    - perf pmu: Fix perf_pmu__parse_scale/unit() OOB access on empty sysfs
      file
    - tools lib api: Fix missing null termination in filename__read_int/ull()
    - perf symbols: Fix signed overflow in sysfs__read_build_id() size check
    - perf symbols: Bounds-check .gnu_debuglink section data
    - perf intel-pt: Fix snprintf size tracking bug in insn decoder
    - perf tools: Fix thread__set_comm_from_proc() on empty comm file
    - perf hwmon: Fix off-by-one null termination on sysfs reads
    - perf hwmon: Use scnprintf() in hwmon_pmu__for_each_event()
    - perf hwmon: Fix parse_hwmon_filename() strlcpy buffer overflow
    - perf symbols: Bounds-check descsz in sysfs__read_build_id() GNU fallback
    - perf hwmon: Guard label read against empty or failed reads
    - perf tools: Use snprintf() in dso__read_running_kernel_build_id()
    - tools lib api: Fix filename__write_int() writing uninitialized stack
      data
    - tools lib api: Fix mount_overload() snprintf truncation and toupper
      range
    - perf bpf: Add NULL check for btf__type_by_id() in
      synthesize_bpf_prog_name()
    - perf bpf: Fix map data leak in bpf_metadata_create() on alloc failure
    - perf bpf: Fix metadata leak in perf_env__add_bpf_info() on duplicate
      insert
    - perf symbols: Add bounds checks to elf_read_build_id() note iteration
    - perf symbols: Add bounds checks to read_build_id() note iteration in
      minimal build
    - dt-bindings: phy: sc8280xp-qmp-pcie: Disallow bifurcation register on
      Purwa
    - PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port()
    - PCI: mediatek: Use actual physical address instead of virt_to_phys()
    - phy: freescale: phy-fsl-imx8qm-lvds-phy: Fix missing
      pm_runtime_disable() on probe error path
    - PCI: dwc: Avoid dwc_pcie_rasdes_debugfs_deinit() NULL dereference when
      no RAS DES capability
    - Revert "PCI/MSI: Unmap MSI-X region on error"
    - apparmor: fix shadowing of plabel that prevents cache from being updated
    - apparmor: fix race in unix socket mediation when peer_path is used
    - apparmor: fix refcount leak when updating the sk_ctx
    - security/apparmor/apparmorfs.c: conditionally compile
      get_loaddata_common_ref()
    - apparmor: check label build before no_new_privs test
    - apparmor: aa_label_alloc use aa_label_free on alloc failure
    - SAUCE: Revert "UBUNTU: SAUCE: apparmor5.0.0 [41/57]: apparmor-next 7.1:
      apparmor: fix rawdata_f_data implicit flex array"
    - apparmor: fix rawdata_f_data implicit flex array
    - SAUCE: Revert "UBUNTU: SAUCE: apparmor5.0.0 [38/57]: apparmor-next 7.1:
      apparmor: grab ns lock and refresh when looking up changehat child
      profiles"
    - apparmor: grab ns lock and refresh when looking up changehat child
      profiles
    - SAUCE: Revert "UBUNTU: SAUCE: apparmor5.0.0 [44/57]: apparmor-next 7.1:
      apparmor: fix potential UAF in aa_replace_profiles"
    - apparmor: fix potential UAF in aa_replace_profiles
    - SAUCE: Revert "UBUNTU: SAUCE: apparmor: fix NULL pointer dereference in
      unpack_pdb"
    - apparmor: fix NULL pointer dereference in unpack_pdb
    - apparmor: remove or add symlinks to rawdata according to export_binary
    - apparmor: Fix return in ns_mkdir_op
    - apparmor: fail policy unpack on accept2 allocation failure
    - apparmor: aa_getprocattr free procattr leak on format failure
    - apparmor: put secmark label after secid lookup
    - apparmor: don't audit files pointing to aa_null.dentry
    - apparmor: fix uninitialised pointer passed to
      audit_log_untrustedstring()
    - i3c: mipi-i3c-hci: Preserve RUN bit when aborting DMA ring
    - i3c: master: Make hot-join workqueue freezable to block hot-join during
      suspend
    - i3c: master: Move rstdaa error suppression
    - i3c: master: Consolidate Hot-Join DAA work in the core
    - i3c: master: Ensure Hot-Join operations are stopped on shutdown
    - i3c: master: Defer new-device registration out of DAA caller context
    - i3c: master: Prevent reuse of dynamic address on device add failure
    - apparmor: fix label can not be immediately before a declaration
    - accel/ivpu: fix HWS command queue leak on registration failure
    - sparc: led: avoid trimming a newline from empty writes
    - perf symbols: Fix bswap copy-paste error for 32-bit ELF p_filesz
    - perf symbols: Validate p_filesz before use in filename__read_build_id()
    - perf symbols: Break infinite loop on zero-filled notes in
      sysfs__read_build_id()
    - perf tools: Add O_CLOEXEC to open() calls in DSO and ELF code
    - perf tools: Fix uninitialized pathname on uncompressed fallback in
      filename__decompress()
    - perf dso: Fix heap overflow in dso__get_filename() on decompressed path
    - perf dso: Set error code when open() fails on uncompressed fallback path
    - perf tools: Use snprintf() for root_dir path construction
    - perf hwmon: Fix fd check to accept fd 0 in hwmon_pmu__describe_items()
    - perf sched: Replace (void*)1 sentinel with proper runtime allocation
    - perf bpf: Validate func_info_rec_size and sub_id in
      synthesize_bpf_prog_name()
    - perf bpf: Reject oversized BPF metadata events that truncate header.size
    - perf bpf: Bounds-check array offsets in bpil_offs_to_addr()
    - perf cs-etm: Reject CPU IDs that would overflow signed comparison
    - gpio: mlxbf3: fail probe if gpiochip registration fails
    - drm/i915: clear CRTC color blob pointers after dropping refs
    - drm/xe: Fix wa_oob codegen recipe for external module builds
    - spi: dw: fix wrong BAUDR setting after resume
    - i3c: master: Update dev_nack_retry_count under maintenance lock
    - i3c: master: Add missing runtime PM get in dev_nack_retry_count_store()
    - ALSA: usb-audio: qcom: Free sideband sg_table objects
    - xfrm: annotate data-races around xfrm_policy_count[] and
      xfrm_policy_default[]
    - xfrm: validate selector family and prefixlen during match
    - perf machine: Use snprintf() for guestmount path construction
    - perf cs-etm: Validate num_cpu before metadata allocation
    - perf cs-etm: Require full global header in auxtrace_info size check
    - perf cs-etm: Bounds-check CPU in cs_etm__get_queue()
    - perf bpf: Validate array presence before casting BPF prog info pointers
    - perf dso: Set standard errno on decompression failure
    - ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode
    - drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free
    - drm/amd/display: Fix mem_type change detection for async flips
    - drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm
    - drm/amdgpu: initialize irq.lock spinlock earlier
    - octeontx2-pf: Fix leak of SQ timestamp buffer on teardown
    - net: psample: fix info leak in PSAMPLE_ATTR_DATA
    - sctp: hold socket lock when dumping endpoints in sctp_diag
    - ALSA: usb-audio: qcom: reject stream disable with no active interface
    - ALSA: usb-audio: qcom: clear opened when stream enable fails
    - PCI: iproc: Restore .map_irq() for the platform bus driver
    - spi: rpc-if: Use correct device for hardware reinitialization on resume
    - virtio-net: fix len check in receive_big()
    - dpaa2-switch: fix VLAN upper check not rejecting bridge join
    - devlink: Fix parent ref leak in devl_rate_node_create()
    - devlink: Fix parent ref leak on tc-bw failure
    - net: airoha: fix foe_check_time allocation size
    - net: macb: add TX stall timeout callback to recover from lost TSTART
      write
    - flow_dissector: check device type before reading ETH_ADDRS
    - selftests: vlan_bridge_binding: Fix flaky operational state check
    - ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints
    - arm64/hw_breakpoint: reject unaligned watchpoints that would truncate
      BAS
    - thermal: intel: Fix dangling resources on thermal_throttle_online()
      failure
    - ACPI: resource: Amend kernel-doc style
    - ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone()
    - ieee802154: Restore initial state on failed device_rename() in
      cfg802154_switch_netns()
    - ieee802154: Avoid calling WARN_ON() on -ENOMEM in
      cfg802154_switch_netns()
    - ieee802154: Remove WARN_ON() in cfg802154_pernet_exit()
    - ieee802154: fix kernel-infoleak in dgram_recvmsg()
    - mac802154: Prevent overwrite return code in
      mac802154_perform_association()
    - md/raid1: honor REQ_NOWAIT when waiting for behind writes
    - md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on
      retry
    - netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer()
    - netfilter: ipset: make sure gc is properly stopped
    - netfilter: nft_payload: reject offsets exceeding 65535 bytes
    - netfilter: nft_meta_bridge: add validate callback for get operations
    - netfilter: nft_flow_offload: zero device address for non-ether case
    - netfilter: nf_reject: skip iphdr options when looking for icmp header
    - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak
    - mailbox: imx: Forward the timeout/ error in imx_mu_generic_tx()
    - irqchip/crossbar: Fix parent domain resource leak
    - alloc_tag: fix use-after-free in /proc/allocinfo after module unload
    - selftests/mm: restore default nr_hugepages value via exit trap in
      charge_reserved_hugetlb.sh
    - selftests/mm: restore default nr_hugepages value via exit trap in
      hugetlb_reparenting_test.sh
    - selftests/mm: fix hugetlb pathname construction in
      hugetlb_reparenting_test.sh
    - selftests/mm: fix cgroup task placement and drop memory.current checks
      in hugetlb_reparenting_test.sh
    - selftests/mm: size tmpfs according to PMD page size in
      split_huge_page_test
    - selftests/mm: free dynamically allocated PMD-sized buffers in
      split_huge_page_test
    - selftest/mm: register existing mapping with userfaultfd in hugetlb-
      mremap
    - selftests/mm: ensure destination is hugetlb-backed in hugetlb-mremap
    - selftests/mm: skip uffd-stress test when nr_pages_per_cpu is zero
    - selftests/mm: clarify alternate unmapping in compaction_test
    - selftests/mm: allow PUD-level entries in compound testcase of hmm tests
    - selftests/mm: fix exclusive_cow test fork() handling
    - net: marvell: prestera: initialize err in prestera_port_sfp_bind
    - tipc: fix use-after-free of the discoverer in tipc_disc_rcv()
    - net: ethernet: mtk_ppe: Fix rhashtable leak in mtk_ppe_init error paths
    - octeontx2-af: mcs: Fix unsupported secy stats read
    - octeontx2-pf: Clear stats of all resources when freeing resources
    - octeontx2-pf: mcs: Fix mcs resources free on PF shutdown
    - net: emac: Fix NULL pointer dereference in emac_probe
    - net/sched: act_ct: fix nf_connlabels leak on two error paths
    - net: airoha: Fix skb->priority underflow in airoha_dev_select_queue()
    - ipv6: ndisc: fix NULL deref in accept_untracked_na()
    - dpaa2-switch: do not accept VLAN uppers while bridged
    - rtc: abx80x: fix the RTC_VL_CLR clearing all status flags
    - rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231
    - bpf: Fix stack slot index in nospec checks
    - bpftool: Fix vmlinux BTF leak in cgroup commands
    - bpf: zero-initialize the fib lookup flow struct
    - bpf: Fix effective prog array index with BPF_F_PREORDER
    - power: sequencing: fix ABBA deadlock in pwrseq_device_unregister()
    - gpiolib: initialize return value in gpiochip_set_multiple()
    - drm/edid: fix OOB read in drm_parse_tiled_block()
    - PCI: endpoint: pci-epf-vntb: Add check to detect 'db_count' value of 0
    - PCI: endpoint: pci-epf-ntb: Add check to detect 'db_count' value of 0
    - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs()
    - ice: fix AQ error code comparison in ice_set_pauseparam()
    - ice: call netif_keep_dst() once when entering switchdev mode
    - rtc: isl1208: Balance enable_irq_wake() with disable_irq_wake() on
      cleanup
    - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info
    - ice: dpll: fix memory leak in ice_dpll_init_info error paths
    - i40e: Fix i40e_debug() to use struct i40e_hw argument
    - rtc: msc313: fix NULL deref in shared IRQ handler at probe
    - ipv6: Fix null-ptr-deref in fib6_nh_mtu_change().
    - eth: bnxt: rename ring_err_stats -> ring_drv_stats
    - eth: bnxt: improve the timing of stats
    - ipv4: fib: Don't ignore error route in local/main tables.
    - md/raid5: use stripe state snapshot in break_stripe_batch_list()
    - md/raid5: avoid R5_Overlap races while breaking stripe batches
    - bpf: Disable xfrm_decode_session hook attachment
    - netfilter: nf_nat: avoid invalid nat_net pointer use on failed
      nf_nat_init()
    - netfilter: nf_conncount: prevent connlimit drops for early confirmed ct
    - netfilter: nft_synproxy: stop bypassing the priv->info snapshot
    - netfilter: nft_compat: ebtables emulation must reject non-bridge targets
    - gpio: davinci: fix IRQ domain leak on devm_kzalloc failure
    - NTB: epf: Make db_valid_mask cover only real doorbell bits
    - NTB: epf: Report 0-based doorbell vector via ntb_db_event()
    - NTB: epf: Fix doorbell bitmask and IRQ vector handling
    - alpha/PCI: Add security_locked_down() check to pci_mmap_resource()
    - alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs
    - net, bpf: check master for NULL in xdp_master_redirect()
    - net: do not acquire dev->tx_global_lock in netdev_watchdog_up()
    - net: dsa: sja1105: round up PTP perout pin duration
    - veth: fix NAPI leak in XDP enable error path
    - net: usb: lan78xx: restore VLAN and hash filters after link up
    - ipv6: fix error handling in disable_ipv6 sysctl
    - ipv6: fix error handling in ignore_routes_with_linkdown sysctl
    - ipv6: fix error handling in forwarding sysctl
    - ipv6: fix error handling in disable_policy sysctl
    - ipv6: fix state corruption during proxy_ndp sysctl restart
    - ipv6: fix missing notification for ignore_routes_with_linkdown
    - eth: fbnic: fix ordering of heartbeat vs ownership
    - thermal: testing: zone: Flush work items during cleanup
    - ACPI: processor_idle: Mark LPI enter functions as __cpuidle
    - smb/client: preserve errors from smb2_set_sparse()
    - rtc: ds1307: Fix off-by-one issue with wday for rx8130
    - rtc: cmos: unregister HPET IRQ handler on probe failure
    - net: dsa: realtek: fix memory leak in rtl8366rb_setup_led()
    - net: phy: realtek: Clear MDIO_AN_10GBT_CTRL_ADV10G bit
    - octeontx2-af: Validate NIX maximum LFs correctly
    - net: mvneta: re-enable percpu interrupt on resume
    - net: sungem: fix probe error cleanup
    - net: ethernet: sunplus: spl2sw: fix phy_node refcount leak in remove
    - LoongArch: Move struct kimage forward declaration before use
    - LoongArch: BPF: Fix outdated tail call comments
    - LoongArch: BPF: Fix off-by-one error in tail call
    - ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count
    - net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync
    - dt-bindings: net: renesas,ether: Drop example "ethernet-phy-
      ieee802.3-c22" fallback
    - selftests: tls: size splice_short pipe by page size
    - net: hns3: unify copper port ksettings configuration path
    - net: hns3: refactor MAC autoneg and speed configuration
    - net: hns3: fix permanent link down deadlock after reset
    - net: hns3: differentiate autoneg default values between copper and fiber
    - ALSA: FCP: Fix NULL pointer dereference in interface lookup
    - tracing: probes: fix typo in a log message
    - spi: sh-msiof: abort transfers when reset times out
    - ACPI: RIMT: Only defer the IOMMU configuration in init stage
    - riscv: Fix 32-bit call_on_irq_stack() frame pointer ABI
    - gpio: mvebu: fail probe if gpiochip registration fails
    - gpio: htc-egpio: use managed gpiochip registration
    - net: pse-pd: scope pse_control regulator handle to kref lifetime
    - seg6: validate SRH length before reading fixed fields
    - qede: fix out-of-bounds check for cqe->len_list[]
    - sctp: fix SCTP_RESET_STREAMS stream list length limit
    - MIPS: DEC: Ensure RTC platform device deregistration upon failure
    - MIPS: mm: Add check for highmem before removing memory block
    - ASoC: codecs: lpass-va-macro: Fix LPASS Codec Version for SC7280
    - hwmon: adm1275: Prevent reading uninitialized stack
    - hwmon: (pmbus) Fix passing events to regulator core
    - hwmon: (aspeed-g6-pwm-tach) Guard fan RPM calculation against divide-by-
      zero
    - ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump
    - usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup()
    - net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy
    - net: libwx: fix VMDQ mask for 1-queue mode
    - net: gianfar: dispose irq mappings on probe failure and device removal
    - net/sched: sch_teql: Introduce slaves_lock to avoid race condition and
      UAF
    - bridge: stp: Fix a potential use-after-free when deleting a bridge
    - drm/panthor: Fix potential invalid pointer deref in
      group_process_tiler_oom()
    - drm/panthor: Don't overrule pending immediate ticks in
      sched_resume_tick()
    - drm/panthor: Fix a leak when a group is evicted before the tiler OOM is
      serviced
    - drm/panthor: Interrupt group start/resumption if group_bind_locked()
      fails
    - tracing/eprobes: Allow use of BTF names to dereference pointers
    - tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg
    - tracing/events: Fix to check the simple_tsk_fn creation
    - tracing: eprobe: read the complete FILTER_PTR_STRING pointer
    - tracing/fprobe: Fix NULL pointer dereference in fprobe_fgraph_entry()
    - tracing/probes: Make the $ prefix mandatory for comm access
    - irqchip/gic-v3-its: Fix OF node reference leak
    - irqchip/ts4800: Fix missing chained handler cleanup on remove
    - sctp: fix addr_wq_timer race in sctp_free_addr_wq()
    - virtio_net: disable cb when NAPI is busy-polled
    - cxgb4: Fix decode strings dump for T6 adapters
    - selftests: drv-net: tso: don't touch dangerous feature bits
    - net/sched: act_bpf: use rcu_dereference_bh() to read the filter
    - ksmbd: reject undersized DACLs before parsing ACEs
    - gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe
    - pinctrl: meson: restore non-sleeping GPIO access
    - net/sched: dualpi2: clear stale classification on filter miss
    - net/sched: hhf: clear heavy-hitter state on reset
    - fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid
    - afs: Fix error code in afs_extract_vl_addrs()
    - afs: Fix double netfs initialisation in afs_root_iget()
    - afs: use kvfree() to free memory allocated by kvcalloc()
    - afs: Remove erroneous seq |= 1 in volume lookup loop
    - afs: Fix bulk lookup malfunction due to change in dir_emit() API
    - afs: Fix misplaced inc of net->cells_outstanding
    - afs: Fix reinitialisation of the inode, in particular ->lock_work
    - afs: Fix callback service message parsers to pass through -EAGAIN
    - afs: Fix missing NULL pointer check in afs_break_some_callbacks()
    - afs: Fix vllist leak
    - afs: Fix lack of locking around modifications of net->cells_dyn_ino
    - afs: Fix premature cell exposure through /afs
    - afs: Fix the volume AFS_VOLUME_RM_TREE is set on
    - afs: Fix unchecked-length string display in debug statement
    - minix: avoid overflow in bitmap block count calculation
    - ovl: fix comment about locking order
    - iomap: guard io_size EOF trim against concurrent truncate underflow
    - netfs: Fix writethrough to use collection offload
    - netfs: Fix writeback error handling
    - netfs: Fix folio state after ENOMEM whilst under writeback iteration
    - drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry()
    - drm/xe/userptr: Hold notifier_lock for write on inject test path
    - drm/xe/hw_engine: Fix double-free of managed BO in error path
    - drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relays
    - x86/uprobes: Keep shadow stack in sync for emulated CALLs
    - uprobes/x86: Use proper mm_struct in __in_uprobe_trampoline
    - cifs: Fix missing credit release on failure in cifs_issue_read()
    - ata: sata_gemini: unwind clocks on IDE pinctrl errors
    - ata: libata-scsi: limit simulated SCSI command copy to response length
    - HID: picolcd: prevent NULL pointer dereference in
      picolcd_send_and_wait()
    - HID: core: Fix OOB read in hid_get_report for numbered reports
    - arm64/mm: Optimize TLB flush in unmap_hotplug_[pmd|pud]_range()
    - HID: bpf: Fix hid_bpf_get_data() range check
    - selftests/hid: Load only requested struct_ops maps
    - selftests/hid: Cover hid_bpf_get_data() size overflow
    - arm64/sysreg: Fix BWE field encoding in ID_AA64DFR2_EL1
    - net: usb: net1080: validate packet_len before pad-byte access in
      rx_fixup
    - netfilter: xt_u32: reject invalid shift counts
    - netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt()
    - netfilter: nft_set_rbtree: get command skips end element with open
      interval
    - netfilter: xt_connmark: reject invalid shift parameters
    - net/mlx5: LAG, MPESW, Fix missing complete() on devcom error
    - net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation
    - net/mlx5e: Fix HV VHCA stats agent registration race
    - net/mlx5e: Fix publication race for priv->channel_stats[]
    - net: microchip: vcap: fix races on the shared Super VCAP block
    - net: qualcomm: rmnet: validate MAP frame length before ingress parsing
    - net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload
    - amt: fix size calculation in amt_get_size()
    - Bluetooth: 6lowpan: hold L2CAP conn across debugfs control
    - Bluetooth: MGMT: Fix adv monitor add failure cleanup
    - Bluetooth: sco: Fix a race condition in sco_sock_timeout()
    - Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length
    - Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()
    - Bluetooth: L2CAP: fix tx ident leak for commands without a response
    - ring-buffer: Fix event length with forced 8-byte alignment
    - accel/amdxdna: Use unsigned long for nr_pages in amdxdna_hmm_register()
    - net/tls: Consume empty data records in tls_sw_read_sock()
    - net: usb: lan78xx: disable VLAN filter in promiscuous mode
    - gpio: dwapb: reduce allocation to single kzalloc
    - gpio: dwapb: Defer clock gating until noirq
    - tracing: Make tracepoint_printk static as not exported
    - accel/amdxdna: Fix potential amdxdna_umap lifetime race
    - drm/v3d: Reject invalid indirect BO handle in indirect CSD setup
    - net: mdio: select REGMAP_MMIO instead of depending on it
    - net/sched: cake: reject overhead values that underflow length
    - octeontx2-pf: check DMAC extraction support before filtering
    - perf/x86/amd/core: Avoid enabling BRS from the SVM reload path
    - gpio: mvebu: free generic chips on unbind
    - ipv4: igmp: annotate data-races around im->users
    - ipv4: igmp: annotate data-races around timer-related fields
    - ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and
      igmp_stop_timer()
    - ipvs: pass parsed transport offset to state handlers
    - ipvs: use parsed transport offset in TCP state lookup
    - s390/zcrypt: Remove the empty file
    - SUNRPC: release lower rpc_clnt if killed waiting for XPRT_LOCKED
    - dm era: fix NULL pointer dereference in metadata_open()
    - regulator: core: regulator_lock_two() should test for EDEADLK not
      EDEADLOCK
    - selftests/net: fix EVP_MD_CTX leak in tcp_mmap
    - net/mlx5: Fix L3 tunnel entropy refcount leak
    - octeontx2-af: fix VF bringup affecting PF promiscuous state
    - drm/xe: remove duplicate <kunit/test-bug.h> include
    - smb: client: fix overflow in passthrough ioctl bounds check
    - idpf: add padding to PTP virtchnl structures
    - mlxsw: fix refcount leak in mlxsw_sp_port_lag_join()
    - mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace()
    - vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter
    - ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put
    - ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc
    - ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get
    - ASoC: SOF: topology: validate vendor array size before parsing
    - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()
    - net: atm: reject out-of-range traffic classes in QoS validation
    - octeontx2-pf: clear stale mailbox IRQ state before request_irq()
    - octeontx2-vf: clear stale mailbox IRQ state before request_irq()
    - arm64: fpsimd: Fix type mismatch in sve_{save,load}_state()
    - arm64: dts: s32g3: Fix SWT8 watchdog address
    - ARM: dts: imx6ul-var-som: fix warning for non-existent dc-supply
      property
    - arm64: dts: qcom: sdm630: describe adsp_mem region properly
    - arm64: dts: rockchip: fix Ethernet PHY not found on PX30 Ringneck
    - ARM: dts: stm32: stm32mp15x-mecio1-io: Fix ADC sampling times
    - ARM: dts: stm32: stm32mp15x-mecio1-io: Move divergent mecio1 ADC
      channels to board files
    - arm64: dts: ti: k3-am62a7-sk: Add bootph-all tag to vqmmc
    - ARM: dts: stm32: stm32mp15x-mecio1-io: Enable internal ADC reference
    - arm64: dts: imx8ulp-evk: Correct Type-C int GPIO flags
    - ARM: dts: stm32: stm32mp15x-mecio1-io: Fix GPIO names typo
    - ARM: dts: stm32: stm32mp15x-mecio1-io: Move gpio-line-names to board
      files
    - ARM: dts: stm32: stm32mp15x-mecio1-io: Fix expander gpio line typo
    - ARM: dts: stm32: stm32mp15x-mecio1-io: Move expander gpio-line-names to
      board files
    - LoongArch: KVM: Validate irqchip index in irqfd routing
    - LoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt()
    - LoongArch: KVM: Check the return values for put_user()
    - LoongArch: KVM: Fix FPU register width with user access API
    - LoongArch: KVM: Return full old CSR value from kvm_emu_xchg_csr()
    - powerpc/pseries/Kconfig: Enable CONFIG_VPA_PMU to be used with KVM
    - KVM: s390: pci: Fix GISC refcount leak on AIF enable failure
    - KVM: s390: pci: Fix handling of AIF enable without AISB
    - KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs
    - KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs
    - KVM: x86: Nullify irqfd->producer if updating IRTE for bypass fails
    - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid
      guest state
    - KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers
    - KVM: arm64: nv: Drop bogus WARN for write to ZCR_EL2
    - KVM: arm64: nv: Write ESR_EL2 for injected nested SError exceptions
    - KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops()
    - fbdev: metronomefb: fix potential memory leak in metronomefb_probe()
    - fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe()
    - fbdev: hecubafb: fix potential memory leak in hecubafb_probe()
    - fbdev: sm712: Fix operator precedence in big_swap macro
    - fbdev: efifb: fix memory leak in efifb_probe()
    - fbdev: radeon: fix potential memory leak in radeonfb_pci_register()
    - fbdev: i740fb: fix potential memory leak in i740fb_probe()
    - fbdev: s3fb: fix potential memory leak in s3_pci_probe()
    - fbdev: uvesafb: fix potential memory leak in uvesafb_probe()
    - fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe()
    - fbdev: carminefb: fix potential memory leak in alloc_carmine_fb()
    - fbdev: vesafb: fix memory leak in vesafb_probe()
    - fbdev: nvidia: fix potential memory leak in nvidiafb_probe()
    - fbdev: tridentfb: fix potential memory leak in trident_pci_probe()
    - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get
    - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control
    - ASoC: mediatek: mt8192: Check runtime resume during probe
    - ASoC: mediatek: mt8192: Release reserved memory on cleanup
    - ASoC: mediatek: mt8183: Check runtime resume during probe
    - ASoC: mediatek: mt8183: Release reserved memory on cleanup
    - ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback
    - netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read
    - netfilter: nfnl_cthelper: apply per-class values when updating policies
    - netfilter: xt_cluster: reject template conntracks in hash match
    - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst
    - netfilter: nft_set_pipapo: don't leak bad clone into future transaction
    - netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6
      defrag
    - netfilter: nf_conncount: fix zone comparison in tuple dedup
    - netfilter: ecache: fix inverted time_after() check
    - netfilter: xt_nat: reject unsupported target families
    - netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()
    - gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error
      path
    - soc: ti: k3-ringacc: Fix access mode for
      k3_ringacc_ring_pop_tail_io/proxy
    - soc: fsl: qe: panic on ioremap() failure in qe_reset()
    - selinux: check connect-related permissions on TCP Fast Open
    - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()
    - selinux: fix incorrect execmem checks on overlayfs
    - leds: uleds: Fix potential buffer overread
    - mfd: sm501: Fix reference leak on failed device registration
    - tools/power/x86/intel-speed-select: Harden daemon pidfile open
    - x86/boot: Validate console=uart8250 baud rate to fix early boot hang
    - x86/boot: Reject too long acpi_rsdp= values
    - perf/x86/amd/brs: Fix kernel address leakage
    - perf/x86/amd/lbr: Fix kernel address leakage
    - cpufreq: schedutil: Fix uncleared need_freq_update on the .adjust_perf()
      path
    - cpufreq: intel_pstate: Set non-turbo capacity to HWP_GUARANTEED_PERF()
    - s390/perf_cpum_cf: Add missing array_index_nospec() to
      __hw_perf_event_init()
    - batman-adv: gw: acquire ethernet header only after skb realloc
    - batman-adv: retrieve ethhdr after potential skb realloc on RX
    - batman-adv: dat: acquire ARP hw source only after skb realloc
    - batman-adv: bla: reacquire gw address after skb realloc
    - batman-adv: dat: ensure accessible eth_hdr proto field
    - batman-adv: ensure minimal ethernet header on TX
    - batman-adv: dat: fix tie-break for candidate selection
    - batman-adv: tt: avoid request storms during pending request
    - batman-adv: fix VLAN priority offset
    - batman-adv: frag: free unfragmentable packet
    - batman-adv: clean untagged VLAN on netdev registration failure
    - batman-adv: frag: fix primary_if leak on failed linearization
    - batman-adv: mcast: avoid OOB read of num_dests header
    - cifs: invalidate cfid on unlink/rename/rmdir
    - mfd: tps6586x: Fix OF node refcount
    - HID: playstation: validate num_touch_reports in DualShock 4 reports
    - Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready
    - Bluetooth: SCO: hold sk properly in sco_conn_ready
    - jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit()
    - nvdimm/btt: Free arenas on btt_init() error paths
    - nvdimm/btt: Free arena sub-allocations on discover_arenas() error path
    - lockd: Plug nlm_file leak when nlm_do_fopen() fails
    - lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure
    - remoteproc: qcom: Fix leak when custom dump_segments addition fails
    - MIPS: ip22-gio: fix gio device memory leak
    - MIPS: ip22-gio: fix kfree() of static object
    - MIPS: ip22-gio: fix device reference leak in probe
    - MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf()
    - mm/mm_init: fix pageblock migratetype for ZONE_DEVICE compound pages
    - power: supply: cpcap-battery: Fix missing nvmem_device_put() causing
      reference leak
    - power: supply: max17042: fix OF node reference imbalance
    - mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch
    - mm/memory_hotplug: fix incorrect altmap passing in error path
    - mm/damon/core: make charge_addr_from aware of end-address exclusivity
    - fs/ntfs3: fix syncing wrong inode on DIRSYNC cross-directory rename
    - fs/ntfs3: bound DeleteIndexEntryAllocation memmove length
    - fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass
    - fs/ntfs3: bound attr_off in UpdateResidentValue against data_off
    - fs/ntfs3: validate lcns_follow in log_replay conversion
    - fs/ntfs3: bound NTFS_DE view.data_off in
      UpdateRecordData{Root,Allocation}
    - ntfs3: cap RESTART_TABLE free-chain walker at rt->used
    - ntfs3: fix out-of-bounds read in decompress_lznt
    - landlock: Fix LANDLOCK_SCOPE_SIGNAL bypass on the SIGIO path
    - power: supply: charger-manager: fix refcount leak in is_full_charged()
    - selftests/landlock: Test SCOPE_SIGNAL on the SIGIO/fowner pgid path
    - mips: sched: Fix CPUMASK_OFFSTACK memory corruption
    - riscv: cacheinfo: Fix node reference leak in populate_cache_leaves
    - mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs()
    - mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error
    - fs/proc/task_mmu: fix hugetlb self-deadlock in pagemap_scan_pte_hole()
    - fs/proc/task_mmu: use huge_page_size() in pagemap_scan_hugetlb_entry()
    - proc: only bump parent nlink when registering directories
    - fs/proc: fix KPF_KSM reported for all anonymous pages
    - powerpc/dt_cpu_ftrs: Set CPU_FTR_P11_PVR for Power11 and later
      processors
    - mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE
    - kcov: use WRITE_ONCE() for selftest mode stores
    - mtd: slram: remove failed entries from the device list
    - 9p: skip nlink update in cacheless mode to fix WARN_ON
    - power: supply: bq257xx: Fix VSYSMIN clamping logic
    - scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished()
    - scsi: sas: Skip opt_sectors when DMA reports no real optimization hint
    - openrisc: Add full instruction cache invalidate functions
    - ocfs2: use kzalloc for quota recovery bitmap allocation
    - mtd: rawnand: pl353: fix probe resource allocation
    - net/9p: fix infinite loop in p9_client_rpc on fatal signal
    - mtd: rawnand: fix condition in 'nand_select_target()'
    - ocfs2: avoid moving extents to occupied clusters
    - ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits
    - ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec
    - ocfs2: add journal NULL check in ocfs2_checkpoint_inode()
    - ocfs2: reject dinodes with non-canonical i_mode type
    - ocfs2: reject dinodes whose i_rdev disagrees with the file type
    - ocfs2: reject non-inline dinodes with i_size and zero i_clusters
    - fpga: dfl: add bounds check in dfh_get_param_size()
    - bus: mhi: host: pci_generic: Fix the physical function check
    - bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path
    - net: thunderbolt: Fix frags[] overflow by bounding frame_count
    - fpga: microchip-spi: fix zero header_size OOB read in
      mpf_ops_parse_header()
    - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl
    - s390/pkey: Check length in pkey_pckmo handler implementation
    - mtd: spi-nor: swp: Improve locking user experience
    - mtd: spi-nor: spansion: use die erase for multi-die devices only
    - mtd: rawnand: Pause continuous reads at block boundaries
    - openrisc: Fix jump_label smp syncing
    - mtd: maps: vmu-flash: fix NULL pointer dereference in initialization
    - taskstats: retain dead thread stats in TGID queries
    - irqchip/crossbar: Use correct index in crossbar_domain_free()
    - tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat()
    - tpm: tpm2-sessions: wait for async KPP completion in tpm_buf_append_salt
    - sunrpc: fix uninitialized xprt_create_args structure
    - dmaengine: tegra: Fix burst size calculation
    - dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and
      ABORT_INT_MASK
    - platform/x86: dell-laptop: fix missing cleanups in init error path
    - platform/x86: ISST: Restore SST-PP control to all domains
    - platform/x86/amd/pmc: Check for intermediate wakeup in function
    - platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops
    - platform/x86/amd/pmc: Add delay_suspend module parameter
    - platform/x86/amd/pmc: Don't log during intermediate wakeups
    - pkey: Move keytype check from pkey api to handler
    - smb: client: use kvzalloc() for megabyte buffer in simple fallocate
    - ksmbd: fix integer overflow in set_file_allocation_info()
    - hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig
    - hwmon: (max6697) add missing 'select REGMAP_I2C' to Kconfig
    - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic)
    - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ)
    - i2c: mediatek: fix WRRD for SoCs without auto_restart option
    - i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource()
    - i2c: spacemit: fix spurious IRQ handling returning IRQ_HANDLED
    - ice: fix ice_init_link() error return preventing probe
    - tcp: Decrement tcp_md5_needed static branch
    - ufs: core: tracing: Do not dereference pointers in TP_printk()
    - xen/gntdev: fix error handling in ioctl
    - xfrm: use compat translator only for u64 alignment mismatch
    - xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for
      changelink
    - tpm: fix event_size output in tpm1_binary_bios_measurements_show
    - tpm: Make the TPM character devices non-seekable
    - time: Fix off-by-one in compat settimeofday() usec validation
    - spi: uniphier: Fix completion initialization order before
      devm_request_irq()
    - NFS: Charge unstable writes by request size, not folio size
    - nvme-apple: Prevent shared tags across queues on Apple A11
    - nvmet: fix refcount leak in nvmet_sq_create()
    - netdev-genl: report NAPI thread PID in the caller's pid namespace
    - can: esd_usb: kill anchored URBs before freeing netdevs
    - can: isotp: use unconditional synchronize_rcu() in isotp_release()
    - can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER
    - can: isotp: serialize TX state transitions under so->rx_lock
    - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF
    - can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure
    - can: bcm: add missing rcu list annotations and operations
    - bpf: Reset register bounds before narrowing retval range in
      check_mem_access()
    - bpf,fork: wipe ->bpf_storage before bailouts that access it
    - bpf: Add missing access_ok call to copy_user_syms
    - block: remove redundant GD_NEED_PART_SCAN in add_disk_final()
    - block: fix race in blk_time_get_ns() returning 0
    - block: fix IORING_URING_CMD_REISSUE flags check in blkdev_uring_cmd
    - net: sparx5: unregister blocking notifier on init failure
    - dm thin metadata: fix superblock refcount leak on snapshot shadow
      failure
    - dm thin metadata: fix metadata snapshot consistency on commit failure
    - dm era: fix out-of-bounds memory access for non-zero start sector
    - dm-bufio: fix wrong count calculation in dm_bufio_issue_discard
    - dm-ioctl: fix a possible overflow in list_version_get_info
    - dm-log: fix a bitset_size overflow on 32bit machines
    - dm-pcache: reject option groups without values
    - dm-stats: fix dm_jiffies_to_msec64
    - dm-stats: fix merge accounting
    - dm_early_create: fix freeing used table on dm_resume failure
    - dm-integrity: fix leaking uninitialized kernel memory
    - dm-integrity: fix a bug if the bio is out of limits
    - dm-integrity: don't increment hash_offset twice
    - dm-verity: avoid double increment of &use_bh_wq_enabled
    - dm-verity: fix a possible NULL pointer dereference
    - dm-verity: increase sprintf buffer size
    - dm-verity: make error counter atomic
    - dma-fence: Make dma_fence_dedup_array() robust against 0-count input
    - accel/amdxdna: Fix use-after-free in amdxdna_gem_dmabuf_mmap()
    - accel/ivpu: Reject firmware log with size smaller than header
    - scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path
    - scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup()
    - scsi: sg: Report request-table problems when any status is set
    - scsi: xen: scsiback: Free the command tag on the TMR submit-failure path
    - scsi: elx: efct: Fix refcount leak in efct_hw_io_abort()
    - scsi: elx: efct: Fix I/O leak on unsupported additional CDB
    - Input: ims-pcu - fix use-after-free and double-free in disconnect
    - Input: ims-pcu - only expose sysfs attributes on control interface
    - Input: ims-pcu - release data interface on disconnect
    - Input: ims-pcu - validate control endpoint type
    - Input: ims-pcu - add response length checks
    - Input: ims-pcu - fix DMA mapping violation in line setup
    - Input: ims-pcu - fix firmware leak in async update
    - Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging
    - Input: ims-pcu - fix potential infinite loop in CDC union descriptor
      parsing
    - Input: ims-pcu - fix race condition in reset_device sysfs callback
    - Input: ims-pcu - fix type confusion in CDC union descriptor parsing
    - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete
    - tracing/user_events: Fix use-after-free in user_event_mm_dup()
    - wifi: libertas_tf: fix use-after-free in lbtf_free_adapter()
    - posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu()
    - selftests/ftrace: Drop invalid top-level local in test_ownership
    - cpu: hotplug: Preserve per instance callback errors
    - cpu: hotplug: Bound hotplug states sysfs output
    - gpio: mt7621: more robust management of IRQ domain teardown
    - gpio: tegra: do not call pinctrl for GPIO direction
    - gpio: mt7621: be sure IRQ domain is created before exposing GPIO chips
    - gpio-f7188x: Add support for NCT6126D version B
    - gpio: mt7621: avoid corruption of shared interrupt trigger state
    - gpios: palmas: add .get_direction() op
    - net: sit: require CAP_NET_ADMIN in the device netns for changelink
    - net: ethernet: ti: icssg: guard PA stat lookups
    - net: wwan: t7xx: destroy DMA pool on CLDMA late init failure
    - net: ixp4xx_hss: fix duplicate HDLC netdev allocation
    - net/sched: act_ct: preserve tc_skb_cb across defragmentation
    - selftests: net: fix file owner for broadcast_ether_dst test
    - net: ena: clean up XDP TX queues when regular TX setup fails
    - net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink
    - net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink
    - net: ipip: require CAP_NET_ADMIN in the device netns for changelink
    - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink
    - net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for
      changelink
    - octeontx2-af: Free BPID bitmap on setup failure
    - ieee802154: admin-gate legacy LLSEC dump operations
    - ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation
    - ieee802154: ca8210: fix cas_ctl leak on spi_async failure
    - ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit
    - platform/x86/amd/pmc: Avoid logging "(null)" for DMI values
    - net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants
    - drm/xe/userptr: Stub notifier_lock helpers when DRM_GPUSVM=n
    - pwm: rzg2l-gpt: Fix period_ticks type from u32 to u64
    - LoongArch: Fix nr passing in set_direct_map_valid_noflush()
    - LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect()
    - ipmi: Fix user refcount underflow in event delivery
    - ipmi: fix refcount leak in i_ipmi_request()
    - bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp()
    - rtc: renesas-rtca3: Fix PIE clear polling condition in alarm setup error
      path
    - rtc: mpfs: fix counter upload completion condition
    - hwmon: (w83627hf) remove VID sysfs files on error and remove
    - hwmon: (w83793) remove vrm sysfs file on probe failure
    - net: liquidio: fix BAR resource leak on PF number failure
    - hwmon: (occ) unregister sysfs devices outside occ lock
    - fsl/fman: Free init resources on KeyGen failure in fman_init()
    - net: lan743x: Initialize eth_syslock spinlock before use
    - net/sched: sch_multiq: Replace direct dequeue call with peek and
      qdisc_dequeue_peeked
    - net/sched: sch_taprio: Replace direct dequeue call with peek and
      qdisc_dequeue_peeked
    - fhandle: reject detached mounts in capable_wrt_mount()
    - hwmon: (max1619) add missing 'select REGMAP' to Kconfig
    - tracing/probes: Fix double addition of offset for @+FOFFSET
    - net/mlx5: HWS, fix matcher leak on resize target setup failure
    - ata: pata_pxa: Fix DMA channel leak on probe error
    - net: wwan: iosm: bound device offsets in the MUX downlink decoder
    - hwmon: (asus_atk0110) Check package count before accessing element
    - riscv: probes: save original sp in rethook trampoline
    - mm/compaction: handle free_pages_prepare() properly in compaction_free()
    - irqchip/irq-riscv-imsic-early: Fix fwnode leak on state setup failure
    - s390/monwriter: Reject buffer reuse with different data length
    - mac802154: remove interfaces with RCU list deletion
    - octeontx2-pf: fix SQB pointer leak on init failure
    - selftests: net: make busywait timeout clock portable
    - llc: fix SAP refcount leak in llc_ui_autobind()
    - ipvs: use parsed transport offset in SCTP state lookup
    - macsec: don't read an unset MAC header in macsec_encrypt()
    - dibs: loopback: validate offset and size in move_data()
    - net: macb: drop in-flight Tx SKBs on close
    - arm64: smp: Fix hot-unplug tearing by forcing unregistration
    - cpu/hotplug: Fix NULL kobject warning in cpuhp_smt_enable()
    - fs/resctrl: Free mon_data structures on rdt_get_tree() failure
    - fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list
    - ata: libata-core: Skip HPA resize for locked drives
    - ata: libata-core: Allow capacity transition to zero for locked drives
    - riscv: Prevent NULL pointer dereference in machine_kexec_prepare()
    - tracing/osnoise: Call synchronize_rcu() when unregistering
    - s390/diag: Add missing array_index_nospec() call to
      memtop_get_page_count()
    - s390/mm: Fix type mismatch in get_align_mask().
    - selftests/rseq: Fix a building error for riscv arch
    - cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed
    - pmdomain: imx: Fix i.MX8MP power notifier
    - pmdomain: imx: Fix i.MX8MP VC8000E power up sequence
    - selftests/landlock: Skip scoped_signal subtest with MSG_OOB if not
      available
    - selftests/landlock: Fix screwed up pointers in the scoped_signal_test
    - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on
      resume
    - powerpc/pseries: fix memory leak on krealloc failure in papr_init
    - net/mlx5: free mlx5_st_idx_data on final dealloc
    - wifi: rt2x00: avoid full teardown before work setup in probe
    - wifi: mwifiex: fix roaming to different channel in host_mlme mode
    - wifi: mac80211: fix memory leak in ieee80211_register_hw()
    - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame
    - riscv: vdso: Do not use LTO for the vDSO
    - regulator: ltc3676: Fix incorrect IRQSTAT bit offsets
    - Bluetooth: btrtl: validate firmware patch bounds
    - llc: fix SAP refcount leak when creating incoming sockets
    - macsec: fix promiscuity refcount leak in macsec_dev_open()
    - memstick: ms_block: reject a card that reports too many blocks
    - reset: sunxi: fix memory region leak on ioremap failure
    - powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()
    - wifi: cfg80211: validate EHT MLE before MLD ID read
    - wifi: ieee80211: validate MLE common info length
    - wifi: mac80211: free ack status frame on TX header build failure
    - wifi: mwifiex: fix permanently busy scans after multiple roam iterations
    - mtd: onenand: samsung: report DMA completion timeouts
    - mtd: mchp23k256: use SPI match data for chip caps
    - mmc: vub300: defer reset until cmd_mutex is unlocked
    - mtd: rawnand: fsl_ifc: return errors for failed page reads
    - mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout
    - mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout
    - mmc: block: fix RPMB device unregister ordering
    - mmc: sdhci-of-dwcmshc: check bus clock enable result in the probe()
      method
    - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check
      for tuning save/restore
    - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume
    - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state
      restore
    - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled
      interrupt
    - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend
    - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend
    - mmc: sdhci-esdhc-imx: fix resume error handling
    - crypto: xilinx-trng - Remove crypto_rng interface
    - ACPI: bus: Introduce devm_acpi_install_notify_handler()
    - ACPI: NFIT: core: Use devm_acpi_install_notify_handler()
    - ACPI: NFIT: core: Fix possible deadlock and missing notifications
    - iio: hid-sensor-rotation: Fix stale or zero output when reading raw
      values
    - ALSA: scarlett2: Allow selecting config_set by firmware version
    - ALSA: scarlett2: Update offsets for 2i2 Gen 4 firmware 2417
    - firmware_loader: Add cancel helper for async requests
    - ALSA: hda/tas2781: Cancel async firmware request at unbind
    - binder: Use LIST_HEAD() to initialize on stack list head
    - binder: cache secctx size before release zeroes it
    - staging: rtl8723bs: fix spaces around binary operators
    - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister
    - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()
    - proc: rename proc_setattr to proc_nochmod_setattr
    - usb: dwc3: Support USB3340x ULPI PHY high-speed negotiation.
    - usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup()
    - usb: atm: ueagle-atm: use dev_dbg() for 'device found' message
    - usb: atm: ueagle-atm: remove function entry/exit debug messages
    - usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()
    - btrfs: remove folio parameter from ordered io related functions
    - KVM: arm64: Ensure level is always initialized when relaxing perms
    - KVM: arm64: Fix propagation of TLBI level in
      kvm_pgtable_stage2_relax_perms()
    - mm/damon/core: always put unsuccessfully committed target pids
    - mm/damon/core: trace esz at first setup
    - samples/damon/mtier: fail early if address range parameters are invalid
    - perf callchain: Handle multiple address spaces
    - soc: fsl: qe_ports_ic: Add missing cleanup on device removal
    - drm/rockchip: inno-hdmi: Switch to drmm_kzalloc()
    - accel/amdxdna: Create shared functions for AIE2 and AIE4
    - Revert "UBUNTU: SAUCE: accel/amdxdna: Support sensors for column
      utilization"
    - accel/amdxdna: Support sensors for column utilization
    - accel/amdxdna: Adjust size for copy_to_user()
    - accel/amdxdna: Handle DETACH_DEBUG_BO through config_debug_bo path
    - accel/amdxdna: Fix order of canceled mailbox messages
    - accel/amdxdna: Guard management mailbox channel cleanup against NULL
      pointer
    - drm/amdkfd: fix redundant MQD iterations in GFX v12.1
    - wifi: ath12k: Fix invalid IRQ requests during AHB probe
    - libbpf: Fix deduplication of typedef with base definitions
    - spi: atcspi200: Use helper function devm_clk_get_enabled()
    - spi: atcspi200: fix use-after-free when driver unbind
    - arm64: dts: rockchip: Fix vdec register blocks order on RK3576
    - arm64: dts: rockchip: Update vdec register blocks order on RK3588
    - dt-bindings: net: bluetooth: qualcomm: Fix WCN6855 regulator names
    - x86/bug: Add printf() validation to HAVE_ARCH_BUG_FORMAT_ARGS WARNs
    - arm64: dts: qcom: milos: Reduce rmtfs_mem size to 2.5MiB
    - arm64: dts: qcom: sdm845-oneplus: Drop address from framebuffer node
    - arm64: dts: qcom: sdm845-shift-axolotl: Correct touchscreen sleep state
    - soc: xilinx: Fix race condition in event registration
    - wifi: ath11k: cancel SSR work items during PCI shutdown
    - ixgbe: fix unaligned u32 access in ixgbe_update_flash_X550()
    - objtool/klp: Fix is_uncorrelated_static_local() for Clang
    - objtool/klp: Fix .data..once static local non-correlation
    - objtool/klp: Fix create_fake_symbols() skipping entsize-based sections
    - objtool/klp: Fix handling of zero-length .altinstr_replacement sections
    - objtool/klp: Fix cloning of zero-length section symbols
    - objtool/klp: Fix extraction of text annotations for alternatives
    - objtool/klp: Fix relocation conversion failures for R_X86_64_NONE
    - objtool/klp: Use sym->demangled_name for symbol_name hash
    - objtool/klp: Match symbols based on demangled_name for global variables
    - objtool: Replace iterator callback with for_each_sym_by_mangled_name()
    - objtool: Fix reloc hash collision in find_reloc_by_dest_range()
    - klp-build: Fix hang on out-of-date .config
    - klp-build: Fix checksum comparison for changed offsets
    - riscv: dts: microchip: gpio controllers on mpfs need 2 interrupt cells
    - riscv: dts: microchip: remove gpio hogs from beaglev-fire
    - wifi: cfg80211: restrict LMR feedback check to TB and non-TB ranging
    - drm/panel: Clean up SOFEF00 config dependencies
    - drm/panel: Clean up S6E3FC2X01 config dependencies
    - arm64: dts: marvell: samsung-coreprimevelte: Increase touchscreen
      voltage
    - arm64: dts: imx8mn-vhip4-evalboard-v1: Correct interrupt flags
    - arm64: dts: imx8mn-vhip4-evalboard-v2: Correct interrupt flags
    - crypto: ccp - Check for page allocation failure correctly in TIO
    - crypto: ccp - Initialize data during __sev_snp_init_locked()
    - accel/amdxdna: Fix clflush buffer size
    - ntb: Store original DMA address for future release
    - ntb: Use consistent DMA attributes when freeing DMA mappings
    - riscv: dts: spacemit: k3: add clock tree
    - dts: riscv: spacemit: correct 32k clock frequency
    - arm64: dts: qcom: sdm660: set cdsp compute-cbs' regs properly
    - arm64: dts: qcom: sdm630: set adsp compute-cbs' regs properly
    - arm64: dts: qcom: lemans: Move PCIe devices into soc node
    - sockptr: fix usize check in copy_struct_from_sockptr() for user pointers
    - arm64: dts: mediatek: mt7988a-bpi-r4pro: rework pcie gpio-hog handling
    - rhashtable: give each instance its own lockdep class
    - thermal: hwmon: Register a hwmon device for each thermal zone
    - crypto: ccp/sev-dev-tsm - bail out early when pdev->bus is NULL
    - crypto: safexcel - Fix potential memory leak in safexcel_pci_probe()
    - net/sched: add qdisc_qlen_inc() and qdisc_qlen_dec()
    - net/sched: sch_dualpi2: annotate data-races in dualpi2_dump_stats()
    - tools/rtla: Fix --dump-tasks usage in timerlat
    - rtla: Stop the record trace on interrupt
    - dm: limit target bio polling to one shot
    - selftests/bpf: Override EXTRA_LDFLAGS for static builds
    - sched/fair: Update util_est after updating util_avg during dequeue
    - hfs: fix incorrect inode ID assignment in hfs_new_inode()
    - vfio: selftests: Fix out-of-tree build with make O=
    - vfio: selftests: Allow builds when ARCH=x86
    - vfio/xe: avoid duplicate reset in xe_vfio_pci_reset_done
    - arm64: dts: qcom: kaanapali: Add power-domain and iface clk for ice node
    - arm64: dts: qcom: sdm845-xiaomi-beryllium: Correct IPA FW path
    - ASoC: mediatek: mt8189: Fix probe resource cleanup
    - drm/msm/mdss: correct UBWC programming sequences
    - tools/nolibc: stackprotector: Avoid stalling program startup if crng is
      not init yet
    - ASoC: dapm: Fix widget lookup with prefixed names across DAPM contexts
    - ACPI: PAD: Fix teardown ordering in acpi_pad_remove()
    - wifi: ath12k: fix error unwind on arch_init() failure in PCI probe
    - cpufreq: governor: Fix data races on per-CPU idle/nice baselines
    - cpufreq: governor: Fix stale prev_cpu_nice spike when enabling
      ignore_nice_load
    - dt-bindings: vendor-prefixes: Add Verbatim Corporation
    - drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info
    - rust: devres: add 'static bound to Devres<T>
    - lib/base64: validate before writing in decode tail path
    - rust: uaccess: use INLINE_COPY_TO_USER to guard copy_to_user()
    - uaccess: unify inline vs outline copy_{from,to}_user() selection
    - uaccess: minimize INLINE_COPY_USER-related ifdefery
    - crypto: ccp/tsm - Enable the root port after the endpoint
    - firmware: samsung: acpm: Add devm_acpm_get_by_phandle helper
    - firmware: samsung: acpm: remove compile-testing stubs
    - drm/msm/a8xx: Make a8xx_recover IFPC safe
    - drm/msm/a8xx: Fix RSCC offset
    - EDAC/igen6: Fix memory topology parsing for Panther Lake-H SoCs
    - arm: dts: bcm2711: Fix typo in gpio-line-names
    - arm64: dts: renesas: r8a78000: Fix GIC-720AE View 1 Redistributor
      description
    - arm64: dts: renesas: ironhide: Describe all reserved memory
    - md: replace wait loop with wait_event() in md_handle_request()
    - md/raid1,raid10: fix deadlock in read error recovery path
    - md/raid1,raid10: fix error-path detection with md_cloned_bio()
    - md/raid1,raid10: fix bio accounting for split md cloned bios
    - liveupdate: Use refcount_t for FLB reference counts
    - liveupdate: Reference count incoming FLB data
    - liveupdate: skip serialization for context-preserving kexec
    - liveupdate: fix TOCTOU race in luo_session_retrieve()
    - liveupdate: block session mutations during reboot
    - spi: imx: replace dmaengine_terminate_all() with
      dmaengine_terminate_sync()
    - wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic()
    - wifi: ath12k: fix inconsistent arvif state in vdev_create error paths
    - ACPI: button: Fix lid_device value leak past driver removal
    - drm/amd/pm: Add empty string validation to sysfs store functions
    - accel/amdxdna: Return errors for failed debug BO commands
    - mm: preserve PG_dropbehind flag during folio split
    - perf/x86/intel/uncore: Fix PCI device refcount leak in UPI discovery
    - wifi: wlcore: enable the right set of ciphers
    - cxl/test: Fix __fortify_panic
    - bpf: Take mmap_lock in zap_pages()
    - ocfs2: fix out-of-bounds write in ocfs2_remove_refcount_extent
    - cxl/pci: Fix the incorrect check of pci_read_config_word() return
    - cxl/pci: Convert PCIBIOS errors to errno on DVSEC config accesses
    - netfilter: cttimeout: detach dataplane timeout policy and repurpose
      refcount
    - arm64: dts: imx94: fix DDR PMU interrupt number
    - arm64: dts: freescale: fsl-ls1028a-tqmls1028a-mbls1028a: switch mmc
      aliases
    - selftests/bpf: Fix flaky file_reader test
    - riscv: alternative: Use IS_ENABLED() over ifdeffery for
      apply_vdso_alternatives()
    - riscv: alternative: Pass vDSO start as parameter to
      apply_vdso_alternatives()
    - riscv: alternative: Also patch the CFI vDSO
    - bpf: Verifier support for sleepable tracepoint programs
    - bpf: Reject sleepable BPF_LSM_CGROUP programs at load time
    - netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag
    - filelock: fix break_lease() stub signature for CONFIG_FILE_LOCKING=n
    - wifi: mac80211: bound S1G TIM PVB walk to the TIM element
    - ACPI: processor: Add cpuidle driver check in
      acpi_processor_register_idle_driver()
    - RDMA/nldev: Fix locking when accessing mr->pd
    - scsi: ufs: core: Handle PM commands timeout before SCSI EH
    - iommufd: Destroy the pages content after detaching from dmabuf
    - lib/test_hmm: fix memory leak in dmirror_migrate_to_system()
    - rust: kbuild: show the right `quiet_cmd_rustc_procmacrolibrary`
    - remoteproc: qcom_q6v5_wcss: drop redundant wcss_q6_bcr_reset
    - wifi: mt76: mt7996: remove redundant pdev->bus check in probe
    - wifi: ath12k: fix EAPOL TX failure caused by stale tcl_metadata bits
    - memory: tegra186-emc: stop borrowing MC aggregate hook for EMC
    - PM: QoS: Fix misc device registration unwind
    - btrfs: lzo: reject compressed segment that overflows the compressed
      input
    - ixgbe: do not configure xps for XDP queues
    - bpf: Cancel special fields on map value recycle
    - clocksource: move NXP timer selection to drivers/clocksource
    - [Config] Allow certain NXP timer selections for arm64
    - vduse: fix compat handling for VDUSE_IOTLB_GET_FD/VDUSE_VQ_GET_INFO
    - iomap: pass the correct len to fserror_report_io in __iomap_write_begin
    - ASoC: cs35l56: Prevent double-free of debugfs
    - ASoC: cs35l56: Cleanup if component_probe fails
    - hwmon: (gpd-fan): drop global driver data and use per-device allocation
    - hwmon: (gpd-fan): Initialize EC before registering hwmon device
    - hwmon: (gpd-fan): fix race condition between device removal and sysfs
      access
    - ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT
    - cxl/test: Verify cmd->size_in before accessing payload
    - m68k: mcf5441x: fix clocks numbering
    - pinctrl: airoha: an7583: add missed gpio32 pin group
    - pinctrl: airoha: an7583: fix misprint in gpio19 pinconf
    - pinctrl: airoha: an7581: fix incorrect led mapping in phy4_led1 pin
      function
    - pinctrl: airoha: an7583: fix incorrect led mapping in phy4_led1 pin
      function
    - pinctrl: airoha: fix pwm pin function for an7581 and an7583
    - pinctrl: airoha: an7583: fix gpio21 pin group
    - pinctrl: airoha: an7583: add missed gpio22 pin group
    - pinctrl: airoha: an7583: fix phy1_led1 pin function
    - pinctrl: airoha: an7583: remove undefined groups from pcm_spi pin
      function
    - Bluetooth: hci_qca: fix NULL pointer dereference in qca_setup() for non-
      serdev device
    - Bluetooth: btintel: Replace CNVi id with hardware variant
    - Bluetooth: btintel: Add DSBR support for ScP2 onwards
    - Bluetooth: btintel_pcie: Load IOSF debug regs by controller variant
    - ASoC: cs35l56: Fix wrong error test on simple_write_to_buffer()
    - ASoC: SOF: Intel: select SND_SOC_SDW_UTILS=y from
      SND_SOC_SOF_HDA_GENERIC=y
    - ASoC: meson: aiu: Validate written enum values
    - ASoC: topology: Check PCM and DAI name strings before use
    - ipv4: fib: Don't dump dying fib_info in fib_leaf_notify().
    - iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path
    - iommufd: Clarify IOAS_MAP_FILE dma-buf support
    - cxl/region: Fill first free targets[] slot during auto-discovery
    - vfio: selftests: Ensure libvfio output dirs are always created
    - cxl/region: Block region delete during region creation
    - cxl/region: Resolve region deletion races
    - cxl/memdev: Pin parents for entire memdev lifetime
    - net: airoha: Fix error handling in airoha_ppe_flush_sram_entries()
    - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path
    - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use
      them
    - geneve: Fix off-by-one comparing with GRO_LEGACY_MAX_SIZE
    - smb: client: fix conflicting option validation for new mount API
    - btrfs: Drop WQ_PERCPU from ordered_flags in btrfs_init_workqueues()
    - bpf: Guard __get_user acesss with access_ok for uprobe_multi data
    - net: ti: icssg-prueth: Fix AF_XDP fill ring alloc and wakeup condition
    - net: ti: icssg: Use undirected TX tag for native XDP in HSR offload mode
    - net: ti: icssg: Use undirected TX tag for XDP zero copy in HSR offload
      mode
    - RDMA/bnxt_re: Free CQ toggle page after firmware teardown
    - RDMA/bnxt_re: Reject GET_TOGGLE_MEM when toggle page was not allocated
    - RDMA/hns: Fix memory leak of bonding resources
    - mfd: bd72720: Drop BUCK11 ID
    - 9p: Add missing read barrier in virtio zero-copy path
    - perf dwarf-aux: Fix libdw segmentation fault in cu_walk_functions_at
    - perf dwarf-aux: Fix libdw API contract violations
    - perf srcline: Introduce inline_node__clear_frames()
    - perf libdw: Fix libdw API contract violations and memory leaks
    - perf probe-finder: Fix libdw API contract violations
    - perf annotate-data: Fix libdw API contract violations
    - coresight: tmc: Fix overflow when calculating is bigger than 2GiB
    - perf tool: Fix missing schedstat delegates and dont_split_sample_group
      in delegate_tool
    - PCI: intel-gw: Move interrupt enable to own function
    - PCI: intel-gw: Enable clock before PHY init
    - PCI: intel-gw: Add .start_link() callback
    - bus: mhi: ep: Add missing state_lock protection for mhi_state access
    - PCI: dwc: Apply ECRC workaround for DesignWare cores prior to 5.10a
    - PCI: qcom: Set max OPP before DBI access during resume
    - perf pmu-events AMD: Switch l2_itlb_misses to
      bp_l1_tlb_miss_l2_tlb_miss.all
    - perf unwind: Refactor get_entries to allow dynamic libdw/libunwind
      selection
    - coresight: Handle helper enable failure properly
    - mailbox: don't free the channel if the startup callback failed
    - PCI/pwrctrl: Lock device when calling device_is_bound()
    - coresight: platform: defer connection counter increment until alloc
      succeeds
    - platform/x86: classmate-laptop: Address memory leaks on driver removal
    - clk: microchip: mpfs-ccc: fix peripheral driver registration failures
      after oob fix
    - perf sample: Add evsel to struct perf_sample
    - perf event: Fix size of synthesized sample with branch stacks
    - perf inject: Fix itrace branch stack synthesis
    - gpib: cb7210: Fix region leak when request_irq fails
    - timers/migration: Update stale @online doc to @available
    - clk: spacemit: k3: Switch to pll2_d6 as parent for PCIe clock
    - clk: spacemit: k3: Fix PCIe clock register offset
    - fs/ntfs3: fix wrong LCN in run_remove_range() when splitting a run
    - ntfs3: Allocate iomap inline_data using alloc_page
    - perf sample: Add file_offset field to struct perf_sample
    - perf sched: Replace BUG_ON on invalid CPU with graceful skip
    - perf sched: Fix NULL dereference in latency_runtime_event
    - perf sched: Fix comp_cpus heap overflow with cross-machine recordings
    - perf tools: Guard remaining test_bit calls from OOB sample CPU
    - perf sched: Fix thread reference leaks in timehist_get_thread()
    - perf sched: Use is_idle_sample() for idle thread runtime cast guard
    - perf sched: Fix thread reference leak in idle hist processing
    - perf sched: Free callchain nodes in idle thread cleanup
    - docs: memfd_preservation: fix rendering of ABI documentation
    - virtio: add missing kernel-doc for map and vmap members
    - fs/ntfs3: prevent potential lcn remains uninitialized
    - perf tools: NULL bitmap pointers after bitmap_free()
    - perf tools: Use scnprintf() in build_id__snprintf() and hwmon
      read_events()
    - perf data convert json: Fix addr_location leak on time-filtered samples
    - perf tools: Use mkostemp() for O_CLOEXEC on temporary files
    - phy: freescale: phy-fsl-imx8qm-lvds-phy: Use synchronous PM runtime put
      in reset
    - sparc: Avoid -Wunused-but-set-parameter in clear_user_page()
    - apparmor: release exe file resources on path failure
    - apparmor: remove unnecessary goto and associated label
    - apparmor: Fix inverted comparison in cache_hold_inc()
    - i3c: mipi-i3c-hci: Fix suspend behavior when bus disable falls back to
      software reset
    - i3c: master: Serialize i3c_set_hotjoin() with the maintenance lock
    - i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev()
    - perf maps: Add maps__mutate_mapping
    - perf c2c: Free format list entries when releasing c2c hist entries
    - regcache: Do not overwrite error code when finalizing cache after error
    - erofs: call erofs_exit_ishare() before rcu_barrier()
    - perf c2c: Free format list entries when c2c_hists__init() fails
    - perf c2c: Fix hist entry and format list leaks in c2c_he_free()
    - drm/amd/display: Skip PHY SSC reduction on some 8K panels
    - net: ethernet: mtk_eth_soc: fix supported_interface set after
      phylink_create
    - selftests/ftrace: Fix trace_marker_raw test on 64K page kernels
    - octeontx2-af: npc: Log successful MCAM drop-on-non-hit install at debug
      level
    - netconsole: don't drop the last byte of a full-sized message
    - eth: fbnic: take netif_addr_lock_bh() around rx mode address programming
    - arm64: static_call: include asm/insns.h
    - md/raid1: fix writes_pending and barrier reference leaks on write
      failures
    - md/raid10: fix writes_pending leak on write request failures
    - md/raid10: fix writes_pending and barrier reference leaks on discard
      failures
    - netfilter: ipset: Don't use test_bit() in lockless RCU readers in bitmap
      types
    - selftests/mm: fix hugetlb pathname construction in
      charge_reserved_hugetlb.sh
    - selftests/mm: run_vmtests.sh: free memory if available memory is low
    - selftests/mm: move hwpoison setup into run_test() and silence modprobe
      output for memory-failure category
    - selftests/mm: remove hardcoded THP sizing assumptions in hmm tests
    - net: dst_metadata: fix false-positive memcpy overflow in tun_dst_unclone
    - bpf: Fix partial copy of non-linear test_run output
    - bpf: Fix BPF_PROG_ASSOC_STRUCT_OPS last field check
    - erofs: handle 48-bit blocks_hi for compressed inodes
    - ASoC: cs530x: Fix expected MCLK rates for CS5302/4/8
    - PCI: endpoint: pci-epf-vntb: Document legacy MSI doorbell offset
    - PCI: endpoint: pci-epf-vntb: Defer pci_epc_raise_irq() out of atomic
      context
    - PCI: endpoint: pci-epf-vntb: Report 0-based doorbell vector via
      ntb_db_event()
    - e1000e: Reconfigure PLL clock gate timeout and re-enable K1 on Meteor
      Lake
    - bpf: Guard conntrack opts error writes
    - selftests/bpf: Cover small conntrack opts error writes
    - netfilter: nf_conntrack_helper: dynamically allocate struct
      nf_conntrack_helper
    - netfilter: nf_conntrack_pptp: move GRE specific cleanup to GRE tracker
    - netfilter: nf_conntrack_gre: fix gre keymap list corruption
    - netfilter: conntrack: check NULL when retrieving ct extension
    - netfilter: nf_conntrack_expect: use conntrack GC to reap expectations
    - netfilter: nf_conntrack_expect: store master_tuple in expectation
    - netfilter: nf_conntrack_expect: run expectation eviction with no helper
    - netfilter: nft_ct: expectation timeouts are passed in milliseconds
    - netfilter: nf_conntrack_helper: cap maximum number of expectation at
      helper registration
    - cpuidle: Allow exit latency to exceed target residency
    - ASoC: SDCA: Validate written enum value in ge_put_enum_double()
    - ASoC: rt5575: Use __le32 for SPI burst write address
    - PCI: endpoint: pci-epf-vntb: Exclude reserved slots from db_valid_mask
    - net: ti: icssg: Fix XSK zero copy TX during application wakeup
    - net: lwtunnel: Drop skb metadata before LWT encapsulation
    - sctp: fix err_chunk memory leaks in INIT handling
    - net: dsa: mxl862xx: avoid unaligned 16-bit access in api_wrap
    - octeontx2-af: fix CGX debugfs RVU AF PCI reference leaks
    - geneve: gate GRO hint in geneve_gro_complete() on gs->gro_hint
    - geneve: validate inner network offset in geneve_gro_complete()
    - tools: ynl: build archives with $(AR)
    - net: enetc: fix potential divide-by-zero when num_vsi is zero
    - udp_tunnel: Pass struct sock to setup_udp_tunnel_sock().
    - tipc: avoid busy looping in tipc_exit_net()
    - bpf: Mask pseudo pointer values in verifier logs
    - bpf: Fix insn_aux_data leak on verifier err_free_env path
    - hwmon: (pmbus/core) Add support for NVIDIA nvidia195mv mode
    - hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid()
    - gpio: shared-proxy: always serialize with a sleeping mutex
    - drm/panthor: Always use the IRQ-safe variant when acquiring the fence
      lock
    - drm/panthor: Keep the reset work disabled until everything is
      initialized
    - drm/panthor: Fix panthor_pwr_unplug()
    - spi: rzv2h-rspi: Fix DMA transfer error handling for signal interruption
    - xen/pvcalls: bound backend response req_id before indexing rsp[]
    - afs: Remove setting of AS_RELEASE_ALWAYS for symlinks and mountpoints
    - afs: Fix directory inode initialisation order
    - afs: Use scoped_seqlock_read() rather than manually doing seqlock stuff
    - afs: Fix leak of ungot volume
    - iomap: release pages on atomic dio size mismatch
    - cachefiles: Fix double unlock in nomem_d_alloc error path
    - cachefiles: Fix file burial to take lock when unsetting S_KERNEL_FILE
    - drm/imagination: Fix returned size for DRM_IOCTL_PVR_DEV_QUERY
    - iio: dac: mcp47feb02: Fix passing uninitialized vref1_uV for no Vref1
      case
    - net/mlx5: LAG, replace pf array with xarray
    - net/mlx5: LAG, use xa_alloc to manage LAG device indices
    - net/mlx5: Lag: refactor representor reload handling
    - net/mlx5: E-Switch, add representor lifecycle lock
    - net/mlx5: Lag, avoid LAG and representor lock cycles
    - net/mlx5: LAG, factor out shared FDB code into dedicated file
    - net/mlx5: LAG, replace peer count check with direct peer lookup
    - net/mlx5: LAG, prepare for SD device integration
    - net/mlx5: LAG, replace mlx5_get_dev_index with LAG sequence number
    - net/mlx5: LAG, extend shared FDB API with group_id filter
    - net/mlx5: LAG, Fix off-by-one in single-FDB error rollback
    - ksmbd: fix multichannel binding and enforce channel limit
    - smb: client: preserve leading slash for POSIX absolute symlink targets
    - gpio: shared: make the voting mechanism adaptable
    - drm/i915/ltphy: Fix SSC Enablement bit in PORT_CLOCK_CTL
    - Bluetooth: 6lowpan: avoid untracked enable work
    - Bluetooth: btintel_pcie: Support Product level reset
    - [Config] Make BT_INTEL_PCIE depend on ACPI
    - Bluetooth: btintel_pcie: Add support for smart trigger dump
    - Bluetooth: btintel_pcie: Separate coredump work from RX work
    - Bluetooth: btintel_pcie: Refactor FLR to use device_reprobe()
    - Bluetooth: ISO: fix malformed ISO_END/CONT handling
    - accel/amdxdna: Prevent PM resume deadlock in hwctx_sync_debug_bo()
    - accel/amdxdna: Fix VMA access race
    - net: rnpgbe: fix mailbox endianness and remove pointer casts
    - drm: Guard DRM_CLIENT_CAP_PLANE_COLOR_PIPELINE
    - smb: client: fix busy dentry warning on unmount after DIO
    - drm/fb-helper: Only consider active CRTCs for vblank sync
    - ethtool: rss: Fix hfunc and input_xfrm parsing on big endian
    - drm/imagination: make pvr_fw_trace_init_mask_ops static
    - VDUSE: avoid leaking information to userspace
    - ASoC: SOF: ipc4-control: Validate notification payload size
    - arm64: dts: renesas: ironhide: Describe inline ECC carveouts
    - arm64: dts: qcom: hamoa: Fix OPP tables for all DisplayPort controllers
    - KVM: s390: vsie: Fix allocation of struct vsie_rmap
    - KVM: s390: vsie: Add missing radix_tree_preload() in
      _gaccess_shadow_fault()
    - KVM: s390: Add some useful mask macros
    - KVM: s390: vsie: Fix rmap handling in _do_shadow_crste()
    - KVM: s390: vsie: Fix redundant rmap entries
    - KVM: s390: vsie: Use mmu cache to allocate rmap
    - KVM: s390: Initialize KVM_S390_GET_CMMA_BITS memory
    - KVM: TDX: Reject concurrent change to CPUID entry count
    - ASoC: SOF: topology: fix memory leak in snd_sof_load_topology
    - netfilter: nft_fib: reject fib expression on the netdev egress hook
    - netfilter: nf_conntrack_sip: remove net variable shadowing
    - netfilter: nf_conntrack_sip: validate skb_dst() before accessing it
    - gpu/buddy: bail out of try_harder when alignment cannot be honoured
    - backlight: ktd2801: Enable BL_CORE_SUSPENDRESUME
    - cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size
    - pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP
    - remoteproc: xlnx: Check remote core state
    - mm/sparse-vmemmap: fix vmemmap accounting underflow
    - mm/huge_memory: preserve pmd_swp_uffd_wp on device-private PMD downgrade
    - fs/proc/task_mmu: fix make_uffd_wp_huge_pte() prot-update race
    - fs/proc/task_mmu: do not warn on seeing non-migration pmd entry
    - kho: make sure scratch size is always aligned by CMA_MIN_ALIGNMENT_BYTES
    - mtd: maps: vmu-flash: fix fault in unaligned fixup
    - dmaengine: dw-edma-pcie: Reject devices without driver data
    - dmaengine: sh: rz-dmac: Move interrupt request after everything is set
      up
    - platform/x86: hp-wmi: Add support for Omen 16-ap0xxx (8D26)
    - platform/x86: hp-wmi: Add support for Omen 16-ap0xxx (8E35)
    - spi: imx: reconfigure for PIO when DMA cannot be started
    - ovl: use linked upper dentry in copy-up tmpfile
    - can: bcm: add locking when updating filter and timer values
    - can: bcm: extend bcm_tx_lock usage for data and timer updates
    - can: bcm: fix CAN frame rx/tx statistics
    - can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()
    - can: bcm: fix stale rx/tx ops after device removal
    - can: bcm: track a single source interface for ANYDEV timeout/throttle
      ops
    - can: bcm: validate frame length in bcm_rx_setup() for RTR replies
    - can: bcm: add missing device refcount for CAN filter removal
    - selftests/bpf: Cover negative buffer pointer offsets
    - dm: avoid leaking the caller's thread keyring via the table device file
    - dma-buf: protected fence ops by RCU v8
    - dma-fence: use correct callback in dma_fence_timeline_name()
    - accel/amdxdna: reject command submission on devices without a submit op
    - accel/amdxdna: reject user command submission without a command BO
    - accel/amdxdna: Use caller client for debug BO sync
    - fs/resctrl: Fix use-after-free during unmount
    - mmc: vub300: fix use-after-free on probe failure
    - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF
    - ksmbd: fix stack buffer overflow in multichannel session-key copy
    - netfilter: nfnetlink_cthelper: cap to maximum number of expectation per
      master
    - netfilter: nfnetlink_cthelper: cap to maximum number of expectation per
      master on updates
    - riscv: vdso: Always declare vdso_start symbols
    - ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD
    - ata: libata-core: Reject an invalid concurrent positioning ranges count
    - net: ipa: fix SMEM state handle leaks in SMP2P init
    - amdkfd: properly free secondary context id
    - pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI
    - pmdomain: mediatek: Fix possible nullptr KP in HWV cleanup/on-check
    - arch/riscv: vdso: remove CFI landing pad from rt_sigreturn
    - reset: imx7: Correct polarity of MIPI CSI resets on i.MX8MQ
    - powerpc/uaccess: correct check for CONFIG_PPC_E500 in
      mask_user_address()
    - wifi: mac80211: validate extension-frame layout before RX
    - xfs: factor out a xfs_zone_mark_free helper
    - xfs: add newly added RTGs to the free pool in growfs
    - liveupdate: validate session type before performing operation
    - posix-timers: Expand timer_[re]arm() callbacks with a boolean return
      value
    - posix-cpu-timers: Prevent UAF caused by non-leader exec() race
    - Revert "gpib: cb7210: Fix region leak when request_irq fails"
    - Upstream stable to v6.18.40, v7.1.5
  * Resolute update: upstream stable patchset 2026-08-20 (LP: #2164666) //
    CVE-2023-20585
    - iommu/amd: Use maximum Event log buffer size when SNP is enabled on
      Family 0x19
    - iommu/amd: Use maximum PPR log buffer size when SNP is enabled on Family
      0x19
  * [Regression] Laptop fails to power off completely when HDMI is connected
    in kernel 7.0.0-28 (LP: #2163121) // CVE-2026-68364
    - drm/amd/display: fix NULL ptr deref in ISM delayed work
    - drm/amd/display: Fix ISM teardown crash from NULL dc dereference
    - drm/amd/display: Fix ISM dc_lock deadlock during suspend
  * CVE-2026-72064
    - net: mana: Sync page pool RX frags for CPU
  * CVE-2026-72065
    - net: mana: Validate the packet length reported by the NIC
  * CVE-2026-72098
    - dm-verity-fec: replace {MAX,MIN}_RSN with {MIN,MAX}_ROOTS
    - dm-verity: fix buffer overflow in FEC calculation
  * CVE-2026-72248
    - netfilter: flowtable: support IPIP tunnel with direct xmit
    - netfilter: flowtable: use correct direction to set up tunnel route
  * CVE-2026-72249
    - netfilter: flowtable: use dst in this direction when pushing IPIP header
  * CVE-2026-72287
    - KVM: nVMX: Move vTPR vs. TPR Threshold consistency check into "normal"
      checks
  * CVE-2026-72329
    - net/liquidio: drop cached VF pci_dev LUT
  * CVE-2026-72355
    - netfs: Fix barriering when walking subrequest list
  * CVE-2026-72412
    - s390/mm: Fix handling of _PAGE_UNUSED pte bit
  * CVE-2026-72417
    - netfilter: flowtable: Validate iph->ihl in nf_flow_ip4_tunnel_proto()
  * CVE-2026-72442
    - netfilter: flowtable: fix and simplify IP6IP6 tunnel handling
  * CVE-2026-72463
    - xfrm: Fix dev use-after-free in xfrm async resumption
  * CVE-2026-72477
    - fs/ntfs3: call _ntfs_bad_inode() when failing to rename
  * CVE-2026-72493
    - net: serialize netif_running() check in enqueue_to_backlog()
  * CVE-2026-72494
    - RDMA/irdma: Replace waitqueue and flag with completion
  * CVE-2026-72496
    - RDMA/bnxt_re: Proper rollback if the ioremap fails
  * CVE-2026-74269
    - bnxt: fix head underflow on XDP head-grow
  * CVE-2026-74350
    - ocfs2: validate fast symlink target during inode read
  * CVE-2026-72495
    - RDMA/bnxt_re: Avoid repeated requests to allocate WC pages
  * CVE-2026-72501
    - RDMA/bnxt_re: Initialize dpi variable to zero
  * CVE-2026-72278
    - KVM: arm64: nv: Re-translate VNCR before injecting abort
  * CVE-2026-68083
    - ksmbd: fix path resolution in ksmbd_vfs_kern_path_create
  * CVE-2026-68457
    - ksmbd: use opener credentials for FSCTL mutations
  * CVE-2026-68476
    - ipvs: reload ip header after head reallocation
  * CVE-2026-68477
    - ipvs: fix more places with wrong ipv6 transport offsets
  * CVE-2026-72014
    - drbd: reject data replies with an out-of-range payload size
  * CVE-2026-72020
    - ipvs: reset full ip_vs_seq structs in ip_vs_conn_new
  * CVE-2026-72033
    - orangefs: keep the readdir entry size 64-bit in fill_from_part()
  * CVE-2026-72041
    - espintcp: use sk_msg_free_partial to fix partial send
  * CVE-2026-72046
    - gve: fix header buffer corruption with header-split and HW-GRO
  * CVE-2026-72069
    - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock()
  * CVE-2026-72083
    - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE
  * CVE-2026-72084
    - scsi: target: Bound PR-OUT TransportID parsing to the received buffer
  * CVE-2026-72085
    - scsi: xen: scsiback: Free unsubmitted command instead of double-putting
      it
  * CVE-2026-72129
    - nvmet-rdma: handle inline data with a nonzero offset
  * CVE-2026-72130
    - nvmet-auth: reject short AUTH_RECEIVE buffers
  * CVE-2026-64551
    - sctp: validate STALE_COOKIE cause length before reading staleness
  * CVE-2026-72137
    - xfrm: nat_keepalive: avoid double free on send error
  * CVE-2026-72139
    - tcp: defer md5sig_info kfree past RCU grace period in tcp_connect
  * CVE-2026-72191
    - ntfs3: validate split-point offset in indx_insert_into_buffer
  * CVE-2026-72192
    - ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head
  * CVE-2026-72194
    - fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow
  * CVE-2026-72217
    - SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing
  * CVE-2026-72220
    - sunrpc: harden rq_procinfo lifecycle to prevent double-free
  * CVE-2026-72221
    - sunrpc: wait for in-flight TLS handshake callback when cancel loses race
  * CVE-2026-72222
    - sunrpc: pin svc_xprt across the asynchronous TLS handshake callback
  * CVE-2026-72226
    - batman-adv: tt: prevent TVLV OOB check overflow
  * CVE-2026-72234
    - batman-adv: access unicast_ttvn skb->data only after skb realloc
  * CVE-2026-72251
    - netfilter: nf_nat_sip: reload possible stale data pointer
  * CVE-2026-72277
    - KVM: arm64: nv: Inject SEA if kvm_translate_vncr() can't resolve PFN
    - KVM: arm64: nv: Inject SEA if guest VNCR isn't normal memory
  * CVE-2026-72279
    - KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR
  * CVE-2026-72288
    - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI
      disabling
  * CVE-2026-72289
    - KVM: arm64: vgic: Check the interrupt is still ours before migrating it
  * CVE-2026-72296
    - net: ife: require ETH_HLEN to be pullable in ife_decode()
  * CVE-2026-72299
    - tipc: restrict socket queue dumps in enqueue tracepoints
  * CVE-2026-72317
    - SUNRPC: pin upper rpc_clnt across the TLS connect_worker
  * CVE-2026-72318
    - cifs: validate DFS referral string offsets
  * CVE-2026-72319
    - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors
    - ipvs: ensure inner headers in ICMP errors are in headroom
  * CVE-2026-72320
    - netfilter: nft_lookup: fix catchall element handling with inverted
      lookups
  * CVE-2026-72322
    - ipv6: mcast: Fix potential UAF in MLD delayed work
  * CVE-2026-72323
    - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()
  * CVE-2026-64541
    - net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket
  * CVE-2026-72339
    - qede: fix off-by-one in BD ring consumption on build_skb failure
  * CVE-2026-72348
    - netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop
  * CVE-2026-72351
    - gue: validate REMCSUM private option length
  * CVE-2026-72366
    - netfs: Fix netfs_create_write_req() to handle async cache object
      creation
  * CVE-2026-72381
    - ksmbd: fix use-after-free of fp->owner.name in durable handle owner
      check
  * CVE-2026-72393
    - eth: fbnic: don't cache shinfo across skb realloc
  * CVE-2026-72398
    - sctp: add INIT verification after cookie unpacking
  * CVE-2026-72399
    - net: enetc: check the number of BDs needed for xdp_frame
  * CVE-2026-64530
    - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle
  * CVE-2026-72422
    - ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2
      NEGOTIATE
  * CVE-2026-72429
    - ipv6: ioam: fix type confusion of dst_entry
  * CVE-2026-72436
    - netfilter: ipset: Fix data race between add and dump in all hash types
    - netfilter: ipset: annotate "pos" for concurrent readers/writers
    - netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash
      types
  * CVE-2026-72451
    - xfrm: Fix xfrm state cache insertion race
  * CVE-2026-72466
    - xprtrdma: Fix bcall rep leak and unbounded peek
  * CVE-2026-72472
    - nfs: use nfsi->rwsem to protect traversal of the file lock list
  * CVE-2026-72473
    - xprtrdma: Avoid 250 ms delay on backlog wakeup
    - xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot
    - xprtrdma: Post receive buffers after RPC completion
    - xprtrdma: Use sendctx DMA state for Send signaling
    - xprtrdma: Decouple req recycling from RPC completion
  * CVE-2026-72491
    - net/9p: fix race condition on rdma->state in trans_rdma.c
  * CVE-2026-72495 // CVE-2026-72501
    - RDMA/bnxt_re: Move the UAPI methods to a dedicated file
  * CVE-2026-74255
    - tipc: fix UAF in tipc_l2_send_msg()
  * CVE-2026-74267
    - net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek
      before restoring qlen
  * CVE-2026-74268
    - tcp: clear sock_ops cb flags before force-closing a child socket
  * CVE-2026-74287
    - sctp: validate embedded address parameter length
  * CVE-2026-74310
    - vhost/net: complete zerocopy ubufs only once
  * CVE-2026-74345
    - RDMA/siw: Fix endpoint/socket association handling
  * CVE-2026-74361
    - nvme: fix FDP fdpcidx bounds check
  * CVE-2026-74376
    - md/raid10: reset read_slot when reusing r10bio for discard
  * CVE-2026-74384
    - nvme-multipath: fix flex array size in struct nvme_ns_head
  * CVE-2026-74394
    - RDMA/srpt: fix integer overflow in immediate data length check
  * CVE-2026-74398
    - ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD
  * CVE-2026-74401
    - dlm: fix add msg handle in send_queue ordered
  * CVE-2026-74406
    - vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().
  * CVE-2026-74427
    - afs: Fix netns teardown to cancel the preallocation charger
    - afs: Fix further netns teardown to cancel the preallocation charger
  * CVE-2026-74428
    - rxrpc: Fix double unlock in rxrpc_recvmsg()
  * CVE-2026-74433
    - rxrpc: Fix UAF in rxgk_issue_challenge()
  * CVE-2026-74434
    - rxrpc: Don't move a peeked OOB message onto the pending queue
  * CVE-2026-74436
    - rxrpc: serialize kernel accept preallocation with socket teardown
  * CVE-2026-64535
    - nvmet-tcp: Fix potential UAF when ddgst mismatch
  * CVE-2026-74439
    - iommu/vt-d: Clear Present bit before tearing down scalable-mode context
      entry
  * CVE-2026-64534
    - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error
      path

 -- Stefan Bader <stefan.bader@canonical.com>  Wed, 09 Sep 2026 18:01:17 +0200

linux-hwe-7.0 (7.0.0-34.34~24.04.1) noble; urgency=medium

  * noble/linux-hwe-7.0: 7.0.0-34.34~24.04.1 -proposed tracker (LP: #2165776)

  * Packaging resync (LP: #1786013)
    - [Packaging] debian.hwe-7.0/dkms-versions -- update from kernel-versions
      (main/s2026.08.03)

  [ Ubuntu: 7.0.0-34.34 ]

  * resolute/linux: 7.0.0-34.34 -proposed tracker (LP: #2165995)

  [ Ubuntu: 7.0.0-32.32 ]

  * resolute/linux: 7.0.0-32.32 -proposed tracker (LP: #2165777)
  * CVE-2026-72064
    - net: mana: Sync page pool RX frags for CPU
  * CVE-2026-72065
    - net: mana: Validate the packet length reported by the NIC
  * CVE-2026-72098
    - dm-verity-fec: replace {MAX,MIN}_RSN with {MIN,MAX}_ROOTS
    - dm-verity: fix buffer overflow in FEC calculation
  * CVE-2026-72248
    - netfilter: flowtable: support IPIP tunnel with direct xmit
    - netfilter: flowtable: use correct direction to set up tunnel route
  * CVE-2026-72249
    - netfilter: flowtable: use dst in this direction when pushing IPIP header
  * CVE-2026-72287
    - KVM: nVMX: Move vTPR vs. TPR Threshold consistency check into "normal"
      checks
  * CVE-2026-72329
    - net/liquidio: drop cached VF pci_dev LUT
  * CVE-2026-72355
    - netfs: Fix barriering when walking subrequest list
  * CVE-2026-72412
    - s390/mm: Fix handling of _PAGE_UNUSED pte bit
  * CVE-2026-72417
    - netfilter: flowtable: Validate iph->ihl in nf_flow_ip4_tunnel_proto()
  * CVE-2026-72442
    - netfilter: flowtable: fix and simplify IP6IP6 tunnel handling
  * CVE-2026-72463
    - xfrm: Fix dev use-after-free in xfrm async resumption
  * CVE-2026-72477
    - fs/ntfs3: call _ntfs_bad_inode() when failing to rename
  * CVE-2026-72493
    - net: serialize netif_running() check in enqueue_to_backlog()
  * CVE-2026-72494
    - RDMA/irdma: Replace waitqueue and flag with completion
  * CVE-2026-72496
    - RDMA/bnxt_re: Proper rollback if the ioremap fails
  * CVE-2026-74269
    - bnxt: fix head underflow on XDP head-grow
  * CVE-2026-74350
    - ocfs2: validate fast symlink target during inode read
  * CVE-2026-72495
    - RDMA/bnxt_re: Avoid repeated requests to allocate WC pages
  * CVE-2026-72501
    - RDMA/bnxt_re: Initialize dpi variable to zero
  * CVE-2026-72278
    - KVM: arm64: nv: Re-translate VNCR before injecting abort
  * CVE-2026-68083
    - ksmbd: fix path resolution in ksmbd_vfs_kern_path_create
  * CVE-2026-68457
    - ksmbd: use opener credentials for FSCTL mutations
  * CVE-2026-68476
    - ipvs: reload ip header after head reallocation
  * CVE-2026-68477
    - ipvs: fix more places with wrong ipv6 transport offsets
  * CVE-2026-72014
    - drbd: reject data replies with an out-of-range payload size
  * CVE-2026-72020
    - ipvs: reset full ip_vs_seq structs in ip_vs_conn_new
  * CVE-2026-72033
    - orangefs: keep the readdir entry size 64-bit in fill_from_part()
  * CVE-2026-72041
    - espintcp: use sk_msg_free_partial to fix partial send
  * CVE-2026-72046
    - gve: fix header buffer corruption with header-split and HW-GRO
  * CVE-2026-72069
    - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock()
  * CVE-2026-72083
    - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE
  * CVE-2026-72084
    - scsi: target: Bound PR-OUT TransportID parsing to the received buffer
  * CVE-2026-72085
    - scsi: xen: scsiback: Free unsubmitted command instead of double-putting
      it
  * CVE-2026-72129
    - nvmet-rdma: handle inline data with a nonzero offset
  * CVE-2026-72130
    - nvmet-auth: reject short AUTH_RECEIVE buffers
  * CVE-2026-64551
    - sctp: validate STALE_COOKIE cause length before reading staleness
  * CVE-2026-72137
    - xfrm: nat_keepalive: avoid double free on send error
  * CVE-2026-72139
    - tcp: defer md5sig_info kfree past RCU grace period in tcp_connect
  * CVE-2026-72191
    - ntfs3: validate split-point offset in indx_insert_into_buffer
  * CVE-2026-72192
    - ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head
  * CVE-2026-72194
    - fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow
  * CVE-2026-72217
    - SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing
  * CVE-2026-72220
    - sunrpc: harden rq_procinfo lifecycle to prevent double-free
  * CVE-2026-72221
    - sunrpc: wait for in-flight TLS handshake callback when cancel loses race
  * CVE-2026-72222
    - sunrpc: pin svc_xprt across the asynchronous TLS handshake callback
  * CVE-2026-72226
    - batman-adv: tt: prevent TVLV OOB check overflow
  * CVE-2026-72234
    - batman-adv: access unicast_ttvn skb->data only after skb realloc
  * CVE-2026-72251
    - netfilter: nf_nat_sip: reload possible stale data pointer
  * CVE-2026-72277
    - KVM: arm64: nv: Inject SEA if kvm_translate_vncr() can't resolve PFN
    - KVM: arm64: nv: Inject SEA if guest VNCR isn't normal memory
  * CVE-2026-72279
    - KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR
  * CVE-2026-72288
    - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI
      disabling
  * CVE-2026-72289
    - KVM: arm64: vgic: Check the interrupt is still ours before migrating it
  * CVE-2026-72296
    - net: ife: require ETH_HLEN to be pullable in ife_decode()
  * CVE-2026-72299
    - tipc: restrict socket queue dumps in enqueue tracepoints
  * CVE-2026-72317
    - SUNRPC: pin upper rpc_clnt across the TLS connect_worker
  * CVE-2026-72318
    - cifs: validate DFS referral string offsets
  * CVE-2026-72319
    - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors
    - ipvs: ensure inner headers in ICMP errors are in headroom
  * CVE-2026-72320
    - netfilter: nft_lookup: fix catchall element handling with inverted
      lookups
  * CVE-2026-72322
    - ipv6: mcast: Fix potential UAF in MLD delayed work
  * CVE-2026-72323
    - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()
  * CVE-2026-64541
    - net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket
  * CVE-2026-72339
    - qede: fix off-by-one in BD ring consumption on build_skb failure
  * CVE-2026-72348
    - netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop
  * CVE-2026-72351
    - gue: validate REMCSUM private option length
  * CVE-2026-72366
    - netfs: Fix netfs_create_write_req() to handle async cache object
      creation
  * CVE-2026-72381
    - ksmbd: fix use-after-free of fp->owner.name in durable handle owner
      check
  * CVE-2026-72393
    - eth: fbnic: don't cache shinfo across skb realloc
  * CVE-2026-72398
    - sctp: add INIT verification after cookie unpacking
  * CVE-2026-72399
    - net: enetc: check the number of BDs needed for xdp_frame
  * CVE-2026-64530
    - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle
  * CVE-2026-72422
    - ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2
      NEGOTIATE
  * CVE-2026-72429
    - ipv6: ioam: fix type confusion of dst_entry
  * CVE-2026-72436
    - netfilter: ipset: Fix data race between add and dump in all hash types
    - netfilter: ipset: annotate "pos" for concurrent readers/writers
    - netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash
      types
  * CVE-2026-72451
    - xfrm: Fix xfrm state cache insertion race
  * CVE-2026-72466
    - xprtrdma: Fix bcall rep leak and unbounded peek
  * CVE-2026-72472
    - nfs: use nfsi->rwsem to protect traversal of the file lock list
  * CVE-2026-72473
    - xprtrdma: Avoid 250 ms delay on backlog wakeup
    - xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot
    - xprtrdma: Post receive buffers after RPC completion
    - xprtrdma: Use sendctx DMA state for Send signaling
    - xprtrdma: Decouple req recycling from RPC completion
  * CVE-2026-72491
    - net/9p: fix race condition on rdma->state in trans_rdma.c
  * CVE-2026-72495 // CVE-2026-72501
    - RDMA/bnxt_re: Move the UAPI methods to a dedicated file
  * CVE-2026-74255
    - tipc: fix UAF in tipc_l2_send_msg()
  * CVE-2026-74267
    - net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek
      before restoring qlen
  * CVE-2026-74268
    - tcp: clear sock_ops cb flags before force-closing a child socket
  * CVE-2026-74287
    - sctp: validate embedded address parameter length
  * CVE-2026-74310
    - vhost/net: complete zerocopy ubufs only once
  * CVE-2026-74345
    - RDMA/siw: Fix endpoint/socket association handling
  * CVE-2026-74361
    - nvme: fix FDP fdpcidx bounds check
  * CVE-2026-74376
    - md/raid10: reset read_slot when reusing r10bio for discard
  * CVE-2026-74384
    - nvme-multipath: fix flex array size in struct nvme_ns_head
  * CVE-2026-74394
    - RDMA/srpt: fix integer overflow in immediate data length check
  * CVE-2026-74398
    - ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD
  * CVE-2026-74401
    - dlm: fix add msg handle in send_queue ordered
  * CVE-2026-74406
    - vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().
  * CVE-2026-74427
    - afs: Fix netns teardown to cancel the preallocation charger
    - afs: Fix further netns teardown to cancel the preallocation charger
  * CVE-2026-74428
    - rxrpc: Fix double unlock in rxrpc_recvmsg()
  * CVE-2026-74433
    - rxrpc: Fix UAF in rxgk_issue_challenge()
  * CVE-2026-74434
    - rxrpc: Don't move a peeked OOB message onto the pending queue
  * CVE-2026-74436
    - rxrpc: serialize kernel accept preallocation with socket teardown
  * CVE-2026-64535
    - nvmet-tcp: Fix potential UAF when ddgst mismatch
  * CVE-2026-74439
    - iommu/vt-d: Clear Present bit before tearing down scalable-mode context
      entry
  * CVE-2026-64534
    - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error
      path

 -- Stefan Bader <stefan.bader@canonical.com>  Fri, 04 Sep 2026 16:31:55 +0200

linux-hwe-7.0 (7.0.0-31.31~24.04.1) noble; urgency=medium

  * noble/linux-hwe-7.0: 7.0.0-31.31~24.04.1 -proposed tracker (LP: #2162412)

  [ Ubuntu: 7.0.0-31.31 ]

  * resolute/linux: 7.0.0-31.31 -proposed tracker (LP: #2162413)
  * Backport: "firmware: arm_ffa: Respect firmware advertised RX/TX buffer
    size limits" (LP: #2162012)
    - firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits
  * Backlight regression (LP: #2161309)
    - Revert "drm/i915/backlight: Remove try_vesa_interface"
  * Resolute real-time patchset: 7.0.1-rt2 (LP: #2161757)
    - SAUCE: Reapply "serial: 8250: Switch to nbcon console"
    - SAUCE: Reapply "serial: 8250: Revert "drop lockdep annotation from
      serial8250_clear_IER()""
    - Real-time patchset 7.0.1-rt2
  * Delta_Ubuntu24.04_Ubuntu (Waston)_Suspend(S3) Stress Test Fail when the
    A400 is on by remote controller . (LP: #2161385)
    - SAUCE: drm/amd/display: Tear down dangling pipe on boot to fix s0i3
  * Camera output is vague and color is abnormal (LP: #2156972)
    - media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for
      overlapping ranges
  * [SRU] Fix incorrect boot_display reporting on multi-GPU systems
    (LP: #2161036)
    - x86/video: Only fall back to vga_default_device() without screen info
  * Backport: complete perf_allow_* trio and use in drm/xe (LP: #2160654)
    - perf/core: out-of-line and export perf_allow_cpu/tracepoint()
    - drm/xe: gate observation streams with perf_allow_cpu()
  * Fix noise of audio output on Dell Pro QCM1255 after reboot (LP: #2160666)
    - ALSA: hda/realtek - Fixed Headphone noise issue for Dell QCM1255
  * Drop DEP-8 tests from kernel packages (LP: #2160302)
    - [Packaging] Drop DEP-8 tests from kernel source
  * The screen will show garbages by running glxgears fullscreen.
    (LP: #2158605)
    - SAUCE: drm/xe/display: skip FORCE_WC and vm_bound check for external
      dma-bufs
  * Audio shows Dummy Output on systems with Cirrus Logic cs42l43 codec
    (LP: #2156313)
    - ASoC: sdw_utils: fix missing component_name for cs42l43 part_id 0x2A3B
  * TPM2 key creation commands time out on some Infineon modules
    (LP: #2158883)
    - tpm: restore timeout for key creation commands
  * Fix Mic Mute LED no function on HP EliteBook (LP: #2158860)
    - ALSA: hda/realtek: Add LED fixup for HP EliteBook 6 G2i Laptops
  * Malformed HV_LINUX_VENDOR_ID breaks VM Availability Metric on Azure
    (LP: #2158462)
    - SAUCE: (no-up) hv: Fix supplied vendor ID
  * [SRU]Enable Realtek ALC287 + Cirrus CS35L56 Audio for Lenovo Yoga Pro 7
    (LP: #2156867)
    - ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Pro 7 15ASH111 audio
    - ALSA: hda/realtek:ALC269 fixup for Yoga Pro 7 15ASH11 mic mute LED
    - ASoC: amd: acp: Add DMI quirk for Lenovo Yoga Pro 7 15ASH11
  * iwlwifi failed to handle oversized command 0xC05 (LP: #2152688)
    - wifi: iwlwifi: mld: add support for iwl_mcc_allowed_ap_type_cmd v2
    - wifi: iwlwifi: mvm: avoid oversized UATS command copy
  * MT7925 wifi is hard blocked on Dell's machine (LP: #2158229)
    - SAUCE: Revert "wifi: mt76: mt7925: add rfkill_poll for hardware rfkill"
  * Resolute update: upstream stable patchset 2026-07-21 (LP: #2161462)
    - rust: str: use the "kernel vertical" imports style
    - rust: str: clean unused import for Rust >= 1.98
    - userfaultfd: gate must_wait writability check on pte_present()
    - device property: initialize the remaining fields of fwnode_handle in
      fwnode_init()
    - f2fs: fix potential deadlock in f2fs_balance_fs()
    - f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()
    - f2fs: fix listxattr handling of corrupted xattr entries
    - net/sched: dualpi2: fix GSO backlog accounting
    - mm/khugepaged: write all dirty file folios when collapsing
    - slab: recognize @GFP parameter as optional in kernel-doc
    - perf trace beauty fcntl: Fix build with older kernel headers
    - KVM: x86: Move update_cr8_intercept() to lapic.c
    - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest
      mode
    - KVM: x86: Unconditionally recompute CR8 intercept on PPR update
    - ACPI: CPPC: Suppress UBSAN warning caused by field misuse
    - ACPI: NFIT: core: Fix possible NULL pointer dereference
    - platform/x86: intel-hid: Protect ACPI notify handler against recursion
    - LoongArch: Add PIO for early access before ACPI PCI root register
    - rust: cpufreq: clean new `clippy::map_or_identity` lint for Rust 1.98.0
    - rust: block: fix GenDisk cleanup paths
    - rust: doctest: fix incorrect pattern in replacement
    - rust: Kbuild: set frame-pointer llvm module flag for
      CONFIG_FRAME_POINTER
    - futex/requeue: Revert "Prevent NULL pointer dereference in
      remove_waiter() on self-deadlock""
    - perf/core: Detach event groups during remove_on_exec
    - rust: kasan: KASAN+RUST requires clang
    - fscrypt: Replace mk_users keyring with simple list
    - usb: gadget: function: rndis: add length check to response query
    - usb: gadget: function: rndis: add length check for header
    - iio: accel: bmc150: clamp the device-reported FIFO frame count
    - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error
    - iio: adc: ad7380: select REGMAP
    - iio: adc: ad7768-1: Select GPIOLIB
    - iio: adc: ad7779: add missing 'select IIO_TRIGGERED_BUFFER' to Kconfig
    - iio: adc: ad_sigma_delta: fix clear_pending_event for registerless
      devices
    - iio: adc: ad_sigma_delta: fix CS held asserted and state leaks
    - iio: adc: lpc32xx: Initialize completion before requesting IRQ
    - iio: adc: spear: Initialize completion before requesting IRQ
    - iio: adc: ti-ads1119: fix PM reference leak in buffer preenable
    - iio: adc: ti-ads124s08: Return reset GPIO lookup errors
    - iio: backend: fix uninitialized data in debugfs
    - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug
    - iio: common: st_sensors: honour channel endianness in read_axis_data
    - iio: core: fix uninitialized data in debugfs
    - iio: dac: ad3552r-hs: fix uninitialized data ni
      ad3552r_hs_write_data_source()
    - iio: event: Fix event FIFO reset race
    - iio: gyro: bmg160: bail out when bandwidth/filter is not in table
    - iio: gyro: bmg160: wait full startup time after mode change at probe
    - iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ
    - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ
    - iio: imu: inv_icm42600: fix timestamp clock period by using lower value
    - iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading
    - iio: imu: st_lsm6dsx: deselect shub page before reading whoami
    - iio: light: al3000a: add missing REGMAP_I2C to Kconfig
    - iio: light: al3010: add missing REGMAP_I2C to Kconfig
    - iio: light: al3010: fix incorrect scale for the highest gain range
    - iio: light: al3010: read both ALS ADC registers again
    - iio: light: al3320a: add missing REGMAP_I2C to Kconfig
    - iio: light: al3320a: read both ALS ADC registers again
    - iio: light: gp2ap002: fix runtime PM leak on read error
    - iio: light: opt3001: fix missing state reset on timeout
    - iio: light: tsl2591: return actual error from probe IRQ failure
    - iio: light: veml6030: fix channel type when pushing events
    - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call
    - iio: pressure: bmp280: zero-init bmp580 trigger handler buffer
    - iio: pressure: mpl115: fix runtime PM leak on read error
    - iio: proximity: vl53l0x: notify trigger and clear IRQ on error paths
    - iio: resolver: ad2s1210: notify trigger and clear state on fault read
      error
    - iio: temperature: Build mlx90635 with CONFIG_MLX90635
    - iio: temperature: ltc2983: Fix n_wires default bypassing rotation check
    - iio: temperature: ltc2983: Fix reinit_completion() called after
      conversion start
    - iio: temperature: tmp006: use devm_iio_trigger_register
    - ALSA: usx2y: us144mkii: fix work UAF on disconnect
    - ALSA: virtio: Add missing 384 kHz PCM rate mapping
    - ALSA: virtio: Validate control metadata from the device
    - ALSA: ymfpci: check snd_ctl_new1() return value
    - ALSA: aoa: check snd_ctl_new1() return value
    - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input
      parser
    - ALSA: cmipci: check snd_ctl_new1() return value
    - ALSA: compress: Fix task creation error unwind
    - ALSA: es1938: check snd_ctl_new1() return value
    - ALSA: FCP: Add Focusrite ISA C8X support
    - ALSA: firewire: isight: bound the sample count to the packet payload
    - ALSA: gus: check snd_ctl_new1() return value
    - ALSA: hda/cs35l41: Fix firmware load work teardown
    - ALSA: hda/hdmi: Add force-connect quirk for HP EliteDesk 800 G5 Mini
    - ALSA: hda/hdmi: Use 'AC_PINSENSE_ELDV' to detect pinsense for Loongson
    - ALSA: hda/realtek: Fix noisy mic for Clevo V6xxAW
    - ALSA: ice1712: check snd_ctl_new1() return value
    - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()
    - ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts
      anchor list on each resubmission
    - ALSA: usb-audio: avoid kobject path lookup in DualSense match
    - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()
    - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch
      put callbacks
    - ALSA: usb-audio: Roll back quirk control caches on write errors
    - ALSA: usb-audio: Update Babyface Pro control caches only after
      successful writes
    - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful
      writes
    - vfio/pci: Use a private flag to prevent power state change with VFs
    - vfio/pci: Latch disable_idle_d3 per device
    - vfio/pci: Release the VGA arbiter client on register_device() failure
    - vfio/pci: Fix racy bitfields and tighten struct layout
    - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc
    - vfio: Remove device debugfs before releasing devres
    - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB
    - Bluetooth: btusb: fix use-after-free on registration failure
    - Bluetooth: btusb: fix use-after-free on marvell probe failure
    - Bluetooth: btusb: fix wakeup source leak on probe failure
    - binder: fix UAF in binder_thread_release()
    - binder: fix UAF in binder_free_transaction()
    - rust_binder: use a u64 stride when cleaning up the offsets array
    - rust_binder: reject context manager self-transaction
    - rust_binder: synchronize Rust Binder stats with freeze commands
    - rust_binder: clear freeze listener on node removal
    - usb: xhci: Fix sleep in atomic context in xhci_free_streams()
    - xhci: sideband: fix ring sg table pages leak
    - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres
    - PCI: loongson: Override PCIe bridge supported speeds for Loongson-3C6000
      series
    - PCI: altera: Do not dispose parent IRQ mapping
    - PCI: altera: Fix resource leaks on probe failure
    - PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining
    - PCI: host-common: Request bus reassignment when not probe-only
    - PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling
    - PCI: mediatek: Fix IRQ domain leak when port fails to enable
    - PCI: qcom: Initialize DWC MSI lock for firmware-managed ECAM hosts
    - PCI/IOV: Skip VF Resizable BAR restore on read error
    - tcp: restore RCU grace period in tcp_ao_destroy_sock
    - mm/damon/ops-common: handle extreme intervals in damon_hot_score()
    - netfilter: ipset: fix race between dump and ip_set_list resize
    - virtio_pci: fix vq info pointer lookup via wrong index
    - virtio-mmio: fix device release warning on module unload
    - hwrng: virtio: clamp device-reported used.len at copy_data()
    - USB: chaoskey: Fix slab-use-after-free in chaoskey_release()
    - usb: dwc3: run gadget disconnect from sleepable suspend context
    - usb: misc: usbio: fix disconnect UAF in client teardown
    - 6lowpan: fix NHC entry use-after-free on error path
    - tipc: fix out-of-bounds read in broadcast Gap ACK blocks
    - staging: vme_user: bound slave read/write to the kern_buf size
    - smb: client: restrict implied bcc[0] exemption to responses without data
      area
    - staging: vme_user: fix location monitor leak in fake bridge
    - staging: vme_user: fix location monitor leak in tsi148 bridge
    - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe
    - staging: media: atomisp: reduce load_primary_binaries() stack usage
    - staging: media: ipu7: fix double-free and use-after-free in error paths
    - staging: rtl8723bs: fix heap buffer overflow in
      rtw_cfg80211_set_wpa_ie()
    - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()
    - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop
    - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop
    - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and
      join_cmd_hdl()
    - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop
    - staging: rtl8723bs: fix OOB write in HT_caps_handler()
    - crypto: amlogic - avoid double cleanup in meson_crypto_probe()
    - crypto: krb5 - filter out async aead implementations at alloc
    - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then
      SMB2_CANCEL
    - net: af_key: initialize alg_key_len for IPComp states
    - audit: Fix data races of skb_queue_len() readers on audit_queue
    - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref
    - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete
    - coresight: etb10: restore atomic_t for shared reading state
    - debugobjects: Plug race against a concurrent OOM disable
    - fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns
    - NTB: epf: Avoid calling pci_irq_vector() from hardirq context
    - gpio: eic-sprd: use raw_spinlock_t in the irq startup path
    - gpio: sch: use raw_spinlock_t in the irq startup path
    - io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE
    - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item
    - io_uring/rw: preserve partial result for iopoll
    - netpoll: fix a use-after-free on shutdown path
    - ipv4: igmp: remove multicast group from hash table on device destruction
    - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes
    - mfd: cros_ec: Delay dev_set_drvdata() until probe success
    - mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()
    - mm: shrinker: fix shrinker_info teardown race with expansion
    - mm: shrinker: fix NULL pointer dereference in debugfs
    - mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless
      host
    - mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent
      softlockup
    - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump
    - netfilter: handle unreadable frags
    - netfilter: ebtables: zero chainstack array
    - netfilter: ebtables: module names must be null-terminated
    - netfilter: ebtables: terminate table name before find_table_lock()
    - netfilter: flowtable: fix offloaded ct timeout never being extended
    - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()
    - Bluetooth: bnep: pin L2CAP connection during netdev registration
    - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in
      nxp_recv_fw_req_v3()
    - Bluetooth: fix UAF in bt_accept_dequeue()
    - Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()
    - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled
    - Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()
    - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock
    - Bluetooth: L2CAP: validate option length before reading conf opt value
    - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()
    - smb: client: resolve SWN tcon from live registrations
    - smb/client: Fix error code in smb2_aead_req_alloc()
    - ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE
    - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA
    - ksmbd: serialize QUERY_DIRECTORY requests per file
    - ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock
      cancellation
    - ksmbd: require source read access for duplicate extents
    - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY
    - ksmbd: run set info with opener credentials
    - ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION
    - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION
    - ksmbd: use opener credentials for delete-on-close
    - ksmbd: use opener credentials for ADS I/O
    - smb: client: fix query directory replay double-free
    - smb: client: fix query_info() replay double-free
    - smb: client: fix double-free in SMB2_ioctl() replay
    - smb: client: fix change notify replay double-free
    - smb: client: fix double-free in SMB2_flush() replay
    - smb: client: fix double-free in SMB2_open() replay
    - smb: client: fix double-free in SMB2_close() replay
    - smb: client: Fix next buffer leak in receive_encrypted_standard()
    - smb: client: use unaligned reads in parse_posix_ctxt()
    - smb: client: harden POSIX SID length parsing
    - smb: client: fix atime clamp check in read completion
    - smb: client: mask server-provided mode to 07777 in modefromsid
    - writeback: fix race between cgroup_writeback_umount() and
      inode_switch_wbs()
    - OPP: of: Fix potential memory leak in opp_parse_supplies()
    - cpufreq: qcom-cpufreq-hw: Fix possible double free
    - firmware_loader: fix device reference leak in firmware_upload_register()
    - libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo()
    - perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box()
    - cpufreq: intel_pstate: Sync policy->cur during CPU offline
    - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT
    - cpufreq: Fix hotplug-suspend race during reboot
    - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation
    - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path
    - time/jiffies: Register jiffies clocksource before usage
    - clocksource/drivers/timer-tegra186: Fix support for multiple watchdog
      instances
    - s390: Revert support for DCACHE_WORD_ACCESS
    - [Config] Disable DCACHE_WORK_ACCESS for s390x
    - perf/arm-cmn: Fix DVM node events
    - X.509: Fix validation of ASN.1 certificate header
    - mm/slab: do not limit zeroing to orig_size when only red zoning is
      enabled
    - tools/mm/slabinfo: Fix trace disable logic inversion
    - tools/mm/slabinfo: fix total_objects attribute name
    - HID: hid-goodix-spi: validate report size to prevent stack buffer
      overflow
    - HID: uhid: convert to hid_safe_input_report()
    - HID: wacom: stop hardware after post-start probe failures
    - HID: pidff: Use correct effect type in effect update
    - HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert
    - HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush()
    - HID: letsketch: fix UAF on inrange_timer at driver unbind
    - HID: multitouch: fix out-of-bounds bit access on mt_io_flags
    - HID: appleir: fix UAF on pending key_up_timer in remove()
    - HID: lg-g15: cancel pending work on remove to fix a use-after-free
    - HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte
      reads
    - hfs/hfsplus: zero-initialize buffer in hfs_bnode_read
    - nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers
    - media: mtk-jpeg: cancel workqueue on release for supported platforms
      only
    - serial: 8250_mid: Disable DMA for selected platforms
    - xfs: use null daddr for unset first bad log block
    - xfs: release dquot buffer after dqflush failure
    - xfs: fix unreachable BIGTIME check in dquot flush validation
    - xfs: fix pointer arithmetic error on 32-bit systems
    - xfs: fix exchmaps reservation limit check
    - xfs: fix memory leak in xfs_dqinode_metadir_create()
    - bpf: Reject fragmented frames in devmap
    - bpf: Restore sysctl new-value from 1 to 0
    - bpf: Validate BTF repeated field counts before expansion
    - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()
    - usb: cdc_acm: Add quirk for Uniden BC125AT scanner
    - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()
    - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub
    - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume()
    - usb: free iso schedules on failed submit
    - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler
    - usb: gadget: udc: Fix use-after-free in gadget_match_driver
    - usb: gadget: f_printer: take kref only for successful open
    - USB: idmouse: fix use-after-free on disconnect race
    - USB: ldusb: fix use-after-free on disconnect race
    - USB: iowarrior: fix use-after-free on disconnect
    - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD
    - USB: legousbtower: fix use-after-free on disconnect race
    - usb: sl811-hcd: disable controller wakeup on remove
    - USB: storage: include US_FL_NO_SAME in quirks mask
    - usb: misc: usbio: bound bulk IN response length to the received transfer
    - USB: misc: uss720: unregister parport on probe failure
    - usb: mtu3: unmap request DMA on queue failure
    - USB: serial: keyspan_pda: fix information leak
    - USB: serial: option: add Telit Cinterion FE990D50 compositions
    - USB: serial: digi_acceleport: fix broken rx after throttle
    - USB: serial: digi_acceleport: fix hard lockup on disconnect
    - USB: serial: digi_acceleport: fix write buffer corruption
    - USB: ulpi: fix memory leak on registration failure
    - USB: usb-storage: ene_ub6250: restore media-ready check
    - usbip: tools: support SuperSpeedPlus devices
    - usbip: vudc: fix NULL deref in vep_dequeue()
    - usb: typec: anx7411: use devm_pm_runtime_enable()
    - usb: typec: class: drop PD lookup reference
    - usb: typec: tcpm: Fix VDM type for Enter Mode commands
    - usb: typec: tcpm: Validate SVID index in svdm_consume_modes()
    - usb: typec: ucsi: Invert DisplayPort role assignment
    - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt
      mode
    - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove
    - usb: typec: ucsi: cancel pending work on system suspend
    - usb: gadget: f_fs: Fix DMA fence leak
    - block: skip sync_blockdev() on surprise removal in bdev_mark_dead()
    - x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when
      SNC enabled
    - ontext]
    - rust_binder: fix BINDER_GET_EXTENDED_ERROR
    - bpf: Support for hardening against JIT spraying
    - x86/bugs: Enable IBPB flush on BPF JIT allocation
    - bpf: Restrict JIT predictor flush to cBPF
    - bpf: Skip redundant IBPB in pack allocator
    - bpf: Prefer packs that won't trigger an IBPB flush on allocation
    - bpf: Prefer dirty packs for eBPF allocations
    - udf: validate free block extents against the partition length
    - udf: validate VAT header length against the VAT inode size
    - udf: validate sparing table length as an entry count, not a byte count
    - hwrng: jh7110 - fix refcount leak in starfive_trng_read()
    - crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A
    - nvme: target: rdma: fix ndev refcount leak on queue connect
    - block: partitions: fix of_node refcount leak in of_partition()
    - dm-ioctl: report an error if a device has no table
    - nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace
      disks
    - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page
    - nvmet-auth: validate reply message payload bounds against transfer
      length
    - btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC
    - btrfs: do not trim a device which is not writeable
    - partitions: aix: bound the pp_count scan to the ppe array
    - isofs: bound Rock Ridge symlink components to the SL record
    - crypto: af_alg - Remove zero-copy support from skcipher and aead
    - crypto: caam - use print_hex_dump_devel to guard key hex dumps
    - crypto: caam - use print_hex_dump_devel to guard key hex dumps again
    - crypto: chacha20poly1305 - validate poly1305 template argument
    - crypto: crypto4xx - Remove insecure and unused rng_alg
    - crypto: ecc - Fix carry overflow in vli multiplication
    - crypto: hisi-trng - Remove crypto_rng interface
    - crypto: pcrypt - restore callback for non-parallel fallback
    - crypto: tegra - fix refcount leak in tegra_se_host1x_submit()
    - crypto: loongson - Select CRYPTO_RNG
    - crypto: ccp - Do not initialize SNP for SEV ioctls
    - crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)
    - crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD)
    - crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG)
    - crypto: drbg - Fix returning success on failure in CTR_DRBG
    - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels
    - crypto: drbg - Fix the fips_enabled priority boost
    - crypto: qat - centralize bus master enable
    - crypto: qat - handle sysfs-triggered reset callbacks
    - crypto: qat - keep VFs enabled during reset
    - crypto: qat - notify fatal error before AER reset preparation
    - crypto: qat - protect service table iterations with service_lock
    - crypto: qat - skip restart for down devices
    - crypto: qat - validate RSA CRT component lengths
    - crypto: qat - factor out AER reset helpers
    - crypto: talitos - use dma_sync_single_for_cpu() before reading
      descriptor header
    - crypto: talitos - add chaining of arbitrary number of descriptor for the
      SEC1
    - crypto: talitos - move dma unmapping code in flush_channel() into a
      standalone dma_unmap_request() function
    - crypto: talitos - move dma mapping code in talitos_submit() into a
      standalone dma_map_request() function
    - crypto: talitos - move code in current_desc_hdr() into a standalone
      function
    - crypto: talitos/hash - prepare SEC1 descriptor chaining, remove
      additional descriptor
    - crypto: talitos/hash - use descriptor chaining for SEC1 instead of
      workqueue
    - crypto: talitos/hash - drop workqueue mechanism for SEC1
    - crypto: talitos/hash - rename first_desc/last_desc to
      first_request/last_request
    - crypto: talitos/hash - remove useless wrapper
    - crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation
    - arm64: fpsimd: Fix type mismatch in sme_{save,load}_state()
    - spi: fsl-lpspi: replace dmaengine_terminate_all() with
      dmaengine_terminate_sync()
    - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path
    - x86/mm: Fix freeing of PMD-sized vmemmap pages
    - EDAC/i10nm: Don't fail probing if ADXL is missing
    - watchdog: apple: Add "apple,t8103-wdt" compatible
    - regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()
    - i2c: core: fix hang on adapter registration failure
    - perf/aux: Fix page UAF in map_range()
    - tracing: Prevent out-of-bounds read in glob matching
    - audit: fix potential integer overflow in audit_log_n_hex()
    - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC
    - rqspinlock: Fix order in raw_res_spin_(un)lock_irq to allow schedule
    - module: decompress: check return value of module_extend_max_pages()
    - exfat: bound uniname advance in exfat_find_dir_entry()
    - NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr()
    - riscv: mm: Define DIRECT_MAP_PHYSMEM_END
    - riscv: mm: Unconditionally sfence.vma for spurious fault
    - mm: fix mmap errno value when MAP_DROPPABLE is not supported
    - selftests: mm: fix and speedup "droppable" test
    - mm: page_ext: add count limit to page_ext_iter_next to prevent invalid
      PFN access
    - mm: do file ownership checks with the proper mount idmap
    - selftests/mm: pagemap_ioctl: use the correct page size for
      transact_test()
    - crypto: loongson - Remove broken and unused loongson-rng
    - iommu/vt-d: Avoid WARNING in sva unbind path
    - iommu/amd: Don't split flush for amd_iommu_domain_flush_all()
    - iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read
    - iommufd: Fix data_len byte-count vs element-count mismatch
    - iommufd: Set veventq_depth upper bound
    - iommufd: Rewind header length in done if iommufd_veventq_fops_read()
      fails
    - iommufd: Reject invalid read count in iommufd_veventq_fops_read()
    - iommufd: Reject invalid read count in iommufd_fault_fops_read()
    - iommufd: Break the loop on failure in iommufd_fault_fops_read()
    - iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read()
    - iommufd: Set upper bounds on cache invalidation entry_num and entry_len
    - audit: fix removal of dangling executable rules
    - landlock: Set audit_net.sk for socket access checks
    - selftests/landlock: Filter dealloc records in audit_count_records()
    - KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB
    - LoongArch: KVM: Add missing slots_lock for device register/unregister
    - KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU
    - KVM: x86: Add dedicated API for getting mask of accelerated x2APIC MSRs
    - KVM: SVM: Disable x2AVIC RDMSR interception for MSRs KVM actually
      supports
    - KVM: SVM: Only disable x2AVIC WRMSR interception for MSRs that are
      accelerated
    - KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs
    - KVM: VMX: Handle bad values on proxied writes to LBR MSRs
    - KVM: x86: Ensure vendor's exit handler runs before fastpath userspace
      exits
    - KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier
    - udmabuf: fix DMA direction mismatch in release_udmabuf()
    - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning
    - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()
    - i2c: core: fix irq domain leak on adapter registration failure
    - i2c: core: fix NULL-deref on adapter registration failure
    - i2c: core: fix adapter probe deferral loop
    - i2c: core: fix adapter debugfs creation
    - i2c: core: fix adapter deregistration race
    - i2c: mpc: Fix timeout calculations
    - i2c: davinci: Unregister cpufreq notifier on probe failure
    - i2c: stm32f7: truncate clock period instead of rounding it
    - i2c: imx-lpi2c: mark I2C adapter when hardware is powered down
    - i2c: i801: fix hardware state machine corruption in error path
    - Input: synaptics-rmi4 - unregister function handlers on physical driver
      registration failure
    - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count
    - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count
    - Input: elan_i2c - prevent division by zero and arithmetic underflow
    - Input: goodix - clamp the device-reported contact count
    - Input: iforce - bound the device-reported force-feedback effect index
    - Input: mms114 - fix touch indexing for MMS134S and MMS136
    - Input: ads7846 - don't use scratch for tx_buf when clearing register
    - Input: touchwin - reset the packet index on every complete packet
    - Input: mms114 - reject an oversized device packet size
    - Input: gscps2 - advance receive buffer write index
    - Input: maplemouse - fix NULL pointer dereference in open()
    - Input: mms114 - fix multi-touch slot corruption
    - Input: maple_keyb - set driver data before registering input device
    - Input: maplemouse - set driver data before registering input device
    - Input: maplecontrol - set driver data before registering input device
    - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg
    - RDMA/core: Fix broadcast address falsely detected as local
    - RDMA/siw: bound Read Response placement to the RREAD length
    - fuse: back uncached readdir buffers with pages
    - fuse: avoid 32-bit prune notification count wrap
    - fuse: fix device node leak in cuse_process_init_reply()
    - fuse: re-lock request before returning from fuse_ref_folio()
    - fuse: fix io-uring background queue dispatch on request completion
    - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req
    - fuse-uring: fix EFAULT clobber in fuse_uring_commit
    - fuse-uring: fix data races on ring->ready
    - fuse-uring: fix moving cancelled entry to ent_in_userspace list
    - fuse-uring: end fuse_req on io-uring cancel task work
    - fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues
    - fuse-uring: Avoid queue->stopped races and set/read that value under
      lock
    - fuse-uring: make a fuse_req on SQE commit only findable after memcpy
    - fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL
      deref
    - usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction
      checks
    - timekeeping: Register default clocksource before taking tk_core.lock
    - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote
      netdev
    - smb: client: reject overlapping data areas in SMB2 responses
    - xfs: fix null pointer dereference in tracepoint
    - xfs: fail recovery on a committed log item with no regions
    - xfs: resample the data fork mapping after cycling ILOCK
    - xfs: don't wrap around quota ids in dqiterate
    - xfs: grab rtrmap btree when checking rgsuper
    - xfs: use the rt version of the cow staging checker
    - xfs: set xfarray killable sort correctly
    - xfs: handle non-inode owners for rtrmap record checking
    - xfs: clamp timestamp nanoseconds correctly
    - xfs: fully check the parent handle when it points to the rootdir
    - xfs: don't zap bmbt forks if they are MAXLEVELS tall
    - xfs: fix off-by-one error when calling xchk_xref_has_rt_owner
    - xfs: write the rg superblock when fixing it
    - xfs: use rtrefcount btree cursor in xchk_xref_is_rt_cow_staging
    - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup
    - rust: pci: use 'static lifetime for PCI BAR resource names
    - iio: adc: ad4062: add GPIOLIB dependency
    - iio: adc: nxp-sar-adc: Fix the delay calculation in
      nxp_sar_adc_wait_for()
    - ALSA: usb-audio: add IFB_SILENCE_ON_EMPTY quirk for Behringer Flow 8
    - vfio/mlx5: Fix racy bitfields and tighten struct layout
    - riscv: dts: sophgo: Add dma-coherent to SG2042 PCIe controllers
    - PCI: imx6: Configure REF_USE_PAD before PHY reset for i.MX95
    - PCI: imx6: Assert ref_clk_en after reference clock stabilizes on i.MX95
    - PCI: Skip Resizable BAR restore on read error
    - tracing: Fix NULL pointer dereference in func_set_flag()
    - staging: rtl8723bs: don't drop short TX frames in _rtw_pktfile_read()
    - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(),
      rtw_get_wapi_ie(), and rtw_get_wps_attr()
    - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()
    - media: nxp: imx8-isi: Fix use-after-free on remove
    - netfilter: flowtable: IPIP tunnel hardware offload is not yet support
    - ksmbd: prevent path traversal bypass by restricting caseless retry
    - ksmbd: centralize ksmbd_conn final release to plug transport leak
    - ksmbd: track the connection owning a byte-range lock
    - ksmbd: validate NTLMv2 response before updating session key
    - smb/client: fix chown/chgrp with SMB3 POSIX Extensions
    - smb/server: do not require delete access for non-replacing links
    - proc: protect ptrace_may_access() with exec_update_lock (FD links)
    - proc: protect ptrace_may_access() with exec_update_lock (part 1)
    - hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length
    - xfs: pass back updated nb from xfs_growfs_compute_deltas
    - xfs: only log freed extents for the current RTG in zoned growfs
    - xfs: initialize iomap->flags earlier in xfs_bmbt_to_iomap
    - bpf: Keep dynamic inner array lookups nullable
    - bpf: Allow LPM map access from sleepable BPF programs
    - USB: iowarrior: fix use-after-free on disconnect race
    - usb: typec: ps883x: Fix DP+USB3 configuration
    - usb: gadget: f_fs: initialize reset_work at allocation time
    - usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile
    - wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon
    - crypto: atmel-sha204a - fail on hwrng registration error in probe path
    - btrfs: fix false IO failure after falling back to buffered write
    - btrfs: fix incorrect buffered IO fallback for append direct writes
    - crypto: drbg - Fix misaligned writes in CTR_DRBG and HASH_DRBG
    - crypto: drbg - Fix ineffective sanity check
    - crypto: qat - fix restarting state leak on allocation failure
    - liveupdate: reject LIVEUPDATE_IOCTL_CREATE_SESSION with invalid name
      length
    - selftests/liveupdate: add test cases for LIVEUPDATE_IOCTL_CREATE_SESSION
      calls with invalid length
    - exfat: fix incorrect directory checksum after rename to shorter name
    - exfat: preserve benign secondary entries during rename and move
    - lib/test_hmm: use kvfree() to free kvcalloc() allocations
    - selftests/mm: fix ksft_process_madv.sh test category
    - nouveau/vmm: fix another SPT/LPT race
    - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is
      uninitialized
    - iommufd: Move vevent memory allocation outside spinlock
    - iommufd: Propagate allocation failure in iommufd_veventq_deliver_fetch()
    - selftests/landlock: Fix socket file descriptor leaks in audit helpers
    - selftests/landlock: Explicitly disable audit in teardowns
    - landlock: Account all audit data allocations to user space
    - selftests/landlock: Increase default audit socket timeout
    - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU
    - KVM: SEV: Pin source page for write when adding CPUID data for SNP guest
    - KVM: SEV: Don't terminate SNP VMs on #VMGEXIT without a registered GHCB
    - KVM: TDX: Account all non-transient page allocations for per-TD
      structures
    - KVM: guest_memfd: Treat memslot binding offset+size as unsigned values
    - Revert "fuse: fix conversion of fuse_reverse_inval_entry() to
      start_removing()"
    - fuse: do not use start_removing_noperm()
    - ALSA: doc: usb-audio: Add doc for QUIRK_FLAG_IFB_SILENCE_ON_EMPTY
    - ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd
    - Upstream stable to v6.18.39, v7.1.4
  * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733)
    - Revert "PCI: qcom: Advertise Hotplug Slot Capability with no Command
      Completion support"
    - batman-adv: tp_meter: keep unacked list in ascending ordered
    - batman-adv: tp_meter: initialize dup_acks explicitly
    - batman-adv: tp_meter: initialize dec_cwnd explicitly
    - batman-adv: tp_meter: avoid window underflow
    - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd
    - batman-adv: tp_meter: fix fast recovery precondition
    - batman-adv: tp_meter: handle seqno wrap-around for fast recovery
      detection
    - batman-adv: tp_meter: add only finished tp_vars to lists
    - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE
    - batman-adv: prevent ELP transmission interval underflow
    - batman-adv: tp_meter: initialize last_recv_time during init
    - batman-adv: gw: don't deselect gateway with active hardif
    - batman-adv: ensure bcast is writable before modifying TTL
    - batman-adv: fix (m|b)cast csum after decrementing TTL
    - batman-adv: frag: ensure fragment is writable before modifying TTL
    - batman-adv: frag: avoid underflow of TTL
    - batman-adv: v: prevent OGM aggregation on disabled hardif
    - batman-adv: tp_meter: restrict number of unacked list entries
    - batman-adv: tp_meter: annotate last_recv_time access with
      READ/WRITE_ONCE
    - batman-adv: tp_meter: prevent parallel modifications of last_recv
    - batman-adv: tp_meter: handle overlapping packets
    - batman-adv: tt: don't merge change entries with different VIDs
    - batman-adv: tt: track roam count per VID
    - batman-adv: dat: prevent false sharing between VLANs
    - batman-adv: tvlv: enforce 2-byte alignment
    - batman-adv: tvlv: avoid race of cifsnotfound handler state
    - ipv4: account for fraggap on the paged allocation path
    - ntfs3: reject direct userspace writes to reserved $LX* xattrs
    - wifi: mt76: add wcid publish check in mt76_sta_add
    - mac802154: llsec: add skb_cow_data() before in-place crypto
    - net: skmsg: preserve sg.copy across SG transforms
    - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink
    - apparmor: mediate the implicit connect of TCP fast open sendmsg
    - apparmor: fix use-after-free in rawdata dedup loop
    - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG
      share BAR
    - fbdev: fix use-after-free in store_modes()
    - kernel/fork: clear PF_BLOCK_TS in copy_process()
    - block: invalidate cached plug timestamp after task switch
    - KVM: arm64: Omit tag sync on stage-2 mappings of the zero page
    - err.h: use __always_inline on all error pointer helpers
    - gcov: use atomic counter updates to fix concurrent access crashes
    - KEYS: fix overflow in keyctl_pkey_params_get_2()
    - keys: Pin request_key_auth payload in instantiate paths
    - userfaultfd: ensure mremap_userfaultfd_fail() releases mmap_changing
    - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S
    - wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer
    - wifi: ath11k: fix warning when unbinding
    - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor
    - wifi: rtw88: increase TX report timeout to fix race condition
    - wifi: rtw88: usb: fix memory leaks on USB write failures
    - wifi: iwlwifi: mvm: fix race condition in PTP removal
    - wifi: iwlwifi: mld: fix race condition in PTP removal
    - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session
      handlers
    - f2fs: pass correct iostat type for single node writes
    - f2fs: validate orphan inode entry count
    - f2fs: validate compress cache inode only when enabled
    - f2fs: fix to round down start offset of fallocate for pin file
    - f2fs: validate ACL entry sizes in f2fs_acl_from_disk()
    - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()
    - f2fs: keep atomic write retry from zeroing original data
    - block: Avoid mounting the bdev pseudo-filesystem in userspace
    - bpf: use kvfree() for replaced sysctl write buffer
    - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS
    - exfat: fix potential use-after-free in exfat_find_dir_entry()
    - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping
      level
    - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with
      get_unaligned()
    - crypto: nx - fix nx_crypto_ctx_exit argument
    - gfs2: fix use-after-free in gfs2_qd_dealloc
    - pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()
    - hdlc_ppp: sync per-proto timers before freeing hdlc state
    - blk-cgroup: fix UAF in __blkcg_rstat_flush()
    - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done
    - LoongArch: Report dying CPU to RCU in stop_this_cpu()
    - pNFS: Fix use-after-free in pnfs_update_layout()
    - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup
      on remove
    - fpga: region: fix use-after-free in child_regions_with_firmware()
    - rpmsg: char: Fix use-after-free on probe error path
    - ocfs2: reject oversized group bitmap descriptors
    - 9p: avoid putting oldfid in p9_client_walk() error path
    - MIPS: smp: report dying CPU to RCU in stop_this_cpu()
    - KVM: x86: hyper-v: Bound the bank index when querying sparse banks
    - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path
    - power: reset: linkstation-poweroff: fix use-after-free in the
      linkstation_poweroff_init()
    - riscv: mm: Extract helper mark_new_valid_map()
    - riscv: kfence: Call mark_new_valid_map() for kfence_unprotect()
    - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in
      fb_videomode_to_var
    - fbdev: modedb: fix a possible UAF in fb_find_mode()
    - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode
    - i2c: core: fix adapter registration race
    - NFSD: Fix SECINFO_NO_NAME decode error cleanup
    - nfsd: fix posix_acl leak on SETACL decode failure
    - nfsd: fix inverted cp_ttl check in async copy reaper
    - nfsd: check get_user() return when reading princhashlen
    - nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race
    - nfsd: reset write verifier on deferred writeback errors
    - NFSv4/flexfiles: reject zero filehandle version count
    - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
    - NFSv4: clear exception state on successful mkdir retry
    - NFS: Prevent resource leak in nfs_alloc_server()
    - ksmbd: fix out-of-bounds read in smb_check_perm_dacl()
    - net/tcp-ao: fix use-after-free of key in del_async path
    - apparmor: advertise the tcp fast open fix is applied
    - PCI/P2PDMA: Add Intel QAT, DSA, IAA devices to whitelist
    - fscrypt: Fix key setup in edge case with multiple data unit sizes
    - wifi: rtl8xxxu: Detect the maximum supported channel width
    - f2fs: fix missing read bio submission on large folio error
    - f2fs: reject setattr size changes on large folio files
    - f2fs: fix to do sanity check on f2fs_get_node_folio_ra()
    - f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode
    - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes
    - Revert "f2fs: remove non-uptodate folio from the page cache in
      move_data_block"
    - f2fs: read COW data with the original inode during atomic write
    - sched/mmcid: Fix OOB clear_bit when CID is MM_CID_UNSET in fixup path
    - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()
    - fbdev: omap2: fix inconsistent lock returns in omapfb_mmap
    - fbdev: omap2: fix use-after-free in omapfb_mmap
    - nfsd: release layout stid on setlease failure
    - nfsd: fix posix_acl leak and ignored error in nfsd4_create_file
    - nfsd: fix dead ACL conflict guard in nfsd4_create
    - Upstream stable to v6.18.38, v7.1.3
  * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733) //
    CVE-2026-53361
    - af_unix: Set gc_in_progress to true in unix_gc().
  * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733) //
    CVE-2026-53362
    - ipv6: account for fraggap on the paged allocation path
  * Resolute update: v7.0.14 upstream stable release (LP: #2158815)
    - io_uring/net: Avoid msghdr on op_connect/op_bind async data
    - arm64/entry: Fix arm64-specific rseq brokenness
    - lockd: fix TEST handling when not all permissions are available.
    - firmware: exynos-acpm: Count number of commands in acpm_xfer
    - firmware: exynos-acpm: Count acpm_xfer buffers with __counted_by_ptr
    - firmware: samsung: acpm: Fix cross-thread RX length corruption
    - firmware: samsung: acpm: Fix false timeouts and Use-After-Free in
      polling
    - firmware: samsung: acpm: Fix missing LKMM barriers in sequence allocator
    - fuse: re-lock request before replacing page cache folio
    - Revert "NFSD: Defer sub-object cleanup in export put callbacks"
    - RDMA/bnxt_re: zero shared page before exposing to userspace
    - i2c: stub: Reject I2C block transfers with invalid length
    - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()
    - rose: fix dev_put() leak in rose_loopback_timer()
    - rose: hold loopback neighbour reference across timer callback
    - rose: fix race between loopback timer and module removal
    - rose: clear neighbour pointer after rose_neigh_put() in state machines
    - rose: guard rose_neigh_put() against NULL in timer expiry
    - rose: fix netdev double-hold in rose_rx_call_request()
    - rose: fix notifier unregistered too early in rose_exit()
    - rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup
    - rose: disconnect orphaned STATE_2 sockets when device is gone
    - rose: fix netdev double-hold in rose_make_new()
    - rose: release netdev ref and destroy orphaned incoming sockets
    - rose: drop CALL_REQUEST in loopback timer when device is not running
    - rose: cancel neighbour timers in rose_neigh_put() before freeing
    - rose: clear neighbour pointer in rose_kill_by_device()
    - rose: don't free fd-owned sockets when reaping in the heartbeat
    - net: export netif_open for self_test usage
    - net: net_failover: Fix the deadlock in slave register
    - iio: light: veml6075: add bounds check to veml6075_it_ms index
    - iio: adc: ti-ads1298: add bounds check to pga_settings index
    - crypto: qat - remove unused character device and IOCTLs
    - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent
      vcs_write
    - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero
    - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails
    - drivers/base/memory: set mem->altmap after successful device
      registration
    - ksmbd: reject non-VALID session in compound request branch
    - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
    - virtiofs: fix UAF on submount umount
    - Linux 7.0.14
  * Resolute update: v7.0.14 upstream stable release (LP: #2158815) //
    CVE-2026-53325
    - agp/amd64: Fix broken error propagation in agp_amd64_probe()
  * Resolute update: v7.0.14 upstream stable release (LP: #2158815) //
    CVE-2026-52938
    - bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths
  * Resolute update: v7.0.13 upstream stable release (LP: #2158003)
    - bpf: Free reuseport cBPF prog after RCU grace period.
    - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl
    - Bluetooth: ISO: Fix a use-after-free of the hci_conn pointer
    - ipv6: mcast: Fix use-after-free when processing MLD queries
    - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS
    - tee: optee: prevent use-after-free when the client exits before the
      supplicant
    - soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE
    - arm64: dts: qcom: x1-dell-thena: remove i2c20 (battery SMBus) and
      reserve its pins
    - ARM: dts: microchip: sam9x7: fix GMAC clock configuration
    - soc: qcom: ice: Return -ENODEV if the ICE platform device is not found
    - tee: fix tee_ioctl_object_invoke_arg padding
    - tee: qcomtee: add missing va_end in early return
      qcomtee_object_user_init()
    - s390/bug: Always emit format word in __BUG_ENTRY
    - ARM: dts: gemini: Fix partition offsets
    - erofs: fix use-after-free on sbi->sync_decompress
    - wifi: iwlwifi: mvm: don't support the reset handshake for old firmwares
    - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers
    - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id
    - ipvs: clear the svc scheduler ptr early on edit
    - netfilter: synproxy: add mutex to guard hook reference counting
    - netfilter: conntrack_irc: fix possible out-of-bounds read
    - netfilter: nft_ct: bail out on template ct in get eval
    - netfilter: bridge: make ebt_snat ARP rewrite writable
    - dm cache policy smq: check allocation under invalidate lock
    - net/sched: act_api: use RCU with deferred freeing for action lifecycle
    - 6lowpan: fix off-by-one in multicast context address compression
    - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()
    - devlink: Release nested relation on devlink free
    - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c
    - wifi: mac80211: limit injected antenna index in
      ieee80211_parse_tx_radiotap
    - pcnet32: stop holding device spin lock during napi_complete_done
    - net: Annotate sk->sk_write_space() for UDP SOCKMAP.
    - hsr: Remove WARN_ONCE() in hsr_addr_is_self().
    - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr
    - net: lan743x: permit VLAN-tagged packets up to configured MTU
    - net: fec: fix pinctrl default state restore order on resume
    - ipv6: anycast: insert aca into global hash under idev->lock
    - wifi: fix leak if split 6 GHz scanning fails
    - wifi: cfg80211: add support to handle incumbent signal detected event
      from mac80211/driver
    - wifi: nl80211: split out UHR operation information
    - wifi: cfg80211: enforce HE/EHT cap/oper consistency
    - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()
    - Bluetooth: MGMT: validate advertising TLV before type checks
    - Bluetooth: RFCOMM: validate skb length in MCC handlers
    - Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame()
      extension handling
    - Bluetooth: bnep: reject short frames before parsing
    - Bluetooth: fix memory leak in error path of hci_alloc_dev()
    - Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync
    - Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls
    - Bluetooth: SCO: Fix data-race on sco_pi fields in sco_connect
    - Bluetooth: MGMT: Fix backward compatibility with userspace
    - xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata()
    - octeontx2-pf: Fix NDC sync operation errors
    - octeontx2-af: Fix initialization of mcam's entry2target_pffunc field
    - af_unix: Fix inq_len update problem in partial read
    - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options
    - ptp: vclock: Switch from RCU to SRCU
    - net: airoha: Fix use-after-free in metadata dst teardown
    - geneve: fix length used in GRO hint UDP checksum adjustment
    - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow
    - vxlan: vnifilter: send notification on VNI add
    - vxlan: vnifilter: fix spurious notification on VNI update
    - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()
    - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr
    - bonding: annotate data-races arcound churn variables
    - fwctl/bnxt_en: Move common definitions to include/linux/bnxt/
    - fwctl/bnxt_en: Refactor aux bus functions to be more generic
    - Reapply "bnxt_en: bring back rtnl_lock() in the bnxt_open() path"
    - Drivers: hv: vmbus: Provide option to skip VMBus unload on panic
    - drm/hyperv: During panic do VMBus unload after frame buffer is flushed
    - selftests: harness: fix pidfd leak in __wait_for_test
    - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()
    - regulator: mt6363: select CONFIG_IRQ_DOMAIN
    - hyperv: Clean up and fix the guest ID comment in hvgdk.h
    - VFS: fix possible failure to unlock in nfsd4_create_file()
    - crypto: s390 - add select CRYPTO_AEAD for aes
    - rseq: Fix using an uninitialized stack variable in
      rseq_exit_user_update()
    - time: Fix off-by-one in settimeofday() usec validation
    - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked
      streams
    - ALSA: seq: dummy: fix UMP event stack overread
    - x86/resctrl: Only check Intel systems for SNC
    - cpufreq/amd-pstate: drop stale @epp_cached kdoc
    - rtla: Fix parsing of multi-character short options
    - tools/rv: Ensure monitor name and desc are NUL-terminated
    - tools/rv: Fix substring match bug in monitor name search
    - tools/rv: Fix substring match when listing container monitors
    - tools/rv: Fix cleanup after failed trace setup
    - verification/rvgen: Fix options shared among commands
    - verification/rvgen: Fix ltl2k writing True as a literal
    - riscv/ptrace: Use USER_REGSET_NOTE_TYPE for REGSET_CFI
    - riscv: cfi: reject unknown flags in PR_SET_CFI
    - xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload
    - dma-mapping: direct: fix missing mapping for THRU_HOST_BRIDGE segments
    - dma-debug: fix physical address retrieval in
      debug_dma_sync_sg_for_device
    - xfrm: policy: fix use-after-free on inexact bin in
      xfrm_policy_bysel_ctx()
    - ice: fix missing priority callbacks for U.FL DPLL pins
    - idpf: fix mailbox capability for set device clock time
    - net: ena: PHC: Add missing barrier
    - bnge: fix context mem iteration
    - netlabel: validate unlabeled address and mask attribute lengths
    - gpio: mvebu: fix NULL pointer dereference in suspend/resume
    - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls
    - tcp: restrict SO_ATTACH_FILTER to priv users
    - net: add pskb_may_pull() to skb_gro_receive_list()
    - net/mlx4: avoid GCC 10 __bad_copy_from() false positive
    - net: ibm: emac: Fix use-after-free during device removal
    - netdev: fix double-free in netdev_nl_bind_rx_doit()
    - net: phy: clean the sfp upstream if phy probing fails
    - net: phy: remove phy ports upon probe failure
    - net: phy: Clean the phy_ports after unregistering the downstream SFP bus
    - net: phy: don't try to setup PHY-driven SFP cages when using genphy
    - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove
    - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list
    - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure
    - net/mlx5: Use effective affinity mask for IRQ selection
    - net: openvswitch: fix possible kfree_skb of ERR_PTR
    - r8152: handle the return value of usb_reset_device()
    - gpio: zynq: fix runtime PM leak on remove
    - gpio: rockchip: fix generic IRQ chip leak on remove
    - net: mctp: usb: fix race between urb completion and rx_retry
      cancellation
    - net: mctp: usb: don't fail mctp_usb_rx_queue on a deferred submission
    - esp: fix page frag reference leak on skb_to_sgvec failure
    - ASoC: SOF: amd: fix for ipc flags check
    - ip6_vti: set netns_immutable on the fallback device.
    - net: guard timestamp cmsgs to real error queue skbs
    - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic
      completion
    - tun: zero the whole vnet header in tun_put_user()
    - ptp: ocp: fix resource freeing order
    - rds: mark snapshot pages dirty in rds_info_getsockopt()
    - spi: rzv2h-rspi: Fix SPDR read access width for 16-bit RX
    - netfilter: revalidate bridge ports
    - netfilter: nf_conntrack: destroy stale expectfn expectations on
      unregister
    - netfilter: x_tables: avoid leaking percpu counter pointers
    - netfilter: nf_log: validate MAC header was set before dumping it
    - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag
    - net: mvpp2: sync RX data at the hardware packet offset
    - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS
    - net: txgbe: initialize module info buffer
    - net: txgbe: distinguish module types by checking identifier
    - net: txgbe: initialize PHY interface to 0
    - ipv6: Fix a potential NPD in cleanup_prefix_route()
    - ASoC: SDCA: fix NULL pointer dereference in
      sdca_dev_unregister_functions
    - clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from getting
      parked
    - clk: samsung: gs101: Fix missing USI7_USI DIV clock in peric0_clk_regs
    - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time
    - drm/i915/edp: Check supported link rates DPCD read
    - drm/virtio: Fix driver removal with disabled KMS
    - drm/vc4: fix krealloc() memory leak
    - drm/colorop: Remove read-only comments from interpolation fields
    - drm/colorop: make lut(1/3)d_interpolation props correctly behave as
      mutable
    - drm/atomic: track individual colorop updates
    - drm/amd/display: use plane color_mgmt_changed to track colorop changes
    - drm/xe: fix refcount leak in xe_range_fence_insert()
    - drm/xe: fix job timeout recovery for unstarted jobs and kernel queues
    - accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()
    - namespace: restrict OPEN_TREE_NAMESPACE/FSMOUNT_NAMESPACE to directories
    - netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register
    - tee: shm: fix shm leak in register_shm_helper()
    - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend
    - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig
    - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get()
    - mm/memory-failure: fix hugetlb_lock AA deadlock in
      get_huge_page_for_hwpoison
    - Revert "drm/xe/nvls: Define GuC firmware for NVL-S"
    - accel/ivpu: Add bounds check for firmware runtime memory
    - accel/ivpu: Add bounds checks for firmware log indices
    - firmware: stratix10-svc: Don't fail probe when async ops unsupported
    - firmware: stratix10-svc: Return -EOPNOTSUPP when ATF async unsupported
    - firmware: stratix10-rsu: Fix NULL deref on rsu_send_msg() timeout in
      probe
    - accel/ivpu: Add buffer overflow check in MS get_info_ioctl
    - accel/ivpu: Fix signed integer truncation in IPC receive
    - tracing: Fix CFI violation in probestub being called by tprobes
    - tracing/probes: Point the error offset correctly for eprobe argument
      error
    - cgroup/cpuset: Use effective_xcpus in partcmd_update add/del mask
      calculation
    - Revert "drm/xe: Skip exec queue schedule toggle if queue is idle during
      suspend"
    - rust: x86: support Rust >= 1.98.0 target spec
    - ARM: Do not select HAVE_RUST when KASAN is enabled
    - rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES
    - rust: kasan/kbuild: fix rustc-option when cross-compiling
    - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation
    - cfi: Include uaccess.h for get_kernel_nofault()
    - mshv: add a missing padding field
    - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying
    - KVM: SEV: Decouple the need to sync the GHCB SA from the need to free
      the SA
    - KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX
    - KVM: arm64: Correctly identify executable PTEs at stage-2
    - KVM: arm64: Restore POR_EL0 access to host EL0
    - drm/i915/gem: Fix phys BO pread/pwrite with offset
    - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf
    - pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init
    - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL
    - xfrm: espintcp: do not reuse an in-progress partial send
    - xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()
    - USB: serial: io_ti: fix heap overflow in get_manuf_info()
    - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()
    - USB: serial: option: add usb-id for Dell Wireless DW5826e-m
    - USB: serial: kl5kusb105: fix bulk-out buffer overflow
    - ALSA: timer: Forcibly close timer instances at closing
    - ALSA: timer: Fix UAF at snd_timer_user_params()
    - io_uring/wait: fix min_timeout behavior
    - io_uring/kbuf: don't truncate end buffer for bundles
    - io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries
    - drm/virtio: fix dma_fence refcount leak on error in
      virtio_gpu_dma_fence_wait()
    - drm/amd/display: Reject gpio_bitshift >= 32 in
      bios_parser_get_gpio_pin_info()
    - mm/huge_memory: update file PMD counter before folio_put()
    - mm/damon/ops-common: call folio_test_lru() after folio_get()
    - mm/huge_memory: update file PUD counter before folio_put()
    - RDMA/core: Validate the passed in fops for ib_get_ucaps()
    - RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc
    - zram: fix use-after-free in zram_bvec_write_partial()
    - udp: clear skb->dev before running a sockmap verdict
    - ARM: socfpga: Fix OF node refcount leak in SMP setup
    - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O
    - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow
    - arm64: mm: call pagetable dtor when freeing hot-removed page tables
    - mptcp: fix missing wakeups in edge scenarios
    - mptcp: fix retransmission loop when csum is enabled
    - mptcp: close TOCTOU race while computing rcv_wnd
    - mptcp: allow subflow rcv wnd to shrink
    - mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation
    - mptcp: check desc->count in read_sock
    - mptcp: sockopt: check timestamping ret value
    - mptcp: sockopt: set sockopt on all subflows
    - selftests: mptcp: add test for extra_subflows underflow on userspace PM
    - mptcp: add-addr: always drop other suboptions
    - xfs: fix error returns in CoW fork repair
    - xfs: fix rtgroup cleanup in CoW fork repair
    - wifi: iwlwifi: pcie: simplify the resume flow if fast resume is not used
    - wifi: nl80211: reject oversized EMA RNR lists
    - vsock/vmci: fix sk_ack_backlog leak on failed handshake
    - timers/migration: Fix livelock in tmigr_handle_remote_up()
    - spi: qcom-geni: Fix cs_change handling on the last transfer
    - staging: rtl8723bs: fix buffer over-read in rtw_update_protection
    - staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length
      subtraction
    - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write
    - bnxt_en: Fix NULL pointer dereference
    - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs
    - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()
    - hv: utils: handle and propagate errors in kvp_register
    - pidfd: refuse access to tasks that have started exiting harder
    - accel/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate()
    - accel/ethosu: fix IFM region index out-of-bounds in command stream
      parser
    - accel/ethosu: fix wrong weight index in NPU_SET_SCALE1_LENGTH on U85
    - accel/ethosu: fix arithmetic issues in dma_length()
    - accel/ethosu: reject DMA commands with uninitialized length
    - accel/ethosu: reject NPU_OP_RESIZE commands from userspace
    - fs/qnx6: fix pointer arithmetic in directory iteration
    - fuse: reject fuse_notify() pagecache ops on directories
    - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios
    - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on
      self-deadlock
    - i2c: imx-lpi2c: fix resource leaks switching to devm_dma_request_chan()
    - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM
    - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()
    - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter
    - i2c: tegra: Fix NOIRQ suspend/resume
    - Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)
    - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard
    - iomap: avoid potential null folio->mapping deref during error reporting
    - iommu/dma: Do not try to iommu_map a 0 length region in swiotlb
    - ipc/shm: serialize orphan cleanup with shm_nattch updates
    - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued
    - memcg: use round-robin victim selection in refill_stock
    - memory: atmel-ebi: Allow deferred probing
    - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context
    - misc: fastrpc: fix use-after-free race in fastrpc_map_create
    - misc: fastrpc: fix DMA address corruption due to find_vma misuse
    - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback
    - firmware: samsung: acpm: Fix mailbox channel leak on probe error
    - net/mlx5: Reorder completion before putting command entry in
      cmd_work_handler
    - net: airoha: Add NULL check for of_reserved_mem_lookup() in
      airoha_qdma_init_hfwd_queues()
    - net: bonding: fix NULL pointer dereference in bond_do_ioctl()
    - net: mv643xx: fix OF node refcount
    - net: phonet: free phonet_device after RCU grace period
    - net: rds: clear i_sends on setup unwind
    - net: sfp: initialize i2c_block_size at adapter configure time
    - nvmem: core: fix use-after-free bugs in error paths
    - nvmem: layouts: onie-tlv: fix hang on unknown types
    - octeontx2-af: fix memory leak in rvu_setup_hw_resources()
    - pinctrl: mcp23s08: Read spi-present-mask as u8 not u32
    - mm/cma: fix reserved page leak on activation failure
    - mm/cma_debug: fix invalid accesses for inactive CMA areas
    - mm/damon/lru_sort: handle ctx allocation failure
    - mm/damon/reclaim: handle ctx allocation failure
    - mm/huge_memory: use correct flags for device private PMD entry
    - mm/hugetlb: avoid false positive lockdep assertion
    - mm/hugetlb: restore reservation on error in hugetlb folio copy paths
    - mm/list_lru: drain before clearing xarray entry on reparent
    - mm/mincore: handle non-swap entries before !CONFIG_SWAP guard
    - mmc: core: Fix host controller programming for fixed driver type
    - mmc: dw_mmc-rockchip: Add missing private data for very old controllers
    - mmc: litex_mmc: Set mandatory idle clocks before CMD0
    - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC
    - mmc: sdhci-of-dwcmshc: Fix reset, clk, and SDIO support for Eswin
      EIC7700
    - mmc: sdhci: add signal voltage switch in sdhci_resume_host
    - pmdomain: imx: fix OF node refcount
    - pmdomain: ti_sci: add wakeup constraint to parent devices of wakeup
      source
    - rtase: Avoid sleeping in get_stats64()
    - rtase: Reset TX subqueue when clearing TX ring
    - sctp: diag: reject stale associations in dump_one path
    - sctp: stream: fully roll back denied add-stream state
    - thunderbolt: Reject zero-length property entries in validator
    - thunderbolt: Bound root directory content to block size
    - thunderbolt: Clamp XDomain response data copy to allocation size
    - thunderbolt: Validate XDomain request packet size before type cast
    - thunderbolt: Limit XDomain response copy to actual frame size
    - slimbus: qcom-ngd-ctrl: fix OF node refcount
    - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration
    - slimbus: qcom-ngd-ctrl: Fix probe error path ordering
    - slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd
    - slimbus: qcom-ngd-ctrl: Initialize controller resources in controller
    - slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership
    - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD
    - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock
    - drm/gem: Try to fix change_handle ioctl, attempt 4
    - drm/i915: Fix color blob reference handling in intel_plane_state
    - drm/amdkfd: fix NULL dereference in get_queue_ids()
    - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on
      GFX11
    - drm/xe/display: fix oops in suspend/shutdown without display
    - drm/xe/multi_queue: skip submit when primary queue is suspended
    - drm/xe: Clear pending_disable before signaling suspend fence
    - drm/v3d: Wait for pending L2T flush before cleaning caches
    - drm/v3d: Fix global performance monitor reference counting
    - drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups
    - drm/v3d: Skip CSD when it has zeroed workgroups
    - drm/amdgpu: fix waiting for all submissions for userptrs
    - drm/amdgpu: restart the CS if some parts of the VM are still invalidated
    - drm/amdgpu: set noretry=1 as default for GFX 10.1.x (Navi10/12/14)
    - drm/amdgpu: Fix incorrect VRAM GART mappings on non-4K page size systems
    - drm/amd/pm: apply SMU 13.0.10 workaround during MP1 unload
    - drm/amd/pm: fix smu13 power limit default/cap calculation
    - drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2
    - drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in
      set_soft_freq_limited_range
    - drm/amd/display: Bound VBIOS record-chain walk loops
    - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size
    - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size
    - drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs
    - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs
    - drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()
    - drm/amd/display: Use krealloc_array() in dal_vector_reserve()
    - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling
    - driver core: faux: fix root device registration
    - driver core: reject devices with unregistered buses
    - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible
    - netfilter: nft_fib: fix stale stack leak via the OIFNAME register
    - sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task()
    - wifi: mac80211: skip ieee80211_verify_sta_ht_mcs_support check in non-
      strict mode
    - wifi: mac80211: tests: mark HT check strict
    - RDMA/umem: fix kernel-doc warnings
    - RDMA: Move DMA block iterator logic into dedicated files
    - RDMA/umem: Fix truncation for block sizes >= 4G
    - vsock/virtio: fix potential unbounded skb queue
    - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc
    - debugobjects: Do not fill_pool() if pi_blocked_on
    - debugobjects: Don't call fill_pool() in early boot hardirq context
    - arm64: cputype: Add C1-Ultra definitions
    - arm64: cputype: Add C1-Premium definitions
    - arm64: errata: Mitigate TLBI errata on various Arm CPUs
    - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU
    - [Config] Add TLBI Erratum for Azure Cobalt 100.
    - vsock/virtio: fix skb overhead overflow on 32-bit builds
    - Linux 7.0.13
  * Resolute update: v7.0.13 upstream stable release (LP: #2158003) //
    CVE-2025-10263. The existing ARM64_ERRATUM_4118414 handling already uses
    - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU
  * Resolute update: v7.0.13 upstream stable release (LP: #2158003) //
    CVE-2026-46300: when fragments backed by read-only page-cache pages are
    - xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()
  * CVE-2026-64531
    - net: openvswitch: reject oversized nested action attrs
  * CVE-2026-46331
    - net/sched: fix pedit partial COW leading to page cache corruption
  * CVE-2026-53212
    - netfilter: nft_tunnel: fix use-after-free on object destroy
  * CVE-2026-53359
    - KVM: x86: Fix shadow paging use-after-free due to unexpected role
  * CVE-2026-53131
    - netfilter: require Ethernet MAC header before using eth_hdr()
  * CVE-2026-53151
    - rxrpc: Fix the ACK parser to extract the SACK table for parsing
  * CVE-2026-53175
    - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush
  * CVE-2026-53176
    - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
  * CVE-2026-53186
    - RDMA/srp: bound SRP_RSP sense copy by the received length
  * CVE-2026-53215
    - net: mvpp2: refill RX buffers before XDP or skb use
  * CVE-2026-53216
    - net: mvpp2: limit XDP frame size to the RX buffer
  * CVE-2026-53221
    - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
  * CVE-2026-53224
    - sctp: validate embedded INIT chunk and address list lengths in cookie
  * CVE-2026-53225
    - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()
  * CVE-2026-53228
    - ipv6: sit: reload inner IPv6 header after GSO offloads
  * CVE-2026-52924
    - sctp: purge outqueue on stale COOKIE-ECHO handling
  * CVE-2026-53246
    - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing
  * CVE-2026-53247
    - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown
  * CVE-2026-53260
    - tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().
  * INVALID or PRIVATE BUG (LP: #2158267)
    - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages
  * Packaging resync (LP: #1786013)
    - [Packaging] update annotations scripts

 -- Mehmet Basaran <mehmet.basaran@canonical.com>  Mon, 10 Aug 2026 11:07:20 +0300

linux-hwe-7.0 (7.0.0-30.30~24.04.1) noble; urgency=medium

  * noble/linux-hwe-7.0: 7.0.0-30.30~24.04.1 -proposed tracker (LP: #2162184)

  [ Ubuntu: 7.0.0-30.30 ]

  * resolute/linux: 7.0.0-30.30 -proposed tracker (LP: #2162185)
  * CVE-2026-64531
    - net: openvswitch: reject oversized nested action attrs

 -- Mehmet Basaran <mehmet.basaran@canonical.com>  Fri, 07 Aug 2026 14:50:38 +0300

linux-hwe-7.0 (7.0.0-29.29~24.04.1) noble; urgency=medium

  * noble/linux-hwe-7.0: 7.0.0-29.29~24.04.1 -proposed tracker (LP: #2160780)

  * Packaging resync (LP: #1786013)
    - [Packaging] debian.hwe-7.0/dkms-versions -- update from kernel-versions
      (main/s2026.06.22)

  [ Ubuntu: 7.0.0-29.29 ]

  * resolute/linux: 7.0.0-29.29 -proposed tracker (LP: #2160781)
  * Packaging resync (LP: #1786013)
    - [Packaging] update annotations scripts
  * CVE-2026-46331
    - net/sched: fix pedit partial COW leading to page cache corruption
  * CVE-2026-53212
    - netfilter: nft_tunnel: fix use-after-free on object destroy
  * CVE-2026-53359
    - KVM: x86: Fix shadow paging use-after-free due to unexpected role
  * CVE-2026-53131
    - netfilter: require Ethernet MAC header before using eth_hdr()
  * CVE-2026-53151
    - rxrpc: Fix the ACK parser to extract the SACK table for parsing
  * CVE-2026-53175
    - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush
  * CVE-2026-53176
    - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
  * CVE-2026-53186
    - RDMA/srp: bound SRP_RSP sense copy by the received length
  * CVE-2026-53215
    - net: mvpp2: refill RX buffers before XDP or skb use
  * CVE-2026-53216
    - net: mvpp2: limit XDP frame size to the RX buffer
  * CVE-2026-53221
    - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
  * CVE-2026-53224
    - sctp: validate embedded INIT chunk and address list lengths in cookie
  * CVE-2026-53225
    - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()
  * CVE-2026-53228
    - ipv6: sit: reload inner IPv6 header after GSO offloads
  * CVE-2026-52924
    - sctp: purge outqueue on stale COOKIE-ECHO handling
  * CVE-2026-53246
    - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing
  * CVE-2026-53247
    - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown
  * CVE-2026-53260
    - tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().
  * Performance regression causes SDXL inference slowdown (~42x) (LP: #2158267)
    - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages

 -- Benjamin Wheeler <benjamin.wheeler@canonical.com>  Wed, 22 Jul 2026 10:30:40 -0400

linux-hwe-7.0 (7.0.0-28.28~24.04.1) noble; urgency=medium

  * noble/linux-hwe-7.0: 7.0.0-28.28~24.04.1 -proposed tracker (LP: #2157519)

  * Packaging resync (LP: #1786013)
    - [Packaging] update variants
    - [Packaging] debian.hwe-7.0/dkms-versions -- update from kernel-versions
      (main/2026.06.22)

  * MT7925 wifi is hard blocked on Dell's machine (LP: #2158229)
    - SAUCE: Revert "wifi: mt76: mt7925: add rfkill_poll for hardware rfkill"

  [ Ubuntu: 7.0.0-28.28 ]

  * resolute/linux: 7.0.0-28.28 -proposed tracker (LP: #2157520)
  * Backport ASoC SDCA, AMD SoundWire, and RT722 audio fixes (LP: #2154418)
    - ASoC: amd: acp-sdw-legacy: rename the dmic component name
    - SAUCE: ASoC: rt722-sdca: add FU06 Playback Switch for speaker mute
      control
  * MIPI camera of a BBG809N3A_B sensor SKU of the DELL Pro 14 Premium PA14260
    renders upside-down (LP: #2155837)
    - SAUCE: media: ipu-bridge: correct platform handling for DELL Pro 14
      Premium PA14260
  * resolute ubuntu_kernel_selftests:seccomp_build test compilation issue
    (LP: #2154174)
    - SAUCE: selftests/seccomp fix compilation issue for amd64
  * [Ubuntu 26.04] Severe Performance Degradation on kernel 7.0.0-15
    (LP: #2154748)
    - s390: Remove GENERIC_LOCKBREAK Kconfig option
    - UBUNTU [Config]: Remove GENERIC_LOCKBREAK in s390x
  * Fix no sound output device on Dell GhostRider PTL no camera SKU
    (LP: #2156559)
    - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally
  * Fix no audio from right built-in speaker on HP ZBook with TAS2781
    amplifier (LP: #2156556)
    - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block
      data processing
  * Installer fails internally with a RSync error due to page fault
    (LP: #2150640)
    - ovl: keep err zero after successful ovl_cache_get()
  * Internal display black screen on Intel Lunar Lake with eDP panel
    (LP: #2156312)
    - drm/i915/alpm: Allow LOBF only for platform that have Always on VRR TG
  * Thunderbolt DP tunnel torn down during boot with LUKS Full Disk Encryption
    (LP: #2155096)
    - SAUCE: thunderbolt: Defer DP tunnel teardown until display driver is
      ready
  * watchdog: lenovo_se10_wdt: Add SE10 Gen 2 support (LP: #2154715)
    - watchdog: lenovo_se10_wdt: Add support for SE10 Gen 2 platform
    - watchdog: lenovo_se10_wdt: Fix use-after-free and resource leak risk
  * [Ubuntu 26.04] KVM: IBM Test Accelerator for Z (TAZ) not working properly
    (LP: #2153159)
    - KVM: s390: only deliver service interrupt with payload
    - KVM: s390: vsie: Allow non-zarch guests
    - KVM: s390: vsie: Disable some bits when in ESA mode
    - KVM: s390: vsie: Accommodate ESA prefix pages
    - KVM: s390: Add KVM capability for ESA mode guests
  * ubuntu_bpf failed to build on Resolute (error: expected ‘:’, ‘,’, ‘;’, ‘}’
    or ‘__attribute__’ before ‘__counted_by’) (LP: #2150071)
    - tools/headers: Regenerate stddef.h to fix BPF selftests
  * ubuntu_bpf: FTBFS with clang 23 / gcc 15 (LP: #2154343)
    - selftests/bpf: Fix const qualifier warning in fexit_bpf2bpf.c
  * ALSA: hda/tas2781 Audio Fix for the front-right speacker (LP: #2149770)
    - ALSA: hda/tas2781: Fix sound abnormal issue on some SPI device
  * Fix bad audio record quality when volume above 50% on Framework PTL
    (LP: #2153155)
    - ALSA: hda/realtek: fix mic boost on Framework PTL
  * Patchset for TUXEDO devices (LP: #2152570)
    - drm/i915/vbt: Add edp pipe joiner enable/disable bits
    - drm/i915/dp: Avoid joiner for eDP if not enabled in VBT
    - drm/amd/display: Add Idle state manager(ISM)
    - drm/i915/backlight: Remove try_vesa_interface
    - drm/i915/backlight: Use intel_panel variable instead of intel_connector
    - drm/i915/backlight: Take luminance_set into account for VESA backlight
    - drm/i915/backlight: Check luminance_set when disabling PWM via AUX VESA
      backlight
    - drm/i915/backlight: Short circuit intel_dp_aux_supports_hdr_backlight
    - drm/i915/backlight: Update debug log during backlight setup
    - drm/i915/backlight: Check if VESA backlight is possible
    - drm/i915/backlight: Provide clear description on how backlight level is
      controlled
    - drm/i915/backlight: Fix VESA backlight possible check condition
  * Resolute update: v7.0.12 upstream stable release (LP: #2156636)
    - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size
    - ACPI: button: Fix ACPI GPE handler leak during removal
    - ACPI: button: Enable wakeup GPEs for ACPI buttons at probe time
    - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit
    - net/sched: sch_sfb: Replace direct dequeue call with peek and
      qdisc_dequeue_peeked
    - bcache: fix uninitialized closure object
    - nfc: llcp: Fix use-after-free in llcp_sock_release()
    - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()
    - xfrm: Check for underflow in xfrm_state_mtu
    - nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems
    - tools/bootconfig: Fix buf leaks in apply_xbc
    - HID: remove duplicate hid_warn_ratelimited definition
    - kunit: fix use-after-free in debugfs when using kunit.filter
    - accel/rocket: fix UAF via dangling GEM handle in create_bo
    - netfilter: synproxy: refresh tcphdr after skb_ensure_writable
    - netfilter: xt_cpu: prefer raw_smp_processor_id
    - netfilter: ebtables: fix OOB read in compat_mtw_from_user
    - netfilter: nf_tables: fix dst corruption in same register operation
    - vsock: keep poll shutdown state consistent
    - net: netlink: fix sending unassigned nsid after assigned one
    - net: netlink: don't set nsid on local notifications
    - net/smc: Do not re-initialize smc hashtables
    - net/iucv: fix locking in .getsockopt
    - scsi: core: Run queues for all non-SDEV_DEL devices from
      scsi_run_host_queues
    - scsi: scsi_debug: Add missing newline in scsi_debug_device_reset()
    - ipv4: free net->ipv4.sysctl_local_reserved_ports after
      unregister_net_sysctl_table()
    - ALSA: hda: cs35l56: Fix system name string leaks
    - ALSA: pcm: oss: Fix setup list UAF on proc write error
    - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors
    - net/mlx5: HWS: Reject unsupported remove-header action
    - net: hsr: fix potential OOB access in supervision frame handling
    - accel/ivpu: prevent uninitialized data bug in debugfs
    - gpio: mxc: fix irq_high handling
    - drm/i915/aux: use polling when irqs are unavailable
    - net: Avoid checksumming unreadable skb tail on trim
    - ethtool: rss: avoid modifying the RSS context response
    - ethtool: rss: add missing errno on RSS context delete
    - ethtool: rss: fix falsely ignoring indir table updates
    - ethtool: rss: fix indir_table and hkey leak on get_rxfh failure
    - ethtool: rss: fix hkey leak when indir_size is 0
    - ethtool: rss: avoid device context leak on reply-build failure
    - ethtool: module: call ethnl_ops_complete() on module flash errors
    - ethtool: module: avoid leaking a netdev ref on module flash errors
    - ethtool: module: avoid racy updates to dev->ethtool bitfield
    - ethtool: module: check fw_flash_in_progress under rtnl_lock
    - ethtool: module: fix cleanup if socket used for flashing multiple
      devices
    - ethtool: cmis: require exact CDB reply length
    - ethtool: cmis: fix u16-to-u8 truncation of msleep_pre_rpl
    - ethtool: cmis: validate start_cmd_payload_size from module
    - ethtool: cmis: validate fw->size against start_cmd_payload_size
    - cxl/test: Update mock dev array before calling platform_device_add()
    - blk-mq: reinsert cached request to the list
    - tunnels: load network headers after skb_cow() in
      iptunnel_pmtud_build_icmp[v6]()
    - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()
    - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()
    - ksmbd: fix FSCTL permission bypass by adding a permission check for
      FSCTL_SET_SPARSE
    - ASoC: codecs: simple-mux: Fix enum control bounds check
    - drm/xe: Restore IDLEDLY regiter on engine reset
    - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()
    - bonding: refuse to enslave CAN devices
    - bridge: Fix sleep in atomic context in netlink path
    - bridge: Fix sleep in atomic context in sysfs path
    - ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES
    - ethtool: tsconfig: fix reply error handling
    - ethtool: linkstate: fix unbalanced ethnl_ops_complete() on PHY lookup
      error
    - ethtool: pse-pd: fix missing ethnl_ops_complete()
    - ethtool: tsconfig: fix missing ethnl_ops_complete()
    - ethtool: tsinfo: fix uninitialized stats on the by-PHC path
    - ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on prepare failure
    - ethtool: strset: fix header attribute index in ethnl_req_get_phydev()
    - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during
      fallback
    - ethtool: eeprom: add more safeties to EEPROM Netlink fallback
    - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
    - net/sched: Revert "net/sched: Restrict conditions for adding duplicating
      netems to qdisc tree"
    - net/sched: fix packet loop on netem when duplicate is on
    - net: Introduce skb tc depth field to track packet loops
    - net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loop
    - net/sched: act_mirred: Fix blockcast recursion bypass leading to stack
      overflow
    - net/sched: act_mirred: Fix return code in early mirred redirect error
      paths
    - net: hibmcge: disable Relaxed Ordering to fix RX packet corruption
    - net: hibmcge: move dma_rmb() after dma_sync_single_for_cpu() in RX path
    - net/handshake: Use spin_lock_bh for hn_lock
    - nvme-tcp: store negative errno in queue->tls_err
    - net/handshake: Pass negative errno through handshake_complete()
    - net/handshake: hand off the pinned file reference to accept_doit
    - net/handshake: Take a long-lived file reference at submit
    - net/handshake: Drain pending requests at net namespace exit
    - dpll: zl3073x: detect DPLL channel count from chip ID at runtime
    - dpll: zl3073x: add die temperature reporting for supported chips
    - dpll: export __dpll_device_change_ntf() for use under dpll_lock
    - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work
    - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success
    - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
    - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close
    - Bluetooth: hci_sync: Reset device counters in hci_dev_close_sync()
    - gpio: adnp: fix flow control regression caused by scoped_guard()
    - gpio: virtuser: Fix uninitialized data bug in
      gpio_virtuser_direction_do_write()
    - gpio: rockchip: convert bank->clk to devm_clk_get_enabled()
    - gpio: rockchip: teardown bugs and resource leaks
    - net: mana: Add NULL guards in teardown path to prevent panic on attach
      failure
    - net: mana: Skip redundant detach on already-detached port
    - sctp: fix race between sctp_wait_for_connect and peeloff
    - net: pcs: pcs-mtk-lynxi: fix bpi-r3 serdes configuration
    - vsock/virtio: bind uarg before filling zerocopy skb
    - ipv6: fix possible infinite loop in rt6_fill_node()
    - ipv6: fix possible infinite loop in fib6_select_path()
    - net: skbuff: fix pskb_carve leaking zcopy pages
    - Revert "ipv6: preserve insertion order for same-scope addresses"
    - Revert "x86/fpu: Refine and simplify the magic number check during
      signal return"
    - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register
    - drm/i915/psr: Read Intel DPCD workaround register
    - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used
    - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer
    - iio: imu: adis16550: fix stack leak in trigger handler
    - iio: pressure: bmp280: fix stack leak in bmp580 trigger handler
    - usb: typec: ucsi: ccg: reject firmware images without a ':' record
      header
    - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers
    - usb: typec: tcpm: bound altmode_desc[] per iteration in
      svdm_consume_modes()
    - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload
      VDO
    - usb: typec: altmodes/displayport: validate count before reading Status
      Update VDO
    - usb: typec: wcove: don't write past struct pd_message in
      wcove_read_rx_buffer()
    - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT
    - usb: typec: ucsi: validate connector number in ucsi_connector_change()
    - USB: serial: safe_serial: fix memory corruption with small endpoint
    - media: rc: igorplugusb: fix control request setup packet
    - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free()
    - USB: serial: cypress_m8: fix memory corruption with small endpoint
    - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse
    - Bluetooth: btusb: Allow firmware re-download when version matches
    - mm/vmalloc: do not trigger BUG() on BH disabled context
    - hpfs: fix a crash if hpfs_map_dnode_bitmap fails
    - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs()
    - ipc: limit next_id allocation to the valid ID range
    - mm: memcontrol: propagate NMI slab stats to memcg vmstats
    - mm/migrate_device: fix pgtable leak in migrate_vma_insert_huge_pmd_page
    - memfd: deny writeable mappings when implying SEAL_WRITE
    - zram: fix use-after-free in zram_writeback_endio
    - mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one
    - auxdisplay: line-display: fix OOB read on zero-length message_store()
    - smb: client: fix uninitialized variable in smb2_writev_callback
    - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()
    - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn
    - Bluetooth: HIDP: fix missing length checks in hidp_input_report()
    - Bluetooth: ISO: fix UAF in iso_recv_frame
    - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock
    - Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate()
    - Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM loading
    - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync
    - Input: xpad - fix out-of-bounds access for Share button
    - parport: Fix race between port and client registration
    - rust_binder: Avoid holding lock when dropping delivered_death
    - rust_binder: avoid calling pending_oneway_finished() on TF_UPDATE_TXN
    - USB: cdc-acm: Fix bit overlap and move quirk definitions to header
    - KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor
    - KVM: arm64: PMU: Preserve AArch32 counter low bits
    - KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC
    - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use
    - KVM: SEV: Ignore Port I/O requests of length '0'
    - KVM: SEV: Use the size of the PSC header as the minimum size for PSC
      requests
    - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0
    - KVM: SEV: Compute the correct max length of the in-GHCB scratch area
    - KVM: SEV: Check PSC request indices against the actual size of the
      buffer
    - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer
    - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc()
    - gpio: shared: undo the vote of the proxy on GPIO free
    - gpio: shared: fix deadlock on shared proxy's parent removal
    - gpio: shared: fix lockdep false positive by removing unneeded lock
    - Disable -Wattribute-alias for clang-23 and newer
    - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux
    - iio: adc: npcm: fix unbalanced clk_disable_unprepare()
    - iio: dac: ad3530r: Fix AD3531/AD3531R powerdown mode strings
    - iio: dac: max5821: fix return value check in powerdown sync
    - iio: dac: ad5686: fix ref bit initialization for single-channel parts
    - iio: dac: ad5686: fix input raw value check
    - iio: dac: ad5686: acquire lock when doing powerdown control
    - iio: dac: ad5686: fix powerdown control on dual-channel devices
    - iio: adc: mt6359: fix unchecked return value in mt6358_read_imp
    - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw
    - iio: adc: ad4695: Fix call ordering in offload buffer postenable
    - iio: adc: nxp-sar-adc: fix division by zero in write_raw
    - iio: adc: nxp-sar-adc: Avoid division by zero
    - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config
    - iio: gyro: itg3200: fix i2c read into the wrong stack location
    - iio: gyro: adis16260: fix division by zero in write_raw
    - iio: ssp_sensors: cancel delayed work_refresh on remove
    - iio: temperature: tsys01: fix broken PROM checksum validation
    - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL
    - iio: light: veml6070: Fix resource leak in probe error path
    - iio: Fix iio_multiply_value use in iio_read_channel_processed_scale
    - iio: chemical: mhz19b: reject oversized serial replies
    - iio: chemical: scd30: fix division by zero in write_raw
    - iio: light: cm3323: fix reg_conf not being initialized correctly
    - iio: buffer: hw-consumer: fix use-after-free in error path
    - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf()
    - USB: serial: omninet: fix memory corruption with small endpoint
    - usb: cdns3: gadget: fix request skipping after clearing halt
    - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy
      acquisition failure
    - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently
      leaks the runtime PM usage counter across bind/unbind cycles
    - usb: dwc2: Fix use after free in debug code
    - Input: elan_i2c - validate firmware size before use
    - i2c: davinci: fix division by zero on missing clock-frequency
    - x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines
    - wireguard: send: append trailer after expanding head
    - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data
    - macsec: fix replay protection at XPN lower-PN wrap
    - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()
    - ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params
    - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify
    - ipv6: exthdrs: refresh nh after handling HAO option
    - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().
    - ipv6: validate extension header length before copying to cmsg
    - xfrm: input: hold netns during deferred transport reinjection
    - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname
    - ip6: vti: Use ip6_tnl.net in vti6_changelink().
    - net: skbuff: fix missing zerocopy reference in pskb_carve helpers
    - spi: spi-mem: avoid mutating op template in spi_mem_supports_op()
    - HID: wacom: Fix OOB write in wacom_hid_set_device_mode()
    - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings
    - nfc: hci: fix out-of-bounds read in HCP header parsing
    - xfrm: route MIGRATE notifications to caller's netns
    - xfrm: ipcomp: Free destination pages on acomp errors
    - xfrm: ah: use skb_to_full_sk in async output callbacks
    - ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware 2417
    - ALSA: firewire-motu: Protect register DSP event queue positions
    - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without
      direction check
    - ASoC: qcom: q6asm-dai: close stream only when running
    - ASoC: qcom: q6asm-dai: do not set stream state in event and trigger
      callbacks
    - xfrm: esp: restore combined single-frag length gate
    - ALSA: hda/realtek: Fix speaker output on ASUS ROG Strix G615LP
    - xfrm: iptfs: reset runtime state when cloning SAs
    - dma-buf: fix UAF in dma_buf_fd() tracepoint
    - Input: xpad - add "Nova 2 Lite" from GameSir
    - Input: xpad - add support for ASUS ROG RAIKIRI II
    - ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops
    - misc: rp1: Send IACK on IRQ activate to fix kdump/kexec
    - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem
    - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490
    - dt-bindings: usb: Fix EIC7700 USB reset's issue
    - comedi: comedi_test: fix check for valid scan_begin_src in
      waveform_ai_cmdtest()
    - comedi: comedi_test: Fix limiting of convert_arg in
      waveform_ai_cmdtest()
    - counter: Fix refcount leak in counter_alloc() error path
    - tty: serial: pch_uart: add check for dma_alloc_coherent()
    - tty: serial: samsung: Remove redundant port lock acquisition in rx
      helpers
    - uio: uio_pci_generic_sva: fix double free of devm_kzalloc() memory
    - usb: chipidea: core: convert ci_role_switch to local variable
    - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval
    - usb: dwc3: xilinx: fix error handling in zynqmp init error paths
    - usb: musb: omap2430: Fix use-after-free in omap2430_probe()
    - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub
      controllers
    - usb: storage: Add quirks for PNY Elite Portable SSD
    - usbip: vudc: Fix use after free bug in vudc_remove due to race condition
    - usb: usbtmc: check URB actual_length for interrupt-IN notifications
    - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize
    - usb: typec: tipd: Fix error code in tps6598x_probe()
    - usb: typec: tcpm: improve handling of DISCOVER_MODES failures
    - usb: typec: ucsi: Check if power role change actually happened before
      handling
    - usb: typec: ucsi: Don't update power_supply on power role change if not
      connected
    - USB: serial: option: add MeiG SRM813Q
    - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL
    - USB: serial: belkin_sa: validate interrupt status length
    - USB: serial: cypress_m8: validate interrupt packet headers
    - USB: serial: digi_acceleport: fix memory corruption with small endpoints
    - USB: serial: keyspan: fix missing indat transfer sanity check
    - USB: serial: mxuport: fix memory corruption with small endpoint
    - USB: serial: mct_u232: fix memory corruption with small endpoint
    - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check
    - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind
    - usb: gadget: net2280: Fix double free in probe error path
    - usb: gadget: f_hid: fix device reference leak in hidg_alloc()
    - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling
    - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports
    - usb: gadget: f_fs: copy only received bytes on short ep0 read
    - usb: gadget: f_fs: serialize DMABUF cancel against request completion
    - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()
    - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow
    - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()
    - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker
    - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32
    - scsi: target: iscsi: Fix CRC overread and double-free in
      iscsit_handle_text_cmd()
    - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf
    - scsi: target: iscsi: Validate CHAP_R length before base64 decode
    - drm/hyperv: validate resolution_count and fix WIN8 fallback
    - drm/hyperv: validate VMBus packet size in receive callback
    - drm/gem: fix race between change_handle and handle_delete
    - drm/i915/color: Fix HDR pre-CSC LUT programming loop
    - drm/i915/psr: Block DC states on vblank enable when Panel Replay
      supported
    - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable
    - drm/i915: Fix potential UAF in TTM object purge
    - drm/amd/pm/si: Disregard vblank time when no displays are connected
    - serial: altera_jtaguart: handle uart_add_one_port() failures
    - serial: qcom-geni: fix UART_RX_PAR_EN bit position
    - serial: qcom_geni: fix kfifo underflow when flush precedes DMA
      completion IRQ
    - serial: sh-sci: fix memory region release in error path
    - serial: zs: Fix swapped RI/DSR modem line transition counting
    - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma
    - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr
    - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger
    - drm/amdkfd: Check for pdd drm file first in CRIU restore path
    - drm/amdgpu: fix lock leak on ENOMEM in AMDGPU_GEM_OP_GET_MAPPING_INFO
    - drm/amdgpu: fix calling VM invalidation in amdgpu_hmm_invalidate_gfx
    - drm/amdgpu: fix amdgpu_hmm_range_get_pages
    - drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO
    - serial: dz: Fix bootconsole message clobbering at chip reset
    - serial: dz: Fix bootconsole handover lockup
    - serial: dz: Convert to use a platform device
    - serial: zs: Fix bootconsole handover lockup
    - serial: zs: Switch to using channel reset
    - serial: zs: Convert to use a platform device
    - serial: core: introduce guard(uart_port_lock_check_sysrq_irqsave)
    - serial: 8250: dispatch SysRq character in serial8250_handle_irq()
    - serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq()
    - platform/x86/intel/vsec: Refactor base_addr handling
    - platform/x86/intel/vsec: Make driver_data info const
    - platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery
    - rxrpc: Fix RESPONSE packet verification to extract skb to a linear
      buffer
    - ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP Envy X360 15-fh0xxx
    - ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP 16 Piston OmniBook
      X
    - arm64: tlb: Flush walk cache when unsharing PMD tables
    - i2c: tegra: make tegra_i2c_mutex_unlock() return void
    - hwmon: (pmbus) Add support for guarded PMBus lock
    - hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read with
      pmbus_lock
    - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock
    - net: phy: micrel: fix LAN8814 QSGMII soft reset
    - xhci: tegra: Fix ghost USB device on dual-role port unplug
    - mailbox: Fix NULL message support in mbox_send_message()
    - usb: core: Fix SuperSpeed root hub wMaxPacketSize
    - tools: ynl: add scope qualifier for definitions
    - Linux 7.0.12
  * Resolute update: v7.0.12 upstream stable release (LP: #2156636) //
    CVE-2026-46318
    - Revert "mm/hugetlbfs: update hugetlbfs to use mmap_prepare"
  * Resolute update: v7.0.12 upstream stable release (LP: #2156636) //
    CVE-2026-46322
    - tun: free page on build_skb failure in tun_xdp_one()
  * Resolute update: v7.0.12 upstream stable release (LP: #2156636) //
    CVE-2026-46320
    - tap: free page on error paths in tap_get_user_xdp()
  * Resolute update: v7.0.12 upstream stable release (LP: #2156636) //
    CVE-2026-46321
    - tun: free page on short-frame rejection in tun_xdp_one()
  * CVE-2026-46316 // CVE-2026-46317
    - KVM: arm64: Reassign nested_mmus array behind mmu_lock
  * CVE-2026-46316
    - KVM: arm64: vgic-its: Drop the translation cache reference only for the
      erased entry
    - KVM: arm64: Take the SRCU lock for page table walks in fault injection
      and AT emulation
  * Resolute update: v7.0.11 upstream stable release (LP: #2156390)
    - iommu/amd: Fix illegal cap/mmio access in IOMMU debugfs
    - iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs
    - ksmbd: close durable scavenger races against m_fp_list lookups
    - ata: libata-scsi: improve readability of ata_scsi_qc_issue()
    - ata: libata-scsi: do not use the deferred QC feature for ATA_DEFER_PORT
    - ata: libata-scsi: do not use the deferred QC feature on PMPs with CBS
    - ata: libata-scsi: do not needlessly defer commands when using PMP with
      FBS
    - sysfs: don't remove existing directory on update failure
    - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break()
    - ksmbd: fix null pointer dereference in compare_guid_key()
    - ksmbd: fix null pointer dereference in proc_show_files()
    - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow
    - ksmbd: validate SID in parent security descriptor during ACL inheritance
    - regulator: tps65219: fix irq_data.rdev not being assigned
    - x86/mm: Disable broadcast TLB flush when PCID is disabled
    - scripts/gdb: mm: cast untyped symbols in x86_page_ops
    - smb: client: require net admin for CIFS SWN netlink
    - smb: client: protect tc_count increment in
      smb2_find_smb_sess_tcon_unlocked()
    - smb: client: use data_len for SMB2 READ encrypted folioq copy
    - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close
    - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX
    - ALSA: ua101: Reject too-short USB descriptors
    - ALSA: pcm: Don't setup bogus iov_iter for silencing
    - ALSA: asihpi: Fix potential OOB array access at reading cache
    - ALSA: scarlett2: Allow flash writes ending at segment boundary
    - ACPI: battery: Fix system wakeup on critical battery status
    - efi: Allocate runtime workqueue before ACPI init
    - spi: amd: Set correct bus number in ACPI probe path
    - io_uring/waitid: clear waitid info before copying it to userspace
    - drivers/base/memory: fix memory block reference leak in poison
      accounting
    - ipv6: ioam: refresh hdr pointer before ioam6_event()
    - mm/memory: fix spurious warning when unmapping device-private/exclusive
      pages
    - mm: fix __vm_normal_page() to handle missing support for
      pmd_special()/pud_special()
    - mm/memory_hotplug: fix memory block reference leak on remove
    - mm/page_alloc: fix initialization of tags of the huge zero folio with
      init_on_free
    - mm/migrate_device: fix spinlock leak in migrate_vma_insert_huge_pmd_page
    - selftests/mm: run_vmtests.sh: fix destructive tests invocation
    - mm/damon: fix damos_stat tracepoint format for sz_applied
    - net: wwan: iosm: fix potential memory leaks in ipc_imem_init()
    - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()
    - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START
    - Bluetooth: bnep: Fix UAF read of dev->name
    - Bluetooth: hci_uart: fix UAFs and race conditions in close and init
      paths
    - Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer
    - Bluetooth: hci_qca: Convert timeout from jiffies to ms
    - Bluetooth: MGMT: validate Add Extended Advertising Data length
    - Bluetooth: serialize accept_q access
    - phonet/pep: disable BH around forwarded sk_receive_skb()
    - net: bcmgenet: keep RBUF EEE/PM disabled
    - net: devmem: reject dma-buf bind with non-page-aligned size or SG length
    - net: phy: skip EEE advertisement write when autoneg is disabled
    - net: hsr: defer node table free until after RCU readers
    - net/mlx5e: Fix use-after-free in mlx5e_tx_reporter_timeout_recover
    - net: ifb: report ethtool stats over num_tx_queues
    - net: pse-pd: fix sign on -ENOENT check in of_load_pse_pis()
    - netfilter: ip6t_hbh: reject oversized option lists
    - netfilter: nf_queue: hold bridge skb->dev while queued
    - netfilter: ipset: stop hash:* range iteration at end
    - net: ethtool: fix NULL pointer dereference in phy_reply_size
    - net: ethtool: phy: avoid NULL deref when PHY driver is unbound
    - ACPI: driver: Check ACPI_COMPANION() against NULL during probe
    - sched_ext: Fix missing warning in scx_set_task_state() default case
    - sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path
    - l2tp: use list_del_rcu in l2tp_session_unhash
    - qed: fix double free in qed_cxt_tables_alloc()
    - ring-buffer: Fix reporting of missed events in iterator
    - ring-buffer: Flush and stop persistent ring buffer on panic
    - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb
    - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()
    - selftests: mptcp: drop nanoseconds width specifier
    - mptcp: pm: fix ADD_ADDR timer infinite retry on option space
      insufficient
    - vsock/vmci: fix UAF when peer resets connection during handshake
    - vsock/virtio: reset connection on receiving queue overflow
    - ice: fix VF queue configuration with low MTU values
    - wifi: ath11k: clear shared SRNG pointer state on restart
    - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices
    - wifi: iwlwifi: mld: stop TX during firmware restart
    - ipv4: raw: reject IP_HDRINCL packets with ihl < 5
    - ixgbevf: fix use-after-free in VEPA multicast source pruning
    - rbd: eliminate a race in lock_dwork draining on unmap
    - mptcp: do not drop partial packets
    - mptcp: reset rcv wnd on disconnect
    - lsm: hold cred_guard_mutex for lsm_set_self_attr()
    - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index
    - octeontx2-pf: fix double free in rvu_rep_rsrc_init()
    - igc: fix potential skb leak in igc_fpe_xmit_smd_frame()
    - ice: fix locking around wait_event_interruptible_locked_irq
    - ice: fix setting promisc mode while adding VID filter
    - ice: restore PTP Rx timestamp config after ethtool set-channels
    - wifi: cfg80211: advance loop vars in cfg80211_merge_profile()
    - af_unix: Fix UAF read of tail->len in unix_stream_data_wait()
    - wifi: mac80211: consume only present negotiated TTLM maps
    - octeontx2-pf: avoid double free of pool->stack on AQ init failure
    - cifs: Fix busy dentry used after unmounting
    - tracing: Do not call map->ops->elt_free() if elt_alloc() fails
    - ASoC: codecs: pcm512x: fix null-ptr dereference in
      pcm512x_overclock_xxx_put()
    - arm64: probes: Handle probes on hinted conditional branch instructions
    - KVM: arm64: vgic-its: Reject restored DTE with out-of-range
      num_eventid_bits
    - KVM: arm64: vgic: Free private_irqs when init fails after allocation
    - KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h (erratum
      #1235)
    - riscv: kvm: return SBI_ERR_FAILURE for pmu_snapshot_set_shmem() when OOM
    - riscv: kvm: return SBI_ERR_FAILURE for pmu_event_info() when OOM
    - virt: sev-guest: Explicitly leak pages in unknown state
    - i2c: tegra: fix pm_runtime leak on mutex_lock failure
    - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe
    - spi: qup: fix error pointer deref after DMA setup failure
    - phy: exynos5-usbdrd: fix USB 2.0 HS PHY tuning values for Exynos7870
    - phy: tegra: xusb: Fix per-pad high-speed termination calibration
    - phy: qcom-qmp-ufs: Fix kaanapali PHY PLL lock failure after SM8650 G4
      fix
    - phy: qcom: edp: Unify generic DP/eDP swing and pre-emphasis tables
    - phy: qcom: edp: Add eDP/DP mode switch support
    - phy: qcom: edp: Fix AUX_CFG8 programming for DP mode
    - scsi: isci: Fix use-after-free in device removal path
    - spi: ep93xx: fix error pointer deref after DMA setup failure
    - spi: sprd: fix error pointer deref after DMA setup failure
    - spi: ti-qspi: fix use-after-free after DMA setup failure
    - mm/slub: hold cpus_read_lock around flush_rcu_sheaves_on_cache()
    - RDMA/siw: Reject MPA FPDU length underflow before signed receive math
    - s390/cio: Restore GFP_DMA for CHSC allocation
    - s390/pai: Disable duplicate read of kernel PAI counter value
    - s390/pai: Fix missing PAI counter increments under heavy load
    - fwctl: pds: Validate RPC input size before parsing
    - LoongArch: kprobes: Use larch_insn_text_copy() to patch instructions
    - LoongArch: Remove unused code to avoid build warning
    - cpufreq: intel_pstate: Use correct scaling factor on Raptor Lake-E
    - device property: set fwnode->secondary to NULL in fwnode_init()
    - drm/i915/display: Copy color pipeline from plane in the primary joiner
      pipe
    - drm/msm: Fix shrinker deadlock
    - drm/v3d: Fix use-after-free of CPU job query arrays on error path
    - drm/v3d: Release indirect CSD GEM reference on CPU job free
    - drm/virtio: use uninterruptible resv lock for plane updates
    - drm/xe/multi_queue: Fix secondary queue error case
    - drm/amdgpu/vpe: Force collaborate sync after TRAP
    - drm/bridge: it66121: acquire reset GPIO in probe
    - drm/bridge: megachips: remove bridge when irq request fails
    - drm/amd/display: Fix integer overflow in bios_get_image()
    - drm/amd/display: Validate GPIO pin LUT table size before iterating
    - drm/amd/display: Validate payload length and link_index in
      dc_process_dmub_aux_transfer_async
    - batman-adv: v: stop OGMv2 on disabled interface
    - batman-adv: tvlv: abort OGM send on tvlv append failure
    - batman-adv: tvlv: reject oversized TVLV packets
    - batman-adv: iv: recover OGM scheduling after forward packet error
    - batman-adv: mcast: fix use-after-free in orig_node RCU release
    - batman-adv: clear current gateway during teardown
    - batman-adv: dat: handle forward allocation error
    - batman-adv: fix fragment reassembly length accounting
    - batman-adv: fix tp_meter counter underflow during shutdown
    - batman-adv: frag: disallow unicast fragment in fragment
    - batman-adv: bla: fix report_work leak on backbone_gw purge
    - batman-adv: bla: avoid double decrement of bla.num_requests
    - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface
    - batman-adv: tp_meter: avoid use of uninit sender vars
    - batman-adv: tp_meter: directly shut down timer on cleanup
    - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown
    - batman-adv: tp_meter: fix race condition in send error reporting
    - batman-adv: tp_meter: avoid role confusion in tp_list
    - batman-adv: tt: fix TOCTOU race for reported vlans
    - batman-adv: tt: reject oversized local TVLV buffers
    - batman-adv: tt: avoid empty VLAN responses
    - batman-adv: tt: fix negative last_changeset_len
    - batman-adv: tt: fix negative tt_buff_len
    - batman-adv: tt: prevent TVLV entry number overflow
    - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock
    - hwmon: (pmbus/adm1266) reject implausible blackbox record_count
    - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer
    - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized
      buffer
    - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR
    - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in
      get_multiple
    - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe()
    - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe()
    - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO
      accessors
    - pinctrl: mediatek: moore: implement gpio_chip::get_direction()
    - pinctrl: qcom: ipq4019: mark gpio as a GPIO pin function
    - arm64: dts: renesas: r8a78000: Fix SCIF brg_int clocks
    - ARM: dts: renesas: genmai: Drop superfluous cells
    - ARM: dts: renesas: rskrza1: Drop superfluous cells
    - pinctrl: renesas: rzg2l: Fix incorrect PUPD register offset for high
      pins during suspend/resume
    - pinctrl: renesas: rzg2l: Fix SMT register cache handling
    - pinctrl: meson: amlogic-a4: fix deadlock issue
    - pinctrl: qcom: Fix GPIO to PDC wake irq map for qcs615
    - kho: skip KHO for crash kernel
    - mm/memfd_luo: report error when restoring a folio fails mid-loop
    - HID: intel-thc-hid: Intel-quickspi: Fix some error codes
    - HID: uclogic: Fix regression of input name assignment
    - firmware: arm_ffa: Check for NULL FF-A ID table while driver
      registration
    - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure
    - firmware: arm_ffa: Fix per-vcpu self notifications handling in workqueue
    - firmware: arm_ffa: Unregister bus notifier on teardown for FF-A v1.0
    - riscv: errata: Fix bitwise vs logical AND in MIPS errata patching
    - riscv: Fix register corruption from uninitialized cregs on error
    - riscv: mm: Fixup no5lvl failure when vaddr is invalid
    - kunit: config: Enable KUNIT_DEBUGFS by default
    - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS
    - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150
    - firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies
    - firmware: arm_ffa: Keep framework RX release under lock
    - firmware: arm_ffa: Validate framework notification message layout
    - firmware: arm_ffa: Align RxTx buffer size before mapping
    - firmware: arm_ffa: Snapshot notifier callbacks under lock
    - firmware: arm_ffa: Fix sched-recv callback partition lookup
    - ARM: integrator: Fix early initialization
    - ALSA: hda: cs35l56: Put ACPI device after setting companion
    - ALSA: hda: cs35l41: Put ACPI device on missing physical node
    - btrfs: tracepoints: fix sleep while in atomic context in
      btrfs_sync_file()
    - netfilter: x_tables: allow initial table replace without emitting audit
      log message
    - netfilter: x_tables: allocate hook ops while under mutex
    - netfilter: x_tables: unregister the templates first
    - netfilter: x_tables: add and use xt_unregister_table_pre_exit
    - netfilter: x_tables: add and use xtables_unregister_table_exit
    - netfilter: ebtables: move to two-stage removal scheme
    - netfilter: ebtables: close dangling table module init race
    - netfilter: x_tables: close dangling table module init race
    - netfilter: bridge: eb_tables: close module init race
    - netfilter: nf_conntrack_expect: restore helper propagation via
      expectation
    - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist()
    - test_kprobes: clear kprobes between test runs
    - tcp: Fix imbalanced icsk_accept_queue count.
    - net: napi: Avoid gro timer misfiring at end of busypoll
    - net: shaper: Reject reparenting of existing nodes
    - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init()
    - ice: fix setting RSS VSI hash for E830
    - ice: fix locking in ice_dcb_rebuild()
    - ice: dpll: fix rclk pin state get for E810
    - ice: dpll: fix misplaced header macros
    - net: lan966x: avoid unregistering netdev on register failure
    - net: ti: icssm-prueth: fix eth_ports_node leak in probe
    - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register
      access
    - phy: spacemit: Remove incorrect clk_disable() in spacemit_usb2phy_init()
    - NFSD: Fix infinite loop in layout state revocation
    - ASoC: sdw_utils: Add quirk to ignore RT712 CODEC_MIC
    - ASoC: sdw_utils: Add quirk to ignore RT721 CODEC_MIC
    - fprobe: Fix unregister_fprobe() to wait for RCU grace period
    - fs/statmount: fix slab out-of-bounds write in statmount_mnt_idmap
    - fs: Fix return in jfs_mkdir and orangefs_mkdir
    - irqchip/ath79-cpu: Remove unused function
    - fs: fix forced iversion increment on lazytime timestamp updates
    - ublk: reject max_sectors smaller than PAGE_SECTORS in parameter
      validation
    - nsfs: fix wrong error code returned for pidns ioctls
    - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT
    - nvme: fix bio leak on mapping failure
    - nvme-pci: fix use-after-free in nvme_free_host_mem()
    - zonefs: handle integer overflow in zonefs_fname_to_fno
    - tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key().
    - ASoC: SOF: amd: Fix error code handling in psp_send_cmd()
    - powerpc: 82xx: fix uninitialized pointers with free attribute
    - powerpc: fix dead default for GUEST_STATE_BUFFER_TEST
    - powerpc/hv-gpci: fix preempt count leak in sysfs show paths
    - netfs: Fix cancellation of a DIO and single read subrequests
    - netfs: Fix missing locking around retry adding new subreqs
    - netfs: Fix missing barriers when accessing stream->subrequests
      locklessly
    - netfs: Fix netfs_read_to_pagecache() to pause on subreq failure
    - netfs: Fix potential for tearing in ->remote_i_size and ->zero_point
    - netfs: Fix zeropoint update where i_size > remote_i_size
    - netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call
    - netfs: Fix overrun check in netfs_extract_user_iter()
    - netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes
      gone
    - netfs: Defer the emission of trace_netfs_folio()
    - netfs: Fix streaming write being overwritten
    - netfs: Fix potential deadlock in write-through mode
    - netfs: Fix read-gaps to remove netfs_folio from filled folio
    - netfs: Fix write streaming disablement if fd open O_RDWR
    - netfs: Fix early put of sink folio in netfs_read_gaps()
    - netfs: Fix leak of request in netfs_write_begin() error handling
    - netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages()
    - netfs: Fix partial invalidation of streaming-write folio
    - netfs: Fix folio->private handling in netfs_perform_write()
    - netfs: Fix netfs_read_folio() to wait on writeback
    - netfs, afs: Fix write skipping in dir/link writepages
    - afs: Fix the locking used by afs_get_link()
    - net: ethernet: cortina: Make RX SKB per-port
    - net: ethernet: cortina: Drop half-assembled SKB
    - net: ethernet: cortina: Carry over frag counter
    - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference
    - wifi: ath11k: fix error path leaks in some WMI WOW calls
    - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm()
    - wifi: ath10k: skip WMI and beacon transmission when device is wedged
    - net: shaper: flip the polarity of the valid flag
    - net: shaper: fix trivial ordering issue in net_shaper_commit()
    - net: shaper: reject duplicate leaves in GROUP request
    - net: shaper: set ret to -ENOMEM when genlmsg_new() fails in group_doit
    - net: shaper: fix undersized reply skb allocation in GROUP command
    - net: shaper: enforce singleton NETDEV scope with id 0
    - net: shaper: reject QUEUE scope handle with missing id
    - block: don't overwrite bip_vcnt in bio_integrity_copy_user()
    - block: recompute nr_integrity_segments in blk_insert_cloned_request
    - HID: quirks: really enable the intended work around for appledisplay
    - block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user()
    - accel/qaic: Add overflow check to remap_pfn_range during mmap
    - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint
    - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics
    - drm/msm/dpu: fix UV scanlines calculation for YUV UBWC formats
    - drm/msm/dpu: Fix Kaanapali CWB register configuration
    - drm/msm/dsi: don't dump registers past the mapped region
    - drm/msm/dpu: don't mix devm and drmm functions
    - block: rename struct gendisk zone_wplugs_lock field
    - block: allow submitting all zone writes from a single context
    - block: fix handling of dead zone write plugs
    - selftests: ublk: cap nthreads to kernel's actual nr_hw_queues
    - x86/mce: Restore MCA polling interval halving
    - Documentation: intel_pstate: Fix description of asymmetric packing with
      SMT
    - drm/msm: Fix GMEM_BASE for A650
    - drm/msm/a6xx: Add soft fuse detection support
    - drm/msm/adreno: Fix a reference leak in a6xx_gpu_init()
    - drm/msm/adreno: fix userspace-triggered crash on a2xx-a4xx
    - drm/msm/a6xx: Restore sysprof_active
    - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN
    - drm/msm/a6xx: Check kzalloc return in a8xx_hfi_send_perf_table
    - ASoC: intel: sof_sdw: Prepare for configuration without a jack
    - ASoC: sdw_utils: cs42l43: allow spk component names to be combined
    - ASoC: sdw_utils: Check speaker component string allocation
    - riscv: Docs: fix unmatched quote warning
    - powerpc/time: Remove redundant preempt_disable|enable() calls from
      arch_irq_work_raise()
    - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot
    - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring
    - net: tls: prevent chain-after-chain in plain text SG
    - net: phy: DP83TC811: add reading of abilities
    - ovpn: tcp - use cached peer pointer in ovpn_tcp_close()
    - ovpn: respect peer refcount in CMD_NEW_PEER error path
    - ovpn: fix race between deleting interface and adding new peer
    - cifs: client: stage smb3_reconfigure() updates and restore ctx on
      failure
    - phy: apple: atc: Fix typec switch/mux leak on unbind
    - gcc-plugins: Always define CONST_CAST_GIMPLE and CONST_CAST_TREE
    - x86/xen: Fix xen_e820_swap_entry_with_ram()
    - vfio/pci: Check BAR resources before exporting a DMABUF
    - ovpn: disable BHs when updating device stats
    - tls: Preserve sk_err across recvmsg() when data has been copied
    - net/mlx5: Do not restore destination-less TC rules
    - net/mlx5: Skip disabled vports when setting max TX speed
    - scsi: sd: Fix return code handling in sd_spinup_disk()
    - ASoC: codecs: fs210x: fix possible buffer overflow
    - iommupt: Directly call iommupt's unmap_range()
    - iommupt: Avoid rewalking during map
    - iommu: Fix loss of errno on map failure for classic ops
    - iommu: Fix up map/unmap debugging for iommupt domains
    - iommu: Handle unmap error when iommu_debug is enabled
    - iommupt: Check for missing PAGE_SIZE in the pgsize_bitmap
    - iommupt: Fix the end_index calculation in __map_range_leaf()
    - ALSA: scarlett2: Add missing error check when initialise Autogain Status
    - ALSA: hda/ca0132: Disable auto-detect on manual output select
    - cachefiles: Fix error return when vfs_mkdir() fails
    - io_uring/net: punt IORING_OP_BIND async if it needs file create
    - vsock/virtio: fix zerocopy completion for multi-skb sends
    - btrfs: check for subvolume before deleting squota qgroup
    - btrfs: fix squota accounting during enable generation
    - ASoC: amd: acp-sdw-legacy: check CPU DAI name before logging
    - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache()
    - netfilter: nft_inner: release local_lock before re-enabling softirqs
    - ALSA: hda/realtek: Use ALC287_FIXUP_TXNW2781_I2C for ASUS Strix Gxx5
    - drm/msm/snapshot: fix dumping of the unaligned regions
    - hwmon: (lm90) Stop work before releasing hwmon device
    - hwmon: (lm90) Add lock protection to lm90_alert
    - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is
      disabled
    - wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it
    - dma-mapping: move dma_map_resource() sanity check into debug code
    - drm/gem: Make the GEM LRU lock part of drm_device
    - drm/xe/gsc: Fix double-free of managed BO in error path
    - drm/xe/vf: Fix signature of print functions
    - drm/xe/pf: Fix CFI failure in debugfs access
    - drm/xe: Consolidate workaround entries for Wa_14019988906
    - drm/xe: Consolidate workaround entries for Wa_18033852989
    - drm/xe: Define and use MCR version of COMMON_SLICE_CHICKEN1
    - drm/xe/tuning: Apply windower hardware filtering setting on Xe3 and Xe3p
    - drm/xe: Define and use MCR version of COMMON_SLICE_CHICKEN4
    - wifi: ath11k: fix peer resolution on rx path when peer_id=0
    - wifi: ath12k: fix EHT TX MCS limitation due to wrong 20 MHz-only parsing
    - drm/mediatek: mtk_hdmi_ddc_v2: Fix non-static global variable
    - drm/mediatek: mtk_hdmi_v2: Fix non-static global variable
    - drm/mediatek: mtk_cec: Fix non-static global variable
    - drm/mediatek: mtk_hdmi_ddc: Fix non-static global variable
    - io_uring: propagate array_index_nospec opcode into req->opcode
    - srcu: Don't queue workqueue handlers to never-online CPUs
    - cgroup/rstat: validate cpu before css_rstat_cpu() access
    - net/mlx5e: xsk: Fix unlocked writing to ICOSQ
    - cifs: Fix undefined variables
    - ice: ptp: serialize E825 PHY timer start with PTP lock
    - ice: ptp: use primary NAC semaphore on E825
    - igc: set tx buffer type for SMD frames
    - drm/i915/dp: Fix readback for target_rr in Adaptive Sync SDP
    - phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp swing config
    - kbuild: pacman-pkg: make "rc" releases adhere to pacman versioning
      scheme
    - net: dsa: mt7530: fix FDB entries not aging out with short timeout
    - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames
    - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer
    - platform/surface: aggregator_registry: omit battery & AC nodes on
      Surface Laptop 7
    - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL
    - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL
    - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL
    - platform/x86: intel_sar: Check ACPI_HANDLE() against NULL
    - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL
    - platform/x86: uniwill-laptop: Properly initialize charging threshold
    - platform/x86: uniwill-laptop: Accept charging threshold of 0
    - platform/x86: uniwill-laptop: Fix behavior of "force" module param
    - platform/x86: asus-armoury: fix mini-LED mode get/set on MODE2 devices
    - ASoC: soc-utils: Add missing va_end in snd_soc_ret()
    - drm/amdgpu: Align amdgpu_gtt_mgr entries to TLB size on Tahiti (v2)
    - drm/amdgpu/vce1: Check that the GPU address is < 128 MiB
    - drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets
    - RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port
    - RDMA/rtrs: Fix use-after-free in path file creation cleanup
    - bridge: mcast: Fix a possible use-after-free when removing a bridge port
    - net: phy: honor eee_disabled_modes in phy_support_eee()
    - net: phy: honor eee_disabled_modes in phy_advertise_eee_all()
    - net: airoha: Fix NPU RX DMA descriptor bits
    - pds_core: fix error handling in pdsc_devcmd_wait
    - pds_core: fix debugfs_lookup dentry leak and error handling
    - erofs: fix managed cache race for unaligned extents
    - erofs: harden h_shared_count in erofs_init_inode_xattrs()
    - erofs: fix metabuf leak in inode xattr initialization
    - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs
    - wifi: mac80211: fix MLE defragmentation
    - wifi: mac80211: fix multi-link element inheritance
    - wifi: wilc1000: fix dma_buffer leak on bus acquire failure
    - ALSA: seq: Serialize UMP output teardown with event_input
    - cgroup: rstat: relax NMI guard after switch to try_cmpxchg
    - tracing: Avoid NULL return from hist_field_name() on truncation
    - Bluetooth: hci_sync: Fix not setting mask for
      HCI_EVT_LE_ALL_REMOTE_FEATURES_COMPLETE
    - Bluetooth: btintel_pcie: Fix incorrect MAC access programming
    - Bluetooth: btmtk: fix urb->setup_packet leak in error paths
    - udp: gso: Fix handling checksum in __udp_gso_segment
    - udp: Fix UDP length on last GSO_PARTIAL segment
    - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA
    - net: shaper: annotate the data races
    - net: shaper: rework the VALID marking (again)
    - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks
    - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg
    - net: ag71xx: check error for platform_get_irq
    - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx
    - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction
    - net: stmmac: eswin: fix HSP CSR init ordering after clock enable
    - net: stmmac: eswin: clear TXD and RXD delay registers during
      initialization
    - net: stmmac: eswin: correct RGMII delay granularity to 20 ps
    - net: stmmac: eswin: validate RGMII delay values
    - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed
    - gpio: aggregator: fix a potential use-after-free
    - gpio: aggregator: stop using dev-sync-probe
    - gpio: aggregator: remove the software node when deactivating the
      aggregator
    - gpio: aggregator: lock device when calling device_is_bound()
    - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove()
    - drm/xe/oa: Fix exec_queue leak on width check in stream open
    - ASoC: cs-amp-lib: Fix wrong sizeof() in
      _cs_amp_set_efi_calibration_data()
    - ASoC: cs-amp-lib: Fix missing dput() after debugfs_lookup()
    - selftests: net: Fix checksums in xdp_native
    - nvme-pci: fix dma_vecs leak on p2p memory
    - nvme-pci: fix dma mapping leak on data setup error
    - octeontx2-af: npc: Fix allmulticast skip logic for LBK and SDP VFs
    - net: mana: validate rx_req_idx to prevent out-of-bounds array access
    - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR
    - net: airoha: Disable GDM2 forwarding before configuring GDM2 loopback
    - pds_core: ensure null-termination for firmware version strings
    - net: enetc: fix missing error code when pf->vf_state allocation fails
    - io_uring/nop: pass all errors to userspace
    - blk-mq: pop cached request if it is usable
    - ksmbd: fix durable reconnect error path file lifetime
    - LoongArch: kprobes: Fix handling of fatal unrecoverable recursions
    - block: avoid use-after-free in disk_free_zone_resources()
    - Documentation: laptops: Update documentation for uniwill laptops
    - platform/x86: uniwill-laptop: Do not enable the charging limit even when
      forced
    - drm/msm: Restore second parameter name in purge() and evict()
    - security/keys: fix missed RCU read section on lookup
    - Linux 7.0.11
  * Resolute update: v7.0.10 upstream stable release (LP: #2156385)
    - blk-cgroup: wait for blkcg cleanup before initializing new disk
    - md: suppress spurious superblock update error message for dm-raid
    - fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START
    - fs/mbcache: cancel shrink work before destroying the cache
    - md/raid1: fix the comparing region of interval tree
    - fs: fix archiecture-specific compat_ftruncate64
    - drbd: Balance RCU calls in drbd_adm_dump_devices()
    - loop: fix partition scan race between udev and loop_reread_partitions()
    - block: fix zones_cond memory leak on zone revalidation error paths
    - nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty()
    - blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current()
    - pstore/ram: fix resource leak when ioremap() fails
    - erofs: include the trailing NUL in FS_IOC_GETFSLABEL
    - md: fix array_state=clear sysfs deadlock
    - ublk: reset per-IO canceled flag on each fetch
    - blk-wbt: remove WARN_ON_ONCE from wbt_init_enable_default()
    - erofs: handle 48-bit blocks/uniaddr for extra devices
    - md: remove unused static md_wq workqueue
    - md: wake raid456 reshape waiters before suspend
    - dcache: permit dynamic_dname()s up to NAME_MAX
    - btrfs: fix the inline compressed extent check in inode_need_compress()
    - btrfs: fix deadlock between reflink and transaction commit when using
      flushoncommit
    - btrfs: do not reject a valid running dev-replace
    - OPP: debugfs: Use performance level if available to distinguish between
      rates
    - OPP: Move break out of scoped_guard in dev_pm_opp_xlate_required_opp()
    - ACPI: x86: cmos_rtc: Clean up address space handler driver
    - ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver
    - devres: fix missing node debug info in devm_krealloc()
    - thermal/drivers/spear: Fix error condition for reading st,thermal-flags
    - debugfs: check for NULL pointer in debugfs_create_str()
    - debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str()
    - soundwire: debugfs: initialize firmware_file to empty string
    - amd-pstate: Fix memory leak in amd_pstate_epp_cpu_init()
    - amd-pstate: Update cppc_req_cached in fast_switch case
    - cpufreq: Pass the policy to cpufreq_driver->adjust_perf()
    - PCI: use generic driver_override infrastructure
    - platform/wmi: use generic driver_override infrastructure
    - vdpa: use generic driver_override infrastructure
    - s390/cio: use generic driver_override infrastructure
    - s390/ap: use generic driver_override infrastructure
    - bus: fsl-mc: use generic driver_override infrastructure
    - locking/mutex: Rename mutex_init_lockep()
    - locking/mutex: Fix wrong comment for CONFIG_DEBUG_LOCK_ALLOC
    - irqchip/irq-pic32-evic: Address warning related to wrong printf()
      formatter
    - hrtimer: Avoid pointless reprogramming in __hrtimer_start_range_ns()
    - hrtimer: Reduce trace noise in hrtimer_start()
    - locking: Fix rwlock and spinlock lock context annotations
    - signal: Fix the lock_task_sighand() annotation
    - ww-mutex: Fix the ww_acquire_ctx function annotations
    - perf/amd/ibs: Account interrupt for discarded samples
    - perf/amd/ibs: Preserve PhyAddrVal bit when clearing PhyAddr MSR
    - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler
    - x86/tdx: Fix the typo in TDX_ATTR_MIGRTABLE
    - rust: sync: atomic: Remove bound `T: Sync` for `Atomic::from_ptr()`
    - sparc64: vdso: Link with -z noexecstack
    - scripts/gdb: timerlist: Adapt to move of tk_core
    - locking: Fix rwlock support in <linux/spinlock_up.h>
    - sched/topology: Compute sd_weight considering cpuset partitions
    - x86/irqflags: Preemptively move include paravirt.h directive where it
      belongs
    - sched/topology: Fix sched_domain_span()
    - irqchip/renesas-rzg2l: Fix error path in rzg2l_irqc_common_probe()
    - ASoC: Intel: avs: Check maximum valid CPUID leaf
    - ASoC: Intel: avs: Include CPUID header at file scope
    - x86/vdso: Clean up remnants of VDSO32_NOTE_MASK
    - firmware: dmi: Correct an indexing error in dmi.h
    - fs/resctrl: Report invalid domain ID when parsing io_alloc_cbm
    - sched: Make class_schedulers avoid pushing current, and get rid of
      proxy_tag_curr()
    - sched/rt: Skip group schedulable check with rt_group_sched=0
    - wifi: ath11k: fix memory leaks in beacon template setup
    - wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt()
    - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished
      irq_prepare_bcn_tasklet
    - bpf: test_run: Fix the null pointer dereference issue in
      bpf_lwt_xmit_push_encap
    - wifi: ath12k: account TX stats only when ACK/BA status is present
    - wifi: ath12k: Fix legacy rate mapping for monitor mode capture
    - selftests/bpf: Handle !CONFIG_SMC in bpf_smc.c
    - wifi: ieee80211: fix definition of EHT-MCS 15 in MRU
    - dpaa2: add independent dependencies for FSL_DPAA2_SWITCH
    - [Config] Disable CONFIG_FSL_DPAA2_SWITCH on armhf and ppc64el
    - dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n
    - s390/bpf: Zero-extend bpf prog return values and kfunc arguments
    - powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy
    - powerpc/64s: Fix unmap race with PMD migration entries
    - module: Fix freeing of charp module parameters when CONFIG_SYSFS=n
    - wifi: libertas: use USB anchors for tracking in-flight URBs
    - wifi: libertas: don't kill URBs in interrupt context
    - bpf: Do not allow deleting local storage in NMI
    - selftests/nolibc: fix test_file_stream() on musl libc
    - selftests/nolibc: Fix build with host headers and libc
    - tools/nolibc/printf: Change variables 'c' to 'ch' and 'tmpbuf[]' to
      'outbuf[]'
    - tools/nolibc/printf: Move snprintf length check to callback
    - tools/nolibc: MIPS: fix clobbers of 'lo' and 'hi' registers on different
      ISAs
    - tools/nolibc: avoid -Wundef warning for __STDC_VERSION__
    - wifi: mt76: mt7996: fix the behavior of radar detection
    - wifi: mt76: mt7996: fix iface combination for different chipsets
    - wifi: mt76: mt7996: Set mtxq->wcid just for primary link
    - wifi: mt76: mt7996: Reset mtxq->idx if primary link is removed in
      mt7996_vif_link_remove()
    - wifi: mt76: mt7996: Switch to the secondary link if the default one is
      removed
    - wifi: mt76: mt7996: Clear wcid pointer in mt7996_mac_sta_deinit_link()
    - wifi: mt76: mt7996: Reset ampdu_state state in case of failure in
      mt7996_tx_check_aggr()
    - wifi: mt76: mt7921: Reset ampdu_state state in case of failure in
      mt76_connac2_tx_check_aggr()
    - wifi: mt76: mt7925: Fix incorrect MLO mode in firmware control
    - wifi: mt76: mt7615: fix use_cts_prot support
    - wifi: mt76: mt7915: fix use_cts_prot support
    - wifi: mt76: mt7925: prevent NULL pointer dereference in
      mt7925_tx_check_aggr()
    - wifi: mt76: mt7925: prevent NULL vif dereference in
      mt7925_mac_write_txwi
    - wifi: mt76: mt7996: fix FCS error flag check in RX descriptor
    - wifi: mt76: mt7921: Place upper limit on station AID
    - wifi: mt76: Fix memory leak destroying device
    - wifi: mt76: mt7996: Fix NPU stop procedure
    - wifi: mt76: npu: Add missing rx_token_size initialization
    - wifi: mt76: mt7925: drop puncturing handling from BSS change path
    - wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync
    - wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req()
    - wifi: mt76: mt7925: fix tx power setting failure after chip reset
    - wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync
    - wifi: mt76: fix deadlock in remain-on-channel
    - wifi: mt76: fix backoff fields and max_power calculation
    - arm64: cpufeature: Make PMUVer and PerfMon unsigned
    - bpf: Switch CONFIG_CFI_CLANG to CONFIG_CFI
    - wifi: mt76: mt7996: fix wrong DMAD length when using MAC TXP
    - wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event
    - wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work()
    - wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work()
    - wifi: mt76: mt7921: fix 6GHz regulatory update on connection
    - wifi: mt76: mt7996: Add missing CHANCTX_STA_CSA property
    - wifi: mt76: mt7996: Remove link pointer dependency in
      mt7996_mac_sta_remove_links()
    - wifi: mt76: mt7996: Decrement sta counter removing the link in
      mt7996_mac_reset_sta_iter()
    - wifi: mt76: fix multi-radio on-channel scanning
    - wifi: mt76: support upgrading passive scans to active
    - wifi: mt76: mt7996: fix RRO EMU configuration
    - bpf: Fix refcount check in check_struct_ops_btf_id()
    - selftests/bpf: Fix sockmap_multi_channels reliability
    - bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path
    - bpf: Fix variable length stack write over spilled pointers
    - arm_mpam: Ensure in_reset_state is false after applying configuration
    - arm_mpam: Reset when feature configuration bit unset
    - bpf,arc_jit: Fix missing newline in pr_err messages
    - wifi: rtw89: phy: fix uninitialized variable access in
      rtw89_phy_cfo_set_crystal_cap()
    - drivers/vfio_pci_core: Change PXD_ORDER check from switch case to
      if/else block
    - r8152: fix incorrect register write to USB_UPHY_XTAL
    - selftests/tracing: Fix to make --logdir option work again
    - selftests/tracing: Fix to check awk supports non POSIX strtonum()
    - powerpc/crash: fix backup region offset update to elfcorehdr
    - powerpc/crash: Update backup region offset in elfcorehdr on memory
      hotplug
    - bpf: Fix abuse of kprobe_write_ctx via freplace
    - macvlan: annotate data-races around port->bc_queue_len_used
    - bpf: Use copy_map_value_locked() in alloc_htab_elem() for BPF_F_LOCK
    - bpf: Fix stale offload->prog pointer after constant blinding
    - net: ethernet: ti-cpsw:: rename soft_reset() function
    - net: ethernet: ti-cpsw: fix linking built-in code to modules
    - wifi: brcmfmac: Fix error pointer dereference
    - wifi: mac80211: handle VHT EXT NSS in ieee80211_determine_our_sta_mode()
    - bpf: Drop task_to_inode and inet_conn_established from lsm sleepable
      hooks
    - bpf: Prefer vmlinux symbols over module symbols for unqualified kprobes
    - wifi: ath10k: fix station lookup failure during disconnect
    - bpf: Fix linked reg delta tracking when src_reg == dst_reg
    - net: dropreason: add SKB_DROP_REASON_RECURSION_LIMIT
    - net: plumb drop reasons to __dev_queue_xmit()
    - net: qdisc_pkt_len_segs_init() cleanup
    - net: pull headers in qdisc_pkt_len_segs_init()
    - arm64: entry: Don't preempt with SError or Debug masked
    - ACPI: AGDI: fix missing newline in error message
    - arm64: kexec: Remove duplicate allocation for trans_pgd
    - bpf: Propagate error from visit_tailcall_insn
    - bpf: Fix ld_{abs,ind} failure path analysis in subprogs
    - bpf: Remove static qualifier from local subprog pointer
    - mptcp: better mptcp-level RTT estimator
    - bpf: Fix use-after-free in offloaded map/prog info fill
    - macsec: Support VLAN-filtering lower devices
    - net: bcmgenet: fix off-by-one in bcmgenet_put_txcb
    - net: bcmgenet: fix leaking free_bds
    - net: bcmgenet: fix racing timeout handler
    - net: airoha: Add dma_rmb() and READ_ONCE() in airoha_qdma_rx_process()
    - eth: fbnic: Use wake instead of start
    - netfilter: xt_socket: enable defrag after all other checks
    - netfilter: nft_fwd_netdev: check ttl/hl before forwarding
    - bpf: fix mm lifecycle in open-coded task_vma iterator
    - bpf: switch task_vma iterator from mmap_lock to per-VMA locks
    - bpf: return VMA snapshot from task_vma iterator
    - bpf: Fix RCU stall in bpf_fd_array_map_clear()
    - net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf
    - net: airoha: Fix FE_PSE_BUF_SET configuration if PPE2 is available
    - bpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars
    - selftests/bpf: fix __jited_unpriv tag name
    - net/sched: cls_fw: fix NULL dereference of "old" filters before change()
    - net/sched: act_ct: Only release RCU read lock after ct_ft
    - selftests: netfilter: nft_tproxy.sh: adjust to socat changes
    - net: mana: Use pci_name() for debugfs directory naming
    - net: mana: Move current_speed debugfs file to mana_init_port()
    - net: airoha: Add missing RX_CPU_IDX() configuration in
      airoha_qdma_cleanup_rx_queue()
    - net_sched: fix skb memory leak in deferred qdisc drops
    - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops
    - bpf: Allow instructions with arena source and non-arena dest registers
    - selftests/bpf: Fix reg_bounds to match new tnum-based refinement
    - net/rds: Optimize rds_ib_laddr_check
    - net/rds: Restrict use of RDS/IB to the initial network namespace
    - bpf: Fix OOB in pcpu_init_value
    - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls
    - net: ipa: Fix programming of QTIME_TIMESTAMP_CFG
    - net: ipa: Fix decoding EV_PER_EE for IPA v5.0+
    - dt-bindings: net: dsa: nxp,sja1105: make spi-cpol optional for sja1110
    - net: phy: fix a return path in get_phy_c45_ids()
    - net/mlx5e: Fix features not applied during netdev registration
    - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic()
    - net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registers
    - net: fix skb_ext_total_length() BUILD_BUG_ON with
      CONFIG_GCOV_PROFILE_ALL
    - bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb
    - Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds
      MTU
    - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error
    - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER
    - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp
    - Bluetooth: SCO: check for codecs->num_codecs == 1 before assigning to
      sco_pi(sk)->codec
    - net: phy: qcom: at803x: Use the correct bit to disable extended next
      page
    - udp: Force compute_score to always inline
    - tcp: Don't set treq->req_usec_ts in cookie_tcp_reqsk_init().
    - sctp: fix missing encap_port propagation for GSO fragments
    - sctp: disable BH before calling udp_tunnel_xmit_skb()
    - selftests/namespaces: remove unused utils.h include from
      listns_efault_test
    - net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master
    - net: airoha: Fix VIP configuration for AN7583 SoC
    - net: airoha: Add missing PPE configurations in airoha_ppe_hw_init()
    - drm/panel: ilitek-ili9882t: Select DRM_DISPLAY_DSC_HELPER
    - selftests/futex: Fix incorrect result reporting of futex_requeue test
      item
    - drm/komeda: fix integer overflow in AFBC framebuffer size check
    - dma-fence: Fix sparse warnings due __rcu annotations
    - drm/gpusvm: Fix unbalanced unlock in drm_gpusvm_scan_mm()
    - drm/virtio: Allow importing prime buffers when 3D is enabled
    - ASoC: soc-compress: use function to clear symmetric params
    - PCI/TPH: Allow TPH enable for RCiEPs
    - PCI: endpoint: pci-epf-vntb: Fix MSI doorbell IRQ unwind
    - PCI: endpoint: pci-epf-test: Don't free doorbell IRQ unless requested
    - PCI: endpoint: pci-ep-msi: Fix error unwind and prevent double alloc
    - drm/sun4i: mixer: Fix layer init code
    - drm/sun4i: backend: fix error pointer dereference
    - drm/xe: Consolidate workaround entries for Wa_14019877138
    - drm/xe: Consolidate workaround entries for Wa_14019386621
    - drm/xe/xe2_hpg: Drop invalid workaround Wa_15010599737
    - gpu: nova-core: gsp: use empty slices instead of [0..0] ranges
    - gpu: nova-core: gsp: fix improper handling of empty slot in cmdq
    - drm/amdkfd: Removed commented line for MQD queue priority
    - PCI: imx6: Fix device node reference leak in imx_pcie_probe()
    - crypto: inside-secure/eip93 - fix register definition
    - ASoC: sti: Return errors from regmap_field_alloc()
    - ASoC: sti: use managed regmap_field allocations
    - dm cache: fix null-deref with concurrent writes in passthrough mode
    - dm cache: fix write path cache coherency in passthrough mode
    - dm cache: fix write hang in passthrough mode
    - dm cache policy smq: fix missing locks in invalidating cache blocks
    - dm cache: fix concurrent write failure in passthrough mode
    - dm cache: fix dirty mapping checking in passthrough mode switching
    - dm-mpath: don't stop probing paths at presuspend
    - drm/amd/ras: Fix type size of remainder argument
    - dt-bindings: mmc: dwcmshc-sdhci: Fix resets array validation
    - drm/amdgpu: GFX12.1 scratch memory limit up to 57-bit
    - platform/chrome: chromeos_tbmc: Drop wakeup source on remove
    - gpu: nova-core: use checked arithmetic in FWSEC firmware parsing
    - gpu: nova-core: create falcon firmware DMA objects lazily
    - gpu: nova-core: falcon: rename load parameters to reflect DMA dependency
    - gpu: nova-core: firmware: fix and explain v2 header offsets computations
    - PCI: dwc: ep: Fix MSI-X Table Size configuration in
      dw_pcie_ep_set_msix()
    - PCI: dwc: ep: Mirror the max link width and speed fields to all
      functions
    - PCI: dwc: Perform cleanup in the error path of dw_pcie_resume_noirq()
    - dm cache metadata: fix memory leak on metadata abort retry
    - dm log: fix out-of-bounds write due to region_count overflow
    - iopoll: fix function parameter names in read_poll_timeout_atomic()
    - drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier
      in atomic_enable()
    - drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to
      drm_bridge_funcs
    - drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge
      atomic check
    - spi: nxp-xspi: Use reinit_completion() for repeated operations
    - spi: nxp-fspi: Use reinit_completion() for repeated operations
    - spi: fsl-qspi: Use reinit_completion() for repeated operations
    - spi: axiado: Remove redundant pm_runtime_mark_last_busy() call
    - media: i2c: og01a1b: Fix V4L2 subdevice data initialization on probe
    - media: synopsys: VIDEO_DW_MIPI_CSI2RX should depend on ARCH_ROCKCHIP
    - [Config] VIDEO_DW_MIPI_CSI2RX depends on ARCH_ROCKCHIP
    - drm/amd/pm: Fix xgmi max speed reporting
    - spi: atcspi200: fix mutex initialization order
    - selftests/sched_ext: Add missing error check for exit__load()
    - drm/v3d: Handle error from drm_sched_entity_init()
    - drm/sun4i: Fix resource leaks
    - crypto: inside-secure/eip93 - register hash before authenc algorithms
    - PCI: rzg3s-host: Fix reset handling in probe error path
    - PCI: rzg3s-host: Reorder reset assertion during suspend
    - dt-bindings: PCI: renesas,r9a08g045s33-pcie: Fix naming properties
    - iommu/riscv: Add IOTINVAL after updating DDT/PDT entries
    - iommu/riscv: Skip IRQ count check when using MSI interrupts
    - iommu/riscv: Add missing GENERIC_MSI_IRQ
    - iommu/riscv: Stop polling when CQCSR reports an error
    - drm/amdkfd: Update queue properties for metadata ring
    - drm/amd/ras: Fix NULL deref in ras_core_ras_interrupt_detected()
    - drm/amdgpu: Add default case in DVI mode validation
    - regulator: dt-bindings: fp9931: Make vin-supply property as required
    - regulator: fp9931: Fix handling of mandatory "vin" supply
    - drm/amd/ras: Fix NULL deref in ras_core_get_utc_second_timestamp()
    - drm/amdgpu: Drop redundant queue NULL check in hang detect worker
    - drm/amdgpu: Remove dead negative offset check in
      amdgpu_virt_init_critical_region()
    - dm init: ensure device probing has finished in dm-mod.waitfor=
    - fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build
      break
    - crypto: simd - reject compat registrations without __ prefixes
    - crypto: tegra - Disable softirqs before finalizing request
    - crypto: atmel-aes - guard unregister on error in atmel_aes_register_algs
    - padata: Remove cpu online check from cpu add and removal
    - padata: Put CPU offline callback in ONLINE section to allow failure
    - PCI: dwc: rcar-gen4: Change EPC BAR alignment to 4K as per the
      documentation
    - accel/amdxdna: fix missing newline in pr_err message
    - drm/amd/ras: Remove redundant NULL check in pending bad-bank list
      iteration
    - drm/amdgpu/gfx10: look at the right prop for gfx queue priority
    - drm/amdgpu/gfx11: look at the right prop for gfx queue priority
    - spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo
    - PCI: sky1: Fix missing cleanup of ECAM config on probe failure
    - drm/imagination: Switch reset_reason fields from enum to u32
    - iommu/tegra241-cmdqv: Set supports_cmd op in tegra241_vcmdq_hw_init()
    - iommu/tegra241-cmdqv: Update uAPI to clarify HYP_OWN requirement
    - drm/msm: add missing MODULE_DEVICE_ID definitions
    - drm/msm/dpu: fix mismatch between power and frequency
    - drm/msm/dsi: add the missing parameter description
    - drm/msm/dpu: don't try using 2 LMs if only one DSC is available
    - drm/msm/dsi: fix bits_per_pclk
    - drm/msm/dsi: fix hdisplay calculation for CMD mode panel
    - drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0
    - ASoC: rockchip: rockchip_sai: Set slot width for non-TDM mode
    - tools/sched_ext: scx_pair: fix pair_ctx indexing for CPU pairs
    - drm/panel: sharp-ls043t1le01: make use of prepare_prev_first
    - drm/panel: simple: Correct G190EAN01 prepare timing
    - PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion
      support
    - PCI: Prevent shrinking bridge window from its required size
    - PCI: Fix premature removal from realloc_head list during resource
      assignment
    - crypto: hisilicon/sec2 - prevent req used-after-free for sec
    - PCI: Fix alignment calculation for resource size larger than align
    - iommu/riscv: Fix signedness bug
    - ALSA: core: Validate compress device numbers without dynamic minors
    - drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths
    - ASoC: amd: acp: update dmic_num logic for acp pdm dmic
    - drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled
    - drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs
    - drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock
    - drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0
    - drm/amd/pm/ci: Clear EnabledForActivity field for memory levels
    - drm/amd/pm/ci: Fill DW8 fields from SMC
    - drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board
    - drm/amdgpu/uvd4.2: Don't initialize UVD 4.2 when DPM is disabled
    - PCI/DPC: Log AER error info for DPC/EDR uncorrectable errors
    - hwmon: (aspeed-g6-pwm-tach): remove redundant driver remove callback
    - ALSA: hda/realtek: fix bad indentation for alc269
    - ALSA: hda/realtek: fix code style (ERROR: else should follow close brace
      '}')
    - ASoC: SOF: Intel: hda: Place check before dereference
    - drm/msm/vma: Avoid lock in VM_BIND fence signaling path
    - drm/msm/a6xx: Add missing aperture_lock init
    - drm/msm: Reject fb creation from _NO_SHARE objs
    - drm/msm: Fix VM_BIND UNMAP locking
    - drm/msm/a6xx: Fix HLSQ register dumping
    - drm/msm/shrinker: Fix can_block() logic
    - drm/msm/a6xx: Fix dumping A650+ debugbus blocks
    - drm/msm/a6xx: Use barriers while updating HFI Q headers
    - drm/msm/a8xx: Fix the ticks used in submit traces
    - drm/msm/a6xx: Switch to preemption safe AO counter
    - drm/msm/a6xx: Correct OOB usage
    - drm/msm/adreno: Implement gx_is_on() for A8x
    - drm/msm/a6xx: Fix gpu init from secure world
    - ALSA: hda/cmedia: Remove duplicate pin configuration parsing
    - pmdomain: ti: omap_prm: Fix a reference leak on device node
    - pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe()
    - PM: domains: De-constify fields in struct dev_pm_domain_attach_data
    - drm/msm/dpu: drop INTF_0 on MSM8953
    - ASoC: fsl_micfil: Add access property for "VAD Detected"
    - ASoC: fsl_micfil: Fix event generation in hwvad_put_enable()
    - ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode()
    - ASoC: fsl_micfil: Fix event generation in micfil_range_set()
    - ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state()
    - ASoC: fsl_micfil: Fix event generation in micfil_quality_set()
    - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put()
    - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put()
    - ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits()
    - ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits()
    - ASoC: fsl_easrc: Change the type for iec958 channel status controls
    - iommu/amd: Fix clone_alias() to use the original device's devid
    - iommu/riscv: Remove overflows on the invalidation path
    - ASoC: qcom: qdsp6: topology: check widget type before accessing data
    - PCI: dwc: Fix type mismatch for kstrtou32_from_user() return value
    - crypto: qat - disable 4xxx AE cluster when lead engine is fused off
    - crypto: qat - disable 420xx AE cluster when lead engine is fused off
    - crypto: qat - fix compression instance leak
    - crypto: qat - fix type mismatch in RAS sysfs show functions
    - crypto: iaa - fix per-node CPU counter reset in rebalance_wq_table()
    - crypto: qat - use swab32 macro
    - ALSA: hda: Notify IEC958 Default PCM switch state changes
    - ASoC: rsnd: Fix potential out-of-bounds access of component_dais[]
    - PCI: Enable AtomicOps only if Root Port supports them
    - PCI: imx6: Keep Root Port MSI capability with iMSI-RX to work around
      hardware bug
    - PCI: aspeed: Fix IRQ domain leak on platform_get_irq() failure
    - dt-bindings: PCI: imx6q-pcie: Fix maxItems of clocks and clock-names
    - PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found
    - gpu: nova-core: bitfield: fix broken Default implementation
    - selftests/mm: skip migration tests if NUMA is unavailable
    - Documentation: fix a hugetlbfs reservation statement
    - Docs/admin-guide/mm/damn/lru_sort: fix intervals autotune parameter name
    - Docs/mm/damon/index: fix typo: autoamted -> automated
    - zram: do not permit params change after init
    - selftest: memcg: skip memcg_sock test if address family not supported
    - gpu: nova-core: remove redundant `.as_ref()` for `dev_*` print
    - gpu: nova-core: fix missing colon in SEC2 boot debug message
    - ALSA: scarlett2: Add missing sentinel initializer field
    - ASoC: qcom: audioreach: explicitly enable speaker protection modules
    - ASoC: SOF: compress: return the configured codec from get_params
    - PCI/NPEM: Set LED_HW_PLUGGABLE for hotplug-capable ports
    - tools/sched_ext: Fix off-by-one in scx_sdt payload zeroing
    - ASoC: soc-component: re-add pcm_new()/pcm_free()
    - ASoC: amd: name back to pcm_new()/pcm_free()
    - ASoC: amd: ps: fix the pcm device numbering for acp pdm dmic
    - ALSA: usb-audio: qcom: Fix incorrect type in enable_audio_stream
    - PCI: tegra194: Fix polling delay for L2 state
    - PCI: tegra194: Increase LTSSM poll time on surprise link down
    - PCI: tegra194: Disable LTSSM after transition to Detect on surprise link
      down
    - PCI: tegra194: Don't force the device into the D0 state before L2
    - PCI: tegra194: Disable PERST# IRQ only in Endpoint mode
    - PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-
      select"
    - PCI: tegra194: Disable direct speed change for Endpoint mode
    - PCI: tegra194: Set LTR message request before PCIe link up in Endpoint
      mode
    - PCI: tegra194: Allow system suspend when the Endpoint link is not up
    - PCI: tegra194: Free up Endpoint resources during remove()
    - PCI: tegra194: Use DWC IP core version
    - PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well
    - PCI: tegra194: Disable L1.2 capability of Tegra234 EP
    - PCI: tegra194: Fix CBB timeout caused by DBI access before core power-on
    - drm/fb-helper: Fix a locking bug in an error path
    - PCI: cadence: Add flags for disabling ASPM capability for broken Root
      Ports
    - PCI: sg2042: Avoid L0s and L1 on Sophgo 2042 PCIe Root Ports
    - ASoC: SDCA: Fix cleanup inversion in class driver
    - spi: rzv2h-rspi: Fix invalid SPR=0/BRDV=0 clock configuration
    - spi: mtk-snfi: unregister ECC engine on probe failure and remove()
      callback
    - ALSA: sc6000: Keep the programmed board state in card-private data
    - dm cache: fix missing return in invalidate_committed's error path
    - sched_ext: Track @p's rq lock across set_cpus_allowed_scx ->
      ops.set_cpumask
    - sched_ext: Fix ops.cgroup_move() invocation kf_mask and rq tracking
    - spi: cadence-qspi: Revert the filtering of certain opcodes in ODTR
    - crypto: jitterentropy - replace long-held spinlock with mutex
    - ALSA: usb-audio: Exclude Scarlett 18i20 1st Gen from SKIP_IFACE_SETUP
    - ALSA: hda/realtek - fixed speaker no sound update
    - gfs2: Call unlock_new_inode before d_instantiate
    - fanotify: avoid/silence premature LSM capability checks
    - fanotify: call fanotify_events_supported() before path_permission() and
      security_path_notify()
    - fuse: fix uninit-value in fuse_dentry_revalidate()
    - ktest: Avoid undef warning when WARNINGS_FILE is unset
    - ktest: Honor empty per-test option overrides
    - ktest: Run POST_KTEST hooks on failure and cancellation
    - vfio: selftests: fix crash in vfio_dma_mapping_mmio_test
    - rtla/utils: Fix resource leak in set_comm_sched_attr()
    - tools/rtla: Generate optstring from long options
    - rtla: Fix segfault on multiple SIGINTs
    - vfio: selftests: Build tests on aarch64
    - gfs2: less aggressive low-memory log flushing
    - quota: Fix race of dquot_scan_active() with quota deactivation
    - vfio: unhide vdev->debug_root
    - gfs2: add some missing log locking
    - gfs2: prevent NULL pointer dereference during unmount
    - efi/capsule-loader: fix incorrect sizeof in phys array reallocation
    - ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine
    - arm64: dts: mediatek: mt8365: Describe infracfg-nao as a pure syscon
    - ARM: dts: mediatek: mt7623: fix efuse fallback compatible
    - memory: tegra124-emc: Fix dll_change check
    - memory: tegra30-emc: Fix dll_change check
    - arm64: dts: imx8-apalis: Fix LEDs name collision
    - arm64: dts: imx91-11x11-evk: change usdhc tuning step for eMMC and SD
    - riscv: dts: spacemit: pcie: fix missing power regulator
    - arm64: dts: mediatek: mt7988a-bpi-r4pro: fix model string
    - arm64: dts: rockchip: Make Jaguar PCIe-refclk pin use pull-up config
    - arm64: dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO
      (M.2 W_DISABLE1)
    - iommufd: vfio compatibility extension check for noiommu mode
    - arm64: dts: qcom: sm6125-xiaomi-ginkgo: Remove board-id
    - arm64: dts: qcom: sm6125-xiaomi-ginkgo: Correct reserved memory ranges
    - arm64: dts: qcom: sm6125-xiaomi-ginkgo: Remove extcon
    - arm64: dts: qcom: sm6125-xiaomi-ginkgo: Fix reserved gpio ranges
    - arm64: dts: qcom: qcs6490-rubikpi3: Use lt9611 DSI Port B
    - arm64: dts: qcom: talos: Add missing clock-names to GCC
    - arm64: dts: ti: k3-am62l: include WKUP_UART0 in wakeup peripheral window
    - arm64: dts: mediatek: mt6795: Fix gpio-ranges pin count
    - arm64: dts: mediatek: mt7981b: Fix gpio-ranges pin count
    - arm64: dts: mediatek: mt7986a: Fix gpio-ranges pin count
    - iommufd/selftest: Fix page leaks in mock_viommu_{init,destroy}
    - arm64: dts: imx8mp-kontron: Fix touch reset configuration on DL devices
    - arm64: dts: imx8mp-kontron: Drop vmmc-supply to fix SD card on SMARC
      eval carrier
    - arm64: dts: imx8mp-hummingboard-pulse/cubox-m: fix vmmc gpio polarity
    - arm64: dts: imx8mp-hummingboard-pulse: fix mini-hdmi dsi port reference
    - ARM: dts: BCM5301X: Drop extra NAND controller compatible
    - arm64: dts: qcom: msm8953-xiaomi-vince: correct wled ovp value
    - arm64: dts: qcom: msm8937-xiaomi-land: correct wled ovp value
    - arm64: dts: qcom: msm8953-xiaomi-daisy: fix backlight
    - firmware: qcom_scm: don't opencode kmemdup
    - soc: qcom: ubwc: disable bank swizzling for Glymur platform
    - arm64: dts: rockchip: Fix Bluetooth stability on LCKFB TaiShan Pi
    - Revert "arm64: dts: rockchip: add SPDIF audio to Beelink A1"
    - arm64: dts: rockchip: Correct Fan Supply for Gameforce Ace
    - arm64: dts: rockchip: Correct Joystick Axes on Gameforce Ace
    - soc: qcom: ocmem: make the core clock optional
    - soc: qcom: ocmem: register reasons for probe deferrals
    - soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available
    - riscv: dts: spacemit: drop incorrect pinctrl for combo PHY
    - arm64: dts: rockchip: Fix RK3562 EVB2 model name
    - arm64: dts: rockchip: Add mphy reset to ufshc node
    - bus: rifsc: fix RIF configuration check for peripherals
    - arm64: dts: qcom: arduino-imola: fix faulty spidev node
    - Revert "UBUNTU: SAUCE: arm64: dts: add missing denali-oled.dtb to
      Makefile"
    - arm64: dts: qcom: add missing denali-oled.dtb to Makefile
    - arm64: dts: qcom: hamoa: correct Iris corners for the MXC rail
    - arm64: dts: qcom: lemans: correct Iris corners for the MXC rail
    - arm64: dts: qcom: monaco: correct Iris corners for the MXC rail
    - arm64: dts: qcom: sm8550: correct Iris corners for the MXC rail
    - arm64: dts: qcom: sm8650: correct Iris corners for the MXC rail
    - arm64: dts: qcom: sm8750: correct Iris corners for the MXC rail
    - arm64: dts: qcom: kaanapali: Fix GIC_ITS range length
    - arm64: dts: qcom: milos: Fix GIC_ITS range length
    - arm64: dts: qcom: sm8450: Fix GIC_ITS range length
    - arm64: dts: qcom: sm8550: Fix GIC_ITS range length
    - arm64: dts: qcom: sm8650: Fix GIC_ITS range length
    - arm64: dts: qcom: sm8750: Fix GIC_ITS range length
    - arm64: dts: qcom: sm8550: Fix xo clock supply of platform SD host
      controller
    - arm64: dts: qcom: sm8650: Fix xo clock supply of SD host controller
    - arm64: dts: qcom: hamoa: Fix xo clock supply of platform SD host
      controller
    - arm64: dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes
    - arm64: dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes
    - arm64: dts: qcom: sm8650: Enable UHS-I SDR50 and SDR104 SD card modes
    - arm64: dts: qcom: sm7225-fairphone-fp4: Fix conflicting bias pinctrl
    - arm64: dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered
      during boot
    - arm64: dts: qcom: msm8917-xiaomi-riva: Fix board-id for all bootloader
    - arm64: dts: ti: k3-am62p5-sk: Disable MMC1 internal pulls on data pins
    - arm64: dts: ti: k3-am62l3-evm: Disable MMC1 internal pulls on data pins
    - arm64: dts: ti: k3-am62-lp-sk: Enable internal pulls for MMC0 data pins
    - arm64: dts: ti: k3-am62-verdin: Fix SPI_1 GPIO CS pinctrl label
    - arm64: dts: freescale: imx8mp-tqma8mpql-mba8mp-ras314: fix UART1 RTS/CTS
      muxing
    - arm64: dts: imx91: Remove TMU's superfluous sensor ID
    - arm64: dts: imx8mp-kontron: Fix boot order for PMIC and RTC
    - arm64: dts: imx8dxl-evk: Use audio-graph-card2 for wm8960-2 and wm8960-3
    - arm64: dts: imx8mp-evk: Specify ADV7535 register addresses
    - arm64: dts: lx2160a: change i2c0 (iic1) pinmux mask to one bit
    - arm64: dts: lx2160a: remove duplicate pinmux nodes
    - arm64: dts: lx2160a: rename pinmux nodes for readability
    - arm64: dts: lx2160a: add sda gpio references for i2c bus recovery
    - arm64: dts: lx2160a: change zeros to hexadecimal in pinmux nodes
    - arm64: dts: lx2160a: complete pinmux for rcwsr12 configuration word
    - arm64: dts: imx8qm-mek: switch Type-C connector power-role to dual
    - arm64: dts: imx8qxp-mek: switch Type-C connector power-role to dual
    - soc/tegra: cbb: Set ERD on resume for err interrupt
    - soc/tegra: cbb: Fix incorrect ARRAY_SIZE in fabric lookup tables
    - soc/tegra: cbb: Fix cross-fabric target timeout lookup
    - arm64: tegra: Fix RTC aliases
    - soc/tegra: pmc: Add kerneldoc for reboot notifier
    - soc/tegra: pmc: Correct function names in kerneldoc
    - soc/tegra: pmc: Add kerneldoc for wake-up variables
    - unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts()
      failure
    - ocfs2/dlm: validate qr_numregions in dlm_match_regions()
    - ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison
    - soc: qcom: llcc: fix v1 SB syndrome register offset
    - soc: qcom: aoss: compare against normalized cooling state
    - arm64: dts: qcom: milos: Add missing CX power domain to GCC
    - arm64: dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP
    - ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX
    - arm64/xor: fix conflicting attributes for xor_block_template
    - lib: kunit_iov_iter: fix memory leaks
    - ARM: dts: imx27-eukrea: replace interrupts with interrupts-extended
    - firmware: arm_ffa: Use the correct buffer size during RXTX_MAP
    - fwctl: Fix class init ordering to avoid NULL pointer dereference on
      device removal
    - ocfs2: fix listxattr handling when the buffer is full
    - ocfs2: validate bg_bits during freefrag scan
    - ocfs2: validate group add input before caching
    - dmaengine: dw-axi-dmac: fix Alignment should match open parenthesis
    - dmaengine: dw-axi-dmac: Remove unnecessary return statement from void
      function
    - phy: apple: apple: Use local variable for ioremap return value
    - soundwire: bus: demote UNATTACHED state warnings to dev_dbg()
    - soundwire: Intel: test bus.bpt_stream before assigning it
    - dmaengine: mxs-dma: Fix missing return value from
      of_dma_controller_register()
    - soundwire: cadence: Clear message complete before signaling waiting
      thread
    - tracing: move __printf() attribute on __ftrace_vbprintk()
    - tracing: Rebuild full_name on each hist_field_name() call
    - hte: tegra194: remove Kconfig dependency on Tegra194 SoC
    - [Config] Enable CONFIG_HTE_TEGRA194 on armhf
    - remoteproc: xlnx: Fix sram property parsing
    - stop_machine: Fix the documentation for a NULL cpus argument
    - remoteproc: imx_rproc: Check return value of regmap_attach_dev() in
      imx_rproc_mmio_detect_mode()
    - ima: check return value of crypto_shash_final() in boot aggregate
    - HID: asus: make asus_resume adhere to linux kernel coding standards
    - HID: asus: do not abort probe when not necessary
    - workqueue: devres: Add device-managed allocate workqueue
    - power: supply: max77705: Drop duplicated IRQ error message
    - power: supply: max77705: Free allocated workqueue and fix removal order
    - mtd: physmap_of_gemini: Fix disabled pinctrl state check
    - ima_fs: Correctly create securityfs files for unsupported hash algos
    - dt-bindings: interrupt-controller: arm,gic-v3: Fix EPPI range
    - mtd: spi-nor: core: correct the op.dummy.nbytes when check read
      operations
    - mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation
    - mtd: spi-nor: micron-st: add SNOR_CMD_PP_8_8_8_DTR sfdp fixup for
      mt35xu512aba
    - mtd: spi-nor: swp: check SR_TB flag when getting tb_mask
    - mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path
    - mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions
    - cxl/pci: Check memdev driver binding status in cxl_reset_done()
    - mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob
    - mtd: spinand: winbond: Clarify when to enable the HS bit
    - HID: usbhid: fix deadlock in hid_post_reset()
    - ext4: fix miss unlock 'sb->s_umount' in extents_kunit_init()
    - ext4: call deactivate_super() in extents_kunit_exit()
    - ext4: fix the error handling process in extents_kunit_init).
    - ext4: fix possible null-ptr-deref in extents_kunit_exit()
    - ext4: fix possible null-ptr-deref in mbt_kunit_exit()
    - bpf, arm64: Reject out-of-range B.cond targets
    - bpf, arm64: Fix off-by-one in check_imm signed range check
    - bpf, arm64: Remove redundant bpf_flush_icache() after pack allocator
      finalize
    - bpf, riscv: Remove redundant bpf_flush_icache() after pack allocator
      finalize
    - bpf, sockmap: Fix af_unix iter deadlock
    - bpf, sockmap: Fix af_unix null-ptr-deref in proto update
    - bpf, sockmap: Take state lock for af_unix iter
    - bpf: Fix precedence bug in convert_bpf_ld_abs alignment check
    - bpf: Fix NULL deref in map_kptr_match_type for scalar regs
    - bpf: allow UTF-8 literals in bpf_bprintf_prepare()
    - libbpf: Prevent double close and leak of btf objects
    - bpf: Validate node_id in arena_alloc_pages()
    - bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT
    - perf trace: Fix IS_ERR() vs NULL check bug
    - dt-bindings: pinctrl: marvell,armada3710-xb-pinctrl: add missing items
      keyword
    - pinctrl: pinctrl-pic32: Fix resource leak
    - perf trace: Avoid an ERR_PTR in syscall_stats
    - pinctrl: microchip-mssio: Fix missing return in probe
    - perf test type profiling: Remote typedef on struct
    - pinctrl: cy8c95x0: remove duplicate error message
    - pinctrl: cy8c95x0: Unify messages with help of dev_err_probe()
    - pinctrl: cy8c95x0: Avoid returning positive values to user space
    - perf branch: Avoid incrementing NULL
    - perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE
      trace
    - pinctrl: pinconf-generic: Fully validate 'pinmux' property
    - pinctrl: realtek: Fix function signature for config argument
    - pinctrl: abx500: Fix type of 'argument' variable
    - pinctrl: renesas: rzg2l: Fix save/restore of {IOLH,IEN,PUPD,SMT}
      registers
    - tools build: Correct link flags for libopenssl
    - perf lock: Fix option value type in parse_max_stack
    - perf stat: Fix opt->value type for parse_cache_level
    - memblock: reserve_mem: fix end caclulation in
      reserve_mem_release_by_name()
    - perf stat: Fix crash on arm64
    - perf tools: Fix module symbol resolution for non-zero .text sh_addr
    - perf test: Fix ratio_to_prev event parsing test
    - perf test: Skip perf data type profiling tests for s390
    - perf expr: Return -EINVAL for syntax error in expr__find_ids()
    - perf metrics: Make common stalled metrics conditional on having the
      event
    - ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure
    - ipmi: ssif_bmc: fix message desynchronization after truncated response
    - ipmi: ssif_bmc: change log level to dbg in irq callback
    - perf cgroup: Update metric leader in evlist__expand_cgroup
    - pinctrl: sophgo: pinctrl-sg2042: Fix wrong module description
    - pinctrl: sophgo: pinctrl-sg2044: Fix wrong module description
    - perf maps: Fix fixup_overlap_and_insert that can break sorted by name
      order
    - perf maps: Fix copy_from that can break sorted by name order
    - perf util: Kill die() prototype, dead for a long time
    - i3c: master: dw-i3c: Fix missing reset assertion in remove() callback
    - i3c: master: dw-i3c: Balance PM runtime usage count on probe failure
    - i3c: master: renesas: Fix memory leak in renesas_i3c_i3c_xfers()
    - i3c: dw: Fix memory leak in dw_i3c_master_i3c_xfers()
    - i3c: master: adi: Fix error propagation for CCCs
    - i3c: mipi-i3c-hci: fix IBI payload length calculation for final status
    - fs/ntfs3: prevent uninitialized lcn caused by zero len
    - backlight: sky81452-backlight: Check return value of
      devm_gpiod_get_optional() in sky81452_bl_parse_dt()
    - platform/surface: surfacepro3_button: Drop wakeup source on remove
    - leds: lgm-sso: Remove duplicate assignments for priv->mmap
    - usb: typec: Fix error pointer dereference
    - tty: hvc_iucv: fix off-by-one in number of supported devices
    - usb: typec: ps883x: Fix Oops at unbind
    - platform/x86: panasonic-laptop: Fix OPTD notifier registration and
      cleanup
    - platform/x86: barco-p50-gpio: normalize return value of gpio_get
    - fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()
    - mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata()
    - nfs/blocklayout: Fix compilation error (`make W=1`) in
      bl_write_pagelist()
    - sunrpc: Kill RPC_IFDEBUG()
    - sunrpc: Fix compilation error (`make W=1`) when dprintk() is no-op
    - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg
    - nfsd: use dynamic allocation for oversized NFSv4.0 replay cache
    - RDMA/umem: Use consistent DMA attributes when unmapping entries
    - greybus: raw: fix use-after-free on cdev close
    - greybus: raw: fix use-after-free if write is called after disconnect
    - platform/x86: asus-wmi: adjust screenpad power/brightness handling
    - platform/x86: asus-wmi: fix screenpad brightness range
    - tty: serial: ip22zilog: Fix section mispatch warning
    - fs/ntfs3: terminate the cached volume label after UTF-8 conversion
    - platform/x86: hp-wmi: fix ignored return values in fan settings
    - platform/x86: hp-wmi: avoid cancel_delayed_work_sync from work handler
    - platform/x86: hp-wmi: use mod_delayed_work to reset keep-alive timer
    - platform/x86: hp-wmi: fix u8 underflow in gpu_delta calculation
    - platform/x86: hp-wmi: add locking for concurrent hwmon access
    - platform/x86: dell_rbu: avoid uninit value usage in packet_size_write()
    - platform/x86: dell-wmi-sysman: bound enumeration string aggregation
    - RDMA/core: Prefer NLA_NUL_STRING
    - platform/x86: hp-wmi: fix fan table parsing
    - dt-bindings: clock: qcom: Add GCC video axi reset clock for Glymur
    - clk: qcom: gcc-glymur: Add video axi clock resets for glymur
    - clk: qcom: dispcc-glymur: use RCG2 ops for DPTX1 AUX clock source
    - clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source
    - clk: renesas: r9a09g057: Fix ordering of module clocks array
    - clk: renesas: r9a09g056: Fix ordering of module clocks array
    - clk: sunxi-ng: sun55i-a523-r: Add missing r-spi module clock
    - scsi: sg: Fix sysctl sg-big-buff register during sg_init()
    - scsi: sg: Resolve soft lockup issue when opening /dev/sgX
    - clk: qcom: dispcc-sc8280xp: remove CLK_SET_RATE_PARENT from
      byte_div_clk_src dividers
    - clk: qcom: dispcc-glymur: Fix DSI byte clock rate setting
    - clk: qcom: dispcc-kaanapali: Fix DSI byte clock rate setting
    - clk: qcom: dispcc-milos: Fix DSI byte clock rate setting
    - clk: qcom: dispcc-sm4450: Fix DSI byte clock rate setting
    - clk: qcom: dispcc[01]-sa8775p: Fix DSI byte clock rate setting
    - clk: renesas: r9a09g057: Remove entries for WDT{0,2,3}
    - scsi: target: core: Fix integer overflow in UNMAP bounds check
    - scsi: ufs: rockchip,rk3576-ufshc: dt-bindings: Add new mphy reset item
    - dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs
    - clk: qcom: gcc-sc8180x: Add missing GDSCs
    - clk: qcom: gcc-sc8180x: Use retention for USB power domains
    - clk: qcom: gcc-sc8180x: Use retention for PCIe power domains
    - clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk
    - clk: qcom: dispcc-sm8250: Enable parents for pixel clocks
    - clk: imx: imx6q: Fix device node reference leak in pll6_bypassed()
    - clk: imx: imx6q: Fix device node reference leak in
      of_assigned_ldb_sels()
    - clk: imx8mq: Correct the CSI PHY sels
    - um: Fix potential race condition in TLB sync
    - x86/um: fix vDSO installation
    - clk: qoriq: avoid format string warning
    - clk: xgene: Fix mapping leak in xgene_pllclk_init()
    - clk: spacemit: ccu_mix: fix inverted condition in ccu_mix_trigger_fc()
    - f2fs: avoid reading already updated pages during GC
    - printk_ringbuffer: Fix get_data() size sanity check
    - clk: qcom: gdsc: Fix error path on registration of multiple pm
      subdomains
    - lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug()
    - f2fs: fix data loss caused by incorrect use of nat_entry flag
    - f2fs: fix to preserve previous reserve_{blocks,node} value when remount
    - scsi: hpsa: Enlarge controller and IRQ name buffers
    - drm/amd/display: Fix parameter mismatch in panel self-refresh helper
    - clk: qcom: gcc-x1e80100: Keep GCC USB QTB clock always ON
    - clk: visconti: pll: initialize clk_init_data to zero
    - f2fs: allow empty mount string for Opt_usr|grp|projjquota
    - f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show()
    - drm/i915/wm: Verify the correct plane DDB entry
    - virt: arm-cca-guest: fix error check for RSI_INCOMPLETE
    - crypto: eip93 - fix hmac setkey algo selection
    - crypto: sa2ul - Fix AEAD fallback algorithm names
    - crypto: ccp - copy IV using skcipher ivsize
    - sh: Include <linux/io.h> in dac.h
    - erofs: unify lcn as u64 for 32-bit platforms
    - tools: hv: Fix cross-compilation
    - Drivers: hv: vmbus: fix hyperv_cpuhp_online variable shadowing
    - arm64: dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT
    - arm64: dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT
    - arm64: dts: imx8mp-navqp: Correct PAD settings for PMIC_nINT
    - arm64: dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT
    - arm64: dts: imx8mp-edm-g: Correct PAD settings for PMIC_nINT
    - arm64: dts: imx8mp-aristainetos3a-som-v1: Correct PAD settings for
      PMIC_nINT
    - arm64: dts: imx8mp-nitrogen-som: Correct PAD settings for PMIC_nINT
    - arm64: dts: imx8mp-sr-som: Correct PAD settings for PMIC_nINT
    - arm64: dts: imx8mp-ultra-mach-sbc: Correct PAD settings for PMIC_nINT
    - arm64: dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT
    - arm64: dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for
      PMIC_nINT
    - PCMCIA: Fix garbled log messages for KERN_CONT
    - reset: amlogic: t7: Fix null reset ops
    - arm64: dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT
    - arm64: dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT
    - arm64: dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT
    - arm64: dts: marvell: armada-37xx: use 'usb2-phy' in USB3 controller's
      phy-names
    - pwm: stm32: Fix rounding issue for requests with inverted polarity
    - net/sched: act_mirred: fix wrong device for mac_header_xmit check in
      tcf_blockcast_redir
    - macvlan: fix macvlan_get_size() not reserving space for
      IFLA_MACVLAN_BC_CUTOFF
    - net/sched: sch_cake: fix NAT destination port not being updated in
      cake_update_flowkeys
    - nexthop: fix IPv6 route referencing IPv4 nexthop
    - net: airoha: Wait for NPU PPE configuration to complete in
      airoha_ppe_offload_setup()
    - net/sched: taprio: fix use-after-free in advance_sched() on schedule
      switch
    - net: dsa: remove redundant netdev_lock_ops() from conduit ethtool ops
    - net: enetc: correct the command BD ring consumer index
    - net: enetc: fix NTMP DMA use-after-free issue
    - ksmbd: fix use-after-free in smb2_open during durable reconnect
    - tcp: move tp->chrono_type next tp->chrono_stat[]
    - tcp: inline tcp_chrono_start()
    - tcp: annotate data-races in tcp_get_info_chrono_stats()
    - tcp: add data-race annotations around tp->data_segs_out and
      tp->total_retrans
    - tcp: add data-races annotations around tp->reordering, tp->snd_cwnd
    - tcp: annotate data-races around tp->snd_ssthresh
    - tcp: annotate data-races around tp->delivered and tp->delivered_ce
    - tcp: add data-race annotations for TCP_NLA_SNDQ_SIZE
    - tcp: annotate data-races around tp->bytes_sent
    - tcp: annotate data-races around tp->bytes_retrans
    - tcp: annotate data-races around tp->dsack_dups
    - tcp: annotate data-races around tp->reord_seen
    - tcp: annotate data-races around tp->srtt_us
    - tcp: annotate data-races around tp->timeout_rehash
    - tcp: annotate data-races around (tp->write_seq - tp->snd_nxt)
    - tcp: annotate data-races around tp->plb_rehash
    - ice: fix 'adjust' timer programming for E830 devices
    - ice: update PCS latency settings for E825 10G/25Gb modes
    - ice: fix double-free of tx_buf skb
    - ice: fix PHY config on media change with link-down-on-close
    - ice: fix ICE_AQ_LINK_SPEED_M for 200G
    - ice: fix race condition in TX timestamp ring cleanup
    - ice: fix potential NULL pointer deref in error path of
      ice_set_ringparam()
    - i40e: don't advertise IFF_SUPP_NOFCS
    - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2
    - e1000e: Unroll PTP in probe error handling
    - ipv6: fix possible UAF in icmpv6_rcv()
    - af_unix: Drop all SCM attributes for SOCKMAP.
    - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks
    - pppoe: drop PFC frames
    - net/mlx5: Fix HCA caps leak on notifier init failure
    - net: airoha: Fix possible TX queue stall in airoha_qdma_tx_napi_poll()
    - netfilter: nft_osf: restrict it to ipv4
    - netfilter: conntrack: remove sprintf usage
    - netfilter: xtables: restrict several matches to inet family
    - netfilter: nat: use kfree_rcu to release ops
    - ipvs: fix MTU check for GSO packets in tunnel mode
    - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching
    - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check
    - net/sched: sch_dualpi2: drain both C-queue and L-queue in
      dualpi2_change()
    - arm64: dts: amlogic: meson-axg: Add missing cache information to cpu0
    - arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number
    - vfio/pci: Clean up DMABUFs before disabling function
    - pwm: atmel-tcb: Cache clock rates and mark chip as atomic
    - ksmbd: destroy tree_conn_ida in ksmbd_session_destroy()
    - ksmbd: destroy async_ida in ksmbd_conn_free()
    - ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open
    - ksmbd: scope conn->binding slowpath to bound sessions only
    - net: validate skb->napi_id in RX tracepoints
    - bnge: fix initial HWRM sequence
    - bnge: remove unsupported backing store type
    - sctp: fix sockets_allocated imbalance after sk_clone()
    - net/rds: zero per-item info buffer before handing it to visitors
    - ice: fix timestamp interrupt configuration for E825C
    - ice: perform PHY soft reset for E825C ports at initialization
    - ice: fix ready bitmap check for non-E822 devices
    - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g
    - net_sched: sch_hhf: annotate data-races in hhf_dump_stats()
    - net/sched: sch_pie: annotate data-races in pie_dump_stats()
    - net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats()
    - net/sched: sch_red: annotate data-races in red_dump_stats()
    - net/sched: sch_sfb: annotate data-races in sfb_dump_stats()
    - net: airoha: Move ndesc initialization at end of airoha_qdma_init_tx()
    - net: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue()
    - net: dsa: realtek: rtl8365mb: fix mode mask calculation
    - net: airoha: Move ndesc initialization at end of
      airoha_qdma_init_rx_queue()
    - net: airoha: Rework the code flow in airoha_remove() and in
      airoha_probe() error path
    - net: airoha: Add size check for TX NAPIs in airoha_qdma_cleanup()
    - net: mana: Init link_change_work before potential error paths in probe
    - net: mana: Init gf_stats_work before potential error paths in probe
    - net: mana: Guard mana_remove against double invocation
    - net: mana: Don't overwrite port probe error with add_adev result
    - net: mana: Fix EQ leak in mana_remove on NULL port
    - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting
    - virtio_net: sync rss_trailer.max_tx_vq on queue_pairs change via
      VQ_PAIRS_SET
    - nfp: fix swapped arguments in nfp_encode_basic_qdr() calls
    - tcp: send a challenge ACK on SEG.ACK > SND.NXT
    - tipc: fix double-free in tipc_buf_append()
    - vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll()
    - nstree: fix func. parameter kernel-doc warnings
    - eventpoll: use hlist_is_singular_node() in __ep_remove()
    - eventpoll: split __ep_remove()
    - eventpoll: kill __ep_remove()
    - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}()
    - eventpoll: move epi_fget() up
    - fs/adfs: validate nzones in adfs_validate_bblk()
    - rtc: abx80x: Disable alarm feature if no interrupt attached
    - kbuild: builddeb - avoid recompiles for non-cross-compiles
    - tools/power turbostat: Fix AMD RAPL regression on big systems
    - fbdev: offb: fix PCI device reference leak on probe failure
    - tools/power turbostat: Fix unrecognized option '-P'
    - tools/power turbostat: Fix --cpu-set 0 regression on HT systems
    - tools/power turbostat: Fix --cpu-set 1 regression on HT systems
    - kbuild: Never respect CONFIG_WERROR / W=e to fixdep
    - mailbox: mtk-vcp-mailbox: Fix the return value in mtk_vcp_mbox_xlate()
    - mailbox: mtk-cmdq: Fix CURR and END addr for task insert case
    - mailbox: mailbox-test: free channels on probe error
    - sched/psi: fix race between file release and pressure write
    - cgroup/rdma: fix integer overflow in rdmacg_try_charge()
    - cgroup/cpuset: record DL BW alloc CPU for attach rollback
    - mailbox: add sanity check for channel array
    - mailbox: mailbox-test: handle channel errors consistently
    - mailbox: mailbox-test: don't free the reused channel
    - mailbox: mailbox-test: initialize struct earlier
    - mailbox: mailbox-test: make data_ready a per-instance variable
    - fsnotify: fix inode reference leak in fsnotify_recalc_mask()
    - btrfs: fix bytes_may_use leak in move_existing_remap()
    - btrfs: fix bytes_may_use leak in do_remap_reloc_trans()
    - btrfs: don't clobber errors in add_remap_tree_entries()
    - btrfs: fix double-decrement of bytes_may_use in
      submit_one_async_extent()
    - tracing: branch: Fix inverted check on stat tracer registration
    - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers
    - netfilter: nf_tables: use list_del_rcu for netlink hooks
    - rculist: add list_splice_rcu() for private lists
    - netfilter: nf_tables: join hook list via splice_list_rcu() in commit
      phase
    - netfilter: nf_tables: add hook transactions for device deletions
    - nvme-pci: fix missed admin queue sq doorbell write
    - drm/amdgpu: avoid double drm_exec_fini() in userq validate
    - drm/amdgpu/gmc: Fix AMDGPU_GART_PLACEMENT_LOW to not overlap with VRAM
    - drm/amd/pm: fix missing fine-grained dpm table flag on aldebaran
    - drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG
    - drm/amdgpu/uvd3.1: Don't validate the firmware when already validated
    - drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2)
    - drm/amdgpu: Only send RMA CPER when threshold is exceeded
    - netfilter: xt_policy: fix strict mode inbound policy matching
    - netfilter: nf_conntrack_sip: don't use simple_strtoul
    - spi: rzv2h-rspi: Fix silent failure in clock setup error path
    - ASoC: amd: acp: Add DMI quirk for Valve Steam Deck OLED
    - ASoC: SOF: Intel: add an empty adr_link
    - spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ
    - ASoC: tas2764: Mark die temp register as volatile
    - ASoC: tas2770: Fix order of operations for temperature calculation
    - drm/sysfb: ofdrm: fix PCI device reference leaks
    - drm/color-mgmt: Typo s/R332/RGB332/
    - arm64/scs: Fix potential sign extension issue of advance_loc4
    - spi: spi-mem: Add a packed command operation
    - mtd: spinand: Add support for packed read data ODTR commands
    - mtd: spinand: winbond: Set the packed page read flag to W35N02/04JW
    - mtd: spinand: winbond: Fix ODTR write VCR on W35NxxJW
    - ACPICA: Provide #defines for EINJV2 error types
    - ACPI: APEI: EINJ: Fix EINJV2 memory error injection
    - cdrom, scsi: sr: propagate read-only status to block layer via
      set_disk_ro()
    - spi: axiado: replace usleep_range() with udelay() in IRQ path
    - netdevsim: zero initialize struct iphdr in dummy sk_buff
    - net/sched: netem: fix probability gaps in 4-state loss model
    - net/sched: netem: fix queue limit check to include reordered packets
    - net/sched: netem: only reseed PRNG when seed is explicitly provided
    - net/sched: netem: validate slot configuration
    - net/sched: netem: fix slot delay calculation overflow
    - net/sched: netem: check for negative latency and jitter
    - net: airoha: fix BQL imbalance in TX path
    - net: airoha: stop net_device TX queue before updating CPU index
    - net: airoha: fix typo in function name
    - net: airoha: Do not wake all netdev TX queues in
      airoha_qdma_wake_netdev_txqs()
    - net: airoha: Do not read uninitialized fragment address in
      airoha_dev_xmit()
    - net/sched: sch_choke: annotate data-races in choke_dump_stats()
    - net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats()
    - vrf: Fix a potential NPD when removing a port from a VRF
    - net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()
    - net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit
    - spi: amlogic-spisg: initialize completion before requesting IRQ
    - NFC: trf7970a: Ignore antenna noise when checking for RF field
    - net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind
    - neigh: let neigh_xmit take skb ownership
    - tcp: make probe0 timer handle expired user timeout
    - netpoll: fix IPv6 local-address corruption
    - ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams
    - sched/fair: Fix wakeup_preempt_fair() vs delayed dequeue
    - sched/fair: Clear rel_deadline when initializing forked entities
    - net: mctp i2c: check length before marking flow active
    - md/raid1,raid10: don't fail devices for invalid IO errors
    - md: add fallback to correct bitmap_ops on version mismatch
    - md: factor bitmap creation away from sysfs handling
    - md/md-bitmap: split bitmap sysfs groups
    - md/md-bitmap: add a none backend for bitmap grow
    - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access()
    - net: phy: dp83869: fix setting CLK_O_SEL field.
    - drm/amd/display: properly handle family setting for early GC 11.5.4
    - drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings
    - drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings
    - drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings
    - drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring
    - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring
    - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.5 enc ring
    - drm/amdgpu/vcn: set no_user_fence for VCN v5.0.0 enc ring
    - drm/amdgpu/vcn: set no_user_fence for VCN v5.0.1 enc ring
    - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring
    - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring
    - drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring
    - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring
    - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring
    - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.5 ring
    - drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.0 ring
    - drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.1 ring
    - drm/amdgpu/jpeg: set no_user_fence for JPEG v5.3.0 ring
    - drm/amd/pm: Add fine grained flag to SMU v13.0.6
    - io_uring/napi: cap busy_poll_to 10 msec
    - ASoC: cs35l56: Fix illegal writes to OTP_MEM registers
    - net: psp: check for device unregister when creating assoc
    - net: psp: require admin permission for dev-set and key-rotate
    - ASoC: codecs: ab8500: Fix casting of private data
    - netfilter: skip recording stale or retransmitted INIT
    - sctp: discard stale INIT after handshake completion
    - net/sched: sch_cake: annotate data-races in cake_dump_stats() (I)
    - net/sched: sch_cake: annotate data-races in cake_dump_stats() (II)
    - net/sched: sch_cake: annotate data-races in cake_dump_stats() (III)
    - net/sched: sch_cake: annotate data-races in cake_dump_stats() (IV)
    - net/sched: sch_cake: annotate data-races in cake_dump_stats() (V)
    - netconsole: return count instead of strnlen(buf, count) from store
      callbacks
    - netconsole: avoid clobbering userdatum value on truncated write
    - netconsole: propagate device name truncation in dev_name_store()
    - netconsole: restore userdatum value on update_userdata() failure
    - ALSA: hda/conexant: Fix missing error check for jack detection
    - ALSA: hda: cs35l56: Fix uninitialized value in cs35l56_hda_read_acpi()
    - ALSA: hda/tas2781: Fix incorrect bit update for non-book-zero or book 0
      pages >1
    - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup
    - drm/amd/display: Allow embedded connectors without DDC
    - drm/amd/display: Allow DCE link encoder without AUX registers
    - drm/amd/display: Allow constructing DCE6 link encoder without DDC
    - drm/amd/display: Allow constructing DCE8 link encoder without DDC
    - drm/amd/display: Read EDID from VBIOS embedded panel info
    - drm/amd/display: Use EDID from VBIOS embedded panel info
    - drm/xe: Use XE_WEDGED_MODE_UPON_ANY_HANG_NO_RESET enum instead of magic
      number
    - drm/xe: Drop registration of guc_submit_wedged_fini from
      xe_guc_submit_wedge()
    - drm/xe/debugfs: Correct printing of register whitelist ranges
    - drm/xe: Fix potential NULL deref in
      xe_exec_queue_tlb_inval_last_fence_put_unlocked
    - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()
    - drm/xe/eustall: Fix drm_dev_put called before stream disable in close
    - drm/xe/gsc: Fix BO leak on error in query_compatibility_version()
    - drm/xe/xelp: Fix Wa_18022495364
    - net: airoha: Do not return err in ndo_stop() callback
    - bonding: print churn state via netlink
    - bonding: 3ad: implement proper RCU rules for port->aggregator
    - page_pool: fix memory-provider leak in page_pool_create_percpu() error
      path
    - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING
    - iavf: stop removing VLAN filters from PF on interface down
    - iavf: wait for PF confirmation before removing VLAN filters
    - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler
    - ice: fix NULL pointer dereference in ice_reset_all_vfs()
    - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw
    - ice: fix missing SMA pin initialization in DPLL subsystem
    - ice: fix SMA and U.FL pin state changes affecting paired pin
    - ice: fix missing dpll notifications for SW pins
    - dpll: export __dpll_pin_change_ntf() for use under dpll_lock
    - ice: add dpll peer notification for paired SMA and U.FL pins
    - net: tls: fix strparser anchor skb leak on offload RX setup failure
    - sfc: fix error code in efx_devlink_info_running_versions()
    - net/sched: cls_flower: revert unintended changes
    - kselftest/arm64: Include <asm/ptrace.h> for user_gcs definition
    - arm64: Reserve an extra page for early kernel mapping
    - futex: Drop CLONE_THREAD requirement for private default hash alloc
    - PCI: Initialize temporary device in new_id_store()
    - workqueue: fix devm_alloc_workqueue() va_list misuse
    - net/sched: sch_pie: annotate more data-races in pie_dump_stats()
    - sched/fair: Fix wakeup_preempt_fair() for not waking up task
    - crypto: af_alg - Cap AEAD AD length to 0x80000000
    - i40e: Cleanup PTP pins on probe failure
    - workqueue: Fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path
    - net: ena: PHC: Fix potential use-after-free in get_timestamp
    - cgroup/cpuset: Reset DL migration state on can_attach() failure
    - netfilter: nf_conntrack_sip: get helper before allocating expectation
    - audit: fix incorrect inheritable capability in CAPSET records
    - net: ena: PHC: Check return code before setting timestamp output
    - cgroup/dmem: Return -ENOMEM on failed pool preallocation
    - idpf: fix double free and use-after-free in aux device error paths
    - cgroup/cpuset: Reserve DL bandwidth only for root-domain moves
    - Revert "ACPI: CPPC: Adjust debug messages in amd_set_max_freq_ratio() to
      warn"
    - netfilter: nft_ct: fix missing expect put in obj eval
    - net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled
    - audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV
    - cgroup/cpuset: Return only actually allocated CPUs during partition
      invalidation
    - KVM: x86: Swap the dst and src operand for MOVNTDQA
    - KVM: Reject wrapped offset in kvm_reset_dirty_gfn()
    - KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer
      arithmetic
    - KVM: x86: Fix Xen hypercall tracepoint argument assignment
    - HID: pass the buffer size to hid_report_raw_event
    - HID: core: introduce hid_safe_input_report()
    - rseq: Revert to historical performance killing behaviour
    - rseq: Implement read only ABI enforcement for optimized RSEQ V2 mode
    - rseq: Reenable performance optimizations conditionally
    - HID: core: Fix size_t specifier in hid_report_raw_event()
    - ata: libata-scsi: fix requeue of deferred ATA PASS-THROUGH commands
    - media: staging: imx: configure src_mux in csi_start
    - Bluetooth: btmtk: accept too short WMT FUNC_CTRL events
    - nvme-apple: Reset q->sq_tail during queue init
    - smb/client: fix possible infinite loop and oob read in symlink_data()
    - drm/loongson: Use managed KMS polling
    - drm: Replace old pointer to new idr
    - drm/bridge: imx8qxp-pxl2dpi: avoid ERR_PTR with device_node cleanup
    - drm/i915/dp: Fix VSC dynamic range signaling for RGB formats
    - drm/amd/display: Wrap DCN32 phantom-plane allocation in
      DC_RUN_WITH_PREEMPTION_ENABLED
    - drm/ttm: Fix ttm_bo_swapout() infinite LRU walk on swapout failure
    - platform/x86: intel: Move debugfs register before creating devices
    - platform/x86: lenovo-wmi-helpers: Move gamezone enums to wmi-helpers
    - platform/x86: lenovo-wmi-helpers: Fix memory leak in
      lwmi_dev_evaluate_int()
    - platform/x86: lenovo-wmi-other: Balance IDA id allocation and free
    - platform/x86: lenovo-wmi-other: Balance component bind and unbind
    - platform/x86: lenovo-wmi-other: Zero initialize WMI arguments
    - platform/x86: lenovo-wmi-other: Fix tunable_attr_01 struct members
    - platform/x86: lenovo-wmi-other: Add Attribute ID helper functions
    - platform/x86: lenovo-wmi-other: Limit adding attributes to supported
      devices
    - accel/rocket: Fix prep_bo ioctl leaking positive return from
      dma_resv_wait_timeout()
    - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion Laptop 16-ag0xxx
    - ALSA: hda/realtek: Add quirk for Samsung Galaxy Book5 360 headphone
    - ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans
    - ALSA: usb-audio: Bound MIDI endpoint descriptor scans
    - ALSA: usb-audio: qcom: Check offload mapping failures
    - btrfs: only release the dirty pages io tree after successful writes
    - ceph: fix a buffer leak in __ceph_setxattr()
    - ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size
    - ceph: put folios not suitable for writeback
    - io-wq: check that the predecessor is hashed in io_wq_remove_pending()
    - iommu/amd: Bounds-check devid in __rlookup_amd_iommu()
    - x86/kexec: Push kjump return address even for non-kjump kexec
    - xfs: fix memory leak on error in xfs_alloc_zone_info()
    - virt: sev-guest: Do not use host-controlled page order in cleanup path
    - powerpc/warp: Fix error handling in pika_dtm_thread
    - netfs: fix error handling in netfs_extract_user_iter()
    - nfsd: fix GET_DIR_DELEGATION when VFS leases are disabled
    - nfsd: fix file change detection in CB_GETATTR
    - nfsd: update mtime/ctime on CLONE in presense of delegated attributes
    - nfsd: update mtime/ctime on COPY in presence of delegated attributes
    - irqchip/riscv-imsic: Clear interrupt move state during CPU offlining
    - irqchip/meson-gpio: Use the correct register in
      meson_s4_gpio_irq_set_type()
    - irqchip/gic-v5: Move LPI allocation into the LPI domain
    - irqchip/gic-v5: Support range allocation for LPIs
    - irqchip/gic-v5: Allocate ITS parent LPIs as a range
    - libceph: Fix potential out-of-bounds access in osdmap_decode()
    - libceph: Fix potential null-ptr-deref in decode_choose_args()
    - libceph: Fix potential out-of-bounds access in __ceph_x_decrypt()
    - libceph: Fix potential out-of-bounds access in crush_decode()
    - libceph: handle rbtree insertion error in decode_choose_args()
    - iommu/vt-d: Disable DMAR for Intel Q35 IGFX
    - iommu/vt-d: Fix oops due to out of scope access
    - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption
    - iommu: Fix NULL group->domain dereference in pci_dev_reset_iommu_done()
    - iommu: Replace per-group resetting_domain with per-gdev blocked flag
    - iommu: Fix WARN_ON in __iommu_group_set_domain_nofail() due to reset
    - iommu: Fix pasid attach in pci_dev_reset_iommu_prepare/done()
    - iommu: Fix nested pci_dev_reset_iommu_prepare/done()
    - iommu: Fix ATS invalidation timeouts during __iommu_remove_group_pasid()
    - drm/i915: skip __i915_request_skip() for already signaled requests
    - drm/panfrost: Fix wait_bo ioctl leaking positive return from
      dma_resv_wait_timeout()
    - drm/xe/dma-buf: handle empty bo and UAF races
    - drm/xe/dma-buf: fix UAF with retry loop
    - drm/ttm: Fix ttm_bo_shrink() infinite LRU walk on backup failure
    - drm/ttm: Convert -EAGAIN from dmem_cgroup_try_charge to -ENOSPC
    - drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup
    - drm/gma500/oaktrail_lvds: fix hang on init failure
    - drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init
    - arm_mpam: Fix monitor instance selection when checking for hardware NRDY
    - arm_mpam: Pretend that NRDY is always hardware managed
    - arm_mpam: Improve check for whether or not NRDY is hardware managed
    - arm_mpam: Fix false positive assert failure during mpam_disable()
    - arm_mpam: Check whether the config array is allocated before destroying
      it
    - eventfs: Simplify code using guard()s
    - eventfs: Use list_add_tail_rcu() for SRCU-protected children list
    - smb: client: Use FullSessionKey for AES-256 encryption key derivation
    - spi: sifive: Simplify clock handling with devm_clk_get_enabled()
    - spi: sifive: fix controller deregistration
    - tracefs: Removed unused 'ret' variable in eventfs_iterate()
    - workqueue: Annotate alloc_workqueue_va() with __printf(1, 0)
    - selftests/bpf: Remove test_access_variable_array
    - netfs: Fix potential uninitialised var in netfs_extract_user_iter()
    - Linux 7.0.10
  * Resolute update: v7.0.10 upstream stable release (LP: #2156385) //
    CVE-2026-45846
    - bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst()
  * Resolute update: v7.0.10 upstream stable release (LP: #2156385) //
    CVE-2026-45845
    - net/sched: taprio: fix NULL pointer dereference in class dump
  * Resolute update: v7.0.10 upstream stable release (LP: #2156385) //
    CVE-2026-45844
    - netfilter: arp_tables: fix IEEE1394 ARP payload parsing
  * Resolute update: v7.0.10 upstream stable release (LP: #2156385) //
    CVE-2026-46242
    - eventpoll: fix ep_remove struct eventpoll / struct file UAF
  * Resolute update: v7.0.10 upstream stable release (LP: #2156385) //
    CVE-2026-45843
    - slip: bound decode() reads against the compressed packet length
  * Resolute update: v7.0.10 upstream stable release (LP: #2156385) //
    CVE-2026-45842
    - slip: reject VJ receive packets on instances with no rstate array
  * Resolute update: v7.0.10 upstream stable release (LP: #2156385) //
    CVE-2026-45841
    - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO
  * Resolute update: v7.0.10 upstream stable release (LP: #2156385) //
    CVE-2026-45840
    - openvswitch: cap upcall PID array size and pre-size vport replies
  * Resolute update: v7.0.10 upstream stable release (LP: #2156385) //
    CVE-2026-45839
    - bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec()
  * Resolute update: v7.0.10 upstream stable release (LP: #2156385) //
    CVE-2026-45838
    - bpf: fix end-of-list detection in cgroup_storage_get_next_key()
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006)
    - Linux 7.0.8
    - HID: pidff: Fix integer overflow in pidff_rescale
    - media: uvcvideo: Enable VB2_DMABUF for metadata stream
    - drm/msm/hdmi: Fix wrong CTRL1 register used in writing info frames
    - media: rzv2h-ivc: Avoid double job scheduling
    - media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0
    - media: rzv2h-ivc: Write AXIRX_PIXFMT once
    - media: rzv2h-ivc: Fix FM_STOP register write
    - media: rzv2h-ivc: Fix concurrent buffer list access
    - media: mali-c55: Initialize the ISP in enable_streams()
    - media: mali-c55: Fix Iridix bypass macros
    - media: renesas: vsp1: Fix NULL pointer deref on module unload
    - media: renesas: vin: Fix RAW8 (again)
    - media: i2c: ov8856: free control handler on error in
      ov8856_init_controls()
    - media: dt-bindings: rockchip,vdec: Add alternative reg-names order for
      RK35{76,88}
    - media: dt-bindings: rockchip,vdec: Mark reg-names required for
      RK35{76,88}
    - media: chips-media: wave5: fix a potential memory leak in
      wave5_vdi_init()
    - media: chips-media: wave5: add missing spinlock protection for
      send_eos_event()
    - media: chips-media: wave5: add missing spinlock protection for
      handle_dynamic_resolution_change()
    - arm64: dts: freescale: imx95-toradex-smarc: fix PMIC_SD2_VSEL label
      position
    - drm/gpusvm: Allow device pages to be mapped in mixed mappings after
      system pages
    - drm/gpusvm: Force unmapping on error in drm_gpusvm_get_pages
    - spi: bcm63xx: fix controller deregistration
    - spi: atmel: fix controller deregistration
    - arm64: dts: lx2160a-cex7/lx2162a-sr-som: fix usd-cd & gpio pinmux
    - regulator: mt6357: fix OF node reference imbalance
    - spi: st-ssc4: fix controller deregistration
    - regulator: max77650: fix OF node reference imbalance
    - media: ti: vpe: Add missing v4l2_device_unregister in vip_remove()
    - media: rc: streamzap: Error handling in probe
    - media: i2c: imx283: Enter full standby when stopping streaming
    - regulator: bq257xx: fix OF node reference imbalance
    - regulator: rk808: fix OF node reference imbalance
    - media: videobuf2: Set vma_flags in vb2_dma_sg_mmap
    - media: mali-c55: Fully reset the ISP configuration
    - media: intel/ipu6: fix error pointer dereference
    - media: i2c: imx283: Fix hang when going from large to small resolution
    - regulator: act8945a: fix OF node reference imbalance
    - regulator: s2dos05: fix OF node reference imbalance
    - regulator: bd9571mwv: fix OF node reference imbalance
    - spi: lantiq-ssc: fix controller deregistration
    - spi: meson-spicc: fix controller deregistration
    - spi: qup: fix controller deregistration
    - arm64: dts: ti: k3-am69-aquila-clover: Fix DP regulator enable GPIO
    - spi: at91-usart: fix controller deregistration
    - media: ipu-bridge: Add upside-down sensor DMI quirk for Dell XPS 13 9340
      and XPS 14 9440
    - spi: amlogic-spisg: fix controller deregistration
    - spi: aspeed-smc: fix controller deregistration
    - drm/colorop: Preserve bypass value in duplicate_state()
    - drm/atomic: Add affected colorops with affected planes
    - platform/x86: hp-wmi: Ignore backlight and FnLock events
    - vsock/virtio: fix MSG_PEEK ignoring skb offset when calculating bytes to
      copy
    - arm64: dts: broadcom: bcm2712-d-rpi-5-b: add fixes for
      pinctrl/pinctrl_aon
    - arm64: dts: broadcom: bcm2712-d-rpi-5-b: update uart10 interrupt
    - media: pci: zoran: fix potential memory leak in zoran_probe()
    - media: dib8000: avoid division by 0 in dib8000_set_dds()
    - media: i2c: imx412: Assert reset GPIO during probe
    - media: staging: imx: request mbus_config in csi_start
    - media: i2c: ov08d10: fix image vertical start setting
    - media: i2c: ov08d10: fix runtime PM handling in probe
    - media: omap3isp: drop the use count of v4l2 pipeline
    - media: iris: fix QCOM_MDT_LOADER dependency
    - media: qcom: camss: Fix csid clock configuration for sa8775p
    - media: qcom: camss: Fix csid IRQ offset for sa8775p
    - media: qcom: iris: increase H265D_MAX_SLICE to fix H.265 decoding on
      SC7280
    - media: venus: fix QCOM_MDT_LOADER dependency
    - media: iris: Fix dma_free_attrs() size in iris_hfi_queues_init()
    - media: iris: switch to hardware mode after firmware boot
    - media: qcom: camss: Add missing clocks for VFE lite on sa8775p
    - spi: mxs: fix controller deregistration
    - spi: mt65xx: fix controller deregistration
    - spi: dln2: fix controller deregistration
    - spi: s3c64xx: fix controller deregistration
    - spi: fsl-espi: fix controller deregistration
    - spi: omap2-mcspi: fix controller deregistration
    - spi: pic32: fix controller deregistration
    - spi: ep93xx: fix controller deregistration
    - spi: mtk-nor: fix controller deregistration
    - spi: pl022: fix controller deregistration
    - spi: sh-hspi: fix controller deregistration
    - spi: bcmbca-hsspi: fix controller deregistration
    - spi: coldfire-qspi: fix controller deregistration
    - spi: npcm-pspi: fix controller deregistration
    - spi: cavium-thunderx: fix controller deregistration
    - spi: pic32-sqi: fix controller deregistration
    - spi: sprd: fix controller deregistration
    - spi: sh-msiof: fix controller deregistration
    - spi: slave-mt27xx: fix controller deregistration
    - spi: img-spfi: fix controller deregistration
    - spi: mpfs: fix controller deregistration
    - spi: octeon: fix controller deregistration
    - spi: imx: fix runtime pm leak on probe deferral
    - spi: mxic: fix controller deregistration
    - spi: orion: fix controller deregistration
    - spi: orion: fix runtime pm leak on unbind
    - spi: orion: fix clock imbalance on registration failure
    - spi: cadence: fix controller deregistration
    - spi: cadence-quadspi: fix controller deregistration
    - spi: cadence: fix unclocked access on unbind
    - spi: cadence: fix clock imbalance on probe failure
    - spi: cadence-quadspi: fix runtime pm disable imbalance on probe failure
    - spi: cadence-quadspi: fix clock imbalance on probe failure
    - spi: cadence-quadspi: fix runtime pm and clock imbalance on unbind
    - drm/colorop: Fix blob property reference tracking in state lifecycle
    - drm/imx: parallel-display: Prefer bus format set via legacy "interface-
      pix-fmt" DT property
    - drm/msm: always recover the gpu
    - drm/v3d: Reject empty multisync extension to prevent infinite loop
    - drm/i915/psr: Init variable to avoid early exit from et alignment loop
    - drm/amd/display: fix math_mod() using arg1 instead of arg2
    - drm/amd: Add missing firmware declaration for PSP v15.0.0
    - drm/amdgpu: Use NBIF offset for register RCC_STRAP0_RCC_DEV0_EPF0_STRAP0
      .
    - drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count.
    - drm/amdgpu: gate VM CPU HDP flush on reset lock
    - drm/amd/pm: fix incorrect FeatureCtrlMask setting on smu v14.0.x
    - drm/amdkfd: Add upper bound check for num_of_nodes
    - drm/amdgpu/vce: Prevent partial address patches
    - drm/amd/display: Change dither policy for 10 bpc output back to
      dithering
    - drm/appletbdrm: Use kvzalloc for big allocations
    - drm/amdgpu: Avoid reset in AMDGPU unload path for APUs with GFX V11 and
      higher.
    - drm/udl: Increase GET_URB_TIMEOUT
    - drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked()
    - drm/xe/bo: Fix bo leak on unaligned size validation in
      xe_bo_init_locked()
    - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise
    - drm/radeon: add missing revision check for CI
    - drm/amdgpu: zero-initialize GART table on allocation
    - drm/exynos: remove bridge when component_add fails
    - drm/amdgpu/userq: fix access to stale wptr mapping
    - drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds
    - drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ
    - drm/bridge: tda998x: Use __be32 for audio port OF property pointer
    - drm/sti: remove bridge when sti_hda component_add fails
    - drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds
    - drm/amdkfd: Make all TLB-flushes heavy-weight
    - drm/amdgpu/pm: add missing revision check for CI
    - drm/amdgpu/pm: align Hawaii mclk workaround with radeon
    - arm64: dts: qcom: kodiak: Fix PCIe1 PHY ref clock voting
    - arm64: dts: qcom: lemans: Correct QUP interrupt numbers
    - arm64: dts: ti: k3-am62a7-sk: Fix pin name in comment from M19 to N22
    - arm64: dts: ti: k3-am69-aquila-dev: Fix DP regulator enable GPIO
    - batman-adv: tp_meter: fix tp_num leak on kmalloc failure
    - sched_ext: Use HK_TYPE_DOMAIN_BOOT to detect isolcpus= domain isolation
    - usb: typec: tcpm: reset internal port states on soft reset AMS
    - io_uring/zcrx: use guards for locking
    - io_uring/zcrx: warn on freelist violations
    - kho: fix error handling in kho_add_subtree()
    - EDAC/versalnet: Refactor memory controller initialization and cleanup
    - spi: uniphier: Simplify clock handling with devm_clk_get_enabled()
    - spi: uniphier: fix controller deregistration
    - cgroup: Increment nr_dying_subsys_* from rmdir context
    - sched_ext: Skip tasks with stale task_rq in bypass_lb_cpu()
    - perf build: fix "argument list too long" in second location
    - mm/vma: do not try to unmap a VMA if mmap_prepare() invoked from mmap()
    - vsock/virtio: fix length and offset in tap skb for split packets
    - drm/amdgpu/vcn3: Avoid overflow on msg bound check
    - drm/amdgpu/vcn4: Avoid overflow on msg bound check
    - Linux 7.0.9
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46214
    - vsock/virtio: fix accept queue count leak on transport mismatch
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46207
    - vsock/virtio: fix empty payload in tap skb for non-linear buffers
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46234
    - vsock: fix buffer size clamping order
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46223
    - cgroup: Defer css percpu_ref kill on rmdir until cgroup is depopulated
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46221
    - EDAC/versalnet: Fix device name memory leak
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46231
    - batman-adv: bla: put backbone reference on failed claim hash insert
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46233
    - batman-adv: bla: only purge non-released claims
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46212
    - batman-adv: bla: prevent use-after-free when deleting claims
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46238
    - batman-adv: stop caching unowned originator pointers in BAT IV
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46208
    - batman-adv: stop tp_meter sessions during mesh teardown
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46206
    - batman-adv: reject new tp_meter sessions during teardown
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46198
    - batman-adv: fix integer overflow on buff_pos
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46227
    - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in
      SCTP_SENDALL
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46220
    - drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46215
    - drm: Set old handle to NULL before prime swap in change_handle
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46201
    - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import()
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46224
    - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46197
    - drm/amdkfd: validate SVM ioctl nattr against buffer size
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46209
    - drm/gem: Fix inconsistent plane dimension calculation in
      drm_gem_fb_init_with_funcs()
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46230
    - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46199
    - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46204
    - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46218
    - drm/amdgpu: Add bounds checking to ib_{get,set}_value
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46229
    - drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46211
    - drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata()
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46203
    - spi: cadence-quadspi: fix unclocked access on unbind
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46219
    - spi: mpc52xx: fix use-after-free on unbind
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46200
    - spi: mpc52xx: fix controller deregistration
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46241
    - spi: mpc52xx: fix use-after-free on registration failure
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46225
    - spi: rspi: fix controller deregistration
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46226
    - spi: fsl: fix controller deregistration
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46228
    - spi: ch341: fix devres lifetime
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46216
    - drm/xe/hdcp: Add NULL check for media_gt in
      intel_hdcp_gsc_check_status()
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46210
    - media: iris: fix use-after-free of fmt_src during MBPF check
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46240
    - media: iris: Fix use-after-free in iris_release_internal_buffers()
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46235
    - media: saa7164: add ioremap return checks and cleanups
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46222
    - media: rockchip: rkcif: Add missing MUST_CONNECT flag to pads
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46239
    - media: i2c: ov5647: Fix runtime PM refcount leak in s_ctrl
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46236
    - media: rc: xbox_remote: heed DMA restrictions
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46205
    - staging: media: atomisp: Disallow all private IOCTLs
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46202
    - HID: appletb-kbd: run inactivity autodim from workqueues
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46213
    - HID: appletb-kbd: fix UAF in inactivity-timer cleanup path
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46232
    - HID: playstation: Clamp num_touch_reports
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988)
    - ACPI: arm64: cpuidle: Tolerate platforms with no deep PSCI idle states
    - ACPI: scan: Use acpi_dev_put() in object add error paths
    - ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO
    - ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug
    - ACPI: video: force native backlight on HP OMEN 16 (8A44)
    - iommufd: Fix a race with concurrent allocation and unmap
    - wifi: mt76: mt7925: fix incorrect TLV length in CLC command
    - spi: rockchip: fix controller deregistration
    - ksmbd: rewrite stop_sessions() with restartable iteration
    - flow_dissector: do not dissect PPPoE PFC frames
    - smb: client/smbdirect: fix MR registration for coalesced SG lists
    - wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr
    - wifi: mt76: mt7925: fix incorrect length field in txpower command
    - wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work
    - wifi: ath5k: do not access array OOB
    - ALSA: usb-audio: midi2: Restart output URBs on resume
    - ALSA: usb-audio: Fix UAC3 cluster descriptor size check
    - usb: dwc3: Move GUID programming after PHY initialization
    - USB: omap_udc: DMA: Don't enable burst 4 mode
    - USB: serial: option: add Telit Cinterion LE910Cx compositions
    - usb: typec: tcpm: fix debug accessory mode detection for sink ports
    - ALSA: hda: cs35l56: Propagate ASP TX source control errors
    - ALSA: hda/realtek: Fix speaker silence after S3 resume on Xiaomi Mi
      Laptop Pro 15
    - ALSA: firewire-tascam: Do not drop unread control events
    - ALSA: core: Serialize deferred fasync state checks
    - ALSA: seq: Fix UMP group 16 filtering
    - powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o
    - x86/efi: Restore IRQ state in EFI page fault handler
    - xfrm: provide message size for XFRM_MSG_MAPPING
    - selinux: fix avdcache auditing
    - selinux: don't reserve xattr slot when we won't fill it
    - selinux: shrink critical section in sel_write_load()
    - selinux: prune /sys/fs/selinux/checkreqprot
    - selinux: prune /sys/fs/selinux/disable
    - selinux: prune /sys/fs/selinux/user
    - selinux: allow multiple opens of /sys/fs/selinux/policy
    - io_uring/kbuf: support min length left for incremental buffers
    - io_uring/tw: serialize ctx->retry_llist with ->uring_lock
    - LoongArch: KVM: Fix missing EMULATE_FAIL in kvm_emu_mmio_read()
    - rust: drm: gem: clean up GEM state in init failure case
    - rust: allow `clippy::collapsible_match` globally
    - rust: allow `clippy::collapsible_if` globally
    - rust: pin-init: internal: move alignment check to `make_field_check`
    - spi: syncuacer: fix controller deregistration
    - spi: sun4i: fix controller deregistration
    - spi: zynq-qspi: fix controller deregistration
    - spi: ti-qspi: fix controller deregistration
    - spi: sun6i: fix controller deregistration
    - spi: tegra114: fix controller deregistration
    - spi: zynqmp-gqspi: fix controller deregistration
    - spi: tegra20-sflash: fix controller deregistration
    - spi: s3c64xx: fix NULL-deref on driver unbind
    - staging: rtl8723bs: os_dep: avoid NULL pointer dereference in
      rtw_cbuf_alloc
    - staging: vme_user: fix root device leak on init failure
    - KVM: arm64: Fix kvm_vcpu_initialized() macro parameter
    - arm64: signal: Preserve POR_EL0 if poe_context is missing
    - mm/hugetlb_cma: round up per_node before logging it
    - LoongArch: Fix SYM_SIGFUNC_START definition for 32BIT
    - LoongArch: KVM: Compile switch.S directly into the kernel
    - mptcp: pm: ADD_ADDR rtx: skip inactive subflows
    - perf/x86/intel: Improve validation and configuration of ACR masks
    - selftests/rseq: Don't run tests with runner scripts outside of the
      scripts
    - rseq: Set rseq::cpu_id_start to 0 on unregistration
    - rseq: Protect rseq_reset() against interrupts
    - rseq: Don't advertise time slice extensions if disabled
    - selftests/rseq: Make registration flexible for legacy and optimized mode
    - selftests/rseq: Skip tests if time slice extensions are not available
    - selftests/rseq: Validate legacy behavior
    - selftests/rseq: Expand for optimized RSEQ ABI v2
    - pseries/papr-hvpipe: Fix race with interrupt handler
    - pseries/papr-hvpipe: Fix & simplify error handling in papr_hvpipe_init()
    - pseries/papr-hvpipe: Fix the usage of copy_to_user()
    - net: libwx: use request_irq for VF misc interrupt
    - netpoll: pass buffer size to egress_dev() to avoid MAC truncation
    - ovl: fix verity lazy-load guard broken by fsverity_active() semantic
      change
    - parisc: Fix IRQ leak in LASI driver
    - x86/efi: Fix graceful fault handling after FPU softirq changes
    - hwmon: (ltc2992) Clamp threshold writes to hardware range
    - hwmon: (ltc2992) Fix u32 overflow in power read path
    - clk: rk808: fix OF node reference imbalance
    - hwmon: (corsair-psu) Close HID device on probe errors
    - af_unix: Reject SIOCATMARK on non-stream sockets
    - arm64/fpsimd: ptrace: zero target's fpsimd_state, not the tracer's
    - pmdomain: mediatek: fix use-after-free in
      scpsys_get_bus_protection_legacy()
    - block: fix zone write plug removal
    - block: only read from sqe on initial invocation of blkdev_uring_cmd()
    - cifs: abort open_cached_dir if we don't request leases
    - cifs: change_conf needs to be called for session setup
    - extcon: ptn5150: handle pending IRQ events during system resume
    - gpio: of: clear OF_POPULATED on hog nodes in remove path
    - hv: Select CONFIG_SYSFB only for CONFIG_HYPERV_VMBUS
    - hv_sock: fix ARM64 support
    - hv_sock: Report EOF instead of -EIO for FIN
    - hv_sock: Return -EIO for malformed/short packets
    - spi: microchip-core-qspi: fix controller deregistration
    - spi: microchip-core-spi: fix controller deregistration
    - tracefs: Fix default permissions not being applied on initial mount
    - udf: reject descriptors with oversized CRC length
    - x86/boot/e820: Re-enable BIOS fallback if e820 table is empty
    - thermal: core: Free thermal zone ID later during removal
    - thermal/drivers/sprd: Fix temperature clamping in
      sprd_thm_temp_to_rawdata
    - thermal/drivers/sprd: Fix raw temperature clamping in
      sprd_thm_rawdata_to_temp
    - spi: topcliff-pch: fix controller deregistration
    - spi: topcliff-pch: fix use-after-free on unbind
    - tracing/fprobe: Avoid kcalloc() in rcu_read_lock section
    - tracing/fprobe: Remove fprobe from hash in failure path
    - tracing/fprobe: Unregister fprobe even if memory allocation fails
    - tracing/probes: Limit size of event probe to 3K
    - tracing/fprobe: Check the same type fprobe on table as the unregistered
      one
    - clk: imx: imx8-acm: fix flags for acm clocks
    - clk: microchip: mpfs-ccc: fix out of bounds access during output
      registration
    - cpuidle: powerpc: avoid double clear when breaking snooze
    - ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk
      table
    - ASoC: ES8389: convert to devm_clk_get_optional() to get clock
    - ASoC: fsl_easrc: fix comment typo
    - ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error
    - ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop
    - ASoC: qcom: q6apm: remove child devices when apm is removed
    - btrfs: do not mark inode incompressible after inline attempt fails
    - dm: don't report warning when doing deferred remove
    - dm: fix a buffer overflow in ioctl processing
    - dm-verity-fec: correctly reject too-small FEC devices
    - dm-verity-fec: correctly reject too-small hash devices
    - dm-verity-fec: fix corrected block count stat
    - dm-verity-fec: fix the size of dm_verity_fec_io::erasures
    - isofs: validate Rock Ridge CE continuation extent against volume size
    - iommufd: Fix return value of iommufd_fault_fops_write()
    - iommu/vt-d: Block PASID attachment to nested domain with dirty tracking
    - iommu/arm-smmu-v3: Add a missing dma_wmb() for hitless STE update
    - lib/crc: tests: Make crc_kunit test only the enabled CRC variants
    - lib/scatterlist: fix temp buffer in extract_user_to_sg()
    - nvme-apple: drop invalid put of admin queue reference count
    - nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free
    - pmdomain: core: Fix detach procedure for virtual devices in genpd
    - psp: strip variable-length PSP header in psp_dev_rcv()
    - s390/debug: Reject zero-length input in debug_input_flush_fn()
    - s390/debug: Reject zero-length input before trimming a newline
    - KVM: x86: Do IRR scan in __kvm_apic_update_irr even if PIR is empty
    - mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values
    - mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values
    - mm/damon/stat: detect and use fresh enabled value
    - PCI: Update saved_config_space upon resource assignment
    - PCI/AER: Clear only error bits in PCIe Device Status
    - PCI/AER: Stop ruling out unbound devices as error source
    - PCI/ASPM: Fix pci_clear_and_set_config_dword() usage
    - power: supply: max17042: avoid overflow when determining health
    - perf/x86/intel: Always reprogram ACR events to prevent stale masks
    - perf/x86/intel: Disable PMI for self-reloaded ACR events
    - perf/x86/intel: Enable auto counter reload for DMR
    - RDMA/ionic: bound node_desc sysfs read with %.64s
    - RDMA/ionic: Fix typo in format string
    - remoteproc: imx_rproc: Fix NULL vs IS_ERR() bug in imx_rproc_addr_init()
    - remoteproc: k3: Fix NULL vs IS_ERR() bug in k3_reserved_mem_init()
    - sched_ext: idle: Recheck prev_cpu after narrowing allowed mask
    - sched_ext: Use dsq->first_task instead of list_empty() in
      dispatch_enqueue() FIFO-tail
    - selftests: mptcp: check output: catch cmd errors
    - selftests: mptcp: pm: restrict 'unknown' check to pm_nl_ctl
    - mptcp: fastclose msk when linger time is 0
    - mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure
    - mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure
    - mptcp: sockopt: set timestamp flags on subflow socket, not msk
    - mptcp: sockopt: increase seq in mptcp_setsockopt_all_sf
    - mptcp: fix rx timestamp corruption on fastopen
    - mptcp: pm: prio: skip closed subflows
    - mptcp: pm: kernel: reset fullmesh counter after flush
    - mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0
    - mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker
    - mptcp: pm: ADD_ADDR rtx: return early if no retrans
    - f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode()
    - f2fs: fix false alarm of lockdep on cp_global_sem lock
    - f2fs: fix fiemap boundary handling when read extent cache is incomplete
    - f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage
    - f2fs: fix incorrect file address mapping when inline inode is unwritten
    - f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks()
    - f2fs: fix uninitialized kobject put in f2fs_init_sysfs()
    - f2fs: refactor f2fs_move_node_folio function
    - f2fs: fix inline data not being written to disk in writeback path
    - KVM: arm64: Wake-up from WFI when iqrchip is in userspace
    - KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value
    - KVM: arm64: Fix initialisation order in __pkvm_init_finalise()
    - KVM: arm64: Fix FEAT_SPE_FnE to use PMSIDR_EL1.FnE, not PMSVer
    - KVM: arm64: Fix FEAT_Debugv8p9 to check DebugVer, not PMUVer
    - LoongArch: KVM: Cap KVM_CAP_NR_VCPUS by KVM_CAP_MAX_VCPUS
    - LoongArch: KVM: Fix "unreliable stack" for kvm_exc_entry
    - LoongArch: KVM: Fix HW timer interrupt lost when inject interrupt by
      software
    - LoongArch: KVM: Move unconditional delay into timer clear scenery
    - LoongArch: KVM: Use kvm_set_pte() in kvm_flush_pte()
    - LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup
    - mmc: core: Adjust MDT beyond 2025
    - mmc: core: Add quirk for incorrect manufacturing date
    - mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs
    - crypto: qat - fix indentation of macros in qat_hal.c
    - crypto: qat - fix firmware loading failure for GEN6 devices
    - hfsplus: fix held lock freed on hfsplus_fill_super()
    - 8021q: use RCU for egress QoS mappings
    - printk: add print_hex_dump_devel()
    - crypto: caam - guard HMAC key hex dumps in hash_digest_key
    - net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY()
    - rust: pin-init: fix incorrect accessor reference lifetime
    - Linux 7.0.7
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-43490
    - ksmbd: validate inherited ACE SID length
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46174
    - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op
      cache
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46110
    - net: stmmac: Prevent NULL deref when RX memory exhausted
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46153
    - 8021q: delete cleared egress QoS mappings
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46169
    - hfsplus: fix uninit-value by validating catalog record size
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46188
    - octeon_ep_vf: add NULL check for napi_build_skb()
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-45837
    - bpf: Fix use-after-free in arena_vm_close on fork
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46156
    - LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang()
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46147
    - KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu()
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46175
    - f2fs: fix fsck inconsistency caused by FGGC of node block
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46194
    - f2fs: fix node_cnt race between extent node destroy and writeback
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46170
    - mptcp: pm: ADD_ADDR rtx: free sk if last
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46158
    - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46168
    - mptcp: fix scheduling with atomic in timestamp sockopt
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46189
    - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46133
    - RDMA/rxe: Reject unknown opcodes before ICRC processing
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46114
    - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46127
    - RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp()
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46176
    - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46178
    - RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq()
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46181
    - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46145
    - RDMA/mana: Validate rx_hash_key_len
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46117
    - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46126
    - RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss()
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46144
    - RDMA/mana: Fix error unwind in mana_ib_create_qp_rss()
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46141
    - powerpc/xive: fix kmemleak caused by incorrect chip_data lookup
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46183
    - mm/damon/sysfs-schemes: protect path kfree() with damon_sysfs_lock
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46121
    - mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46131
    - KVM: x86: check for nEPT/nNPT in slow flush hypercalls
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46139
    - smb: client: use kzalloc to zero-initialize security descriptor buffer
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46105
    - scsi: mpt3sas: Limit NVMe request size to 2 MiB
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46171
    - riscv: kvm: fix vector context allocation leak
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46112
    - RDMA/hns: Fix unlocked call to hns_roce_qp_remove()
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46165
    - openvswitch: vport: fix self-deadlock on release of tunnel ports
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46161
    - md/raid10: fix divide-by-zero in setup_geo() with zero far_copies
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-43492
    - lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl()
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46124
    - isofs: validate block number from NFS file handle in isofs_export_iget
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46130
    - dm-verity-fec: fix reading parity bytes split across blocks (take 3)
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46106
    - eventfs: Hold eventfs_mutex and SRCU when remount walks events
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46107
    - dm-thin: fix metadata refcount underflow
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46160
    - btrfs: fix missing last_unlink_trans update when removing a directory
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46164
    - btrfs: fix double free in create_space_info_sub_group() error path
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46129
    - btrfs: fix double free in create_space_info() error path
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46159
    - btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to
      info-leak
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46143
    - ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46148
    - spi: microchip-core-qspi: control built-in cs manually
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46192
    - spi: microchip-core-qspi: don't attempt to transmit during emulated
      read-only dual/quad operations
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46162
    - ice: fix double free in ice_sf_eth_activate() error path
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46273
    - ibmveth: Disable GSO for packets with small MSS
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46191
    - fbcon: Avoid OOB font access if console rotation fails
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46134
    - platform/chrome: cros_ec_typec: Init mutex in Thunderbolt registration
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-43495
    - net: wwan: t7xx: validate port_count against message length in
      t7xx_port_enum_msg_handler
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-43502
    - net/rds: handle zerocopy send cleanup before the message is queued
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46120
    - ip6_gre: Use cached t->net in ip6erspan_changelink().
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46142
    - net: libwx: fix VF illegal register access
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46118
    - pseries/papr-hvpipe: Fix null ptr deref in
      papr_hvpipe_dev_create_handle()
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46182
    - pseries/papr-hvpipe: Prevent kernel stack memory leak to userspace
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46184
    - sound: ua101: fix division by zero at probe
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-43498
    - accel/ivpu: Disallow re-exporting imported GEM objects
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46132
    - net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in
      rtnl_fill_vfinfo
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46190
    - mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show()
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46150
    - fanotify: fix false positive on permission events
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-45836
    - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb()
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-45834
    - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-45835
    - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb()
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46138
    - Bluetooth: hci_event: Fix OOB read and infinite loop in
      hci_le_create_big_complete_evt
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46111
    - Bluetooth: hci_conn: fix potential UAF in create_big_sync
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46140
    - Bluetooth: btmtk: validate WMT event SKB length before struct access
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46186
    - Bluetooth: virtio_bt: validate rx pkt_type header length
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46123
    - Bluetooth: virtio_bt: clamp rx length before skb_put
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46104
    - selinux: use sk blob accessor in socket permission helpers
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46193
    - xfrm: ah: account for ESN high bits in async callbacks
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46172
    - ipv6: xfrm6: release dst on error in xfrm6_rcv_encap()
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46116
    - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46154
    - sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46157
    - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46109
    - usb: ulpi: fix memory leak on ulpi_register() error paths
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46146
    - ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3()
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46167
    - usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46151
    - usb: usblp: fix heap leak in IEEE 1284 device ID via short response
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46180
    - wifi: brcmfmac: Fix potential use-after-free issue when stopping
      watchdog task
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46122
    - wifi: b43: enforce bounds check on firmware key index in b43_rx()
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46125
    - wifi: mac80211: remove station if connection prep fails
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46166
    - wifi: mac80211: use safe list iteration in radar detect work
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46187
    - wifi: rsi: fix kthread lifetime race between self-exit and external-stop
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46152
    - wifi: mac80211: drop stray 'static' from fast-RX rx_result
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46163
    - wifi: b43legacy: enforce bounds check on firmware key index in RX path
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46136
    - wifi: mt76: mt7921: fix a potential clc buffer length underflow
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46173
    - exit: prevent preemption of oopsing TASK_DEAD task
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-43496
    - net/sched: sch_red: Replace direct dequeue call with peek and
      qdisc_dequeue_peeked
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46113
    - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46179
    - ASoC: SOF: Don't allow pointer operations on unconfigured streams
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46196
    - tracepoint: balance regfunc() on func_add() failure in
      tracepoint_add_func()
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-43497
    - fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46108
    - ipmi:si: Return state to normal if message allocation fails
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46128
    - ipmi: Check event message buffer response for bad data
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46177
    - ipmi: Add limits to event and receive message requests
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46149
    - scsi: target: configfs: Bound snprintf() return in
      tg_pt_gp_members_show()
  * Ubuntu 26.04 linux kernel has non-functional nova-core GPU driver enabled,
    conflicting with nouveau (LP: #2150845)
    - [Config] Disable NOVA_CORE
  * CVE-2026-46244
    - netfilter: nft_inner: Fix IPv6 inner_thoff desync
  * CVE-2026-46137
    - mptcp: pm: ADD_ADDR rtx: allow ID 0
    - mptcp: pm: ADD_ADDR rtx: fix potential data-race
  * CVE-2026-46185
    - smb/client: fix out-of-bounds read in symlink_data()
  * CVE-2026-46195
    - smb: client: validate dacloffset before building DACL pointers
  * CVE-2026-46289
    - lib/scatterlist: fix length calculations in extract_kvec_to_sg
  * CVE-2026-46119
    - libceph: Fix slab-out-of-bounds access in auth message processing
  * CVE-2026-46135
    - nvmet-tcp: fix race between ICReq handling and queue teardown
  * CVE-2026-46155
    - smb/client: fix out-of-bounds read in smb2_compound_op()
  * CVE-2026-46115
    - block: add pgmap check to biovec_phys_mergeable
  * CVE-2026-46243
    - smb: client: reject userspace cifs.spnego descriptions

 -- Stefan Bader <stefan.bader@canonical.com>  Wed, 01 Jul 2026 11:48:13 +0200

linux-hwe-7.0 (7.0.0-26.26~24.04.1) noble; urgency=medium

  * noble/linux-hwe-7.0: 7.0.0-26.26~24.04.1 -proposed tracker (LP: #2154736)

  * Packaging resync (LP: #1786013)
    - [Packaging] debian.hwe-7.0/dkms-versions -- update from kernel-versions
      (main/2026.05.18)

  [ Ubuntu: 7.0.0-26.26 ]

  * resolute/linux: 7.0.0-26.26 -proposed tracker (LP: #2154530)
  * Packaging resync (LP: #1786013)
    - Revert "UBUNTU: SAUCE: import Huawei ES3000_V2 (2.1.0.23)"
    - [Packaging] debian.master/dkms-versions -- remove dkms-versions
      (main/2026.05.18)
  * Fix mic mute  led on a HP EliteBook 6 G2a platform (LP: #2150065)
    - ALSA: hda/realtek: Add LED fixup for HP EliteBook 6 G2a Laptops
  * ov08x40 module mounted upside down on a certain DELL platforms
    (LP: #2146517)
    - SAUCE: media: ipu-bridge: Add DMI quirk for new Dell XPS laptops with
      upside down sensors
    - SAUCE: media: ipu-bridge: Add DMI quirk for Dell 14 laptops with upside
      down sensors
  * Support additional 2888x1808@30fps 900MHz for OVTI05C1 camera sensor
    (LP: #2147409)
    - SAUCE: media: ipu-bridge: Add 900MHz for OV05C10
    - SAUCE: platform/x86: int3472: increase handshake delay to 50ms for
      OV05C10
  * Support Samsung S5K3J1 sensor for Intel MIPI camera (LP: #2121852)
    - SAUCE: media: ipu-bridge: Support s5k3j1 sensor
  * [SRU] ASoC: enable rt1320 speaker amp and DMIC on PTL SoundWire platforms
    (LP: #2150196)
    - ASoC: Intel: soc-acpi-intel-ptl-match: drop rt722 monolithic match
      tables
    - ASoC: SOF: Intel: Add a is_amp flag to fix the wrong name prefix
    - ASoC: sdw_utils: add rt1320 and rt1321 dmic dai in codec_info_list
  * powerpc-build in ubuntu_kernel_selftests fails to build due to
    uninitialized value (LP: #2129844)
    - selftests/powerpc: Suppress -Wmaybe-uninitialized with GCC 15
  * Ubuntu 26.04 linux kernel has non-functional nova-core GPU driver enabled,
    conflicting with nouveau (LP: #2150845)
    - [Config] Disable DRM_NOVA
  * Resolute update: v7.0.6 upstream stable release (LP: #2152558)
    - Linux 7.0.6
    - Upstream stable to v7.0.6
  * Resolute update: v7.0.5 upstream stable release (LP: #2152556)
    - Linux 7.0.5
    - Upstream stable to v7.0.5
  * Resolute update: v7.0.4 upstream stable release (LP: #2152552)
    - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES
    - ALSA: usb-audio: Avoid false E-MU sample-rate notifications
    - ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch
    - usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable()
    - usb: chipidea: otg: not wait vbus drop if use role_switch
    - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS
      change
    - ALSA: usb-audio: Evaluate packsize caps at the right place
    - LoongArch: Add spectre boundry for syscall dispatch table
    - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check
    - leds: qcom-lpg: Check for array overflow when selecting the high
      resolution
    - greybus: gb-beagleplay: bound bootloader receive buffering
    - greybus: gb-beagleplay: fix sleep in atomic context in hdlc_tx_frames()
    - misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt()
    - ibmasm: fix OOB reads in command_file_write due to missing size checks
    - ibmasm: fix heap over-read in ibmasm_send_i2o_message()
    - sysfs: attribute_group: Respect is_visible_const() when changing owner
    - driver core: Don't let a device probe until it's ready
    - device property: Make modifications of fwnode "flags" thread safe
    - drm/nouveau: fix nvkm_device leak on aperture removal failure
    - rust: dma: remove DMA_ATTR_NO_KERNEL_MAPPING from public attrs
    - kbuild: rust: allow `clippy::uninlined_format_args`
    - fs: afs: revert mmap_prepare() change
    - firmware: google: framebuffer: Do not mark framebuffer as busy
    - lib: test_hmm: evict device pages on file close to avoid use-after-free
    - arm64/mm: Enable batched TLB flush in unmap_hotplug_range()
    - arm64: mm: Fix rodata=full block mapping support for realm guests
    - mm: migrate: requeue destination folio on deferred split queue
    - mm: prevent droppable mappings from being locked
    - mm: fix deferred split queue races during migration
    - ocfs2: split transactions in dio completion to avoid credit exhaustion
    - Input: edt-ft5x06 - fix use-after-free in debugfs teardown
    - zram: do not forget to endio for partial discard requests
    - wifi: rtw88: check for PCI upstream bridge existence
    - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()
    - vfio: selftests: Fix VLA initialisation in vfio_pci_irq_set()
    - vfio/xe: Add a missing vfio_pci_core_release_dev()
    - vfio/virtio: Convert list_lock from spinlock to mutex
    - vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex
    - vfio/cdx: Fix NULL pointer dereference in interrupt trigger path
    - um: drivers: call kernel_strrchr() explicitly in cow_user.c
    - thermal: core: Fix thermal zone governor cleanup issues
    - spi: imx: fix use-after-free on unbind
    - spi: ch341: fix memory leaks on probe failures
    - crypto: algif_aead - snapshot IV for async AEAD requests
    - crypto: pcrypt - Fix handling of MAY_BACKLOG requests
    - dt-bindings: display: ti, am65x-dss: Fix AM62L DSS reg and clock
      constraints
    - of: unittest: fix use-after-free in of_unittest_changeset()
    - of: unittest: fix use-after-free in testdrv_probe()
    - hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt
    - EDAC/versalnet: Fix device_node leak in mc_probe()
    - PCI: imx6: Skip waiting for L2/L3 Ready on i.MX6SX
    - media: amphion: Fix race between m2m job_abort and device_run
    - ALSA: control: Validate buf_len before strnlen() in
      snd_ctl_elem_init_enum_names()
    - net: caif: clear client service pointer on teardown
    - net: strparser: fix skb_head leak in strp_abort_strp()
    - media: mtk-jpeg: fix use-after-free in release path due to uncancelled
      work
    - crypto: atmel-sha204a - Fix OTP sysfs read and error handling
    - PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown
    - Revert "ALSA: usb: Increase volume range that triggers a warning"
    - phy: qcom: m31-eusb2: clear PLL_EN during init
    - PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete
    - lib/ts_kmp: fix integer overflow in pattern length calculation
    - media: i2c: imx219: Check return value of devm_gpiod_get_optional() in
      imx219_probe()
    - net: qrtr: ns: Fix use-after-free in driver remove()
    - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget()
    - mm/zsmalloc: copy KMSAN metadata in zs_page_migrate()
    - ALSA: aoa: i2sbus: clear stale prepared state
    - ALSA: aoa: i2sbus: fix OF node lifetime handling
    - ALSA: aoa: Skip devices with no codecs in i2sbus_resume()
    - ALSA: ctxfi: Add fallback to default RSR for S/PDIF
    - ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes
    - erofs: fix the out-of-bounds nameoff handling for trailing dirents
    - ipmi:ssif: Clean up kthread on errors
    - jbd2: fix deadlock in jbd2_journal_cancel_revoke()
    - KVM: selftests: Fix reserved value WRMSR testcase for multi-feature MSRs
    - md/raid10: fix deadlock with check operation and nowait requests
    - media: rc: igorplugusb: heed coherency rules
    - media: rockchip: rkcif: fix off by one bugs
    - media: rockchip: rkcif: comply with minimum number of buffers
      requirement
    - mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused
    - mm/alloc_tag: clear codetag for pages allocated before page_ext
      initialization
    - mm/damon/core: fix damon_call() vs kdamond_fn() exit race
    - mm/damon/core: fix damos_walk() vs kdamond_fn() exit race
    - mm/hugetlb: fix early boot crash on parameters without '=' separator
    - mtd: docg3: fix use-after-free in docg3_release()
    - nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4
    - nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set
    - parisc: _llseek syscall is only available for 32-bit userspace
    - parisc: Drop ip_fast_csum() inline assembly implementation
    - PCI: cadence: Use cdns_pcie_read_sz() for byte or word read access
    - PCI: imx6: Fix reference clock source selection for i.MX95
    - perf annotate: Use jump__delete when freeing LoongArch jumps
    - RDMA/mana_ib: Disable RX steering on RSS QP destroy
    - remoteproc: xlnx: Only access buffer information if IPI is buffered
    - reset: rzv2h-usb2phy: Keep PHY clock enabled for entire device lifetime
    - sched: Use u64 for bandwidth ratio calculations
    - selftests/mqueue: Fix incorrectly named file
    - landlock: Fix LOG_SUBDOMAINS_OFF inheritance across fork()
    - landlock: Allow TSYNC with LOG_SUBDOMAINS_OFF and fd=-1
    - selftests/landlock: Drain stale audit records on init
    - selftests/landlock: Fix format warning for __u64 in net_test
    - selftests/landlock: Fix snprintf truncation checks in audit helpers
    - selftests/landlock: Skip stale records in audit_match_record()
    - rbd: fix null-ptr-deref when device_add_disk() fails
    - mm/zone_device: do not touch device folio after calling ->folio_free()
    - block: fix zone write plugs refcount handling in
      disk_zone_wplug_schedule_bio_work()
    - io_uring/zcrx: return back two step unregistration
    - io_uring/timeout: check unused sqe fields
    - block: relax pgmap check in bio_add_page for compatible zone device
      pages
    - iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned()
    - io_uring/register: fix ring resizing with mixed/large SQEs/CQEs
    - io_uring/zcrx: fix user_struct uaf
    - io_uring/poll: fix signed comparison in io_poll_get_ownership()
    - io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE
    - module.lds,codetag: force 0 sh_addr for sections
    - module.lds.S: Fix modules on 32-bit parisc architecture
    - ALSA: core: Fix potential data race at fasync handling
    - ALSA: caiaq: Fix control_put() result and cache rollback
    - ALSA: caiaq: Handle probe errors properly
    - ALSA: 6fire: Fix input volume change detection
    - ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa2xxx
    - ALSA: pcmtest: fix reference leak on failed device registration
    - ALSA: pcmtest: Fix resource leaks in module init error paths
    - iio: adc: ad7768-1: fix one-shot mode data acquisition
    - iio: adc: ad7768-1: remove switch to one-shot mode
    - rxrpc: Fix memory leaks in rxkad_verify_response()
    - rxrpc: Fix rxkad crypto unalignment handling
    - rxrpc: Fix error handling in rxgk_extract_token()
    - rxrpc: Fix re-decryption of RESPONSE packets
    - EDAC/versalnet: Fix memory leak in remove and probe error paths
    - tools/accounting: handle truncated taskstats netlink messages
    - net: txgbe: fix RTNL assertion warning when remove module
    - arm64: dts: marvell: uDPU: add ethernet aliases
    - net: qrtr: ns: Limit the maximum server registration per node
    - net: qrtr: ns: Limit the maximum number of lookups
    - net: qrtr: ns: Free the node during ctrl_cmd_bye()
    - net: qrtr: ns: Limit the total number of nodes
    - net: rds: fix MR cleanup on copy error
    - net: txgbe: fix firmware version check
    - net/smc: avoid early lgr access in smc_clc_wait_msg
    - net: ks8851: Reinstate disabling of BHs around IRQ handler
    - net: bridge: use a stable FDB dst snapshot in RCU readers
    - netconsole: avoid out-of-bounds access on empty string in trim_newline()
    - net: mctp: fix don't require received header reserved bits to be zero
    - net: ks8851: Avoid excess softirq scheduling
    - drm/arcpgu: fix device node leak
    - slub: fix data loss and overflow in krealloc()
    - tracing/fprobe: Reject registration of a registered fprobe before init
    - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv
    - printf: Compile the kunit test with DISABLE_BRANCH_PROFILING
      DISABLE_BRANCH_PROFILING
    - ipv4: icmp: validate reply type before using icmp_pointers
    - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply()
    - spi: fix resource leaks on device setup failure
    - extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE'
    - tpm: avoid -Wunused-but-set-variable
    - LoongArch: Make arch_irq_work_has_interrupt() true only if IPI HW exist
    - LoongArch: Show CPU vulnerabilites correctly
    - fbdev: defio: Disconnect deferred I/O from the lifetime of struct
      fb_info
    - power: supply: axp288_charger: Do not cancel work before initializing it
    - hwmon: (isl28022) Fix integer overflow in power calculation on 32-bit
    - hwmon: (powerz) Avoid cacheline sharing for DMA buffer
    - media: rzv2h-ivc: Revise default VBLANK formula
    - media: rzv2h-ivc: Fix AXIRX_VBLANK register write
    - fs: prepare for adding LSM blob to backing_file
    - lsm: add backing_file LSM hooks
    - selinux: fix overlayfs mmap() and mprotect() access checks
    - hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data()
    - randomize_kstack: Maintain kstack_offset per task
    - mmc: block: use single block write in retry
    - mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration
    - arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins
    - crypto: qat - fix IRQ cleanup on 6xxx probe failure
    - xfs: start gc on zonegc_low_space attribute updates
    - xfs: fix a resource leak in xfs_alloc_buftarg()
    - firmware: google: framebuffer: Do not unregister platform device
    - firmware: exynos-acpm: Drop fake 'const' on handle pointer
    - crypto: talitos - fix SEC1 32k ahash request limitation
    - crypto: talitos - rename first/last to first_desc/last_desc
    - pwm: imx-tpm: Count the number of enabled channels in probe
    - tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public()
    - tpm: Fix auth session leak in tpm2_get_random() error path
    - tpm: Use kfree_sensitive() to free auth session in tpm_dev_release()
    - tpm: tpm_tis: add error logging for data transfer
    - tpm: tpm_tis: stop transmit if retries are exhausted
    - rtc: ntxec: fix OF node reference imbalance
    - mm/vmalloc: take vmap_purge_lock in shrinker
    - mm/memfd_luo: fix physical address conversion in put_folios cleanup
    - mm/mempolicy: fix memory leaks in weighted_interleave_auto_store()
    - mm/damon/stat: fix memory leak on damon_start() failure in
      damon_stat_start()
    - mm/damon/core: validate damos_quota_goal->nid for
      node_mem_{used,free}_bp
    - mm/damon/core: validate damos_quota_goal->nid for
      node_memcg_{used,free}_bp
    - mm/damon/core: use time_in_range_open() for damos quota window start
    - mm/damon/core: disallow time-quota setting zero esz
    - mm/damon/core: disallow non-power of two min_region_sz on damon_start()
    - userfaultfd: allow registration of ranges below mmap_min_addr
    - LoongArch: KVM: Use CSR_CRMD_PLV in kvm_arch_vcpu_in_kernel()
    - KVM: x86: Defer non-architectural deliver of exception payload to
      userspace read
    - KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state
    - KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2
    - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2
    - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0
    - KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts
    - KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode
    - KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN
    - KVM: nSVM: Delay stuffing L2's current RIP into NextRIP until vCPU run
    - KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT
    - KVM: arm64: Account for RESx bits in __compute_fgt()
    - KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12
    - KVM: nSVM: Delay setting soft IRQ RIP tracking fields until vCPU run
    - KVM: SVM: Switch svm_copy_lbrs() to a macro
    - KVM: SVM: Add missing save/restore handling of LBR MSRs
    - KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN
    - KVM: nSVM: Refactor checking LBRV enablement in vmcb12 into a helper
    - KVM: nSVM: Refactor writing vmcb12 on nested #VMEXIT as a helper
    - KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT
    - KVM: nSVM: Triple fault if mapping VMCB12 fails on nested #VMEXIT
    - KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID)
    - KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT
    - KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT
    - KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS
    - KVM: nSVM: Drop the non-architectural consistency check for NP_ENABLE
    - KVM: nSVM: Add missing consistency check for nCR3 validity
    - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1
    - KVM: nSVM: Always intercept VMMCALL when L2 is active
    - ARM: 9472/1: fix race condition on PG_dcache_clean in
      __sync_icache_dcache()
    - ring-buffer: Do not double count the reader_page
    - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access
    - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all()
    - udf: fix partition descriptor append bookkeeping
    - mtd: spi-nor: sst: Fix write enable before AAI sequence
    - mtd: spinand: winbond: Declare the QE bit on W25NxxJW
    - amdgpu/jpeg: fix deepsleep register for jpeg 5_0_0 and 5_0_2
    - md/md-llbitmap: skip reading rdevs that are not in_sync
    - md/md-llbitmap: raise barrier before state machine transition
    - md/raid5: fix soft lockup in retry_aligned_read()
    - md/raid5: validate payload size before accessing journal metadata
    - check-uapi: link into shared objects
    - mm, swap: speed up hibernation allocation and writeout
    - HID: apple: ensure the keyboard backlight is off if suspending
    - inotify: fix watch count leak when fsnotify_add_inode_mark_locked()
      fails
    - x86/cpu: Disable FRED when PTI is forced on
    - x86/shstk: Prevent deadlock during shstk sigreturn
    - wifi: rtl8xxxu: fix potential use of uninitialized value
    - tcp: call sk_data_ready() after listener migration
    - taskstats: set version in TGID exit notifications
    - mptcp: sync the msk->sndbuf at accept() time
    - mfd: core: Preserve OF node when ACPI handle is present
    - 9p: fix access mode flags being ORed instead of replaced
    - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers
    - bus: mhi: host: pci_generic: Switch to async power up to avoid boot
      delays
    - can: ucan: fix devres lifetime
    - crypto: acomp - fix wrong pointer stored by acomp_save_req()
    - crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit
    - crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup
    - crypto: atmel-ecc - Release client on allocation failure
    - crypto: hisilicon - Fix dma_unmap_single() direction
    - crypto: ccree - fix a memory leak in cc_mac_digest()
    - crypto: atmel-tdes - fix DMA sync direction
    - crypto: atmel-sha204a - Fix error codes in OTP reads
    - crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path
    - crypto: atmel-sha204a - Fix uninitialized data access on OTP read error
    - crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx
    - crypto: nx - fix context leak in nx842_crypto_free_ctx
    - crypto: nx - Fix packed layout in struct nx842_crypto_header
    - dm mirror: fix integer overflow in create_dirty_log()
    - erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap()
    - ceph: fix num_ops off-by-one when crypto allocation fails
    - ceph: only d_add() negative dentries when they are unhashed
    - gtp: disable BH before calling udp_tunnel_xmit_skb()
    - IB/core: Fix zero dmac race in neighbor resolution
    - ktest: Fix the month in the name of the failure directory
    - NFSv4.1: Apply session size limits on clone path
    - ntfs3: add buffer boundary checks to run_unpack()
    - ntfs3: fix integer overflow in run_unpack() volume boundary check
    - rtmutex: Use waiter::task instead of current in remove_waiter()
    - rxgk: Fix potential integer overflow in length check
    - sched_ext: Documentation: Clarify ops.dispatch() role in task lifecycle
    - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails
    - seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode
    - perf loongarch: Fix build failure with CONFIG_LIBDW_DWARF_UNWIND
    - iio: frequency: admv1013: add dev variable
    - iio: frequency: admv1013: fix NULL pointer dereference on str
    - wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor
    - wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling
    - mm: various small mmap_prepare cleanups
    - mm: avoid deadlock when holding rmap on mmap_prepare error
    - mei: me: use PCI_DEVICE_DATA macro
    - mei: me: add nova lake point H DID
    - crypto: authencesn - reject short ahash digests during instance creation
    - driver core: Add kernel-doc for DEV_FLAG_COUNT enum value
    - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path
    - ALSA: caiaq: Don't abort when no input device is available
    - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
    - drm/amdgpu: fix zero-size GDS range init on RDNA4
    - drm/imagination: Fix segfault when updating ftrace mask
    - ALSA: caiaq: fix usb_dev refcount leak on probe failure
    - ALSA: aloop: Fix peer runtime UAF during format-change stop
    - vmalloc: fix buffer overflow in vrealloc_node_align()
    - mm/page_alloc: return NULL early from alloc_frozen_pages_nolock() in NMI
      on UP
    - mm/slab: return NULL early from kmalloc_nolock() in NMI on UP
    - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels
    - netfilter: reject zero shift in nft_bitwise
    - ipmi:ssif: Remove unnecessary indention
    - ipmi:ssif: NULL thread on error
    - Linux 7.0.4
    - Upstream stable to v7.0.4
  * Resolute update: v7.0.3 upstream stable release (LP: #2152550)
    - Buffer overflow in drivers/xen/sys-hypervisor.c
    - xen/privcmd: fix double free via VMA splitting
    - Linux 7.0.3
    - Upstream stable to v7.0.3
  * Resolute update: v7.0.2 upstream stable release (LP: #2150553)
    - crypto: authencesn - Fix src offset when decrypting in-place
    - pwm: th1520: fix `CLIPPY=1` warning
    - drm/amdgpu: replace PASID IDR with XArray
    - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch
    - crypto: krb5enc - fix async decrypt skipping hash verification
    - ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger
    - ksmbd: validate owner of durable handle on reconnect
    - scripts: generate_rust_analyzer.py: define scripts
    - scripts/dtc: Remove unused dts_version in dtc-lexer.l
    - fs/ntfs3: validate rec->used in journal-replay file record check
    - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally
    - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in
      f2fs_write_end_io()
    - f2fs: fix to avoid memory leak in f2fs_rename()
    - f2fs: fix to avoid uninit-value access in f2fs_sanity_check_node_footer
    - fuse: reject oversized dirents in page cache
    - fuse: abort on fatal signal during sync init
    - fuse: Check for large folio with SPLICE_F_MOVE
    - fuse: quiet down complaints in fuse_conn_limit_write
    - fuse: fuse_dev_ioctl_clone() should wait for device file to be
      initialized
    - ksmbd: require minimum ACE size in smb_check_perm_dacl()
    - smb: server: fix active_num_conn leak on transport allocation failure
    - smb: client: fix dir separator in SMB1 UNIX mounts
    - smb: server: fix max_connections off-by-one in tcp accept path
    - smb: client: require a full NFS mode SID before reading mode bits
    - smb: client: validate the whole DACL before rewriting it in cifsacl
    - smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path
    - ksmbd: validate response sizes in ipc_validate_msg()
    - ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl()
    - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment
    - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow
    - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id()
    - writeback: Fix use after free in inode_switch_wbs_work_fn()
    - f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io()
    - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu
    - ALSA: hda/realtek: Add quirk for Legion S7 15IMH
    - ALSA: caiaq: take a reference on the USB device in create_card()
    - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()
    - crypto: ccp: Don't attempt to copy CSR to userspace if PSP command
      failed
    - crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command
      failed
    - crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed
    - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing
    - mshv_vtl: Fix vmemmap_shift exceeding MAX_FOLIO_ORDER
    - Linux 7.0.2
  * Resolute update: v7.0.1 upstream stable release (LP: #2150547)
    - Revert "UBUNTU: SAUCE: cdc-acm: Exclude Exar USB serial ports"
    - nfc: llcp: add missing return after LLCP_CLOSED checks
    - x86/CPU: Fix FPDSS on Zen1
    - can: raw: fix ro->uniq use-after-free in raw_rcv()
    - i2c: s3c24xx: check the size of the SMBUS message before using it
    - staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify()
    - HID: alps: fix NULL pointer dereference in alps_raw_event()
    - HID: core: clamp report_size in s32ton() to avoid undefined shift
    - net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()
    - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler
    - drm/vc4: platform_get_irq_byname() returns an int
    - bnge: return after auxiliary_device_uninit() in error path
    - ALSA: usx2y: us144mkii: fix NULL deref on missing interface 0
    - ALSA: fireworks: bound device-supplied status before string array lookup
    - fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
    - usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb()
    - usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete()
    - usb: gadget: renesas_usb3: validate endpoint index in standard request
      handlers
    - smb: client: fix off-by-8 bounds check in check_wsl_eas()
    - smb: client: fix OOB reads parsing symlink error response
    - ksmbd: validate EaNameLength in smb2_get_ea()
    - ksmbd: require 3 sub-authorities before reading sub_auth[2]
    - ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc
    - smb: client: avoid double-free in smbd_free_send_io() after
      smbd_send_batch_flush()
    - smb: server: avoid double-free in smb_direct_free_sendmsg after
      smb_direct_flush_send_list()
    - usbip: validate number_of_packets in usbip_pack_ret_submit()
    - usb: typec: fusb302: Switch to threaded IRQ handler
    - usb: storage: Expand range of matched versions for VL817 quirks entry
    - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen
    - usb: gadget: f_hid: don't call cdev_init while cdev in use
    - usb: port: add delay after usb_hub_set_port_power()
    - fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
    - scripts/gdb/symbols: handle module path parameters
    - scripts: generate_rust_analyzer.py: avoid FD leak
    - wifi: rtw88: fix device leak on probe failure
    - staging: sm750fb: fix division by zero in ps_to_hz()
    - selftests/mm: hmm-tests: don't hardcode THP size to 2MB
    - USB: serial: option: add Telit Cinterion FN990A MBIM composition
    - Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates
      race
    - Docs/admin-guide/mm/damon/lru_sort: warn commit_inputs vs param updates
      race
    - ALSA: ctxfi: Limit PTP to a single page
    - dcache: Limit the minimal number of bucket to two
    - vfio/xe: Reorganize the init to decouple migration from reset
    - arm64: mm: Handle invalid large leaf mappings correctly
    - media: vidtv: fix NULL pointer dereference in
      vidtv_channel_pmt_match_sections
    - ocfs2: fix possible deadlock between unlink and dio_end_io_write
    - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY
    - ocfs2: handle invalid dinode in ocfs2_group_extend
    - PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in
      epf_ntb_epc_cleanup
    - PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown
    - KVM: selftests: Remove duplicate LAUNCH_UPDATE_VMSA call in SEV-ES
      migrate test
    - KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted
      vCPU
    - KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock
    - KVM: SEV: Disallow LAUNCH_FINISH if vCPUs are actively being created
    - KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish
    - KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION
    - mm: call ->free_folio() directly in folio_unmap_invalidate()
    - checkpatch: add support for Assisted-by tag
    - x86-64: rename misleadingly named '__copy_user_nocache()' function
    - x86: rename and clean up __copy_from_user_inatomic_nocache()
    - x86-64/arm64/powerpc: clean up and rename __copy_from_user_flushcache
    - KVM: x86: Use scratch field in MMIO fragment to hold small write values
    - ASoC: qcom: q6apm: move component registration to unmanaged version
    - mm/kasan: fix double free for kasan pXds
    - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()
    - media: vidtv: fix nfeeds state corruption on start_streaming failure
    - media: mediatek: vcodec: fix use-after-free in encoder release path
    - media: em28xx: fix use-after-free in em28xx_v4l2_open()
    - hwmon: (powerz) Fix use-after-free on USB disconnect
    - ALSA: 6fire: fix use-after-free on disconnect
    - bcache: fix cached_dev.sb_bio use-after-free and crash
    - wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in
      pre_exit
    - media: as102: fix to not free memory after the device is registered in
      as102_usb_probe()
    - nilfs2: fix NULL i_assoc_inode dereference in
      nilfs_mdt_save_to_shadow_map
    - media: vidtv: fix pass-by-value structs causing MSAN warnings
    - media: hackrf: fix to not free memory after the device is registered in
      hackrf_probe()
    - mm/userfaultfd: fix hugetlb fault mutex hash calculation
    - clockevents: Add missing resets of the next_event_forced flag
    - Linux 7.0.1
  * GRO managed-frag use-after-free leading to local privilege escalation
    (LP: #2154172)
    - net: gro: don't merge zcopy skbs
  * AppArmor Vulnerabilities  (LP: #2151747)
    - SAUCE: apparmor: pass big_resp to handler
    - SAUCE: apparmor: remove redundant kref_init for listener->count
    - SAUCE: apparmor: fix NULL pointer dereference in unpack_pdb
  * AppArmor Vulnerabilities  (LP: #2151747) // CVE-2026-47337
    - SAUCE: apparmor: fix NULL pointer dereference in bind_map_addr
  * AppArmor Vulnerabilities  (LP: #2151747) // CVE-2026-47334
    - SAUCE: apparmor: fix sleep prone memory allocation under a spin_lock
  * AppArmor Vulnerabilities  (LP: #2151747) // CVE-2026-47333
    - SAUCE: apparmor: fix dfa unpacking size of the notification filter
  * AppArmor Vulnerabilities  (LP: #2151747) // CVE-2026-47332
    - SAUCE: apparmor: fix size check against type instead of pointer
  * apparmor: LLVM/clang build failure due to uninitialized variable in
    notify.c (LP: #2148809) // CVE-2026-47330
    - SAUCE: apparmor: initialize variable used in uninitialized context
  * AppArmor Vulnerabilities  (LP: #2151747) // CVE-2026-47329
    - SAUCE: apparmor: fix name validation bypass on notification
  * AppArmor Vulnerabilities  (LP: #2151747) // CVE-2026-47327 //
    CVE-2026-47328
    - SAUCE: apparmor: fix glob memory leak after kstrdup
  * AppArmor Vulnerabilities  (LP: #2151747) // CVE-2026-47326
    - SAUCE: apparmor: fix inverted NULL check after aa_get_buffer
  * CVE-2026-46300
    - net: skbuff: preserve shared-frag marker during coalescing
    - net: skbuff: propagate shared-frag marker through frag-transfer helpers
  * net/rds: reset op_nents when zerocopy page pin fails (LP: #2153962)
    - net/rds: reset op_nents when zerocopy page pin fails
  * CVE-2026-46333
    - ptrace: slightly saner 'get_dumpable()' logic
  * CVE-2026-43500
    - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets
    - rxrpc: Fix potential UAF after skb_unshare() failure
    - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets
    - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
  * CVE-2026-43284
    - xfrm: esp: avoid in-place decrypt on shared skb frags

  [ Ubuntu: 7.0.0-15.15 ]

  * resolute/linux: 7.0.0-15.15 -proposed tracker (LP: #2148866)
  * Qualcomm X1E: Speaker overdrive causes hardware protection shutdown
    (LP: #2149808)
    - SAUCE: ASoC: qcom: x1e80100: limit speaker volumes
  * intel-ipu7 / intel-ipu7-isys modules are shipped unsigned in latest
    Resolute kernels, breaking Secure Boot systems  (LP: #2148718)
    - [packaging] add intel-ipu7 to signature inclusion list

 -- Stefan Bader <stefan.bader@canonical.com>  Tue, 02 Jun 2026 14:12:18 +0200

linux-hwe-7.0 (7.0.0-14.14~24.04.3) noble; urgency=medium

  * noble/linux-hwe-6.17: 6.17.0-9.9~24.04.3 -proposed tracker (LP: #2132312)
    - SAUCE: tools: clamp sizeof in perf_cpu_map__merge

 -- Stefan Bader <stefan.bader@canonical.com>  Fri, 24 Apr 2026 14:10:36 +0200

linux-hwe-7.0 (7.0.0-14.14~24.04.2) noble; urgency=medium

  * linux-hwe-6.14-tools-6.14.0-24:amd64 == 6.14.0-24.24~24.04.3 is missing
    the perf and bpftool binaries (LP: #2117147)
    - [Packaging] Add do_tools_noble_hwe to include perf and bpftool in
      SRCPKGNAME-tools-$(abi_release)

  * Miscellaneous Ubuntu changes
    - [Packaging] hwe-7.0: Fix run-parts usage in maintscripts
    - [Packaging] hwe-7.0: Undo /lib/ -> /usr/lib changes
    - [Packaging] hwe-7.0: Temporarily add back DKMS modules
    - [Packaging] hwe-7.0: Drop DKMS:doca-ofed

 -- Stefan Bader <stefan.bader@canonical.com>  Fri, 24 Apr 2026 12:05:54 +0200

linux-hwe-7.0 (7.0.0-14.14~24.04.1) noble; urgency=medium

  * noble/linux-hwe-7.0: 7.0.0-14.14~24.04.1 -proposed tracker (LP: #2148677)

  * Packaging resync (LP: #1786013)
    - [Packaging] update update.conf

  * Miscellaneous Ubuntu changes
    - [Packaging] Import dkms-versions
    - [Packaging] Drop linux-modules-extra support
    - [Packaging] Attempt to stay with bindgen-0.65
    - [Packaging] Updated config after 7.0 rebase
    - [Packaging] Sync control.stub.in from parent
    - [Packaging] Revert cross compile changes
    - [Packaging] hwe-7.0: Switch arm64 builds to EFI images

  [ Ubuntu: 7.0.0-14.14 ]

  * resolute/linux: 7.0.0-14.14 -proposed tracker (LP: #2148159)
  * support vflip/hflip for Sony IMX471 camera sensor (LP: #2138841)
    - SAUCE: media: ipu-bridge: add TBE20A0 ACPI id for Sony IMX471
  * AA: disable SECURITY_APPARMOR_PACKET_MEDIATION_ENABLED (LP: #2147533)
    - [Config] disable SECURITY_APPARMOR_PACKET_MEDIATION_ENABLED
  * System doesn't response with mt76 call trace (LP: #2137448)
    - wifi: mt76: mt792x: Fix a potential deadlock in high-load situations
  * The second tbt storage plugged on the dock will not be recognized
    (LP: #2139572)
    - SAUCE: thunderbolt: Fix PCIe device enumeration with delayed rescan
  * dma-buf filesystem flags fix (LP: #2139656)
    - SAUCE: dma-buf: set SB_I_NOEXEC and SB_I_NODEV on dmabuf filesystem
  * Bluetooth device (MT7925) not detected on USB bus with linux-oem-6.17
    (LP: #2145164)
    - SAUCE: USB: hub: call ACPI _PRR reset during port power-cycle on
      enumeration failure
  * drm/i915/lnl+/tc: Fix false disconnect of active DP-alt TC port during
    long HPD pulse (LP: #2143879)
    - SAUCE: drm/i915/lnl+/tc: Fix false disconnect of active DP-alt TC port
      during long HPD pulse
  * i915 WARN_ON call trace during CB/WB on MTL/ARL platforms (LP: #2144537)
    - SAUCE: drm/i915/xelpdp/tc: Convert TCSS power check WARN to a debug
      message
  * Miscellaneous Ubuntu changes
    - [Packaging] Add support for per-flavour depends
    - [Packaging] Don't hard-code lmm zfs dependency
    - [Config] updateconfigs following v7.0 release

 -- Stefan Bader <stefan.bader@canonical.com>  Wed, 22 Apr 2026 12:20:19 +0200

linux-hwe-7.0 (7.0.0-13.13~24.04.1) noble; urgency=medium

  * Initial hwe-7.0 packaging (based on resolute:linux 7.0.0-13.13)

 -- Stefan Bader <stefan.bader@canonical.com>  Fri, 17 Apr 2026 11:41:01 +0200

linux (7.0.0-13.13) resolute; urgency=medium

  * resolute/linux: 7.0.0-13.13 -proposed tracker (LP: #2147403)

  * ubuntu_kselftests:_net/net:gre_gso.sh failing (LP: #2136820)
    - SAUCE increase socat timeout in gre_gso.sh

  * Canonical Kmod 2025 key rotation (LP: #2147447)
    - [Packaging] ubuntu-compatible-signing -- make Ubuntu-Compatible-Signing
      extensible
    - [Packaging] ubuntu-compatible-signing -- allow consumption of positive
      certs
    - [Packaging] ubuntu-compatible-signing -- report the livepatch:2025 key
    - [Config] prepare for Canonical Kmod key rotation
    - [Packaging] ubuntu-compatible-signing -- report the kmod:2025 key
    - [Packaging] ensure our cert rollups are always fresh

  * On Dell system, the internal OLED display drops to a visibly low FPS after
    suspend/resume (LP: #2144712)
    - drm/i915/psr: Disable Panel Replay on Dell XPS 14 DA14260 as a quirk
    - drm/i915/psr: Fixes for Dell XPS DA14260 quirk

  * Realtek RTL8116AF SFP option module fails to get connected (LP: #2116144)
    - SAUCE: r8169: add quirk for RTL8116af SerDes

  * Miscellaneous Ubuntu changes
    - [Config] updateconfigs following v7.0-rc7 rebase

 -- Paolo Pisati <paolo.pisati@canonical.com>  Wed, 08 Apr 2026 06:56:37 +0200

linux (7.0.0-12.12) resolute; urgency=medium

  * resolute/linux: 7.0.0-12.12 -proposed tracker (LP: #2146778)

  * Packaging resync (LP: #1786013)
    - [Packaging] update variants

  * linux-generic does not run scripts in /usr/share/kernel/*.d (LP: #2147005)
    - [Packaging] templates: Use consistent indentation
    - [Packaging] templates: Run scripts in /usr/share/kernel/*.d too

  * RISC-V kernel config is out of sync with other archs (LP: #1981437)
    - [Config] riscv64: Enable COUNTER=m
    - [Config] riscv64: Use GENDWARFKSYMS like other architectures

  * unconfined profile denies userns_create for chromium based processes
    (LP: #1990064)
    - [Config] disable CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS

  * FFe: add network interface mediation to 26.04 (LP: #2144679)
    - SAUCE: apparmor5.0.0 [57/57]: apparmor: add the ability to use interface
      in network mediation.

  * Jellyfin Desktop Flatpak doesn't work with the current AppArmor profile
    (LP: #2142956)
    - SAUCE: apparmor5.0.0 [29/57]: apparmor: fix fine grained inet mediation
      sock_file_perm
    - SAUCE: apparmor5.0.0 [30/57]: apparmor-next 7.1: aapparmor: use target
      task's context in apparmor_getprocattr()
    - SAUCE: apparmor5.0.0 [31/57]: apparmor-next 7.1: apparmor: return error
      on namespace mismatch in verify_header
    - SAUCE: apparmor5.0.0 [32/57]: apparmor-next 7.1: apparmor: enable
      differential encoding
    - SAUCE: apparmor5.0.0 [33/57]: apparmor-next 7.1: apparmor: propagate
      -ENOMEM correctly in unpack_table
    - SAUCE: apparmor5.0.0 [34/57]: apparmor-next 7.1: apparmor: Replace
      memcpy + NUL termination with kmemdup_nul in do_setattr
    - SAUCE: apparmor5.0.0 [35/57]: apparmor-next 7.1: apparmor: Remove
      redundant if check in sk_peer_get_label
    - SAUCE: apparmor5.0.0 [36/57]: apparmor-next 7.1: apparmor: use
      __label_make_stale in __aa_proxy_redirect
    - SAUCE: apparmor5.0.0 [37/57]: apparmor-next 7.1: apparmor: fix net.h and
      policy.h circular include pattern
    - SAUCE: apparmor5.0.0 [39/57]: apparmor-next 7.1: apparmor: make include
      headers self-contained
    - SAUCE: apparmor5.0.0 [40/57]: apparmor-next 7.1: apparmor: Use
      sysfs_emit in param_get_{audit,mode}
    - SAUCE: apparmor5.0.0 [41/57]: apparmor-next 7.1: apparmor: fix
      rawdata_f_data implicit flex array
    - SAUCE: apparmor5.0.0 [42/57]: apparmor-next 7.1: apparmor: free rawdata
      as soon as possible
    - SAUCE: apparmor5.0.0 [43/57]: apparmor-next 7.1: apparmor: Initial
      support for compressed policies
    - SAUCE: apparmor5.0.0 [44/57]: apparmor-next 7.1: apparmor: fix potential
      UAF in aa_replace_profiles
    - SAUCE: apparmor5.0.0 [45/57]: apparmor-next 7.1: apparmor: hide unused
      get_loaddata_common_ref() function
    - SAUCE: apparmor5.0.0 [46/57]: apparmor-next 7.1: apparmor: Fix string
      overrun due to missing termination
    - SAUCE: apparmor5.0.0 [47/57]: apparmor: fix packed tag on v5 header
      struct
    - SAUCE: apparmor5.0.0 [48/57]: apparmor: add temporal caching to audit
      responses.
    - SAUCE: apparmor5.0.0 [49/57]: apparmor: change fn_label_build() call to
      not return NULL
    - SAUCE: apparmor5.0.0 [50/57]: apparmor: make fn_label_build() capable of
      handling not supported
    - SAUCE: apparmor5.0.0 [51/57]: apparmor: move netfilter functions next to
      the LSM network operations
    - SAUCE: apparmor5.0.0 [52/57]: apparmor: move sock_rvc_skb() next to
      inet_conn_request
    - SAUCE: apparmor5.0.0 [53/57]: apparmor: fix af_unix local addr mediation
      binding
    - SAUCE: apparmor5.0.0 [54/57]: cleanups of apparmor af_unix mediation
    - SAUCE: apparmor5.0.0 [55/57]: apparmor: fix apparmor_secmark_check()
      when !inet and secmark defined.
    - SAUCE: apparmor5.0.0 [56/57]: apparmor: fix auditing of non-mediation
      falures

  * snap service cannot change apparmor hat (LP: #2139664) // Jellyfin Desktop
    Flatpak doesn't work with the current AppArmor profile (LP: #2142956)
    - SAUCE: apparmor5.0.0 [38/57]: apparmor-next 7.1: apparmor: grab ns lock
      and refresh when looking up changehat child profiles

  * AppArmor blocks write(2) to network sockets with Linux 6.19 (LP: #2141298)
    - SAUCE: apparmor5.0.0 [28/57]: apparmor: fix aa_label_sk_perm to check
      for RULE_MEDIATES_NET

  * update apparmor and LSM stacking patch set (LP: #2028253)
    - SAUCE: apparmor5.0.0 [1/57]: Stacking: LSM: Single calls in secid hooks
    - SAUCE: apparmor5.0.0 [2/57]: Stacking: LSM: Exclusive secmark usage
    - SAUCE: apparmor5.0.0 [3/57]: Stacking: AppArmor: Remove the exclusive
      flag
    - SAUCE: apparmor5.0.0 [4/57]: Revert "apparmor: fix dbus permission
      queries to v9 ABI"
    - SAUCE: apparmor5.0.0 [5/57]: Revert "apparmor: gate make fine grained
      unix mediation behind v9 abi"
    - SAUCE: apparmor5.0.0 [6/57]: apparmor: net: patch to provide
      compatibility with v2.x net rules
    - SAUCE: apparmor5.0.0 [7/57]: apparmor: net: add fine grained ipv4/ipv6
      mediation
    - SAUCE: apparmor5.0.0 [8/57]: apparmor: lift compatibility check out of
      profile_af_perm
    - SAUCE: apparmor5.0.0 [9/57]: apparmor: userns: add unprivileged user ns
      mediation
    - SAUCE: apparmor5.0.0 [10/57]: apparmor: userns: Add sysctls for
      additional controls of unpriv userns restrictions
    - SAUCE: apparmor5.0.0 [12/57]: apparmor: userns: open userns related
      sysctl so lxc can check if restriction are in place
    - SAUCE: apparmor5.0.0 [13/57]: apparmor: userns: allow profile to be
      transitioned when a userns is created
    - SAUCE: apparmor5.0.0 [14/57]: apparmor: mqueue: call
      security_inode_init_security on inode creation
    - SAUCE: apparmor5.0.0 [15/57]: apparmor: mqueue: add fine grained
      mediation of posix mqueues
    - SAUCE: apparmor5.0.0 [16/57]: apparmor: uring: add io_uring mediation
    - SAUCE: apparmor5.0.0 [19/57]: apparmor: prompt: setup slab cache for
      audit data
    - SAUCE: apparmor5.0.0 [20/57]: apparmor: prompt: add the ability for
      profiles to have a learning cache
    - SAUCE: apparmor5.0.0 [21/57]: apparmor: prompt: enable userspace upcall
      for mediation
    - SAUCE: apparmor5.0.0 [22/57]: apparmor: prompt: pass prompt boolean
      through into path_name as well
    - SAUCE: apparmor5.0.0 [23/57]: apparmor: check for supported version in
      notification messages.
    - SAUCE: apparmor5.0.0 [24/57]: apparmor: refactor building notice so it
      is easier to extend
    - SAUCE: apparmor5.0.0 [25/57]: apparmor: switch from ENOTSUPP to
      EPROTONOSUPPORT
    - SAUCE: apparmor5.0.0 [26/57]: apparmor: add support for meta data tags
    - SAUCE: apparmor5.0.0 [27/57]: apparmor: prevent profile->disconnected
      double free in aa_free_profile

  * update apparmor and LSM stacking patch set (LP: #2028253) // Installation
    of AppArmor on a 6.14 kernel produces error message "Illegal number: yes"
    (LP: #2102680)
    - SAUCE: apparmor5.0.0 [17/57]: apparmor: create an
      AA_SFS_TYPE_BOOLEAN_INTPRINT sysctl variant
    - SAUCE: apparmor5.0.0 [18/57]: apparmor: Use AA_SFS_FILE_BOOLEAN_INTPRINT
      for userns and io_uring sysctls

  * update apparmor and LSM stacking patch set (LP: #2028253) // [FFe]
    apparmor-4.0.0-alpha2 for unprivileged user namespace restrictions in
    mantic (LP: #2032602)
    - SAUCE: apparmor5.0.0 [11/57]: apparmor: userns - make it so special
      unconfined profiles can mediate user namespaces

  * Enable new Intel WCL soundwire support (LP: #2143301)
    - ASoC: sdw_utils: Add CS42L43B codec info
    - ASoC: dt-bindings: cirrus, cs42l43: Add CS42L43B variant
    - mfd: cs42l43: Add support for the B variant
    - ASoC: cs42l43: Add support for the B variant

  * Enable audio functions on Dell Huracan/Renegade platforms w/o built-in
    microphone (LP: #2143902)
    - ASoC: SDCA: Add default value for mipi-sdca-function-reset-max-delay
    - ASoC: SDCA: Update counting of SU/GE DAPM routes
    - ASoC: SDCA: Improve mapping of Q7.8 SDCA volumes
    - ASoC: SDCA: Pull the Q7.8 volume helpers out of soc-ops
    - ASoC: add snd_soc_lookup_component_by_name helper
    - ASoC: soc_sdw_utils: partial match the codec name
    - ASoC: soc_sdw_utils: remove index from sdca codec name

  * [SRU] MIPI camera is not working after upgrading to 6.17-oem
    (LP: #2145171)
    - SAUCE: ACPI: respect items already in honor_dep before skipping

  * linux-tools: consider linking perf against LLVM (LP: #2138328)
    - [Packaging] Actually enable llvm for perf

  * Pull patch in qla2xxx to Resolute  (LP: #2144856)
    - scsi: qla2xxx: Add support to report MPI FW state

  * Ubuntu Resolute Desktop image arm64 - Boot on SC8280XP stalls with gpi-dma
    errors (LP: #2142403)
    - Revert "arm64: dts: qcom: sc8280xp: Enable GPI DMA"

  * 26.04 Snapdragon X Elite: Sync concept kernel changes  (LP: #2144643)
    - SAUCE: arm64: dts: add missing denali-oled.dtb to Makefile
    - SAUCE: dt-bindings: phy: qcom: Add CSI2 C-PHY/DPHY schema
    - SAUCE: phy: qcom-mipi-csi2: Add a CSI2 MIPI DPHY driver
    - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add simple-mfd
      compatible
    - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add optional PHY handle
      definitions
    - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add support for combo-
      mode endpoints
    - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Describe iommu entries
    - SAUCE: media: qcom: camss: Add legacy_phy flag to SoC definition
      structures
    - SAUCE: media: qcom: camss: Add support for PHY API devices
    - SAUCE: media: qcom: camss: Drop legacy PHY descriptions from x1e
    - SAUCE: arm64: dts: qcom: x1e80100: Add CAMCC block definition
    - SAUCE: arm64: dts: qcom: x1e80100: Add CCI definitions
    - SAUCE: arm64: dts: qcom: x1e80100: Add CAMSS block definition
    - SAUCE: arm64: dts: qcom: x1e80100-crd: Add pm8010 CRD pmic,id=m
      regulators
    - SAUCE: arm64: dts: qcom: x1e80100-crd: Add ov08x40 RGB sensor on CSIPHY4
    - SAUCE: arm64: dts: qcom: x1e80100-t14s: Add pm8010 camera PMIC with
      voltage levels for IR and RGB camera
    - SAUCE: arm64: dts: qcom: x1e80100-t14s: Add on ov02c10 RGB sensor on
      CSIPHY4
    - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add pm8010 camera
      PMIC with voltage levels for IR and RGB camera
    - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add l7b_2p8
      voltage regulator for RGB camera
    - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add ov02c10 RGB
      sensor on CSIPHY4
    - SAUCE: arm64: dts: qcom: x1e80100-dell-inspiron14-7441: Switch on CAMSS
      RGB sensor
    - SAUCE: arm64: dts: qcom: x1-asus-zenbook-a14: Add on OV02C10 RGB sensor
      on CSIPHY4
    - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: add camera support
    - SAUCE: arm64: dts: qcom: x1e78100-t14s: enable camera privacy indicator
    - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: enable camera
      privacy indicator
    - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: enable camera privacy
      indicator
    - SAUCE: dt-bindings: arm: qcom: Add ASUS Vivobook X1P42100 variant
    - SAUCE: arm64: dts: qcom: x1-vivobook-s15: create a common dtsi for Hamoa
      and Purwa variants
    - SAUCE: arm64: dts: qcom: x1-vivobook-s15: add Purwa-compatible device
      tree
    - SAUCE: firmware: qcom: scm: allow QSEECOM on ASUS Vivobook X1P42100
      variant
    - SAUCE: arm64: dts: qcom: hamoa: Move PCIe PERST and Wake GPIOs to port
      nodes
    - SAUCE: arm64: dts: qcom: x1e-acer-swift-14: Move PCIe PERST and Wake
      GPIOs to port nodes

  * 25.10 Snapdragon X Elite: Sync concept kernel changes (LP: #2121477)
    - SAUCE: wip: arm64: dts: qcom: x1e78100-t14s: enable bluetooth

  * Miscellaneous Ubuntu changes
    - SAUCE: dt-bindings: arm: qcom: Document HP EliteBook 6 G1q
    - SAUCE: firmware: qcom: scm: Allow QSEECOM for HP EliteBook 6 G1q
    - SAUCE: arm64: dts: qcom: x1p42100-hp-elitebook-6-g1q: DT for HP
      EliteBook 6 G1q
    - [Config] PHY_QCOM_MIPI_CSI2=m
    - SAUCE: arm64: dts: x1e80100-lenovo-yoga-slim7x: Fix RGB camera supplies
    - [Config] toolchain version update
    - Update Changes.md after v7.0-rc5 rebase
    - [Packaging] update Ubuntu.md
    - [Config] enable SECURITY_APPARMOR_PACKET_MEDIATION_ENABLED
    - [Packaging] Add linux-main-modules-zfs to linux-modules depends

  * Miscellaneous upstream changes
    - Revert "UBUNTU: SAUCE: Add Bluetooth support for the Lenovo Yoga Slim
      7x"

 -- Timo Aaltonen <timo.aaltonen@canonical.com>  Thu, 02 Apr 2026 11:50:22 +0300

linux (7.0.0-10.10) resolute; urgency=medium

  * resolute/linux: 7.0.0-10.10 -proposed tracker (LP: #2144865)

  * Miscellaneous upstream changes
    - Revert "powerpc: fix KUAP warning in VMX usercopy path"

 -- Paolo Pisati <paolo.pisati@canonical.com>  Thu, 19 Mar 2026 09:44:11 +0100

linux (7.0.0-9.9) resolute; urgency=medium

  * resolute/linux: 7.0.0-9.9 -proposed tracker (LP: #2144735)

  * Please make dracut the default initrd generator (LP: #2142775)
    - [Packaging] recommends dracut instead of initramfs-tools

  * Miscellaneous Ubuntu changes
    - SAUCE: Change RISC-V target to RVA23 (riscv64a23-unknown-linux-gnu)

 -- Paolo Pisati <paolo.pisati@canonical.com>  Wed, 18 Mar 2026 13:11:06 +0100

linux (7.0.0-8.8) resolute; urgency=medium

  * resolute/linux: 7.0.0-8.8 -proposed tracker (LP: #2144652)

  * UBUNTU: SAUCE: igc: Increase Thunderbolt MAC passthrough delay to 1000ms
    (LP: #2143197)
    - SAUCE: igc: Increase Thunderbolt MAC passthrough delay to 1000ms

  * [usrmerge] evaluate kernel owned packages for DEP17 compliance
    (LP: #2139276)
    - [Packaging] Install modules in /usr/lib/modules

  * Miscellaneous Ubuntu changes
    - [Config] hardening: enable LIST_HARDENED
    - [Config] hardening: disable LDISC_AUTOLOAD
    - [Config] hardening: disable LEGACY_PTYS
    - [Config] updateconfigs following v7.0-rc4 rebase

 -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 17 Mar 2026 18:01:36 +0100

linux (7.0.0-7.7) resolute; urgency=medium

  * resolute/linux: 7.0.0-7.7 -proposed tracker (LP: #2143974)

  * unconfined profile denies userns_create for chromium based processes
    (LP: #1990064)
    - [Config] disable CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS

  * Jellyfin Desktop Flatpak doesn't work with the current AppArmor profile
    (LP: #2142956)
    - SAUCE: apparmor5.0.0 [29/29]: apparmor: fix fine grained inet mediation
      sock_file_perm

  * AppArmor blocks write(2) to network sockets with Linux 6.19 (LP: #2141298)
    - SAUCE: apparmor5.0.0 [28/29]: apparmor: fix aa_label_sk_perm to check
      for RULE_MEDIATES_NET

  * update apparmor and LSM stacking patch set (LP: #2028253)
    - SAUCE: apparmor5.0.0 [1/29]: Stacking: LSM: Single calls in secid hooks
    - SAUCE: apparmor5.0.0 [2/29]: Stacking: LSM: Exclusive secmark usage
    - SAUCE: apparmor5.0.0 [3/29]: Stacking: AppArmor: Remove the exclusive
      flag
    - SAUCE: apparmor5.0.0 [4/29]: Revert "apparmor: fix dbus permission
      queries to v9 ABI"
    - SAUCE: apparmor5.0.0 [5/29]: Revert "apparmor: gate make fine grained
      unix mediation behind v9 abi"
    - SAUCE: apparmor5.0.0 [6/29]: apparmor: net: patch to provide
      compatibility with v2.x net rules
    - SAUCE: apparmor5.0.0 [7/29]: apparmor: net: add fine grained ipv4/ipv6
      mediation
    - SAUCE: apparmor5.0.0 [8/29]: apparmor: lift compatibility check out of
      profile_af_perm
    - SAUCE: apparmor5.0.0 [9/29]: apparmor: userns: add unprivileged user ns
      mediation
    - SAUCE: apparmor5.0.0 [10/29]: apparmor: userns: Add sysctls for
      additional controls of unpriv userns restrictions
    - SAUCE: apparmor5.0.0 [12/29]: apparmor: userns: open userns related
      sysctl so lxc can check if restriction are in place
    - SAUCE: apparmor5.0.0 [13/29]: apparmor: userns: allow profile to be
      transitioned when a userns is created
    - SAUCE: apparmor5.0.0 [14/29]: apparmor: mqueue: call
      security_inode_init_security on inode creation
    - SAUCE: apparmor5.0.0 [15/29]: apparmor: mqueue: add fine grained
      mediation of posix mqueues
    - SAUCE: apparmor5.0.0 [16/29]: apparmor: uring: add io_uring mediation
    - SAUCE: apparmor5.0.0 [19/29]: apparmor: prompt: setup slab cache for
      audit data
    - SAUCE: apparmor5.0.0 [20/29]: apparmor: prompt: add the ability for
      profiles to have a learning cache
    - SAUCE: apparmor5.0.0 [21/29]: apparmor: prompt: enable userspace upcall
      for mediation
    - SAUCE: apparmor5.0.0 [22/29]: apparmor: prompt: pass prompt boolean
      through into path_name as well
    - SAUCE: apparmor5.0.0 [23/29]: apparmor: check for supported version in
      notification messages.
    - SAUCE: apparmor5.0.0 [24/29]: apparmor: refactor building notice so it
      is easier to extend
    - SAUCE: apparmor5.0.0 [25/29]: apparmor: switch from ENOTSUPP to
      EPROTONOSUPPORT
    - SAUCE: apparmor5.0.0 [26/29]: apparmor: add support for meta data tags
    - SAUCE: apparmor5.0.0 [27/29]: apparmor: prevent profile->disconnected
      double free in aa_free_profile

  * update apparmor and LSM stacking patch set (LP: #2028253) // Installation
    of AppArmor on a 6.14 kernel produces error message "Illegal number: yes"
    (LP: #2102680)
    - SAUCE: apparmor5.0.0 [17/29]: apparmor: create an
      AA_SFS_TYPE_BOOLEAN_INTPRINT sysctl variant
    - SAUCE: apparmor5.0.0 [18/29]: apparmor: Use AA_SFS_FILE_BOOLEAN_INTPRINT
      for userns and io_uring sysctls

  * update apparmor and LSM stacking patch set (LP: #2028253) // [FFe]
    apparmor-4.0.0-alpha2 for unprivileged user namespace restrictions in
    mantic (LP: #2032602)
    - SAUCE: apparmor5.0.0 [11/29]: apparmor: userns - make it so special
      unconfined profiles can mediate user namespaces

  * NPU utilization on amdxdna is missing (LP: #2143243)
    - SAUCE: accel/amdxdna: Add IOCTL to retrieve realtime NPU power estimate
    - SAUCE: accel/amdxdna: Support sensors for column utilization
    - SAUCE: accel/amdxdna: Import AMD_PMF namespace

  * Adopting dark mode by default for OLED panel (LP: #2143203)
    - SAUCE: drm/connector: Add a new 'panel_type' property
    - SAUCE: drm/amd/display: Attach OLED property to eDP panels

  * Support AMD Image Signal Processing (ISP) unit V4.0 (LP: #2110092)
    - SAUCE: media: platform: amd: Introduce amd isp4 capture driver
    - SAUCE: media: platform: amd: low level support for isp4 firmware
    - SAUCE: media: platform: amd: Add isp4 fw and hw interface
    - SAUCE: media: platform: amd: isp4 subdev and firmware loading handling
      added
    - SAUCE: media: platform: amd: isp4 video node and buffers handling added
    - SAUCE: Documentation: add documentation of AMD isp 4 driver
    - SAUCE: media: platform: amd: isp4 debug fs logging and more descriptive
      errors
    - [Config] Enable VIDEO_AMD_ISP4_CAPTURE

  * Miscellaneous Ubuntu changes
    - [Config] temporarily disable OBJTOOL_WERROR

 -- Paolo Pisati <paolo.pisati@canonical.com>  Thu, 12 Mar 2026 10:49:34 +0100

linux (7.0.0-6.6) resolute; urgency=medium

  * resolute/linux: 7.0.0-6.6 -proposed tracker (LP: #2143745)

  * Miscellaneous Ubuntu changes
    - [Packaging] drop unstable suffix

 -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 09 Mar 2026 17:20:26 +0100

linux (7.0.0-5.5) resolute; urgency=medium

  * resolute/linux-unstable: 7.0.0-5.5 -proposed tracker (LP: #2143700)

  * Resolute real-time patchset: 7.0-rc1-rt1 (LP: #2143181)
    - SAUCE: Reapply "serial: 8250: Switch to nbcon console"
    - SAUCE: Reapply "serial: 8250: Revert "drop lockdep annotation from
      serial8250_clear_IER()""
    - SAUCE: drm/i915: Use preempt_disable/enable_rt() where recommended
    - SAUCE: drm/i915: Don't disable interrupts on PREEMPT_RT during atomic
      updates
    - SAUCE: drm/i915: Disable tracing points on PREEMPT_RT
    - SAUCE: drm/i915/gt: Use spin_lock_irq() instead of local_irq_disable() +
      spin_lock()
    - SAUCE: drm/i915: Drop the irqs_disabled() check
    - SAUCE: drm/i915/guc: Consider also RCU depth in busy loop.
    - SAUCE: drm/i915: Consider RCU read section as atomic.
    - SAUCE: Revert "drm/i915: Depend on !PREEMPT_RT."
    - SAUCE: sysfs: Add /sys/kernel/realtime entry
    - Real-time patchset 7.0-rc1-rt1

  * Miscellaneous Ubuntu changes
    - [Config] rust toolchain version update

 -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 09 Mar 2026 08:10:31 +0100

linux-unstable (7.0.0-4.4) resolute; urgency=medium

  * resolute/linux-unstable: 7.0.0-4.4 -proposed tracker (LP: #2143123)

  * efi: Fix swapped arguments to bsearch() in efi_status_to_*() SAUCE patch
    (LP: #2141276)
    - SAUCE efi: Fix swapped arguments to bsearch() in efi_status_to_*()

  * Plucky preinstalled server fails to boot on rb3gen2 (LP: #2106681) //
    Questing preinstalled server fails to boot on sa8775p boards
    (LP: #2121347)
    - [Config] move more qcom interconnect/pinctrl/gcc options to builtin

  * linux-tools: consider linking perf against LLVM (LP: #2138328)
    - [Packaging] Add llvm-21-dev to build-depends for perf

  * Miscellaneous Ubuntu changes
    - [Packaging] Add intel-speed-select to linux-tools
    - [Packaging] remove stale debian/dkms-versions
    - [Packaging] remove stale debian/dkms-versions scripting

 -- Paolo Pisati <paolo.pisati@canonical.com>  Wed, 04 Mar 2026 13:59:02 +0100

linux-unstable (7.0.0-3.3) resolute; urgency=medium

  * resolute/linux-unstable: 7.0.0-3.3 -proposed tracker (LP: #2143020)

  * Miscellaneous Ubuntu changes
    - [Config] updateconfig after rebase to v7.0-rc2
    - [Config] switch to PREEMPT_LAZY

 -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 02 Mar 2026 09:26:45 +0100

linux-unstable (7.0.0-2.2) resolute; urgency=medium

  * resolute/linux-unstable: 7.0.0-2.2 -proposed tracker (LP: #2142764)

 -- Paolo Pisati <paolo.pisati@canonical.com>  Fri, 27 Feb 2026 10:25:35 +0100

linux-unstable (7.0.0-1.1) resolute; urgency=medium

  * resolute/linux-unstable: 7.0.0-1.1 -proposed tracker (LP: #2142402)

  * Miscellaneous Ubuntu changes
    - [packaging] rename to linux-unstable
    - [Config] updateconfig after rebase to v7.0-rc1
    - Update Changes.md
    - [Packaging] add libbpf-dev to Build-Depends
    - [Config] disable AMD_ISP4, FTBFS
    - [Packaging] debian.master/dkms-versions -- temporarily remove zfs FTBFS
    - [Packaging] debian.master/dkms-versions -- temporarily remove evdi FTBFS
    - [Config] updateconfig after rebase to v7.0-rc1
    - [Config] update toolchain version

 -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 23 Feb 2026 08:32:17 +0100
