{"old": "/home/jenkins/agent/workspace/multiarch/src-openeuler/aarch64/kernel/old_rpms/", "new": "/home/jenkins/agent/workspace/multiarch/src-openeuler/aarch64/kernel/new_rpms/", "compare_result": "not pass", "compare_details": {"same": {"same_details": {"old": ["python3-perf-6.6.0-145.1.19.156.oe2403sp1.aarch64.rpm", "kernel-tools-devel-6.6.0-145.1.19.156.oe2403sp1.aarch64.rpm", "kernel-headers-6.6.0-145.1.19.156.oe2403sp1.aarch64.rpm", "kernel-tools-6.6.0-145.1.19.156.oe2403sp1.aarch64.rpm", "perf-6.6.0-145.1.19.156.oe2403sp1.aarch64.rpm", "bpftool-6.6.0-145.1.19.156.oe2403sp1.aarch64.rpm"], "new": ["python3-perf-6.6.0-145.1.20.157.oe2403sp1.aarch64.rpm", "kernel-tools-devel-6.6.0-145.1.20.157.oe2403sp1.aarch64.rpm", "kernel-headers-6.6.0-145.1.20.157.oe2403sp1.aarch64.rpm", "kernel-tools-6.6.0-145.1.20.157.oe2403sp1.aarch64.rpm", "perf-6.6.0-145.1.20.157.oe2403sp1.aarch64.rpm", "bpftool-6.6.0-145.1.20.157.oe2403sp1.aarch64.rpm"]}, "same_num": 6}, "diff": {"diff_details": {"kernel-devel": {"name": {"old": "kernel-devel-6.6.0-145.1.19.156.oe2403sp1.aarch64.rpm", "new": "kernel-devel-6.6.0-145.1.20.157.oe2403sp1.aarch64.rpm"}, "RPM Level": "level3", "rpm requires": {}, "rpm provides": {}, "rpm files": {}, "rpm header": {"more": ["irq_work_types.h"]}}, "python3-perf": {"name": {"old": "python3-perf-6.6.0-145.1.19.156.oe2403sp1.aarch64.rpm", "new": "python3-perf-6.6.0-145.1.20.157.oe2403sp1.aarch64.rpm"}, "RPM Level": "level4", "rpm requires": {}, "rpm provides": {}, "rpm files": {}, "rpm lib": {}}, "kernel-tools-devel": {"name": {"old": "kernel-tools-devel-6.6.0-145.1.19.156.oe2403sp1.aarch64.rpm", "new": "kernel-tools-devel-6.6.0-145.1.20.157.oe2403sp1.aarch64.rpm"}, "RPM Level": "level4", "rpm requires": {}, "rpm provides": {}, "rpm header": {}}, "kernel": {"name": {"old": "kernel-6.6.0-145.1.19.156.oe2403sp1.aarch64.rpm", "new": "kernel-6.6.0-145.1.20.157.oe2403sp1.aarch64.rpm"}, "RPM Level": "level0", "rpm requires": {}, "rpm provides": {}, "rpm files": {}, "rpm config": {}, "kconfig": {}, "kabi": {}, "drive kabi": {}, "ko": {"diff": {"old": ["/lib/modules/6.6.0-145.1.19.156.oe2403sp1.aarch64/kernel/net/ipv4/ip_gre.ko.xz", "/lib/modules/6.6.0-145.1.19.156.oe2403sp1.aarch64/kernel/net/ipv4/netfilter/iptable_nat.ko.xz", "/lib/modules/6.6.0-145.1.19.156.oe2403sp1.aarch64/kernel/net/ipv4/netfilter/nf_nat_h323.ko.xz", "/lib/modules/6.6.0-145.1.19.156.oe2403sp1.aarch64/kernel/net/bridge/br_netfilter.ko.xz", "/lib/modules/6.6.0-145.1.19.156.oe2403sp1.aarch64/kernel/net/bridge/netfilter/ebt_dnat.ko.xz", "/lib/modules/6.6.0-145.1.19.156.oe2403sp1.aarch64/kernel/net/bridge/netfilter/ebt_redirect.ko.xz", "/lib/modules/6.6.0-145.1.19.156.oe2403sp1.aarch64/kernel/net/netfilter/nf_nat_sip.ko.xz", "/lib/modules/6.6.0-145.1.19.156.oe2403sp1.aarch64/kernel/net/netfilter/nfnetlink_queue.ko.xz", "/lib/modules/6.6.0-145.1.19.156.oe2403sp1.aarch64/kernel/net/netfilter/nfnetlink_log.ko.xz", "/lib/modules/6.6.0-145.1.19.156.oe2403sp1.aarch64/kernel/net/netfilter/nf_synproxy_core.ko.xz", "/lib/modules/6.6.0-145.1.19.156.oe2403sp1.aarch64/kernel/net/netfilter/nf_nat.ko.xz", "/lib/modules/6.6.0-145.1.19.156.oe2403sp1.aarch64/kernel/net/netfilter/ipset/ip_set.ko.xz", "/lib/modules/6.6.0-145.1.19.156.oe2403sp1.aarch64/kernel/net/netfilter/ipset/ip_set_list_set.ko.xz", "/lib/modules/6.6.0-145.1.19.156.oe2403sp1.aarch64/kernel/net/key/af_key.ko.xz", "/lib/modules/6.6.0-145.1.19.156.oe2403sp1.aarch64/kernel/net/ipv6/netfilter/ip6table_nat.ko.xz", "/lib/modules/6.6.0-145.1.19.156.oe2403sp1.aarch64/kernel/fs/mbcache.ko.xz", "/lib/modules/6.6.0-145.1.19.156.oe2403sp1.aarch64/kernel/fs/overlayfs/overlay.ko.xz", "/lib/modules/6.6.0-145.1.19.156.oe2403sp1.aarch64/kernel/fs/fuse/fuse.ko.xz", "/lib/modules/6.6.0-145.1.19.156.oe2403sp1.aarch64/kernel/fs/ext4/ext4.ko.xz", "/lib/modules/6.6.0-145.1.19.156.oe2403sp1.aarch64/kernel/drivers/net/ethernet/mellanox/mlx4/mlx4_core.ko.xz", "/lib/modules/6.6.0-145.1.19.156.oe2403sp1.aarch64/kernel/drivers/scsi/hisi_sas/hisi_sas_v3_hw.ko.xz", "/lib/modules/6.6.0-145.1.19.156.oe2403sp1.aarch64/kernel/drivers/scsi/hisi_sas/hisi_sas_v1_hw.ko.xz", "/lib/modules/6.6.0-145.1.19.156.oe2403sp1.aarch64/kernel/drivers/scsi/hisi_sas/hisi_sas_main.ko.xz", "/lib/modules/6.6.0-145.1.19.156.oe2403sp1.aarch64/kernel/drivers/scsi/hisi_sas/hisi_sas_v2_hw.ko.xz", "/lib/modules/6.6.0-145.1.19.156.oe2403sp1.aarch64/kernel/drivers/scsi/libsas/libsas.ko.xz", "/lib/modules/6.6.0-145.1.19.156.oe2403sp1.aarch64/kernel/drivers/ata/ahci_platform.ko.xz", "/lib/modules/6.6.0-145.1.19.156.oe2403sp1.aarch64/kernel/drivers/ata/ahci.ko.xz", "/lib/modules/6.6.0-145.1.19.156.oe2403sp1.aarch64/kernel/drivers/ata/libahci_platform.ko.xz", "/lib/modules/6.6.0-145.1.19.156.oe2403sp1.aarch64/kernel/drivers/ata/libahci.ko.xz", "/lib/modules/6.6.0-145.1.19.156.oe2403sp1.aarch64/kernel/drivers/ata/ahci_seattle.ko.xz", "/lib/modules/6.6.0-145.1.19.156.oe2403sp1.aarch64/kernel/drivers/ata/ata_piix.ko.xz", "/lib/modules/6.6.0-145.1.19.156.oe2403sp1.aarch64/kernel/drivers/ata/libata.ko.xz", "/lib/modules/6.6.0-145.1.19.156.oe2403sp1.aarch64/kernel/drivers/ata/ahci_xgene.ko.xz", "/lib/modules/6.6.0-145.1.19.156.oe2403sp1.aarch64/kernel/drivers/ata/ata_generic.ko.xz", "/lib/modules/6.6.0-145.1.19.156.oe2403sp1.aarch64/kernel/drivers/usb/class/cdc-acm.ko.xz", "/lib/modules/6.6.0-145.1.19.156.oe2403sp1.aarch64/kernel/drivers/usb/storage/uas.ko.xz", "/lib/modules/6.6.0-145.1.19.156.oe2403sp1.aarch64/kernel/drivers/usb/storage/usb-storage.ko.xz", "/lib/modules/6.6.0-145.1.19.156.oe2403sp1.aarch64/kernel/drivers/usb/serial/mct_u232.ko.xz", "/lib/modules/6.6.0-145.1.19.156.oe2403sp1.aarch64/kernel/drivers/usb/serial/io_edgeport.ko.xz", "/lib/modules/6.6.0-145.1.19.156.oe2403sp1.aarch64/kernel/drivers/usb/serial/keyspan.ko.xz", "/lib/modules/6.6.0-145.1.19.156.oe2403sp1.aarch64/kernel/drivers/usb/serial/option.ko.xz", "/lib/modules/6.6.0-145.1.19.156.oe2403sp1.aarch64/kernel/drivers/block/rbd.ko.xz", "/lib/modules/6.6.0-145.1.19.156.oe2403sp1.aarch64/kernel/drivers/gpu/drm/virtio/virtio-gpu.ko.xz"], "new": ["/lib/modules/6.6.0-145.1.20.157.oe2403sp1.aarch64/kernel/net/ipv4/ip_gre.ko.xz", "/lib/modules/6.6.0-145.1.20.157.oe2403sp1.aarch64/kernel/net/ipv4/netfilter/iptable_nat.ko.xz", "/lib/modules/6.6.0-145.1.20.157.oe2403sp1.aarch64/kernel/net/ipv4/netfilter/nf_nat_h323.ko.xz", "/lib/modules/6.6.0-145.1.20.157.oe2403sp1.aarch64/kernel/net/bridge/br_netfilter.ko.xz", "/lib/modules/6.6.0-145.1.20.157.oe2403sp1.aarch64/kernel/net/bridge/netfilter/ebt_dnat.ko.xz", "/lib/modules/6.6.0-145.1.20.157.oe2403sp1.aarch64/kernel/net/bridge/netfilter/ebt_redirect.ko.xz", "/lib/modules/6.6.0-145.1.20.157.oe2403sp1.aarch64/kernel/net/netfilter/nf_nat_sip.ko.xz", "/lib/modules/6.6.0-145.1.20.157.oe2403sp1.aarch64/kernel/net/netfilter/nfnetlink_queue.ko.xz", "/lib/modules/6.6.0-145.1.20.157.oe2403sp1.aarch64/kernel/net/netfilter/nfnetlink_log.ko.xz", "/lib/modules/6.6.0-145.1.20.157.oe2403sp1.aarch64/kernel/net/netfilter/nf_synproxy_core.ko.xz", "/lib/modules/6.6.0-145.1.20.157.oe2403sp1.aarch64/kernel/net/netfilter/nf_nat.ko.xz", "/lib/modules/6.6.0-145.1.20.157.oe2403sp1.aarch64/kernel/net/netfilter/ipset/ip_set.ko.xz", "/lib/modules/6.6.0-145.1.20.157.oe2403sp1.aarch64/kernel/net/netfilter/ipset/ip_set_list_set.ko.xz", "/lib/modules/6.6.0-145.1.20.157.oe2403sp1.aarch64/kernel/net/key/af_key.ko.xz", "/lib/modules/6.6.0-145.1.20.157.oe2403sp1.aarch64/kernel/net/ipv6/netfilter/ip6table_nat.ko.xz", "/lib/modules/6.6.0-145.1.20.157.oe2403sp1.aarch64/kernel/fs/mbcache.ko.xz", "/lib/modules/6.6.0-145.1.20.157.oe2403sp1.aarch64/kernel/fs/overlayfs/overlay.ko.xz", "/lib/modules/6.6.0-145.1.20.157.oe2403sp1.aarch64/kernel/fs/fuse/fuse.ko.xz", "/lib/modules/6.6.0-145.1.20.157.oe2403sp1.aarch64/kernel/fs/ext4/ext4.ko.xz", "/lib/modules/6.6.0-145.1.20.157.oe2403sp1.aarch64/kernel/drivers/net/ethernet/mellanox/mlx4/mlx4_core.ko.xz", "/lib/modules/6.6.0-145.1.20.157.oe2403sp1.aarch64/kernel/drivers/scsi/hisi_sas/hisi_sas_v3_hw.ko.xz", "/lib/modules/6.6.0-145.1.20.157.oe2403sp1.aarch64/kernel/drivers/scsi/hisi_sas/hisi_sas_v1_hw.ko.xz", "/lib/modules/6.6.0-145.1.20.157.oe2403sp1.aarch64/kernel/drivers/scsi/hisi_sas/hisi_sas_main.ko.xz", "/lib/modules/6.6.0-145.1.20.157.oe2403sp1.aarch64/kernel/drivers/scsi/hisi_sas/hisi_sas_v2_hw.ko.xz", "/lib/modules/6.6.0-145.1.20.157.oe2403sp1.aarch64/kernel/drivers/scsi/libsas/libsas.ko.xz", "/lib/modules/6.6.0-145.1.20.157.oe2403sp1.aarch64/kernel/drivers/ata/ahci_platform.ko.xz", "/lib/modules/6.6.0-145.1.20.157.oe2403sp1.aarch64/kernel/drivers/ata/ahci.ko.xz", "/lib/modules/6.6.0-145.1.20.157.oe2403sp1.aarch64/kernel/drivers/ata/libahci_platform.ko.xz", "/lib/modules/6.6.0-145.1.20.157.oe2403sp1.aarch64/kernel/drivers/ata/libahci.ko.xz", "/lib/modules/6.6.0-145.1.20.157.oe2403sp1.aarch64/kernel/drivers/ata/ahci_seattle.ko.xz", "/lib/modules/6.6.0-145.1.20.157.oe2403sp1.aarch64/kernel/drivers/ata/ata_piix.ko.xz", "/lib/modules/6.6.0-145.1.20.157.oe2403sp1.aarch64/kernel/drivers/ata/libata.ko.xz", "/lib/modules/6.6.0-145.1.20.157.oe2403sp1.aarch64/kernel/drivers/ata/ahci_xgene.ko.xz", "/lib/modules/6.6.0-145.1.20.157.oe2403sp1.aarch64/kernel/drivers/ata/ata_generic.ko.xz", "/lib/modules/6.6.0-145.1.20.157.oe2403sp1.aarch64/kernel/drivers/usb/class/cdc-acm.ko.xz", "/lib/modules/6.6.0-145.1.20.157.oe2403sp1.aarch64/kernel/drivers/usb/storage/uas.ko.xz", "/lib/modules/6.6.0-145.1.20.157.oe2403sp1.aarch64/kernel/drivers/usb/storage/usb-storage.ko.xz", "/lib/modules/6.6.0-145.1.20.157.oe2403sp1.aarch64/kernel/drivers/usb/serial/mct_u232.ko.xz", "/lib/modules/6.6.0-145.1.20.157.oe2403sp1.aarch64/kernel/drivers/usb/serial/io_edgeport.ko.xz", "/lib/modules/6.6.0-145.1.20.157.oe2403sp1.aarch64/kernel/drivers/usb/serial/keyspan.ko.xz", "/lib/modules/6.6.0-145.1.20.157.oe2403sp1.aarch64/kernel/drivers/usb/serial/option.ko.xz", "/lib/modules/6.6.0-145.1.20.157.oe2403sp1.aarch64/kernel/drivers/block/rbd.ko.xz", "/lib/modules/6.6.0-145.1.20.157.oe2403sp1.aarch64/kernel/drivers/gpu/drm/virtio/virtio-gpu.ko.xz"]}}, "drive kconfig": {}, "rpm cmd": {}, "rpm lib": {}}, "kernel-headers": {"name": {"old": "kernel-headers-6.6.0-145.1.19.156.oe2403sp1.aarch64.rpm", "new": "kernel-headers-6.6.0-145.1.20.157.oe2403sp1.aarch64.rpm"}, "RPM Level": "level4", "rpm requires": {}, "rpm provides": {}, "rpm files": {}, "rpm header": {}}, "kernel-tools": {"name": {"old": "kernel-tools-6.6.0-145.1.19.156.oe2403sp1.aarch64.rpm", "new": "kernel-tools-6.6.0-145.1.20.157.oe2403sp1.aarch64.rpm"}, "RPM Level": "level3", "rpm requires": {}, "rpm provides": {}, "rpm files": {}, "rpm service": {}, "rpm cmd": {}, "rpm lib": {}}, "kernel-source": {"name": {"old": "kernel-source-6.6.0-145.1.19.156.oe2403sp1.aarch64.rpm", "new": "kernel-source-6.6.0-145.1.20.157.oe2403sp1.aarch64.rpm"}, "RPM Level": "level4", "rpm requires": {}, "rpm provides": {}, "rpm files": {"more": ["/usr/src/linux-6.6.0-145.1.20.157.oe2403sp1.aarch64/security/landlock/errata"]}, "rpm header": {"more": ["intel_dpcd.h", "irq_work_types.h", "smbacl.h"]}}, "perf": {"name": {"old": "perf-6.6.0-145.1.19.156.oe2403sp1.aarch64.rpm", "new": "perf-6.6.0-145.1.20.157.oe2403sp1.aarch64.rpm"}, "RPM Level": "level4", "rpm requires": {}, "rpm provides": {}, "rpm files": {}, "rpm cmd": {}, "rpm lib": {}}, "bpftool": {"name": {"old": "bpftool-6.6.0-145.1.19.156.oe2403sp1.aarch64.rpm", "new": "bpftool-6.6.0-145.1.20.157.oe2403sp1.aarch64.rpm"}, "RPM Level": "level4", "rpm requires": {}, "rpm provides": {}, "rpm files": {}, "rpm cmd": {}}}, "diff_num": 3}, "less": {"less_details": {}, "less_num": 0}, "more": {"more_details": {}, "more_num": 0}}, "pr_link": "https://gitcode.com/src-openeuler/kernel/pull/2739", "pr_changelog": "* Mon Jul 27 2026 Tengda Wu <wutengda2@huawei.com> - 6.6.0-145.1.20.157\n- !25068 sync CVE LTS and bugfix from OLK-6.6 b72db20c0437 to 641f6fd78aeb\n- rbd: eliminate a race in lock_dwork draining on unmap\n- blk-cgroup: fix UAF in __blkcg_rstat_flush()\n- net: Fix kabi breakage of struct tc_action\n- net/sched: act_api: use RCU with deferred freeing for action lifecycle\n- net: Fix kabi breakage of struct header_ops\n- bonding: prevent potential infinite loop in bond_header_parse()\n- bonding: fix type confusion in bond_setup_by_slave()\n- rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc\n- ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL\n- ASoC: cs35l56: Fix missing calls to wm_adsp2_remove()\n- time: Fix off-by-one in compat settimeofday() usec validation\n- scsi: target: Fix hexadecimal CHAP_I handling\n- net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink\n- ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY\n- ksmbd: add a permission check for FSCTL_SET_ZERO_DATA\n- ksmbd: add per-handle permission check to FILE_LINK_INFORMATION\n- mptcp: fix missing wakeups in edge scenarios\n- mptcp: add-addr: always drop other suboptions\n- ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6\n- RDMA/umem: fix kernel-doc warnings\n- mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio\n- usb: typec: ucsi: Don't update power_supply on power role change if not connected\n- serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ\n- scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()\n- thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()\n- usb: typec: ucsi: Check if power role change actually happened before handling\n- usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind\n- usb: dwc3: xilinx: fix error handling in zynqmp init error paths\n- usb: musb: omap2430: Fix use-after-free in omap2430_probe()\n- tty: serial: samsung: Remove redundant port lock acquisition in rx helpers\n- tty: serial: samsung: use u32 for register interactions\n- serial: samsung_tty: Use port lock wrappers\n- ALSA: firewire-motu: Protect register DSP event queue positions\n- memfd: deny writeable mappings when implying SEAL_WRITE\n- iio: dac: ad5686: fix ref bit initialization for single-channel parts\n- usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure\n- iio: chemical: scd30: fix division by zero in write_raw\n- iio: chemical: scd30: Use guard(mutex) to allow early returns\n- iio: gyro: adis16260: fix division by zero in write_raw\n- Bluetooth: hci_qca: Convert timeout from jiffies to ms\n- Bluetooth: hci_qca: Migrate to serdev specific shutdown function\n- serdev: Provide a bustype shutdown function\n- serdev: make serdev_bus_type const\n- mm/damon/sysfs-schemes: delete tried region in regions_rmdirs()\n- mptcp: do not drop partial packets\n- mptcp: introduce the mptcp_init_skb helper\n- iio: adc: npcm: fix unbalanced clk_disable_unprepare()\n- iio: adc: npcm: Convert to platform remove callback returning void\n- octeontx2-pf: avoid double free of pool->stack on AQ init failure\n- af_unix: Fix UAF read of tail->len in unix_stream_data_wait()\n- af_unix: Cache state->msg in unix_stream_read_generic().\n- rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg\n- net: hsr: defer node table free until after RCU readers\n- mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient\n- ice: fix VF queue configuration with low MTU values\n- mptcp: reset rcv wnd on disconnect\n- mptcp: cleanup fallback dummy mapping generation\n- octeontx2-af: CGX: add bounds check to cgx_speed_mbps index\n- octeontx2-af: replace deprecated strncpy with strscpy\n- cgroup/cpuset: Reset DL migration state on can_attach() failure\n- fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros\n- soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get()\n- driver core: reject devices with unregistered buses\n- drm/amd/display: Use krealloc_array() in dal_vector_reserve()\n- drm/amdgpu: restart the CS if some parts of the VM are still invalidated\n- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11\n- drm/amdkfd: fix NULL dereference in get_queue_ids()\n- slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock\n- slimbus: qcom-ngd-ctrl: fix OF node refcount\n- thunderbolt: Limit XDomain response copy to actual frame size\n- sctp: stream: fully roll back denied add-stream state\n- mmc: sdhci: add signal voltage switch in sdhci_resume_host\n- mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC\n- mmc: litex_mmc: Set mandatory idle clocks before CMD0\n- mmc: core: Fix host controller programming for fixed driver type\n- mm/hugetlb: restore reservation on error in hugetlb folio copy paths\n- octeontx2-af: fix memory leak in rvu_setup_hw_resources()\n- nvmem: layouts: onie-tlv: fix hang on unknown types\n- net: rds: clear i_sends on setup unwind\n- net: mv643xx: fix OF node refcount\n- net/mlx5: Reorder completion before putting command entry in cmd_work_handler\n- misc: fastrpc: fix use-after-free race in fastrpc_map_create\n- misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context\n- Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard\n- i2c: tegra: Fix NOIRQ suspend/resume\n- i2c: stm32f7: fix timing computation ignoring i2c-analog-filter\n- i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()\n- pidfd: refuse access to tasks that have started exiting harder\n- ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write\n- vsock/vmci: fix sk_ack_backlog leak on failed handshake\n- wifi: nl80211: reject oversized EMA RNR lists\n- selftests: mptcp: add test for extra_subflows underflow on userspace PM\n- mptcp: sockopt: check timestamping ret value\n- mptcp: allow subflow rcv wnd to shrink\n- mptcp: close TOCTOU race while computing rcv_wnd\n- mptcp: fix retransmission loop when csum is enabled\n- ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow\n- ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O\n- ARM: socfpga: Fix OF node refcount leak in SMP setup\n- mm/damon/ops-common: call folio_test_lru() after folio_get()\n- drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info()\n- ALSA: timer: Fix UAF at snd_timer_user_params()\n- USB: serial: option: add usb-id for Dell Wireless DW5826e-m\n- xfrm: espintcp: do not reuse an in-progress partial send\n- ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL\n- mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation\n- tracing/probes: Point the error offset correctly for eprobe argument error\n- netfilter: nft_tunnel: fix use-after-free on object destroy\n- clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time\n- net: mvpp2: build skb from XDP-adjusted data on XDP_PASS\n- net: mvpp2: refill RX buffers before XDP or skb use\n- net: mvpp2: Add metadata support for xdp mode\n- netfilter: nf_log: validate MAC header was set before dumping it\n- rds: mark snapshot pages dirty in rds_info_getsockopt()\n- net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion\n- r8152: handle the return value of usb_reset_device()\n- net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove\n- net: phy: clean the sfp upstream if phy probing fails\n- net/mlx4: avoid GCC 10 __bad_copy_from() false positive\n- ASoC: wm_adsp: Fix NULL dereference when removing firmware controls\n- arm64: tlb: Allow XZR argument to TLBI ops\n- KVM: arm64: Remove VPIPT I-cache handling\n- tools/rv: Fix cleanup after failed trace setup\n- time: Fix off-by-one in settimeofday() usec validation\n- ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp\n- ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()\n- vxlan: vnifilter: fix spurious notification on VNI update\n- vxlan: vnifilter: send notification on VNI add\n- octeontx2-af: npc: Fix CPT channel mask in npc_install_flow\n- net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown\n- ptp: vclock: Switch from RCU to SRCU\n- net: fec: fix pinctrl default state restore order on resume\n- net: lan743x: permit VLAN-tagged packets up to configured MTU\n- net: garp: fix unsigned integer underflow in garp_pdu_parse_attr\n- hsr: Remove WARN_ONCE() in hsr_addr_is_self().\n- net: Annotate sk->sk_write_space() for UDP SOCKMAP.\n- pcnet32: stop holding device spin lock during napi_complete_done\n- drm/imx: Fix three kernel-doc warnings in dcss-scaler.c\n- 6lowpan: fix off-by-one in multicast context address compression\n- netfilter: xt_NFQUEUE: prefer raw_smp_processor_id\n- tee: optee: prevent use-after-free when the client exits before the supplicant\n- net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS\n- Disable -Wattribute-alias for clang-23 and newer\n- RDMA/rxe: Fix \"trying to register non-static key in rxe_qp_do_cleanup\" bug\n- USB: serial: mct_u232: fix memory corruption with small endpoint\n- usb: core: Fix SuperSpeed root hub wMaxPacketSize\n- serial: zs: Convert to use a platform device\n- serial: dz: Convert to use a platform device\n- serial: dz: Fix bootconsole handover lockup\n- xhci: tegra: Fix ghost USB device on dual-role port unplug\n- USB: serial: digi_acceleport: fix memory corruption with small endpoints\n- landlock: Fix handling of disconnected directories\n- Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync\n- USB: serial: cypress_m8: fix memory corruption with small endpoint\n- serial: zs: Switch to using channel reset\n- serial: zs: Fix bootconsole handover lockup\n- serial: dz: Fix bootconsole message clobbering at chip reset\n- drm/amdkfd: Check for pdd drm file first in CRIU restore path\n- drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger\n- drm/amdkfd: fix NULL pointer bug in svm_range_set_attr\n- serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma\n- serial: zs: Fix swapped RI/DSR modem line transition counting\n- serial: sh-sci: fix memory region release in error path\n- serial: qcom-geni: fix UART_RX_PAR_EN bit position\n- serial: altera_jtaguart: handle uart_add_one_port() failures\n- drm/amd/pm/si: Disregard vblank time when no displays are connected\n- drm/i915: Fix potential UAF in TTM object purge\n- drm/hyperv: validate VMBus packet size in receive callback\n- drm/hyperv: validate resolution_count and fix WIN8 fallback\n- scsi: target: iscsi: Validate CHAP_R length before base64 decode\n- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf\n- scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32\n- scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker\n- thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow\n- thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()\n- usb: gadget: f_fs: copy only received bytes on short ep0 read\n- usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports\n- usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling\n- usb: gadget: f_hid: fix device reference leak in hidg_alloc()\n- usb: gadget: net2280: Fix double free in probe error path\n- USB: serial: mct_u232: fix missing interrupt-in transfer sanity check\n- USB: serial: mxuport: fix memory corruption with small endpoint\n- USB: serial: keyspan: fix missing indat transfer sanity check\n- USB: serial: cypress_m8: validate interrupt packet headers\n- USB: serial: belkin_sa: validate interrupt status length\n- USB: serial: option: add MeiG SRM813Q\n- usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize\n- usb: usbtmc: check URB actual_length for interrupt-IN notifications\n- usbip: vudc: Fix use after free bug in vudc_remove due to race condition\n- usb: storage: Add quirks for PNY Elite Portable SSD\n- USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers\n- usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval\n- usb: chipidea: core: convert ci_role_switch to local variable\n- tty: serial: pch_uart: add check for dma_alloc_coherent()\n- counter: Fix refcount leak in counter_alloc() error path\n- comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest()\n- comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest()\n- Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490\n- Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem\n- Input: xpad - add support for ASUS ROG RAIKIRI II\n- Input: xpad - add \"Nova 2 Lite\" from GameSir\n- ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks\n- ASoC: qcom: q6asm-dai: close stream only when running\n- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check\n- xfrm: ah: use skb_to_full_sk in async output callbacks\n- xfrm: route MIGRATE notifications to caller's netns\n- nfc: hci: fix out-of-bounds read in HCP header parsing\n- iommu, debugobjects: avoid gcc-16.1 section mismatch warnings\n- HID: wacom: Fix OOB write in wacom_hid_set_device_mode()\n- ip6: vti: Use ip6_tnl.net in vti6_changelink().\n- xfrm: input: hold netns during deferred transport reinjection\n- ipv6: validate extension header length before copying to cmsg\n- ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().\n- ipv6: exthdrs: refresh nh after handling HAO option\n- ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params\n- ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()\n- macsec: fix replay protection at XPN lower-PN wrap\n- bpf: sockmap: fix tail fragment offset in bpf_msg_push_data\n- Input: elan_i2c - validate firmware size before use\n- usb: dwc2: Fix use after free in debug code\n- usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles\n- usb: cdns3: gadget: fix request skipping after clearing halt\n- USB: serial: omninet: fix memory corruption with small endpoint\n- iio: buffer: hw-consumer: fix use-after-free in error path\n- iio: light: cm3323: fix reg_conf not being initialized correctly\n- iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL\n- iio: temperature: tsys01: fix broken PROM checksum validation\n- iio: ssp_sensors: cancel delayed work_refresh on remove\n- iio: gyro: itg3200: fix i2c read into the wrong stack location\n- iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw\n- iio: dac: ad5686: acquire lock when doing powerdown control\n- iio: dac: ad5686: fix input raw value check\n- iio: dac: max5821: fix return value check in powerdown sync\n- iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux\n- wireguard: send: append trailer after expanding head\n- KVM: arm64: PMU: Preserve AArch32 counter low bits\n- parport: Fix race between port and client registration\n- Input: xpad - fix out-of-bounds access for Share button\n- Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock\n- Bluetooth: ISO: fix UAF in iso_recv_frame\n- Bluetooth: HIDP: fix missing length checks in hidp_input_report()\n- auxdisplay: line-display: fix OOB read on zero-length message_store()\n- hpfs: fix a crash if hpfs_map_dnode_bitmap fails\n- Bluetooth: btusb: Allow firmware re-download when version matches\n- HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse\n- Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free()\n- USB: serial: safe_serial: fix memory corruption with small endpoint\n- usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT\n- usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer()\n- usb: typec: altmodes/displayport: validate count before reading Status Update VDO\n- usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO\n- usb: typec: ucsi: ccg: reject firmware images without a ':' record header\n- iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer\n- soc/tegra: pmc: Fix unsafe generic_handle_irq() call\n- hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock\n- hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock\n- of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range()\n- phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X\n- drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used\n- drm/dp: Add eDP 1.5 bit definition\n- drm/i915/psr: Read Intel DPCD workaround register\n- drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register\n- media: rc: fix race between unregister and urb/irq callbacks\n- batman-adv: bla: avoid double decrement of bla.num_requests\n- batman-adv: tt: avoid empty VLAN responses\n- batman-adv: tt: fix TOCTOU race for reported vlans\n- batman-adv: tp_meter: directly shut down timer on cleanup\n- batman-adv: tp_meter: avoid role confusion in tp_list\n- batman-adv: iv: recover OGM scheduling after forward packet error\n- batman-adv: tvlv: reject oversized TVLV packets\n- batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface\n- batman-adv: tt: reject oversized local TVLV buffers\n- batman-adv: tvlv: abort OGM send on tvlv append failure\n- net: skbuff: fix pskb_carve leaking zcopy pages\n- ipv6: fix possible infinite loop in fib6_select_path()\n- ipv6: fix possible infinite loop in rt6_fill_node()\n- sctp: fix race between sctp_wait_for_connect and peeloff\n- net: mana: Add NULL guards in teardown path to prevent panic on attach failure\n- gpio: rockchip: convert bank->clk to devm_clk_get_enabled()\n- Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success\n- ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()\n- ethtool: eeprom: add more safeties to EEPROM Netlink fallback\n- ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback\n- bonding: refuse to enslave CAN devices\n- Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()\n- ASoC: codecs: simple-mux: Fix enum control bounds check\n- ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE\n- tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()\n- vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()\n- tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()\n- gpio: mxc: fix irq_high handling\n- net: hsr: fix potential OOB access in supervision frame handling\n- ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors\n- ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()\n- scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues\n- net/iucv: fix locking in .getsockopt\n- net/smc: Do not re-initialize smc hashtables\n- net: netlink: don't set nsid on local notifications\n- net: netlink: fix sending unassigned nsid after assigned one\n- vsock: keep poll shutdown state consistent\n- netfilter: nf_tables: fix dst corruption in same register operation\n- netfilter: bitwise: add support for doing AND, OR and XOR directly\n- netfilter: bitwise: rename some boolean operation functions\n- netfilter: ebtables: fix OOB read in compat_mtw_from_user\n- netfilter: xt_cpu: prefer raw_smp_processor_id\n- netfilter: synproxy: refresh tcphdr after skb_ensure_writable\n- xfrm: Check for underflow in xfrm_state_mtu\n- nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()\n- nfc: llcp: Fix use-after-free in llcp_sock_release()\n- net: cpsw_new: Fix potential unregister of netdev that has not been registered yet\n- drm: Remove plane hsub/vsub alignment requirement for core helpers\n- net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked\n- net: mctp: ensure our nlmsg responses are initialised\n- Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size\n- MIPS: smp: report dying CPU to RCU in stop_this_cpu()\n- LoongArch: Report dying CPU to RCU in stop_this_cpu()\n- irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT\n- tls: Flush backlog before waiting for a new record\n- net: ethernet: cortina: No mapping is a dropped rx\n- batman-adv: fix batadv_skb_is_frag() kernel-doc\n- Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled\n- Bluetooth: ISO: fix malformed ISO_END/CONT handling\n- Bluetooth: MGMT: Fix backward compatibility with userspace\n- security/keys: fix missed RCU read section on lookup\n- LoongArch: kprobes: Fix handling of fatal unrecoverable recursions\n- pds_core: ensure null-termination for firmware version strings\n- pds_core: add an error code check in pdsc_dl_info_get\n- net: mana: validate rx_req_idx to prevent out-of-bounds array access\n- ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove()\n- gpio: cdev: check if uAPI v2 config attributes are correctly zeroed\n- gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n)\n- string: add mem_is_zero() helper to check if memory area is all zeros\n- bpf, skmsg: fix verdict sk_data_ready racing with ktls rx\n- net: ag71xx: check error for platform_get_irq\n- Bluetooth: btmtk: rename btmediatek_data\n- Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset\n- Bluetooth: btmtk: add the function to get the fw name\n- ALSA: seq: Serialize UMP output teardown with event_input\n- ALSA: seq: ump: Use guard() for locking\n- pds_core: fix debugfs_lookup dentry leak and error handling\n- pds_core: fix error handling in pdsc_devcmd_wait\n- bridge: mcast: Fix a possible use-after-free when removing a bridge port\n- net: bridge: Flush multicast groups when snooping is disabled\n- RDMA/rtrs: Fix use-after-free in path file creation cleanup\n- platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL\n- platform/x86: intel-hid: Check ACPI_HANDLE() against NULL\n- platform/x86: hp_accel: Check ACPI_COMPANION() against NULL\n- platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL\n- net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer\n- net: dsa: mt7530: preserve VLAN tags on trapped link-local frames\n- net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw\n- net: dsa: mt7530: fix FDB entries not aging out with short timeout\n- wifi: ath11k: fix peer resolution on rx path when peer_id=0\n- drm/msm/snapshot: fix dumping of the unaligned regions\n- spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache()\n- net/mlx5: Do not restore destination-less TC rules\n- tls: Preserve sk_err across recvmsg() when data has been copied\n- x86/xen: Fix xen_e820_swap_entry_with_ram()\n- net: phy: DP83TC811: add reading of abilities\n- net: phy: c45: add genphy_c45_pma_read_ext_abilities() function\n- net: tls: prevent chain-after-chain in plain text SG\n- net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring\n- net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot\n- powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise()\n- drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN\n- drm/msm/dsi: don't dump registers past the mapped region\n- ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics\n- net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint\n- accel/qaic: Add overflow check to remap_pfn_range during mmap\n- HID: quirks: really enable the intended work around for appledisplay\n- wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm()\n- wifi: ath11k: fix error path leaks in some WMI WOW calls\n- net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference\n- net: ethernet: cortina: Carry over frag counter\n- net: ethernet: cortina: Drop half-assembled SKB\n- net: ethernet: cortina: Make RX SKB per-port\n- netfs: Fix overrun check in netfs_extract_user_iter()\n- zonefs: handle integer overflow in zonefs_fname_to_fno\n- irqchip/ath79-cpu: Remove unused function\n- phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access\n- net: lan966x: avoid unregistering netdev on register failure\n- ice: fix locking in ice_dcb_rebuild()\n- tcp: Fix imbalanced icsk_accept_queue count.\n- test_kprobes: clear kprobes between test runs\n- kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist()\n- netfilter: x_tables: unregister the templates first\n- ALSA: hda: cs35l56: Put ACPI device after setting companion\n- ARM: integrator: Fix early initialization\n- pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150\n- kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS\n- kunit: config: Enable KUNIT_DEBUGFS by default\n- firmware: arm_ffa: Skip free_pages on RX buffer alloc failure\n- firmware: arm_ffa: Check for NULL FF-A ID table while driver registration\n- HID: uclogic: Fix regression of input name assignment\n- hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors\n- hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe()\n- hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe()\n- hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple\n- hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR\n- hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer\n- hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer\n- hwmon: (pmbus/adm1266) reject implausible blackbox record_count\n- hwmon: (pmbus/adm1266) seed timestamp from the real-time clock\n- batman-adv: tt: fix negative tt_buff_len\n- batman-adv: tt: fix negative last_changeset_len\n- batman-adv: tp_meter: fix race condition in send error reporting\n- batman-adv: tp_meter: avoid use of uninit sender vars\n- batman-adv: bla: fix report_work leak on backbone_gw purge\n- batman-adv: frag: disallow unicast fragment in fragment\n- batman-adv: fix fragment reassembly length accounting\n- batman-adv: dat: handle forward allocation error\n- batman-adv: clear current gateway during teardown\n- batman-adv: mcast: fix use-after-free in orig_node RCU release\n- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async\n- drm/amd/display: Validate GPIO pin LUT table size before iterating\n- drm/amd/display: Fix integer overflow in bios_get_image()\n- drm/bridge: megachips: remove bridge when irq request fails\n- drm/bridge: it66121: acquire reset GPIO in probe\n- drm/virtio: use uninterruptible resv lock for plane updates\n- device property: set fwnode->secondary to NULL in fwnode_init()\n- LoongArch: Remove unused code to avoid build warning\n- RDMA/siw: Reject MPA FPDU length underflow before signed receive math\n- spi: ti-qspi: fix use-after-free after DMA setup failure\n- spi: sprd: fix error pointer deref after DMA setup failure\n- scsi: isci: Fix use-after-free in device removal path\n- phy: tegra: xusb: Fix per-pad high-speed termination calibration\n- spi: qup: fix error pointer deref after DMA setup failure\n- drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe\n- KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits\n- arm64: probes: Handle probes on hinted conditional branch instructions\n- wifi: cfg80211: advance loop vars in cfg80211_merge_profile()\n- ice: fix setting promisc mode while adding VID filter\n- ixgbevf: fix use-after-free in VEPA multicast source pruning\n- ipv4: raw: reject IP_HDRINCL packets with ihl < 5\n- wifi: ath11k: clear shared SRNG pointer state on restart\n- vsock/vmci: fix UAF when peer resets connection during handshake\n- ring-buffer: Fix reporting of missed events in iterator\n- qed: fix double free in qed_cxt_tables_alloc()\n- netfilter: ipset: stop hash:* range iteration at end\n- netfilter: nf_queue: hold bridge skb->dev while queued\n- netfilter: ip6t_hbh: reject oversized option lists\n- net: ifb: report ethtool stats over num_tx_queues\n- net: bcmgenet: keep RBUF EEE/PM disabled\n- phonet/pep: disable BH around forwarded sk_receive_skb()\n- Bluetooth: MGMT: validate Add Extended Advertising Data length\n- Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths\n- Bluetooth: bnep: Fix UAF read of dev->name\n- Bluetooth: ISO: drop ISO_END frames received without prior ISO_START\n- net: wwan: iosm: fix potential memory leaks in ipc_imem_init()\n- drivers/base/memory: fix memory block reference leak in poison accounting\n- efi: Allocate runtime workqueue before ACPI init\n- ALSA: asihpi: Fix potential OOB array access at reading cache\n- ALSA: pcm: Don't setup bogus iov_iter for silencing\n- ALSA: ua101: Reject too-short USB descriptors\n- hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX\n- smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close\n- smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked()\n- ksmbd: fix null pointer dereference in compare_guid_key()\n- mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break()\n- sysfs: don't remove existing directory on update failure\n- Revert \"af_unix: Reject SIOCATMARK on non-stream sockets\"\n- Revert \"s390/cio: Update purge function to unregister the unused subchannels\"\n- Revert \"ice: Remove jumbo_remove step from TX path\"\n- Revert \"ice: fix double-free of tx_buf skb\"\n- Revert \"x86/vdso: Fix output operand size of RDPID\"\n- wifi: mac80211: check tdls flag in ieee80211_tdls_oper\n- s390/debug: Reject zero-length input before trimming a newline\n- mptcp: pm: ADD_ADDR rtx: free sk if last\n- mptcp: sync the msk->sndbuf at accept() time\n- !24953 sync CVE LTS and bugfix from OLK-6.6 ba6ab2982f30 to b72db20c0437\n- Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close\n- netfilter: revalidate bridge ports\n- Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp\n- net: bonding: fix NULL pointer dereference in bond_do_ioctl()\n- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister\n- xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()\n- udp: clear skb->dev before running a sockmap verdict\n- crypto: nx - Fix packed layout in struct nx842_crypto_header\n- crypto: nx - Use static_assert() to check struct sizes\n- batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown\n- Revert \"ALSA: pcmtest: fix reference leak on failed device registration\"\n- media: rc: ttusbir: fix inverted error logic\n- media: rc: igorplugusb: fix control request setup packet\n- batman-adv: tp_meter: fix tp_num leak on kmalloc failure\n- batman-adv: stop tp_meter sessions during mesh teardown\n- ALSA: seq: Fix UMP group 16 filtering\n- ALSA: seq: Notify client and port info changes\n- ALSA: core: Serialize deferred fasync state checks\n- ALSA: misc: Use guard() for spin locks\n- ALSA: hda: cs35l56: Propagate ASP TX source control errors\n- crypto: nx - Avoid -Wflex-array-member-not-at-end warning\n- ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id()\n- media: rc: igorplugusb: heed coherency rules\n- ALSA: aoa: Skip devices with no codecs in i2sbus_resume()\n- media: rc: ttusbir: respect DMA coherency rules\n- ALSA: aoa: i2sbus: clear stale prepared state\n- ALSA: aoa: Use guard() for mutex locks\n- f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally\n- ksmbd: replace connection list with hash table\n- ksmbd: use msleep instaed of schedule_timeout_interruptible()\n- f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io()\n- smb: move some duplicate definitions to common/smbacl.h\n- iommu/amd: serialize sequence allocation under concurrent TLB invalidations\n- x86/shstk: Prevent deadlock during shstk sigreturn\n- ALSA: pcmtest: Fix resource leaks in module init error paths\n- ALSA: pcmtest: fix reference leak on failed device registration\n- ALSA: 6fire: Fix input volume change detection\n- ALSA: caiaq: Fix control_put() result and cache rollback\n- ALSA: core: Fix potential data race at fasync handling\n- Revert \"ALSA: usb-audio: Cap the packet size pre-calculations\"\n- ipv6: sit: reload inner IPv6 header after GSO offloads\n- net: guard timestamp cmsgs to real error queue skbs\n- ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()\n- netfilter: x_tables: avoid leaking percpu counter pointers\n- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag\n- inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush\n- netfilter: require Ethernet MAC header before using eth_hdr()\n- netfilter: nft_fib: fix stale stack leak via the OIFNAME register\n- vsock/virtio: reset connection on receiving queue overflow\n- vsock/virtio: fix skb overhead accounting to preserve full buf_alloc\n- vsock/virtio: fix potential unbounded skb queue\n- mptcp: pm: ADD_ADDR rtx: always decrease sk refcount\n- mptcp: pm: ADD_ADDR rtx: allow ID 0\n- ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers\n- srcu: Use irq_work to start GP in tiny SRCU\n- irqwork: Move data struct to a types header\n- types: move struct rcuwait into types.h\n- rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer\n- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present\n- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets\n- wifi: iwlwifi: fix 22000 series SMEM parsing\n- wifi: iwlwifi: allow IWL_FW_CHECK() with just a string\n- x86: shadow stacks: proper error handling for mmap lock\n- net: mvpp2: sync RX data at the hardware packet offset\n- net: mvpp2: limit XDP frame size to the RX buffer\n- batman-adv: fix tp_meter counter underflow during shutdown\n- batman-adv: v: stop OGMv2 on disabled interface\n- ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger\n- spi: mpc52xx: fix controller deregistration\n- thunderbolt: Bound root directory content to block size\n- selinux: fix overlayfs mmap() and mprotect() access checks\n- lsm: add backing_file LSM hooks\n- fs: constify file ptr in backing_file accessor helpers\n- fs: prepare for adding LSM blob to backing_file\n- selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs\n- bpf: Fix ld_{abs,ind} failure path analysis in subprogs\n- KVM: x86: Fix shadow paging use-after-free due to unexpected role\n- Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref\n- Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn\n- Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()\n- fix kabi for ppp_defs.h\n- pppoe: drop PFC frames\n- netfilter: nat: use kfree_rcu to release ops\n- drm/i915/gem: Fix phys BO pread/pwrite with offset\n- selinux: allow multiple opens of /sys/fs/selinux/policy\n- ksmbd: make ksmbd thread names distinct by client IP\n- ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path\n- ALSA: caiaq: Don't abort when no input device is available\n- ALSA: caiaq: fix usb_dev refcount leak on probe failure\n- ALSA: caiaq: Handle probe errors properly\n- ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow\n- USB: cdc-acm: Fix bit overlap and move quirk definitions to header\n- ALSA: caiaq: take a reference on the USB device in create_card()\n- ALSA: usb-audio: apply quirk for MOONDROP JU Jiu\n- ksmbd: use check_add_overflow() to prevent u16 DACL size overflow\n- ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment\n- smb: server: fix max_connections off-by-one in tcp accept path\n- smb: server: fix active_num_conn leak on transport allocation failure\n- usb: port: add delay after usb_hub_set_port_power()\n- USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen\n- usb: storage: Expand range of matched versions for VL817 quirks entry\n- xfrm: Wait for RCU readers during policy netns exit\n- KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying\n- Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()\n- sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing\n- mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison\n- thunderbolt: Clamp XDomain response data copy to allocation size\n- bpf: return VMA snapshot from task_vma iterator\n- bpf: switch task_vma iterator from mmap_lock to per-VMA locks\n- bpf: fix mm lifecycle in open-coded task_vma iterator\n- netfilter: nft_ct: bail out on template ct in get eval\n- drm/amd/display: Bound VBIOS record-chain walk loops\n- drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size\n- drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait()\n- netfilter: conntrack_irc: fix possible out-of-bounds read\n- drm/vc4: fix krealloc() memory leak\n- Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error\n- f2fs: fix data loss caused by incorrect use of nat_entry flag\n- bnxt_en: Fix NULL pointer dereference\n- ipv6: mcast: Fix use-after-free when processing MLD queries\n- ipvs: clear the svc scheduler ptr early on edit\n- netfilter: synproxy: add mutex to guard hook reference counting\n- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list\n- net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr\n- netlabel: validate unlabeled address and mask attribute lengths\n- netfilter: bridge: make ebt_snat ARP rewrite writable\n- tcp: restrict SO_ATTACH_FILTER to priv users\n- ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options\n- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size\n- Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER\n- Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig\n- misc: fastrpc: fix DMA address corruption due to find_vma misuse\n- misc: fastrpc: Fix NULL pointer dereference in rpmsg callback\n- gpio: mvebu: fix NULL pointer dereference in suspend/resume\n- Bluetooth: fix memory leak in error path of hci_alloc_dev()\n- Bluetooth: bnep: reject short frames before parsing\n- Bluetooth: RFCOMM: validate skb length in MCC handlers\n- Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()\n- ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams\n- RDMA/srp: bound SRP_RSP sense copy by the received length\n- IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN\n- net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure\n- sched/psi: fix race between file release and pressure write\n- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase\n- rculist: add list_splice_rcu() for private lists\n- net: skbuff: fix missing zerocopy reference in pskb_carve helpers\n- ip6_vti: set netns_immutable on the fallback device.\n- wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band()\n- wifi: rtw88: debugfs: support multiple adapters debugging\n- erofs: fix use-after-free on sbi->sync_decompress\n- net: openvswitch: fix possible kfree_skb of ERR_PTR\n- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()\n- md: wake raid456 reshape waiters before suspend\n- dm cache policy smq: check allocation under invalidate lock\n- Bluetooth: MGMT: validate advertising TLV before type checks\n- Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend\n- USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL\n- USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam\n- USB: serial: option: add support for Rolling Wireless RW135R-GL\n- USB: serial: io_edgeport: add support for Blackbox IC135A\n- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr\n- netfilter: flowtable: strictly check for maximum number of actions\n- fuse: reject fuse_notify() pagecache ops on directories\n- fs/mbcache: cancel shrink work before destroying the cache\n- smb/client: fix possible infinite loop and oob read in symlink_data()\n- fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling\n- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp\n- ata: libata-scsi: do not needlessly defer commands when using PMP with FBS\n- ata: libata-scsi: do not use the deferred QC feature on PMPs with CBS\n- ata: libata-scsi: do not use the deferred QC feature for ATA_DEFER_PORT\n- ata: libata-scsi: improve readability of ata_scsi_qc_issue()\n- ata: libata-scsi: fix requeue of deferred ATA PASS-THROUGH commands\n- ata: libata-eh: Fix detection of deferred qc timeouts\n- ata: libata: cancel pending work after clearing deferred_qc\n- ata: libata-core: fix cancellation of a port deferred qc work\n- ata: libata-scsi: rename and improve ata_qc_done()\n- ata: libata-scsi: simplify ata_scsi_requeue_deferred_qc()\n- ata: libata-sata: simplify ata_sas_queuecmd()\n- ata: libata-core: improve tag checks in ata_qc_issue()\n- ata: libata-eh: correctly handle deferred qc timeouts\n- ata: libata-scsi: avoid Non-NCQ command starvation\n- ata: libata: Introduce ata_port_eh_scheduled()\n- ext4: handle wraparound when searching for blocks for indirect mapped blocks\n- ext4: fix error pointer dereference in ext4_mb_load_buddy_gfp()\n- ext4: always allocate blocks only from groups inode can use\n- ext4: fix e4b bitmap inconsistency reports\n- ext4: convert bd_buddy_page to bd_buddy_folio\n- ext4: convert bd_bitmap_page to bd_bitmap_folio\n- Revert \"ext4: fix e4b bitmap inconsistency reports\"\n- ext4: cleanup for ext4_map_blocks\n- ext4: rename EXT4_GET_BLOCKS_PRE_IO\n- ext4: drop extent cache when splitting extent fails\n- ext4: drop extent cache after doing PARTIAL_VALID1 zeroout\n- ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O\n- ext4: correct the comments place for EXT4_EXT_MAY_ZEROOUT\n- ext4: get rid of ppath in ext4_ext_handle_unwritten_extents()\n- ext4: get rid of ppath in ext4_ext_convert_to_initialized()\n- ext4: get rid of ppath in ext4_split_convert_extents()\n- ext4: get rid of ppath in ext4_split_extent()\n- ext4: get rid of ppath in ext4_force_split_extent_at()\n- ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1\n- ext4: subdivide EXT4_EXT_DATA_VALID1\n- Revert \"ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O\"\n- ext4: get rid of ppath in ext4_split_extent_at()\n- ext4: get rid of ppath in ext4_ext_insert_extent()\n- ext4: get rid of ppath in get_ext_path()\n- ext4: add new ext4_ext_path_brelse() helper\n"}